@aurabase/aurabase-js 0.3.0 → 0.3.1

package/packages/auth/tests/is-mfa-challenge.test.ts

@@ -1,27 +0,0 @@
-// ---------------------------------------------------------------------------
-// isMfaChallenge (LOT 3, 3.4) : garde de type exportée pour discriminer
-// `LoginResponse = TokenPair | MfaChallenge` côté consommateur.
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect } from 'vitest'
-import { isMfaChallenge } from '../src/AuthService'
-
-describe('isMfaChallenge', () => {
-  it('reconnaît un MfaChallenge (mfa_required: true)', () => {
-    expect(isMfaChallenge({ mfa_required: true, mfa_token: 'tok' })).toBe(true)
-  })
-
-  it('rejette une TokenPair normale', () => {
-    expect(
-      isMfaChallenge({ access_token: 'a', refresh_token: 'b', token_type: 'bearer', expires_in: 3600 }),
-    ).toBe(false)
-  })
-
-  it('rejette les valeurs non-objet / null / mfa_required falsy', () => {
-    expect(isMfaChallenge(null)).toBe(false)
-    expect(isMfaChallenge(undefined)).toBe(false)
-    expect(isMfaChallenge('x')).toBe(false)
-    expect(isMfaChallenge({})).toBe(false)
-    expect(isMfaChallenge({ mfa_required: false })).toBe(false)
-  })
-})

package/packages/auth/tests/password-recovery.test.ts

@@ -1,124 +0,0 @@
-import { describe, it, expect, afterEach, vi } from 'vitest'
-import { AuthService } from '../src/AuthService'
-import { BaseAuthStore } from '@aurabase/core'
-import type { AuraClientLike, TokenPair, User, AuthEvent, AuthChangePayload } from '@aurabase/core'
-
-function fakeUser(id = 'u1'): User {
-  return { id, email: 't@e.com', phone: null, role: 'authenticated', email_verified: true, is_banned: false, is_anonymous: false, mfa_enabled: false, user_metadata: {}, app_metadata: {}, created_at: '2025-01-01T00:00:00Z' }
-}
-function tokenPair(): TokenPair {
-  return { access_token: 'AT', refresh_token: 'RT', token_type: 'bearer', expires_in: 3600, user: fakeUser() }
-}
-
-const VERIFIER_KEY = 'aura-proj-1-pkce-code-verifier'
-
-afterEach(() => {
-  vi.restoreAllMocks()
-  delete (globalThis as unknown as { window?: unknown }).window
-})
-
-function makeAuth(store: BaseAuthStore) {
-  const fetchFn = (async (url: string) => {
-    if (String(url).includes('/oauth/pkce')) {
-      return new Response(JSON.stringify({ data: tokenPair() }), { status: 200, headers: { 'Content-Type': 'application/json' } })
-    }
-    return new Response('{}', { status: 200 })
-  }) as unknown as typeof globalThis.fetch
-  const client: AuraClientLike = {
-    baseUrl: 'http://x', projectId: 'proj-1', apiKey: 'k', authStore: store,
-    fetchFn, auth: null as unknown as AuraClientLike['auth'],
-  }
-  const svc = new AuthService(client, { autoRefresh: false, persistSession: false })
-  ;(client as { auth: unknown }).auth = svc
-  const payloads: AuthChangePayload[] = []
-  const events: AuthEvent[] = []
-  svc.onAuthStateChange((p) => {
-    payloads.push(p)
-    events.push(p.event)
-  })
-  return { svc, client, events, payloads }
-}
-
-function setWindow(opts: { search?: string; pathname?: string }) {
-  const replaceState = vi.fn()
-  ;(globalThis as unknown as { window: unknown }).window = {
-    location: { hash: '', search: opts.search ?? '', pathname: opts.pathname ?? '/app' },
-    history: { replaceState },
-  }
-  return replaceState
-}
-
-describe('AuthService — PASSWORD_RECOVERY (lien email ?token=…&type=recovery)', () => {
-  it('?token=X&type=recovery → PASSWORD_RECOVERY émis une fois avec recoveryToken=X, PAS SIGNED_IN, PAS de session, URL nettoyée', async () => {
-    const store = new BaseAuthStore()
-    const { svc, events, payloads } = makeAuth(store)
-    const replaceState = setWindow({
-      search: '?token=RCVTOKEN&project_id=proj-1&type=recovery',
-      pathname: '/reset-password',
-    })
-
-    await svc._detectSessionInUrl()
-    // Laisser filer d'éventuels microtasks.
-    await Promise.resolve()
-
-    const recoveryPayloads = payloads.filter((p) => p.event === 'PASSWORD_RECOVERY')
-    expect(recoveryPayloads).toHaveLength(1)
-    expect(recoveryPayloads[0]!.recoveryToken).toBe('RCVTOKEN')
-    expect(recoveryPayloads[0]!.user).toBeNull()
-    expect(recoveryPayloads[0]!.accessToken).toBeNull()
-
-    // AUCUNE connexion, AUCUNE session posée.
-    expect(events).not.toContain('SIGNED_IN')
-    expect(store.token).toBeNull()
-
-    // URL nettoyée (token/project_id/type retirés).
-    expect(replaceState).toHaveBeenCalledTimes(1)
-    const cleaned = String(replaceState.mock.calls[0]![2])
-    expect(cleaned).not.toContain('token=')
-    expect(cleaned).not.toContain('project_id=')
-    expect(cleaned).not.toContain('type=')
-  })
-
-  it('?code=… normal (sans type=recovery) → SIGNED_IN, PAS PASSWORD_RECOVERY (non-régression)', async () => {
-    const store = new BaseAuthStore()
-    store.setItem(VERIFIER_KEY, 'verifier-value')
-    const { svc, events } = makeAuth(store)
-    setWindow({ search: '?code=NORMALCODE', pathname: '/cb' })
-
-    await svc._detectSessionInUrl()
-    await Promise.resolve()
-
-    expect(events).toContain('SIGNED_IN')
-    expect(events).not.toContain('PASSWORD_RECOVERY')
-    expect(store.token).toBe('AT')
-  })
-
-  it('URL sans token ni code → aucun événement, no-op', async () => {
-    const store = new BaseAuthStore()
-    const { svc, events } = makeAuth(store)
-    setWindow({ search: '?foo=bar' })
-
-    await svc._detectSessionInUrl()
-    await Promise.resolve()
-
-    expect(events).not.toContain('PASSWORD_RECOVERY')
-    expect(events).not.toContain('SIGNED_IN')
-  })
-
-  it('type=recovery sans token → ignoré (no-op, pas de PASSWORD_RECOVERY)', async () => {
-    const store = new BaseAuthStore()
-    const { svc, events } = makeAuth(store)
-    setWindow({ search: '?type=recovery' })
-
-    await svc._detectSessionInUrl()
-    await Promise.resolve()
-
-    expect(events).not.toContain('PASSWORD_RECOVERY')
-  })
-
-  it('hors navigateur → no-op, ne throw pas', async () => {
-    const store = new BaseAuthStore()
-    const { svc } = makeAuth(store)
-    await expect(svc._detectSessionInUrl()).resolves.toBeUndefined()
-  })
-})

package/packages/auth/tests/pkce.test.ts

@@ -1,192 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
-import { AuthService } from '../src/AuthService'
-import { generateCodeVerifier, codeChallengeS256 } from '../src/pkce'
-import { BaseAuthStore } from '@aurabase/core'
-import type { AuraClientLike, User, TokenPair } from '@aurabase/core'
-
-// --- helpers -----------------------------------------------------------------
-
-function fakeUser(id = 'u1'): User {
-  return {
-    id,
-    email: 't@e.com',
-    role: 'authenticated',
-    email_verified: true,
-    is_banned: false,
-    is_anonymous: false,
-    mfa_enabled: false,
-    user_metadata: {},
-    app_metadata: {},
-    created_at: '2025-01-01T00:00:00Z',
-  }
-}
-
-class FakeBC {
-  static instances: FakeBC[] = []
-  onmessage: ((e: { data: unknown }) => void) | null = null
-  posted: unknown[] = []
-  closed = false
-  constructor(public name: string) {
-    FakeBC.instances.push(this)
-  }
-  postMessage(d: unknown) {
-    this.posted.push(d)
-  }
-  close() {
-    this.closed = true
-  }
-}
-
-beforeEach(() => {
-  FakeBC.instances = []
-  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
-})
-afterEach(() => {
-  vi.useRealTimers()
-  vi.restoreAllMocks()
-  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
-})
-
-function makeAuth(
-  fetchFn: typeof globalThis.fetch = (async () =>
-    new Response('{}', { status: 200 })) as unknown as typeof globalThis.fetch,
-  store = new BaseAuthStore(),
-) {
-  const client: AuraClientLike = {
-    baseUrl: 'http://pkce.local',
-    projectId: 'proj-1',
-    apiKey: 'k',
-    fetchFn,
-    authStore: store,
-    auth: null as unknown as AuraClientLike['auth'],
-  }
-  const svc = new AuthService(client, { autoRefresh: false, persistSession: false })
-  ;(client as { auth: unknown }).auth = svc
-  return { svc, client, store }
-}
-
-const VERIFIER_KEY = 'aura-proj-1-pkce-code-verifier'
-
-// --- pkce.ts -------------------------------------------------------------------
-
-describe('generateCodeVerifier', () => {
-  it('longueur dans [43, 128] et charset base64url', () => {
-    const v = generateCodeVerifier()
-    expect(v.length).toBeGreaterThanOrEqual(43)
-    expect(v.length).toBeLessThanOrEqual(128)
-    expect(v).toMatch(/^[A-Za-z0-9\-_]+$/)
-  })
-
-  it('deux appels produisent des valeurs différentes (aléatoire)', () => {
-    const a = generateCodeVerifier()
-    const b = generateCodeVerifier()
-    expect(a).not.toBe(b)
-  })
-})
-
-describe('codeChallengeS256', () => {
-  it('vecteur connu RFC 7636 Appendix B', async () => {
-    const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'
-    const expected = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM'
-    await expect(codeChallengeS256(verifier)).resolves.toBe(expected)
-  })
-})
-
-// --- Store setItem/getItem/removeItem -------------------------------------------
-
-describe('BaseAuthStore — stockage clé/valeur générique', () => {
-  it('setItem/getItem/removeItem round-trip', () => {
-    const store = new BaseAuthStore()
-    store.setItem('k', 'v')
-    expect(store.getItem('k')).toBe('v')
-    store.removeItem('k')
-    expect(store.getItem('k')).toBeNull()
-  })
-
-  it("getItem d'une clé absente renvoie null", () => {
-    const store = new BaseAuthStore()
-    expect(store.getItem('absent')).toBeNull()
-  })
-})
-
-// --- signInWithOAuth --------------------------------------------------------------
-
-describe('AuthService.signInWithOAuth — flux PKCE opt-in', () => {
-  it("flowType: 'pkce' → URL contient code_challenge + S256, store contient le verifier, cohérence verifier↔challenge", async () => {
-    const { svc, store } = makeAuth()
-    // Pas de `window` dans l'environnement de test par défaut (node) → pas de redirect.
-    const { data, error } = await svc.signInWithOAuth('github', { flowType: 'pkce' })
-
-    expect(error).toBeNull()
-    expect(data?.url).toContain('code_challenge=')
-    expect(data?.url).toContain('code_challenge_method=S256')
-
-    const storedVerifier = store.getItem(VERIFIER_KEY)
-    expect(storedVerifier).toBeTruthy()
-
-    const url = new URL(data!.url)
-    const challengeInUrl = url.searchParams.get('code_challenge')
-    const expectedChallenge = await codeChallengeS256(storedVerifier!)
-    expect(challengeInUrl).toBe(expectedChallenge)
-  })
-
-  it('sans flowType (implicite) → aucun paramètre PKCE, store vide', async () => {
-    const { svc, store } = makeAuth()
-
-    const { data, error } = await svc.signInWithOAuth('github')
-
-    expect(error).toBeNull()
-    expect(data?.url).not.toContain('code_challenge')
-    expect(store.getItem(VERIFIER_KEY)).toBeNull()
-  })
-})
-
-// --- exchangeCodeForSession --------------------------------------------------------
-
-describe('AuthService.exchangeCodeForSession — lecture/purge du verifier stocké', () => {
-  it('sans verifier explicite → lit le verifier stocké, POST /oauth/pkce avec ce code_verifier, purge à succès', async () => {
-    const store = new BaseAuthStore()
-    store.setItem(VERIFIER_KEY, 'stored-verifier-value')
-    const tokenPair: TokenPair = {
-      access_token: 'at',
-      refresh_token: 'rt',
-      user: fakeUser(),
-    }
-    let capturedBody: unknown = null
-    const fetchFn = (async (url: string | URL | Request, init?: RequestInit) => {
-      const u = String(url)
-      if (u.includes('/oauth/pkce')) {
-        capturedBody = init?.body ? JSON.parse(String(init.body)) : null
-        return new Response(JSON.stringify({ data: tokenPair }), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      }
-      return new Response('{}', { status: 200 })
-    }) as unknown as typeof globalThis.fetch
-    const { svc } = makeAuth(fetchFn, store)
-
-    const { data, error } = await svc.exchangeCodeForSession('auth-code-1')
-
-    expect(error).toBeNull()
-    expect(data?.access_token).toBe('at')
-    expect(capturedBody).toEqual({ auth_code: 'auth-code-1', code_verifier: 'stored-verifier-value' })
-    expect(store.getItem(VERIFIER_KEY)).toBeNull()
-  })
-
-  it('sans verifier stocké ni fourni → error no_code_verifier, pas de POST', async () => {
-    const store = new BaseAuthStore()
-    let called = false
-    const fetchFn = (async () => {
-      called = true
-      return new Response('{}', { status: 200 })
-    }) as unknown as typeof globalThis.fetch
-    const { svc } = makeAuth(fetchFn, store)
-
-    const { data, error } = await svc.exchangeCodeForSession('auth-code-2')
-
-    expect(data).toBeNull()
-    expect((error as { code?: string })?.code).toBe('no_code_verifier')
-    expect(called).toBe(false)
-  })
-})

package/packages/auth/tests/session-manager.test.ts

@@ -1,103 +0,0 @@
-import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest'
-import { SessionManager, type SessionManagerOptions } from '../src/SessionManager'
-
-// Mock minimal de BroadcastChannel
-class FakeBC {
-  static instances: FakeBC[] = []
-  onmessage: ((e: { data: unknown }) => void) | null = null
-  posted: unknown[] = []
-  closed = false
-  constructor(public name: string) {
-    FakeBC.instances.push(this)
-  }
-  postMessage(d: unknown) {
-    this.posted.push(d)
-  }
-  close() {
-    this.closed = true
-  }
-}
-
-beforeEach(() => {
-  FakeBC.instances = []
-  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
-})
-afterEach(() => {
-  vi.useRealTimers()
-  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
-})
-
-function make(overrides: Partial<SessionManagerOptions> = {}) {
-  const onTick = vi.fn()
-  let due = true
-  const onRemoteMessage = vi.fn()
-  const sm = new SessionManager({
-    channelName: 'aura-p-auth',
-    enabled: true,
-    onTick,
-    isRefreshDue: () => due,
-    onRemoteMessage,
-    tickMs: 1000,
-    ...overrides,
-  })
-  return { sm, onTick, onRemoteMessage, setDue: (v: boolean) => { due = v } }
-}
-
-describe('SessionManager', () => {
-  it('tick appelle onTick quand refresh dû, pas sinon', () => {
-    vi.useFakeTimers()
-    const { sm, onTick, setDue } = make()
-    sm.start()
-    sm.setActive(true)
-    vi.advanceTimersByTime(1000)
-    expect(onTick).toHaveBeenCalledTimes(1)
-    setDue(false)
-    vi.advanceTimersByTime(1000)
-    expect(onTick).toHaveBeenCalledTimes(1)
-  })
-
-  it('inactif → aucun tick', () => {
-    vi.useFakeTimers()
-    const { sm, onTick } = make()
-    sm.start()
-    sm.setActive(false)
-    vi.advanceTimersByTime(5000)
-    expect(onTick).not.toHaveBeenCalled()
-  })
-
-  it('broadcast poste sur le canal', () => {
-    const { sm } = make()
-    sm.start()
-    sm.broadcast({ hello: 1 })
-    expect(FakeBC.instances[0].posted).toEqual([{ hello: 1 }])
-  })
-
-  it('réception → onRemoteMessage', () => {
-    const { sm, onRemoteMessage } = make()
-    sm.start()
-    FakeBC.instances[0].onmessage!({ data: { x: 2 } })
-    expect(onRemoteMessage).toHaveBeenCalledWith({ x: 2 })
-  })
-
-  it('stop() coupe tout (canal fermé, plus de tick)', () => {
-    vi.useFakeTimers()
-    const { sm, onTick } = make()
-    sm.start()
-    sm.setActive(true)
-    sm.stop()
-    vi.advanceTimersByTime(5000)
-    expect(onTick).not.toHaveBeenCalled()
-    expect(FakeBC.instances[0].closed).toBe(true)
-    expect(sm.isActive).toBe(false)
-  })
-
-  it('enabled=false → pas de canal, pas de tick', () => {
-    vi.useFakeTimers()
-    const { sm, onTick } = make({ enabled: false })
-    sm.start()
-    sm.setActive(true)
-    vi.advanceTimersByTime(5000)
-    expect(onTick).not.toHaveBeenCalled()
-    expect(FakeBC.instances.length).toBe(0)
-  })
-})

package/packages/auth/tests/set-session.test.ts

@@ -1,139 +0,0 @@
-import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest'
-import { AuthService } from '../src/AuthService'
-import { BaseAuthStore, AuraError } from '@aurabase/core'
-import type { AuraClientLike, User } from '@aurabase/core'
-
-// --- helpers -----------------------------------------------------------------
-function b64url(obj: unknown): string {
-  return btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
-}
-/** JWT non expiré (paramétrable pour obtenir des tokens distincts). */
-function jwt(sub = 'u1', ttlSec = 3600): string {
-  const exp = Math.floor(Date.now() / 1000) + ttlSec
-  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub, exp })}.sig`
-}
-/** JWT déjà expiré. */
-function expiredJwt(sub = 'u1'): string {
-  const exp = Math.floor(Date.now() / 1000) - 60
-  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub, exp })}.sig`
-}
-function fakeUser(id = 'u1'): User {
-  return {
-    id, email: 't@e.com', role: 'authenticated', email_verified: true,
-    is_banned: false, is_anonymous: false, mfa_enabled: false,
-    user_metadata: {}, app_metadata: {}, created_at: '2025-01-01T00:00:00Z',
-  }
-}
-
-class FakeBC {
-  static instances: FakeBC[] = []
-  onmessage: ((e: { data: unknown }) => void) | null = null
-  posted: unknown[] = []
-  closed = false
-  constructor(public name: string) { FakeBC.instances.push(this) }
-  postMessage(d: unknown) { this.posted.push(d) }
-  close() { this.closed = true }
-}
-
-beforeEach(() => {
-  FakeBC.instances = []
-  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
-})
-afterEach(() => {
-  vi.useRealTimers()
-  vi.restoreAllMocks()
-  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
-})
-
-function newAuth(store: BaseAuthStore, fetchFn?: typeof globalThis.fetch) {
-  const client: AuraClientLike = {
-    baseUrl: 'http://x', projectId: 'p', apiKey: 'k',
-    fetchFn: (fetchFn ?? (async () => new Response('{}', { status: 200 }))) as unknown as typeof globalThis.fetch,
-    authStore: store,
-    auth: null as unknown as AuraClientLike['auth'],
-  }
-  const svc = new AuthService(client, { autoRefresh: true, persistSession: true, forceEnabled: true })
-  ;(client as { auth: unknown }).auth = svc
-  return { svc, client }
-}
-
-describe('AuthService.setSession — rollback + validation', () => {
-  it("échec de validation (/user KO) et aucune session préalable ⇒ store PURGÉ (pas de pollution)", async () => {
-    const store = new BaseAuthStore()
-    const { svc } = newAuth(store)
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    vi.spyOn(svc as any, 'request').mockResolvedValue({
-      data: null,
-      error: new AuraError(401, { error: { code: 'unauthorized', message: 'bad token' } }),
-    })
-
-    const res = await svc.setSession(jwt(), 'rt-bad')
-
-    expect(res.error).toBeTruthy()
-    expect(res.data).toBeNull()
-    // Le bug : sans rollback, token+refreshToken restaient posés avec user {}.
-    expect(store.token).toBeNull()
-    expect(store.refreshToken).toBeNull()
-    expect(store.user).toBeNull()
-    expect(store.isValid).toBe(false)
-  })
-
-  it('validation OK ⇒ session complète + SIGNED_IN', async () => {
-    const store = new BaseAuthStore()
-    const { svc } = newAuth(store)
-    const token = jwt()
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    vi.spyOn(svc as any, 'request').mockResolvedValue({ data: fakeUser(), error: null })
-    const events: string[] = []
-    svc.onAuthStateChange(({ event }) => { if (event !== 'INITIAL_SESSION') events.push(event) })
-
-    const res = await svc.setSession(token, 'rt')
-
-    expect(res.data?.id).toBe('u1')
-    expect(store.token).toBe(token)
-    expect(store.user?.id).toBe('u1')
-    expect(events).toContain('SIGNED_IN')
-  })
-
-  it('échec de validation avec session préalable VALIDE ⇒ restauration de l’ancienne session', async () => {
-    const store = new BaseAuthStore()
-    const oldToken = jwt('old')
-    store.save(oldToken, 'rt-old', fakeUser('old'))
-    const { svc } = newAuth(store)
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    vi.spyOn(svc as any, 'request').mockResolvedValue({
-      data: null,
-      error: new AuraError(404, { error: { code: 'not_found', message: 'user gone' } }),
-    })
-
-    const res = await svc.setSession(jwt('new'), 'rt-new')
-
-    expect(res.error).toBeTruthy()
-    // L'ancienne session valide doit être intacte (pas écrasée par le token invalide).
-    expect(store.token).toBe(oldToken)
-    expect(store.refreshToken).toBe('rt-old')
-    expect(store.user?.id).toBe('old')
-  })
-
-  it('access token DÉJÀ expiré ⇒ refresh via le refresh token (parité Supabase)', async () => {
-    const store = new BaseAuthStore()
-    const tokenPair = { access_token: jwt('u1'), refresh_token: 'rt-fresh', user: fakeUser() }
-    const fetchFn = (async (url: string) => {
-      if (String(url).endsWith('/refresh')) {
-        return new Response(JSON.stringify({ data: tokenPair }), { status: 200 })
-      }
-      return new Response('{}', { status: 200 })
-    }) as unknown as typeof globalThis.fetch
-    const { svc } = newAuth(store, fetchFn)
-    const events: string[] = []
-    svc.onAuthStateChange(({ event }) => { if (event !== 'INITIAL_SESSION') events.push(event) })
-
-    const res = await svc.setSession(expiredJwt(), 'rt-provided')
-
-    expect(res.data?.id).toBe('u1')
-    // Le store porte les tokens RAFRAÎCHIS, pas le token expiré fourni.
-    expect(store.token).toBe(tokenPair.access_token)
-    expect(store.refreshToken).toBe('rt-fresh')
-    expect(events).toContain('SIGNED_IN')
-  })
-})