@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/aurabase/tests/production-robustness.test.ts

@@ -1,268 +0,0 @@
-import { describe, it, expect, beforeAll, afterAll } from 'vitest'
-import { createClient } from '../src/index'
-
-const GATEWAY_URL = 'http://localhost:8080'
-const MGMT_URL = 'http://localhost:8090'
-
-describe('Tests de robustesse de production E2E (Multi-tenant, Transactions, Injection, Concurrence)', () => {
-  let devToken: string
-  let projectId: string
-  let anonKey: string
-  let serviceKey: string
-  
-  const runId = Math.random().toString(36).substring(2, 10)
-  const devEmail = `robustness-dev-${runId}@aurabase.dev`
-  const devPassword = 'RobustPasswordE2E123!'
-  const projectName = `robustness-proj-${runId}`
-  
-  const endUserEmail = `enduser-${runId}@example.com`
-  const endUserPassword = 'EndUserPassword123!'
-
-  beforeAll(async () => {
-    // 1. Enregistrement développeur
-    const regRes = await fetch(`${MGMT_URL}/v1/control/accounts/register`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ email: devEmail, password: devPassword }),
-    })
-    expect(regRes.status).toBe(200)
-    const regData = await regRes.json()
-    devToken = regData.data.access_token
-
-    // 2. Création organisation
-    const orgRes = await fetch(`${MGMT_URL}/v1/control/orgs`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${devToken}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({ name: 'Robustness Org', slug: `robust-org-${runId}` }),
-    })
-    expect(orgRes.status).toBeLessThan(300)
-    const orgData = await orgRes.json()
-    const orgId = orgData.id
-
-    // 3. Création projet
-    const projRes = await fetch(`${MGMT_URL}/v1/control/orgs/${orgId}/projects`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${devToken}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({ name: projectName, engine: 'postgres', region: 'eu-west-1' }),
-    })
-    expect(projRes.status).toBe(202)
-    const projData = await projRes.json()
-    projectId = projData.id
-
-    // Attente du provisioning
-    let active = false
-    for (let i = 0; i < 50; i++) {
-      const statusRes = await fetch(`${MGMT_URL}/v1/control/projects/${projectId}`, {
-        headers: { 'Authorization': `Bearer ${devToken}` },
-      })
-      const statusData = await statusRes.json()
-      if (statusData && statusData.status === 'active') {
-        active = true
-        break
-      }
-      await new Promise((resolve) => setTimeout(resolve, 1500))
-    }
-    expect(active).toBe(true)
-
-    // Récupération clés API (avec retry)
-    let keysRes: Response | null = null
-    for (let i = 0; i < 15; i++) {
-      keysRes = await fetch(`${MGMT_URL}/v1/control/projects/${projectId}/initial-keys`, {
-        headers: { 'Authorization': `Bearer ${devToken}` },
-      })
-      if (keysRes.status === 200) {
-        break
-      }
-      await new Promise((resolve) => setTimeout(resolve, 1000))
-    }
-    expect(keysRes).not.toBeNull()
-    expect(keysRes!.status).toBe(200)
-    const keysData = await keysRes!.json()
-    const keys = keysData.data || keysData
-    anonKey = keys.find((k: any) => k.scope === 'anon').key
-    serviceKey = keys.find((k: any) => k.scope === 'service_role').key
-
-    // 4. Création de la table 'tasks' avec RLS active
-    const tableDef = {
-      name: 'tasks',
-      columns: [
-        {
-          name: 'id',
-          col_type: 'uuid',
-          nullable: false,
-          unique: true,
-          default_val: 'gen_random_uuid()',
-          references: null
-        },
-        {
-          name: 'title',
-          col_type: 'text',
-          nullable: false,
-          unique: false,
-          default_val: null,
-          references: null
-        },
-        {
-          name: 'owner_id',
-          col_type: 'text',
-          nullable: false,
-          unique: false,
-          default_val: null,
-          references: null
-        }
-      ],
-      primary_key: 'id',
-      indexes: [],
-      rls_enabled: true,
-      realtime_enabled: true
-    }
-
-    const tableRes = await fetch(`${MGMT_URL}/v1/db/${projectId}/schema/tables`, {
-      method: 'POST',
-      headers: {
-        'Authorization': `Bearer ${devToken}`,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify(tableDef),
-    })
-    expect(tableRes.status).toBe(200)
-
-    // Attendre l'indexation PostgREST
-    let ready = false
-    for (let i = 0; i < 30; i++) {
-      const probeRes = await fetch(`${GATEWAY_URL}/v1/db/${projectId}/tasks`, {
-        headers: { 'apikey': anonKey },
-      })
-      if (probeRes.status === 200) {
-        ready = true
-        break
-      }
-      await new Promise((resolve) => setTimeout(resolve, 1500))
-    }
-    expect(ready).toBe(true)
-
-    // Attendre 3 secondes que PostgREST stabilise son cache après les DDL de setup
-    await new Promise((resolve) => setTimeout(resolve, 3000))
-  }, 60000)
-
-  afterAll(async () => {
-    // Suppression propre
-    if (projectId && devToken) {
-      const delRes = await fetch(`${MGMT_URL}/v1/control/projects/${projectId}`, {
-        method: 'DELETE',
-        headers: { 'Authorization': `Bearer ${devToken}` },
-      })
-      expect(delRes.status).toBe(204)
-    }
-  })
-
-  it('devrait exécuter des requêtes avec EXPLAIN ANALYZE', async () => {
-    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
-      auth: { persistSession: false },
-    })
-
-    const explainRes = await client.db.sql<any[]>('EXPLAIN ANALYZE SELECT * FROM tasks')
-    expect(explainRes.error).toBeNull()
-    expect(explainRes.data).toBeDefined()
-    expect(explainRes.data!.length).toBeGreaterThan(0)
-    
-    // Vérifier la présence d'éléments typiques d'un plan d'exécution
-    const planText = JSON.stringify(explainRes.data)
-    expect(planText).toMatch(/Plan|Scan/i)
-  })
-
-  it('devrait empêcher le contournement d\'isolation multi-tenant (Lecture inter-schéma)', async () => {
-    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
-      auth: { persistSession: false },
-    })
-
-    // Tenter de lire un schéma d'un autre tenant inexistant ou existant (ex: project_autre_tenant)
-    // Devrait être rejeté avec une erreur 400 (BAD REQUEST) par Axum avant d'exécuter le SQL
-    const foreignSchemaRes = await client.db.sql('SELECT * FROM project_00000000_0000_0000_0000_000000000000.tasks')
-    expect(foreignSchemaRes.error).not.toBeNull()
-    expect(foreignSchemaRes.error?.code).toBe('BAD_REQUEST')
-    expect(foreignSchemaRes.error?.message).toContain('interdite')
-  })
-
-  it('devrait garantir la sécurité face aux injections SQL', async () => {
-    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
-      auth: { persistSession: false },
-    })
-
-    // Tentative d'injection SQL via filtre
-    const maliciosQueryRes = await client.db
-      .from('tasks')
-      .eq('title', "'; DROP TABLE tasks; --")
-      .select('*')
-
-    expect(maliciosQueryRes.error).toBeNull() // Sûr grâce à la paramétrisation PostgREST
-
-    // Vérifier que la table 'tasks' existe toujours
-    const probeRes = await client.db.from('tasks').select('*')
-    expect(probeRes.error).toBeNull()
-  })
-
-  it('devrait exécuter des requêtes concurrentes saines (saturation de charge)', async () => {
-    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
-      auth: { persistSession: false },
-    })
-
-    const requests = Array.from({ length: 50 }).map((_, idx) =>
-      client.db.from('tasks').insert({
-        title: `Tâche concurrente ${idx}`,
-        owner_id: `owner_${idx}`,
-      })
-    )
-
-    const startTime = performance.now()
-    const results = await Promise.all(requests)
-    const duration = performance.now() - startTime
-
-    console.log(`[PERF] 50 requêtes concurrentes d'insertion exécutées en ${duration.toFixed(1)}ms`)
-
-    // Vérifier que toutes les requêtes ont réussi
-    for (const r of results) {
-      expect(r.error).toBeNull()
-    }
-
-    // Vérifier que 50 lignes ont bien été insérées
-    const selectRes = await client.db.from('tasks').select('*')
-    expect(selectRes.data?.length).toBe(50)
-  })
-
-  it('devrait gérer proprement les transactions SQL brutes (Commit & Rollback)', async () => {
-    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
-      auth: { persistSession: false },
-    })
-
-    // 1. Test du ROLLBACK : exécuter BEGIN, INSERT et ROLLBACK dans un seul bloc multi-statement
-    const txRollbackRes = await client.db.sql(
-      `BEGIN;
-       INSERT INTO tasks (title, owner_id) VALUES ('Task Tx Rollback', 'owner_tx');
-       ROLLBACK;`
-    )
-    expect(txRollbackRes.error).toBeNull()
-
-    // La ligne ne doit pas exister dans la base
-    const selectPostRollback = await client.db.from('tasks').eq('title', 'Task Tx Rollback')
-    expect(selectPostRollback.data?.length).toBe(0)
-
-    // 2. Test du COMMIT : exécuter BEGIN, INSERT et COMMIT dans un seul bloc
-    const txCommitRes = await client.db.sql(
-      `BEGIN;
-       INSERT INTO tasks (title, owner_id) VALUES ('Task Tx Commit', 'owner_tx');
-       COMMIT;`
-    )
-    expect(txCommitRes.error).toBeNull()
-
-    // La ligne doit exister
-    const selectPostCommit = await client.db.from('tasks').eq('title', 'Task Tx Commit')
-    expect(selectPostCommit.data?.length).toBe(1)
-  })
-})

package/packages/aurabase/tests/public-api-surface.test.ts

@@ -1,53 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import * as root from '../src/index'
-import * as ssr from '../src/ssr'
-
-describe('surface publique du meta-package aurabase', () => {
-  it('exporte exactement les symboles runtime attendus depuis la racine', () => {
-    const actual = Object.keys(root).sort()
-    const expected = [
-      'AiService',
-      'AuraChannel',
-      'AuraClient',
-      'AuraError',
-      'AuthAdminService',
-      'AuthService',
-      'BaseAuthStore',
-      'DatabaseService',
-      'FunctionsService',
-      'LocalAuthStore',
-      'NotificationsService',
-      'NotificationsAdminService',
-      'QueryBuilder',
-      'RealtimeService',
-      'StorageService',
-      'createAdminClient',
-      'createClient',
-      'isAuraError',
-      'isMfaChallenge',
-    ].sort()
-    expect(actual).toEqual(expected)
-  })
-
-  it('createClient fabrique un AuraClient fonctionnel', () => {
-    const client = root.createClient('http://localhost:8080', 'proj-1', 'aura_anon_x')
-    expect(client).toBeInstanceOf(root.AuraClient)
-    expect(client.baseUrl).toBe('http://localhost:8080')
-    expect(client.projectId).toBe('proj-1')
-    // sous-clients accessibles
-    expect(client.auth).toBeInstanceOf(root.AuthService)
-    expect(client.db).toBeInstanceOf(root.DatabaseService)
-    expect(client.storage).toBeInstanceOf(root.StorageService)
-    expect(client.functions).toBeInstanceOf(root.FunctionsService)
-    expect(client.ai).toBeInstanceOf(root.AiService)
-    expect(client.notifications).toBeInstanceOf(root.NotificationsService)
-    expect(client.realtime).toBeInstanceOf(root.RealtimeService)
-  })
-
-  it('exporte les helpers SSR', () => {
-    const actual = Object.keys(ssr).sort()
-    expect(actual).toEqual(
-      ['createBrowserClient', 'createServerClient', 'parseCookieHeader', 'serializeCookieHeader'].sort(),
-    )
-  })
-})

package/packages/aurabase/tests/query-builder.test.ts

@@ -1,329 +0,0 @@
-// ---------------------------------------------------------------------------
-// QueryBuilder tests -- verify query string compilation for all operators
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { AuraClient } from '../src/AuraClient'
-import { QueryBuilder } from '@aurabase/db'
-import { FetchMock, fakeTokenPair } from './mocks'
-
-const BASE = 'http://localhost:8080'
-const PROJECT = 'test-project'
-
-let fetchMock: FetchMock
-let client: AuraClient
-
-beforeEach(() => {
-  fetchMock = new FetchMock()
-  fetchMock.init()
-  client = new AuraClient(BASE, PROJECT, {
-    auth: { persistSession: false },
-  })
-  // Pre-populate auth so fetchWithAuth does not try to refresh
-  const tp = fakeTokenPair()
-  client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
-})
-
-afterEach(() => {
-  fetchMock.restore()
-  fetchMock.clearMocks()
-})
-
-/** Helper: build a QueryBuilder for a table and return its query string. */
-function qs(configure: (qb: QueryBuilder) => void): string {
-  const qb = new QueryBuilder(client, `/v1/db/${PROJECT}/posts`)
-  configure(qb)
-  return qb.buildQueryString()
-}
-
-// ---------------------------------------------------------------------------
-// Filter operators
-// ---------------------------------------------------------------------------
-
-describe('QueryBuilder filters', () => {
-  it('eq produces col=eq.val', () => {
-    const q = qs((qb) => qb.eq('status', 'active'))
-    expect(q).toContain('status=eq.active')
-  })
-
-  it('neq produces col=neq.val', () => {
-    const q = qs((qb) => qb.neq('status', 'deleted'))
-    expect(q).toContain('status=neq.deleted')
-  })
-
-  it('gt produces col=gt.val', () => {
-    const q = qs((qb) => qb.gt('age', 18))
-    expect(q).toContain('age=gt.18')
-  })
-
-  it('gte produces col=gte.val', () => {
-    const q = qs((qb) => qb.gte('score', 90))
-    expect(q).toContain('score=gte.90')
-  })
-
-  it('lt produces col=lt.val', () => {
-    const q = qs((qb) => qb.lt('price', 100))
-    expect(q).toContain('price=lt.100')
-  })
-
-  it('lte produces col=lte.val', () => {
-    const q = qs((qb) => qb.lte('price', 50))
-    expect(q).toContain('price=lte.50')
-  })
-
-  it('in produces col=in.(a,b,c)', () => {
-    const q = qs((qb) => qb.in('id', [1, 2, 3]))
-    expect(q).toContain('id=in.%281%2C2%2C3%29')
-    // Decoded: id=in.(1,2,3)
-    expect(decodeURIComponent(q)).toContain('id=in.(1,2,3)')
-  })
-
-  it('like produces col=like.pattern', () => {
-    const q = qs((qb) => qb.like('name', '%john%'))
-    expect(decodeURIComponent(q)).toContain('name=like.%john%')
-  })
-
-  it('ilike produces col=ilike.pattern', () => {
-    const q = qs((qb) => qb.ilike('name', '%JOHN%'))
-    expect(decodeURIComponent(q)).toContain('name=ilike.%JOHN%')
-  })
-
-  it('is(col, null) produces col=is.null', () => {
-    const q = qs((qb) => qb.is('deleted_at', 'null'))
-    expect(q).toContain('deleted_at=is.null')
-  })
-
-  it('is(col, not_null) produces col=is.not_null', () => {
-    const q = qs((qb) => qb.is('email', 'not_null'))
-    expect(q).toContain('email=is.not_null')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// OR groups
-// ---------------------------------------------------------------------------
-
-describe('QueryBuilder or()', () => {
-  it('produces or=(col1.eq.val1,col2.gt.val2)', () => {
-    const q = qs((qb) =>
-      qb.or([
-        { column: 'status', op: 'eq', value: 'active' },
-        { column: 'priority', op: 'gt', value: 5 },
-      ]),
-    )
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('or=(status.eq.active,priority.gt.5)')
-  })
-
-  it('supports in operator inside or group', () => {
-    const q = qs((qb) =>
-      qb.or([{ column: 'id', op: 'in', value: [1, 2] }]),
-    )
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('or=(id.in.(1,2))')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// Select
-// ---------------------------------------------------------------------------
-
-describe('QueryBuilder select()', () => {
-  it('select("id, title") compiles to select=id,title', () => {
-    const q = qs((qb) => qb.select('id, title'))
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('select=id,title')
-  })
-
-  it('select(["id","title"]) works the same', () => {
-    const q = qs((qb) => qb.select(['id', 'title']))
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('select=id,title')
-  })
-
-  it('select("*") omits the select param', () => {
-    const q = qs((qb) => qb.select('*'))
-    expect(q).not.toContain('select=')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// Order / Pagination
-// ---------------------------------------------------------------------------
-
-describe('QueryBuilder order / limit / offset', () => {
-  it('order("created_at", "desc") produces sort_by + sort_order', () => {
-    const q = qs((qb) => qb.order('created_at', 'desc'))
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('sort_by=created_at')
-    expect(decoded).toContain('sort_order=desc')
-  })
-
-  it('limit(10).offset(20) produces limit=10&offset=20', () => {
-    const q = qs((qb) => qb.limit(10).offset(20))
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('limit=10')
-    expect(decoded).toContain('offset=20')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// Count
-// ---------------------------------------------------------------------------
-
-describe('QueryBuilder count()', () => {
-  it('count("exact") adds count=exact', () => {
-    const q = qs((qb) => qb.count('exact'))
-    expect(q).toContain('count=exact')
-  })
-
-  it('count("estimated") adds count=estimated', () => {
-    const q = qs((qb) => qb.count('estimated'))
-    expect(q).toContain('count=estimated')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// single() and throwOnError()
-// ---------------------------------------------------------------------------
-
-describe('QueryBuilder single()', () => {
-  it('sets limit to 1 and unwraps the first element', async () => {
-    const rows = [{ id: '1', title: 'Hello' }]
-    fetchMock.on({
-      method: 'GET',
-      url: /\/posts\?/,
-      replyCode: 200,
-      replyBody: { data: rows },
-    })
-
-    const res = await client.db.from('posts').eq('id', '1').single()
-
-    expect(res.data).toEqual({ id: '1', title: 'Hello' })
-  })
-
-  it('returns null when array is empty', async () => {
-    fetchMock.on({
-      method: 'GET',
-      url: /\/posts\?/,
-      replyCode: 200,
-      replyBody: { data: [] },
-    })
-
-    const res = await client.db.from('posts').eq('id', 'nonexistent').single()
-
-    expect(res.data).toBeNull()
-  })
-})
-
-describe('QueryBuilder throwOnError()', () => {
-  it('throws an error when response has error', async () => {
-    fetchMock.on({
-      method: 'GET',
-      url: /\/posts/,
-      replyCode: 500,
-      replyBody: { error: { code: 'internal', message: 'DB down' } },
-    })
-
-    await expect(
-      client.db.from('posts').throwOnError(),
-    ).rejects.toThrow('DB down')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// Chained combinations
-// ---------------------------------------------------------------------------
-
-describe('QueryBuilder chained combinations', () => {
-  it('combines select + filters + order + pagination', () => {
-    const q = qs((qb) =>
-      qb
-        .select('id, title, created_at')
-        .eq('published', true)
-        .gt('views', 100)
-        .order('created_at', 'desc')
-        .limit(10)
-        .offset(0),
-    )
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('select=id,title,created_at')
-    expect(decoded).toContain('published=eq.true')
-    expect(decoded).toContain('views=gt.100')
-    expect(decoded).toContain('sort_by=created_at')
-    expect(decoded).toContain('sort_order=desc')
-    expect(decoded).toContain('limit=10')
-    expect(decoded).toContain('offset=0')
-  })
-
-  it('combines multiple filters with or group', () => {
-    const q = qs((qb) =>
-      qb
-        .eq('type', 'post')
-        .or([
-          { column: 'status', op: 'eq', value: 'published' },
-          { column: 'status', op: 'eq', value: 'draft' },
-        ]),
-    )
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('type=eq.post')
-    expect(decoded).toContain('or=(status.eq.published,status.eq.draft)')
-  })
-})
-
-// ---------------------------------------------------------------------------
-// Resource Embedding (PostgREST parity)
-// ---------------------------------------------------------------------------
-
-describe('QueryBuilder resource embedding', () => {
-  it('select with embed passes raw string to ?select=', () => {
-    const q = qs((qb) => qb.select('*,customer:customers(name,email)'))
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('select=*,customer:customers(name,email)')
-  })
-
-  it('select with one-to-many embed', () => {
-    const q = qs((qb) => qb.select('last_name,films(title,year)'))
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('select=last_name,films(title,year)')
-  })
-
-  it('select with FK hint', () => {
-    const q = qs((qb) =>
-      qb.select('*,billing:addresses!billing_address_id(name),shipping:addresses!shipping_address_id(name)'),
-    )
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('billing:addresses!billing_address_id(name)')
-    expect(decoded).toContain('shipping:addresses!shipping_address_id(name)')
-  })
-
-  it('select with nested embedding', () => {
-    const q = qs((qb) => qb.select('first_name,roles(character,films(title))'))
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('select=first_name,roles(character,films(title))')
-  })
-
-  it('select with embed + filters + pagination', () => {
-    const q = qs((qb) =>
-      qb
-        .select('*,customer:customers(name)')
-        .eq('status', 'active')
-        .limit(10),
-    )
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('select=*,customer:customers(name)')
-    expect(decoded).toContain('status=eq.active')
-    expect(decoded).toContain('limit=10')
-  })
-
-  it('select star returns no select param', () => {
-    const q = qs((qb) => qb.select('*'))
-    expect(q).toBe('')  // no params = select all
-  })
-
-  it('select with array still joins with comma', () => {
-    const q = qs((qb) => qb.select(['id', 'name', 'email']))
-    const decoded = decodeURIComponent(q)
-    expect(decoded).toContain('select=id,name,email')
-  })
-})