@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/auth/tests/auth-lifecycle.test.ts

@@ -1,149 +0,0 @@
-import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest'
-import { AuthService } from '../src/AuthService'
-import { BaseAuthStore } from '@aurabase/core'
-import type { AuraClientLike, User } from '@aurabase/core'
-
-// --- helpers inline (évite un mocks.ts dédié au package auth) ----------------
-function b64url(obj: unknown): string {
-  return btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
-}
-function validJwt(): string {
-  const exp = Math.floor(Date.now() / 1000) + 3600
-  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub: 'u1', exp })}.sig`
-}
-function fakeUser(): User {
-  return {
-    id: 'u1', email: 't@e.com', role: 'authenticated', email_verified: true,
-    is_banned: false, is_anonymous: false, mfa_enabled: false,
-    user_metadata: {}, app_metadata: {}, created_at: '2025-01-01T00:00:00Z',
-  }
-}
-
-// --- mock BroadcastChannel ---------------------------------------------------
-class FakeBC {
-  static instances: FakeBC[] = []
-  onmessage: ((e: { data: unknown }) => void) | null = null
-  posted: unknown[] = []
-  closed = false
-  constructor(public name: string) { FakeBC.instances.push(this) }
-  postMessage(d: unknown) { this.posted.push(d) }
-  close() { this.closed = true }
-}
-
-beforeEach(() => {
-  FakeBC.instances = []
-  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
-})
-afterEach(() => {
-  vi.useRealTimers()
-  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
-})
-
-function newAuth(store: BaseAuthStore) {
-  const client: AuraClientLike = {
-    baseUrl: 'http://x', projectId: 'p', apiKey: 'k',
-    fetchFn: (async () => new Response('{}', { status: 200 })) as unknown as typeof globalThis.fetch,
-    authStore: store,
-    auth: null as unknown as AuraClientLike['auth'],
-  }
-  const svc = new AuthService(client, { autoRefresh: true, persistSession: true, forceEnabled: true })
-  ;(client as { auth: unknown }).auth = svc
-  return { svc, client }
-}
-
-describe('AuthService — cycle de vie session', () => {
-  it('sign-in (save) démarre le ticker et broadcaste', () => {
-    vi.useFakeTimers()
-    const store = new BaseAuthStore()
-    const { svc } = newAuth(store)
-    store.save(validJwt(), 'rt', fakeUser())
-    expect((svc as unknown as { _sessionManager: { isActive: boolean } })._sessionManager.isActive).toBe(true)
-    expect(FakeBC.instances[0].posted.length).toBe(1)
-  })
-
-  it('sign-out (clear) arrête le ticker', () => {
-    const store = new BaseAuthStore()
-    const { svc } = newAuth(store)
-    store.save(validJwt(), 'rt', fakeUser())
-    store.clear()
-    expect((svc as unknown as { _sessionManager: { isActive: boolean } })._sessionManager.isActive).toBe(false)
-  })
-
-  it('réception d’un logout distant → SIGNED_OUT local + store vidé, sans rebroadcast', () => {
-    const store = new BaseAuthStore()
-    store.save(validJwt(), 'rt', fakeUser())
-    const { svc } = newAuth(store)
-    const events: string[] = []
-    svc.onAuthStateChange(({ event }) => events.push(event))
-    const bc = FakeBC.instances[0]
-    const before = bc.posted.length
-    bc.onmessage!({ data: null }) // null = signed out
-    expect(store.token).toBeNull()
-    expect(events).toContain('SIGNED_OUT')
-    expect(bc.posted.length).toBe(before) // pas de rebroadcast
-  })
-
-  it('dispose() coupe le ticker, ferme le canal, vide les listeners', async () => {
-    const store = new BaseAuthStore()
-    const { svc } = newAuth(store)
-    store.save(validJwt(), 'rt', fakeUser())
-    const cb = vi.fn()
-    svc.onAuthStateChange(cb)
-    svc.dispose()
-    expect((svc as unknown as { _sessionManager: { isActive: boolean } })._sessionManager.isActive).toBe(false)
-    expect(FakeBC.instances[0].closed).toBe(true)
-    await Promise.resolve() // flush le microtask INITIAL_SESSION
-    expect(cb).not.toHaveBeenCalled() // listeners vidés → aucun event
-  })
-
-  // --- Correctifs post-audit ---
-
-  it('F2 : onAuthStateChange APRÈS dispose() n’émet rien', async () => {
-    const store = new BaseAuthStore()
-    const { svc } = newAuth(store)
-    svc.dispose()
-    const cb = vi.fn()
-    svc.onAuthStateChange(cb) // abonnement après dispose
-    await Promise.resolve()
-    expect(cb).not.toHaveBeenCalled()
-  })
-
-  it('F3 : un user placeholder (sans id) n’est PAS broadcasté', () => {
-    const store = new BaseAuthStore()
-    newAuth(store)
-    const bc = FakeBC.instances[0]
-    store.save(validJwt(), 'rt', {} as User) // placeholder incomplet (setSession)
-    expect(bc.posted.length).toBe(0) // rien diffusé
-    store.save(validJwt(), 'rt', fakeUser()) // état complet
-    expect(bc.posted.length).toBe(1)
-  })
-
-  it('F4 : un message distant malformé est ignoré (store inchangé, aucun event)', () => {
-    const store = new BaseAuthStore()
-    store.save(validJwt(), 'rt', fakeUser())
-    const { svc } = newAuth(store)
-    const events: string[] = []
-    svc.onAuthStateChange(({ event }) => events.push(event))
-    const before = store.token
-    FakeBC.instances[0].onmessage!({ data: { foo: 1 } }) // malformé
-    FakeBC.instances[0].onmessage!({ data: { token: 123, refreshToken: 'x', user: {} } }) // token non-string
-    expect(store.token).toBe(before) // inchangé
-    expect(events.filter((e) => e !== 'INITIAL_SESSION')).toEqual([]) // aucun event applicatif
-  })
-
-  it('F6 : inférence d’événement distant (SIGNED_IN / TOKEN_REFRESHED / USER_UPDATED)', () => {
-    // Tokens explicitement distincts : _applyRemoteState compare des strings (pas de décodage JWT).
-    const store = new BaseAuthStore()
-    const { svc } = newAuth(store)
-    const events: string[] = []
-    svc.onAuthStateChange(({ event }) => { if (event !== 'INITIAL_SESSION') events.push(event) })
-    const bc = FakeBC.instances[0]
-    // 1) pas de session → login distant
-    bc.onmessage!({ data: { token: 'tokA', refreshToken: 'rt', user: fakeUser() } })
-    // 2) même token, user modifié → USER_UPDATED
-    bc.onmessage!({ data: { token: 'tokA', refreshToken: 'rt', user: { ...fakeUser(), email: 'new@e.com' } } })
-    // 3) token différent → TOKEN_REFRESHED
-    bc.onmessage!({ data: { token: 'tokB', refreshToken: 'rt2', user: fakeUser() } })
-    expect(events).toEqual(['SIGNED_IN', 'USER_UPDATED', 'TOKEN_REFRESHED'])
-  })
-})

package/packages/auth/tests/detect-session.test.ts

@@ -1,361 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
-import { AuthService } from '../src/AuthService'
-import { BaseAuthStore, LocalAuthStore } from '@aurabase/core'
-import type { AuraClientLike, User } from '@aurabase/core'
-
-// --- helpers -----------------------------------------------------------------
-
-function fakeUser(id = 'u1'): User {
-  return {
-    id,
-    email: 't@e.com',
-    role: 'authenticated',
-    email_verified: true,
-    is_banned: false,
-    is_anonymous: false,
-    mfa_enabled: false,
-    user_metadata: {},
-    app_metadata: {},
-    created_at: '2025-01-01T00:00:00Z',
-  }
-}
-
-class FakeBC {
-  static instances: FakeBC[] = []
-  onmessage: ((e: { data: unknown }) => void) | null = null
-  posted: unknown[] = []
-  closed = false
-  constructor(public name: string) {
-    FakeBC.instances.push(this)
-  }
-  postMessage(d: unknown) {
-    this.posted.push(d)
-  }
-  close() {
-    this.closed = true
-  }
-}
-
-function b64url(obj: unknown): string {
-  return btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
-}
-/** JWT non expiré (signature factice — non vérifiée localement en HS256). */
-function jwt(sub = 'u1', ttlSec = 3600): string {
-  const exp = Math.floor(Date.now() / 1000) + ttlSec
-  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub, exp })}.sig`
-}
-
-const VERIFIER_KEY = 'aura-proj-1-pkce-code-verifier'
-
-beforeEach(() => {
-  FakeBC.instances = []
-  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
-})
-afterEach(() => {
-  vi.useRealTimers()
-  vi.restoreAllMocks()
-  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
-  delete (globalThis as unknown as { window?: unknown }).window
-  delete (globalThis as unknown as { localStorage?: unknown }).localStorage
-})
-
-function makeAuth(
-  fetchFn: typeof globalThis.fetch = (async () =>
-    new Response('{}', { status: 200 })) as unknown as typeof globalThis.fetch,
-  store: BaseAuthStore = new BaseAuthStore(),
-) {
-  // Construit HORS navigateur (pas de window) → le constructeur ne déclenche pas
-  // _detectSessionInUrl ; on le pilote explicitement dans chaque test.
-  const client: AuraClientLike = {
-    baseUrl: 'http://detect.local',
-    projectId: 'proj-1',
-    apiKey: 'k',
-    fetchFn,
-    authStore: store,
-    auth: null as unknown as AuraClientLike['auth'],
-  }
-  const svc = new AuthService(client, { autoRefresh: false, persistSession: false })
-  ;(client as { auth: unknown }).auth = svc
-  return { svc, client, store }
-}
-
-function setWindow(opts: { hash?: string; search?: string; pathname?: string }) {
-  const replaceState = vi.fn()
-  ;(globalThis as unknown as { window: unknown }).window = {
-    location: {
-      hash: opts.hash ?? '',
-      search: opts.search ?? '',
-      pathname: opts.pathname ?? '/app',
-    },
-    history: { replaceState },
-  }
-  return replaceState
-}
-
-// --- detectSessionInUrl -------------------------------------------------------
-
-const INITIATED_KEY = 'aura-proj-1-oauth-implicit-initiated'
-
-describe('AuthService._detectSessionInUrl — callback OAuth au boot', () => {
-  it('fragment implicit (#access_token) AVEC marqueur d’initiation → setSession + URL nettoyée', async () => {
-    const store = new BaseAuthStore()
-    // SEC-F3 : le SDK a initié le flux (marqueur posé par signInWithOAuth).
-    store.setItem(INITIATED_KEY, '1')
-    const { svc } = makeAuth(undefined, store)
-    const setSession = vi
-      .spyOn(svc, 'setSession')
-      .mockResolvedValue({ data: fakeUser(), error: null })
-    const replaceState = setWindow({
-      hash: '#access_token=AT123&refresh_token=RT456&expires_in=3600&token_type=bearer',
-      search: '',
-      pathname: '/callback',
-    })
-
-    await svc._detectSessionInUrl()
-
-    expect(setSession).toHaveBeenCalledWith('AT123', 'RT456')
-    // Marqueur à usage unique : purgé après adoption.
-    expect(store.getItem(INITIATED_KEY)).toBeNull()
-    // URL nettoyée : replaceState appelé, plus aucun token dans l'URL cible.
-    expect(replaceState).toHaveBeenCalledTimes(1)
-    const cleaned = String(replaceState.mock.calls[0]![2])
-    expect(cleaned).not.toContain('access_token')
-    expect(cleaned).toBe('/callback')
-  })
-
-  it('query PKCE (?code) → exchangeCodeForSession(code) + code/state retirés de l’URL', async () => {
-    const { svc } = makeAuth()
-    const exchange = vi
-      .spyOn(svc, 'exchangeCodeForSession')
-      .mockResolvedValue({ data: null, error: null })
-    const replaceState = setWindow({
-      hash: '',
-      search: '?code=AUTHCODE&state=xyz&foo=bar',
-      pathname: '/auth/callback',
-    })
-
-    await svc._detectSessionInUrl()
-
-    expect(exchange).toHaveBeenCalledWith('AUTHCODE')
-    expect(replaceState).toHaveBeenCalledTimes(1)
-    const cleaned = String(replaceState.mock.calls[0]![2])
-    expect(cleaned).not.toContain('code=')
-    expect(cleaned).not.toContain('state=')
-    // Les autres query params sont préservés.
-    expect(cleaned).toContain('foo=bar')
-  })
-
-  it('URL sans token ni code → no-op (aucun setSession/exchange, aucun nettoyage)', async () => {
-    const { svc } = makeAuth()
-    const setSession = vi.spyOn(svc, 'setSession')
-    const exchange = vi.spyOn(svc, 'exchangeCodeForSession')
-    const replaceState = setWindow({ hash: '', search: '?foo=bar' })
-
-    await svc._detectSessionInUrl()
-
-    expect(setSession).not.toHaveBeenCalled()
-    expect(exchange).not.toHaveBeenCalled()
-    expect(replaceState).not.toHaveBeenCalled()
-  })
-
-  it('SEC-F3 : fragment implicit SANS marqueur d’initiation (injecté par un attaquant) → NON adopté (aucun setSession)', async () => {
-    const store = new BaseAuthStore() // pas de marqueur : flux NON initié par ce SDK
-    const { svc } = makeAuth(undefined, store)
-    const setSession = vi.spyOn(svc, 'setSession')
-    const replaceState = setWindow({
-      hash: '#access_token=ATTACKER&refresh_token=RTATT&token_type=bearer',
-      pathname: '/callback',
-    })
-
-    await svc._detectSessionInUrl()
-
-    // Session fixation évitée : le fragment forgé n'est jamais consommé.
-    expect(setSession).not.toHaveBeenCalled()
-    expect(replaceState).not.toHaveBeenCalled()
-    expect(store.token).toBeNull()
-  })
-
-  it('SEC-F3 : marqueur à usage unique — un 2e fragment (rejeu) après adoption n’est plus adopté', async () => {
-    const store = new BaseAuthStore()
-    store.setItem(INITIATED_KEY, '1')
-    const { svc } = makeAuth(undefined, store)
-    const setSession = vi
-      .spyOn(svc, 'setSession')
-      .mockResolvedValue({ data: fakeUser(), error: null })
-    setWindow({
-      hash: '#access_token=AT1&refresh_token=RT1&token_type=bearer',
-      pathname: '/cb',
-    })
-
-    await svc._detectSessionInUrl() // 1er passage : marqueur présent → adopté + purgé
-    expect(setSession).toHaveBeenCalledTimes(1)
-
-    await svc._detectSessionInUrl() // 2e passage : marqueur purgé → plus adopté
-    expect(setSession).toHaveBeenCalledTimes(1)
-  })
-
-  it('SEC-F3 : signInWithOAuth (flux implicit) POSE le marqueur d’initiation avant le redirect', async () => {
-    const store = new LocalAuthStore('aurabase_auth')
-    // localStorage minimal (persistant → survit au redirect simulé).
-    const mem = new Map<string, string>()
-    ;(globalThis as unknown as { localStorage: unknown }).localStorage = {
-      get length() {
-        return mem.size
-      },
-      key: (i: number) => Array.from(mem.keys())[i] ?? null,
-      getItem: (k: string) => (mem.has(k) ? mem.get(k)! : null),
-      setItem: (k: string, v: string) => void mem.set(k, v),
-      removeItem: (k: string) => void mem.delete(k),
-      clear: () => mem.clear(),
-    }
-    ;(globalThis as unknown as { window: unknown }).window = { location: { href: '' } }
-    const { svc } = makeAuth(undefined, store)
-
-    await svc.signInWithOAuth('google', { redirectTo: 'http://app/cb' })
-
-    // Marqueur posé (preuve d'initiation) — le fragment retour sera adoptable.
-    expect(store.getItem(INITIATED_KEY)).toBe('1')
-  })
-
-  it('SEC-F3 : flux PKCE (?code) reste adopté SANS marqueur implicit (lié au code_verifier)', async () => {
-    const store = new BaseAuthStore() // aucun marqueur implicit
-    const { svc } = makeAuth(undefined, store)
-    const exchange = vi
-      .spyOn(svc, 'exchangeCodeForSession')
-      .mockResolvedValue({ data: null, error: null })
-    setWindow({ hash: '', search: '?code=PKCECODE', pathname: '/cb' })
-
-    await svc._detectSessionInUrl()
-
-    // PKCE est déjà lié cryptographiquement au verifier → inchangé par SEC-F3.
-    expect(exchange).toHaveBeenCalledWith('PKCECODE')
-  })
-
-  it('hors navigateur (SSR/Node, pas de window) → no-op, ne throw pas', async () => {
-    const { svc } = makeAuth()
-    const setSession = vi.spyOn(svc, 'setSession')
-    const exchange = vi.spyOn(svc, 'exchangeCodeForSession')
-    // pas de window
-    await expect(svc._detectSessionInUrl()).resolves.toBeUndefined()
-    expect(setSession).not.toHaveBeenCalled()
-    expect(exchange).not.toHaveBeenCalled()
-  })
-
-  it('déclenché au boot en navigateur quand détecté (constructeur)', async () => {
-    // window AVANT construction → le constructeur appelle _detectSessionInUrl.
-    const at = jwt('u1')
-    setWindow({
-      hash: `#access_token=${at}&refresh_token=RT&token_type=bearer`,
-      pathname: '/cb',
-    })
-    const store = new BaseAuthStore()
-    // SEC-F3 : le flux a été initié par ce SDK (marqueur présent avant le retour OAuth).
-    store.setItem('aura-proj-1-oauth-implicit-initiated', '1')
-    let userCalls = 0
-    const fetchFn = (async (url: string) => {
-      if (String(url).includes('/user')) {
-        userCalls++
-        return new Response(JSON.stringify({ data: fakeUser() }), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      }
-      return new Response('{}', { status: 200 })
-    }) as unknown as typeof globalThis.fetch
-    const client: AuraClientLike = {
-      baseUrl: 'http://detect.local',
-      projectId: 'proj-1',
-      apiKey: 'k',
-      fetchFn,
-      authStore: store,
-      auth: null as unknown as AuraClientLike['auth'],
-    }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    const svc = new AuthService(client, { autoRefresh: false, persistSession: true })
-    ;(client as { auth: unknown }).auth = svc
-    // Laisse le microtask/await du detect se dérouler.
-    await new Promise((r) => setTimeout(r, 0))
-    expect(userCalls).toBeGreaterThanOrEqual(1)
-    expect(store.token).toBe(at)
-  })
-})
-
-// --- Purge PKCE ---------------------------------------------------------------
-
-describe('Purge du code_verifier PKCE', () => {
-  it('BaseAuthStore.clear() vide aussi le stockage clé/valeur (_kv)', () => {
-    const store = new BaseAuthStore()
-    store.setItem(VERIFIER_KEY, 'verifier-value')
-    store.setItem('other', 'x')
-    expect(store.getItem(VERIFIER_KEY)).toBe('verifier-value')
-
-    store.clear()
-
-    expect(store.getItem(VERIFIER_KEY)).toBeNull()
-    expect(store.getItem('other')).toBeNull()
-  })
-
-  it('signOut purge le code_verifier (via clear)', async () => {
-    const store = new BaseAuthStore()
-    const { svc } = makeAuth(undefined, store)
-    store.setItem(VERIFIER_KEY, 'verifier-value')
-
-    await svc.signOut()
-
-    expect(store.getItem(VERIFIER_KEY)).toBeNull()
-  })
-
-  it('exchangeCodeForSession en ÉCHEC purge quand même le verifier (usage unique)', async () => {
-    const store = new BaseAuthStore()
-    store.setItem(VERIFIER_KEY, 'verifier-value')
-    const fetchFn = (async (url: string) => {
-      if (String(url).includes('/oauth/pkce')) {
-        return new Response(JSON.stringify({ error: { code: 'invalid_grant', message: 'bad code' } }), {
-          status: 400,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      }
-      return new Response('{}', { status: 200 })
-    }) as unknown as typeof globalThis.fetch
-    const { svc } = makeAuth(fetchFn, store)
-
-    const { error } = await svc.exchangeCodeForSession('auth-code')
-
-    expect(error).toBeTruthy()
-    // Purge inconditionnelle même à l'échec : plus de réutilisation possible.
-    expect(store.getItem(VERIFIER_KEY)).toBeNull()
-  })
-
-  it('LocalAuthStore.clear() supprime les clés PKCE de localStorage (multi-projets)', () => {
-    // localStorage minimal en mémoire.
-    const mem = new Map<string, string>()
-    ;(globalThis as unknown as { localStorage: unknown }).localStorage = {
-      get length() {
-        return mem.size
-      },
-      key: (i: number) => Array.from(mem.keys())[i] ?? null,
-      getItem: (k: string) => (mem.has(k) ? mem.get(k)! : null),
-      setItem: (k: string, v: string) => {
-        mem.set(k, v)
-      },
-      removeItem: (k: string) => {
-        mem.delete(k)
-      },
-      clear: () => mem.clear(),
-    }
-
-    const store = new LocalAuthStore('aurabase_auth')
-    store.setItem('aura-proj-1-pkce-code-verifier', 'v1')
-    store.setItem('aura-proj-2-pkce-code-verifier', 'v2')
-    store.setItem('unrelated-key', 'keep-me')
-    expect(mem.get('aura-proj-1-pkce-code-verifier')).toBe('v1')
-
-    store.clear()
-
-    expect(store.getItem('aura-proj-1-pkce-code-verifier')).toBeNull()
-    expect(mem.get('aura-proj-1-pkce-code-verifier')).toBeUndefined()
-    expect(mem.get('aura-proj-2-pkce-code-verifier')).toBeUndefined()
-    // Une clé non-PKCE n'est pas balayée par la purge.
-    expect(mem.get('unrelated-key')).toBe('keep-me')
-  })
-})