@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/storage/tests/parity.test.ts

@@ -1,154 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { StorageService } from '../src/StorageService'
-import { BaseAuthStore } from '@aurabase/core'
-import type { AuraClientLike } from '@aurabase/core'
-
-interface Call {
-  url: string
-  method: string
-  body: unknown
-}
-
-/**
- * Client de test capturant chaque requête (url + method + body) ; le responder
- * choisit la réponse en fonction de l'URL. `apiKey` présent → header apikey injecté.
- */
-function make(responder: (url: string, init: RequestInit) => Response) {
-  const calls: Call[] = []
-  const client: AuraClientLike = {
-    baseUrl: 'http://x',
-    projectId: 'p',
-    apiKey: 'k',
-    authStore: new BaseAuthStore(),
-    fetchFn: (async (url: string, init: RequestInit) => {
-      calls.push({ url: String(url), method: init.method ?? 'GET', body: init.body })
-      return responder(String(url), init)
-    }) as unknown as typeof globalThis.fetch,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    auth: { refreshSession: async () => ({ data: null, error: null }) as any },
-  }
-  return { storage: new StorageService(client), calls }
-}
-
-function json(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } })
-}
-
-describe('storage.updateBucket', () => {
-  it('émet PATCH /v1/storage/{pid}/buckets/{id} avec le mapping createBucket', async () => {
-    const { storage, calls } = make(() => json({ id: 'b', name: 'b', public: true }))
-    const { error } = await storage.updateBucket('b', { public: true, fileSizeLimit: 1024, allowedMimeTypes: ['image/png'] })
-    expect(error).toBeNull()
-    expect(calls).toHaveLength(1)
-    expect(calls[0].method).toBe('PATCH')
-    expect(calls[0].url).toBe('http://x/v1/storage/p/buckets/b')
-    const sent = JSON.parse(calls[0].body as string)
-    expect(sent).toEqual({ public: true, file_size_limit: 1024, allowed_mime_types: ['image/png'] })
-  })
-
-  it('mise à jour partielle : seuls les champs fournis sont envoyés (public seul)', async () => {
-    const { storage, calls } = make(() => json({ id: 'b', name: 'b', public: false }))
-    await storage.updateBucket('b', { public: false })
-    const sent = JSON.parse(calls[0].body as string)
-    expect(sent).toEqual({ public: false })
-    expect('file_size_limit' in sent).toBe(false)
-    expect('allowed_mime_types' in sent).toBe(false)
-  })
-
-  it('sans options → PATCH avec corps vide {}', async () => {
-    const { storage, calls } = make(() => json({ id: 'b', name: 'b' }))
-    await storage.updateBucket('b')
-    expect(JSON.parse(calls[0].body as string)).toEqual({})
-  })
-})
-
-describe('storage.upload — option metadata', () => {
-  it("chaque paire metadata est ajoutée au FormData en plus de 'file'", async () => {
-    const { storage, calls } = make(() => json({ key: 'k.png' }))
-    await storage.upload('b', 'p.png', new Blob(['x']), { metadata: { owner: 'x', team: 'a' } })
-    const fd = calls[0].body as FormData
-    expect(fd).toBeInstanceOf(FormData)
-    expect(fd.get('owner')).toBe('x')
-    expect(fd.get('team')).toBe('a')
-    expect(fd.get('file')).toBeInstanceOf(Blob)
-  })
-
-  it('non-régression : upload sans metadata ne contient que file (+ upsert si demandé)', async () => {
-    const { storage, calls } = make(() => json({ key: 'k.png' }))
-    await storage.upload('b', 'p.png', new Blob(['x']), { upsert: true })
-    const fd = calls[0].body as FormData
-    expect(fd.get('file')).toBeInstanceOf(Blob)
-    expect(fd.get('upsert')).toBe('true')
-    expect([...fd.keys()].sort()).toEqual(['file', 'upsert'])
-  })
-
-  it('metadata + upsert cohabitent', async () => {
-    const { storage, calls } = make(() => json({ key: 'k.png' }))
-    await storage.upload('b', 'p.png', new Blob(['x']), { upsert: true, metadata: { owner: 'z' } })
-    const fd = calls[0].body as FormData
-    expect(fd.get('upsert')).toBe('true')
-    expect(fd.get('owner')).toBe('z')
-  })
-})
-
-describe('storage.createSignedUrls — batch', () => {
-  it('fan-out N : appelle createSignedUrl pour chaque chemin, renvoie N entrées avec path+url', async () => {
-    const { storage, calls } = make((url) => {
-      const key = new URL(url).searchParams.get('key')
-      return json({ url: `http://signed/${key}?sig=abc`, expires_in: 3600 })
-    })
-    const { data, error } = await storage.createSignedUrls('b', ['a.png', 'b.png', 'c.png'])
-    expect(error).toBeNull()
-    expect(calls).toHaveLength(3)
-    expect(data).toHaveLength(3)
-    expect(data![0]).toMatchObject({ path: 'a.png', expires_in: 3600 })
-    expect((data![0] as { url: string }).url).toContain('a.png')
-    expect(data!.map((d) => (d as { path: string }).path)).toEqual(['a.png', 'b.png', 'c.png'])
-  })
-
-  it('résilient par-item : une erreur produit {path, error} sans faire échouer les autres', async () => {
-    const { storage } = make((url) => {
-      const key = new URL(url).searchParams.get('key')
-      if (key === 'bad.png') return json({ error: { message: 'not found' } }, 404)
-      return json({ url: `http://signed/${key}`, expires_in: 60 })
-    })
-    const { data, error } = await storage.createSignedUrls('b', ['ok.png', 'bad.png'], 60)
-    expect(error).toBeNull()
-    expect(data).toHaveLength(2)
-    const ok = data!.find((d) => (d as { path: string }).path === 'ok.png') as { url: string }
-    const bad = data!.find((d) => (d as { path: string }).path === 'bad.png') as { error: unknown }
-    expect(ok.url).toContain('ok.png')
-    expect(bad.error).toBeTruthy()
-  })
-
-  it('propage expiresInSeconds à chaque appel (ttl_secs)', async () => {
-    const { storage, calls } = make((url) => {
-      const key = new URL(url).searchParams.get('key')
-      return json({ url: `http://signed/${key}`, expires_in: 120 })
-    })
-    await storage.createSignedUrls('b', ['a.png'], 120)
-    expect(calls[0].url).toContain('ttl_secs=120')
-  })
-})
-
-describe('storage.list — offset no-op', () => {
-  it("n'inclut PAS offset dans l'URL même si fourni", async () => {
-    const { storage, calls } = make(() => json([]))
-    await storage.list('b', { offset: 10 })
-    expect(calls[0].url).not.toContain('offset')
-  })
-
-  it('non-régression : prefix et limit toujours transmis', async () => {
-    const { storage, calls } = make(() => json([]))
-    await storage.list('b', { prefix: 'sub/', limit: 5, offset: 99 })
-    expect(calls[0].url).toContain('prefix=sub%2F')
-    expect(calls[0].url).toContain('limit=5')
-    expect(calls[0].url).not.toContain('offset')
-  })
-
-  it('aucune option → aucune query string', async () => {
-    const { storage, calls } = make(() => json([]))
-    await storage.list('b')
-    expect(calls[0].url).toBe('http://x/v1/storage/p/b')
-  })
-})

package/packages/storage/tests/path.test.ts

@@ -1,87 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { encodeObjectPath } from '../src/path'
-import { StorageService } from '../src/StorageService'
-import { BaseAuthStore, isAuraError } from '@aurabase/core'
-import type { AuraClientLike } from '@aurabase/core'
-
-function make(responder: (url: string) => Response) {
-  const calls: string[] = []
-  const client: AuraClientLike = {
-    baseUrl: 'http://x', projectId: 'p', apiKey: 'k', authStore: new BaseAuthStore(),
-    fetchFn: (async (url: string) => { calls.push(String(url)); return responder(String(url)) }) as unknown as typeof globalThis.fetch,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    auth: { refreshSession: async () => ({ data: null, error: null }) as any },
-  }
-  return { storage: new StorageService(client), calls }
-}
-
-describe('encodeObjectPath — anti-traversal + encodage', () => {
-  it('laisse un chemin normal intact et préserve la structure de dossiers', () => {
-    expect(encodeObjectPath('k.png')).toBe('k.png')
-    expect(encodeObjectPath('users/1.png')).toBe('users/1.png')
-  })
-
-  it('encode les caractères qui casseraient l’URL ou injecteraient une query', () => {
-    expect(encodeObjectPath('my photo.png')).toBe('my%20photo.png')
-    expect(encodeObjectPath('f?admin=1#frag')).toBe('f%3Fadmin%3D1%23frag')
-    // Un `%` littéral est ré-encodé (évite le double-décodage côté serveur).
-    expect(encodeObjectPath('50%off')).toBe('50%25off')
-  })
-
-  it('retire les slashes de tête (pas de bucket//key ni de path absolu)', () => {
-    expect(encodeObjectPath('/leading')).toBe('leading')
-    expect(encodeObjectPath('///a/b')).toBe('a/b')
-  })
-
-  it('rejette tout segment de traversal `..`', () => {
-    for (const p of ['..', '../secret', 'a/../b', 'a/b/..']) {
-      let thrown: unknown
-      try { encodeObjectPath(p) } catch (e) { thrown = e }
-      expect(isAuraError(thrown)).toBe(true)
-      expect((thrown as { code: string }).code).toBe('invalid_path')
-    }
-  })
-
-  it('un `..` déjà encodé (%2E%2E) reste littéral (pas de traversal)', () => {
-    // Le segment n'est pas `..`, il est ré-encodé → aucune normalisation possible.
-    expect(encodeObjectPath('%2E%2E/x')).toBe('%252E%252E/x')
-  })
-})
-
-describe('StorageService — application de l’encodage', () => {
-  it('download() encode le path (pas d’injection de query string)', () => {
-    const { storage, calls } = make(() => new Response(new Blob(['x']), { status: 200 }))
-    // Ne pas await : on veut juste l'URL construite au premier fetch.
-    void storage.download('b', 'f?admin=1').then(() => {})
-    // La requête part de façon paresseuse ; on force le déclenchement.
-    return storage.download('b', 'f?admin=1').then(() => {
-      const url = calls[calls.length - 1]
-      expect(url).toContain('/b/f%3Fadmin%3D1')
-      expect(url).not.toContain('?admin=1')
-    })
-  })
-
-  it('download() lève synchroniquement sur `..`', () => {
-    const { storage } = make(() => new Response(null, { status: 200 }))
-    expect(() => storage.download('b', 'a/../../secret')).toThrow()
-  })
-
-  it('getPublicUrl() lève sur `..`, encode sinon', () => {
-    const { storage } = make(() => new Response(null, { status: 200 }))
-    expect(() => storage.getPublicUrl('b', '../x')).toThrow()
-    expect(storage.getPublicUrl('b', 'dir/my file.png')).toContain('/b/dir/my%20file.png')
-  })
-
-  it('getMetadata() renvoie {error invalid_path} sur `..` (never-throw)', async () => {
-    const { storage } = make(() => new Response(null, { status: 200 }))
-    const { data, error } = await storage.getMetadata('b', '../etc')
-    expect(data).toBeNull()
-    expect(error?.code).toBe('invalid_path')
-  })
-
-  it('remove() renvoie {error} si une des clés fait du traversal', async () => {
-    const { storage } = make(() => new Response(JSON.stringify({ data: null }), { status: 200 }))
-    const { error } = await storage.remove('b', ['ok.png', '../evil'])
-    expect(error?.code).toBe('invalid_path')
-  })
-})

package/packages/storage/tests/transform.test.ts

@@ -1,79 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { renderTransformParams } from '../src/transform'
-import { StorageService } from '../src/StorageService'
-import { BaseAuthStore } from '@aurabase/core'
-import type { AuraClientLike } from '@aurabase/core'
-
-describe('renderTransformParams', () => {
-  it('mappe resize→fit et garde width/height/quality', () => {
-    const qs = renderTransformParams({ width: 200, height: 100, resize: 'cover', quality: 80 }).toString()
-    expect(qs).toContain('width=200'); expect(qs).toContain('height=100')
-    expect(qs).toContain('fit=cover'); expect(qs).toContain('quality=80')
-    expect(qs).not.toContain('resize=')
-  })
-  it("omet format quand 'origin'", () => {
-    const qs = renderTransformParams({ format: 'origin', width: 50 }).toString()
-    expect(qs).not.toContain('format='); expect(qs).toContain('width=50')
-  })
-  it('passe format webp', () => {
-    expect(renderTransformParams({ format: 'webp' }).toString()).toContain('format=webp')
-  })
-  it('borne quality 20-100', () => {
-    expect(renderTransformParams({ quality: 5 }).get('quality')).toBe('20')
-    expect(renderTransformParams({ quality: 500 }).get('quality')).toBe('100')
-  })
-})
-
-// -- Fixtures partagées avec download.test.ts (mock AuraClientLike minimal) --
-
-function make(responder: (url: string) => Response, store = new BaseAuthStore()) {
-  const calls: string[] = []
-  const client: AuraClientLike = {
-    baseUrl: 'http://x', projectId: 'p', apiKey: 'k', authStore: store,
-    fetchFn: (async (url: string) => { calls.push(String(url)); return responder(String(url)) }) as unknown as typeof globalThis.fetch,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    auth: { refreshSession: async () => ({ data: null, error: null }) as any },
-  }
-  return { storage: new StorageService(client), calls }
-}
-
-describe('getPublicUrl / download avec { transform }', () => {
-  it('getPublicUrl appende la query transform', () => {
-    const { storage } = make(() => new Response(null, { status: 200 }))
-    const url = storage.getPublicUrl('b', 'k.png', { transform: { width: 50 } })
-    expect(url).toContain('?width=50')
-  })
-
-  it('download appende la query transform à l’URL figée du builder', async () => {
-    const { storage, calls } = make(() => new Response(new Blob(['x']), { status: 200 }))
-    await storage.download('b', 'k.png', { transform: { width: 50, resize: 'cover' } })
-    expect(calls[0]).toContain('width=50')
-    expect(calls[0]).toContain('fit=cover')
-  })
-})
-
-describe('createSignedUrl avec { transform }', () => {
-  it('appende la query transform à l’URL signée retournée par le backend', async () => {
-    const { storage } = make(() =>
-      new Response(JSON.stringify({ url: 'http://x/signed?sig=abc', expires_in: 600 }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    )
-    const { data, error } = await storage.createSignedUrl('b', 'k.png', 600, { transform: { width: 50 } })
-    expect(error).toBeNull()
-    expect(data?.url).toContain('sig=abc')
-    expect(data?.url).toContain('width=50')
-  })
-
-  it('sans transform, laisse l’URL signée inchangée', async () => {
-    const { storage } = make(() =>
-      new Response(JSON.stringify({ url: 'http://x/signed?sig=abc', expires_in: 600 }), {
-        status: 200,
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    )
-    const { data } = await storage.createSignedUrl('b', 'k.png', 600)
-    expect(data?.url).toBe('http://x/signed?sig=abc')
-  })
-})

package/packages/storage/tsconfig.json

@@ -1,5 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": { "outDir": "dist", "rootDir": "src" },
-  "include": ["src"]
-}

package/packages/storage/tsup.config.ts

@@ -1,11 +0,0 @@
-import { defineConfig } from 'tsup'
-
-export default defineConfig({
-  entry: ['src/index.ts'],
-  format: ['cjs', 'esm'],
-  dts: true,
-  splitting: false,
-  clean: true,
-  treeshake: true,
-  minify: false,
-})

package/pnpm-workspace.yaml

@@ -1,24 +0,0 @@
-packages:
-  - 'packages/*'
-
-catalog:
-  tsup: ^8.0.0
-  typescript: ^5.5.0
-  vitest: ^4.1.6
-  '@types/node': 20.14.15
-
-# Durcissement supply-chain (pnpm v10.16+) — imposé par le hook semgrep du projet.
-# - minimumReleaseAge : attendre 7 jours (10080 min) avant d'installer une version fraîchement publiée
-# - blockExoticSubdeps : bloquer les sous-dépendances de sources non fiables (git, tarball…)
-# - trustPolicy : empêcher un downgrade malveillant des réglages de sécurité
-minimumReleaseAge: 10080
-blockExoticSubdeps: true
-trustPolicy: no-downgrade
-# Exemption ciblée : chokidar@4.0.3 (dépendance transitive de tsup, l'outil de build)
-# a perdu son attestation de provenance — le mainteneur a cessé de signer ses publications
-# (les 4.0.0/4.0.1 étaient signées). Ce n'est pas une compromission. La politique stricte
-# reste appliquée partout ailleurs. Réf. pnpm.io/settings#trustpolicyexclude (v10.22+).
-trustPolicyExclude:
-  - 'chokidar@4.0.3'
-allowBuilds:
-  esbuild: true

package/tsconfig.base.json

@@ -1,15 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "lib": ["ES2022", "DOM"],
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "declaration": true,
-    "declarationMap": true,
-    "sourceMap": true,
-    "types": ["vitest/globals"]
-  }
-}