@aurabase/aurabase-js 0.3.0 → 0.4.0

package/packages/aurabase/tests/auth-e2e.test.ts

@@ -1,135 +0,0 @@
-// ---------------------------------------------------------------------------
-// E2E réel auth (stack live) — Task 8
-//
-// Valide en conditions réelles les correctifs des Tasks 3/5/6 contre le
-// déploiement Docker local (gateway :8080, control :8090). Le JWKS de ce
-// déploiement est vide (`{"keys":[]}`) et les tokens sont HS256 : `getClaims`
-// doit donc exercer le chemin FALLBACK `getUser()` (pas la vérif locale
-// JWKS/WebCrypto), cf. `AuthService.getClaims` (packages/auth/src/AuthService.ts).
-//
-// Flux (une seule séquence, en `it` unique) :
-//   1. signUp + signInWithPassword (anon key) → token + user.id.
-//   2. getClaims() sur le vrai token → fallback getUser → claims.sub === user.id.
-//   3. generateLink admin : type 'magic' → { link, token } ; type 'magiclink'
-//      (invalide) → error.
-//   4. updatePassword → ancien token révoqué (401 brut) + store vidé +
-//      événement SIGNED_OUT émis via onAuthStateChange.
-//   5. getUserStats admin → total >= 1.
-//   6. Nettoyage en `finally` (authAdmin.deleteUser, best-effort).
-//
-// Gaté par RUN_E2E + credentials — squelette calqué sur
-// `packages/aurabase/tests/db-types-e2e.test.ts` (env-based, describe.runIf,
-// cleanup en finally, timeout long).
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect } from 'vitest'
-import { createClient, createAdminClient } from '../src/index'
-import type { AuraResponse, AuthChangePayload } from '../src/index'
-
-const URL = process.env.AURA_E2E_URL
-const PROJECT = process.env.AURA_E2E_PROJECT
-const ANON = process.env.AURA_E2E_ANON_KEY
-const SERVICE = process.env.AURA_E2E_SERVICE_KEY
-const RUN = Boolean(process.env.RUN_E2E && URL && PROJECT && ANON && SERVICE)
-
-/** Statuts transitoires observés sur la stack locale (timeout gateway→service sous charge). */
-const TRANSIENT_STATUS = new Set([408, 429, 502, 503, 504])
-
-/** Rejoue une requête tant qu'elle renvoie un statut transitoire (408/429/502/503/504), borné. */
-async function retryTransient<T>(fn: () => Promise<AuraResponse<T>>): Promise<AuraResponse<T>> {
-  let res = await fn()
-  for (let i = 0; i < 10 && res.error && TRANSIENT_STATUS.has(res.error.status); i++) {
-    await new Promise((r) => setTimeout(r, 1000))
-    res = await fn()
-  }
-  return res
-}
-
-describe.runIf(RUN)('auth E2E réel — getClaims fallback / generateLink / updatePassword / stats (stack live)', () => {
-  it(
-    'register→login→getClaims(fallback HS256)→generateLink→updatePassword(révocation+SIGNED_OUT)→getUserStats',
-    async () => {
-      const client = createClient(URL!, PROJECT!, ANON!)
-      const admin = createAdminClient(URL!, PROJECT!, SERVICE!)
-      const suffix = process.env.AURA_E2E_SUFFIX ?? Math.random().toString(36).slice(2, 8)
-      const email = `auth-e2e-${suffix}@aurabase.dev`
-      const password = 'EndUserPassword123!'
-
-      let userId: string | null = null
-      try {
-        // -- 1. register + login (anon key) -----------------------------------
-        const signUpRes = await retryTransient(() => client.auth.signUp({ email, password }))
-        expect(signUpRes.error).toBeNull()
-
-        const loginRes = await retryTransient(() => client.auth.signInWithPassword({ email, password }))
-        expect(loginRes.error).toBeNull()
-        const loginData = loginRes.data as { access_token: string; user: { id: string } }
-        expect(loginData.access_token).toBeTruthy()
-        userId = loginData.user.id
-        expect(userId).toBeTruthy()
-
-        const { accessToken: tokenAfterLogin } = await client.auth.getSession()
-        expect(tokenAfterLogin).toBe(loginData.access_token)
-
-        // -- 2. getClaims — déploiement HS256 / JWKS vide → chemin fallback getUser --
-        const claimsRes = await client.auth.getClaims()
-        expect(claimsRes.error).toBeNull()
-        expect(claimsRes.data?.claims.sub).toBe(userId)
-        expect(claimsRes.data?.header.alg).toBe('HS256')
-
-        // -- 3. generateLink (admin) -------------------------------------------
-        const magicRes = await admin.authAdmin.generateLink(userId!, 'magic')
-        expect(magicRes.error).toBeNull()
-        expect(magicRes.data).not.toBeNull()
-        expect(magicRes.data).toHaveProperty('link')
-        expect(magicRes.data).toHaveProperty('token')
-
-        const invalidRes = await admin.authAdmin.generateLink(
-          userId!,
-          // Type invalide volontaire — vérifie le rejet serveur (400), pas le typage TS.
-          'magiclink' as unknown as 'magic',
-        )
-        expect(invalidRes.error).not.toBeNull()
-
-        // -- 4. updatePassword : ancien token révoqué + SIGNED_OUT émis --------
-        const events: AuthChangePayload[] = []
-        const sub = client.auth.onAuthStateChange((payload) => {
-          events.push(payload)
-        })
-
-        const oldToken = (await client.auth.getSession()).accessToken
-        expect(oldToken).toBeTruthy()
-
-        const updateRes = await client.auth.updatePassword('NewPassword456!', password)
-        expect(updateRes.error).toBeNull()
-
-        const sessionAfterUpdate = await client.auth.getSession()
-        expect(sessionAfterUpdate.accessToken).toBeNull()
-        expect(events.some((e) => e.event === 'SIGNED_OUT')).toBe(true)
-
-        sub.unsubscribe()
-
-        // Requête BRUTE avec l'ancien token (le client courant a le store vidé) :
-        // preuve que le backend a bien révoqué la session, pas seulement le SDK local.
-        const rawRes = await fetch(`${URL}/v1/auth/${PROJECT}/user`, {
-          headers: { Authorization: `Bearer ${oldToken}`, apikey: ANON! },
-        })
-        expect(rawRes.status).toBe(401)
-
-        // -- 5. getUserStats (admin) -------------------------------------------
-        const statsRes = await admin.authAdmin.getUserStats()
-        expect(statsRes.error).toBeNull()
-        expect(statsRes.data?.total).toBeGreaterThanOrEqual(1)
-      } finally {
-        if (userId) {
-          try {
-            await admin.authAdmin.deleteUser(userId)
-          } catch {
-            // best-effort cleanup
-          }
-        }
-      }
-    },
-    120_000,
-  )
-})

package/packages/aurabase/tests/auth-hardening.test.ts

@@ -1,206 +0,0 @@
-// ---------------------------------------------------------------------------
-// Tests des correctifs Lot 4 — durcissement SDK auth (E17/E18/E19/E20/E21)
-// ---------------------------------------------------------------------------
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { AuraClient } from '../src/AuraClient'
-import { createAdminClient } from '../src/index'
-import { isAuraError, AuraError } from '@aurabase/core'
-import { FetchMock, fakeTokenPair, fakeUser, validJwt, expiredJwt } from './mocks'
-
-const BASE = 'http://localhost:8080'
-const PROJECT = 'test-project'
-const PREFIX = `${BASE}/v1/auth/${PROJECT}`
-
-function jsonResponse(body: unknown, status: number): Response {
-  return new Response(body !== undefined ? JSON.stringify(body) : null, {
-    status,
-    headers: { 'Content-Type': 'application/json' },
-  })
-}
-
-// ---------------------------------------------------------------------------
-// E18 — le contrat d'erreur retourne de vraies instances AuraError
-// ---------------------------------------------------------------------------
-
-describe('E18 — error est une vraie instance AuraError', () => {
-  let fetchMock: FetchMock
-  let client: AuraClient
-
-  beforeEach(() => {
-    fetchMock = new FetchMock()
-    fetchMock.init()
-    client = new AuraClient(BASE, PROJECT, { auth: { persistSession: false } })
-  })
-  afterEach(() => {
-    fetchMock.restore()
-    fetchMock.clearMocks()
-  })
-
-  it('expose status / isUnauthorized / isAuraError sur une erreur HTTP', async () => {
-    fetchMock.on({
-      method: 'POST',
-      url: `${PREFIX}/login`,
-      replyCode: 401,
-      replyBody: { error: { code: 'invalid', message: 'Identifiants invalides' } },
-    })
-    const { error } = await client.auth.signInWithPassword({ email: 'a@b.com', password: 'x' })
-    expect(error).not.toBeNull()
-    expect(isAuraError(error)).toBe(true)
-    expect(error).toBeInstanceOf(AuraError)
-    expect((error as AuraError).status).toBe(401)
-    expect((error as AuraError).isUnauthorized).toBe(true)
-    expect((error as AuraError).code).toBe('invalid')
-  })
-
-  it('erreur synthétique (no_session) est aussi une vraie instance', async () => {
-    // pas de refresh token en mémoire → refreshSession renvoie no_session
-    const { error } = await client.auth.refreshSession()
-    expect(isAuraError(error)).toBe(true)
-    expect((error as AuraError).code).toBe('no_session')
-    expect((error as AuraError).status).toBe(0)
-  })
-})
-
-// ---------------------------------------------------------------------------
-// E17 — single-flight unifié : refresh concurrent = un seul POST /refresh
-// ---------------------------------------------------------------------------
-
-describe('E17 — single-flight du refresh', () => {
-  let fetchMock: FetchMock
-  let client: AuraClient
-
-  beforeEach(() => {
-    fetchMock = new FetchMock()
-    fetchMock.init()
-    client = new AuraClient(BASE, PROJECT, { auth: { persistSession: false } })
-  })
-  afterEach(() => {
-    fetchMock.restore()
-    fetchMock.clearMocks()
-  })
-
-  it('refreshSession + getUser concurrents → un seul appel /refresh', async () => {
-    // token EXPIRÉ → getUser déclenche maybeRefresh, en même temps que refreshSession
-    client.authStore.save(expiredJwt(), 'rt_1', fakeUser())
-    fetchMock.on({ method: 'POST', url: `${PREFIX}/refresh`, replyCode: 200, replyBody: { data: fakeTokenPair() } })
-    fetchMock.on({ method: 'GET', url: `${PREFIX}/user`, replyCode: 200, replyBody: { data: fakeUser() } })
-
-    const [r1, r2] = await Promise.all([client.auth.refreshSession(), client.auth.getUser()])
-
-    expect(r1.error).toBeNull()
-    expect(r2.error).toBeNull()
-    const refreshCalls = fetchMock.calls.filter((c) => c.url.endsWith('/refresh') && c.method === 'POST')
-    expect(refreshCalls.length).toBe(1)
-  })
-})
-
-// ---------------------------------------------------------------------------
-// E19 — retry réactif borné sur 401
-// ---------------------------------------------------------------------------
-
-describe('E19 — retry sur 401', () => {
-  it('un 401 déclenche un refresh + un unique rejeu réussi', async () => {
-    let userCalls = 0
-    let refreshCalls = 0
-    const fetchFn = (async (input: RequestInfo | URL): Promise<Response> => {
-      const url = input.toString()
-      if (url.endsWith('/refresh')) {
-        refreshCalls++
-        return jsonResponse({ data: fakeTokenPair() }, 200)
-      }
-      if (url.endsWith('/user')) {
-        userCalls++
-        return userCalls === 1
-          ? jsonResponse({ error: { code: 'unauthorized', message: 'expired' } }, 401)
-          : jsonResponse({ data: fakeUser() }, 200)
-      }
-      return jsonResponse({}, 200)
-    }) as typeof globalThis.fetch
-
-    const client = new AuraClient(BASE, PROJECT, { fetch: fetchFn, auth: { persistSession: false } })
-    client.authStore.save(validJwt(), 'rt_1', fakeUser()) // token valide → pas de refresh proactif
-
-    const res = await client.auth.getUser()
-    expect(res.error).toBeNull()
-    expect(res.data).not.toBeNull()
-    expect(userCalls).toBe(2) // 401 puis rejeu 200
-    expect(refreshCalls).toBe(1)
-  })
-
-  it('ne boucle pas si le rejeu échoue encore (borné à un essai)', async () => {
-    let userCalls = 0
-    const fetchFn = (async (input: RequestInfo | URL): Promise<Response> => {
-      const url = input.toString()
-      if (url.endsWith('/refresh')) return jsonResponse({ data: fakeTokenPair() }, 200)
-      if (url.endsWith('/user')) {
-        userCalls++
-        return jsonResponse({ error: { code: 'unauthorized', message: 'nope' } }, 401)
-      }
-      return jsonResponse({}, 200)
-    }) as typeof globalThis.fetch
-
-    const client = new AuraClient(BASE, PROJECT, { fetch: fetchFn, auth: { persistSession: false } })
-    client.authStore.save(validJwt(), 'rt_1', fakeUser())
-
-    const res = await client.auth.getUser()
-    expect((res.error as AuraError).status).toBe(401)
-    expect(userCalls).toBe(2) // 1 essai + 1 rejeu, pas plus
-  })
-})
-
-// ---------------------------------------------------------------------------
-// E20 — bus d'événements unique : refreshSession émet UN seul TOKEN_REFRESHED
-// ---------------------------------------------------------------------------
-
-describe('E20 — onAuthStateChange sans doublon', () => {
-  let fetchMock: FetchMock
-  let client: AuraClient
-
-  beforeEach(() => {
-    fetchMock = new FetchMock()
-    fetchMock.init()
-    client = new AuraClient(BASE, PROJECT, { auth: { persistSession: false } })
-  })
-  afterEach(() => {
-    fetchMock.restore()
-    fetchMock.clearMocks()
-  })
-
-  it('refreshSession émet exactement un TOKEN_REFRESHED (pas de SIGNED_IN en doublon)', async () => {
-    client.authStore.save(validJwt(), 'rt_1', fakeUser())
-    fetchMock.on({ method: 'POST', url: `${PREFIX}/refresh`, replyCode: 200, replyBody: { data: fakeTokenPair() } })
-
-    const events: string[] = []
-    const sub = client.auth.onAuthStateChange((p) => events.push(p.event))
-    await new Promise((r) => queueMicrotask(() => r(null))) // laisser passer INITIAL_SESSION
-    events.length = 0
-
-    await client.auth.refreshSession()
-    expect(events).toEqual(['TOKEN_REFRESHED'])
-    sub.unsubscribe()
-  })
-})
-
-// ---------------------------------------------------------------------------
-// E21 — client admin séparé, interdit côté navigateur
-// ---------------------------------------------------------------------------
-
-describe('E21 — createAdminClient', () => {
-  it('lève une erreur si appelé dans un contexte navigateur', () => {
-    const g = globalThis as { window?: unknown }
-    const had = 'window' in g
-    g.window = {} // simuler un navigateur
-    try {
-      expect(() => createAdminClient(BASE, PROJECT, 'aura_srole_x')).toThrow(/navigateur/)
-    } finally {
-      if (!had) delete g.window
-    }
-  })
-
-  it("retourne un client en contexte serveur (pas de window)", () => {
-    const admin = createAdminClient(BASE, PROJECT, 'aura_srole_x')
-    expect(admin).toBeInstanceOf(AuraClient)
-    expect(admin.apiKey).toBe('aura_srole_x')
-  })
-})