@aurabase/aurabase-js 0.3.0

package/packages/aurabase/tests/functions.test.ts

@@ -0,0 +1,107 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { AuraClient } from '../src/AuraClient'
+import { FetchMock, fakeTokenPair } from './mocks'
+
+const BASE = 'http://localhost:8080'
+const PROJECT = '00000000-0000-0000-0000-000000000001'
+const PREFIX = `${BASE}/v1/functions/${PROJECT}`
+
+let fetchMock: FetchMock
+let client: AuraClient
+
+beforeEach(() => {
+  fetchMock = new FetchMock()
+  fetchMock.init()
+  client = new AuraClient(BASE, PROJECT, 'aura_anon_test', {
+    auth: { persistSession: false },
+  })
+  const tp = fakeTokenPair()
+  client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+})
+
+afterEach(() => {
+  fetchMock.restore()
+  fetchMock.clearMocks()
+})
+
+describe('FunctionsService route contract', () => {
+  it('lists and gets functions through backend routes', async () => {
+    fetchMock.on({ method: 'GET', url: PREFIX, replyCode: 200, replyBody: { data: [] } })
+    fetchMock.on({
+      method: 'GET',
+      url: `${PREFIX}/hello`,
+      replyCode: 200,
+      replyBody: { data: { id: 'fn-1', name: 'hello' } },
+    })
+
+    await client.functions.list()
+    await client.functions.get('hello')
+
+    expect(fetchMock.calls[0].url).toBe(PREFIX)
+    expect(fetchMock.calls[1].url).toBe(`${PREFIX}/hello`)
+  })
+
+  it('invokes a function at /{name}/invoke and wraps the request body', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/hello/invoke`,
+      replyCode: 200,
+      replyBody: { data: { status: 200 } },
+    })
+
+    await client.functions.invoke('hello', {
+      body: { name: 'Ada' },
+      method: 'POST',
+      path: '/welcome',
+      headers: { 'x-test': '1' },
+    })
+
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/hello/invoke`)
+    expect(fetchMock.calls[0].body).toEqual({
+      method: 'POST',
+      path: '/welcome',
+      headers: { 'x-test': '1' },
+      body: { name: 'Ada' },
+    })
+  })
+
+  it('uses status and limit query params for jobs', async () => {
+    fetchMock.on({
+      method: 'GET',
+      url: `${PREFIX}/jobs?status=pending&limit=10`,
+      replyCode: 200,
+      replyBody: { data: [] },
+    })
+
+    await client.functions.listJobs({ status: 'pending', limit: 10 })
+
+    expect(fetchMock.calls[0].url).toBe(`${PREFIX}/jobs?status=pending&limit=10`)
+  })
+
+  it('creates and deletes cron jobs by name', async () => {
+    fetchMock.on({
+      method: 'POST',
+      url: `${PREFIX}/cron`,
+      replyCode: 200,
+      replyBody: { data: { name: 'nightly' } },
+    })
+    fetchMock.on({
+      method: 'DELETE',
+      url: `${PREFIX}/cron/nightly`,
+      replyCode: 204,
+    })
+
+    await client.functions.createCronJob('nightly', '0 0 * * * *', 'hello', {
+      payload: { ok: true },
+    })
+    await client.functions.deleteCronJob('nightly')
+
+    expect(fetchMock.calls[0].body).toEqual({
+      name: 'nightly',
+      schedule: '0 0 * * * *',
+      function_name: 'hello',
+      payload: { ok: true },
+    })
+    expect(fetchMock.calls[1].url).toBe(`${PREFIX}/cron/nightly`)
+  })
+})

package/packages/aurabase/tests/integration.test.ts

@@ -0,0 +1,413 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+import { createClient } from '../src/index'
+
+const GATEWAY_URL = 'http://localhost:8080'
+const MGMT_URL = 'http://localhost:8090'
+
+describe('Tests d\'intégration du SDK JS en conditions réelles (E2E)', () => {
+  let devToken: string
+  let projectId: string
+  let anonKey: string
+  let serviceKey: string
+  
+  // Identifiants développeur console générés dynamiquement
+  const runId = Math.random().toString(36).substring(2, 10)
+  const devEmail = `integration-dev-${runId}@aurabase.dev`
+  const devPassword = 'DevPasswordE2E123!'
+  const projectName = `integration-proj-${runId}`
+  
+  // Identifiants utilisateur final
+  const endUserEmail = `enduser-${runId}@example.com`
+  const endUserPassword = 'EndUserPassword123!'
+  const otherUserEmail = `other-${runId}@example.com`
+  const otherUserPassword = 'OtherPassword123!'
+
+  beforeAll(async () => {
+    // 1. Enregistrement du développeur sur la console
+    const regRes = await fetch(`${MGMT_URL}/v1/control/accounts/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: devEmail, password: devPassword }),
+    })
+    expect(regRes.status).toBe(200)
+    const regData = await regRes.json()
+    devToken = regData.data.access_token
+    expect(devToken).toBeDefined()
+
+    // 2. Création dynamique d'une organisation
+    const orgRes = await fetch(`${MGMT_URL}/v1/control/orgs`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${devToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ name: 'Integration Org', slug: `integration-org-${runId}` }),
+    })
+    expect(orgRes.status).toBeLessThan(300)
+    const orgData = await orgRes.json()
+    const orgId = orgData.id
+    expect(orgId).toBeDefined()
+
+    // 3. Création du projet temporaire via l'organisation
+    const projRes = await fetch(`${MGMT_URL}/v1/control/orgs/${orgId}/projects`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${devToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ name: projectName, engine: 'postgres', region: 'eu-west-1' }),
+    })
+    expect(projRes.status).toBe(202) // 202 ACCEPTED
+    const projData = await projRes.json()
+    projectId = projData.id
+    expect(projectId).toBeDefined()
+
+    // Attente active du provisioning du projet (status = active)
+    let active = false
+    for (let i = 0; i < 50; i++) {
+      const statusRes = await fetch(`${MGMT_URL}/v1/control/projects/${projectId}`, {
+        headers: { 'Authorization': `Bearer ${devToken}` },
+      })
+      const statusData = await statusRes.json()
+      if (statusData && statusData.status === 'active') {
+        active = true
+        break
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1500))
+    }
+    expect(active).toBe(true)
+
+    // Récupération des clés API initiales (avec retry en cas de KEYS_PENDING / 404)
+    let keysRes: Response | null = null
+    for (let i = 0; i < 15; i++) {
+      keysRes = await fetch(`${MGMT_URL}/v1/control/projects/${projectId}/initial-keys`, {
+        headers: { 'Authorization': `Bearer ${devToken}` },
+      })
+      if (keysRes.status === 200) {
+        break
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1000))
+    }
+    expect(keysRes).not.toBeNull()
+    expect(keysRes!.status).toBe(200)
+    const keysData = await keysRes!.json()
+    const keys = keysData.data || keysData
+    anonKey = keys.find((k: any) => k.scope === 'anon').key
+    serviceKey = keys.find((k: any) => k.scope === 'service_role').key
+    expect(anonKey).toBeDefined()
+    expect(serviceKey).toBeDefined()
+
+    // 4. Création de la table 'todos' avec RLS active
+    const tableDef = {
+      name: 'todos',
+      columns: [
+        {
+          name: 'id',
+          col_type: 'uuid',
+          nullable: false,
+          unique: true,
+          default_val: 'gen_random_uuid()',
+          references: null
+        },
+        {
+          name: 'title',
+          col_type: 'text',
+          nullable: false,
+          unique: false,
+          default_val: null,
+          references: null
+        },
+        {
+          name: 'completed',
+          col_type: 'bool',
+          nullable: false,
+          unique: false,
+          default_val: 'false',
+          references: null
+        },
+        {
+          name: 'owner_id',
+          col_type: 'text',
+          nullable: false,
+          unique: false,
+          default_val: null,
+          references: null
+        }
+      ],
+      primary_key: 'id',
+      indexes: [],
+      rls_enabled: true,
+      realtime_enabled: true
+    }
+
+    const tableRes = await fetch(`${MGMT_URL}/v1/db/${projectId}/schema/tables`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${devToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(tableDef),
+    })
+    expect(tableRes.status).toBe(200)
+
+    // 5. Création de la policy RLS (propriétaire uniquement)
+    const policyDef = {
+      name: 'todos_owner_policy',
+      table: 'todos',
+      command: 'ALL',
+      using_expr: 'auth.uid()::text = owner_id',
+      check_expr: 'auth.uid()::text = owner_id'
+    }
+
+    const policyRes = await fetch(`${MGMT_URL}/v1/db/${projectId}/policies`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${devToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(policyDef),
+    })
+    expect(policyRes.status).toBe(200)
+
+    // 6. Attente de l'indexation PostgREST (statut 200 OK garanti et réponse JSON sous forme de tableau ou de enveloppe data)
+    let ready = false
+    for (let i = 0; i < 30; i++) {
+      const probeRes = await fetch(`${GATEWAY_URL}/v1/db/${projectId}/todos`, {
+        headers: { 'apikey': anonKey },
+      })
+      const status = probeRes.status
+      let bodyText = ''
+      try {
+        bodyText = await probeRes.text()
+      } catch (e) {}
+      console.log(`[PROBE LOOP ${i}] HTTP STATUS:`, status, 'BODY:', bodyText)
+      
+      // On s'assure que la Gateway ou PostgREST répond avec un succès (soit un tableau [], soit un objet enveloppe {"data":[]})
+      if (status === 200 && (bodyText.trim().startsWith('[') || bodyText.includes('"data":'))) {
+        ready = true
+        break
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1500))
+    }
+    expect(ready).toBe(true)
+
+    // Attendre 3 secondes supplémentaires de sécurité pour garantir la stabilisation complète du cache PostgREST
+    await new Promise((resolve) => setTimeout(resolve, 3000))
+  }, 50000)
+
+  afterAll(async () => {
+    // Suppression propre du projet de test
+    if (projectId && devToken) {
+      const delRes = await fetch(`${MGMT_URL}/v1/control/projects/${projectId}`, {
+        method: 'DELETE',
+        headers: { 'Authorization': `Bearer ${devToken}` },
+      })
+      expect(delRes.status).toBe(204) // NO CONTENT
+    }
+  })
+
+  it('devrait inscrire et connecter un utilisateur final avec succès', async () => {
+    const client = createClient(GATEWAY_URL, projectId, anonKey, {
+      auth: { persistSession: false },
+    })
+
+    // Inscription utilisateur principal
+    const signUpRes = await client.auth.signUp({
+      email: endUserEmail,
+      password: endUserPassword,
+    })
+    expect(signUpRes.error).toBeNull()
+    expect(signUpRes.data?.user).toBeDefined()
+    expect(signUpRes.data?.user?.email).toBe(endUserEmail)
+
+    // Inscription du second utilisateur (pour tester l'isolation RLS plus tard)
+    const signUpOtherRes = await client.auth.signUp({
+      email: otherUserEmail,
+      password: otherUserPassword,
+    })
+    expect(signUpOtherRes.error).toBeNull()
+
+    // Connexion
+    const signInRes = await client.auth.signInWithPassword({
+      email: endUserEmail,
+      password: endUserPassword,
+    })
+    expect(signInRes.error).toBeNull()
+    expect(signInRes.data?.access_token).toBeDefined()
+
+    // Récupération de l'utilisateur courant
+    const userRes = await client.auth.getUser()
+    expect(userRes.error).toBeNull()
+    expect(userRes.data?.email).toBe(endUserEmail)
+  })
+
+  it('devrait exécuter des requêtes CRUD avec RLS et valider l\'isolation des données', async () => {
+    const client = createClient(GATEWAY_URL, projectId, anonKey, {
+      auth: { persistSession: false },
+    })
+
+    // Se connecter en tant qu'utilisateur principal
+    await client.auth.signInWithPassword({
+      email: endUserEmail,
+      password: endUserPassword,
+    })
+
+    const user = (await client.auth.getUser()).data
+    expect(user).toBeDefined()
+    const userId = user!.id
+
+    // 1. Insertion de todo
+    const insertRes = await client.db.from('todos').insert({
+      title: 'Tester le SDK en conditions réelles',
+      completed: false,
+      owner_id: userId,
+    })
+    if (insertRes.error) {
+      console.log('DEBUG INSERT ERROR DETAIL:', JSON.stringify(insertRes.error, null, 2))
+    }
+    expect(insertRes.error).toBeNull()
+
+    // 2. Sélection de todo
+    const selectRes = await client.db.from('todos').select('*')
+    expect(selectRes.error).toBeNull()
+    expect(selectRes.data).toBeInstanceOf(Array)
+    expect(selectRes.data!.length).toBe(1)
+    expect(selectRes.data![0].title).toBe('Tester le SDK en conditions réelles')
+    
+    const todoId = selectRes.data![0].id
+    expect(todoId).toBeDefined()
+
+    // 3. Vérification de l'isolation RLS : l'accès anonyme (sans JWT) doit retourner 0 lignes
+    const anonClient = createClient(GATEWAY_URL, projectId, anonKey, {
+      auth: { persistSession: false },
+    })
+    const anonSelectRes = await anonClient.db.from('todos').select('*')
+    expect(anonSelectRes.error).toBeNull()
+    expect(anonSelectRes.data).toBeInstanceOf(Array)
+    expect(anonSelectRes.data!.length).toBe(0)
+
+    // 4. Vérification de l'isolation RLS : un autre utilisateur connecté doit obtenir 0 lignes
+    const otherClient = createClient(GATEWAY_URL, projectId, anonKey, {
+      auth: { persistSession: false },
+    })
+    await otherClient.auth.signInWithPassword({
+      email: otherUserEmail,
+      password: otherUserPassword,
+    })
+    const otherSelectRes = await otherClient.db.from('todos').select('*')
+    expect(otherSelectRes.error).toBeNull()
+    expect(otherSelectRes.data).toBeInstanceOf(Array)
+    expect(otherSelectRes.data!.length).toBe(0)
+
+    // 5. Mise à jour de todo (l'utilisateur principal modifie son propre todo)
+    const updateRes = await client.db.from('todos').update(todoId, {
+      completed: true,
+    })
+    expect(updateRes.error).toBeNull()
+
+    const selectUpdatedRes = await client.db.from('todos').select('*')
+    expect(selectUpdatedRes.data![0].completed).toBe(true)
+
+    // 6. Suppression de todo
+    const deleteRes = await client.db.from('todos').delete(todoId)
+    expect(deleteRes.error).toBeNull()
+
+    const selectDeletedRes = await client.db.from('todos').select('*')
+    expect(selectDeletedRes.data!.length).toBe(0)
+  })
+
+  it('devrait exécuter des requêtes SQL brutes et rejeter les requêtes non autorisées', async () => {
+    const client = createClient(GATEWAY_URL, projectId, anonKey, {
+      auth: { persistSession: false },
+    })
+
+    await client.auth.signInWithPassword({
+      email: endUserEmail,
+      password: endUserPassword,
+    })
+
+    const user = (await client.auth.getUser()).data
+    const userId = user!.id
+
+    // Insérer un todo temporaire pour la requête SQL
+    const sqlInsert = await client.db.from('todos').insert({
+      title: 'SQL Todo',
+      completed: false,
+      owner_id: userId,
+    })
+    if (sqlInsert.error) {
+      console.log('DEBUG SQL INSERT ERROR:', JSON.stringify(sqlInsert.error, null, 2))
+    }
+
+    // Requête SQL autorisée
+    const sqlRes = await client.db.sql<any[]>('SELECT title FROM todos WHERE owner_id = $1', [userId])
+    expect(sqlRes.error).toBeNull()
+    expect(sqlRes.data).toBeDefined()
+    expect(sqlRes.data!.length).toBe(1)
+    expect(sqlRes.data![0].title).toBe('SQL Todo')
+
+    // Requête SQL non autorisée vers pg_catalog (rejetée par l'AST de la gateway)
+    const forbiddenSqlRes = await client.db.sql('SELECT * FROM pg_catalog.pg_tables')
+    expect(forbiddenSqlRes.error).not.toBeNull()
+    expect(forbiddenSqlRes.error?.message).toMatch(/non autorisées|interdit|rejetée|pg_catalog/)
+  })
+
+  it('devrait manipuler le service Storage (buckets et objets) avec succès', async () => {
+    // La gestion des buckets (create/delete) exige une clé service_role côté gateway ;
+    // ce test valide les méthodes storage du SDK de bout en bout, on utilise donc un
+    // client service_role (la RLS storage est testée ailleurs).
+    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
+      auth: { persistSession: false },
+    })
+
+    const bucketName = `integration-bucket-${runId}`
+    const fileName = 'test-file.txt'
+    const fileContent = 'Bonjour Aurabase E2E'
+
+    // 1. Création de bucket
+    const bucketCreateRes = await client.storage.createBucket(bucketName, {
+      public: true,
+    })
+    expect(bucketCreateRes.error).toBeNull()
+    expect(bucketCreateRes.data?.name).toBe(bucketName)
+
+    // 2. Téléversement de fichier (upload)
+    const blob = new Blob([fileContent], { type: 'text/plain' })
+    const uploadRes = await client.storage.upload(bucketName, fileName, blob, {
+      contentType: 'text/plain',
+    })
+    expect(uploadRes.error).toBeNull()
+    expect(uploadRes.data?.key).toBeDefined()
+    
+    // `data.key` est déjà relative au bucket (contrat SDK : réutilisable directement).
+    // Robuste : strippe un éventuel préfixe bucket si le backend en ajoutait un.
+    const uploadedKey = uploadRes.data!.key
+    const objectPath = uploadedKey.startsWith(`${bucketName}/`)
+      ? uploadedKey.slice(bucketName.length + 1)
+      : uploadedKey
+    expect(objectPath).toBeTruthy()
+
+    // 3. Récupération des métadonnées
+    const metaRes = await client.storage.getMetadata(bucketName, objectPath)
+    expect(metaRes.error).toBeNull()
+    // Note : `getMetadata` renvoie la clé préfixée du bucket alors qu'`upload` renvoie la clé
+    // nue (incohérence de format backend, à harmoniser) → on vérifie l'inclusion, pas l'égalité.
+    expect((metaRes.data as any)?.key).toContain(uploadedKey)
+
+    // 4. Téléchargement et vérification du contenu
+    const downloadRes = await client.storage.download(bucketName, objectPath)
+    expect(downloadRes.error).toBeNull()
+    expect(downloadRes.data).toBeInstanceOf(Blob)
+    
+    const textContent = await downloadRes.data!.text()
+    expect(textContent).toBe(fileContent)
+
+    // 5. Suppression du fichier
+    const removeRes = await client.storage.remove(bucketName, [objectPath])
+    expect(removeRes.error).toBeNull()
+
+    // 6. Suppression du bucket
+    const bucketDeleteRes = await client.storage.deleteBucket(bucketName)
+    expect(bucketDeleteRes.error).toBeNull()
+  })
+})