@aurabase/aurabase-js 0.3.0

package/packages/aurabase/tests/production-robustness.test.ts

@@ -0,0 +1,268 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+import { createClient } from '../src/index'
+
+const GATEWAY_URL = 'http://localhost:8080'
+const MGMT_URL = 'http://localhost:8090'
+
+describe('Tests de robustesse de production E2E (Multi-tenant, Transactions, Injection, Concurrence)', () => {
+  let devToken: string
+  let projectId: string
+  let anonKey: string
+  let serviceKey: string
+  
+  const runId = Math.random().toString(36).substring(2, 10)
+  const devEmail = `robustness-dev-${runId}@aurabase.dev`
+  const devPassword = 'RobustPasswordE2E123!'
+  const projectName = `robustness-proj-${runId}`
+  
+  const endUserEmail = `enduser-${runId}@example.com`
+  const endUserPassword = 'EndUserPassword123!'
+
+  beforeAll(async () => {
+    // 1. Enregistrement développeur
+    const regRes = await fetch(`${MGMT_URL}/v1/control/accounts/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: devEmail, password: devPassword }),
+    })
+    expect(regRes.status).toBe(200)
+    const regData = await regRes.json()
+    devToken = regData.data.access_token
+
+    // 2. Création organisation
+    const orgRes = await fetch(`${MGMT_URL}/v1/control/orgs`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${devToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ name: 'Robustness Org', slug: `robust-org-${runId}` }),
+    })
+    expect(orgRes.status).toBeLessThan(300)
+    const orgData = await orgRes.json()
+    const orgId = orgData.id
+
+    // 3. Création projet
+    const projRes = await fetch(`${MGMT_URL}/v1/control/orgs/${orgId}/projects`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${devToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ name: projectName, engine: 'postgres', region: 'eu-west-1' }),
+    })
+    expect(projRes.status).toBe(202)
+    const projData = await projRes.json()
+    projectId = projData.id
+
+    // Attente du provisioning
+    let active = false
+    for (let i = 0; i < 50; i++) {
+      const statusRes = await fetch(`${MGMT_URL}/v1/control/projects/${projectId}`, {
+        headers: { 'Authorization': `Bearer ${devToken}` },
+      })
+      const statusData = await statusRes.json()
+      if (statusData && statusData.status === 'active') {
+        active = true
+        break
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1500))
+    }
+    expect(active).toBe(true)
+
+    // Récupération clés API (avec retry)
+    let keysRes: Response | null = null
+    for (let i = 0; i < 15; i++) {
+      keysRes = await fetch(`${MGMT_URL}/v1/control/projects/${projectId}/initial-keys`, {
+        headers: { 'Authorization': `Bearer ${devToken}` },
+      })
+      if (keysRes.status === 200) {
+        break
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1000))
+    }
+    expect(keysRes).not.toBeNull()
+    expect(keysRes!.status).toBe(200)
+    const keysData = await keysRes!.json()
+    const keys = keysData.data || keysData
+    anonKey = keys.find((k: any) => k.scope === 'anon').key
+    serviceKey = keys.find((k: any) => k.scope === 'service_role').key
+
+    // 4. Création de la table 'tasks' avec RLS active
+    const tableDef = {
+      name: 'tasks',
+      columns: [
+        {
+          name: 'id',
+          col_type: 'uuid',
+          nullable: false,
+          unique: true,
+          default_val: 'gen_random_uuid()',
+          references: null
+        },
+        {
+          name: 'title',
+          col_type: 'text',
+          nullable: false,
+          unique: false,
+          default_val: null,
+          references: null
+        },
+        {
+          name: 'owner_id',
+          col_type: 'text',
+          nullable: false,
+          unique: false,
+          default_val: null,
+          references: null
+        }
+      ],
+      primary_key: 'id',
+      indexes: [],
+      rls_enabled: true,
+      realtime_enabled: true
+    }
+
+    const tableRes = await fetch(`${MGMT_URL}/v1/db/${projectId}/schema/tables`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${devToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(tableDef),
+    })
+    expect(tableRes.status).toBe(200)
+
+    // Attendre l'indexation PostgREST
+    let ready = false
+    for (let i = 0; i < 30; i++) {
+      const probeRes = await fetch(`${GATEWAY_URL}/v1/db/${projectId}/tasks`, {
+        headers: { 'apikey': anonKey },
+      })
+      if (probeRes.status === 200) {
+        ready = true
+        break
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1500))
+    }
+    expect(ready).toBe(true)
+
+    // Attendre 3 secondes que PostgREST stabilise son cache après les DDL de setup
+    await new Promise((resolve) => setTimeout(resolve, 3000))
+  }, 60000)
+
+  afterAll(async () => {
+    // Suppression propre
+    if (projectId && devToken) {
+      const delRes = await fetch(`${MGMT_URL}/v1/control/projects/${projectId}`, {
+        method: 'DELETE',
+        headers: { 'Authorization': `Bearer ${devToken}` },
+      })
+      expect(delRes.status).toBe(204)
+    }
+  })
+
+  it('devrait exécuter des requêtes avec EXPLAIN ANALYZE', async () => {
+    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
+      auth: { persistSession: false },
+    })
+
+    const explainRes = await client.db.sql<any[]>('EXPLAIN ANALYZE SELECT * FROM tasks')
+    expect(explainRes.error).toBeNull()
+    expect(explainRes.data).toBeDefined()
+    expect(explainRes.data!.length).toBeGreaterThan(0)
+    
+    // Vérifier la présence d'éléments typiques d'un plan d'exécution
+    const planText = JSON.stringify(explainRes.data)
+    expect(planText).toMatch(/Plan|Scan/i)
+  })
+
+  it('devrait empêcher le contournement d\'isolation multi-tenant (Lecture inter-schéma)', async () => {
+    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
+      auth: { persistSession: false },
+    })
+
+    // Tenter de lire un schéma d'un autre tenant inexistant ou existant (ex: project_autre_tenant)
+    // Devrait être rejeté avec une erreur 400 (BAD REQUEST) par Axum avant d'exécuter le SQL
+    const foreignSchemaRes = await client.db.sql('SELECT * FROM project_00000000_0000_0000_0000_000000000000.tasks')
+    expect(foreignSchemaRes.error).not.toBeNull()
+    expect(foreignSchemaRes.error?.code).toBe('BAD_REQUEST')
+    expect(foreignSchemaRes.error?.message).toContain('interdite')
+  })
+
+  it('devrait garantir la sécurité face aux injections SQL', async () => {
+    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
+      auth: { persistSession: false },
+    })
+
+    // Tentative d'injection SQL via filtre
+    const maliciosQueryRes = await client.db
+      .from('tasks')
+      .eq('title', "'; DROP TABLE tasks; --")
+      .select('*')
+
+    expect(maliciosQueryRes.error).toBeNull() // Sûr grâce à la paramétrisation PostgREST
+
+    // Vérifier que la table 'tasks' existe toujours
+    const probeRes = await client.db.from('tasks').select('*')
+    expect(probeRes.error).toBeNull()
+  })
+
+  it('devrait exécuter des requêtes concurrentes saines (saturation de charge)', async () => {
+    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
+      auth: { persistSession: false },
+    })
+
+    const requests = Array.from({ length: 50 }).map((_, idx) =>
+      client.db.from('tasks').insert({
+        title: `Tâche concurrente ${idx}`,
+        owner_id: `owner_${idx}`,
+      })
+    )
+
+    const startTime = performance.now()
+    const results = await Promise.all(requests)
+    const duration = performance.now() - startTime
+
+    console.log(`[PERF] 50 requêtes concurrentes d'insertion exécutées en ${duration.toFixed(1)}ms`)
+
+    // Vérifier que toutes les requêtes ont réussi
+    for (const r of results) {
+      expect(r.error).toBeNull()
+    }
+
+    // Vérifier que 50 lignes ont bien été insérées
+    const selectRes = await client.db.from('tasks').select('*')
+    expect(selectRes.data?.length).toBe(50)
+  })
+
+  it('devrait gérer proprement les transactions SQL brutes (Commit & Rollback)', async () => {
+    const client = createClient(GATEWAY_URL, projectId, serviceKey, {
+      auth: { persistSession: false },
+    })
+
+    // 1. Test du ROLLBACK : exécuter BEGIN, INSERT et ROLLBACK dans un seul bloc multi-statement
+    const txRollbackRes = await client.db.sql(
+      `BEGIN;
+       INSERT INTO tasks (title, owner_id) VALUES ('Task Tx Rollback', 'owner_tx');
+       ROLLBACK;`
+    )
+    expect(txRollbackRes.error).toBeNull()
+
+    // La ligne ne doit pas exister dans la base
+    const selectPostRollback = await client.db.from('tasks').eq('title', 'Task Tx Rollback')
+    expect(selectPostRollback.data?.length).toBe(0)
+
+    // 2. Test du COMMIT : exécuter BEGIN, INSERT et COMMIT dans un seul bloc
+    const txCommitRes = await client.db.sql(
+      `BEGIN;
+       INSERT INTO tasks (title, owner_id) VALUES ('Task Tx Commit', 'owner_tx');
+       COMMIT;`
+    )
+    expect(txCommitRes.error).toBeNull()
+
+    // La ligne doit exister
+    const selectPostCommit = await client.db.from('tasks').eq('title', 'Task Tx Commit')
+    expect(selectPostCommit.data?.length).toBe(1)
+  })
+})

package/packages/aurabase/tests/public-api-surface.test.ts

@@ -0,0 +1,53 @@
+import { describe, it, expect } from 'vitest'
+import * as root from '../src/index'
+import * as ssr from '../src/ssr'
+
+describe('surface publique du meta-package aurabase', () => {
+  it('exporte exactement les symboles runtime attendus depuis la racine', () => {
+    const actual = Object.keys(root).sort()
+    const expected = [
+      'AiService',
+      'AuraChannel',
+      'AuraClient',
+      'AuraError',
+      'AuthAdminService',
+      'AuthService',
+      'BaseAuthStore',
+      'DatabaseService',
+      'FunctionsService',
+      'LocalAuthStore',
+      'NotificationsService',
+      'NotificationsAdminService',
+      'QueryBuilder',
+      'RealtimeService',
+      'StorageService',
+      'createAdminClient',
+      'createClient',
+      'isAuraError',
+      'isMfaChallenge',
+    ].sort()
+    expect(actual).toEqual(expected)
+  })
+
+  it('createClient fabrique un AuraClient fonctionnel', () => {
+    const client = root.createClient('http://localhost:8080', 'proj-1', 'aura_anon_x')
+    expect(client).toBeInstanceOf(root.AuraClient)
+    expect(client.baseUrl).toBe('http://localhost:8080')
+    expect(client.projectId).toBe('proj-1')
+    // sous-clients accessibles
+    expect(client.auth).toBeInstanceOf(root.AuthService)
+    expect(client.db).toBeInstanceOf(root.DatabaseService)
+    expect(client.storage).toBeInstanceOf(root.StorageService)
+    expect(client.functions).toBeInstanceOf(root.FunctionsService)
+    expect(client.ai).toBeInstanceOf(root.AiService)
+    expect(client.notifications).toBeInstanceOf(root.NotificationsService)
+    expect(client.realtime).toBeInstanceOf(root.RealtimeService)
+  })
+
+  it('exporte les helpers SSR', () => {
+    const actual = Object.keys(ssr).sort()
+    expect(actual).toEqual(
+      ['createBrowserClient', 'createServerClient', 'parseCookieHeader', 'serializeCookieHeader'].sort(),
+    )
+  })
+})

package/packages/aurabase/tests/query-builder.test.ts

@@ -0,0 +1,329 @@
+// ---------------------------------------------------------------------------
+// QueryBuilder tests -- verify query string compilation for all operators
+// ---------------------------------------------------------------------------
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { AuraClient } from '../src/AuraClient'
+import { QueryBuilder } from '@aurabase/db'
+import { FetchMock, fakeTokenPair } from './mocks'
+
+const BASE = 'http://localhost:8080'
+const PROJECT = 'test-project'
+
+let fetchMock: FetchMock
+let client: AuraClient
+
+beforeEach(() => {
+  fetchMock = new FetchMock()
+  fetchMock.init()
+  client = new AuraClient(BASE, PROJECT, {
+    auth: { persistSession: false },
+  })
+  // Pre-populate auth so fetchWithAuth does not try to refresh
+  const tp = fakeTokenPair()
+  client.authStore.save(tp.access_token, tp.refresh_token, tp.user)
+})
+
+afterEach(() => {
+  fetchMock.restore()
+  fetchMock.clearMocks()
+})
+
+/** Helper: build a QueryBuilder for a table and return its query string. */
+function qs(configure: (qb: QueryBuilder) => void): string {
+  const qb = new QueryBuilder(client, `/v1/db/${PROJECT}/posts`)
+  configure(qb)
+  return qb.buildQueryString()
+}
+
+// ---------------------------------------------------------------------------
+// Filter operators
+// ---------------------------------------------------------------------------
+
+describe('QueryBuilder filters', () => {
+  it('eq produces col=eq.val', () => {
+    const q = qs((qb) => qb.eq('status', 'active'))
+    expect(q).toContain('status=eq.active')
+  })
+
+  it('neq produces col=neq.val', () => {
+    const q = qs((qb) => qb.neq('status', 'deleted'))
+    expect(q).toContain('status=neq.deleted')
+  })
+
+  it('gt produces col=gt.val', () => {
+    const q = qs((qb) => qb.gt('age', 18))
+    expect(q).toContain('age=gt.18')
+  })
+
+  it('gte produces col=gte.val', () => {
+    const q = qs((qb) => qb.gte('score', 90))
+    expect(q).toContain('score=gte.90')
+  })
+
+  it('lt produces col=lt.val', () => {
+    const q = qs((qb) => qb.lt('price', 100))
+    expect(q).toContain('price=lt.100')
+  })
+
+  it('lte produces col=lte.val', () => {
+    const q = qs((qb) => qb.lte('price', 50))
+    expect(q).toContain('price=lte.50')
+  })
+
+  it('in produces col=in.(a,b,c)', () => {
+    const q = qs((qb) => qb.in('id', [1, 2, 3]))
+    expect(q).toContain('id=in.%281%2C2%2C3%29')
+    // Decoded: id=in.(1,2,3)
+    expect(decodeURIComponent(q)).toContain('id=in.(1,2,3)')
+  })
+
+  it('like produces col=like.pattern', () => {
+    const q = qs((qb) => qb.like('name', '%john%'))
+    expect(decodeURIComponent(q)).toContain('name=like.%john%')
+  })
+
+  it('ilike produces col=ilike.pattern', () => {
+    const q = qs((qb) => qb.ilike('name', '%JOHN%'))
+    expect(decodeURIComponent(q)).toContain('name=ilike.%JOHN%')
+  })
+
+  it('is(col, null) produces col=is.null', () => {
+    const q = qs((qb) => qb.is('deleted_at', 'null'))
+    expect(q).toContain('deleted_at=is.null')
+  })
+
+  it('is(col, not_null) produces col=is.not_null', () => {
+    const q = qs((qb) => qb.is('email', 'not_null'))
+    expect(q).toContain('email=is.not_null')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// OR groups
+// ---------------------------------------------------------------------------
+
+describe('QueryBuilder or()', () => {
+  it('produces or=(col1.eq.val1,col2.gt.val2)', () => {
+    const q = qs((qb) =>
+      qb.or([
+        { column: 'status', op: 'eq', value: 'active' },
+        { column: 'priority', op: 'gt', value: 5 },
+      ]),
+    )
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('or=(status.eq.active,priority.gt.5)')
+  })
+
+  it('supports in operator inside or group', () => {
+    const q = qs((qb) =>
+      qb.or([{ column: 'id', op: 'in', value: [1, 2] }]),
+    )
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('or=(id.in.(1,2))')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Select
+// ---------------------------------------------------------------------------
+
+describe('QueryBuilder select()', () => {
+  it('select("id, title") compiles to select=id,title', () => {
+    const q = qs((qb) => qb.select('id, title'))
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('select=id,title')
+  })
+
+  it('select(["id","title"]) works the same', () => {
+    const q = qs((qb) => qb.select(['id', 'title']))
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('select=id,title')
+  })
+
+  it('select("*") omits the select param', () => {
+    const q = qs((qb) => qb.select('*'))
+    expect(q).not.toContain('select=')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Order / Pagination
+// ---------------------------------------------------------------------------
+
+describe('QueryBuilder order / limit / offset', () => {
+  it('order("created_at", "desc") produces sort_by + sort_order', () => {
+    const q = qs((qb) => qb.order('created_at', 'desc'))
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('sort_by=created_at')
+    expect(decoded).toContain('sort_order=desc')
+  })
+
+  it('limit(10).offset(20) produces limit=10&offset=20', () => {
+    const q = qs((qb) => qb.limit(10).offset(20))
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('limit=10')
+    expect(decoded).toContain('offset=20')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Count
+// ---------------------------------------------------------------------------
+
+describe('QueryBuilder count()', () => {
+  it('count("exact") adds count=exact', () => {
+    const q = qs((qb) => qb.count('exact'))
+    expect(q).toContain('count=exact')
+  })
+
+  it('count("estimated") adds count=estimated', () => {
+    const q = qs((qb) => qb.count('estimated'))
+    expect(q).toContain('count=estimated')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// single() and throwOnError()
+// ---------------------------------------------------------------------------
+
+describe('QueryBuilder single()', () => {
+  it('sets limit to 1 and unwraps the first element', async () => {
+    const rows = [{ id: '1', title: 'Hello' }]
+    fetchMock.on({
+      method: 'GET',
+      url: /\/posts\?/,
+      replyCode: 200,
+      replyBody: { data: rows },
+    })
+
+    const res = await client.db.from('posts').eq('id', '1').single()
+
+    expect(res.data).toEqual({ id: '1', title: 'Hello' })
+  })
+
+  it('returns null when array is empty', async () => {
+    fetchMock.on({
+      method: 'GET',
+      url: /\/posts\?/,
+      replyCode: 200,
+      replyBody: { data: [] },
+    })
+
+    const res = await client.db.from('posts').eq('id', 'nonexistent').single()
+
+    expect(res.data).toBeNull()
+  })
+})
+
+describe('QueryBuilder throwOnError()', () => {
+  it('throws an error when response has error', async () => {
+    fetchMock.on({
+      method: 'GET',
+      url: /\/posts/,
+      replyCode: 500,
+      replyBody: { error: { code: 'internal', message: 'DB down' } },
+    })
+
+    await expect(
+      client.db.from('posts').throwOnError(),
+    ).rejects.toThrow('DB down')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Chained combinations
+// ---------------------------------------------------------------------------
+
+describe('QueryBuilder chained combinations', () => {
+  it('combines select + filters + order + pagination', () => {
+    const q = qs((qb) =>
+      qb
+        .select('id, title, created_at')
+        .eq('published', true)
+        .gt('views', 100)
+        .order('created_at', 'desc')
+        .limit(10)
+        .offset(0),
+    )
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('select=id,title,created_at')
+    expect(decoded).toContain('published=eq.true')
+    expect(decoded).toContain('views=gt.100')
+    expect(decoded).toContain('sort_by=created_at')
+    expect(decoded).toContain('sort_order=desc')
+    expect(decoded).toContain('limit=10')
+    expect(decoded).toContain('offset=0')
+  })
+
+  it('combines multiple filters with or group', () => {
+    const q = qs((qb) =>
+      qb
+        .eq('type', 'post')
+        .or([
+          { column: 'status', op: 'eq', value: 'published' },
+          { column: 'status', op: 'eq', value: 'draft' },
+        ]),
+    )
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('type=eq.post')
+    expect(decoded).toContain('or=(status.eq.published,status.eq.draft)')
+  })
+})
+
+// ---------------------------------------------------------------------------
+// Resource Embedding (PostgREST parity)
+// ---------------------------------------------------------------------------
+
+describe('QueryBuilder resource embedding', () => {
+  it('select with embed passes raw string to ?select=', () => {
+    const q = qs((qb) => qb.select('*,customer:customers(name,email)'))
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('select=*,customer:customers(name,email)')
+  })
+
+  it('select with one-to-many embed', () => {
+    const q = qs((qb) => qb.select('last_name,films(title,year)'))
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('select=last_name,films(title,year)')
+  })
+
+  it('select with FK hint', () => {
+    const q = qs((qb) =>
+      qb.select('*,billing:addresses!billing_address_id(name),shipping:addresses!shipping_address_id(name)'),
+    )
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('billing:addresses!billing_address_id(name)')
+    expect(decoded).toContain('shipping:addresses!shipping_address_id(name)')
+  })
+
+  it('select with nested embedding', () => {
+    const q = qs((qb) => qb.select('first_name,roles(character,films(title))'))
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('select=first_name,roles(character,films(title))')
+  })
+
+  it('select with embed + filters + pagination', () => {
+    const q = qs((qb) =>
+      qb
+        .select('*,customer:customers(name)')
+        .eq('status', 'active')
+        .limit(10),
+    )
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('select=*,customer:customers(name)')
+    expect(decoded).toContain('status=eq.active')
+    expect(decoded).toContain('limit=10')
+  })
+
+  it('select star returns no select param', () => {
+    const q = qs((qb) => qb.select('*'))
+    expect(q).toBe('')  // no params = select all
+  })
+
+  it('select with array still joins with comma', () => {
+    const q = qs((qb) => qb.select(['id', 'name', 'email']))
+    const decoded = decodeURIComponent(q)
+    expect(decoded).toContain('select=id,name,email')
+  })
+})