@aurabase/aurabase-js 0.3.0

package/packages/auth/tests/auth-lifecycle.test.ts

@@ -0,0 +1,149 @@
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest'
+import { AuthService } from '../src/AuthService'
+import { BaseAuthStore } from '@aurabase/core'
+import type { AuraClientLike, User } from '@aurabase/core'
+
+// --- helpers inline (évite un mocks.ts dédié au package auth) ----------------
+function b64url(obj: unknown): string {
+  return btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+function validJwt(): string {
+  const exp = Math.floor(Date.now() / 1000) + 3600
+  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub: 'u1', exp })}.sig`
+}
+function fakeUser(): User {
+  return {
+    id: 'u1', email: 't@e.com', role: 'authenticated', email_verified: true,
+    is_banned: false, is_anonymous: false, mfa_enabled: false,
+    user_metadata: {}, app_metadata: {}, created_at: '2025-01-01T00:00:00Z',
+  }
+}
+
+// --- mock BroadcastChannel ---------------------------------------------------
+class FakeBC {
+  static instances: FakeBC[] = []
+  onmessage: ((e: { data: unknown }) => void) | null = null
+  posted: unknown[] = []
+  closed = false
+  constructor(public name: string) { FakeBC.instances.push(this) }
+  postMessage(d: unknown) { this.posted.push(d) }
+  close() { this.closed = true }
+}
+
+beforeEach(() => {
+  FakeBC.instances = []
+  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
+})
+afterEach(() => {
+  vi.useRealTimers()
+  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
+})
+
+function newAuth(store: BaseAuthStore) {
+  const client: AuraClientLike = {
+    baseUrl: 'http://x', projectId: 'p', apiKey: 'k',
+    fetchFn: (async () => new Response('{}', { status: 200 })) as unknown as typeof globalThis.fetch,
+    authStore: store,
+    auth: null as unknown as AuraClientLike['auth'],
+  }
+  const svc = new AuthService(client, { autoRefresh: true, persistSession: true, forceEnabled: true })
+  ;(client as { auth: unknown }).auth = svc
+  return { svc, client }
+}
+
+describe('AuthService — cycle de vie session', () => {
+  it('sign-in (save) démarre le ticker et broadcaste', () => {
+    vi.useFakeTimers()
+    const store = new BaseAuthStore()
+    const { svc } = newAuth(store)
+    store.save(validJwt(), 'rt', fakeUser())
+    expect((svc as unknown as { _sessionManager: { isActive: boolean } })._sessionManager.isActive).toBe(true)
+    expect(FakeBC.instances[0].posted.length).toBe(1)
+  })
+
+  it('sign-out (clear) arrête le ticker', () => {
+    const store = new BaseAuthStore()
+    const { svc } = newAuth(store)
+    store.save(validJwt(), 'rt', fakeUser())
+    store.clear()
+    expect((svc as unknown as { _sessionManager: { isActive: boolean } })._sessionManager.isActive).toBe(false)
+  })
+
+  it('réception d’un logout distant → SIGNED_OUT local + store vidé, sans rebroadcast', () => {
+    const store = new BaseAuthStore()
+    store.save(validJwt(), 'rt', fakeUser())
+    const { svc } = newAuth(store)
+    const events: string[] = []
+    svc.onAuthStateChange(({ event }) => events.push(event))
+    const bc = FakeBC.instances[0]
+    const before = bc.posted.length
+    bc.onmessage!({ data: null }) // null = signed out
+    expect(store.token).toBeNull()
+    expect(events).toContain('SIGNED_OUT')
+    expect(bc.posted.length).toBe(before) // pas de rebroadcast
+  })
+
+  it('dispose() coupe le ticker, ferme le canal, vide les listeners', async () => {
+    const store = new BaseAuthStore()
+    const { svc } = newAuth(store)
+    store.save(validJwt(), 'rt', fakeUser())
+    const cb = vi.fn()
+    svc.onAuthStateChange(cb)
+    svc.dispose()
+    expect((svc as unknown as { _sessionManager: { isActive: boolean } })._sessionManager.isActive).toBe(false)
+    expect(FakeBC.instances[0].closed).toBe(true)
+    await Promise.resolve() // flush le microtask INITIAL_SESSION
+    expect(cb).not.toHaveBeenCalled() // listeners vidés → aucun event
+  })
+
+  // --- Correctifs post-audit ---
+
+  it('F2 : onAuthStateChange APRÈS dispose() n’émet rien', async () => {
+    const store = new BaseAuthStore()
+    const { svc } = newAuth(store)
+    svc.dispose()
+    const cb = vi.fn()
+    svc.onAuthStateChange(cb) // abonnement après dispose
+    await Promise.resolve()
+    expect(cb).not.toHaveBeenCalled()
+  })
+
+  it('F3 : un user placeholder (sans id) n’est PAS broadcasté', () => {
+    const store = new BaseAuthStore()
+    newAuth(store)
+    const bc = FakeBC.instances[0]
+    store.save(validJwt(), 'rt', {} as User) // placeholder incomplet (setSession)
+    expect(bc.posted.length).toBe(0) // rien diffusé
+    store.save(validJwt(), 'rt', fakeUser()) // état complet
+    expect(bc.posted.length).toBe(1)
+  })
+
+  it('F4 : un message distant malformé est ignoré (store inchangé, aucun event)', () => {
+    const store = new BaseAuthStore()
+    store.save(validJwt(), 'rt', fakeUser())
+    const { svc } = newAuth(store)
+    const events: string[] = []
+    svc.onAuthStateChange(({ event }) => events.push(event))
+    const before = store.token
+    FakeBC.instances[0].onmessage!({ data: { foo: 1 } }) // malformé
+    FakeBC.instances[0].onmessage!({ data: { token: 123, refreshToken: 'x', user: {} } }) // token non-string
+    expect(store.token).toBe(before) // inchangé
+    expect(events.filter((e) => e !== 'INITIAL_SESSION')).toEqual([]) // aucun event applicatif
+  })
+
+  it('F6 : inférence d’événement distant (SIGNED_IN / TOKEN_REFRESHED / USER_UPDATED)', () => {
+    // Tokens explicitement distincts : _applyRemoteState compare des strings (pas de décodage JWT).
+    const store = new BaseAuthStore()
+    const { svc } = newAuth(store)
+    const events: string[] = []
+    svc.onAuthStateChange(({ event }) => { if (event !== 'INITIAL_SESSION') events.push(event) })
+    const bc = FakeBC.instances[0]
+    // 1) pas de session → login distant
+    bc.onmessage!({ data: { token: 'tokA', refreshToken: 'rt', user: fakeUser() } })
+    // 2) même token, user modifié → USER_UPDATED
+    bc.onmessage!({ data: { token: 'tokA', refreshToken: 'rt', user: { ...fakeUser(), email: 'new@e.com' } } })
+    // 3) token différent → TOKEN_REFRESHED
+    bc.onmessage!({ data: { token: 'tokB', refreshToken: 'rt2', user: fakeUser() } })
+    expect(events).toEqual(['SIGNED_IN', 'USER_UPDATED', 'TOKEN_REFRESHED'])
+  })
+})

package/packages/auth/tests/detect-session.test.ts

@@ -0,0 +1,361 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { AuthService } from '../src/AuthService'
+import { BaseAuthStore, LocalAuthStore } from '@aurabase/core'
+import type { AuraClientLike, User } from '@aurabase/core'
+
+// --- helpers -----------------------------------------------------------------
+
+function fakeUser(id = 'u1'): User {
+  return {
+    id,
+    email: 't@e.com',
+    role: 'authenticated',
+    email_verified: true,
+    is_banned: false,
+    is_anonymous: false,
+    mfa_enabled: false,
+    user_metadata: {},
+    app_metadata: {},
+    created_at: '2025-01-01T00:00:00Z',
+  }
+}
+
+class FakeBC {
+  static instances: FakeBC[] = []
+  onmessage: ((e: { data: unknown }) => void) | null = null
+  posted: unknown[] = []
+  closed = false
+  constructor(public name: string) {
+    FakeBC.instances.push(this)
+  }
+  postMessage(d: unknown) {
+    this.posted.push(d)
+  }
+  close() {
+    this.closed = true
+  }
+}
+
+function b64url(obj: unknown): string {
+  return btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+/** JWT non expiré (signature factice — non vérifiée localement en HS256). */
+function jwt(sub = 'u1', ttlSec = 3600): string {
+  const exp = Math.floor(Date.now() / 1000) + ttlSec
+  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub, exp })}.sig`
+}
+
+const VERIFIER_KEY = 'aura-proj-1-pkce-code-verifier'
+
+beforeEach(() => {
+  FakeBC.instances = []
+  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
+})
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
+  delete (globalThis as unknown as { window?: unknown }).window
+  delete (globalThis as unknown as { localStorage?: unknown }).localStorage
+})
+
+function makeAuth(
+  fetchFn: typeof globalThis.fetch = (async () =>
+    new Response('{}', { status: 200 })) as unknown as typeof globalThis.fetch,
+  store: BaseAuthStore = new BaseAuthStore(),
+) {
+  // Construit HORS navigateur (pas de window) → le constructeur ne déclenche pas
+  // _detectSessionInUrl ; on le pilote explicitement dans chaque test.
+  const client: AuraClientLike = {
+    baseUrl: 'http://detect.local',
+    projectId: 'proj-1',
+    apiKey: 'k',
+    fetchFn,
+    authStore: store,
+    auth: null as unknown as AuraClientLike['auth'],
+  }
+  const svc = new AuthService(client, { autoRefresh: false, persistSession: false })
+  ;(client as { auth: unknown }).auth = svc
+  return { svc, client, store }
+}
+
+function setWindow(opts: { hash?: string; search?: string; pathname?: string }) {
+  const replaceState = vi.fn()
+  ;(globalThis as unknown as { window: unknown }).window = {
+    location: {
+      hash: opts.hash ?? '',
+      search: opts.search ?? '',
+      pathname: opts.pathname ?? '/app',
+    },
+    history: { replaceState },
+  }
+  return replaceState
+}
+
+// --- detectSessionInUrl -------------------------------------------------------
+
+const INITIATED_KEY = 'aura-proj-1-oauth-implicit-initiated'
+
+describe('AuthService._detectSessionInUrl — callback OAuth au boot', () => {
+  it('fragment implicit (#access_token) AVEC marqueur d’initiation → setSession + URL nettoyée', async () => {
+    const store = new BaseAuthStore()
+    // SEC-F3 : le SDK a initié le flux (marqueur posé par signInWithOAuth).
+    store.setItem(INITIATED_KEY, '1')
+    const { svc } = makeAuth(undefined, store)
+    const setSession = vi
+      .spyOn(svc, 'setSession')
+      .mockResolvedValue({ data: fakeUser(), error: null })
+    const replaceState = setWindow({
+      hash: '#access_token=AT123&refresh_token=RT456&expires_in=3600&token_type=bearer',
+      search: '',
+      pathname: '/callback',
+    })
+
+    await svc._detectSessionInUrl()
+
+    expect(setSession).toHaveBeenCalledWith('AT123', 'RT456')
+    // Marqueur à usage unique : purgé après adoption.
+    expect(store.getItem(INITIATED_KEY)).toBeNull()
+    // URL nettoyée : replaceState appelé, plus aucun token dans l'URL cible.
+    expect(replaceState).toHaveBeenCalledTimes(1)
+    const cleaned = String(replaceState.mock.calls[0]![2])
+    expect(cleaned).not.toContain('access_token')
+    expect(cleaned).toBe('/callback')
+  })
+
+  it('query PKCE (?code) → exchangeCodeForSession(code) + code/state retirés de l’URL', async () => {
+    const { svc } = makeAuth()
+    const exchange = vi
+      .spyOn(svc, 'exchangeCodeForSession')
+      .mockResolvedValue({ data: null, error: null })
+    const replaceState = setWindow({
+      hash: '',
+      search: '?code=AUTHCODE&state=xyz&foo=bar',
+      pathname: '/auth/callback',
+    })
+
+    await svc._detectSessionInUrl()
+
+    expect(exchange).toHaveBeenCalledWith('AUTHCODE')
+    expect(replaceState).toHaveBeenCalledTimes(1)
+    const cleaned = String(replaceState.mock.calls[0]![2])
+    expect(cleaned).not.toContain('code=')
+    expect(cleaned).not.toContain('state=')
+    // Les autres query params sont préservés.
+    expect(cleaned).toContain('foo=bar')
+  })
+
+  it('URL sans token ni code → no-op (aucun setSession/exchange, aucun nettoyage)', async () => {
+    const { svc } = makeAuth()
+    const setSession = vi.spyOn(svc, 'setSession')
+    const exchange = vi.spyOn(svc, 'exchangeCodeForSession')
+    const replaceState = setWindow({ hash: '', search: '?foo=bar' })
+
+    await svc._detectSessionInUrl()
+
+    expect(setSession).not.toHaveBeenCalled()
+    expect(exchange).not.toHaveBeenCalled()
+    expect(replaceState).not.toHaveBeenCalled()
+  })
+
+  it('SEC-F3 : fragment implicit SANS marqueur d’initiation (injecté par un attaquant) → NON adopté (aucun setSession)', async () => {
+    const store = new BaseAuthStore() // pas de marqueur : flux NON initié par ce SDK
+    const { svc } = makeAuth(undefined, store)
+    const setSession = vi.spyOn(svc, 'setSession')
+    const replaceState = setWindow({
+      hash: '#access_token=ATTACKER&refresh_token=RTATT&token_type=bearer',
+      pathname: '/callback',
+    })
+
+    await svc._detectSessionInUrl()
+
+    // Session fixation évitée : le fragment forgé n'est jamais consommé.
+    expect(setSession).not.toHaveBeenCalled()
+    expect(replaceState).not.toHaveBeenCalled()
+    expect(store.token).toBeNull()
+  })
+
+  it('SEC-F3 : marqueur à usage unique — un 2e fragment (rejeu) après adoption n’est plus adopté', async () => {
+    const store = new BaseAuthStore()
+    store.setItem(INITIATED_KEY, '1')
+    const { svc } = makeAuth(undefined, store)
+    const setSession = vi
+      .spyOn(svc, 'setSession')
+      .mockResolvedValue({ data: fakeUser(), error: null })
+    setWindow({
+      hash: '#access_token=AT1&refresh_token=RT1&token_type=bearer',
+      pathname: '/cb',
+    })
+
+    await svc._detectSessionInUrl() // 1er passage : marqueur présent → adopté + purgé
+    expect(setSession).toHaveBeenCalledTimes(1)
+
+    await svc._detectSessionInUrl() // 2e passage : marqueur purgé → plus adopté
+    expect(setSession).toHaveBeenCalledTimes(1)
+  })
+
+  it('SEC-F3 : signInWithOAuth (flux implicit) POSE le marqueur d’initiation avant le redirect', async () => {
+    const store = new LocalAuthStore('aurabase_auth')
+    // localStorage minimal (persistant → survit au redirect simulé).
+    const mem = new Map<string, string>()
+    ;(globalThis as unknown as { localStorage: unknown }).localStorage = {
+      get length() {
+        return mem.size
+      },
+      key: (i: number) => Array.from(mem.keys())[i] ?? null,
+      getItem: (k: string) => (mem.has(k) ? mem.get(k)! : null),
+      setItem: (k: string, v: string) => void mem.set(k, v),
+      removeItem: (k: string) => void mem.delete(k),
+      clear: () => mem.clear(),
+    }
+    ;(globalThis as unknown as { window: unknown }).window = { location: { href: '' } }
+    const { svc } = makeAuth(undefined, store)
+
+    await svc.signInWithOAuth('google', { redirectTo: 'http://app/cb' })
+
+    // Marqueur posé (preuve d'initiation) — le fragment retour sera adoptable.
+    expect(store.getItem(INITIATED_KEY)).toBe('1')
+  })
+
+  it('SEC-F3 : flux PKCE (?code) reste adopté SANS marqueur implicit (lié au code_verifier)', async () => {
+    const store = new BaseAuthStore() // aucun marqueur implicit
+    const { svc } = makeAuth(undefined, store)
+    const exchange = vi
+      .spyOn(svc, 'exchangeCodeForSession')
+      .mockResolvedValue({ data: null, error: null })
+    setWindow({ hash: '', search: '?code=PKCECODE', pathname: '/cb' })
+
+    await svc._detectSessionInUrl()
+
+    // PKCE est déjà lié cryptographiquement au verifier → inchangé par SEC-F3.
+    expect(exchange).toHaveBeenCalledWith('PKCECODE')
+  })
+
+  it('hors navigateur (SSR/Node, pas de window) → no-op, ne throw pas', async () => {
+    const { svc } = makeAuth()
+    const setSession = vi.spyOn(svc, 'setSession')
+    const exchange = vi.spyOn(svc, 'exchangeCodeForSession')
+    // pas de window
+    await expect(svc._detectSessionInUrl()).resolves.toBeUndefined()
+    expect(setSession).not.toHaveBeenCalled()
+    expect(exchange).not.toHaveBeenCalled()
+  })
+
+  it('déclenché au boot en navigateur quand détecté (constructeur)', async () => {
+    // window AVANT construction → le constructeur appelle _detectSessionInUrl.
+    const at = jwt('u1')
+    setWindow({
+      hash: `#access_token=${at}&refresh_token=RT&token_type=bearer`,
+      pathname: '/cb',
+    })
+    const store = new BaseAuthStore()
+    // SEC-F3 : le flux a été initié par ce SDK (marqueur présent avant le retour OAuth).
+    store.setItem('aura-proj-1-oauth-implicit-initiated', '1')
+    let userCalls = 0
+    const fetchFn = (async (url: string) => {
+      if (String(url).includes('/user')) {
+        userCalls++
+        return new Response(JSON.stringify({ data: fakeUser() }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      return new Response('{}', { status: 200 })
+    }) as unknown as typeof globalThis.fetch
+    const client: AuraClientLike = {
+      baseUrl: 'http://detect.local',
+      projectId: 'proj-1',
+      apiKey: 'k',
+      fetchFn,
+      authStore: store,
+      auth: null as unknown as AuraClientLike['auth'],
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const svc = new AuthService(client, { autoRefresh: false, persistSession: true })
+    ;(client as { auth: unknown }).auth = svc
+    // Laisse le microtask/await du detect se dérouler.
+    await new Promise((r) => setTimeout(r, 0))
+    expect(userCalls).toBeGreaterThanOrEqual(1)
+    expect(store.token).toBe(at)
+  })
+})
+
+// --- Purge PKCE ---------------------------------------------------------------
+
+describe('Purge du code_verifier PKCE', () => {
+  it('BaseAuthStore.clear() vide aussi le stockage clé/valeur (_kv)', () => {
+    const store = new BaseAuthStore()
+    store.setItem(VERIFIER_KEY, 'verifier-value')
+    store.setItem('other', 'x')
+    expect(store.getItem(VERIFIER_KEY)).toBe('verifier-value')
+
+    store.clear()
+
+    expect(store.getItem(VERIFIER_KEY)).toBeNull()
+    expect(store.getItem('other')).toBeNull()
+  })
+
+  it('signOut purge le code_verifier (via clear)', async () => {
+    const store = new BaseAuthStore()
+    const { svc } = makeAuth(undefined, store)
+    store.setItem(VERIFIER_KEY, 'verifier-value')
+
+    await svc.signOut()
+
+    expect(store.getItem(VERIFIER_KEY)).toBeNull()
+  })
+
+  it('exchangeCodeForSession en ÉCHEC purge quand même le verifier (usage unique)', async () => {
+    const store = new BaseAuthStore()
+    store.setItem(VERIFIER_KEY, 'verifier-value')
+    const fetchFn = (async (url: string) => {
+      if (String(url).includes('/oauth/pkce')) {
+        return new Response(JSON.stringify({ error: { code: 'invalid_grant', message: 'bad code' } }), {
+          status: 400,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      return new Response('{}', { status: 200 })
+    }) as unknown as typeof globalThis.fetch
+    const { svc } = makeAuth(fetchFn, store)
+
+    const { error } = await svc.exchangeCodeForSession('auth-code')
+
+    expect(error).toBeTruthy()
+    // Purge inconditionnelle même à l'échec : plus de réutilisation possible.
+    expect(store.getItem(VERIFIER_KEY)).toBeNull()
+  })
+
+  it('LocalAuthStore.clear() supprime les clés PKCE de localStorage (multi-projets)', () => {
+    // localStorage minimal en mémoire.
+    const mem = new Map<string, string>()
+    ;(globalThis as unknown as { localStorage: unknown }).localStorage = {
+      get length() {
+        return mem.size
+      },
+      key: (i: number) => Array.from(mem.keys())[i] ?? null,
+      getItem: (k: string) => (mem.has(k) ? mem.get(k)! : null),
+      setItem: (k: string, v: string) => {
+        mem.set(k, v)
+      },
+      removeItem: (k: string) => {
+        mem.delete(k)
+      },
+      clear: () => mem.clear(),
+    }
+
+    const store = new LocalAuthStore('aurabase_auth')
+    store.setItem('aura-proj-1-pkce-code-verifier', 'v1')
+    store.setItem('aura-proj-2-pkce-code-verifier', 'v2')
+    store.setItem('unrelated-key', 'keep-me')
+    expect(mem.get('aura-proj-1-pkce-code-verifier')).toBe('v1')
+
+    store.clear()
+
+    expect(store.getItem('aura-proj-1-pkce-code-verifier')).toBeNull()
+    expect(mem.get('aura-proj-1-pkce-code-verifier')).toBeUndefined()
+    expect(mem.get('aura-proj-2-pkce-code-verifier')).toBeUndefined()
+    // Une clé non-PKCE n'est pas balayée par la purge.
+    expect(mem.get('unrelated-key')).toBe('keep-me')
+  })
+})