@aurabase/aurabase-js 0.3.0

package/packages/auth/tests/is-mfa-challenge.test.ts

@@ -0,0 +1,27 @@
+// ---------------------------------------------------------------------------
+// isMfaChallenge (LOT 3, 3.4) : garde de type exportée pour discriminer
+// `LoginResponse = TokenPair | MfaChallenge` côté consommateur.
+// ---------------------------------------------------------------------------
+
+import { describe, it, expect } from 'vitest'
+import { isMfaChallenge } from '../src/AuthService'
+
+describe('isMfaChallenge', () => {
+  it('reconnaît un MfaChallenge (mfa_required: true)', () => {
+    expect(isMfaChallenge({ mfa_required: true, mfa_token: 'tok' })).toBe(true)
+  })
+
+  it('rejette une TokenPair normale', () => {
+    expect(
+      isMfaChallenge({ access_token: 'a', refresh_token: 'b', token_type: 'bearer', expires_in: 3600 }),
+    ).toBe(false)
+  })
+
+  it('rejette les valeurs non-objet / null / mfa_required falsy', () => {
+    expect(isMfaChallenge(null)).toBe(false)
+    expect(isMfaChallenge(undefined)).toBe(false)
+    expect(isMfaChallenge('x')).toBe(false)
+    expect(isMfaChallenge({})).toBe(false)
+    expect(isMfaChallenge({ mfa_required: false })).toBe(false)
+  })
+})

package/packages/auth/tests/password-recovery.test.ts

@@ -0,0 +1,124 @@
+import { describe, it, expect, afterEach, vi } from 'vitest'
+import { AuthService } from '../src/AuthService'
+import { BaseAuthStore } from '@aurabase/core'
+import type { AuraClientLike, TokenPair, User, AuthEvent, AuthChangePayload } from '@aurabase/core'
+
+function fakeUser(id = 'u1'): User {
+  return { id, email: 't@e.com', phone: null, role: 'authenticated', email_verified: true, is_banned: false, is_anonymous: false, mfa_enabled: false, user_metadata: {}, app_metadata: {}, created_at: '2025-01-01T00:00:00Z' }
+}
+function tokenPair(): TokenPair {
+  return { access_token: 'AT', refresh_token: 'RT', token_type: 'bearer', expires_in: 3600, user: fakeUser() }
+}
+
+const VERIFIER_KEY = 'aura-proj-1-pkce-code-verifier'
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  delete (globalThis as unknown as { window?: unknown }).window
+})
+
+function makeAuth(store: BaseAuthStore) {
+  const fetchFn = (async (url: string) => {
+    if (String(url).includes('/oauth/pkce')) {
+      return new Response(JSON.stringify({ data: tokenPair() }), { status: 200, headers: { 'Content-Type': 'application/json' } })
+    }
+    return new Response('{}', { status: 200 })
+  }) as unknown as typeof globalThis.fetch
+  const client: AuraClientLike = {
+    baseUrl: 'http://x', projectId: 'proj-1', apiKey: 'k', authStore: store,
+    fetchFn, auth: null as unknown as AuraClientLike['auth'],
+  }
+  const svc = new AuthService(client, { autoRefresh: false, persistSession: false })
+  ;(client as { auth: unknown }).auth = svc
+  const payloads: AuthChangePayload[] = []
+  const events: AuthEvent[] = []
+  svc.onAuthStateChange((p) => {
+    payloads.push(p)
+    events.push(p.event)
+  })
+  return { svc, client, events, payloads }
+}
+
+function setWindow(opts: { search?: string; pathname?: string }) {
+  const replaceState = vi.fn()
+  ;(globalThis as unknown as { window: unknown }).window = {
+    location: { hash: '', search: opts.search ?? '', pathname: opts.pathname ?? '/app' },
+    history: { replaceState },
+  }
+  return replaceState
+}
+
+describe('AuthService — PASSWORD_RECOVERY (lien email ?token=…&type=recovery)', () => {
+  it('?token=X&type=recovery → PASSWORD_RECOVERY émis une fois avec recoveryToken=X, PAS SIGNED_IN, PAS de session, URL nettoyée', async () => {
+    const store = new BaseAuthStore()
+    const { svc, events, payloads } = makeAuth(store)
+    const replaceState = setWindow({
+      search: '?token=RCVTOKEN&project_id=proj-1&type=recovery',
+      pathname: '/reset-password',
+    })
+
+    await svc._detectSessionInUrl()
+    // Laisser filer d'éventuels microtasks.
+    await Promise.resolve()
+
+    const recoveryPayloads = payloads.filter((p) => p.event === 'PASSWORD_RECOVERY')
+    expect(recoveryPayloads).toHaveLength(1)
+    expect(recoveryPayloads[0]!.recoveryToken).toBe('RCVTOKEN')
+    expect(recoveryPayloads[0]!.user).toBeNull()
+    expect(recoveryPayloads[0]!.accessToken).toBeNull()
+
+    // AUCUNE connexion, AUCUNE session posée.
+    expect(events).not.toContain('SIGNED_IN')
+    expect(store.token).toBeNull()
+
+    // URL nettoyée (token/project_id/type retirés).
+    expect(replaceState).toHaveBeenCalledTimes(1)
+    const cleaned = String(replaceState.mock.calls[0]![2])
+    expect(cleaned).not.toContain('token=')
+    expect(cleaned).not.toContain('project_id=')
+    expect(cleaned).not.toContain('type=')
+  })
+
+  it('?code=… normal (sans type=recovery) → SIGNED_IN, PAS PASSWORD_RECOVERY (non-régression)', async () => {
+    const store = new BaseAuthStore()
+    store.setItem(VERIFIER_KEY, 'verifier-value')
+    const { svc, events } = makeAuth(store)
+    setWindow({ search: '?code=NORMALCODE', pathname: '/cb' })
+
+    await svc._detectSessionInUrl()
+    await Promise.resolve()
+
+    expect(events).toContain('SIGNED_IN')
+    expect(events).not.toContain('PASSWORD_RECOVERY')
+    expect(store.token).toBe('AT')
+  })
+
+  it('URL sans token ni code → aucun événement, no-op', async () => {
+    const store = new BaseAuthStore()
+    const { svc, events } = makeAuth(store)
+    setWindow({ search: '?foo=bar' })
+
+    await svc._detectSessionInUrl()
+    await Promise.resolve()
+
+    expect(events).not.toContain('PASSWORD_RECOVERY')
+    expect(events).not.toContain('SIGNED_IN')
+  })
+
+  it('type=recovery sans token → ignoré (no-op, pas de PASSWORD_RECOVERY)', async () => {
+    const store = new BaseAuthStore()
+    const { svc, events } = makeAuth(store)
+    setWindow({ search: '?type=recovery' })
+
+    await svc._detectSessionInUrl()
+    await Promise.resolve()
+
+    expect(events).not.toContain('PASSWORD_RECOVERY')
+  })
+
+  it('hors navigateur → no-op, ne throw pas', async () => {
+    const store = new BaseAuthStore()
+    const { svc } = makeAuth(store)
+    await expect(svc._detectSessionInUrl()).resolves.toBeUndefined()
+  })
+})

package/packages/auth/tests/pkce.test.ts

@@ -0,0 +1,192 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { AuthService } from '../src/AuthService'
+import { generateCodeVerifier, codeChallengeS256 } from '../src/pkce'
+import { BaseAuthStore } from '@aurabase/core'
+import type { AuraClientLike, User, TokenPair } from '@aurabase/core'
+
+// --- helpers -----------------------------------------------------------------
+
+function fakeUser(id = 'u1'): User {
+  return {
+    id,
+    email: 't@e.com',
+    role: 'authenticated',
+    email_verified: true,
+    is_banned: false,
+    is_anonymous: false,
+    mfa_enabled: false,
+    user_metadata: {},
+    app_metadata: {},
+    created_at: '2025-01-01T00:00:00Z',
+  }
+}
+
+class FakeBC {
+  static instances: FakeBC[] = []
+  onmessage: ((e: { data: unknown }) => void) | null = null
+  posted: unknown[] = []
+  closed = false
+  constructor(public name: string) {
+    FakeBC.instances.push(this)
+  }
+  postMessage(d: unknown) {
+    this.posted.push(d)
+  }
+  close() {
+    this.closed = true
+  }
+}
+
+beforeEach(() => {
+  FakeBC.instances = []
+  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
+})
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
+})
+
+function makeAuth(
+  fetchFn: typeof globalThis.fetch = (async () =>
+    new Response('{}', { status: 200 })) as unknown as typeof globalThis.fetch,
+  store = new BaseAuthStore(),
+) {
+  const client: AuraClientLike = {
+    baseUrl: 'http://pkce.local',
+    projectId: 'proj-1',
+    apiKey: 'k',
+    fetchFn,
+    authStore: store,
+    auth: null as unknown as AuraClientLike['auth'],
+  }
+  const svc = new AuthService(client, { autoRefresh: false, persistSession: false })
+  ;(client as { auth: unknown }).auth = svc
+  return { svc, client, store }
+}
+
+const VERIFIER_KEY = 'aura-proj-1-pkce-code-verifier'
+
+// --- pkce.ts -------------------------------------------------------------------
+
+describe('generateCodeVerifier', () => {
+  it('longueur dans [43, 128] et charset base64url', () => {
+    const v = generateCodeVerifier()
+    expect(v.length).toBeGreaterThanOrEqual(43)
+    expect(v.length).toBeLessThanOrEqual(128)
+    expect(v).toMatch(/^[A-Za-z0-9\-_]+$/)
+  })
+
+  it('deux appels produisent des valeurs différentes (aléatoire)', () => {
+    const a = generateCodeVerifier()
+    const b = generateCodeVerifier()
+    expect(a).not.toBe(b)
+  })
+})
+
+describe('codeChallengeS256', () => {
+  it('vecteur connu RFC 7636 Appendix B', async () => {
+    const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'
+    const expected = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM'
+    await expect(codeChallengeS256(verifier)).resolves.toBe(expected)
+  })
+})
+
+// --- Store setItem/getItem/removeItem -------------------------------------------
+
+describe('BaseAuthStore — stockage clé/valeur générique', () => {
+  it('setItem/getItem/removeItem round-trip', () => {
+    const store = new BaseAuthStore()
+    store.setItem('k', 'v')
+    expect(store.getItem('k')).toBe('v')
+    store.removeItem('k')
+    expect(store.getItem('k')).toBeNull()
+  })
+
+  it("getItem d'une clé absente renvoie null", () => {
+    const store = new BaseAuthStore()
+    expect(store.getItem('absent')).toBeNull()
+  })
+})
+
+// --- signInWithOAuth --------------------------------------------------------------
+
+describe('AuthService.signInWithOAuth — flux PKCE opt-in', () => {
+  it("flowType: 'pkce' → URL contient code_challenge + S256, store contient le verifier, cohérence verifier↔challenge", async () => {
+    const { svc, store } = makeAuth()
+    // Pas de `window` dans l'environnement de test par défaut (node) → pas de redirect.
+    const { data, error } = await svc.signInWithOAuth('github', { flowType: 'pkce' })
+
+    expect(error).toBeNull()
+    expect(data?.url).toContain('code_challenge=')
+    expect(data?.url).toContain('code_challenge_method=S256')
+
+    const storedVerifier = store.getItem(VERIFIER_KEY)
+    expect(storedVerifier).toBeTruthy()
+
+    const url = new URL(data!.url)
+    const challengeInUrl = url.searchParams.get('code_challenge')
+    const expectedChallenge = await codeChallengeS256(storedVerifier!)
+    expect(challengeInUrl).toBe(expectedChallenge)
+  })
+
+  it('sans flowType (implicite) → aucun paramètre PKCE, store vide', async () => {
+    const { svc, store } = makeAuth()
+
+    const { data, error } = await svc.signInWithOAuth('github')
+
+    expect(error).toBeNull()
+    expect(data?.url).not.toContain('code_challenge')
+    expect(store.getItem(VERIFIER_KEY)).toBeNull()
+  })
+})
+
+// --- exchangeCodeForSession --------------------------------------------------------
+
+describe('AuthService.exchangeCodeForSession — lecture/purge du verifier stocké', () => {
+  it('sans verifier explicite → lit le verifier stocké, POST /oauth/pkce avec ce code_verifier, purge à succès', async () => {
+    const store = new BaseAuthStore()
+    store.setItem(VERIFIER_KEY, 'stored-verifier-value')
+    const tokenPair: TokenPair = {
+      access_token: 'at',
+      refresh_token: 'rt',
+      user: fakeUser(),
+    }
+    let capturedBody: unknown = null
+    const fetchFn = (async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url)
+      if (u.includes('/oauth/pkce')) {
+        capturedBody = init?.body ? JSON.parse(String(init.body)) : null
+        return new Response(JSON.stringify({ data: tokenPair }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      return new Response('{}', { status: 200 })
+    }) as unknown as typeof globalThis.fetch
+    const { svc } = makeAuth(fetchFn, store)
+
+    const { data, error } = await svc.exchangeCodeForSession('auth-code-1')
+
+    expect(error).toBeNull()
+    expect(data?.access_token).toBe('at')
+    expect(capturedBody).toEqual({ auth_code: 'auth-code-1', code_verifier: 'stored-verifier-value' })
+    expect(store.getItem(VERIFIER_KEY)).toBeNull()
+  })
+
+  it('sans verifier stocké ni fourni → error no_code_verifier, pas de POST', async () => {
+    const store = new BaseAuthStore()
+    let called = false
+    const fetchFn = (async () => {
+      called = true
+      return new Response('{}', { status: 200 })
+    }) as unknown as typeof globalThis.fetch
+    const { svc } = makeAuth(fetchFn, store)
+
+    const { data, error } = await svc.exchangeCodeForSession('auth-code-2')
+
+    expect(data).toBeNull()
+    expect((error as { code?: string })?.code).toBe('no_code_verifier')
+    expect(called).toBe(false)
+  })
+})

package/packages/auth/tests/session-manager.test.ts

@@ -0,0 +1,103 @@
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest'
+import { SessionManager, type SessionManagerOptions } from '../src/SessionManager'
+
+// Mock minimal de BroadcastChannel
+class FakeBC {
+  static instances: FakeBC[] = []
+  onmessage: ((e: { data: unknown }) => void) | null = null
+  posted: unknown[] = []
+  closed = false
+  constructor(public name: string) {
+    FakeBC.instances.push(this)
+  }
+  postMessage(d: unknown) {
+    this.posted.push(d)
+  }
+  close() {
+    this.closed = true
+  }
+}
+
+beforeEach(() => {
+  FakeBC.instances = []
+  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
+})
+afterEach(() => {
+  vi.useRealTimers()
+  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
+})
+
+function make(overrides: Partial<SessionManagerOptions> = {}) {
+  const onTick = vi.fn()
+  let due = true
+  const onRemoteMessage = vi.fn()
+  const sm = new SessionManager({
+    channelName: 'aura-p-auth',
+    enabled: true,
+    onTick,
+    isRefreshDue: () => due,
+    onRemoteMessage,
+    tickMs: 1000,
+    ...overrides,
+  })
+  return { sm, onTick, onRemoteMessage, setDue: (v: boolean) => { due = v } }
+}
+
+describe('SessionManager', () => {
+  it('tick appelle onTick quand refresh dû, pas sinon', () => {
+    vi.useFakeTimers()
+    const { sm, onTick, setDue } = make()
+    sm.start()
+    sm.setActive(true)
+    vi.advanceTimersByTime(1000)
+    expect(onTick).toHaveBeenCalledTimes(1)
+    setDue(false)
+    vi.advanceTimersByTime(1000)
+    expect(onTick).toHaveBeenCalledTimes(1)
+  })
+
+  it('inactif → aucun tick', () => {
+    vi.useFakeTimers()
+    const { sm, onTick } = make()
+    sm.start()
+    sm.setActive(false)
+    vi.advanceTimersByTime(5000)
+    expect(onTick).not.toHaveBeenCalled()
+  })
+
+  it('broadcast poste sur le canal', () => {
+    const { sm } = make()
+    sm.start()
+    sm.broadcast({ hello: 1 })
+    expect(FakeBC.instances[0].posted).toEqual([{ hello: 1 }])
+  })
+
+  it('réception → onRemoteMessage', () => {
+    const { sm, onRemoteMessage } = make()
+    sm.start()
+    FakeBC.instances[0].onmessage!({ data: { x: 2 } })
+    expect(onRemoteMessage).toHaveBeenCalledWith({ x: 2 })
+  })
+
+  it('stop() coupe tout (canal fermé, plus de tick)', () => {
+    vi.useFakeTimers()
+    const { sm, onTick } = make()
+    sm.start()
+    sm.setActive(true)
+    sm.stop()
+    vi.advanceTimersByTime(5000)
+    expect(onTick).not.toHaveBeenCalled()
+    expect(FakeBC.instances[0].closed).toBe(true)
+    expect(sm.isActive).toBe(false)
+  })
+
+  it('enabled=false → pas de canal, pas de tick', () => {
+    vi.useFakeTimers()
+    const { sm, onTick } = make({ enabled: false })
+    sm.start()
+    sm.setActive(true)
+    vi.advanceTimersByTime(5000)
+    expect(onTick).not.toHaveBeenCalled()
+    expect(FakeBC.instances.length).toBe(0)
+  })
+})

package/packages/auth/tests/set-session.test.ts

@@ -0,0 +1,139 @@
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest'
+import { AuthService } from '../src/AuthService'
+import { BaseAuthStore, AuraError } from '@aurabase/core'
+import type { AuraClientLike, User } from '@aurabase/core'
+
+// --- helpers -----------------------------------------------------------------
+function b64url(obj: unknown): string {
+  return btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+/** JWT non expiré (paramétrable pour obtenir des tokens distincts). */
+function jwt(sub = 'u1', ttlSec = 3600): string {
+  const exp = Math.floor(Date.now() / 1000) + ttlSec
+  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub, exp })}.sig`
+}
+/** JWT déjà expiré. */
+function expiredJwt(sub = 'u1'): string {
+  const exp = Math.floor(Date.now() / 1000) - 60
+  return `${b64url({ alg: 'HS256', typ: 'JWT' })}.${b64url({ sub, exp })}.sig`
+}
+function fakeUser(id = 'u1'): User {
+  return {
+    id, email: 't@e.com', role: 'authenticated', email_verified: true,
+    is_banned: false, is_anonymous: false, mfa_enabled: false,
+    user_metadata: {}, app_metadata: {}, created_at: '2025-01-01T00:00:00Z',
+  }
+}
+
+class FakeBC {
+  static instances: FakeBC[] = []
+  onmessage: ((e: { data: unknown }) => void) | null = null
+  posted: unknown[] = []
+  closed = false
+  constructor(public name: string) { FakeBC.instances.push(this) }
+  postMessage(d: unknown) { this.posted.push(d) }
+  close() { this.closed = true }
+}
+
+beforeEach(() => {
+  FakeBC.instances = []
+  ;(globalThis as unknown as { BroadcastChannel: unknown }).BroadcastChannel = FakeBC
+})
+afterEach(() => {
+  vi.useRealTimers()
+  vi.restoreAllMocks()
+  delete (globalThis as unknown as { BroadcastChannel?: unknown }).BroadcastChannel
+})
+
+function newAuth(store: BaseAuthStore, fetchFn?: typeof globalThis.fetch) {
+  const client: AuraClientLike = {
+    baseUrl: 'http://x', projectId: 'p', apiKey: 'k',
+    fetchFn: (fetchFn ?? (async () => new Response('{}', { status: 200 }))) as unknown as typeof globalThis.fetch,
+    authStore: store,
+    auth: null as unknown as AuraClientLike['auth'],
+  }
+  const svc = new AuthService(client, { autoRefresh: true, persistSession: true, forceEnabled: true })
+  ;(client as { auth: unknown }).auth = svc
+  return { svc, client }
+}
+
+describe('AuthService.setSession — rollback + validation', () => {
+  it("échec de validation (/user KO) et aucune session préalable ⇒ store PURGÉ (pas de pollution)", async () => {
+    const store = new BaseAuthStore()
+    const { svc } = newAuth(store)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    vi.spyOn(svc as any, 'request').mockResolvedValue({
+      data: null,
+      error: new AuraError(401, { error: { code: 'unauthorized', message: 'bad token' } }),
+    })
+
+    const res = await svc.setSession(jwt(), 'rt-bad')
+
+    expect(res.error).toBeTruthy()
+    expect(res.data).toBeNull()
+    // Le bug : sans rollback, token+refreshToken restaient posés avec user {}.
+    expect(store.token).toBeNull()
+    expect(store.refreshToken).toBeNull()
+    expect(store.user).toBeNull()
+    expect(store.isValid).toBe(false)
+  })
+
+  it('validation OK ⇒ session complète + SIGNED_IN', async () => {
+    const store = new BaseAuthStore()
+    const { svc } = newAuth(store)
+    const token = jwt()
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    vi.spyOn(svc as any, 'request').mockResolvedValue({ data: fakeUser(), error: null })
+    const events: string[] = []
+    svc.onAuthStateChange(({ event }) => { if (event !== 'INITIAL_SESSION') events.push(event) })
+
+    const res = await svc.setSession(token, 'rt')
+
+    expect(res.data?.id).toBe('u1')
+    expect(store.token).toBe(token)
+    expect(store.user?.id).toBe('u1')
+    expect(events).toContain('SIGNED_IN')
+  })
+
+  it('échec de validation avec session préalable VALIDE ⇒ restauration de l’ancienne session', async () => {
+    const store = new BaseAuthStore()
+    const oldToken = jwt('old')
+    store.save(oldToken, 'rt-old', fakeUser('old'))
+    const { svc } = newAuth(store)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    vi.spyOn(svc as any, 'request').mockResolvedValue({
+      data: null,
+      error: new AuraError(404, { error: { code: 'not_found', message: 'user gone' } }),
+    })
+
+    const res = await svc.setSession(jwt('new'), 'rt-new')
+
+    expect(res.error).toBeTruthy()
+    // L'ancienne session valide doit être intacte (pas écrasée par le token invalide).
+    expect(store.token).toBe(oldToken)
+    expect(store.refreshToken).toBe('rt-old')
+    expect(store.user?.id).toBe('old')
+  })
+
+  it('access token DÉJÀ expiré ⇒ refresh via le refresh token (parité Supabase)', async () => {
+    const store = new BaseAuthStore()
+    const tokenPair = { access_token: jwt('u1'), refresh_token: 'rt-fresh', user: fakeUser() }
+    const fetchFn = (async (url: string) => {
+      if (String(url).endsWith('/refresh')) {
+        return new Response(JSON.stringify({ data: tokenPair }), { status: 200 })
+      }
+      return new Response('{}', { status: 200 })
+    }) as unknown as typeof globalThis.fetch
+    const { svc } = newAuth(store, fetchFn)
+    const events: string[] = []
+    svc.onAuthStateChange(({ event }) => { if (event !== 'INITIAL_SESSION') events.push(event) })
+
+    const res = await svc.setSession(expiredJwt(), 'rt-provided')
+
+    expect(res.data?.id).toBe('u1')
+    // Le store porte les tokens RAFRAÎCHIS, pas le token expiré fourni.
+    expect(store.token).toBe(tokenPair.access_token)
+    expect(store.refreshToken).toBe('rt-fresh')
+    expect(events).toContain('SIGNED_IN')
+  })
+})