@bajustone/fortress 1.0.0-rc.1

package/dist/testing.d.cts

@@ -0,0 +1,197 @@
+import { D as DatabaseAdapter } from './index-CxEkfCA0.cjs';
+import { F as Fortress, a as RouteClassification, R as RouteManifestEntry, M as MigrationDialect, b as MigrationDrift } from './fortress-BmSvFfqK.cjs';
+import { R as RouteManifestDrift } from './drift-BT1wtMDJ.cjs';
+import './index-D054pcb-.cjs';
+import './config-GtlVt6ZD.cjs';
+import './jwt.cjs';
+import './types-et0R8tsC.cjs';
+import './auth-service-BcyQ2PuZ.cjs';
+import './plugins/api-key.cjs';
+import './plugins/audit-log.cjs';
+import './plugins/data-isolation.cjs';
+import './plugins/email-verification.cjs';
+import './plugins/magic-link.cjs';
+import './plugins/oauth.cjs';
+import './plugins/social-login.cjs';
+import './plugins/tenancy.cjs';
+import './plugins/two-factor.cjs';
+import './plugins/webauthn.cjs';
+import '@simplewebauthn/server';
+
+/**
+ * CI-ready check utilities for Fortress projects (P1-10).
+ *
+ * Wraps the drift detectors and manifests Fortress already builds for
+ * itself so consumer apps can wire them into their own CI pipeline. The
+ * functions are framework-agnostic — they consume a `Fortress` instance
+ * and / or a `DatabaseAdapter` and return structured results suitable
+ * for `expect(...)`-style assertions or printing alongside a non-zero
+ * exit code.
+ *
+ * Re-exported from `@bajustone/fortress/testing` alongside the existing
+ * `createTestAdapter` helper.
+ *
+ * @module
+ */
+
+/**
+ * Combined result returned by every `check*` helper.
+ *
+ * `ok: true` ⇒ the check passed cleanly; `messages` is informational
+ * only. `ok: false` ⇒ at least one finding requires attention; the
+ * messages describe what.
+ */
+interface CheckResult {
+    ok: boolean;
+    messages: string[];
+}
+/**
+ * Run the route-manifest drift detector and return a {@link CheckResult}.
+ * Suitable for CI: a non-empty {@link RouteManifestDrift} flips
+ * `ok: false` and emits one message per drift category.
+ */
+declare function checkRouteManifestDrift(fortress: Fortress): CheckResult & {
+    drift: RouteManifestDrift;
+};
+/**
+ * Options for {@link checkPublicRoutes}.
+ */
+interface PublicRouteCheckOptions {
+    /**
+     * Explicit allow-list of `'<METHOD> <path>'` entries that are *allowed*
+     * to be `public` or `oauth-protocol`. Anything classified as `public`
+     * but **not** on this list is reported as a finding so a stray
+     * `.security('none')` on a sensitive route fails the build.
+     *
+     * Defaults to Fortress's own intentional public surface (auth open
+     * routes + OAuth protocol endpoints) so consumers only need to add
+     * their own public routes.
+     */
+    allow?: string[];
+    /**
+     * Additional classifications considered "public-equivalent" for the
+     * purposes of the allow-list. Defaults to `['public', 'oauth-protocol']`
+     * because OAuth protocol endpoints are reachable without a Fortress
+     * session by design (the handler self-authenticates).
+     */
+    classifications?: RouteClassification[];
+}
+/**
+ * Assert that no Fortress-managed route is unintentionally public.
+ *
+ * Walks the route manifest, collects every entry classified as `public`
+ * or `oauth-protocol` (configurable), and reports any entry not present
+ * in the allow-list. Defaults cover Fortress's own intentional public
+ * surface so consumers only need to add their own.
+ */
+declare function checkPublicRoutes(fortress: Fortress, options?: PublicRouteCheckOptions): CheckResult & {
+    unexpected: RouteManifestEntry[];
+};
+/**
+ * Run the migration drift detector and return a {@link CheckResult}.
+ * Reports missing version table, pending migrations, an unknown
+ * future version (DB ahead of the bundled catalog), missing
+ * Fortress-owned tables, and present-but-stale tables missing columns.
+ */
+declare function checkMigrationDrift(db: DatabaseAdapter, dialect?: MigrationDialect): Promise<CheckResult & {
+    drift: MigrationDrift;
+}>;
+/**
+ * Inputs to {@link smokeTestAuth}.
+ */
+interface AuthSmokeTestOptions {
+    /** Email used for the register/login round-trip. */
+    email?: string;
+    /** Password to register the smoke-test user with. */
+    password?: string;
+    /** Optional display name. */
+    name?: string;
+}
+/**
+ * End-to-end auth smoke test: create user → login → verify access token → refresh → logout.
+ * Designed to run against a fortress instance backed by
+ * {@link createTestAdapter} or any disposable DB. Returns a
+ * {@link CheckResult} so it composes with the other checks for a single
+ * CI gate.
+ *
+ * Calls the direct `fortress.auth.*` service methods so auth persistence,
+ * hashing, token verification, refresh rotation, and revocation run without
+ * a network roundtrip.
+ */
+declare function smokeTestAuth(fortress: Fortress, options?: AuthSmokeTestOptions): Promise<CheckResult>;
+/**
+ * Inputs to {@link runFortressChecks}.
+ */
+interface RunFortressChecksOptions {
+    fortress: Fortress;
+    /** Optional DB adapter for the migration check. Defaults to `fortress.config.database`. */
+    db?: DatabaseAdapter;
+    /** Skip the migration drift check (e.g. if you bring your own migration tool). */
+    skipMigrations?: boolean;
+    /** Skip the auth smoke test (e.g. in environments without a writable DB). */
+    skipAuthSmokeTest?: boolean;
+    /** Public-route allow-list overrides. */
+    publicRoutes?: PublicRouteCheckOptions;
+    /** Smoke-test overrides. */
+    smokeTest?: AuthSmokeTestOptions;
+}
+/**
+ * Aggregate result returned by {@link runFortressChecks}.
+ */
+interface FortressChecksResult {
+    ok: boolean;
+    manifest: ReturnType<typeof checkRouteManifestDrift>;
+    publicRoutes: ReturnType<typeof checkPublicRoutes>;
+    migrations?: Awaited<ReturnType<typeof checkMigrationDrift>>;
+    authSmokeTest?: Awaited<ReturnType<typeof smokeTestAuth>>;
+    /** All non-ok messages flattened in run order. */
+    messages: string[];
+}
+/**
+ * Run every CI check Fortress ships in one shot. Suitable for a single
+ * `fortress check` step in CI:
+ *
+ * ```ts
+ * import { runFortressChecks } from '@bajustone/fortress/testing';
+ *
+ * const result = await runFortressChecks({ fortress });
+ * if (!result.ok) {
+ *   console.error(result.messages.join('\\n'));
+ *   process.exit(1);
+ * }
+ * ```
+ */
+declare function runFortressChecks(options: RunFortressChecksOptions): Promise<FortressChecksResult>;
+
+/**
+ * In-memory SQLite test adapter for fortress.
+ *
+ * Spins up a fresh `bun:sqlite` database with the full fortress schema and
+ * returns a {@link DatabaseAdapter} ready to pass into `createFortress` from
+ * unit tests. Designed for fast, isolated test runs — every call creates a
+ * new database, so tests cannot leak state into each other.
+ *
+ * @example
+ * ```ts
+ * import { createTestAdapter } from '@bajustone/fortress/testing';
+ *
+ * const db = createTestAdapter();
+ * const fortress = createFortress({ database: db, jwt: { key: 'test' } });
+ * ```
+ *
+ * @module
+ */
+
+/**
+ * Create a test DatabaseAdapter using in-memory SQLite.
+ * Automatically detects the runtime:
+ * - Bun: uses bun:sqlite
+ * - Node/Vitest: uses better-sqlite3
+ *
+ * Usage:
+ *   import { createTestAdapter } from '@bajustone/fortress/testing';
+ *   const fortress = createFortress({ database: createTestAdapter(), jwt: { key: 'test' } });
+ */
+declare function createTestAdapter(): DatabaseAdapter;
+
+export { type AuthSmokeTestOptions, type CheckResult, type FortressChecksResult, type PublicRouteCheckOptions, type RunFortressChecksOptions, checkMigrationDrift, checkPublicRoutes, checkRouteManifestDrift, createTestAdapter, runFortressChecks, smokeTestAuth };

package/dist/testing.d.ts

@@ -0,0 +1,197 @@
+import { D as DatabaseAdapter } from './index-CxEkfCA0.js';
+import { F as Fortress, a as RouteClassification, R as RouteManifestEntry, M as MigrationDialect, b as MigrationDrift } from './fortress-uA-_cheR.js';
+import { R as RouteManifestDrift } from './drift-k9LiYpRP.js';
+import './index-jAMbbUAY.js';
+import './config-B2366s_G.js';
+import './jwt.js';
+import './types-et0R8tsC.js';
+import './auth-service-BkzZkWfH.js';
+import './plugins/api-key.js';
+import './plugins/audit-log.js';
+import './plugins/data-isolation.js';
+import './plugins/email-verification.js';
+import './plugins/magic-link.js';
+import './plugins/oauth.js';
+import './plugins/social-login.js';
+import './plugins/tenancy.js';
+import './plugins/two-factor.js';
+import './plugins/webauthn.js';
+import '@simplewebauthn/server';
+
+/**
+ * CI-ready check utilities for Fortress projects (P1-10).
+ *
+ * Wraps the drift detectors and manifests Fortress already builds for
+ * itself so consumer apps can wire them into their own CI pipeline. The
+ * functions are framework-agnostic — they consume a `Fortress` instance
+ * and / or a `DatabaseAdapter` and return structured results suitable
+ * for `expect(...)`-style assertions or printing alongside a non-zero
+ * exit code.
+ *
+ * Re-exported from `@bajustone/fortress/testing` alongside the existing
+ * `createTestAdapter` helper.
+ *
+ * @module
+ */
+
+/**
+ * Combined result returned by every `check*` helper.
+ *
+ * `ok: true` ⇒ the check passed cleanly; `messages` is informational
+ * only. `ok: false` ⇒ at least one finding requires attention; the
+ * messages describe what.
+ */
+interface CheckResult {
+    ok: boolean;
+    messages: string[];
+}
+/**
+ * Run the route-manifest drift detector and return a {@link CheckResult}.
+ * Suitable for CI: a non-empty {@link RouteManifestDrift} flips
+ * `ok: false` and emits one message per drift category.
+ */
+declare function checkRouteManifestDrift(fortress: Fortress): CheckResult & {
+    drift: RouteManifestDrift;
+};
+/**
+ * Options for {@link checkPublicRoutes}.
+ */
+interface PublicRouteCheckOptions {
+    /**
+     * Explicit allow-list of `'<METHOD> <path>'` entries that are *allowed*
+     * to be `public` or `oauth-protocol`. Anything classified as `public`
+     * but **not** on this list is reported as a finding so a stray
+     * `.security('none')` on a sensitive route fails the build.
+     *
+     * Defaults to Fortress's own intentional public surface (auth open
+     * routes + OAuth protocol endpoints) so consumers only need to add
+     * their own public routes.
+     */
+    allow?: string[];
+    /**
+     * Additional classifications considered "public-equivalent" for the
+     * purposes of the allow-list. Defaults to `['public', 'oauth-protocol']`
+     * because OAuth protocol endpoints are reachable without a Fortress
+     * session by design (the handler self-authenticates).
+     */
+    classifications?: RouteClassification[];
+}
+/**
+ * Assert that no Fortress-managed route is unintentionally public.
+ *
+ * Walks the route manifest, collects every entry classified as `public`
+ * or `oauth-protocol` (configurable), and reports any entry not present
+ * in the allow-list. Defaults cover Fortress's own intentional public
+ * surface so consumers only need to add their own.
+ */
+declare function checkPublicRoutes(fortress: Fortress, options?: PublicRouteCheckOptions): CheckResult & {
+    unexpected: RouteManifestEntry[];
+};
+/**
+ * Run the migration drift detector and return a {@link CheckResult}.
+ * Reports missing version table, pending migrations, an unknown
+ * future version (DB ahead of the bundled catalog), missing
+ * Fortress-owned tables, and present-but-stale tables missing columns.
+ */
+declare function checkMigrationDrift(db: DatabaseAdapter, dialect?: MigrationDialect): Promise<CheckResult & {
+    drift: MigrationDrift;
+}>;
+/**
+ * Inputs to {@link smokeTestAuth}.
+ */
+interface AuthSmokeTestOptions {
+    /** Email used for the register/login round-trip. */
+    email?: string;
+    /** Password to register the smoke-test user with. */
+    password?: string;
+    /** Optional display name. */
+    name?: string;
+}
+/**
+ * End-to-end auth smoke test: create user → login → verify access token → refresh → logout.
+ * Designed to run against a fortress instance backed by
+ * {@link createTestAdapter} or any disposable DB. Returns a
+ * {@link CheckResult} so it composes with the other checks for a single
+ * CI gate.
+ *
+ * Calls the direct `fortress.auth.*` service methods so auth persistence,
+ * hashing, token verification, refresh rotation, and revocation run without
+ * a network roundtrip.
+ */
+declare function smokeTestAuth(fortress: Fortress, options?: AuthSmokeTestOptions): Promise<CheckResult>;
+/**
+ * Inputs to {@link runFortressChecks}.
+ */
+interface RunFortressChecksOptions {
+    fortress: Fortress;
+    /** Optional DB adapter for the migration check. Defaults to `fortress.config.database`. */
+    db?: DatabaseAdapter;
+    /** Skip the migration drift check (e.g. if you bring your own migration tool). */
+    skipMigrations?: boolean;
+    /** Skip the auth smoke test (e.g. in environments without a writable DB). */
+    skipAuthSmokeTest?: boolean;
+    /** Public-route allow-list overrides. */
+    publicRoutes?: PublicRouteCheckOptions;
+    /** Smoke-test overrides. */
+    smokeTest?: AuthSmokeTestOptions;
+}
+/**
+ * Aggregate result returned by {@link runFortressChecks}.
+ */
+interface FortressChecksResult {
+    ok: boolean;
+    manifest: ReturnType<typeof checkRouteManifestDrift>;
+    publicRoutes: ReturnType<typeof checkPublicRoutes>;
+    migrations?: Awaited<ReturnType<typeof checkMigrationDrift>>;
+    authSmokeTest?: Awaited<ReturnType<typeof smokeTestAuth>>;
+    /** All non-ok messages flattened in run order. */
+    messages: string[];
+}
+/**
+ * Run every CI check Fortress ships in one shot. Suitable for a single
+ * `fortress check` step in CI:
+ *
+ * ```ts
+ * import { runFortressChecks } from '@bajustone/fortress/testing';
+ *
+ * const result = await runFortressChecks({ fortress });
+ * if (!result.ok) {
+ *   console.error(result.messages.join('\\n'));
+ *   process.exit(1);
+ * }
+ * ```
+ */
+declare function runFortressChecks(options: RunFortressChecksOptions): Promise<FortressChecksResult>;
+
+/**
+ * In-memory SQLite test adapter for fortress.
+ *
+ * Spins up a fresh `bun:sqlite` database with the full fortress schema and
+ * returns a {@link DatabaseAdapter} ready to pass into `createFortress` from
+ * unit tests. Designed for fast, isolated test runs — every call creates a
+ * new database, so tests cannot leak state into each other.
+ *
+ * @example
+ * ```ts
+ * import { createTestAdapter } from '@bajustone/fortress/testing';
+ *
+ * const db = createTestAdapter();
+ * const fortress = createFortress({ database: db, jwt: { key: 'test' } });
+ * ```
+ *
+ * @module
+ */
+
+/**
+ * Create a test DatabaseAdapter using in-memory SQLite.
+ * Automatically detects the runtime:
+ * - Bun: uses bun:sqlite
+ * - Node/Vitest: uses better-sqlite3
+ *
+ * Usage:
+ *   import { createTestAdapter } from '@bajustone/fortress/testing';
+ *   const fortress = createFortress({ database: createTestAdapter(), jwt: { key: 'test' } });
+ */
+declare function createTestAdapter(): DatabaseAdapter;
+
+export { type AuthSmokeTestOptions, type CheckResult, type FortressChecksResult, type PublicRouteCheckOptions, type RunFortressChecksOptions, checkMigrationDrift, checkPublicRoutes, checkRouteManifestDrift, createTestAdapter, runFortressChecks, smokeTestAuth };