@bevel-software/platform-core-backend 0.15.1 → 0.20.0

package/src/modules/auth/__tests__/account-erasure.approval-gate.test.ts

@@ -0,0 +1,209 @@
+import { describe, it, expect } from 'vitest';
+import type { SQL } from 'drizzle-orm';
+import { PgDialect } from 'drizzle-orm/pg-core';
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { AccountErasureService, type IErasureParticipant } from '../account-erasure.service.js';
+import type { Database } from '../../database/connection.js';
+import { ReviewWorkflowService } from '../../workflow/review-workflow/review-workflow.service.js';
+
+/**
+ * Erasing an account rewrites the person's name and address out of every
+ * approval they ever made. One other writer COPIES those rows — a change
+ * request that brings itself up to date re-pins the approvals its merge did
+ * not disturb onto the new head — so a copy that read the row a moment before
+ * the rewrite would insert the real address back afterwards, onto a row
+ * created after the last trace of them was supposed to be gone.
+ *
+ * What stops it is the lock both sides take: shared per request on the copy's
+ * side, exclusive on every request here. This pins that the erasure takes it,
+ * that it takes it BEFORE the statement it has to cover, and that it keeps
+ * holding it (a transaction-scoped lock) through the rest of the erasure.
+ */
+
+/** The table a statement names, as far as this stub needs to know. */
+function tableOf(target: unknown): string {
+  const t = target as Record<symbol | string, unknown>;
+  for (const sym of Object.getOwnPropertySymbols(t)) {
+    const name = String(t[sym]);
+    if (name && name !== 'undefined' && !name.startsWith('[object')) return name;
+  }
+  return 'unknown';
+}
+
+/**
+ * A `where` clause as the SQL it renders to.
+ *
+ * The sweeps' guard is a `notExists` over `users`, and it is the whole reason
+ * they are safe to run at all: without it they would anonymize the approvals
+ * and change requests of whoever signed in again at that address since the
+ * commit. A stub that ignored its condition would pass just as happily with
+ * the guard deleted — so the marker below is recorded only for a clause whose
+ * SQL actually names `users`, and the assertions are on that.
+ */
+function whereSql(clause: unknown): string {
+  return new PgDialect().sqlToQuery(clause as SQL).sql;
+}
+
+function statementText(statement: { queryChunks?: unknown[] }): string {
+  return (statement.queryChunks ?? [])
+    .flatMap((c) => (c as { value?: unknown }).value ?? [])
+    .filter((v): v is string => typeof v === 'string')
+    .join(' ');
+}
+
+function harness(opts: { participants?: IErasureParticipant[] } = {}) {
+  /** Everything the erasure did, in order, as `<verb>:<table>` / lock labels. */
+  const order: string[] = [];
+  const locked: unknown[][] = [];
+  /** The lock statements as written, so the FUNCTION is pinned, not just its keys. */
+  const lockSql: string[] = [];
+  const done = Promise.resolve([]);
+  const tx = {
+    execute: async (statement: { queryChunks?: unknown[] }) => {
+      const text = statementText(statement);
+      if (text.includes('lock_timeout')) {
+        order.push('timeout');
+        return { rows: [] };
+      }
+      order.push(text.includes('_shared') ? 'gate:shared' : 'gate:exclusive');
+      lockSql.push(text);
+      locked.push((statement.queryChunks ?? []).filter((c) => typeof c === 'number'));
+      return { rows: [] };
+    },
+    delete: (table: unknown) => ({
+      where: () => {
+        order.push(`delete:${tableOf(table)}`);
+        return done;
+      },
+    }),
+    update: (table: unknown) => ({
+      set: () => ({
+        where: () => {
+          order.push(`update:${tableOf(table)}`);
+          return done;
+        },
+      }),
+    }),
+  };
+  // A client-less drizzle instance, purely to BUILD queries. Two callers share
+  // this `select`: the read that finds the user, which awaits `.limit(1)`, and
+  // the sweeps' `notExists` subquery, which is handed to drizzle as a query and
+  // has to render as one — a hand-rolled stand-in renders as nothing, and the
+  // guard these tests are about would be invisible.
+  const builder = drizzle({} as never);
+  const db = {
+    select: (fields?: unknown) => ({
+      from: (table: unknown) => ({
+        where: (condition: unknown) =>
+          Object.assign(
+            builder
+              .select(fields as never)
+              .from(table as never)
+              .where(condition as never),
+            { limit: async () => [{ id: 'u1', email: 'Bob@Bevel.software', name: 'Bob' }] },
+          ),
+      }),
+    }),
+    // Outside the transaction: the second passes, once it has committed. The
+    // marker is recorded ONLY for a clause guarded on `users` — a sweep that
+    // lost that guard is a sweep that rewrites a new account's rows, so it must
+    // not be able to satisfy these tests.
+    update: (table: unknown) => ({
+      set: () => ({
+        where: async (clause: unknown) => {
+          const guarded = /not exists .*"users"/s.test(whereSql(clause));
+          order.push(`${guarded ? 'after-commit' : 'unguarded'}:${tableOf(table)}`);
+        },
+      }),
+    }),
+    transaction: async <T,>(fn: (t: typeof tx) => Promise<T>) => fn(tx),
+  } as unknown as Database;
+  return {
+    // The REAL review workflow, so what is pinned below is the contract as
+    // wired: erasure asks it to rewrite the approvals inside the erasure's
+    // transaction, and it is the workflow that takes the lock. Its other
+    // collaborators are never reached by `eraseApprover`.
+    svc: new AccountErasureService(
+      db,
+      new ReviewWorkflowService(db, {} as never, {} as never, {} as never),
+      opts.participants ?? [],
+    ),
+    order,
+    locked,
+    lockSql,
+  };
+}
+
+describe('AccountErasureService: approvals are rewritten under the approval lock', () => {
+  it('takes the every-request lock exclusively, right before it anonymizes them', async () => {
+    const h = harness();
+    await expect(h.svc.eraseUser('u1')).resolves.toBe(true);
+
+    const gate = h.order.indexOf('gate:exclusive');
+    const approvals = h.order.indexOf('update:pr_file_approvals');
+    expect(gate).toBeGreaterThan(-1);
+    expect(approvals).toBeGreaterThan(-1);
+    // Before the rewrite — a lock taken after it would leave the very window
+    // it exists to close wide open.
+    expect(gate).toBeLessThan(approvals);
+    // And bounded, so a wedged writer fails the erasure loudly (its
+    // transaction is atomic, so nothing is half-erased) instead of hanging.
+    expect(h.order[gate - 1]).toBe('timeout');
+    // Exclusive on the every-request key (0) of the approval lock's class —
+    // the shared form is the per-request writers', not this.
+    expect(h.locked).toEqual([[4207, 0]]);
+    expect(h.order).not.toContain('gate:shared');
+    // And TRANSACTION-scoped. The session-scoped `pg_advisory_lock` would
+    // satisfy every assertion above and then keep an exclusive lock on a
+    // pooled connection after this transaction ends — held by whatever request
+    // borrows that connection next, released by nobody.
+    expect(h.lockSql).toHaveLength(1);
+    expect(h.lockSql[0]).toContain('pg_advisory_xact_lock');
+    expect(h.lockSql[0]).not.toMatch(/pg_advisory_lock\b/);
+    // Still inside the same transaction as the user row's deletion, which is
+    // what keeps the lock held for the whole rewrite.
+    expect(h.order.indexOf('delete:users')).toBeGreaterThan(gate);
+  });
+
+  it('sweeps the approvals once more after the commit, for anything the lock did not order', async () => {
+    // The lock covers every writer that takes it, and `approveFile` re-reads
+    // the account under it before writing. This is the belt to those braces:
+    // one idempotent statement so the guarantee does not rest on every future
+    // writer of this table remembering the lock.
+    const h = harness();
+    await h.svc.eraseUser('u1');
+
+    const committed = h.order.indexOf('delete:users');
+    const sweep = h.order.indexOf('after-commit:pr_file_approvals');
+    expect(sweep).toBeGreaterThan(committed);
+    // The change requests get the same treatment, and did before this.
+    expect(h.order).toContain('after-commit:change_requests');
+    // Both guarded on `users`: the marker is only recorded for a clause that
+    // names it, so a sweep that dropped the `notExists` lands here instead.
+    expect(h.order.filter((step) => step.startsWith('unguarded:'))).toEqual([]);
+  });
+
+  it('sweeps before the post-commit callbacks, so one that rejects cannot skip them', async () => {
+    // The erasure is committed by now and `eraseUser` cannot be retried into
+    // it, so a pass sequenced behind a failing callback is one that may never
+    // run at all. Nothing in the sweeps depends on a callback having succeeded.
+    const h = harness({
+      participants: [
+        {
+          inTransaction: async () => async () => {
+            h.order.push('callback');
+            throw new Error('the external store is down');
+          },
+        },
+      ],
+    });
+
+    await expect(h.svc.eraseUser('u1')).rejects.toThrow(/external store/);
+
+    expect(h.order).toContain('after-commit:pr_file_approvals');
+    expect(h.order).toContain('after-commit:change_requests');
+    expect(h.order.indexOf('after-commit:pr_file_approvals')).toBeLessThan(
+      h.order.indexOf('callback'),
+    );
+  });
+});

package/src/modules/auth/__tests__/account.routes.test.ts

@@ -2,7 +2,9 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import express from 'express';
 import type { Server } from 'node:http';
 import { createAccountRoutes } from '../account.routes.js';
-import type { AuthService } from '../auth.service.js';
+import { AuthService } from '../auth.service.js';
+import { hashPassword } from '../password-hash.js';
+import type { Database } from '../../database/connection.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';
 
 const authService = {
@@ -15,7 +17,7 @@ const authService = {
 // Satisfies the route's narrow Pick<IAccountErasureService, 'eraseUser'>
 // contract directly — no concrete-service cast needed.
 const accountErasure = {
-  eraseUser: vi.fn(async (_userId: string) => true),
+  eraseUser: vi.fn<(userId: string, opts?: { erasureId?: string }) => Promise<boolean>>(async () => true),
 };
 
 function makeApp(opts: { admin: boolean; email?: string }) {
@@ -81,6 +83,48 @@ describe('account routes — admin gate', () => {
     expect(authService.createAccount).toHaveBeenCalledWith('b@example.com', 'B', 'long-enough-pw');
   });
 
+  it('list reports hasPassword + isEnvAdmin and never carries a hash or password', async () => {
+    const passwordHash = await hashPassword('stored-password-1');
+    const rows = [
+      { id: 'u1', email: 'root@example.com', name: 'Root', passwordHash: null, createdAt: new Date() },
+      { id: 'u2', email: 'b@example.com', name: 'B', passwordHash, createdAt: new Date() },
+    ];
+    // A real AuthService over a stub db — the route's body is what the
+    // service produces from full `users` rows, hash column included.
+    const db = {
+      select: () => ({ from: () => ({ orderBy: async () => rows }) }),
+    } as unknown as Database;
+    const realAuth = new AuthService(db, {
+      jwtSecret: 'test-jwt-secret',
+      adminEmail: 'root@example.com',
+      adminPassword: 'env-admin-secret',
+      allowedEmailDomains: [],
+    });
+    const app = express();
+    app.use((req, _res, next) => {
+      req.userId = 'caller';
+      req.userEmail = 'caller@example.com';
+      next();
+    });
+    app.use('/api', createAccountRoutes(realAuth, { isAdmin: async () => true }, accountErasure));
+    const base = await listen(app);
+
+    const res = await fetch(`${base}/api/admin/accounts`);
+    expect(res.status).toBe(200);
+    const text = await res.text();
+    const body = JSON.parse(text) as {
+      accounts: Array<{ email: string; hasPassword: boolean; isEnvAdmin: boolean }>;
+    };
+    expect(body.accounts.map((a) => [a.email, a.hasPassword, a.isEnvAdmin])).toEqual([
+      ['root@example.com', false, true],
+      ['b@example.com', true, false],
+    ]);
+    expect(text).not.toContain('scrypt:');
+    expect(text).not.toContain('passwordHash');
+    expect(text).not.toContain('env-admin-secret');
+    expect(text).not.toContain('stored-password-1');
+  });
+
   it('erasure: refuses non-admins, refuses self, 404s unknown, 204s success', async () => {
     const nonAdmin = await listen(makeApp({ admin: false }));
     expect((await fetch(`${nonAdmin}/api/admin/accounts/u9`, { method: 'DELETE' })).status).toBe(403);
@@ -135,3 +179,135 @@ describe('account routes — admin gate', () => {
     expect(body.error).toContain('at least 8');
   });
 });
+
+describe('account routes — removing the erased address from access files', () => {
+  const lee = { id: 'u2', email: 'lee@example.com', name: 'Lee' };
+  const caller = { id: 'u1', email: 'caller@example.com', name: 'Caller' };
+
+  function makeRemovalApp() {
+    const auth = {
+      ...authService,
+      getUserById: vi.fn(async (id: string) => (id === 'u2' ? lee : id === 'u1' ? caller : null)),
+    } as unknown as AuthService;
+    const accessRemoval = {
+      report: vi.fn(async () => ({
+        roles: 1,
+        groups: 1,
+        accessRules: 2,
+        fileGrants: 1,
+        total: 5,
+        files: ['Sales/Plan.md', 'Sales/access.md', 'groups.yaml', 'roles.yaml'],
+        removable: true,
+        blockedReason: null,
+        unwritable: ['Sales/Plan.md'],
+      })),
+      assertRemovable: vi.fn(async () => {}),
+      remove: vi.fn(async () => ({ removedFrom: ['roles.yaml'], stillNamedIn: [] as string[] | null })),
+      filesNaming: vi.fn(async (): Promise<string[]> => ['Sales/access.md', 'roles.yaml']),
+    };
+    const app = express();
+    app.use((req, _res, next) => {
+      req.userId = 'u1';
+      req.userEmail = 'caller@example.com';
+      next();
+    });
+    app.use('/api', createAccountRoutes(auth, { isAdmin: async () => true }, accountErasure, accessRemoval));
+    return { app, accessRemoval };
+  }
+
+  it('reports the reference counts for the confirmation, without the address', async () => {
+    const { app, accessRemoval } = makeRemovalApp();
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/u2/references`);
+    expect(res.status).toBe(200);
+    const text = await res.text();
+    expect(JSON.parse(text)).toMatchObject({ total: 5, roles: 1, groups: 1, accessRules: 2, fileGrants: 1 });
+    // The TARGET's address is counted; the ACTING admin's decides what they
+    // can write, so the dialog can warn before the delete.
+    expect(accessRemoval.report).toHaveBeenCalledWith('lee@example.com', 'caller@example.com');
+    expect(JSON.parse(text).unwritable).toEqual(['Sales/Plan.md']);
+    expect(text).not.toContain('lee@example.com');
+    expect((await fetch(`${base}/api/admin/accounts/ghost/references`)).status).toBe(404);
+  });
+
+  it('option off: erases as today (204) and never touches the access files', async () => {
+    const { app, accessRemoval } = makeRemovalApp();
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/u2`, { method: 'DELETE' });
+    expect(res.status).toBe(204);
+    expect(accountErasure.eraseUser).toHaveBeenLastCalledWith('u2');
+    expect(accessRemoval.assertRemovable).not.toHaveBeenCalled();
+    expect(accessRemoval.remove).not.toHaveBeenCalled();
+  });
+
+  it('option on: erases, then removes in one call named by the anonymised id', async () => {
+    const { app, accessRemoval } = makeRemovalApp();
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/u2?removeFromAccess=1`, { method: 'DELETE' });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { erased: boolean; accessRemoval: { ok: boolean; removedFrom: string[] } };
+    expect(body).toEqual({ erased: true, accessRemoval: { ok: true, removedFrom: ['roles.yaml'], stillNamedIn: [] } });
+
+    const [, opts] = vi.mocked(accountErasure.eraseUser).mock.calls.at(-1)! as unknown as [string, { erasureId: string }];
+    expect(opts.erasureId).toMatch(/^[0-9a-f-]{36}$/);
+    expect(accessRemoval.remove).toHaveBeenCalledTimes(1);
+    const [actor, email, accountId] = accessRemoval.remove.mock.calls[0] as unknown as [
+      { email: string },
+      string,
+      string,
+    ];
+    expect(actor.email).toBe('caller@example.com');
+    expect(email).toBe('lee@example.com');
+    expect(accountId).toBe(`deleted-${opts.erasureId}`);
+    // Erasure happened before the removal.
+    expect(vi.mocked(accountErasure.eraseUser).mock.invocationCallOrder.at(-1)!).toBeLessThan(
+      accessRemoval.remove.mock.invocationCallOrder[0],
+    );
+  });
+
+  it('commit failure: the account is still erased and the response lists the files still naming the user', async () => {
+    const { app, accessRemoval } = makeRemovalApp();
+    accessRemoval.remove.mockRejectedValueOnce(new Error('push rejected: /srv/kb internal detail'));
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/u2?removeFromAccess=1`, { method: 'DELETE' });
+    expect(res.status).toBe(200);
+    const text = await res.text();
+    const body = JSON.parse(text) as {
+      erased: boolean;
+      accessRemoval: { ok: boolean; error: string; stillNamedIn: string[] };
+    };
+    expect(accountErasure.eraseUser).toHaveBeenCalledTimes(1);
+    expect(body.erased).toBe(true);
+    expect(body.accessRemoval.ok).toBe(false);
+    expect(body.accessRemoval.stillNamedIn).toEqual(['Sales/access.md', 'roles.yaml']);
+    expect(text).not.toContain('/srv/kb');
+    expect(text).not.toContain('lee@example.com');
+  });
+
+  it('commit failure with an unreadable re-scan reports the files as unknown, not as none', async () => {
+    const { app, accessRemoval } = makeRemovalApp();
+    accessRemoval.remove.mockRejectedValueOnce(new Error('push rejected'));
+    accessRemoval.filesNaming.mockRejectedValueOnce(new Error('EACCES'));
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/u2?removeFromAccess=1`, { method: 'DELETE' });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { erased: boolean; accessRemoval: { ok: boolean; stillNamedIn: string[] | null } };
+    expect(body.erased).toBe(true);
+    expect(body.accessRemoval.ok).toBe(false);
+    expect(body.accessRemoval.stillNamedIn).toBeNull();
+  });
+
+  it('the guards refuse up front: nothing is erased', async () => {
+    const { app, accessRemoval } = makeRemovalApp();
+    const { WorkflowDomainError } = await import('../../../shared/domain-errors.js');
+    accessRemoval.assertRemovable.mockRejectedValueOnce(
+      new WorkflowDomainError('This is the last Admin; the Admin role must keep at least one direct email member.', 409),
+    );
+    const base = await listen(app);
+    const res = await fetch(`${base}/api/admin/accounts/u2?removeFromAccess=1`, { method: 'DELETE' });
+    expect(res.status).toBe(409);
+    expect(((await res.json()) as { error: string }).error).toMatch(/last Admin/);
+    expect(accountErasure.eraseUser).not.toHaveBeenCalled();
+    expect(accessRemoval.remove).not.toHaveBeenCalled();
+  });
+});

package/src/modules/auth/__tests__/auth.middleware.test.ts

@@ -0,0 +1,78 @@
+import { describe, it, expect, vi } from 'vitest';
+import type { Request, Response, NextFunction } from 'express';
+import { createAuthMiddleware, AUTH_COOKIE_NAME } from '../auth.middleware.js';
+import type { AuthService } from '../auth.service.js';
+
+/**
+ * The cookie fallback is the whole reason a markdown image can be a plain
+ * `<img>`: the tag sends no Authorization header, only the `bevel_token`
+ * cookie the login route set. Nothing else in the suite exercised that path
+ * (the route harnesses inject `userId` directly), so this pins it.
+ */
+
+const GOOD_TOKEN = 'good-token';
+const IDENTITY = { userId: 'user-1', email: 'alice@example.com' };
+
+function run(headers: Record<string, string>) {
+  const verifyToken = vi.fn((token: string) => {
+    if (token !== GOOD_TOKEN) throw new Error('bad token');
+    return IDENTITY;
+  });
+  const authService = { verifyToken } as unknown as AuthService;
+  const req = { headers } as unknown as Request;
+  const json = vi.fn();
+  const status = vi.fn(() => ({ json }));
+  const res = { status } as unknown as Response;
+  const next = vi.fn() as unknown as NextFunction;
+  createAuthMiddleware(authService)(req, res, next);
+  return { req, next, status, json, verifyToken };
+}
+
+describe('createAuthMiddleware', () => {
+  it('authenticates a request that carries only the auth cookie (an <img>, an EventSource)', () => {
+    const { req, next, status } = run({ cookie: `${AUTH_COOKIE_NAME}=${GOOD_TOKEN}` });
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(status).not.toHaveBeenCalled();
+    expect(req.userId).toBe(IDENTITY.userId);
+    expect(req.userEmail).toBe(IDENTITY.email);
+  });
+
+  it('finds the cookie among others, and decodes a percent-encoded value', () => {
+    const { next, verifyToken } = run({
+      cookie: `theme=dark; ${AUTH_COOKIE_NAME}=${encodeURIComponent(GOOD_TOKEN)}; seen=1`,
+    });
+    expect(verifyToken).toHaveBeenCalledWith(GOOD_TOKEN);
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('prefers the Bearer header when both are present', () => {
+    const { next, verifyToken } = run({
+      authorization: `Bearer ${GOOD_TOKEN}`,
+      cookie: `${AUTH_COOKIE_NAME}=stale-cookie`,
+    });
+    expect(verifyToken).toHaveBeenCalledTimes(1);
+    expect(verifyToken).toHaveBeenCalledWith(GOOD_TOKEN);
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('refuses a request with neither', () => {
+    const { next, status, json } = run({});
+    expect(next).not.toHaveBeenCalled();
+    expect(status).toHaveBeenCalledWith(401);
+    expect(json.mock.calls[0][0].error).toContain('auth cookie');
+  });
+
+  it('refuses an empty cookie value as missing, not as a token to verify', () => {
+    const { next, status, verifyToken } = run({ cookie: `${AUTH_COOKIE_NAME}=` });
+    expect(verifyToken).not.toHaveBeenCalled();
+    expect(next).not.toHaveBeenCalled();
+    expect(status).toHaveBeenCalledWith(401);
+  });
+
+  it('refuses a cookie the auth service rejects', () => {
+    const { next, status, json } = run({ cookie: `${AUTH_COOKIE_NAME}=forged` });
+    expect(next).not.toHaveBeenCalled();
+    expect(status).toHaveBeenCalledWith(401);
+    expect(json.mock.calls[0][0].error).toBe('Invalid or expired token');
+  });
+});