@brika/auth 0.1.1

package/src/__tests__/UserService-avatar.test.ts

@@ -0,0 +1,277 @@
+/**
+ * @brika/auth - UserService Avatar & deleteUser Tests
+ *
+ * Tests for avatar-related methods (processAvatar, setAvatar, getAvatarData,
+ * removeAvatar) and deleteUser. These complement the existing UserService.test.ts
+ * which covers createUser, getUser, getUserByEmail, listUsers, setPassword,
+ * verifyPassword, and hasAdmin.
+ */
+
+import type { Database } from 'bun:sqlite';
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { deflateSync } from 'node:zlib';
+import { processAvatar, UserService } from '../services/UserService';
+import { openAuthDatabase } from '../setup';
+import { Role } from '../types';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Create a valid W×H RGB PNG buffer for testing. */
+function makeTestPng(width: number, height: number = width): Buffer {
+  function crc32(buf: Buffer): number {
+    const table = new Uint32Array(256);
+    for (let i = 0; i < 256; i++) {
+      let c = i;
+      for (let j = 0; j < 8; j++) {
+        c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+      }
+      table[i] = c;
+    }
+    let c = 0xffffffff;
+    for (let i = 0; i < buf.length; i++) {
+      c = (c >>> 8) ^ (table[(c ^ (buf[i] ?? 0)) & 0xff] ?? 0);
+    }
+    return (c ^ 0xffffffff) >>> 0;
+  }
+
+  function chunk(type: string, data: Buffer): Buffer {
+    const len = Buffer.alloc(4);
+    len.writeUInt32BE(data.length);
+    const td = Buffer.concat([Buffer.from(type), data]);
+    const crc = Buffer.alloc(4);
+    crc.writeUInt32BE(crc32(td));
+    return Buffer.concat([len, td, crc]);
+  }
+
+  const rowBytes = 1 + width * 3; // filter byte + RGB per pixel
+  const raw = Buffer.alloc(height * rowBytes);
+  for (let y = 0; y < height; y++) {
+    raw[y * rowBytes] = 0; // filter=none
+    for (let x = 0; x < width; x++) {
+      raw[y * rowBytes + 1 + x * 3] = 255; // R
+    }
+  }
+
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(width, 0);
+  ihdr.writeUInt32BE(height, 4);
+  ihdr[8] = 8; // bit depth
+  ihdr[9] = 2; // colour type: RGB
+
+  return Buffer.concat([
+    Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]), // PNG signature
+    chunk('IHDR', ihdr),
+    chunk('IDAT', deflateSync(raw)),
+    chunk('IEND', Buffer.alloc(0)),
+  ]);
+}
+
+// ---------------------------------------------------------------------------
+// processAvatar (exported pure function)
+// ---------------------------------------------------------------------------
+
+describe('processAvatar', () => {
+  it('should return a Buffer', () => {
+    const input = makeTestPng(16);
+    const result = processAvatar(input);
+    expect(result).toBeInstanceOf(Buffer);
+  });
+
+  it('should produce a non-empty output', () => {
+    const input = makeTestPng(16);
+    const result = processAvatar(input);
+    expect(result.byteLength).toBeGreaterThan(0);
+  });
+
+  it('should produce WebP output (RIFF....WEBP magic bytes)', () => {
+    const input = makeTestPng(16);
+    const result = processAvatar(input);
+    // WebP files start with RIFF
+    expect(result[0]).toBe(0x52); // R
+    expect(result[1]).toBe(0x49); // I
+    expect(result[2]).toBe(0x46); // F
+    expect(result[3]).toBe(0x46); // F
+    // Bytes 8-11 are "WEBP"
+    expect(result[8]).toBe(0x57); // W
+    expect(result[9]).toBe(0x45); // E
+    expect(result[10]).toBe(0x42); // B
+    expect(result[11]).toBe(0x50); // P
+  });
+
+  it('should produce consistent output for the same input', () => {
+    const input = makeTestPng(16);
+    const r1 = processAvatar(input);
+    const r2 = processAvatar(input);
+    expect(Buffer.compare(r1, r2)).toBe(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// UserService — avatar methods + deleteUser
+// ---------------------------------------------------------------------------
+
+describe('UserService — avatar & deleteUser', () => {
+  let db: Database;
+  let service: UserService;
+
+  beforeEach(() => {
+    db = openAuthDatabase(':memory:');
+    service = new UserService(db);
+  });
+
+  afterEach(() => {
+    db.close();
+  });
+
+  // -------------------------------------------------------------------------
+  // setAvatar
+  // -------------------------------------------------------------------------
+
+  describe('setAvatar', () => {
+    it('should return a hash string', () => {
+      const user = service.createUser('avatar@example.com', 'Avatar User', Role.USER);
+      const hash = service.setAvatar(user.id, makeTestPng(16));
+      expect(typeof hash).toBe('string');
+      expect(hash.length).toBeGreaterThan(0);
+    });
+
+    it('should return a short alphanumeric hash (base-36, max 8 chars)', () => {
+      const user = service.createUser('avatar@example.com', 'Avatar User', Role.USER);
+      const hash = service.setAvatar(user.id, makeTestPng(16));
+      expect(hash).toMatch(/^[0-9a-z]{1,8}$/);
+    });
+
+    it('should produce the same hash for the same image', () => {
+      const user = service.createUser('avatar@example.com', 'Avatar User', Role.USER);
+      const input = makeTestPng(16);
+      const h1 = service.setAvatar(user.id, input);
+      const h2 = service.setAvatar(user.id, input);
+      expect(h1).toBe(h2);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // getAvatarData
+  // -------------------------------------------------------------------------
+
+  describe('getAvatarData', () => {
+    it('should retrieve avatar data after setAvatar', () => {
+      const user = service.createUser('avatar@example.com', 'Avatar User', Role.USER);
+      service.setAvatar(user.id, makeTestPng(16));
+
+      const result = service.getAvatarData(user.id);
+      expect(result).not.toBeNull();
+      // bun:sqlite returns BLOB columns as Uint8Array (Buffer is a Uint8Array subclass)
+      expect(result?.data).toBeInstanceOf(Uint8Array);
+      expect(result?.data.byteLength).toBeGreaterThan(0);
+    });
+
+    it('should return image/webp mimeType after setAvatar', () => {
+      const user = service.createUser('avatar@example.com', 'Avatar User', Role.USER);
+      service.setAvatar(user.id, makeTestPng(16));
+
+      const result = service.getAvatarData(user.id);
+      expect(result?.mimeType).toBe('image/webp');
+    });
+
+    it('should return null for user without avatar', () => {
+      const user = service.createUser('noavatar@example.com', 'No Avatar', Role.USER);
+      const result = service.getAvatarData(user.id);
+      expect(result).toBeNull();
+    });
+
+    it('should return null for non-existent user id', () => {
+      const result = service.getAvatarData('00000000-0000-0000-0000-000000000000');
+      expect(result).toBeNull();
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // removeAvatar
+  // -------------------------------------------------------------------------
+
+  describe('removeAvatar', () => {
+    it('should clear avatar so getAvatarData returns null', () => {
+      const user = service.createUser('avatar@example.com', 'Avatar User', Role.USER);
+      service.setAvatar(user.id, makeTestPng(16));
+
+      // Confirm avatar was set
+      expect(service.getAvatarData(user.id)).not.toBeNull();
+
+      service.removeAvatar(user.id);
+
+      expect(service.getAvatarData(user.id)).toBeNull();
+    });
+
+    it('should be a no-op for user without avatar', () => {
+      const user = service.createUser('noavatar@example.com', 'No Avatar', Role.USER);
+      // Should not throw even if no avatar is present
+      expect(service.removeAvatar(user.id)).toBeUndefined();
+      expect(service.getAvatarData(user.id)).toBeNull();
+    });
+
+    it('should clear avatarHash on user after removeAvatar', () => {
+      const user = service.createUser('avatar@example.com', 'Avatar User', Role.USER);
+      service.setAvatar(user.id, makeTestPng(16));
+
+      const before = service.getUser(user.id);
+      expect(before?.avatarHash).not.toBeNull();
+
+      service.removeAvatar(user.id);
+
+      const after = service.getUser(user.id);
+      expect(after?.avatarHash).toBeNull();
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // deleteUser
+  // -------------------------------------------------------------------------
+
+  describe('deleteUser', () => {
+    it('should delete an existing non-admin user', () => {
+      service.createUser('todelete@example.com', 'To Delete', Role.USER);
+
+      service.deleteUser('todelete@example.com');
+
+      const gone = service.getUserByEmail('todelete@example.com');
+      expect(gone).toBeNull();
+    });
+
+    it('should throw for a non-existent user', () => {
+      expect(() => service.deleteUser('ghost@example.com')).toThrow('User not found');
+    });
+
+    it('should throw when trying to delete an admin user', () => {
+      service.createUser('admin@example.com', 'Admin', Role.ADMIN);
+
+      expect(() => service.deleteUser('admin@example.com')).toThrow('Cannot delete admin user');
+
+      // User must still exist after the failed attempt
+      const still = service.getUserByEmail('admin@example.com');
+      expect(still).not.toBeNull();
+    });
+
+    it('should be case-insensitive for email lookup', () => {
+      service.createUser('mixed@example.com', 'Mixed Case', Role.USER);
+
+      service.deleteUser('MIXED@EXAMPLE.COM');
+
+      const gone = service.getUserByEmail('mixed@example.com');
+      expect(gone).toBeNull();
+    });
+
+    it('should delete GUEST and SERVICE roles as well', () => {
+      service.createUser('guest@example.com', 'Guest User', Role.GUEST);
+      service.createUser('svc@example.com', 'Service Account', Role.SERVICE);
+
+      service.deleteUser('guest@example.com');
+      service.deleteUser('svc@example.com');
+
+      expect(service.getUserByEmail('guest@example.com')).toBeNull();
+      expect(service.getUserByEmail('svc@example.com')).toBeNull();
+    });
+  });
+});

package/src/__tests__/UserService.test.ts

@@ -0,0 +1,223 @@
+/**
+ * @brika/auth - UserService Tests
+ */
+
+import type { Database } from 'bun:sqlite';
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { UserService } from '../services/UserService';
+import { openAuthDatabase } from '../setup';
+import { Role } from '../types';
+
+describe('UserService', () => {
+  let service: UserService;
+  let db: Database;
+
+  beforeEach(() => {
+    db = openAuthDatabase(':memory:');
+    service = new UserService(db);
+  });
+
+  afterEach(() => {
+    db.close();
+  });
+
+  describe('createUser', () => {
+    it('should create a new user', () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      expect(user).toBeDefined();
+      expect(user.email).toBe('test@example.com');
+      expect(user.name).toBe('Test User');
+      expect(user.role).toBe(Role.USER);
+      expect(user.isActive).toBe(true);
+    });
+
+    it('should lowercase email', () => {
+      const user = service.createUser('TEST@EXAMPLE.COM', 'Test User', Role.USER);
+
+      expect(user.email).toBe('test@example.com');
+    });
+
+    it('should reject duplicate email', () => {
+      service.createUser('test@example.com', 'User 1', Role.USER);
+
+      try {
+        service.createUser('test@example.com', 'User 2', Role.USER);
+        expect.unreachable('Should throw error');
+      } catch (error: unknown) {
+        expect((error as Error).message).toContain('UNIQUE constraint failed');
+      }
+    });
+
+    it('should generate unique IDs', () => {
+      const user1 = service.createUser('user1@example.com', 'User 1', Role.USER);
+      const user2 = service.createUser('user2@example.com', 'User 2', Role.USER);
+
+      expect(user1.id).not.toBe(user2.id);
+    });
+  });
+
+  describe('getUser', () => {
+    it('should retrieve user by ID', () => {
+      const created = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      const retrieved = service.getUser(created.id);
+      expect(retrieved).toBeDefined();
+      expect(retrieved?.email).toBe('test@example.com');
+    });
+
+    it('should return null for unknown user', () => {
+      const user = service.getUser('unknown-id');
+      expect(user).toBeNull();
+    });
+  });
+
+  describe('getUserByEmail', () => {
+    it('should retrieve user by email', () => {
+      service.createUser('test@example.com', 'Test User', Role.USER);
+
+      const user = service.getUserByEmail('test@example.com');
+      expect(user).toBeDefined();
+      expect(user?.name).toBe('Test User');
+    });
+
+    it('should be case-insensitive', () => {
+      service.createUser('test@example.com', 'Test User', Role.USER);
+
+      const user = service.getUserByEmail('TEST@EXAMPLE.COM');
+      expect(user).toBeDefined();
+      expect(user?.email).toBe('test@example.com');
+    });
+
+    it('should return null for unknown email', () => {
+      const user = service.getUserByEmail('unknown@example.com');
+      expect(user).toBeNull();
+    });
+  });
+
+  describe('listUsers', () => {
+    it('should list all users', () => {
+      service.createUser('user1@example.com', 'User 1', Role.USER);
+      service.createUser('user2@example.com', 'User 2', Role.ADMIN);
+      service.createUser('user3@example.com', 'User 3', Role.GUEST);
+
+      const users = service.listUsers();
+      expect(users).toHaveLength(3);
+    });
+
+    it('should return empty array initially', () => {
+      const users = service.listUsers();
+      expect(users).toEqual([]);
+    });
+  });
+
+  describe('setPassword', () => {
+    it('should set password for user', async () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      await service.setPassword(user.id, 'Password123!');
+
+      const valid = await service.verifyPassword(user.id, 'Password123!');
+      expect(valid).toBe(true);
+    });
+
+    it('should reject password too short', async () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      try {
+        await service.setPassword(user.id, 'short');
+        expect.unreachable('Should throw error');
+      } catch (error: unknown) {
+        expect((error as Error).message).toContain('Min 8 characters');
+      }
+    });
+
+    it('should require uppercase', async () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      try {
+        await service.setPassword(user.id, 'password123!');
+        expect.unreachable('Should throw error');
+      } catch (error: unknown) {
+        expect((error as Error).message).toContain('uppercase letter');
+      }
+    });
+
+    it('should require number', async () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      try {
+        await service.setPassword(user.id, 'Password!!!!');
+        expect.unreachable('Should throw error');
+      } catch (error: unknown) {
+        expect((error as Error).message).toBeTruthy();
+      }
+    });
+
+    it('should require special character', async () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      try {
+        await service.setPassword(user.id, 'Password12345');
+        expect.unreachable('Should throw error');
+      } catch (error: unknown) {
+        expect((error as Error).message).toBeTruthy();
+      }
+    });
+
+    it('should hash password and verify it', async () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      await service.setPassword(user.id, 'Password123!');
+
+      const valid = await service.verifyPassword(user.id, 'Password123!');
+      expect(valid).toBe(true);
+
+      const invalid = await service.verifyPassword(user.id, 'WrongPassword1!');
+      expect(invalid).toBe(false);
+    });
+  });
+
+  describe('verifyPassword', () => {
+    it('should verify correct password', async () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      await service.setPassword(user.id, 'Password123!');
+
+      const valid = await service.verifyPassword(user.id, 'Password123!');
+      expect(valid).toBe(true);
+    });
+
+    it('should reject wrong password', async () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.USER);
+
+      await service.setPassword(user.id, 'Password123!');
+
+      const valid = await service.verifyPassword(user.id, 'WrongPassword123!');
+      expect(valid).toBe(false);
+    });
+
+    it('should return false for user without password', async () => {
+      const user = service.createUser('test@example.com', 'Test User', Role.SERVICE);
+
+      const valid = await service.verifyPassword(user.id, 'Password123!');
+      expect(valid).toBe(false);
+    });
+  });
+
+  describe('hasAdmin', () => {
+    it('should detect if admin exists', () => {
+      let hasAdmin = service.hasAdmin();
+      expect(hasAdmin).toBe(false);
+
+      service.createUser('admin@example.com', 'Admin', Role.ADMIN);
+      hasAdmin = service.hasAdmin();
+      expect(hasAdmin).toBe(true);
+    });
+
+    it('should return false initially', () => {
+      const hasAdmin = service.hasAdmin();
+      expect(hasAdmin).toBe(false);
+    });
+  });
+});

package/src/__tests__/canAccess.test.ts

@@ -0,0 +1,166 @@
+/**
+ * @brika/auth - canAccess Tests
+ */
+
+import { describe, expect, it } from 'bun:test';
+import {
+  canAccess,
+  canAccessAll,
+  createPermissionChecker,
+  Features,
+} from '../middleware/canAccess';
+import { Role, Scope } from '../types';
+
+describe('canAccess', () => {
+  describe('canAccess function', () => {
+    it('should return false for null/undefined scopes', () => {
+      expect(canAccess(null, Scope.WORKFLOW_READ)).toBe(false);
+      expect(canAccess(undefined, Scope.WORKFLOW_READ)).toBe(false);
+      expect(canAccess([], Scope.WORKFLOW_READ)).toBe(false);
+    });
+
+    it('should check single scope', () => {
+      const scopes = [Scope.WORKFLOW_READ];
+      expect(canAccess(scopes, Scope.WORKFLOW_READ)).toBe(true);
+      expect(canAccess(scopes, Scope.WORKFLOW_WRITE)).toBe(false);
+    });
+
+    it('should check multiple scopes (any)', () => {
+      const scopes = [Scope.WORKFLOW_READ, Scope.BOARD_READ];
+      const required = [Scope.WORKFLOW_WRITE, Scope.WORKFLOW_READ];
+      expect(canAccess(scopes, required)).toBe(true);
+    });
+
+    it('should grant all to admin', () => {
+      const scopes = [Scope.ADMIN_ALL];
+      expect(canAccess(scopes, Scope.WORKFLOW_READ)).toBe(true);
+      expect(canAccess(scopes, Scope.PLUGIN_MANAGE)).toBe(true);
+      expect(canAccess(scopes, Scope.SETTINGS_WRITE)).toBe(true);
+    });
+
+    it('should handle array input', () => {
+      const scopes = [Scope.WORKFLOW_READ, Scope.WORKFLOW_WRITE];
+      const required = [Scope.WORKFLOW_WRITE, Scope.WORKFLOW_EXECUTE];
+      expect(canAccess(scopes, required)).toBe(true); // Has one
+    });
+  });
+
+  describe('canAccessAll function', () => {
+    it('should return false for null/undefined scopes', () => {
+      expect(canAccessAll(null, [Scope.WORKFLOW_READ])).toBe(false);
+      expect(canAccessAll(undefined, [Scope.WORKFLOW_READ])).toBe(false);
+    });
+
+    it('should check all required scopes', () => {
+      const scopes = [Scope.WORKFLOW_READ, Scope.WORKFLOW_WRITE];
+      expect(canAccessAll(scopes, [Scope.WORKFLOW_READ, Scope.WORKFLOW_WRITE])).toBe(true);
+      expect(canAccessAll(scopes, [Scope.WORKFLOW_READ, Scope.WORKFLOW_EXECUTE])).toBe(false);
+    });
+
+    it('should grant all to admin', () => {
+      const scopes = [Scope.ADMIN_ALL];
+      expect(
+        canAccessAll(scopes, [Scope.WORKFLOW_READ, Scope.WORKFLOW_WRITE, Scope.PLUGIN_MANAGE])
+      ).toBe(true);
+    });
+  });
+
+  describe('createPermissionChecker', () => {
+    it('should create feature permission object', () => {
+      const WorkflowPerms = createPermissionChecker('Workflow', {
+        read: Scope.WORKFLOW_READ,
+        write: Scope.WORKFLOW_WRITE,
+        execute: Scope.WORKFLOW_EXECUTE,
+      });
+
+      expect(typeof WorkflowPerms.read).toBe('function');
+      expect(typeof WorkflowPerms.write).toBe('function');
+      expect(typeof WorkflowPerms.execute).toBe('function');
+    });
+
+    it('should check permissions correctly', () => {
+      const WorkflowPerms = createPermissionChecker('Workflow', {
+        read: Scope.WORKFLOW_READ,
+        write: Scope.WORKFLOW_WRITE,
+      });
+
+      const userScopes = [Scope.WORKFLOW_READ];
+      const readCheck = WorkflowPerms.read;
+      const writeCheck = WorkflowPerms.write;
+      if (!readCheck || !writeCheck) {
+        throw new Error('Expected read and write permission checkers to be defined');
+      }
+      expect(readCheck(userScopes)).toBe(true);
+      expect(writeCheck(userScopes)).toBe(false);
+    });
+
+    it('should support array scopes', () => {
+      const AdminPerms = createPermissionChecker('Admin', {
+        fullAccess: [Scope.ADMIN_ALL],
+        userManagement: [Scope.ADMIN_ALL],
+      });
+
+      const adminScopes = [Scope.ADMIN_ALL];
+      const fullAccessCheck = AdminPerms.fullAccess;
+      const userManagementCheck = AdminPerms.userManagement;
+      if (!fullAccessCheck || !userManagementCheck) {
+        throw new Error('Expected fullAccess and userManagement permission checkers to be defined');
+      }
+      expect(fullAccessCheck(adminScopes)).toBe(true);
+      expect(userManagementCheck(adminScopes)).toBe(true);
+    });
+  });
+
+  describe('Features preset', () => {
+    it('should have Workflow feature', () => {
+      expect(Features.Workflow.read).toBeDefined();
+      expect(Features.Workflow.write).toBeDefined();
+      expect(Features.Workflow.execute).toBeDefined();
+    });
+
+    it('should check Workflow permissions', () => {
+      const userScopes = [Scope.WORKFLOW_READ, Scope.WORKFLOW_WRITE];
+      const readCheck = Features.Workflow.read;
+      const writeCheck = Features.Workflow.write;
+      const executeCheck = Features.Workflow.execute;
+      if (!readCheck || !writeCheck || !executeCheck) {
+        throw new Error('Expected Workflow permission checkers to be defined');
+      }
+      expect(readCheck(userScopes)).toBe(true);
+      expect(writeCheck(userScopes)).toBe(true);
+      expect(executeCheck(userScopes)).toBe(false);
+    });
+
+    it('should have Board feature', () => {
+      expect(Features.Board.read).toBeDefined();
+      expect(Features.Board.write).toBeDefined();
+    });
+
+    it('should have Plugin feature', () => {
+      expect(Features.Plugin.read).toBeDefined();
+      expect(Features.Plugin.manage).toBeDefined();
+    });
+
+    it('should have Settings feature', () => {
+      expect(Features.Settings.read).toBeDefined();
+      expect(Features.Settings.write).toBeDefined();
+    });
+
+    it('should have Admin feature', () => {
+      expect(Features.Admin.all).toBeDefined();
+    });
+
+    it('should work with admin scopes', () => {
+      const adminScopes = [Scope.ADMIN_ALL];
+      const executeCheck = Features.Workflow.execute;
+      const boardWriteCheck = Features.Board.write;
+      const adminAllCheck = Features.Admin.all;
+      if (!executeCheck || !boardWriteCheck || !adminAllCheck) {
+        throw new Error('Expected permission checkers to be defined');
+      }
+      expect(executeCheck(adminScopes)).toBe(true);
+      expect(boardWriteCheck(adminScopes)).toBe(true);
+      expect(adminAllCheck(adminScopes)).toBe(true);
+    });
+  });
+});