@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/api/__tests__/auth-routes-invalid-body-invite.test.ts

@@ -0,0 +1,253 @@
+// auth-routes invalid_body + invite-accept success paths — HTTP-layer only,
+// stub Dispatcher (same pattern as auth-routes-mfa-verify.test.ts).
+
+import { describe, expect, test } from "bun:test";
+import type { Hono } from "hono";
+import { Hono as HonoCtor } from "hono";
+import type { SessionUser, TenantId } from "../../engine/types";
+import type { BatchResult, Dispatcher, WriteResult } from "../../pipeline/dispatcher";
+import { TestUsers } from "../../stack";
+import { getSetCookies } from "../../testing/http-cookies";
+import { PUBLIC_API_PATHS } from "../api-constants";
+import { AUTH_COOKIE_NAME, authMiddleware, CSRF_COOKIE_NAME } from "../auth-middleware";
+import { type AuthRoutesConfig, createAuthRoutes } from "../auth-routes";
+import { createJwtHelper } from "../jwt";
+
+const JWT_SECRET = "auth-routes-invalid-body-invite-secret-min-32-chars";
+const INVITE_ACCEPT_QN = "auth:write:invite-accept";
+const INVITE_LOGIN_QN = "auth:write:invite-accept-with-login";
+
+function createStubDispatcher(overrides?: Partial<Dispatcher>): Dispatcher {
+  const base: Dispatcher = {
+    async write(): Promise<WriteResult> {
+      const ok: WriteResult = { isSuccess: true, data: { kind: "noop" } };
+      return ok;
+    },
+    async query(): Promise<unknown> {
+      return [];
+    },
+    async command(): Promise<void> {},
+    async batch(): Promise<BatchResult> {
+      return { isSuccess: true, results: [] };
+    },
+    async resolveAuthClaims(): Promise<Record<string, unknown>> {
+      return {};
+    },
+    // Stream API added with r.streamHandler (#1446) — stub unused in these routes.
+    async *stream(): AsyncGenerator<unknown> {},
+  };
+  return { ...base, ...overrides };
+}
+
+async function buildApp(
+  overrides: Partial<AuthRoutesConfig> = {},
+  dispatcher: Dispatcher = createStubDispatcher(),
+): Promise<{ app: Hono; validToken: string }> {
+  const jwt = createJwtHelper(JWT_SECRET);
+  const validToken = await jwt.sign(TestUsers.user);
+  const config: AuthRoutesConfig = {
+    membershipQuery: "tenant:query:memberships",
+    loginHandler: "auth:write:login",
+    loginRateLimit: null,
+    ...overrides,
+  };
+  const app = new HonoCtor();
+  const jwtGuard = authMiddleware(jwt);
+  app.use("/api/*", async (c, next) => {
+    if (PUBLIC_API_PATHS.has(c.req.path)) return next();
+    return jwtGuard(c, next);
+  });
+  app.route("/api", createAuthRoutes(dispatcher, jwt, config));
+  return { app, validToken };
+}
+
+const inviteConfig: AuthRoutesConfig["invite"] = {
+  acceptHandler: INVITE_ACCEPT_QN,
+  acceptWithLoginHandler: INVITE_LOGIN_QN,
+  signupCompleteHandler: "auth:write:invite-signup-complete",
+};
+
+describe("POST /auth/login — invalid_body", () => {
+  test("400 when password field is missing", async () => {
+    let dispatched = false;
+    const dispatcher = createStubDispatcher({
+      async write(): Promise<WriteResult> {
+        dispatched = true;
+        return { isSuccess: true, data: { kind: "auth-session", session: TestUsers.user } };
+      },
+    });
+    const { app } = await buildApp({}, dispatcher);
+    const res = await app.request("/api/auth/login", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: "a@b.c" }),
+    });
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { isSuccess: boolean; error: string };
+    expect(body.error).toBe("invalid_body");
+    expect(dispatched).toBe(false);
+  });
+});
+
+describe("POST /auth/invite-accept", () => {
+  test("requires JWT — not a public route", async () => {
+    expect(PUBLIC_API_PATHS.has("/api/auth/invite-accept")).toBe(false);
+
+    let dispatched = false;
+    const dispatcher = createStubDispatcher({
+      async write(): Promise<WriteResult> {
+        dispatched = true;
+        return { isSuccess: true, data: { kind: "noop" } };
+      },
+    });
+    const { app } = await buildApp({ invite: inviteConfig }, dispatcher);
+    const res = await app.request("/api/auth/invite-accept", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ inviteToken: "t" }),
+    });
+    expect(res.status).toBe(401);
+    expect(dispatched).toBe(false);
+  });
+
+  test("400 invalid_body before dispatch", async () => {
+    let dispatched = false;
+    const dispatcher = createStubDispatcher({
+      async write(): Promise<WriteResult> {
+        dispatched = true;
+        return {
+          isSuccess: true,
+          data: {
+            kind: "invite-accepted",
+            tenantId: TestUsers.otherTenant.tenantId,
+            role: "User",
+            alreadyMember: false,
+          },
+        };
+      },
+    });
+    const { app, validToken } = await buildApp({ invite: inviteConfig }, dispatcher);
+    const res = await app.request("/api/auth/invite-accept", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${validToken}`,
+      },
+      body: JSON.stringify({}),
+    });
+    expect(res.status).toBe(400);
+    expect((await res.json()) as { isSuccess: boolean; error: string }).toMatchObject({
+      isSuccess: false,
+      error: "invalid_body",
+    });
+    expect(dispatched).toBe(false);
+  });
+
+  test("success returns tenantId, role, alreadyMember", async () => {
+    const tenantId = TestUsers.otherTenant.tenantId as TenantId;
+    let receivedUser: SessionUser | undefined;
+    const dispatcher = createStubDispatcher({
+      async write(qn, payload, user): Promise<WriteResult> {
+        expect(qn).toBe(INVITE_ACCEPT_QN);
+        expect(payload).toEqual({ token: "invite-token-abc" });
+        receivedUser = user;
+        return {
+          isSuccess: true,
+          data: {
+            kind: "invite-accepted",
+            tenantId,
+            role: "Editor",
+            alreadyMember: true,
+          },
+        };
+      },
+    });
+    const { app, validToken } = await buildApp({ invite: inviteConfig }, dispatcher);
+    const res = await app.request("/api/auth/invite-accept", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${validToken}`,
+      },
+      body: JSON.stringify({ token: "invite-token-abc" }),
+    });
+    expect(res.status).toBe(200);
+    expect(receivedUser?.id).toBe(TestUsers.user.id);
+    expect(await res.json()).toEqual({
+      isSuccess: true,
+      tenantId,
+      role: "Editor",
+      alreadyMember: true,
+    });
+  });
+});
+
+describe("POST /auth/invite-accept-with-login — invalid_body + success", () => {
+  test("400 when email missing", async () => {
+    let dispatched = false;
+    const dispatcher = createStubDispatcher({
+      async write(): Promise<WriteResult> {
+        dispatched = true;
+        return { isSuccess: true, data: { kind: "auth-session", session: TestUsers.user } };
+      },
+    });
+    const { app } = await buildApp({ invite: inviteConfig }, dispatcher);
+    const res = await app.request("/api/auth/invite-accept-with-login", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token: "t", password: "long-enough-pw" }),
+    });
+    expect(res.status).toBe(400);
+    expect((await res.json()) as { error: string }).toMatchObject({
+      isSuccess: false,
+      error: "invalid_body",
+    });
+    expect(dispatched).toBe(false);
+  });
+
+  test("success mints JWT + cookies", async () => {
+    const tenantId = TestUsers.otherTenant.tenantId as TenantId;
+    const dispatcher = createStubDispatcher({
+      async write(qn, payload): Promise<WriteResult> {
+        expect(qn).toBe(INVITE_LOGIN_QN);
+        expect(payload).toEqual({
+          token: "invite-t",
+          email: "user@example.com",
+          password: "password123",
+        });
+        return {
+          isSuccess: true,
+          data: {
+            kind: "auth-session",
+            session: TestUsers.user,
+            tenantId,
+            role: "User",
+          },
+        };
+      },
+    });
+    const { app } = await buildApp({ invite: inviteConfig }, dispatcher);
+    const res = await app.request("/api/auth/invite-accept-with-login", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        token: "invite-t",
+        email: "user@example.com",
+        password: "password123",
+      }),
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      isSuccess: boolean;
+      token: string;
+      tenantId: TenantId;
+      role: string;
+    };
+    expect(body.isSuccess).toBe(true);
+    expect(typeof body.token).toBe("string");
+    expect(body.tenantId).toBe(tenantId);
+    expect(body.role).toBe("User");
+    expect(getSetCookies(res).get(AUTH_COOKIE_NAME)).toBeDefined();
+    expect(getSetCookies(res).get(CSRF_COOKIE_NAME)).toBeDefined();
+  });
+});

package/src/api/__tests__/auth-routes-mfa-preauth-confirm.test.ts

@@ -0,0 +1,222 @@
+// auth-routes /auth/mfa/preauth-confirm — framework-level route mechanics
+// only: body validation, dispatch-and-mint-on-success, its OWN rate limiter
+// (mfaPreauthConfirmRateLimit, distinct from mfaVerifyRateLimit/
+// loginRateLimit), and error-status mapping. Uses a stub Dispatcher with a
+// fake handler — the REAL setupToken verification / TOTP check / brute-
+// force cap lives in auth-mfa's own handler and is covered there, not here.
+
+import { describe, expect, test } from "bun:test";
+import type { Hono } from "hono";
+import { Hono as HonoCtor } from "hono";
+import { InternalError, UnprocessableError } from "../../errors";
+import type { BatchResult, Dispatcher, WriteResult } from "../../pipeline/dispatcher";
+import { TestUsers } from "../../stack";
+import { getSetCookies } from "../../testing/http-cookies";
+import { PUBLIC_API_PATHS } from "../api-constants";
+import { AUTH_COOKIE_NAME, authMiddleware, CSRF_COOKIE_NAME } from "../auth-middleware";
+import {
+  type AuthRoutesConfig,
+  createAuthRoutes,
+  createInMemoryLoginRateLimiter,
+} from "../auth-routes";
+import { createJwtHelper } from "../jwt";
+
+const JWT_SECRET = "test-jwt-secret-for-mfa-preauth-confirm-route-tests-only-not-a-real-secret";
+const PREAUTH_CONFIRM_QN = "auth-mfa:write:enable-confirm-preauth";
+
+function createStubDispatcher(overrides?: Partial<Dispatcher>): Dispatcher {
+  const base: Dispatcher = {
+    async write(): Promise<WriteResult> {
+      const ok: WriteResult = {
+        isSuccess: true,
+        data: { kind: "mfa-preauth-confirm-success", session: TestUsers.user },
+      };
+      return ok;
+    },
+    async query(): Promise<unknown> {
+      return [];
+    },
+    async *stream(): AsyncGenerator<unknown> {},
+    async command(): Promise<void> {},
+    async batch(): Promise<BatchResult> {
+      const ok: BatchResult = { isSuccess: true, results: [] };
+      return ok;
+    },
+    async resolveAuthClaims(): Promise<Record<string, unknown>> {
+      return {};
+    },
+  };
+  return { ...base, ...overrides };
+}
+
+async function buildApp(
+  overrides: Partial<AuthRoutesConfig> = {},
+  dispatcher: Dispatcher = createStubDispatcher(),
+): Promise<{ app: Hono }> {
+  const jwt = createJwtHelper(JWT_SECRET);
+  const config: AuthRoutesConfig = {
+    membershipQuery: "tenant:query:memberships",
+    mfaPreauthConfirmHandler: PREAUTH_CONFIRM_QN,
+    mfaPreauthConfirmRateLimit: null,
+    ...overrides,
+  };
+  const app = new HonoCtor();
+  const jwtGuard = authMiddleware(jwt);
+  app.use("/api/*", async (c, next) => {
+    if (PUBLIC_API_PATHS.has(c.req.path)) return next();
+    return jwtGuard(c, next);
+  });
+  app.route("/api", createAuthRoutes(dispatcher, jwt, config));
+  return { app };
+}
+
+function preauthConfirmRequest(body: unknown): Request {
+  return new Request("http://localhost/api/auth/mfa/preauth-confirm", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+describe("POST /auth/mfa/preauth-confirm", () => {
+  test("is public — reachable without a JWT", async () => {
+    expect(PUBLIC_API_PATHS.has("/api/auth/mfa/preauth-confirm")).toBe(true);
+    const { app } = await buildApp();
+    const res = await app.request(preauthConfirmRequest({ setupToken: "t", code: "123456" }));
+    // No Authorization header sent at all — if the route required a JWT,
+    // authMiddleware would reject with 401 before the handler ever runs.
+    expect(res.status).toBe(200);
+  });
+
+  test("not mounted when mfaPreauthConfirmHandler is unset", async () => {
+    const { app } = await buildApp({ mfaPreauthConfirmHandler: undefined });
+    const res = await app.request(preauthConfirmRequest({ setupToken: "t", code: "123456" }));
+    expect(res.status).toBe(404);
+  });
+
+  test("400 on a malformed body, before dispatch or rate-limit", async () => {
+    let dispatched = false;
+    const dispatcher = createStubDispatcher({
+      async write(): Promise<WriteResult> {
+        dispatched = true;
+        return {
+          isSuccess: true,
+          data: { kind: "mfa-preauth-confirm-success", session: TestUsers.user },
+        };
+      },
+    });
+    // An active limiter, not null — "before rate-limit" is only checkable
+    // when there's a rate-limit to (not) consume.
+    const { app } = await buildApp(
+      { mfaPreauthConfirmRateLimit: createInMemoryLoginRateLimiter(2, 60_000) },
+      dispatcher,
+    );
+    const res = await app.request(preauthConfirmRequest({ setupToken: "t" }));
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { isSuccess: boolean; error: string };
+    expect(body.error).toBe("invalid_body");
+    expect(dispatched).toBe(false);
+
+    // The limiter's cap (2) must still be fully available — a malformed
+    // body must not have consumed an attempt.
+    for (let i = 0; i < 5; i++) {
+      const retry = await app.request(preauthConfirmRequest({ setupToken: "t" }));
+      expect(retry.status).toBe(400);
+    }
+  });
+
+  test("on success: dispatches to mfaPreauthConfirmHandler, mints a JWT + cookies", async () => {
+    let receivedBody: unknown;
+    const dispatcher = createStubDispatcher({
+      async write(qn, payload): Promise<WriteResult> {
+        expect(qn).toBe(PREAUTH_CONFIRM_QN);
+        receivedBody = payload;
+        return {
+          isSuccess: true,
+          data: { kind: "mfa-preauth-confirm-success", session: TestUsers.user },
+        };
+      },
+    });
+    const { app } = await buildApp({}, dispatcher);
+    const res = await app.request(
+      preauthConfirmRequest({ setupToken: "secret-carrying-setup-token", code: "123456" }),
+    );
+    expect(res.status).toBe(200);
+    expect(receivedBody).toEqual({
+      setupToken: "secret-carrying-setup-token",
+      code: "123456",
+    });
+
+    const body = (await res.json()) as { isSuccess: boolean; token: string };
+    expect(body.isSuccess).toBe(true);
+    expect(typeof body.token).toBe("string");
+    expect(body.token.length).toBeGreaterThan(20);
+
+    const cookies = getSetCookies(res);
+    expect(cookies.get(AUTH_COOKIE_NAME)).toBeDefined();
+    expect(cookies.get(CSRF_COOKIE_NAME)).toBeDefined();
+  });
+
+  test("a handler failure maps through mfaPreauthConfirmErrorStatusMap", async () => {
+    const dispatcher = createStubDispatcher({
+      async write(): Promise<WriteResult> {
+        return {
+          isSuccess: false,
+          error: new UnprocessableError("invalid_totp_code", {
+            details: { reason: "invalid_totp_code" },
+          }),
+        };
+      },
+    });
+    const { app } = await buildApp(
+      { mfaPreauthConfirmErrorStatusMap: { invalid_totp_code: 422 } },
+      dispatcher,
+    );
+    const res = await app.request(preauthConfirmRequest({ setupToken: "t", code: "000000" }));
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { isSuccess: boolean };
+    expect(body.isSuccess).toBe(false);
+  });
+
+  test("an unmapped handler failure falls back to the error's own httpStatus", async () => {
+    const dispatcher = createStubDispatcher({
+      async write(): Promise<WriteResult> {
+        return { isSuccess: false, error: new InternalError({ message: "boom" }) };
+      },
+    });
+    const { app } = await buildApp({}, dispatcher);
+    const res = await app.request(preauthConfirmRequest({ setupToken: "t", code: "000000" }));
+    expect(res.status).toBe(500);
+  });
+
+  test("mfaPreauthConfirmRateLimit is independent from mfaVerifyRateLimit — 429 after its own cap", async () => {
+    const dispatcher = createStubDispatcher({
+      async write(): Promise<WriteResult> {
+        return {
+          isSuccess: false,
+          error: new UnprocessableError("invalid_totp_code"),
+        };
+      },
+    });
+    const { app } = await buildApp(
+      { mfaPreauthConfirmRateLimit: createInMemoryLoginRateLimiter(2, 60_000) },
+      dispatcher,
+    );
+    const attempt = () => app.request(preauthConfirmRequest({ setupToken: "t", code: "000000" }));
+    expect((await attempt()).status).toBe(422);
+    expect((await attempt()).status).toBe(422);
+    const third = await attempt();
+    expect(third.status).toBe(429);
+    const body = (await third.json()) as { isSuccess: boolean; error: string };
+    expect(body.error).toBe("rate_limited");
+  });
+
+  test("a successful confirm resets the rate-limit counter for that IP", async () => {
+    const { app } = await buildApp({
+      mfaPreauthConfirmRateLimit: createInMemoryLoginRateLimiter(1, 60_000),
+    });
+    const attempt = () => app.request(preauthConfirmRequest({ setupToken: "t", code: "000000" }));
+    expect((await attempt()).status).toBe(200);
+    expect((await attempt()).status).toBe(200);
+  });
+});