@cosmicdrift/kumiko-server-runtime 0.329.0 → 0.330.2

package/src/__tests__/cache-headers.test.ts

@@ -1,83 +0,0 @@
-// Unit-Tests für staticCachePolicy — die Cache-Strategie hinter
-// runProdApp's static-fallback. Pure function, leicht zu testen.
-//
-// Strategie (siehe run-prod-app.ts):
-//   /assets/*               → immutable
-//   /, /index.html          → revalidate (max-age=0, must-revalidate)
-//   /manifest.json, /sw.js,
-//   /build-info.json        → no-cache
-//   alles andere            → none
-
-import { describe, expect, test } from "bun:test";
-import { cacheControlHeader } from "@cosmicdrift/kumiko-framework/api";
-import { staticCachePolicy } from "../run-prod-app";
-
-function cacheControlFor(pathname: string): Record<string, string> {
-  const header = cacheControlHeader(staticCachePolicy(pathname));
-  return header === undefined ? {} : { "cache-control": header };
-}
-
-describe("staticCachePolicy", () => {
-  test("hashed asset → immutable + 1 Jahr", () => {
-    expect(cacheControlFor("/assets/client-abc123.js")).toEqual({
-      "cache-control": "public, max-age=31536000, immutable",
-    });
-  });
-
-  test("hashed CSS asset → immutable + 1 Jahr", () => {
-    expect(cacheControlFor("/assets/styles-def456.css")).toEqual({
-      "cache-control": "public, max-age=31536000, immutable",
-    });
-  });
-
-  test("nested asset path → immutable", () => {
-    expect(cacheControlFor("/assets/chunks/foo-789.js")).toEqual({
-      "cache-control": "public, max-age=31536000, immutable",
-    });
-  });
-
-  test("/ → revalidate", () => {
-    expect(cacheControlFor("/")).toEqual({
-      "cache-control": "public, max-age=0, must-revalidate",
-    });
-  });
-
-  test("/index.html → revalidate", () => {
-    expect(cacheControlFor("/index.html")).toEqual({
-      "cache-control": "public, max-age=0, must-revalidate",
-    });
-  });
-
-  test("/manifest.json → no-cache", () => {
-    expect(cacheControlFor("/manifest.json")).toEqual({
-      "cache-control": "no-cache",
-    });
-  });
-
-  test("/sw.js → no-cache", () => {
-    expect(cacheControlFor("/sw.js")).toEqual({
-      "cache-control": "no-cache",
-    });
-  });
-
-  test("/build-info.json → no-cache (sonst pollt UpdateChecker eine veraltete id)", () => {
-    expect(cacheControlFor("/build-info.json")).toEqual({
-      "cache-control": "no-cache",
-    });
-  });
-
-  test("public-folder file (favicon) → kein expliziter Header", () => {
-    expect(cacheControlFor("/favicon.ico")).toEqual({});
-  });
-
-  test("public-folder file (og-image) → kein expliziter Header", () => {
-    expect(cacheControlFor("/og-image.png")).toEqual({});
-  });
-
-  test("path mit assets als Substring (kein /assets/ prefix) → kein immutable", () => {
-    // Schutz: /myassets/foo.js soll NICHT immutable kriegen — wäre ein Bug
-    // weil die nicht gehashed sind.
-    expect(cacheControlFor("/myassets/foo.js")).toEqual({});
-    expect(cacheControlFor("/foo/assets/bar.js")).toEqual({});
-  });
-});

package/src/__tests__/compose-features-mfa-wiring.integration.test.ts

@@ -1,308 +0,0 @@
-// Full-stack wiring test for kumiko-framework#266 Step 6: proves the exact
-// bootstrap path runProdApp/runDevApp produce — composeFeatures() auto-
-// detecting a mounted auth-mfa app-feature and wiring its status-checker
-// into the login handler — actually completes a two-step login over real
-// HTTP. compose-features-wiring.integration.test.ts pins the same pattern
-// for passwordReset/emailVerification; this is the auth-mfa analogue.
-//
-// No mocking: setupTestStack boots a real DB + Redis.
-
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import {
-  AuthHandlers,
-  hashPassword,
-} from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
-import {
-  AuthMfaHandlers,
-  base32Decode,
-  bindMfaRevokeAllOtherSessionsFromFeature,
-  createAuthMfaFeature,
-  mfaRequiredConfigHandle,
-  userMfaEntity,
-} from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
-import { currentTotpCode } from "@cosmicdrift/kumiko-bundled-features/auth-mfa/testing";
-import {
-  configValuesTable,
-  createConfigResolver,
-} from "@cosmicdrift/kumiko-bundled-features/config";
-import {
-  createSessionCallbacks,
-  userSessionEntity,
-} from "@cosmicdrift/kumiko-bundled-features/sessions";
-import { tenantEntity, tenantMembershipsTable } from "@cosmicdrift/kumiko-bundled-features/tenant";
-import { seedTenantMembership } from "@cosmicdrift/kumiko-bundled-features/tenant/testing";
-import { UserHandlers, userEntity, userTable } from "@cosmicdrift/kumiko-bundled-features/user";
-import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  setupTestStack,
-  type TestStack,
-  TestUsers,
-  unsafeCreateEntityTable,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import { createTestEnvelopeCipher, deleteRows } from "@cosmicdrift/kumiko-framework/testing";
-import { composeFeatures } from "../compose-features";
-
-const CHALLENGE_TOKEN_SECRET = "test-mfa-challenge-secret-at-least-32-bytes!!";
-const SETUP_TOKEN_SECRET = "test-mfa-setup-secret-at-least-32-bytes-long!!";
-const TEST_TENANT_ID: TenantId = "00000000-0000-4000-8000-000000000001" as TenantId;
-const systemAdmin = TestUsers.systemAdmin;
-
-async function bootStack(): Promise<TestStack> {
-  configureEntityFieldEncryption(createTestEnvelopeCipher());
-  const mfaFeature = createAuthMfaFeature({
-    setupTokenSecret: SETUP_TOKEN_SECRET,
-    challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
-    issuer: "Kumiko Test",
-  });
-
-  // Exactly what runProdApp/runDevApp do: composeFeatures sees auth-mfa in
-  // the app-feature list and threads mfaStatusChecker into the bundled
-  // auth-email-password feature's login handler on its own — no authOptions
-  // override needed here, which is the thing this test proves.
-  const features = composeFeatures([mfaFeature], { includeBundled: true });
-
-  const stack = await setupTestStack({
-    features,
-    extraContext: () => ({ configResolver: createConfigResolver() }),
-    authConfig: {
-      membershipQuery: "tenant:query:memberships",
-      loginHandler: AuthHandlers.login,
-      mfaVerifyHandler: AuthMfaHandlers.verify,
-    },
-  });
-
-  const sessionCallbacks = createSessionCallbacks({ db: stack.db });
-  bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(sessionCallbacks.sessionRevokeAllOthers);
-
-  await unsafeCreateEntityTable(stack.db, userEntity);
-  await unsafeCreateEntityTable(stack.db, tenantEntity);
-  await unsafeCreateEntityTable(stack.db, userMfaEntity);
-  await unsafeCreateEntityTable(stack.db, userSessionEntity);
-  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
-
-  return stack;
-}
-
-async function seedUser(
-  stack: TestStack,
-  opts: { email: string; password: string; roles?: readonly string[] },
-): Promise<{ id: string }> {
-  const hash = await hashPassword(opts.password);
-  const created = await stack.http.writeOk<{ id: string }>(
-    UserHandlers.create,
-    { email: opts.email, passwordHash: hash, displayName: opts.email.split("@")[0] ?? "user" },
-    systemAdmin,
-  );
-  await seedTenantMembership(stack.db, {
-    userId: created.id,
-    tenantId: TEST_TENANT_ID,
-    roles: opts.roles ?? ["User"],
-  });
-  return { id: created.id };
-}
-
-describe("composeFeatures wiring — auth-mfa (kumiko-framework#266 Step 6)", () => {
-  let stack: TestStack;
-
-  beforeAll(async () => {
-    stack = await bootStack();
-  });
-
-  afterAll(async () => {
-    await stack.cleanup();
-  });
-
-  beforeEach(async () => {
-    await deleteRows(stack.db, userTable, {});
-    await deleteRows(stack.db, tenantMembershipsTable, {});
-  });
-
-  test("full login-with-MFA flow: password login → mfa-challenge → /auth/mfa/verify → session", async () => {
-    const user = await seedUser(stack, {
-      email: "alice@example.com",
-      password: "correct-password-1234",
-    });
-
-    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
-      AuthMfaHandlers.enableStart,
-      { accountLabel: "alice@example.com" },
-      { id: user.id, tenantId: TEST_TENANT_ID, roles: ["User"] },
-    );
-    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
-    const secret = base32Decode(secretParam);
-    await stack.http.writeOk(
-      AuthMfaHandlers.enableConfirm,
-      { setupToken: start.setupToken, code: currentTotpCode(secret) },
-      { id: user.id, tenantId: TEST_TENANT_ID, roles: ["User"] },
-    );
-
-    // Step 1: a correct password no longer mints a session directly — it
-    // hands back a challenge, proving composeFeatures actually wired
-    // mfaStatusChecker into the login handler (without the wiring this
-    // would 200 straight to a session and the test would fail below).
-    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
-      email: "alice@example.com",
-      password: "correct-password-1234",
-    });
-    expect(loginRes.status).toBe(200);
-    const loginBody = (await loginRes.json()) as {
-      isSuccess: boolean;
-      mfaRequired?: boolean;
-      challengeToken?: string;
-    };
-    expect(loginBody.mfaRequired).toBe(true);
-    expect(loginBody.challengeToken).toBeTruthy();
-    const challengeToken = loginBody.challengeToken;
-    if (!challengeToken) throw new Error("no challengeToken in login response");
-
-    // Step 2: completing the challenge over the REAL /api/auth/mfa/verify
-    // route (not a direct handler dispatch) mints the session.
-    const verifyRes = await stack.http.raw("POST", "/api/auth/mfa/verify", {
-      challengeToken,
-      code: currentTotpCode(secret),
-    });
-    expect(verifyRes.status).toBe(200);
-    const verifyBody = (await verifyRes.json()) as {
-      isSuccess: boolean;
-      token: string;
-      user: { id: string; tenantId: string };
-    };
-    expect(verifyBody.isSuccess).toBe(true);
-    expect(verifyBody.token).toBeTruthy();
-    expect(verifyBody.user.id).toBe(user.id);
-  });
-
-  test("a user without MFA enabled logs in with a straight session (no challenge)", async () => {
-    await seedUser(stack, { email: "bob@example.com", password: "any-password-1234" });
-
-    const res = await stack.http.raw("POST", "/api/auth/login", {
-      email: "bob@example.com",
-      password: "any-password-1234",
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as {
-      isSuccess: boolean;
-      mfaRequired?: boolean;
-      token?: string;
-    };
-    expect(body.mfaRequired).toBeUndefined();
-    expect(body.token).toBeTruthy();
-  });
-});
-
-async function setPolicy(stack: TestStack, policy: "optional" | "admins" | "all"): Promise<void> {
-  await stack.http.writeOk(
-    "config:write:set",
-    { key: mfaRequiredConfigHandle.name, value: policy },
-    { id: systemAdmin.id, tenantId: TEST_TENANT_ID, roles: ["SystemAdmin"] },
-  );
-}
-
-// Step 7: enforcement policy only matters for UNENROLLED users — an
-// enrolled user always gets a challenge regardless of policy (they opted
-// in themselves). ponytail (see auth-mfa's config.ts): "admins"/"all"
-// hard-block an unenrolled matching user with mfaSetupRequired — there is
-// no enrollment-during-login UI yet (PR3). By design for this backend step.
-describe("composeFeatures wiring — auth-mfa enforcement policy (kumiko-framework#266 Step 7)", () => {
-  let stack: TestStack;
-
-  beforeAll(async () => {
-    stack = await bootStack();
-  });
-
-  afterAll(async () => {
-    await stack.cleanup();
-  });
-
-  beforeEach(async () => {
-    await deleteRows(stack.db, userTable, {});
-    await deleteRows(stack.db, tenantMembershipsTable, {});
-    await setPolicy(stack, "optional");
-  });
-
-  test("optional (default): unenrolled user still gets a straight session", async () => {
-    await seedUser(stack, { email: "carol@example.com", password: "any-password-1234" });
-    const res = await stack.http.raw("POST", "/api/auth/login", {
-      email: "carol@example.com",
-      password: "any-password-1234",
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { mfaSetupRequired?: boolean; token?: string };
-    expect(body.mfaSetupRequired).toBeUndefined();
-    expect(body.token).toBeTruthy();
-  });
-
-  test("all: unenrolled user is blocked with mfaSetupRequired, no session/challenge", async () => {
-    await setPolicy(stack, "all");
-    await seedUser(stack, { email: "dave@example.com", password: "any-password-1234" });
-    const res = await stack.http.raw("POST", "/api/auth/login", {
-      email: "dave@example.com",
-      password: "any-password-1234",
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as {
-      mfaSetupRequired?: boolean;
-      mfaRequired?: boolean;
-      token?: string;
-    };
-    expect(body.mfaSetupRequired).toBe(true);
-    expect(body.mfaRequired).toBeUndefined();
-    expect(body.token).toBeUndefined();
-  });
-
-  test("all: an already-enrolled user still gets a challenge, not a block", async () => {
-    await setPolicy(stack, "all");
-    const user = await seedUser(stack, {
-      email: "erin@example.com",
-      password: "any-password-1234",
-    });
-    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
-      AuthMfaHandlers.enableStart,
-      { accountLabel: "erin@example.com" },
-      { id: user.id, tenantId: TEST_TENANT_ID, roles: ["User"] },
-    );
-    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
-    const secret = base32Decode(secretParam);
-    await stack.http.writeOk(
-      AuthMfaHandlers.enableConfirm,
-      { setupToken: start.setupToken, code: currentTotpCode(secret) },
-      { id: user.id, tenantId: TEST_TENANT_ID, roles: ["User"] },
-    );
-
-    const res = await stack.http.raw("POST", "/api/auth/login", {
-      email: "erin@example.com",
-      password: "any-password-1234",
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as { mfaSetupRequired?: boolean; mfaRequired?: boolean };
-    expect(body.mfaRequired).toBe(true);
-    expect(body.mfaSetupRequired).toBeUndefined();
-  });
-
-  test("admins: unenrolled admin is blocked, unenrolled non-admin logs in normally", async () => {
-    await setPolicy(stack, "admins");
-    await seedUser(stack, {
-      email: "frank-admin@example.com",
-      password: "any-password-1234",
-      roles: ["Admin"],
-    });
-    await seedUser(stack, { email: "gina-user@example.com", password: "any-password-1234" });
-
-    const adminRes = await stack.http.raw("POST", "/api/auth/login", {
-      email: "frank-admin@example.com",
-      password: "any-password-1234",
-    });
-    const adminBody = (await adminRes.json()) as { mfaSetupRequired?: boolean };
-    expect(adminBody.mfaSetupRequired).toBe(true);
-
-    const userRes = await stack.http.raw("POST", "/api/auth/login", {
-      email: "gina-user@example.com",
-      password: "any-password-1234",
-    });
-    const userBody = (await userRes.json()) as { mfaSetupRequired?: boolean; token?: string };
-    expect(userBody.mfaSetupRequired).toBeUndefined();
-    expect(userBody.token).toBeTruthy();
-  });
-});