@dotdo/postgres 0.1.0

package/src/rls/auth-integration.test.ts

@@ -0,0 +1,752 @@
+/**
+ * RLS Auth Integration Tests
+ *
+ * Tests for the RLS auth integration module including:
+ * - RLSContextManager functionality
+ * - Admin bypass operations
+ * - Policy expression generators
+ * - Role validation helpers
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import {
+  RLSContextManager,
+  createAdminBypassCheck,
+  createTenantPolicyWithBypass,
+  createOwnerPolicyWithBypass,
+  hasRole,
+  hasAnyRole,
+  hasAllRoles,
+  type RLSUser,
+  type AdminBypassOptions,
+} from './auth-integration'
+
+// Mock PGlite interface for testing
+interface MockPGlite {
+  exec: ReturnType<typeof vi.fn>
+  query: ReturnType<typeof vi.fn>
+}
+
+const createMockPGlite = (): MockPGlite => ({
+  exec: vi.fn().mockResolvedValue(undefined),
+  query: vi.fn().mockResolvedValue({ rows: [] }),
+})
+
+describe('RLSContextManager', () => {
+  let mockPGlite: MockPGlite
+  let manager: RLSContextManager
+
+  beforeEach(() => {
+    mockPGlite = createMockPGlite()
+    manager = new RLSContextManager(mockPGlite)
+  })
+
+  afterEach(() => {
+    manager.dispose()
+  })
+
+  describe('getContext()', () => {
+    it('should return initial unauthenticated context', () => {
+      const context = manager.getContext()
+
+      expect(context.user).toBeNull()
+      expect(context.tenantId).toBeNull()
+      expect(context.isBypassed).toBe(false)
+      expect(context.bypassReason).toBeUndefined()
+    })
+
+    it('should return a copy of context to prevent mutation', () => {
+      const context1 = manager.getContext()
+      const context2 = manager.getContext()
+
+      expect(context1).not.toBe(context2)
+      expect(context1).toEqual(context2)
+    })
+  })
+
+  describe('setupFromAuth()', () => {
+    it('should set user ID session variable', async () => {
+      await manager.setupFromAuth({ id: 'user-123' })
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.user_id = 'user-123'")
+      )
+    })
+
+    it('should set tenant ID session variable when provided', async () => {
+      await manager.setupFromAuth({
+        id: 'user-123',
+        tenantId: 'tenant-456',
+      })
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.tenant_id = 'tenant-456'")
+      )
+
+      const context = manager.getContext()
+      expect(context.tenantId).toBe('tenant-456')
+    })
+
+    it('should use user ID as tenant ID when autoExtractTenant is true and no tenant provided', async () => {
+      await manager.setupFromAuth(
+        { id: 'user-123' },
+        { autoExtractTenant: true }
+      )
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.tenant_id = 'user-123'")
+      )
+    })
+
+    it('should not set tenant ID when autoExtractTenant is false', async () => {
+      await manager.setupFromAuth(
+        { id: 'user-123' },
+        { autoExtractTenant: false }
+      )
+
+      // Should only call once for user_id, not for tenant_id
+      const tenantCalls = mockPGlite.exec.mock.calls.filter(
+        (call) => (call[0] as string).includes('tenant_id')
+      )
+      expect(tenantCalls).toHaveLength(0)
+    })
+
+    it('should set roles as array when provided', async () => {
+      await manager.setupFromAuth({
+        id: 'user-123',
+        roles: ['user', 'editor'],
+      })
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.roles = '{user,editor}'")
+      )
+    })
+
+    it('should use LOCAL keyword when local option is true', async () => {
+      await manager.setupFromAuth(
+        { id: 'user-123' },
+        { local: true }
+      )
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET LOCAL app.user_id = 'user-123'")
+      )
+    })
+
+    it('should use custom session variable names', async () => {
+      await manager.setupFromAuth(
+        { id: 'user-123', tenantId: 'tenant-456', roles: ['admin'] },
+        {
+          userIdVariable: 'myapp.user',
+          tenantIdVariable: 'myapp.org',
+          rolesVariable: 'myapp.perms',
+        }
+      )
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET myapp.user = 'user-123'")
+      )
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET myapp.org = 'tenant-456'")
+      )
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET myapp.perms = '{admin}'")
+      )
+    })
+
+    it('should update context with user information', async () => {
+      const user: RLSUser = {
+        id: 'user-123',
+        email: 'user@example.com',
+        tenantId: 'tenant-456',
+        roles: ['user'],
+        isAdmin: false,
+      }
+
+      await manager.setupFromAuth(user)
+
+      const context = manager.getContext()
+      expect(context.user).toEqual(user)
+      expect(context.tenantId).toBe('tenant-456')
+      expect(context.isBypassed).toBe(false)
+    })
+
+    it('should throw on invalid user ID', async () => {
+      await expect(
+        manager.setupFromAuth({ id: "user'; DROP TABLE users;--" })
+      ).rejects.toThrow('Invalid user ID')
+    })
+
+    it('should throw on invalid tenant ID', async () => {
+      await expect(
+        manager.setupFromAuth({
+          id: 'user-123',
+          tenantId: "tenant'; DROP TABLE users;--",
+        })
+      ).rejects.toThrow('Invalid tenant ID')
+    })
+
+    it('should throw on invalid role', async () => {
+      await expect(
+        manager.setupFromAuth({
+          id: 'user-123',
+          roles: ["admin'; DROP TABLE users;--"],
+        })
+      ).rejects.toThrow('Invalid role')
+    })
+  })
+
+  describe('clearContext()', () => {
+    it('should reset all session variables', async () => {
+      await manager.setupFromAuth({
+        id: 'user-123',
+        tenantId: 'tenant-456',
+        roles: ['user'],
+      })
+
+      mockPGlite.exec.mockClear()
+
+      await manager.clearContext()
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining('RESET app.user_id')
+      )
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining('RESET app.tenant_id')
+      )
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining('RESET app.roles')
+      )
+    })
+
+    it('should reset context to initial state', async () => {
+      await manager.setupFromAuth({
+        id: 'user-123',
+        tenantId: 'tenant-456',
+      })
+
+      await manager.clearContext()
+
+      const context = manager.getContext()
+      expect(context.user).toBeNull()
+      expect(context.tenantId).toBeNull()
+      expect(context.isBypassed).toBe(false)
+    })
+  })
+
+  describe('isAdmin()', () => {
+    it('should return false for unauthenticated user', () => {
+      expect(manager.isAdmin()).toBe(false)
+    })
+
+    it('should return true when user has isAdmin flag', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-123',
+        isAdmin: true,
+      })
+
+      expect(manager.isAdmin()).toBe(true)
+    })
+
+    it('should return true when user has admin role', async () => {
+      await manager.setupFromAuth({
+        id: 'user-123',
+        roles: ['admin'],
+      })
+
+      expect(manager.isAdmin()).toBe(true)
+    })
+
+    it('should return true when user has super_admin role', async () => {
+      await manager.setupFromAuth({
+        id: 'user-123',
+        roles: ['super_admin'],
+      })
+
+      expect(manager.isAdmin()).toBe(true)
+    })
+
+    it('should return false for regular user', async () => {
+      await manager.setupFromAuth({
+        id: 'user-123',
+        roles: ['user', 'editor'],
+      })
+
+      expect(manager.isAdmin()).toBe(false)
+    })
+  })
+
+  describe('withAdminBypass()', () => {
+    const bypassOptions: AdminBypassOptions = {
+      reason: 'Test bypass',
+    }
+
+    it('should return error if user is not admin', async () => {
+      await manager.setupFromAuth({
+        id: 'user-123',
+        roles: ['user'],
+      })
+
+      const result = await manager.withAdminBypass(bypassOptions, async () => {
+        return 'data'
+      })
+
+      expect(result.success).toBe(false)
+      expect(result.error?.message).toContain('Admin privileges required')
+    })
+
+    it('should execute operation when user is admin', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-123',
+        isAdmin: true,
+      })
+
+      const result = await manager.withAdminBypass(bypassOptions, async () => {
+        return 'success'
+      })
+
+      expect(result.success).toBe(true)
+      expect(result.data).toBe('success')
+    })
+
+    it('should set bypass session variables during operation', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-123',
+        isAdmin: true,
+      })
+
+      mockPGlite.exec.mockClear()
+
+      await manager.withAdminBypass(bypassOptions, async () => {
+        // Check that bypass is active during operation
+        expect(manager.isBypassed()).toBe(true)
+        return 'data'
+      })
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.rls_bypass = 'true'")
+      )
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.bypass_reason = 'Test bypass'")
+      )
+    })
+
+    it('should clear bypass after operation completes', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-123',
+        isAdmin: true,
+      })
+
+      await manager.withAdminBypass(bypassOptions, async () => 'data')
+
+      expect(manager.isBypassed()).toBe(false)
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining('RESET app.rls_bypass')
+      )
+    })
+
+    it('should clear bypass even if operation throws', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-123',
+        isAdmin: true,
+      })
+
+      const result = await manager.withAdminBypass(bypassOptions, async () => {
+        throw new Error('Operation failed')
+      })
+
+      expect(result.success).toBe(false)
+      expect(result.error?.message).toBe('Operation failed')
+      expect(manager.isBypassed()).toBe(false)
+    })
+
+    it('should track bypass duration', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-123',
+        isAdmin: true,
+      })
+
+      const result = await manager.withAdminBypass(bypassOptions, async () => {
+        await new Promise((resolve) => setTimeout(resolve, 50))
+        return 'data'
+      })
+
+      expect(result.bypassDuration).toBeGreaterThanOrEqual(50)
+    })
+
+    it('should call onBypassStart and onBypassEnd callbacks', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-123',
+        isAdmin: true,
+      })
+
+      const onBypassStart = vi.fn()
+      const onBypassEnd = vi.fn()
+
+      await manager.withAdminBypass(
+        { reason: 'Test', onBypassStart, onBypassEnd },
+        async () => 'data'
+      )
+
+      expect(onBypassStart).toHaveBeenCalledTimes(1)
+      expect(onBypassEnd).toHaveBeenCalledTimes(1)
+
+      // Verify context passed to callbacks
+      const startContext = onBypassStart.mock.calls[0][0]
+      expect(startContext.isBypassed).toBe(true)
+      expect(startContext.bypassReason).toBe('Test')
+    })
+
+    it('should escape single quotes in bypass reason', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-123',
+        isAdmin: true,
+      })
+
+      mockPGlite.exec.mockClear()
+
+      await manager.withAdminBypass(
+        { reason: "User's request #123" },
+        async () => 'data'
+      )
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.bypass_reason = 'User''s request #123'")
+      )
+    })
+
+    it('should respect maxDuration option', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-123',
+        isAdmin: true,
+      })
+
+      // This test verifies the timeout is set, but we won't actually wait for it
+      const result = await manager.withAdminBypass(
+        { reason: 'Test', maxDuration: 1000 },
+        async () => 'data'
+      )
+
+      expect(result.success).toBe(true)
+    })
+  })
+})
+
+describe('Policy Expression Generators', () => {
+  describe('createAdminBypassCheck()', () => {
+    it('should return bypass check expression', () => {
+      const check = createAdminBypassCheck()
+
+      expect(check).toBe("current_setting('app.rls_bypass', true) = 'true'")
+    })
+  })
+
+  describe('createTenantPolicyWithBypass()', () => {
+    it('should create policy with default session variable', () => {
+      const expr = createTenantPolicyWithBypass('tenant_id')
+
+      expect(expr).toContain(createAdminBypassCheck())
+      expect(expr).toContain('OR')
+      expect(expr).toContain("tenant_id = current_setting('app.tenant_id')::text")
+    })
+
+    it('should create policy with custom session variable', () => {
+      const expr = createTenantPolicyWithBypass('org_id', 'myapp.org')
+
+      expect(expr).toContain("org_id = current_setting('myapp.org')::text")
+    })
+  })
+
+  describe('createOwnerPolicyWithBypass()', () => {
+    it('should create policy with default session variable', () => {
+      const expr = createOwnerPolicyWithBypass('user_id')
+
+      expect(expr).toContain(createAdminBypassCheck())
+      expect(expr).toContain('OR')
+      expect(expr).toContain("user_id = current_setting('app.user_id')::text")
+    })
+
+    it('should create policy with custom session variable', () => {
+      const expr = createOwnerPolicyWithBypass('owner_id', 'myapp.current_user')
+
+      expect(expr).toContain("owner_id = current_setting('myapp.current_user')::text")
+    })
+  })
+})
+
+describe('Role Validation Helpers', () => {
+  describe('hasRole()', () => {
+    it('should return false if user has no roles', () => {
+      const user: RLSUser = { id: 'user-123' }
+      expect(hasRole(user, 'admin')).toBe(false)
+    })
+
+    it('should return false if user does not have the role', () => {
+      const user: RLSUser = { id: 'user-123', roles: ['user', 'editor'] }
+      expect(hasRole(user, 'admin')).toBe(false)
+    })
+
+    it('should return true if user has the role', () => {
+      const user: RLSUser = { id: 'user-123', roles: ['user', 'admin'] }
+      expect(hasRole(user, 'admin')).toBe(true)
+    })
+  })
+
+  describe('hasAnyRole()', () => {
+    it('should return false if user has no roles', () => {
+      const user: RLSUser = { id: 'user-123' }
+      expect(hasAnyRole(user, ['admin', 'superuser'])).toBe(false)
+    })
+
+    it('should return false if user has none of the roles', () => {
+      const user: RLSUser = { id: 'user-123', roles: ['user'] }
+      expect(hasAnyRole(user, ['admin', 'superuser'])).toBe(false)
+    })
+
+    it('should return true if user has any of the roles', () => {
+      const user: RLSUser = { id: 'user-123', roles: ['user', 'admin'] }
+      expect(hasAnyRole(user, ['admin', 'superuser'])).toBe(true)
+    })
+
+    it('should return true if user has all of the roles', () => {
+      const user: RLSUser = { id: 'user-123', roles: ['admin', 'superuser'] }
+      expect(hasAnyRole(user, ['admin', 'superuser'])).toBe(true)
+    })
+  })
+
+  describe('hasAllRoles()', () => {
+    it('should return false if user has no roles', () => {
+      const user: RLSUser = { id: 'user-123' }
+      expect(hasAllRoles(user, ['admin', 'superuser'])).toBe(false)
+    })
+
+    it('should return false if user has only some roles', () => {
+      const user: RLSUser = { id: 'user-123', roles: ['admin'] }
+      expect(hasAllRoles(user, ['admin', 'superuser'])).toBe(false)
+    })
+
+    it('should return true if user has all required roles', () => {
+      const user: RLSUser = { id: 'user-123', roles: ['admin', 'superuser', 'user'] }
+      expect(hasAllRoles(user, ['admin', 'superuser'])).toBe(true)
+    })
+
+    it('should return true for empty required roles array', () => {
+      const user: RLSUser = { id: 'user-123', roles: ['user'] }
+      expect(hasAllRoles(user, [])).toBe(true)
+    })
+  })
+})
+
+describe('RLS Enforcement Integration Tests', () => {
+  let mockPGlite: MockPGlite
+  let manager: RLSContextManager
+
+  beforeEach(() => {
+    mockPGlite = createMockPGlite()
+    manager = new RLSContextManager(mockPGlite)
+  })
+
+  afterEach(() => {
+    manager.dispose()
+  })
+
+  describe('Multi-tenant Isolation Scenarios', () => {
+    it('should set correct context for tenant A user', async () => {
+      await manager.setupFromAuth({
+        id: 'user-1',
+        tenantId: 'tenant-A',
+        roles: ['user'],
+      })
+
+      const context = manager.getContext()
+      expect(context.tenantId).toBe('tenant-A')
+
+      // Verify session variables were set
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.tenant_id = 'tenant-A'")
+      )
+    })
+
+    it('should set correct context for tenant B user', async () => {
+      await manager.setupFromAuth({
+        id: 'user-2',
+        tenantId: 'tenant-B',
+        roles: ['user'],
+      })
+
+      const context = manager.getContext()
+      expect(context.tenantId).toBe('tenant-B')
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.tenant_id = 'tenant-B'")
+      )
+    })
+
+    it('should allow admin to access all tenants via bypass', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-1',
+        isAdmin: true,
+      })
+
+      const result = await manager.withAdminBypass(
+        { reason: 'Cross-tenant report' },
+        async () => {
+          // In real usage, this query would return all tenant data
+          // because app.rls_bypass = 'true'
+          return mockPGlite.query('SELECT * FROM orders')
+        }
+      )
+
+      expect(result.success).toBe(true)
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.rls_bypass = 'true'")
+      )
+    })
+
+    it('should prevent regular user from bypassing RLS', async () => {
+      await manager.setupFromAuth({
+        id: 'user-1',
+        tenantId: 'tenant-A',
+        roles: ['user'],
+      })
+
+      const result = await manager.withAdminBypass(
+        { reason: 'Attempted bypass' },
+        async () => 'should not run'
+      )
+
+      expect(result.success).toBe(false)
+      expect(result.error?.message).toContain('Admin privileges required')
+    })
+  })
+
+  describe('Context Switching Scenarios', () => {
+    it('should switch from one user to another', async () => {
+      // First user logs in
+      await manager.setupFromAuth({
+        id: 'user-1',
+        tenantId: 'tenant-A',
+      })
+
+      expect(manager.getContext().user?.id).toBe('user-1')
+
+      // Clear and set up new user
+      await manager.clearContext()
+      await manager.setupFromAuth({
+        id: 'user-2',
+        tenantId: 'tenant-B',
+      })
+
+      expect(manager.getContext().user?.id).toBe('user-2')
+      expect(manager.getContext().tenantId).toBe('tenant-B')
+    })
+
+    it('should maintain isolation after context switch', async () => {
+      await manager.setupFromAuth({
+        id: 'user-1',
+        tenantId: 'tenant-A',
+      })
+
+      mockPGlite.exec.mockClear()
+
+      await manager.clearContext()
+      await manager.setupFromAuth({
+        id: 'user-2',
+        tenantId: 'tenant-B',
+      })
+
+      // Verify tenant-B context is set
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.tenant_id = 'tenant-B'")
+      )
+    })
+  })
+
+  describe('Security Edge Cases', () => {
+    it('should reject tenant ID with SQL injection', async () => {
+      await expect(
+        manager.setupFromAuth({
+          id: 'user-1',
+          tenantId: "tenant' OR '1'='1",
+        })
+      ).rejects.toThrow('Invalid tenant ID')
+    })
+
+    it('should reject user ID with semicolon', async () => {
+      await expect(
+        manager.setupFromAuth({
+          id: 'user-1; DROP TABLE users;',
+        })
+      ).rejects.toThrow('Invalid user ID')
+    })
+
+    it('should allow user IDs with multiple hyphens', async () => {
+      // Double hyphens are allowed since values are properly escaped in session vars
+      // The pattern allows alphanumeric + hyphens/underscores
+      await manager.setupFromAuth({
+        id: 'user-1--test',
+      })
+
+      const context = manager.getContext()
+      expect(context.user?.id).toBe('user-1--test')
+    })
+
+    it('should handle UUID tenant IDs', async () => {
+      await manager.setupFromAuth({
+        id: '550e8400-e29b-41d4-a716-446655440000',
+        tenantId: '550e8400-e29b-41d4-a716-446655440001',
+      })
+
+      const context = manager.getContext()
+      expect(context.tenantId).toBe('550e8400-e29b-41d4-a716-446655440001')
+    })
+
+    it('should handle alphanumeric tenant IDs', async () => {
+      await manager.setupFromAuth({
+        id: 'user_abc_123',
+        tenantId: 'tenant_xyz_789',
+      })
+
+      const context = manager.getContext()
+      expect(context.tenantId).toBe('tenant_xyz_789')
+    })
+  })
+
+  describe('Audit Trail for Admin Operations', () => {
+    it('should track bypass reason in session', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-1',
+        isAdmin: true,
+      })
+
+      mockPGlite.exec.mockClear()
+
+      await manager.withAdminBypass(
+        { reason: 'Support ticket #12345' },
+        async () => 'data'
+      )
+
+      expect(mockPGlite.exec).toHaveBeenCalledWith(
+        expect.stringContaining("SET app.bypass_reason = 'Support ticket #12345'")
+      )
+    })
+
+    it('should provide bypass duration for audit logging', async () => {
+      await manager.setupFromAuth({
+        id: 'admin-1',
+        isAdmin: true,
+      })
+
+      const result = await manager.withAdminBypass(
+        { reason: 'Admin task' },
+        async () => {
+          // Simulate some work
+          await new Promise((resolve) => setTimeout(resolve, 10))
+          return 'done'
+        }
+      )
+
+      expect(result.bypassDuration).toBeGreaterThan(0)
+    })
+  })
+})