@edge-base/server 0.1.1

package/src/__tests__/password-policy.test.ts

@@ -0,0 +1,191 @@
+/**
+ * 서버 단위 테스트 — lib/password-policy.ts
+ *
+ * 실행: cd packages/server && npx vitest run src/__tests__/password-policy.test.ts
+ *
+ * 테스트 대상:
+ *   validatePassword — policy validation + HIBP k-anonymity mock
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { validatePassword } from '../lib/password-policy.js';
+
+// ─── A. Default policy (no config) ─────────────────────────────────────────
+
+describe('validatePassword — default policy', () => {
+  it('8+ char password → valid', async () => {
+    const result = await validatePassword('abcdefgh');
+    expect(result.valid).toBe(true);
+    expect(result.errors).toEqual([]);
+  });
+
+  it('7 char password → too short', async () => {
+    const result = await validatePassword('abcdefg');
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toContain('at least 8');
+  });
+
+  it('empty password → too short', async () => {
+    const result = await validatePassword('');
+    expect(result.valid).toBe(false);
+  });
+
+  it('exactly 8 chars → valid', async () => {
+    const result = await validatePassword('12345678');
+    expect(result.valid).toBe(true);
+  });
+});
+
+// ─── B. Custom minLength ────────────────────────────────────────────────────
+
+describe('validatePassword — custom minLength', () => {
+  it('minLength 12 — 11 chars → invalid', async () => {
+    const result = await validatePassword('12345678901', { minLength: 12 });
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toContain('at least 12');
+  });
+
+  it('minLength 12 — 12 chars → valid', async () => {
+    const result = await validatePassword('123456789012', { minLength: 12 });
+    expect(result.valid).toBe(true);
+  });
+});
+
+// ─── C. Uppercase requirement ───────────────────────────────────────────────
+
+describe('validatePassword — requireUppercase', () => {
+  it('no uppercase → error', async () => {
+    const result = await validatePassword('abcdefgh', { requireUppercase: true });
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toContain('uppercase');
+  });
+
+  it('with uppercase → valid', async () => {
+    const result = await validatePassword('Abcdefgh', { requireUppercase: true });
+    expect(result.valid).toBe(true);
+  });
+});
+
+// ─── D. Lowercase requirement ───────────────────────────────────────────────
+
+describe('validatePassword — requireLowercase', () => {
+  it('no lowercase → error', async () => {
+    const result = await validatePassword('ABCDEFGH', { requireLowercase: true });
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toContain('lowercase');
+  });
+
+  it('with lowercase → valid', async () => {
+    const result = await validatePassword('ABCDEFGh', { requireLowercase: true });
+    expect(result.valid).toBe(true);
+  });
+});
+
+// ─── E. Number requirement ──────────────────────────────────────────────────
+
+describe('validatePassword — requireNumber', () => {
+  it('no digit → error', async () => {
+    const result = await validatePassword('abcdefgh', { requireNumber: true });
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toContain('digit');
+  });
+
+  it('with digit → valid', async () => {
+    const result = await validatePassword('abcdefg1', { requireNumber: true });
+    expect(result.valid).toBe(true);
+  });
+});
+
+// ─── F. Special character requirement ───────────────────────────────────────
+
+describe('validatePassword — requireSpecial', () => {
+  it('no special char → error', async () => {
+    const result = await validatePassword('Abcdefg1', { requireSpecial: true });
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toContain('special');
+  });
+
+  it('with special char → valid', async () => {
+    const result = await validatePassword('Abcdefg!', { requireSpecial: true });
+    expect(result.valid).toBe(true);
+  });
+});
+
+// ─── G. Multiple errors ─────────────────────────────────────────────────────
+
+describe('validatePassword — multiple errors', () => {
+  it('all requirements violated → all errors returned', async () => {
+    const result = await validatePassword('ab', {
+      minLength: 8,
+      requireUppercase: true,
+      requireNumber: true,
+      requireSpecial: true,
+    });
+    expect(result.valid).toBe(false);
+    expect(result.errors.length).toBeGreaterThanOrEqual(3);
+  });
+});
+
+// ─── H. HIBP check (mocked) ────────────────────────────────────────────────
+
+describe('validatePassword — HIBP check', () => {
+  let originalFetch: typeof globalThis.fetch;
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    vi.restoreAllMocks();
+  });
+
+  it('leaked password → error', async () => {
+    // SHA-1 of "password" = 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
+    // Prefix: 5BAA6, Suffix: 1E4C9B93F3F0682250B6CF8331B7EE68FD8
+    globalThis.fetch = vi.fn(async () =>
+      new Response('1E4C9B93F3F0682250B6CF8331B7EE68FD8:3861493\nABC:1\n', { status: 200 }),
+    ) as any;
+
+    const result = await validatePassword('password', { checkLeaked: true });
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toContain('data breach');
+  });
+
+  it('safe password → valid', async () => {
+    globalThis.fetch = vi.fn(async () =>
+      new Response('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:1\nBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB:2\n', { status: 200 }),
+    ) as any;
+
+    const result = await validatePassword('MyUniquePa$$w0rd!', { checkLeaked: true });
+    expect(result.valid).toBe(true);
+  });
+
+  it('HIBP API error → fail-open (valid)', async () => {
+    globalThis.fetch = vi.fn(async () => {
+      throw new Error('Network error');
+    }) as any;
+
+    const result = await validatePassword('password', { checkLeaked: true });
+    // Fail-open: password accepted when API is down
+    expect(result.valid).toBe(true);
+  });
+
+  it('HIBP API non-200 → fail-open (valid)', async () => {
+    globalThis.fetch = vi.fn(async () =>
+      new Response('', { status: 500 }),
+    ) as any;
+
+    const result = await validatePassword('password', { checkLeaked: true });
+    expect(result.valid).toBe(true);
+  });
+
+  it('HIBP not checked if other validations fail', async () => {
+    const fetchSpy = vi.fn();
+    globalThis.fetch = fetchSpy as any;
+
+    // Password too short — HIBP should NOT be called
+    await validatePassword('ab', { minLength: 8, checkLeaked: true });
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+});

package/src/__tests__/plugin-migrations.test.ts

@@ -0,0 +1,379 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const {
+  controlDb,
+  ensureControlSchemaMock,
+  resolveControlDbMock,
+  parseConfigMock,
+  buildAdminDbProxyMock,
+  buildFunctionKvProxyMock,
+  buildFunctionD1ProxyMock,
+  buildFunctionVectorizeProxyMock,
+  buildFunctionPushProxyMock,
+  buildAdminAuthContextMock,
+  resolveRootServiceKeyMock,
+} = vi.hoisted(() => ({
+  controlDb: {
+    query: vi.fn(),
+    first: vi.fn(),
+    run: vi.fn(),
+  },
+  ensureControlSchemaMock: vi.fn(),
+  resolveControlDbMock: vi.fn(),
+  parseConfigMock: vi.fn(),
+  buildAdminDbProxyMock: vi.fn(),
+  buildFunctionKvProxyMock: vi.fn(),
+  buildFunctionD1ProxyMock: vi.fn(),
+  buildFunctionVectorizeProxyMock: vi.fn(),
+  buildFunctionPushProxyMock: vi.fn(),
+  buildAdminAuthContextMock: vi.fn(),
+  resolveRootServiceKeyMock: vi.fn(),
+}));
+
+vi.mock('../lib/control-db.js', () => ({
+  ensureControlSchema: ensureControlSchemaMock,
+  resolveControlDb: resolveControlDbMock,
+}));
+
+vi.mock('../lib/do-router.js', () => ({
+  callDO: vi.fn(),
+  getDbDoName: vi.fn(),
+  parseConfig: parseConfigMock,
+}));
+
+vi.mock('../lib/functions.js', () => ({
+  buildAdminDbProxy: buildAdminDbProxyMock,
+  buildFunctionKvProxy: buildFunctionKvProxyMock,
+  buildFunctionD1Proxy: buildFunctionD1ProxyMock,
+  buildFunctionVectorizeProxy: buildFunctionVectorizeProxyMock,
+  buildFunctionPushProxy: buildFunctionPushProxyMock,
+  buildAdminAuthContext: buildAdminAuthContextMock,
+}));
+
+vi.mock('../lib/service-key.js', () => ({
+  resolveRootServiceKey: resolveRootServiceKeyMock,
+}));
+
+describe('executePluginMigrations', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.useRealTimers();
+
+    controlDb.first.mockReset().mockResolvedValue(null);
+    controlDb.query.mockReset().mockResolvedValue([]);
+    controlDb.run.mockReset().mockResolvedValue(undefined);
+
+    ensureControlSchemaMock.mockReset().mockResolvedValue(undefined);
+    resolveControlDbMock.mockReset().mockReturnValue(controlDb);
+    parseConfigMock.mockReset().mockReturnValue({ databases: {} });
+    buildAdminDbProxyMock.mockReset().mockReturnValue(
+      vi.fn(() => ({
+        table: vi.fn(),
+      })),
+    );
+    buildFunctionKvProxyMock.mockReset().mockReturnValue({});
+    buildFunctionD1ProxyMock.mockReset().mockReturnValue({});
+    buildFunctionVectorizeProxyMock.mockReset().mockReturnValue({});
+    buildFunctionPushProxyMock.mockReset().mockReturnValue({});
+    buildAdminAuthContextMock.mockReset().mockReturnValue({});
+    resolveRootServiceKeyMock.mockReset().mockReturnValue('sk-root');
+  });
+
+  it('runs onInstall and all migrations up to the current version on first install', async () => {
+    const { executePluginMigrations } = await import('../lib/plugin-migrations.js');
+    const calls: string[] = [];
+
+    await executePluginMigrations(
+      [
+        {
+          name: 'cert-plugin',
+          version: '0.3.0',
+          config: { marker: 'plugin-platform-suite' },
+          onInstall: vi.fn(async (ctx: { previousVersion: string | null }) => {
+            calls.push(`install:${ctx.previousVersion}`);
+          }),
+          migrations: {
+            '0.2.0': vi.fn(async (ctx: { previousVersion: string | null }) => {
+              calls.push(`0.2.0:${ctx.previousVersion}`);
+            }),
+            '0.3.0': vi.fn(async (ctx: { previousVersion: string | null }) => {
+              calls.push(`0.3.0:${ctx.previousVersion}`);
+            }),
+          },
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+
+    expect(calls).toEqual(['install:null', '0.2.0:null', '0.3.0:null']);
+    expect(controlDb.run).toHaveBeenCalledWith('INSERT OR REPLACE INTO _meta (key, value) VALUES (?, ?)', [
+      'plugin_version:cert-plugin',
+      '0.3.0',
+    ]);
+  });
+
+  it('runs only pending migrations between the stored and current version', async () => {
+    controlDb.first.mockResolvedValue({ value: '0.1.0' });
+    const { executePluginMigrations } = await import('../lib/plugin-migrations.js');
+    const calls: string[] = [];
+
+    await executePluginMigrations(
+      [
+        {
+          name: 'cert-plugin',
+          version: '0.3.0',
+          config: { marker: 'plugin-platform-suite' },
+          onInstall: vi.fn(),
+          migrations: {
+            '0.1.0': vi.fn(async (ctx: { previousVersion: string | null }) => {
+              calls.push(`0.1.0:${ctx.previousVersion}`);
+            }),
+            '0.2.0': vi.fn(async (ctx: { previousVersion: string | null }) => {
+              calls.push(`0.2.0:${ctx.previousVersion}`);
+            }),
+            '0.3.0': vi.fn(async (ctx: { previousVersion: string | null }) => {
+              calls.push(`0.3.0:${ctx.previousVersion}`);
+            }),
+            '0.4.0': vi.fn(async (ctx: { previousVersion: string | null }) => {
+              calls.push(`0.4.0:${ctx.previousVersion}`);
+            }),
+          },
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+
+    expect(calls).toEqual(['0.2.0:0.1.0', '0.3.0:0.1.0']);
+    expect(controlDb.run).toHaveBeenCalledWith('INSERT OR REPLACE INTO _meta (key, value) VALUES (?, ?)', [
+      'plugin_version:cert-plugin',
+      '0.3.0',
+    ]);
+  });
+
+  it('runs versionless migrations once per isolate', async () => {
+    const { executePluginMigrations } = await import('../lib/plugin-migrations.js');
+    const calls: string[] = [];
+
+    await executePluginMigrations(
+      [
+        {
+          name: 'versionless-plugin',
+          config: {},
+          migrations: {
+            '0.1.0': vi.fn(async () => {
+              calls.push('0.1.0');
+            }),
+            '0.2.0': vi.fn(async () => {
+              calls.push('0.2.0');
+            }),
+          },
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+
+    await executePluginMigrations(
+      [
+        {
+          name: 'versionless-plugin',
+          config: {},
+          migrations: {
+            '0.1.0': vi.fn(async () => {
+              calls.push('0.1.0:rerun');
+            }),
+            '0.2.0': vi.fn(async () => {
+              calls.push('0.2.0:rerun');
+            }),
+          },
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+
+    expect(calls).toEqual(['0.1.0', '0.2.0']);
+    expect(controlDb.run).not.toHaveBeenCalled();
+  });
+
+  it('updates stored plugin version even when no versioned migrations are defined', async () => {
+    controlDb.first.mockResolvedValue({ value: '0.1.0' });
+    const { executePluginMigrations } = await import('../lib/plugin-migrations.js');
+
+    await executePluginMigrations(
+      [
+        {
+          name: 'cert-plugin',
+          version: '0.2.0',
+          config: { marker: 'plugin-platform-suite' },
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+
+    expect(controlDb.run).toHaveBeenCalledWith('INSERT OR REPLACE INTO _meta (key, value) VALUES (?, ?)', [
+      'plugin_version:cert-plugin',
+      '0.2.0',
+    ]);
+  });
+
+  it('re-runs migrations after control state is cleared in the same isolate', async () => {
+    const { executePluginMigrations, resetPluginMigrationState } = await import('../lib/plugin-migrations.js');
+    const onInstall = vi.fn(async () => {});
+
+    await executePluginMigrations(
+      [
+        {
+          name: 'cert-plugin',
+          version: '0.3.0',
+          config: { marker: 'plugin-platform-suite' },
+          onInstall,
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+
+    resetPluginMigrationState();
+
+    await executePluginMigrations(
+      [
+        {
+          name: 'cert-plugin',
+          version: '0.3.0',
+          config: { marker: 'plugin-platform-suite' },
+          onInstall,
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+
+    expect(onInstall).toHaveBeenCalledTimes(2);
+    expect(controlDb.run).toHaveBeenCalledTimes(2);
+  });
+
+  it('skips repeated control DB checks while the current-state cache is warm', async () => {
+    controlDb.query.mockResolvedValue([{ key: 'plugin_version:cert-plugin', value: '0.3.0' }]);
+    controlDb.first.mockResolvedValue({ value: '0.3.0' });
+    const { executePluginMigrations } = await import('../lib/plugin-migrations.js');
+
+    await executePluginMigrations(
+      [
+        {
+          name: 'cert-plugin',
+          version: '0.3.0',
+          config: { marker: 'plugin-platform-suite' },
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+
+    expect(ensureControlSchemaMock).toHaveBeenCalledTimes(1);
+    expect(controlDb.query).toHaveBeenCalledTimes(1);
+
+    await executePluginMigrations(
+      [
+        {
+          name: 'cert-plugin',
+          version: '0.3.0',
+          config: { marker: 'plugin-platform-suite' },
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+
+    expect(ensureControlSchemaMock).toHaveBeenCalledTimes(1);
+    expect(controlDb.query).toHaveBeenCalledTimes(1);
+  });
+
+  it('resets the latch after a timed-out migration so the next request can retry', async () => {
+    vi.useFakeTimers();
+    const { executePluginMigrations } = await import('../lib/plugin-migrations.js');
+
+    const stuck = executePluginMigrations(
+      [
+        {
+          name: 'cert-plugin',
+          version: '0.3.0',
+          config: { marker: 'plugin-platform-suite' },
+          onInstall: vi.fn(() => new Promise(() => {})),
+        } as any,
+      ],
+      {
+        DATABASE: {},
+        AUTH_DB: {},
+        KV: {},
+      } as any,
+      { databases: {} } as any,
+    );
+    const stuckResult = stuck.catch((error) => error);
+
+    await vi.advanceTimersByTimeAsync(30_000);
+    await expect(stuckResult).resolves.toMatchObject({
+      message: 'Plugin migrations timed out (30000ms)',
+    });
+
+    controlDb.query.mockResolvedValue([{ key: 'plugin_version:cert-plugin', value: '0.3.0' }]);
+    controlDb.first.mockResolvedValue({ value: '0.3.0' });
+
+    await expect(
+      executePluginMigrations(
+        [
+          {
+            name: 'cert-plugin',
+            version: '0.3.0',
+            config: { marker: 'plugin-platform-suite' },
+          } as any,
+        ],
+        {
+          DATABASE: {},
+          AUTH_DB: {},
+          KV: {},
+        } as any,
+        { databases: {} } as any,
+      ),
+    ).resolves.toBeUndefined();
+  });
+});

package/src/__tests__/postgres-batch-compat.test.ts

@@ -0,0 +1,133 @@
+import { describe, expect, it, vi, afterEach } from 'vitest';
+import { defineConfig } from '@edge-base/shared';
+import { buildInternalHandlerContext } from '../lib/internal-request.js';
+import type { Env } from '../types.js';
+
+describe('postgres batch compatibility', () => {
+  afterEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    vi.unstubAllGlobals();
+  });
+
+  it('accepts D1-style batch inserts for upsertMany and returns inserted rows', async () => {
+    const executePostgresQuery = vi.fn()
+      .mockResolvedValueOnce({
+        rows: [{
+          id: 'probe-1',
+          probeKey: 'probe-a',
+          phase: 'batch',
+          sourceProvider: 'neon',
+          targetProvider: 'neon',
+          checksum: 'checksum-a',
+          verified: false,
+        }],
+        rowCount: 1,
+      })
+      .mockResolvedValueOnce({
+        rows: [{
+          id: 'probe-2',
+          probeKey: 'probe-b',
+          phase: 'batch',
+          sourceProvider: 'neon',
+          targetProvider: 'neon',
+          checksum: 'checksum-b',
+          verified: false,
+        }],
+        rowCount: 1,
+      });
+
+    vi.doMock('../lib/postgres-executor.js', () => ({
+      executePostgresQuery,
+      ensureLocalDevPostgresSchema: vi.fn().mockResolvedValue(undefined),
+      withPostgresConnection: vi.fn(async (_connectionString, fn) =>
+        fn((sql: string, params: unknown[] = []) => executePostgresQuery(_connectionString, sql, params))),
+      getLocalDevPostgresExecOptions: vi.fn(() => undefined),
+      getProviderBindingName: () => 'DB_SHARED',
+    }));
+    vi.doMock('../lib/postgres-schema-init.js', () => ({
+      ensurePgSchema: vi.fn().mockResolvedValue(undefined),
+    }));
+
+    const { handlePgRequest } = await import('../lib/postgres-handler.js');
+
+    const env = {
+      EDGEBASE_CONFIG: defineConfig({
+        release: true,
+        databases: {
+          shared: {
+            provider: 'postgres',
+            connectionString: 'DB_POSTGRES_SHARED_URL',
+            tables: {
+              suite_provider_migration_probe: {
+                schema: {
+                  probeKey: { type: 'string', required: true, unique: true },
+                  phase: { type: 'string', required: true },
+                  sourceProvider: { type: 'string', required: true },
+                  targetProvider: { type: 'string', required: true },
+                  checksum: { type: 'string', required: true },
+                  verified: { type: 'boolean', default: false },
+                },
+                access: {
+                  insert: () => true,
+                },
+              },
+            },
+          },
+        },
+      }),
+      DB_POSTGRES_SHARED_URL: 'postgres://edgebase:test@localhost/shared',
+    } as unknown as Env;
+
+    const request = new Request(
+      'http://internal/api/db/shared/tables/suite_provider_migration_probe/batch?upsert=true&conflictTarget=probeKey',
+      {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'X-Is-Service-Key': 'true',
+        },
+      },
+    );
+
+    const ctx = buildInternalHandlerContext({
+      env,
+      request,
+      body: {
+        inserts: [
+          {
+            probeKey: 'probe-a',
+            phase: 'batch',
+            sourceProvider: 'neon',
+            targetProvider: 'neon',
+            checksum: 'checksum-a',
+            verified: false,
+          },
+          {
+            probeKey: 'probe-b',
+            phase: 'batch',
+            sourceProvider: 'neon',
+            targetProvider: 'neon',
+            checksum: 'checksum-b',
+            verified: false,
+          },
+        ],
+      },
+    });
+
+    const response = await handlePgRequest(
+      ctx,
+      'shared',
+      'suite_provider_migration_probe',
+      '/tables/suite_provider_migration_probe/batch',
+    );
+    const json = await response.json() as { inserted: Array<Record<string, unknown>>; items: Array<Record<string, unknown>> };
+
+    expect(response.status).toBe(200);
+    expect(json.inserted).toHaveLength(2);
+    expect(json.items).toHaveLength(2);
+    expect(executePostgresQuery).toHaveBeenCalledTimes(2);
+    const firstSql = executePostgresQuery.mock.calls[0][1] as string;
+    expect(firstSql).toContain('ON CONFLICT ("probeKey") DO UPDATE');
+  });
+});