@edge-base/server 0.1.1

package/src/__tests__/rate-limit.test.ts

@@ -0,0 +1,260 @@
+/**
+ * Regression tests for rate-limit helpers.
+ *
+ * Key regression: requests=0 must be honoured (ban-mode),
+ * not silently swallowed by a truthy check.
+ */
+import { describe, it, expect } from 'vitest';
+import { Hono } from 'hono';
+import {
+  counter,
+  getLimit,
+  parseWindow,
+  FixedWindowCounter,
+  RATE_LIMIT_DEFAULTS,
+  rateLimitMiddleware,
+} from '../middleware/rate-limit.js';
+import type { EdgeBaseConfig } from '@edge-base/shared';
+import { setConfig } from '../lib/do-router.js';
+
+// ─── parseWindow ───
+
+describe('parseWindow', () => {
+  it('parses seconds', () => {
+    expect(parseWindow('30s')).toBe(30);
+  });
+
+  it('parses minutes', () => {
+    expect(parseWindow('5m')).toBe(300);
+  });
+
+  it('parses hours', () => {
+    expect(parseWindow('1h')).toBe(3600);
+  });
+
+  it('falls back to 60 for invalid format', () => {
+    expect(parseWindow('abc')).toBe(60);
+    expect(parseWindow('')).toBe(60);
+    expect(parseWindow('10')).toBe(60);
+  });
+});
+
+// ─── getLimit ───
+
+describe('getLimit', () => {
+  it('returns defaults when config is undefined', () => {
+    const result = getLimit(undefined, 'db');
+    expect(result).toEqual(RATE_LIMIT_DEFAULTS['db']);
+  });
+
+  it('returns defaults when rateLimiting is not set', () => {
+    const config = {} as EdgeBaseConfig;
+    const result = getLimit(config, 'db');
+    expect(result).toEqual(RATE_LIMIT_DEFAULTS['db']);
+  });
+
+  it('returns defaults for unknown group', () => {
+    const result = getLimit(undefined, 'nonexistent');
+    expect(result).toEqual({ requests: 10_000_000, windowSec: 60 });
+  });
+
+  it('uses config values when set', () => {
+    const config = {
+      rateLimiting: {
+        db: { requests: 500, window: '2m' },
+      },
+    } as EdgeBaseConfig;
+    expect(getLimit(config, 'db')).toEqual({ requests: 500, windowSec: 120 });
+  });
+
+  // ── REGRESSION: requests=0 must NOT fall through to defaults ──
+  it('honours requests=0 (ban-mode) — does not treat 0 as falsy', () => {
+    const config = {
+      rateLimiting: {
+        db: { requests: 0, window: '60s' },
+      },
+    } as EdgeBaseConfig;
+    const result = getLimit(config, 'db');
+    expect(result).toEqual({ requests: 0, windowSec: 60 });
+  });
+
+  it('falls back when group exists but has no requests/window', () => {
+    const config = {
+      rateLimiting: {
+        db: undefined,
+      },
+    } as EdgeBaseConfig;
+    expect(getLimit(config, 'db')).toEqual(RATE_LIMIT_DEFAULTS['db']);
+  });
+});
+
+// ─── FixedWindowCounter ───
+
+describe('FixedWindowCounter', () => {
+  it('allows requests within limit', () => {
+    const counter = new FixedWindowCounter();
+    expect(counter.check('test:key', 3, 60)).toBe(true);
+    expect(counter.check('test:key', 3, 60)).toBe(true);
+    expect(counter.check('test:key', 3, 60)).toBe(true);
+  });
+
+  it('blocks requests over limit', () => {
+    const counter = new FixedWindowCounter();
+    counter.check('over:key', 2, 60);
+    counter.check('over:key', 2, 60);
+    expect(counter.check('over:key', 2, 60)).toBe(false);
+  });
+
+  // ── REGRESSION: limit=0 must block all requests (ban-mode) ──
+  it('blocks all requests when limit=0 (ban-mode)', () => {
+    const counter = new FixedWindowCounter();
+    expect(counter.check('ban:key', 0, 60)).toBe(false);
+  });
+});
+
+// ─── rateLimitMiddleware ───
+
+describe('rateLimitMiddleware — valid Service Key bypass', () => {
+  function createApp(config: EdgeBaseConfig) {
+    setConfig(config);
+    const app = new Hono();
+    app.use('*', rateLimitMiddleware as never);
+    app.get('/api/health', (c) => c.json({ ok: true }));
+    app.get('/api/db/shared/tables/posts', (c) => c.json({ ok: true }));
+    return app;
+  }
+
+  const env = {
+    SERVICE_KEY: 'sk-root-test',
+    ENVIRONMENT: 'test',
+  };
+
+  const config = {
+    rateLimiting: {
+      global: { requests: 1, window: '60s' },
+      db: { requests: 1, window: '60s' },
+    },
+    serviceKeys: {
+      keys: [
+        {
+          kid: 'root-test',
+          tier: 'root',
+          scopes: ['*'],
+          secretSource: 'dashboard',
+          secretRef: 'SERVICE_KEY',
+        },
+        {
+          kid: 'db-scoped',
+          tier: 'scoped',
+          scopes: ['db:table:posts:read'],
+          secretSource: 'inline',
+          inlineSecret: 'jb_db-scoped_payload',
+        },
+        {
+          kid: 'constrained-db',
+          tier: 'scoped',
+          scopes: ['db:table:posts:read'],
+          secretSource: 'inline',
+          inlineSecret: 'jb_constrained-db_payload',
+          constraints: {
+            env: ['prod'],
+            ipCidr: ['10.0.0.0/8'],
+          },
+        },
+      ],
+    },
+  } as EdgeBaseConfig;
+
+  it('bypasses the global limiter for valid service key requests', async () => {
+    const app = createApp(config);
+    const ip = `rl-sk-global-${Date.now()}`;
+    counter.check(`global:${ip}`, 1, 60);
+
+    const response = await app.fetch(
+      new Request('http://localhost/api/health', {
+        headers: {
+          'cf-connecting-ip': ip,
+          'X-EdgeBase-Service-Key': 'sk-root-test',
+        },
+      }),
+      env,
+      {} as ExecutionContext,
+    );
+
+    expect(response.status).toBe(200);
+  });
+
+  it('bypasses group-specific limiters for valid service key requests', async () => {
+    const app = createApp(config);
+    const ip = `rl-sk-db-${Date.now()}`;
+    counter.check(`db:${ip}`, 1, 60);
+    counter.check(`global:${ip}`, 1, 60);
+
+    const response = await app.fetch(
+      new Request('http://localhost/api/db/shared/tables/posts', {
+        headers: {
+          'cf-connecting-ip': ip,
+          'X-EdgeBase-Service-Key': 'sk-root-test',
+        },
+      }),
+      env,
+      {} as ExecutionContext,
+    );
+
+    expect(response.status).toBe(200);
+  });
+
+  it('bypasses for scoped service key requests too', async () => {
+    const app = createApp(config);
+    const ip = `rl-sk-scoped-${Date.now()}`;
+    counter.check(`db:${ip}`, 1, 60);
+    counter.check(`global:${ip}`, 1, 60);
+
+    const response = await app.fetch(
+      new Request('http://localhost/api/db/shared/tables/posts', {
+        headers: {
+          'cf-connecting-ip': ip,
+          'X-EdgeBase-Service-Key': 'jb_db-scoped_payload',
+        },
+      }),
+      env,
+      {} as ExecutionContext,
+    );
+
+    expect(response.status).toBe(200);
+  });
+
+  it('still requires constraints to pass before bypassing', async () => {
+    const app = createApp(config);
+    const allowedIp = '10.1.2.3';
+    counter.check(`db:${allowedIp}`, 1, 60);
+    counter.check(`global:${allowedIp}`, 1, 60);
+    const prodEnv = { ...env, ENVIRONMENT: 'prod' };
+    const devEnv = { ...env, ENVIRONMENT: 'dev' };
+
+    const allowed = await app.fetch(
+      new Request('http://localhost/api/db/shared/tables/posts', {
+        headers: {
+          'cf-connecting-ip': allowedIp,
+          'X-EdgeBase-Service-Key': 'jb_constrained-db_payload',
+        },
+      }),
+      prodEnv as never,
+      {} as ExecutionContext,
+    );
+
+    const denied = await app.fetch(
+      new Request('http://localhost/api/db/shared/tables/posts', {
+        headers: {
+          'cf-connecting-ip': allowedIp,
+          'X-EdgeBase-Service-Key': 'jb_constrained-db_payload',
+        },
+      }),
+      devEnv as never,
+      {} as ExecutionContext,
+    );
+
+    expect(allowed.status).toBe(200);
+    expect(denied.status).toBe(429);
+  });
+});

package/src/__tests__/room-access-policy.test.ts

@@ -0,0 +1,101 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { defineConfig, type AuthContext } from '@edge-base/shared';
+import { setConfig } from '../lib/do-router.js';
+import { OpenAPIHono, type HonoEnv } from '../lib/hono.js';
+import { roomRoute } from '../routes/room.js';
+import type { Env } from '../types.js';
+
+function createRoomEnv(): Env {
+  return {
+    ROOMS: {
+      idFromName: (name: string) => name as unknown as DurableObjectId,
+      get: () => ({
+        fetch: async () => new Response(JSON.stringify({ visibility: 'public' }), {
+          headers: { 'Content-Type': 'application/json' },
+        }),
+      }),
+    } as unknown as DurableObjectNamespace,
+  } as Env;
+}
+
+function createApp(auth?: AuthContext | null) {
+  const app = new OpenAPIHono<HonoEnv>();
+  app.use('/api/room/*', async (c, next) => {
+    c.set('auth', (auth ?? null) as never);
+    await next();
+  });
+  app.route('/api/room', roomRoute);
+  return app;
+}
+
+describe('Room route access policy', () => {
+  afterEach(() => {
+    setConfig({});
+  });
+
+  it('denies metadata in release mode without access.metadata or public.metadata', async () => {
+    setConfig(defineConfig({
+      release: true,
+      rooms: {
+        game: {},
+      },
+    }));
+
+    const app = createApp();
+    const response = await app.request('/api/room/metadata?namespace=game&id=room-1', {
+      method: 'GET',
+    }, createRoomEnv());
+
+    expect(response.status).toBe(403);
+    await expect(response.json()).resolves.toMatchObject({
+      message: 'Room metadata requires access.metadata or public.metadata in release mode',
+    });
+  });
+
+  it('allows metadata when public.metadata is explicitly enabled', async () => {
+    setConfig(defineConfig({
+      release: true,
+      rooms: {
+        game: {
+          public: {
+            metadata: true,
+          },
+        },
+      },
+    }));
+
+    const app = createApp();
+    const response = await app.request('/api/room/metadata?namespace=game&id=room-1', {
+      method: 'GET',
+    }, createRoomEnv());
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ visibility: 'public' });
+  });
+
+  it('passes enriched auth context into metadata access rules', async () => {
+    setConfig(defineConfig({
+      release: true,
+      rooms: {
+        game: {
+          access: {
+            metadata: (auth, roomId) => auth?.meta?.tenant === 'team-1' && roomId === 'room-1',
+          },
+        },
+      },
+    }));
+
+    const app = createApp({
+      id: 'user-1',
+      role: 'user',
+      isAnonymous: false,
+      meta: { tenant: 'team-1' },
+    });
+    const response = await app.request('/api/room/metadata?namespace=game&id=room-1', {
+      method: 'GET',
+    }, createRoomEnv());
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ visibility: 'public' });
+  });
+});

package/src/__tests__/room-handler-context.test.ts

@@ -0,0 +1,130 @@
+import { describe, expect, it, vi, afterEach } from 'vitest';
+
+vi.mock('cloudflare:workers', () => ({
+  DurableObject: class DurableObject {},
+}));
+
+describe('RoomsDO handler context', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('routes admin.db() through the database durable object instead of worker fetch', async () => {
+    const { RoomsDO } = await import('../durable-objects/rooms-do.js');
+    const workerFetch = vi.fn().mockRejectedValue(new Error('worker fetch should not be used'));
+    vi.stubGlobal('fetch', workerFetch);
+
+    const databaseFetch = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ id: 'sig-1', title: 'Room inserted' }), {
+        status: 201,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+
+    const room: any = Object.create(RoomsDO.prototype);
+
+    room.env = {
+      DATABASE: {
+        idFromName: vi.fn(() => 'shared-id'),
+        get: vi.fn(() => ({ fetch: databaseFetch })),
+      },
+      AUTH: {
+        idFromName: vi.fn(() => 'auth-id'),
+        get: vi.fn(() => ({ fetch: vi.fn() })),
+      },
+      AUTH_DB: {},
+    };
+    room.config = {
+      databases: {
+        shared: {
+          tables: {
+            signals: {
+              schema: {
+                title: { type: 'string' },
+              },
+            },
+          },
+        },
+      },
+    };
+
+    const ctx = room.buildHandlerContext();
+    const inserted = await ctx.admin.db('shared').table('signals').insert({ title: 'Room inserted' });
+
+    expect(inserted).toEqual({ id: 'sig-1', title: 'Room inserted' });
+    expect(workerFetch).not.toHaveBeenCalled();
+    expect(databaseFetch).toHaveBeenCalledWith(
+      'http://do/tables/signals',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          'X-DO-Name': 'shared',
+          'X-EdgeBase-Internal': 'true',
+        }),
+      }),
+    );
+  });
+
+  it('routes admin.db().upsert() through the database durable object', async () => {
+    const { RoomsDO } = await import('../durable-objects/rooms-do.js');
+    const workerFetch = vi.fn().mockRejectedValue(new Error('worker fetch should not be used'));
+    vi.stubGlobal('fetch', workerFetch);
+
+    const databaseFetch = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ id: 'sig-1', title: 'Room upserted', action: 'updated' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+
+    const room: any = Object.create(RoomsDO.prototype);
+
+    room.env = {
+      DATABASE: {
+        idFromName: vi.fn(() => 'shared-id'),
+        get: vi.fn(() => ({ fetch: databaseFetch })),
+      },
+      AUTH: {
+        idFromName: vi.fn(() => 'auth-id'),
+        get: vi.fn(() => ({ fetch: vi.fn() })),
+      },
+      AUTH_DB: {},
+    };
+    room.config = {
+      databases: {
+        shared: {
+          tables: {
+            signals: {
+              schema: {
+                title: { type: 'string' },
+              },
+            },
+          },
+        },
+      },
+    };
+
+    const ctx = room.buildHandlerContext();
+    const upserted = await ctx.admin.db('shared').table('signals').upsert({
+      id: 'sig-1',
+      title: 'Room upserted',
+    });
+
+    expect(upserted).toEqual({ id: 'sig-1', title: 'Room upserted', action: 'updated' });
+    expect(workerFetch).not.toHaveBeenCalled();
+    expect(databaseFetch).toHaveBeenCalledWith(
+      'http://do/tables/signals?upsert=true',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          'X-DO-Name': 'shared',
+          'X-EdgeBase-Internal': 'true',
+        }),
+        body: JSON.stringify({
+          id: 'sig-1',
+          title: 'Room upserted',
+        }),
+      }),
+    );
+  });
+});

package/src/__tests__/room-monitoring.test.ts

@@ -0,0 +1,138 @@
+import { describe, expect, it } from 'vitest';
+import {
+  fetchRoomMonitoringStatsFromKv,
+  persistRoomMonitoringSnapshot,
+} from '../lib/room-monitoring.js';
+
+interface MockKvEntry {
+  value: string;
+  options?: { expirationTtl?: number };
+}
+
+function createMockKv(pageSize = 50): KVNamespace & { _store: Record<string, MockKvEntry> } {
+  const store: Record<string, MockKvEntry> = {};
+
+  return {
+    get: async (key: string, type?: 'text' | 'json') => {
+      const entry = store[key];
+      if (!entry) return null;
+      if (type === 'json') {
+        try {
+          return JSON.parse(entry.value);
+        } catch {
+          return null;
+        }
+      }
+      return entry.value;
+    },
+    put: async (key: string, value: string, options?: { expirationTtl?: number }) => {
+      store[key] = { value, options };
+    },
+    delete: async (key: string) => {
+      delete store[key];
+    },
+    list: async ({ prefix = '', cursor }: { prefix?: string; cursor?: string } = {}) => {
+      const names = Object.keys(store)
+        .filter((name) => name.startsWith(prefix))
+        .sort();
+      const start = cursor ? Number(cursor) : 0;
+      const page = names.slice(start, start + pageSize);
+      const nextCursor = start + pageSize;
+
+      return {
+        keys: page.map((name) => ({ name })),
+        list_complete: nextCursor >= names.length,
+        cursor: nextCursor >= names.length ? undefined : String(nextCursor),
+        cacheStatus: null,
+      };
+    },
+    _store: store,
+  } as unknown as KVNamespace & { _store: Record<string, MockKvEntry> };
+}
+
+describe('room monitoring helpers', () => {
+  it('persists active room snapshots with a monitoring TTL', async () => {
+    const kv = createMockKv();
+
+    await persistRoomMonitoringSnapshot(kv, {
+      room: 'incident-1',
+      activeConnections: 3,
+      authenticatedConnections: 2,
+      updatedAt: '2026-03-12T00:00:00.000Z',
+    });
+
+    const stored = kv._store['monitoring:room:incident-1'];
+    expect(stored).toBeDefined();
+    expect(stored.options?.expirationTtl).toBe(600);
+    expect(JSON.parse(stored!.value)).toMatchObject({
+      room: 'incident-1',
+      activeConnections: 3,
+      authenticatedConnections: 2,
+    });
+  });
+
+  it('deletes room snapshots when the room is no longer active', async () => {
+    const kv = createMockKv();
+
+    await persistRoomMonitoringSnapshot(kv, {
+      room: 'incident-2',
+      activeConnections: 1,
+      authenticatedConnections: 1,
+      updatedAt: '2026-03-12T00:00:00.000Z',
+    });
+
+    await persistRoomMonitoringSnapshot(kv, {
+      room: 'incident-2',
+      activeConnections: 0,
+      authenticatedConnections: 0,
+      updatedAt: '2026-03-12T00:01:00.000Z',
+    });
+
+    expect(kv._store['monitoring:room:incident-2']).toBeUndefined();
+  });
+
+  it('aggregates paginated room snapshots and ignores invalid entries', async () => {
+    const kv = createMockKv(1);
+
+    await kv.put('monitoring:room:alpha', JSON.stringify({
+      room: 'alpha',
+      activeConnections: 2,
+      authenticatedConnections: 1,
+      updatedAt: '2026-03-12T00:00:00.000Z',
+    }));
+    await kv.put('monitoring:room:beta', JSON.stringify({
+      room: 'beta',
+      activeConnections: 4,
+      authenticatedConnections: 3,
+      updatedAt: '2026-03-12T00:00:00.000Z',
+    }));
+    await kv.put('monitoring:room:gamma', JSON.stringify({
+      room: 'gamma',
+      activeConnections: 0,
+      authenticatedConnections: 0,
+      updatedAt: '2026-03-12T00:00:00.000Z',
+    }));
+    await kv.put('monitoring:room:broken', JSON.stringify({
+      room: 'broken',
+      activeConnections: 'many',
+      authenticatedConnections: 1,
+      updatedAt: '2026-03-12T00:00:00.000Z',
+    }));
+    await kv.put('unrelated:key', JSON.stringify({
+      room: 'ignored',
+      activeConnections: 99,
+      authenticatedConnections: 99,
+      updatedAt: '2026-03-12T00:00:00.000Z',
+    }));
+
+    await expect(fetchRoomMonitoringStatsFromKv(kv)).resolves.toEqual({
+      activeConnections: 6,
+      authenticatedConnections: 4,
+      channels: 2,
+      channelDetails: [
+        { channel: 'beta', subscribers: 4 },
+        { channel: 'alpha', subscribers: 2 },
+      ],
+    });
+  });
+});