@edge-base/server 0.1.1

package/src/__tests__/rules.test.ts

@@ -0,0 +1,234 @@
+/**
+ * 서버 단위 테스트 — rules 평가 로직 + database-live broadcast
+ * 1-14 rules.test.ts — 80개 (순수 로직 파트)
+ * 1-19 broadcast.test.ts — 20개
+ *
+ * 실행: cd packages/server && npx vitest run src/__tests__/rules.test.ts
+ *
+ * NOTE: DB 규칙 평가는 DatabaseDO 내부에서 이루어지지만,
+ *       규칙 함수 자체(JS 함수)의 동작 로직은 여기서 순수 테스트
+ */
+
+import { describe, it, expect } from 'vitest';
+
+// ─── 규칙 평가 로직 (DatabaseDO rules 동일 패턴) ─────────────────────────────
+
+type AuthCtx = { id: string; role: string | null; email: string | null } | null;
+type ResourceCtx = Record<string, unknown>;
+type ContextCtx = Record<string, unknown>;
+
+type RuleValue = boolean | string | ((auth: AuthCtx, resource: ResourceCtx, ctx: ContextCtx) => boolean);
+
+function evaluateRule(
+  rule: RuleValue,
+  auth: AuthCtx,
+  resource: ResourceCtx,
+  ctx: ContextCtx,
+): boolean {
+  if (rule === true) return true;
+  if (rule === false) return false;
+  if (typeof rule === 'function') {
+    try {
+      return Boolean(rule(auth, resource, ctx));
+    } catch {
+      return false; // 규칙 평가 오류 → 거부
+    }
+  }
+  // 문자열 규칙은 DB 레벨에서 평가; 여기선 다루지 않음
+  return false;
+}
+
+// ─── A. true / false 규칙 ────────────────────────────────────────────────────
+
+describe('evaluateRule — boolean', () => {
+  it('true → always allow', () => {
+    expect(evaluateRule(true, null, {}, {})).toBe(true);
+  });
+
+  it('false → always deny', () => {
+    expect(evaluateRule(false, null, {}, {})).toBe(false);
+  });
+
+  it('true with authenticated user → allow', () => {
+    const auth: AuthCtx = { id: 'user-1', role: null, email: null };
+    expect(evaluateRule(true, auth, {}, {})).toBe(true);
+  });
+
+  it('false with authenticated user → deny', () => {
+    const auth: AuthCtx = { id: 'user-1', role: null, email: null };
+    expect(evaluateRule(false, auth, {}, {})).toBe(false);
+  });
+});
+
+// ─── B. auth!=null (인증 여부) ────────────────────────────────────────────────
+
+describe('evaluateRule — auth != null', () => {
+  const rule: RuleValue = (auth) => auth !== null;
+
+  it('no auth → deny', () => {
+    expect(evaluateRule(rule, null, {}, {})).toBe(false);
+  });
+
+  it('with valid auth → allow', () => {
+    const auth: AuthCtx = { id: 'user-1', role: null, email: null };
+    expect(evaluateRule(rule, auth, {}, {})).toBe(true);
+  });
+});
+
+// ─── C. auth.id == resource.authorId (소유자 확인) ───────────────────────────
+
+describe('evaluateRule — ownership check', () => {
+  const rule: RuleValue = (auth, resource) => auth !== null && auth.id === resource['authorId'];
+
+  it('owner → allow', () => {
+    const auth: AuthCtx = { id: 'user-1', role: null, email: null };
+    expect(evaluateRule(rule, auth, { authorId: 'user-1' }, {})).toBe(true);
+  });
+
+  it('non-owner → deny', () => {
+    const auth: AuthCtx = { id: 'user-2', role: null, email: null };
+    expect(evaluateRule(rule, auth, { authorId: 'user-1' }, {})).toBe(false);
+  });
+
+  it('no auth → deny for any resource', () => {
+    expect(evaluateRule(rule, null, { authorId: 'user-1' }, {})).toBe(false);
+  });
+
+  it('resource without authorId → deny', () => {
+    const auth: AuthCtx = { id: 'user-1', role: null, email: null };
+    expect(evaluateRule(rule, auth, {}, {})).toBe(false);
+  });
+});
+
+// ─── D. auth.role 비교 ───────────────────────────────────────────────────────
+
+describe('evaluateRule — role check', () => {
+  const adminOnlyRule: RuleValue = (auth) => auth?.role === 'admin';
+
+  it('admin role → allow', () => {
+    const auth: AuthCtx = { id: 'u-1', role: 'admin', email: null };
+    expect(evaluateRule(adminOnlyRule, auth, {}, {})).toBe(true);
+  });
+
+  it('user role → deny', () => {
+    const auth: AuthCtx = { id: 'u-1', role: 'user', email: null };
+    expect(evaluateRule(adminOnlyRule, auth, {}, {})).toBe(false);
+  });
+
+  it('null role → deny', () => {
+    const auth: AuthCtx = { id: 'u-1', role: null, email: null };
+    expect(evaluateRule(adminOnlyRule, auth, {}, {})).toBe(false);
+  });
+
+  it('no auth → deny', () => {
+    expect(evaluateRule(adminOnlyRule, null, {}, {})).toBe(false);
+  });
+});
+
+// ─── E. in 연산자 (배열 포함 여부) ───────────────────────────────────────────
+
+describe('evaluateRule — in operator', () => {
+  const allowedRoles = ['admin', 'editor', 'moderator'];
+  const rule: RuleValue = (auth) => auth !== null && allowedRoles.includes(auth.role ?? '');
+
+  it('admin → allow', () => {
+    const auth: AuthCtx = { id: 'u', role: 'admin', email: null };
+    expect(evaluateRule(rule, auth, {}, {})).toBe(true);
+  });
+
+  it('editor → allow', () => {
+    const auth: AuthCtx = { id: 'u', role: 'editor', email: null };
+    expect(evaluateRule(rule, auth, {}, {})).toBe(true);
+  });
+
+  it('viewer → deny', () => {
+    const auth: AuthCtx = { id: 'u', role: 'viewer', email: null };
+    expect(evaluateRule(rule, auth, {}, {})).toBe(false);
+  });
+});
+
+// ─── F. contains (문자열 포함) ───────────────────────────────────────────────
+
+describe('evaluateRule — contains', () => {
+  const rule: RuleValue = (auth) => auth?.email?.includes('@company.com') ?? false;
+
+  it('company email → allow', () => {
+    const auth: AuthCtx = { id: 'u', role: null, email: 'user@company.com' };
+    expect(evaluateRule(rule, auth, {}, {})).toBe(true);
+  });
+
+  it('personal email → deny', () => {
+    const auth: AuthCtx = { id: 'u', role: null, email: 'user@gmail.com' };
+    expect(evaluateRule(rule, auth, {}, {})).toBe(false);
+  });
+
+  it('null email → deny', () => {
+    const auth: AuthCtx = { id: 'u', role: null, email: null };
+    expect(evaluateRule(rule, auth, {}, {})).toBe(false);
+  });
+});
+
+// ─── G. null-safety sentinel (#109) ─────────────────────────────────────────
+
+describe('evaluateRule — null-safety', () => {
+  it('rule with nested null propagation (safe)', () => {
+    // auth?.metadata?.tier === 'pro' pattern
+    const rule: RuleValue = (auth) => {
+      const tier = (auth as any)?.metadata?.tier;
+      return tier === 'pro';
+    };
+    const auth: AuthCtx = { id: 'u', role: null, email: null };
+    // metadata undefined → safe false
+    expect(evaluateRule(rule, auth, {}, {})).toBe(false);
+  });
+
+  it('rule throwing exception → deny (graceful)', () => {
+    const badRule: RuleValue = () => { throw new Error('Rule error'); };
+    expect(evaluateRule(badRule, null, {}, {})).toBe(false);
+  });
+
+  it('rule returning null → deny (falsy)', () => {
+    const nullRule: RuleValue = () => null as any;
+    expect(evaluateRule(nullRule, null, {}, {})).toBe(false);
+  });
+
+  it('rule returning undefined → deny (falsy)', () => {
+    const undefinedRule: RuleValue = () => undefined as any;
+    expect(evaluateRule(undefinedRule, null, {}, {})).toBe(false);
+  });
+});
+
+// ─── H. context.workspaceId 참조 ─────────────────────────────────────────────
+
+describe('evaluateRule — context access', () => {
+  it('ctx.workspaceId match → allow', () => {
+    const rule: RuleValue = (auth, resource, ctx) =>
+      ctx['workspaceId'] === resource['workspaceId'];
+    const ctx = { workspaceId: 'ws-1' };
+    expect(evaluateRule(rule, null, { workspaceId: 'ws-1' }, ctx)).toBe(true);
+  });
+
+  it('ctx.workspaceId mismatch → deny', () => {
+    const rule: RuleValue = (auth, resource, ctx) =>
+      ctx['workspaceId'] === resource['workspaceId'];
+    const ctx = { workspaceId: 'ws-1' };
+    expect(evaluateRule(rule, null, { workspaceId: 'ws-2' }, ctx)).toBe(false);
+  });
+});
+
+// ─── I. 규칙 미정의 → false (default deny) ───────────────────────────────────
+
+describe('evaluateRule — default deny', () => {
+  it('string rule (non-boolean, non-function) → deny by default', () => {
+    // String rules are DB-evaluated; here we treat as deny
+    expect(evaluateRule('auth!=null' as any, null, {}, {})).toBe(false);
+  });
+
+  it('undefined rule → treated as false', () => {
+    expect(evaluateRule(undefined as any, null, {}, {})).toBe(false);
+  });
+
+  it('null rule → treated as false', () => {
+    expect(evaluateRule(null as any, null, {}, {})).toBe(false);
+  });
+});

package/src/__tests__/runtime-surface-accounting.test.ts

@@ -0,0 +1,120 @@
+/**
+ * Runtime surface accounting.
+ *
+ * Guards against route / middleware / durable object files silently drifting
+ * outside the test suite's field of view. A runtime file must either be
+ * mentioned in unit/integration tests or be explicitly tracked here as
+ * indirectly covered.
+ */
+import { readFileSync, readdirSync } from 'fs';
+import { resolve } from 'path';
+import { describe, expect, it } from 'vitest';
+
+const SRC_ROOT = resolve(new URL('..', import.meta.url).pathname);
+const PACKAGE_ROOT = resolve(SRC_ROOT, '..');
+const RUNTIME_DIRS = [
+  resolve(SRC_ROOT, 'routes'),
+  resolve(SRC_ROOT, 'durable-objects'),
+  resolve(SRC_ROOT, 'middleware'),
+];
+const TEST_DIRS = [
+  resolve(SRC_ROOT, '__tests__'),
+  resolve(PACKAGE_ROOT, 'test/integration'),
+];
+const THIS_TEST_PATH = resolve(new URL(import.meta.url).pathname);
+
+// Files below are exercised indirectly, but the test sources do not mention the
+// exact filename/stem yet. Tracking them here keeps the gap reviewable.
+const KNOWN_INDIRECT_RUNTIME_COVERAGE = new Map<string, string>([
+  [
+    'routes/schema-endpoint.ts',
+    'Covered via /api/schema integration tests and OpenAPI/spec checks, but the file name is not referenced directly.',
+  ],
+  [
+    'durable-objects/logs-do.ts',
+    'Covered indirectly via analytics/logging flows; keep explicit until a direct file reference lands in tests.',
+  ],
+  [
+    'durable-objects/room-runtime-base.ts',
+    'Covered through RoomsDO and room protocol/state tests, but the shared runtime base is not referenced by filename.',
+  ],
+]);
+
+function collectFiles(dir: string, predicate: (path: string) => boolean): string[] {
+  const results: string[] = [];
+
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const entryPath = resolve(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...collectFiles(entryPath, predicate));
+      continue;
+    }
+    if (predicate(entryPath)) {
+      results.push(entryPath);
+    }
+  }
+
+  return results;
+}
+
+function toRuntimeKey(absPath: string): string {
+  for (const dir of RUNTIME_DIRS) {
+    if (absPath.startsWith(dir)) {
+      return absPath.slice(dir.length + 1).replace(/^/, `${dir.split('/').at(-1)}/`);
+    }
+  }
+  throw new Error(`Unexpected runtime path: ${absPath}`);
+}
+
+function fileMentionsRuntime(testSource: string, runtimeKey: string): boolean {
+  const fileName = runtimeKey.split('/').at(-1) ?? runtimeKey;
+  const stem = fileName.replace(/\.ts$/, '');
+  return testSource.includes(fileName) || testSource.includes(stem);
+}
+
+describe('runtime surface accounting', () => {
+  const runtimeFiles = RUNTIME_DIRS
+    .flatMap((dir) => collectFiles(dir, (path) => path.endsWith('.ts')))
+    .map(toRuntimeKey)
+    .sort();
+
+  const allTestSource = TEST_DIRS
+    .flatMap((dir) => collectFiles(dir, (path) => path.endsWith('.test.ts')))
+    .filter((path) => path !== THIS_TEST_PATH)
+    .map((path) => readFileSync(path, 'utf-8'))
+    .join('\n');
+
+  it('every runtime file is referenced by tests or tracked as indirect coverage', () => {
+    const unaccounted = runtimeFiles.filter((runtimeKey) => (
+      !fileMentionsRuntime(allTestSource, runtimeKey)
+      && !KNOWN_INDIRECT_RUNTIME_COVERAGE.has(runtimeKey)
+    ));
+
+    if (unaccounted.length > 0) {
+      expect.fail(
+        `Found runtime files that are not referenced by tests.\n` +
+        `Mention them in a test (comment/import/assertion) or add them to KNOWN_INDIRECT_RUNTIME_COVERAGE with a reason.\n\n` +
+        unaccounted.map((file) => `  - ${file}`).join('\n'),
+      );
+    }
+  });
+
+  it('indirect coverage entries still point to real runtime files', () => {
+    for (const runtimeKey of KNOWN_INDIRECT_RUNTIME_COVERAGE.keys()) {
+      expect(
+        runtimeFiles.includes(runtimeKey),
+        `KNOWN_INDIRECT_RUNTIME_COVERAGE contains '${runtimeKey}' but that runtime file no longer exists.`,
+      ).toBe(true);
+    }
+  });
+
+  it('indirect coverage entries are removed once tests mention the runtime file', () => {
+    for (const [runtimeKey, reason] of KNOWN_INDIRECT_RUNTIME_COVERAGE.entries()) {
+      expect(reason.trim().length, `Provide a reason for '${runtimeKey}'.`).toBeGreaterThan(0);
+      expect(
+        fileMentionsRuntime(allTestSource, runtimeKey),
+        `Tests now mention '${runtimeKey}'. Remove it from KNOWN_INDIRECT_RUNTIME_COVERAGE.`,
+      ).toBe(false);
+    }
+  });
+});

package/src/__tests__/scheduled.test.ts

@@ -0,0 +1,80 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const {
+  cleanExpiredSessionsMock,
+  cleanStaleAnonymousAccountsMock,
+  ensureAuthSchemaMock,
+  deleteAnonMock,
+  resolveAuthDbMock,
+} = vi.hoisted(() => ({
+  cleanExpiredSessionsMock: vi.fn(),
+  cleanStaleAnonymousAccountsMock: vi.fn(),
+  ensureAuthSchemaMock: vi.fn(),
+  deleteAnonMock: vi.fn(),
+  resolveAuthDbMock: vi.fn(),
+}));
+
+vi.mock('cloudflare:workers', () => ({
+  DurableObject: class DurableObject {},
+}));
+
+vi.mock('../lib/auth-d1-service.js', async () => {
+  const actual = await vi.importActual<typeof import('../lib/auth-d1-service.js')>('../lib/auth-d1-service.js');
+  return {
+    ...actual,
+    cleanExpiredSessions: cleanExpiredSessionsMock,
+    cleanStaleAnonymousAccounts: cleanStaleAnonymousAccountsMock,
+  };
+});
+
+vi.mock('../lib/auth-d1.js', async () => {
+  const actual = await vi.importActual<typeof import('../lib/auth-d1.js')>('../lib/auth-d1.js');
+  return {
+    ...actual,
+    ensureAuthSchema: ensureAuthSchemaMock,
+    deleteAnon: deleteAnonMock,
+  };
+});
+
+vi.mock('../lib/auth-db-adapter.js', async () => {
+  const actual = await vi.importActual<typeof import('../lib/auth-db-adapter.js')>('../lib/auth-db-adapter.js');
+  return {
+    ...actual,
+    resolveAuthDb: resolveAuthDbMock,
+  };
+});
+
+describe('scheduled handler', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    cleanExpiredSessionsMock.mockReset().mockResolvedValue(undefined);
+    cleanStaleAnonymousAccountsMock.mockReset().mockResolvedValue([]);
+    ensureAuthSchemaMock.mockReset().mockResolvedValue(undefined);
+    deleteAnonMock.mockReset().mockResolvedValue(undefined);
+    resolveAuthDbMock.mockReset().mockReturnValue({ kind: 'auth-db' });
+  });
+
+  it('runs system cleanup even when no user schedule functions are registered', async () => {
+    const worker = (await import('../index.js')).default;
+    const pending: Promise<unknown>[] = [];
+    const ctx = {
+      waitUntil: vi.fn((promise: Promise<unknown>) => {
+        pending.push(Promise.resolve(promise));
+      }),
+    };
+
+    await worker.scheduled(
+      { scheduledTime: Date.parse('2026-03-07T03:00:00Z') } as never,
+      {} as never,
+      ctx as never,
+    );
+
+    expect(ctx.waitUntil).toHaveBeenCalledTimes(1);
+    await Promise.all(pending);
+    expect(resolveAuthDbMock).toHaveBeenCalledTimes(1);
+    expect(ensureAuthSchemaMock).toHaveBeenCalledWith({ kind: 'auth-db' });
+    expect(cleanExpiredSessionsMock).toHaveBeenCalledWith({ kind: 'auth-db' });
+    expect(cleanStaleAnonymousAccountsMock.mock.calls[0]?.[0]).toEqual({ kind: 'auth-db' });
+    expect(deleteAnonMock).not.toHaveBeenCalled();
+  }, 15_000);
+});