@edge-base/server 0.2.9 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edge-base/server",
-  "version": "0.2.9",
+  "version": "0.3.2",
   "description": "EdgeBase runtime assets consumed by the EdgeBase CLI",
   "license": "MIT",
   "repository": {
@@ -34,8 +34,8 @@
     "jose": "^6.0.0",
     "pg": "^8.16.3",
     "zod": "^4.3.6",
-    "@edge-base/core": "0.2.9",
-    "@edge-base/shared": "0.2.9"
+    "@edge-base/core": "0.3.2",
+    "@edge-base/shared": "0.3.2"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.8.71",

package/src/__tests__/auth-token.test.ts

@@ -0,0 +1,142 @@
+import { describe, expect, it } from 'vitest';
+import type { AuthDb } from '../lib/auth-db-adapter.js';
+import {
+  createEmailToken,
+  deleteEmailToken,
+  getEmailToken,
+  getEmailTokenByType,
+} from '../lib/auth-d1-service.js';
+import {
+  authSecretLookupKeys,
+  hashAuthSecret,
+  hashOtpSecret,
+  verifyAuthSecret,
+  verifyOtpSecret,
+} from '../lib/auth-token.js';
+
+class MemoryAuthDb implements AuthDb {
+  readonly dialect = 'sqlite' as const;
+  rows: Array<Record<string, unknown>> = [];
+
+  async query<T = Record<string, unknown>>(): Promise<T[]> {
+    return this.rows as T[];
+  }
+
+  async first<T = Record<string, unknown>>(_sql: string, params: unknown[] = []): Promise<T | null> {
+    const type = _sql.includes('AND type = ?') ? params[params.length - 1] : undefined;
+    const tokenKeys = type ? params.slice(0, -1) : params;
+    const row = this.rows.find((candidate) => {
+      return tokenKeys.includes(candidate.token) && (!type || candidate.type === type);
+    });
+    return (row ?? null) as T | null;
+  }
+
+  async run(sql: string, params: unknown[] = []): Promise<void> {
+    if (sql.includes('INSERT INTO _email_tokens')) {
+      const [token, userId, type, expiresAt, createdAt] = params;
+      this.rows.push({ token, userId, type, expiresAt, createdAt });
+      return;
+    }
+    if (sql.includes('DELETE FROM _email_tokens WHERE token IN')) {
+      const keys = new Set(params);
+      this.rows = this.rows.filter((row) => !keys.has(row.token));
+      return;
+    }
+    throw new Error(`Unexpected SQL in MemoryAuthDb: ${sql}`);
+  }
+
+  async batch(): Promise<void> {}
+}
+
+describe('auth-token helpers', () => {
+  it('hashes auth secrets and verifies them without storing the raw value', async () => {
+    const hash = await hashAuthSecret('123456');
+
+    expect(hash).toMatch(/^sha256:[a-f0-9]{64}$/);
+    expect(hash).not.toBe('123456');
+    await expect(verifyAuthSecret('123456', hash)).resolves.toBe(true);
+    await expect(verifyAuthSecret('000000', hash)).resolves.toBe(false);
+  });
+
+  it('hashes short OTP secrets with a server-keyed HMAC', async () => {
+    const hash = await hashOtpSecret('123456', 'server-secret-a');
+
+    expect(hash).toMatch(/^hmac-sha256:[a-f0-9]{64}$/);
+    expect(hash).not.toBe('123456');
+    expect(hash).not.toBe(await hashAuthSecret('123456'));
+    await expect(verifyOtpSecret('123456', hash, 'server-secret-a')).resolves.toBe(true);
+    await expect(verifyOtpSecret('000000', hash, 'server-secret-a')).resolves.toBe(false);
+    await expect(verifyOtpSecret('123456', hash, 'server-secret-b')).resolves.toBe(false);
+  });
+
+  it('keeps short-lived legacy SHA-256 OTP hashes verifiable', async () => {
+    const legacyHash = await hashAuthSecret('123456');
+
+    await expect(verifyOtpSecret('123456', legacyHash, 'server-secret-a')).resolves.toBe(true);
+    await expect(verifyOtpSecret('000000', legacyHash, 'server-secret-a')).resolves.toBe(false);
+  });
+
+  it('builds hashed and legacy lookup keys for auth secrets', async () => {
+    const keys = await authSecretLookupKeys('raw-magic-link-token');
+
+    expect(keys).toHaveLength(2);
+    expect(keys[0]).toMatch(/^sha256:[a-f0-9]{64}$/);
+    expect(keys[1]).toBe('raw-magic-link-token');
+    await expect(authSecretLookupKeys(keys[0])).resolves.toEqual([keys[0]]);
+  });
+});
+
+describe('email token storage', () => {
+  it('stores hashed email tokens while allowing raw-token lookup and deletion', async () => {
+    const db = new MemoryAuthDb();
+    const expiresAt = new Date(Date.now() + 60_000).toISOString();
+
+    await createEmailToken(db, {
+      token: 'raw-magic-link-token',
+      userId: 'user-1',
+      type: 'magic-link',
+      expiresAt,
+    });
+
+    expect(db.rows).toHaveLength(1);
+    expect(db.rows[0].token).toMatch(/^sha256:[a-f0-9]{64}$/);
+    expect(db.rows[0].token).not.toBe('raw-magic-link-token');
+
+    const row = await getEmailToken(db, 'raw-magic-link-token');
+    expect(row?.userId).toBe('user-1');
+
+    await deleteEmailToken(db, 'raw-magic-link-token');
+    expect(db.rows).toHaveLength(0);
+  });
+
+  it('still accepts and deletes legacy raw email tokens', async () => {
+    const db = new MemoryAuthDb();
+    db.rows.push({
+      token: 'legacy-verify-token',
+      userId: 'user-2',
+      type: 'verify',
+      expiresAt: new Date(Date.now() + 60_000).toISOString(),
+      createdAt: new Date().toISOString(),
+    });
+
+    const row = await getEmailTokenByType(db, 'legacy-verify-token', 'verify');
+    expect(row?.userId).toBe('user-2');
+
+    await deleteEmailToken(db, 'legacy-verify-token');
+    expect(db.rows).toHaveLength(0);
+  });
+
+  it('cleans up expired hashed tokens on lookup', async () => {
+    const db = new MemoryAuthDb();
+    await createEmailToken(db, {
+      token: 'expired-token',
+      userId: 'user-3',
+      type: 'password-reset',
+      expiresAt: new Date(Date.now() - 60_000).toISOString(),
+    });
+
+    const row = await getEmailToken(db, 'expired-token');
+    expect(row).toBeNull();
+    expect(db.rows).toHaveLength(0);
+  });
+});

package/src/__tests__/email-provider.test.ts

@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import {
+  CloudflareEmailProvider,
   SESProvider,
   SendGridProvider,
   createEmailProvider,
@@ -78,6 +79,87 @@ describe('SendGridProvider', () => {
   });
 });
 
+describe('CloudflareEmailProvider', () => {
+  it('uses the Workers send_email binding when available', async () => {
+    const send = vi.fn().mockResolvedValue({ messageId: 'cf-binding-1' });
+
+    const provider = createEmailProvider(
+      { provider: 'cloudflare', from: 'noreply@example.com' },
+      { EMAIL: { send } },
+    );
+    expect(provider).not.toBeNull();
+
+    const result = await provider!.send({
+      to: 'user@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+
+    expect(result).toEqual({ success: true, messageId: 'cf-binding-1' });
+    expect(send).toHaveBeenCalledWith({
+      to: 'user@example.com',
+      from: 'noreply@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+  });
+
+  it('sends through the Cloudflare Email Service REST API when no binding exists', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({
+        success: true,
+        errors: [],
+        messages: [],
+        result: { delivered: ['user@example.com'], permanent_bounces: [], queued: [] },
+      }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    const provider = new CloudflareEmailProvider({
+      from: 'noreply@example.com',
+      accountId: 'acct-1',
+      apiKey: 'cf-token',
+    });
+    const result = await provider.send({
+      to: 'user@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+
+    expect(result).toEqual({ success: true });
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://api.cloudflare.com/client/v4/accounts/acct-1/email/sending/send',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          Authorization: 'Bearer cf-token',
+          'Content-Type': 'application/json',
+        }),
+      }),
+    );
+  });
+
+  it('fails without REST credentials when no Workers binding exists', async () => {
+    const fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+
+    const provider = createEmailProvider({ provider: 'cloudflare', from: 'noreply@example.com' });
+    expect(provider).not.toBeNull();
+
+    const result = await provider!.send({
+      to: 'user@example.com',
+      subject: 'Hello',
+      html: '<p>hello</p>',
+    });
+
+    expect(result).toEqual({ success: false });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
+
 describe('SESProvider', () => {
   it('signs the outbound request with AWS SigV4 headers', async () => {
     const fetchMock = vi.fn().mockResolvedValue(

package/src/__tests__/error-format.test.ts

@@ -263,6 +263,27 @@ describe('normalizeDatabaseError', () => {
     expect(err?.slug).toBe('constraint-failed');
   });
 
+  // PostgreSQL uses different constraint phrasings than SQLite/D1; the same
+  // normalizer must map them to the same slugs/status codes for provider parity.
+  it('maps PostgreSQL foreign key violations to the same 400 slug', () => {
+    const err = normalizeDatabaseError(
+      new Error('insert or update on table "posts" violates foreign key constraint "posts_author_id_fkey"'),
+    );
+    expect(err).toBeInstanceOf(EdgeBaseError);
+    expect(err?.code).toBe(400);
+    expect(err?.slug).toBe('foreign-key-failed');
+  });
+
+  it('maps PostgreSQL not-null violations to the constraint slug and extracts the column', () => {
+    const err = normalizeDatabaseError(
+      new Error('null value in column "email" of relation "users" violates not-null constraint'),
+    );
+    expect(err).toBeInstanceOf(EdgeBaseError);
+    expect(err?.code).toBe(400);
+    expect(err?.message).toContain("'email'");
+    expect(err?.slug).toBe('constraint-failed');
+  });
+
   it('returns null for blank string inputs', () => {
     expect(normalizeDatabaseError('   ')).toBeNull();
   });

package/src/__tests__/functions-context.test.ts

@@ -10,6 +10,28 @@ describe('buildFunctionContext admin.db', () => {
     vi.unstubAllGlobals();
   });
 
+  it('exposes worker environment values to app functions', async () => {
+    const env = {
+      NOTION_IMPORT_SECRET: 'test-secret',
+      CUSTOM_BINDING: { id: 'binding' },
+    };
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/feed-summary'),
+      auth: null,
+      databaseNamespace: {} as DurableObjectNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {
+        databases: {},
+      },
+      env: env as never,
+    });
+
+    expect(ctx.env?.NOTION_IMPORT_SECRET).toBe('test-secret');
+    expect(ctx.env?.CUSTOM_BINDING).toBe(env.CUSTOM_BINDING);
+  });
+
   it('routes table proxy calls through the worker when workerUrl is available', async () => {
     const fetchMock = vi.fn().mockResolvedValue(
       new Response(JSON.stringify({ items: [{ id: 'p1' }] }), {
@@ -197,6 +219,71 @@ describe('buildFunctionContext admin.db', () => {
     );
   });
 
+  it('exposes the configured email provider to app functions', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ messageId: 'msg_1' }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/send-invite'),
+      auth: null,
+      databaseNamespace: {} as DurableObjectNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {
+        email: {
+          provider: 'cloudflare',
+          from: 'noreply@example.com',
+        },
+      },
+      env: {
+        EDGEBASE_EMAIL_API_URL: 'http://mail.local',
+      } as never,
+    });
+
+    expect(ctx.email).toBeDefined();
+    await expect(
+      ctx.email?.send({
+        to: 'member@example.com',
+        subject: 'Workspace invite',
+        html: '<p>Join the workspace</p>',
+      }),
+    ).resolves.toEqual({ success: true, messageId: 'msg_1' });
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      'http://mail.local/send',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          'Content-Type': 'application/json',
+        }),
+        body: JSON.stringify({
+          from: 'noreply@example.com',
+          to: 'member@example.com',
+          subject: 'Workspace invite',
+          html: '<p>Join the workspace</p>',
+        }),
+      }),
+    );
+  });
+
+  it('omits the email sender when no provider is configured', () => {
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/no-email'),
+      auth: null,
+      databaseNamespace: {} as DurableObjectNamespace,
+      authNamespace: {} as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      config: {},
+    });
+
+    expect(ctx.email).toBeUndefined();
+  });
+
   it('rejects instance ids for single-instance admin.sqlProviderAware calls before touching direct backends', async () => {
     const fetchMock = vi.fn();
     vi.stubGlobal('fetch', fetchMock);

package/src/__tests__/functions-d1-proxy.test.ts

@@ -227,6 +227,76 @@ describe('buildFunctionContext admin.db D1 routing', () => {
     expect(databaseFetch).not.toHaveBeenCalled();
   });
 
+  it('falls back to the database durable object for implicit D1 namespaces when the D1 binding is absent', async () => {
+    const handleD1Request = vi.fn().mockRejectedValue(new Error('D1 handler should not be used'));
+    vi.doMock('../lib/d1-handler.js', () => ({
+      handleD1Request,
+    }));
+
+    const workerFetch = vi.fn().mockRejectedValue(new Error('worker fetch should not be used'));
+    vi.stubGlobal('fetch', workerFetch);
+
+    const databaseFetch = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify({ items: [{ id: 'sig-do', title: 'Read via DO' }] }), {
+        status: 200,
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    );
+    const databaseNamespace = {
+      idFromName: vi.fn(() => 'shared-id'),
+      get: vi.fn(() => ({ fetch: databaseFetch })),
+    } as unknown as DurableObjectNamespace;
+
+    const { buildFunctionContext } = await import('../lib/functions.js');
+
+    const ctx = buildFunctionContext({
+      request: new Request('http://localhost/api/functions/save-room-signal'),
+      auth: null,
+      databaseNamespace,
+      authNamespace: {
+        idFromName: vi.fn(() => 'auth-id'),
+        get: vi.fn(() => ({ fetch: vi.fn() })),
+      } as unknown as DurableObjectNamespace,
+      d1Database: {} as D1Database,
+      env: {
+        DATABASE: databaseNamespace,
+        AUTH: {} as DurableObjectNamespace,
+        AUTH_DB: {} as D1Database,
+      } as never,
+      executionCtx: { waitUntil: vi.fn() } as unknown as ExecutionContext,
+      config: {
+        databases: {
+          shared: {
+            tables: {
+              signals: {
+                schema: {
+                  title: { type: 'string', required: true },
+                },
+              },
+            },
+          },
+        },
+      },
+    });
+
+    const result = await ctx.admin.db('shared').table('signals').getList();
+
+    expect(result.items).toEqual([{ id: 'sig-do', title: 'Read via DO' }]);
+    expect(handleD1Request).not.toHaveBeenCalled();
+    expect(workerFetch).not.toHaveBeenCalled();
+    expect(databaseNamespace.idFromName).toHaveBeenCalledWith('shared');
+    expect(databaseFetch).toHaveBeenCalledWith(
+      'http://do/tables/signals',
+      expect.objectContaining({
+        method: 'GET',
+        headers: expect.objectContaining({
+          'X-DO-Name': 'shared',
+          'X-EdgeBase-Internal': 'true',
+        }),
+      }),
+    );
+  });
+
   it('rejects instance ids for single-instance namespaces before touching D1 handlers', async () => {
     const handleD1Request = vi.fn();
     vi.doMock('../lib/d1-handler.js', () => ({

package/src/__tests__/functions-route.test.ts

@@ -8,6 +8,7 @@ import {
   rebuildCompiledRoutes,
   registerFunction,
   registerMiddleware,
+  wrapMethodExport,
 } from '../lib/functions.js';
 import { functionsRoute } from '../routes/functions.js';
 import type { Env } from '../types.js';
@@ -104,6 +105,20 @@ afterEach(() => {
   setConfig({});
 });
 
+describe('function registry wrapping', () => {
+  it('preserves full default-export function definitions with non-HTTP triggers', () => {
+    const scheduleFunction: FunctionDefinition = {
+      trigger: { type: 'schedule', cron: '*/15 * * * *' },
+      handler: async () => ({ ok: true }),
+    };
+
+    const wrapped = wrapMethodExport(scheduleFunction, '*');
+
+    expect(wrapped).toBe(scheduleFunction);
+    expect(wrapped.trigger).toEqual({ type: 'schedule', cron: '*/15 * * * *' });
+  });
+});
+
 describe('functionsRoute FunctionError compatibility', () => {
   it('returns structured JSON when directory middleware throws a foreign FunctionError', async () => {
     registerMiddleware('', async () => {