@haverstack/server 0.8.0

package/tests/routes/relatedToQuery.test.ts

@@ -0,0 +1,182 @@
+/**
+ * POST /records/query's filter.relatedTo — the body-side counterpart to
+ * the relatedTo/relatedToEntity/relatedToNs/relatedToId/relatedToStack URL
+ * params covered in records.test.ts. Same scoped-target shape, carried as
+ * a JSON object instead of query params.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { buildTestApp, req, TEST_TOKEN, OTHER_ENTITY_ID, type TestApp } from '../setup.js';
+
+const NOTE_TYPE_ID = 'com.example.test/note@1';
+
+async function seedType(ctx: TestApp['ctx']) {
+  return ctx.stack.defineType(NOTE_TYPE_ID, 'Note', {
+    body: { kind: 'text' as const, required: true as const },
+  });
+}
+
+async function seedRecord(ctx: TestApp['ctx'], overrides: Record<string, unknown> = {}) {
+  return ctx.stack.create(NOTE_TYPE_ID, { body: 'Hello world', ...overrides });
+}
+
+describe('POST /records/query filter.relatedTo', () => {
+  let t: TestApp;
+  beforeEach(async () => {
+    t = await buildTestApp();
+    await seedType(t.ctx);
+  });
+  afterEach(async () => {
+    await t.cleanup();
+  });
+
+  it('matches a record-scope target, narrowed further by label', async () => {
+    const target = await seedRecord(t.ctx, { body: 'target' });
+    const child = await t.ctx.stack.create(
+      NOTE_TYPE_ID,
+      { body: 'child' },
+      {
+        associations: [
+          {
+            kind: 'relationship',
+            label: 'child',
+            target: { scope: 'record', recordId: target.id },
+          },
+        ],
+      },
+    );
+
+    const { status, data } = await req(t.app, 'POST', '/records/query', {
+      token: TEST_TOKEN,
+      body: { filter: { relatedTo: { target: { scope: 'record', recordId: target.id } } } },
+    });
+    expect(status).toBe(200);
+    expect((data as { records: Array<{ id: string }> }).records.map((r) => r.id)).toEqual([
+      child.id,
+    ]);
+  });
+
+  it('matches an entity-scope target', async () => {
+    const child = await t.ctx.stack.create(
+      NOTE_TYPE_ID,
+      { body: 'child' },
+      {
+        associations: [
+          {
+            kind: 'relationship',
+            label: 'author',
+            target: { scope: 'entity', entityId: OTHER_ENTITY_ID },
+          },
+        ],
+      },
+    );
+
+    const { status, data } = await req(t.app, 'POST', '/records/query', {
+      token: TEST_TOKEN,
+      body: {
+        filter: { relatedTo: { target: { scope: 'entity', entityId: OTHER_ENTITY_ID } } },
+      },
+    });
+    expect(status).toBe(200);
+    expect((data as { records: Array<{ id: string }> }).records.map((r) => r.id)).toEqual([
+      child.id,
+    ]);
+  });
+
+  it('matches an external-scope target, and the whole namespace when id is omitted', async () => {
+    const syndicated = await t.ctx.stack.create(
+      NOTE_TYPE_ID,
+      { body: 'syndicated' },
+      {
+        associations: [
+          {
+            kind: 'relationship',
+            label: 'syndicated-to',
+            target: {
+              scope: 'external',
+              ns: 'atproto',
+              id: 'at://did:plc:abc/app.bsky.feed.post/1',
+            },
+          },
+        ],
+      },
+    );
+
+    const { status, data } = await req(t.app, 'POST', '/records/query', {
+      token: TEST_TOKEN,
+      body: { filter: { relatedTo: { target: { scope: 'external', ns: 'atproto' } } } },
+    });
+    expect(status).toBe(200);
+    expect((data as { records: Array<{ id: string }> }).records.map((r) => r.id)).toEqual([
+      syndicated.id,
+    ]);
+  });
+
+  it('label alone (no target) is valid and matches every target under it', async () => {
+    const target = await seedRecord(t.ctx, { body: 'target' });
+    const child = await t.ctx.stack.create(
+      NOTE_TYPE_ID,
+      { body: 'child' },
+      {
+        associations: [
+          {
+            kind: 'relationship',
+            label: 'reply-to',
+            target: { scope: 'record', recordId: target.id },
+          },
+        ],
+      },
+    );
+
+    const { status, data } = await req(t.app, 'POST', '/records/query', {
+      token: TEST_TOKEN,
+      body: { filter: { relatedTo: { label: 'reply-to' } } },
+    });
+    expect(status).toBe(200);
+    expect((data as { records: Array<{ id: string }> }).records.map((r) => r.id)).toEqual([
+      child.id,
+    ]);
+  });
+
+  it('rejects filter.relatedTo naming neither a label nor a target with 400', async () => {
+    const { status, data } = await req(t.app, 'POST', '/records/query', {
+      token: TEST_TOKEN,
+      body: { filter: { relatedTo: {} } },
+    });
+    expect(status).toBe(400);
+    expect((data as { error: { code: string } }).error.code).toBe('bad_request');
+  });
+
+  // An unrecognized target scope is a parsing rejection, pinned once at the
+  // unit level in @haverstack/core's wire-request.test.ts rather than here
+  // — see server#114.
+
+  it('rejects a record target with an empty recordId with 400', async () => {
+    const { status, data } = await req(t.app, 'POST', '/records/query', {
+      token: TEST_TOKEN,
+      body: { filter: { relatedTo: { target: { scope: 'record', recordId: '' } } } },
+    });
+    expect(status).toBe(400);
+    expect((data as { error: { code: string } }).error.code).toBe('bad_request');
+  });
+
+  it('rejects a record target with an empty stackUrl with 400', async () => {
+    const target = await seedRecord(t.ctx, { body: 'target' });
+    const { status, data } = await req(t.app, 'POST', '/records/query', {
+      token: TEST_TOKEN,
+      body: {
+        filter: { relatedTo: { target: { scope: 'record', recordId: target.id, stackUrl: '' } } },
+      },
+    });
+    expect(status).toBe(400);
+    expect((data as { error: { code: string } }).error.code).toBe('bad_request');
+  });
+
+  it('rejects an external target with an empty id with 400', async () => {
+    const { status, data } = await req(t.app, 'POST', '/records/query', {
+      token: TEST_TOKEN,
+      body: { filter: { relatedTo: { target: { scope: 'external', ns: 'atproto', id: '' } } } },
+    });
+    expect(status).toBe(400);
+    expect((data as { error: { code: string } }).error.code).toBe('bad_request');
+  });
+});

package/tests/routes/tokens.test.ts

@@ -0,0 +1,157 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { buildTestApp, req, TEST_TOKEN, OTHER_ENTITY_ID, type TestApp } from '../setup.js';
+
+describe('POST /tokens', () => {
+  let t: TestApp;
+  beforeEach(async () => {
+    t = await buildTestApp();
+  });
+  afterEach(async () => {
+    await t.cleanup();
+  });
+
+  it('owner can create a token and receives the token value', async () => {
+    const { status, data } = await req(t.app, 'POST', '/tokens', {
+      token: TEST_TOKEN,
+      body: { entityId: OTHER_ENTITY_ID, label: 'test-label' },
+    });
+    expect(status).toBe(201);
+    const d = data as Record<string, unknown>;
+    expect(typeof d.id).toBe('string');
+    expect(typeof d.token).toBe('string');
+    expect(d.principalId).toBe(OTHER_ENTITY_ID);
+    expect(d.subjectId).toBe(OTHER_ENTITY_ID);
+    expect(d.label).toBe('test-label');
+  });
+
+  it('owner can assert a delegation via onBehalfOf', async () => {
+    const subjectId = 'did:key:subject-entity-id-00000003';
+    const { status, data } = await req(t.app, 'POST', '/tokens', {
+      token: TEST_TOKEN,
+      body: { entityId: OTHER_ENTITY_ID, onBehalfOf: subjectId },
+    });
+    expect(status).toBe(201);
+    const d = data as Record<string, unknown>;
+    expect(d.principalId).toBe(OTHER_ENTITY_ID);
+    expect(d.subjectId).toBe(subjectId);
+
+    const session = await t.ctx.adapter.lookupToken(d.token as string);
+    expect(session).toEqual({ principalId: OTHER_ENTITY_ID, subjectId });
+  });
+
+  it('returns 403 for a non-owner authenticated entity', async () => {
+    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+    const { status } = await req(t.app, 'POST', '/tokens', {
+      token,
+      body: {},
+    });
+    expect(status).toBe(403);
+  });
+
+  it('returns 401 for an unauthenticated request', async () => {
+    const { status } = await req(t.app, 'POST', '/tokens', { body: {} });
+    expect(status).toBe(401);
+  });
+
+  it('rejects a non-DID entityId with 422', async () => {
+    const { status, data } = await req(t.app, 'POST', '/tokens', {
+      token: TEST_TOKEN,
+      body: { entityId: 'not-a-did' },
+    });
+    expect(status).toBe(422);
+    const body = data as { error: { code: string; details: Array<{ path: string }> } };
+    expect(body.error.code).toBe('validation');
+    expect(body.error.details.some((d) => d.path === 'entityId')).toBe(true);
+  });
+
+  it('rejects a non-DID onBehalfOf with 422', async () => {
+    const { status, data } = await req(t.app, 'POST', '/tokens', {
+      token: TEST_TOKEN,
+      body: { entityId: OTHER_ENTITY_ID, onBehalfOf: 'not-a-did' },
+    });
+    expect(status).toBe(422);
+    const body = data as { error: { code: string; details: Array<{ path: string }> } };
+    expect(body.error.code).toBe('validation');
+    expect(body.error.details.some((d) => d.path === 'onBehalfOf')).toBe(true);
+  });
+
+  it('reports the stored createdAt, matching what GET /tokens later reports', async () => {
+    const { data } = await req(t.app, 'POST', '/tokens', {
+      token: TEST_TOKEN,
+      body: { entityId: OTHER_ENTITY_ID },
+    });
+    const created = data as { id: string; createdAt: string };
+
+    const { data: listed } = await req(t.app, 'GET', '/tokens', { token: TEST_TOKEN });
+    const row = (listed as { tokens: Array<{ id: string; createdAt: string }> }).tokens.find(
+      (tok) => tok.id === created.id,
+    );
+    expect(row?.createdAt).toBe(created.createdAt);
+  });
+});
+
+describe('GET /tokens', () => {
+  let t: TestApp;
+  beforeEach(async () => {
+    t = await buildTestApp();
+  });
+  afterEach(async () => {
+    await t.cleanup();
+  });
+
+  it('owner can list tokens without token values exposed', async () => {
+    await t.ctx.adapter.createToken(OTHER_ENTITY_ID, { label: 'tok-a' });
+    await t.ctx.adapter.createToken(OTHER_ENTITY_ID, { label: 'tok-b' });
+
+    const { status, data } = await req(t.app, 'GET', '/tokens', { token: TEST_TOKEN });
+    expect(status).toBe(200);
+    const d = data as { tokens: Array<Record<string, unknown>> };
+    expect(d.tokens).toHaveLength(2);
+    for (const t of d.tokens) {
+      expect(t.token).toBeUndefined();
+      expect(typeof t.id).toBe('string');
+    }
+  });
+
+  it('returns 403 for a non-owner authenticated entity', async () => {
+    const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+    const { status } = await req(t.app, 'GET', '/tokens', { token });
+    expect(status).toBe(403);
+  });
+
+  it('returns 401 for an unauthenticated request', async () => {
+    const { status } = await req(t.app, 'GET', '/tokens');
+    expect(status).toBe(401);
+  });
+});
+
+describe('DELETE /tokens/:id', () => {
+  let t: TestApp;
+  beforeEach(async () => {
+    t = await buildTestApp();
+  });
+  afterEach(async () => {
+    await t.cleanup();
+  });
+
+  it('owner can revoke a token', async () => {
+    const { id } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+    const { status } = await req(t.app, 'DELETE', `/tokens/${id}`, { token: TEST_TOKEN });
+    expect(status).toBe(204);
+
+    const tokens = await t.ctx.adapter.listTokens();
+    expect(tokens.find((tok) => tok.id === id)).toBeUndefined();
+  });
+
+  it('returns 403 for a non-owner authenticated entity', async () => {
+    const { id, token: otherToken } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+    const { status } = await req(t.app, 'DELETE', `/tokens/${id}`, { token: otherToken });
+    expect(status).toBe(403);
+  });
+
+  it('returns 401 for an unauthenticated request', async () => {
+    const { id } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+    const { status } = await req(t.app, 'DELETE', `/tokens/${id}`);
+    expect(status).toBe(401);
+  });
+});

package/tests/routes/tombstones.test.ts

@@ -0,0 +1,93 @@
+/**
+ * Soft-delete tombstone projection and mutation refusal. The behavior is
+ * core's, pinned at this server's HTTP surface rather than assumed to
+ * survive the trip through it.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { buildTestApp, req, TEST_TOKEN, type TestApp } from '../setup.js';
+import { openChangeFeed } from '../changeFeedClient.js';
+
+const NOTE_TYPE = 'com.example.test/note@1';
+
+async function seedNoteType(ctx: TestApp['ctx']) {
+  await ctx.stack.defineType(NOTE_TYPE, 'Note', {
+    title: { kind: 'string' },
+    body: { kind: 'text' },
+  });
+}
+
+describe('tombstone projection and mutation refusal', () => {
+  let t: TestApp;
+  beforeEach(async () => {
+    t = await buildTestApp();
+    await seedNoteType(t.ctx);
+  });
+  afterEach(async () => {
+    await t.cleanup();
+  });
+
+  it('GET on a soft-deleted record projects a tombstone: content emptied, deletedAt set', async () => {
+    const record = await t.ctx.stack.create(NOTE_TYPE, { title: 'x' });
+    await req(t.app, 'DELETE', `/records/${record.id}`, { token: TEST_TOKEN });
+    const { status, data } = await req(t.app, 'GET', `/records/${record.id}`, {
+      token: TEST_TOKEN,
+    });
+    expect(status).toBe(200);
+    const d = data as { content: unknown; deletedAt?: string };
+    expect(d.content).toEqual({});
+    expect(typeof d.deletedAt).toBe('string');
+  });
+
+  it('query({ includeDeleted: true }) surfaces the same tombstone projection', async () => {
+    const record = await t.ctx.stack.create(NOTE_TYPE, { title: 'y' });
+    await req(t.app, 'DELETE', `/records/${record.id}`, { token: TEST_TOKEN });
+    const { status, data } = await req(t.app, 'POST', '/records/query', {
+      token: TEST_TOKEN,
+      body: { filter: { typeId: NOTE_TYPE, includeDeleted: true } },
+    });
+    expect(status).toBe(200);
+    const d = data as { records: Array<{ id: string; content: unknown; deletedAt?: string }> };
+    const found = d.records.find((r) => r.id === record.id)!;
+    expect(found.content).toEqual({});
+    expect(typeof found.deletedAt).toBe('string');
+  });
+
+  it('the change feed carries the same tombstone projection on delete', async () => {
+    const record = await t.ctx.stack.create(NOTE_TYPE, { title: 'x' });
+    const conn = await openChangeFeed(t.app, '/changes?include=record', { token: TEST_TOKEN });
+    try {
+      await conn.waitForFrames(1); // ready
+      await req(t.app, 'DELETE', `/records/${record.id}`, { token: TEST_TOKEN });
+      const [, frame] = await conn.waitForFrames(2);
+      const data = frame.data as unknown as {
+        record: { content: unknown; deletedAt?: string };
+      };
+      expect(data.record.content).toEqual({});
+      expect(typeof data.record.deletedAt).toBe('string');
+    } finally {
+      await conn.close();
+    }
+  });
+
+  it('mutating a soft-deleted record is refused with 409, not applied to the tombstone', async () => {
+    const record = await t.ctx.stack.create(NOTE_TYPE, { title: 'z' });
+    await req(t.app, 'DELETE', `/records/${record.id}`, { token: TEST_TOKEN });
+    const { status, data } = await req(t.app, 'PATCH', `/records/${record.id}`, {
+      token: TEST_TOKEN,
+      body: { contentPatch: { title: 'edited' } },
+    });
+    expect(status).toBe(409);
+    expect((data as { error: { code: string } }).error.code).toBe('conflict');
+  });
+
+  it('version history is exempt from the tombstone projection and still serves content', async () => {
+    const record = await t.ctx.stack.create(NOTE_TYPE, { title: 'w' });
+    await req(t.app, 'DELETE', `/records/${record.id}`, { token: TEST_TOKEN });
+    const { status, data } = await req(t.app, 'GET', `/records/${record.id}/versions`, {
+      token: TEST_TOKEN,
+    });
+    expect(status).toBe(200);
+    const versions = data as Array<{ content: Record<string, unknown> }>;
+    expect(versions[0]!.content).toEqual({ title: 'w' });
+  });
+});

package/tests/routes/types.test.ts

@@ -0,0 +1,129 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { hashSchema } from '@haverstack/core';
+import { buildTestApp, req, TEST_TOKEN, OTHER_ENTITY_ID, type TestApp } from '../setup.js';
+
+describe('Types', () => {
+  let t: TestApp;
+  beforeEach(async () => {
+    t = await buildTestApp();
+  });
+  afterEach(async () => {
+    await t.cleanup();
+  });
+
+  const typeId = 'com.example.test/item@1';
+  const schema = { name: { kind: 'string' as const, required: true as const } };
+
+  describe('POST /types', () => {
+    it('registers a type as owner', async () => {
+      const schemaHash = await hashSchema(schema);
+      const { status, data } = await req(t.app, 'POST', '/types', {
+        token: TEST_TOKEN,
+        body: {
+          id: typeId,
+          baseId: 'com.example.test/item',
+          version: 1,
+          name: 'Item',
+          schema,
+          schemaHash,
+          createdAt: new Date().toISOString(),
+        },
+      });
+      expect(status).toBe(201);
+      expect((data as Record<string, unknown>).id).toBe(typeId);
+    });
+
+    it('returns 401 without auth', async () => {
+      const { status } = await req(t.app, 'POST', '/types', {
+        body: { id: typeId, baseId: 'x', version: 1, name: 'x', schema: {}, schemaHash: 'x' },
+      });
+      expect(status).toBe(401);
+    });
+
+    it('returns 403 for a non-owner entity', async () => {
+      const { token } = await t.ctx.adapter.createToken(OTHER_ENTITY_ID);
+      const { status } = await req(t.app, 'POST', '/types', {
+        token,
+        body: { id: typeId, baseId: 'x', version: 1, name: 'x', schema: {}, schemaHash: 'x' },
+      });
+      expect(status).toBe(403);
+    });
+
+    it('re-POSTing an identical schema is a no-op that preserves createdAt', async () => {
+      const schemaHash = await hashSchema(schema);
+      const first = await req(t.app, 'POST', '/types', {
+        token: TEST_TOKEN,
+        body: { id: typeId, name: 'Item', schema, schemaHash },
+      });
+      expect(first.status).toBe(201);
+      const createdAt = (first.data as Record<string, unknown>).createdAt;
+
+      const second = await req(t.app, 'POST', '/types', {
+        token: TEST_TOKEN,
+        body: { id: typeId, name: 'Item', schema, schemaHash },
+      });
+      expect(second.status).toBe(201);
+      expect((second.data as Record<string, unknown>).createdAt).toBe(createdAt);
+    });
+
+    it('re-POSTing an additive-legal schema change is accepted', async () => {
+      const schemaHash = await hashSchema(schema);
+      await req(t.app, 'POST', '/types', {
+        token: TEST_TOKEN,
+        body: { id: typeId, name: 'Item', schema, schemaHash },
+      });
+
+      const widened = {
+        ...schema,
+        note: { kind: 'string' as const, required: false as const },
+      };
+      const widenedHash = await hashSchema(widened);
+      const { status, data } = await req(t.app, 'POST', '/types', {
+        token: TEST_TOKEN,
+        body: { id: typeId, name: 'Item', schema: widened, schemaHash: widenedHash },
+      });
+      expect(status).toBe(201);
+      expect((data as Record<string, unknown>).schema).toEqual(widened);
+    });
+
+    it('re-POSTing a non-additive schema change returns 409 schema_drift', async () => {
+      const schemaHash = await hashSchema(schema);
+      await req(t.app, 'POST', '/types', {
+        token: TEST_TOKEN,
+        body: { id: typeId, name: 'Item', schema, schemaHash },
+      });
+
+      const incompatible = { name: { kind: 'number' as const, required: true as const } };
+      const incompatibleHash = await hashSchema(incompatible);
+      const { status, data } = await req(t.app, 'POST', '/types', {
+        token: TEST_TOKEN,
+        body: { id: typeId, name: 'Item', schema: incompatible, schemaHash: incompatibleHash },
+      });
+      expect(status).toBe(409);
+      expect((data as { error: { code: string } }).error.code).toBe('schema_drift');
+    });
+  });
+
+  describe('GET /types', () => {
+    it('returns all registered types (no auth required)', async () => {
+      await t.ctx.stack.defineType(typeId, 'Item', schema);
+      const { status, data } = await req(t.app, 'GET', '/types');
+      expect(status).toBe(200);
+      expect((data as unknown[]).length).toBeGreaterThanOrEqual(1);
+    });
+  });
+
+  describe('GET /types/:id', () => {
+    it('returns one type (URL-encoded, no auth required)', async () => {
+      await t.ctx.stack.defineType(typeId, 'Item', schema);
+      const { status, data } = await req(t.app, 'GET', `/types/${encodeURIComponent(typeId)}`);
+      expect(status).toBe(200);
+      expect((data as Record<string, unknown>).id).toBe(typeId);
+    });
+
+    it('returns 404 for unknown type', async () => {
+      const { status } = await req(t.app, 'GET', '/types/unknown%40999');
+      expect(status).toBe(404);
+    });
+  });
+});