@hiai-gg/hiai-docs 0.0.1

package/backend/src/__tests__/auth-helpers.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, test } from "bun:test";
+
+describe("auth-helpers", () => {
+	test("getSessionUserId exports a function", async () => {
+		const mod = await import("../lib/auth-helpers");
+		expect(typeof mod.getSessionUserId).toBe("function");
+	});
+
+	test("getSessionUserId returns null for empty headers (no auth)", async () => {
+		const mod = await import("../lib/auth-helpers");
+		const headers = new Headers();
+		const result = await mod.getSessionUserId(headers);
+		// No API key configured and no session => null
+		expect(result === null || typeof result === "string").toBe(true);
+	});
+
+	test("getSessionUserId returns null for malformed Authorization header", async () => {
+		const mod = await import("../lib/auth-helpers");
+		const headers = new Headers({ authorization: "Basic dXNlcjpwYXNz" });
+		const result = await mod.getSessionUserId(headers);
+		// Not a Bearer token, so API key check skips; no session => null
+		expect(result === null || typeof result === "string").toBe(true);
+	});
+
+	test("getSessionUserId returns null for Bearer token with no matching API key", async () => {
+		const mod = await import("../lib/auth-helpers");
+		const headers = new Headers({ authorization: "Bearer wrong-token-value" });
+		const result = await mod.getSessionUserId(headers);
+		// Token doesn't match HIAI_DOCS_API_KEY (if set), Better Auth also fails
+		expect(result === null || typeof result === "string").toBe(true);
+	});
+
+	test("getSessionUserId accepts Headers object without throwing", async () => {
+		const mod = await import("../lib/auth-helpers");
+		const headers = new Headers({
+			authorization: "Bearer test123",
+			"content-type": "application/json",
+		});
+		// Should not throw regardless of auth outcome
+		await expect(mod.getSessionUserId(headers)).resolves.toBeDefined();
+	});
+
+	test("getSessionUserId handles Headers with x-forwarded-for (no effect on auth)", async () => {
+		const mod = await import("../lib/auth-helpers");
+		const headers = new Headers({
+			"x-forwarded-for": "192.168.1.1",
+		});
+		const result = await mod.getSessionUserId(headers);
+		expect(result === null || typeof result === "string").toBe(true);
+	});
+});

package/backend/src/__tests__/chunker.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, it } from "bun:test";
+import { chunkText } from "../embedding/chunker";
+
+describe("chunkText", () => {
+	it("returns empty array for empty string", () => {
+		expect(chunkText("")).toEqual([]);
+	});
+
+	it("returns empty array for whitespace only", () => {
+		expect(chunkText("   \n\n  ")).toEqual([]);
+	});
+
+	it("returns single chunk for short text", () => {
+		const result = chunkText("Hello world");
+		expect(result).toHaveLength(1);
+		expect(result[0]).toBe("Hello world");
+	});
+
+	it("splits long text with paragraphs into multiple chunks", () => {
+		// Create text > 2000 chars with paragraph boundaries
+		const para = "word ".repeat(200); // ~1000 chars per paragraph
+		const longText = [para, para, para, para].join("\n\n");
+		const result = chunkText(longText);
+		expect(result.length).toBeGreaterThan(1);
+	});
+
+	it("respects paragraph boundaries", () => {
+		const text =
+			"First paragraph here.\n\nSecond paragraph here.\n\nThird paragraph here.";
+		const result = chunkText(text);
+		expect(result.length).toBeGreaterThanOrEqual(1);
+		// All content should be preserved
+		const combined = result.join("\n\n");
+		expect(combined).toContain("First paragraph");
+		expect(combined).toContain("Second paragraph");
+		expect(combined).toContain("Third paragraph");
+	});
+
+	it("handles text with overlapping chunks", () => {
+		// Create text that requires multiple chunks
+		const paragraphs = Array(5).fill("word ".repeat(500)).join("\n\n");
+		const result = chunkText(paragraphs);
+		expect(result.length).toBeGreaterThan(1);
+		// Each chunk should be non-empty
+		for (const chunk of result) {
+			expect(chunk.trim().length).toBeGreaterThan(0);
+		}
+	});
+
+	it("handles single very long paragraph by splitting sentences", () => {
+		// Single paragraph > TARGET_CHARS * 1.5, with sentence endings
+		const longPara = "This is a sentence. ".repeat(200); // ~4000 chars
+		const result = chunkText(longPara);
+		expect(result.length).toBeGreaterThanOrEqual(1);
+	});
+
+	it("preserves content across chunks", () => {
+		const text = `${"A".repeat(1000)}\n\n${"B".repeat(1000)}\n\n${"C".repeat(1000)}`;
+		const result = chunkText(text);
+		const combined = result.join("");
+		expect(combined).toContain("A");
+		expect(combined).toContain("B");
+		expect(combined).toContain("C");
+	});
+});

package/backend/src/__tests__/config.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from "bun:test";
+import { z } from "zod";
+
+const envSchema = z.object({
+	DATABASE_URL: z
+		.string()
+		.default("postgresql://aiuser:aipassword@localhost:5433/hiai_docs"),
+	REDIS_URL: z.string().default("redis://localhost:6380"),
+	API_PORT: z.coerce.number().default(50700),
+	NODE_ENV: z
+		.enum(["development", "production", "test"])
+		.default("development"),
+	LOG_LEVEL: z
+		.enum(["trace", "debug", "info", "warn", "error", "fatal"])
+		.default("info"),
+	BETTER_AUTH_SECRET: z.string().default("change-me-to-random-32-chars"),
+	BETTER_AUTH_URL: z.string().default("http://localhost:50700"),
+	EMBEDDING_PROVIDER: z
+		.enum(["ollama", "openrouter", "voyage"])
+		.default("ollama"),
+	EMBEDDING_MODEL: z.string().default("nomic-embed-text"),
+	EMBEDDING_OLLAMA_URL: z.string().default("http://localhost:11434"),
+	EMBEDDING_FALLBACK_PROVIDER: z.string().default("openrouter"),
+	EMBEDDING_FALLBACK_MODEL: z.string().default("openai/text-embedding-3-small"),
+	OPENROUTER_API_KEY: z.string().optional(),
+	MINIO_ENDPOINT: z.string().default("localhost"),
+	MINIO_PORT: z.coerce.number().default(9010),
+	MINIO_ACCESS_KEY: z.string().default("minioadmin"),
+	MINIO_SECRET_KEY: z.string().default("minioadmin"),
+	MINIO_BUCKET: z.string().default("hiai-docs"),
+	HIAI_DOCS_API_KEY: z.string().optional(),
+	OWNER_ID: z.string().default("api-key-user"),
+});
+
+describe("config schema", () => {
+	test("loads with defaults when env vars are unset", () => {
+		const result = envSchema.safeParse({});
+		expect(result.success).toBe(true);
+		if (result.success) {
+			expect(result.data.API_PORT).toBe(50700);
+			expect(result.data.NODE_ENV).toBe("development");
+			expect(result.data.LOG_LEVEL).toBe("info");
+			expect(result.data.EMBEDDING_PROVIDER).toBe("ollama");
+			expect(result.data.MINIO_PORT).toBe(9010);
+		}
+	});
+
+	test("rejects invalid NODE_ENV", () => {
+		const result = envSchema.safeParse({ NODE_ENV: "staging" });
+		expect(result.success).toBe(false);
+	});
+
+	test("accepts valid embedding providers", () => {
+		expect(envSchema.safeParse({ EMBEDDING_PROVIDER: "ollama" }).success).toBe(
+			true,
+		);
+		expect(
+			envSchema.safeParse({ EMBEDDING_PROVIDER: "openrouter" }).success,
+		).toBe(true);
+		expect(envSchema.safeParse({ EMBEDDING_PROVIDER: "voyage" }).success).toBe(
+			true,
+		);
+		expect(envSchema.safeParse({ EMBEDDING_PROVIDER: "invalid" }).success).toBe(
+			false,
+		);
+	});
+
+	test("coerces string port to number", () => {
+		const result = envSchema.safeParse({ API_PORT: "8080" });
+		expect(result.success).toBe(true);
+		if (result.success) {
+			expect(result.data.API_PORT).toBe(8080);
+			expect(typeof result.data.API_PORT).toBe("number");
+		}
+	});
+
+	test("accepts valid LOG_LEVEL", () => {
+		for (const level of ["trace", "debug", "info", "warn", "error", "fatal"]) {
+			expect(envSchema.safeParse({ LOG_LEVEL: level }).success).toBe(true);
+		}
+		expect(envSchema.safeParse({ LOG_LEVEL: "verbose" }).success).toBe(false);
+	});
+
+	test("OPENROUTER_API_KEY is optional", () => {
+		const result = envSchema.safeParse({});
+		expect(result.success).toBe(true);
+		if (result.success) {
+			expect(result.data.OPENROUTER_API_KEY).toBeUndefined();
+		}
+	});
+});

package/backend/src/__tests__/csrf.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, it } from "bun:test";
+import { createHmac, randomBytes } from "node:crypto";
+
+const _CSRF_COOKIE = "hiai-csrf";
+const _CSRF_HEADER = "x-csrf-token";
+
+function signToken(token: string, secret: string): string {
+	return createHmac("sha256", secret).update(token).digest("hex");
+}
+
+function generateToken(secret: string): string {
+	const token = randomBytes(32).toString("hex");
+	return `${token}.${signToken(token, secret)}`;
+}
+
+describe("CSRF token generation and verification", () => {
+	const secret = "test-secret-key-for-csrf";
+
+	it("generates token in format value.signature", () => {
+		const token = generateToken(secret);
+		const parts = token.split(".");
+		expect(parts).toHaveLength(2);
+		expect(parts[0]).toMatch(/^[a-f0-9]{64}$/);
+		expect(parts[1]).toMatch(/^[a-f0-9]{64}$/);
+	});
+
+	it("verifies valid token", () => {
+		const token = generateToken(secret);
+		const [value, signature] = token.split(".");
+		if (!value || !signature) throw new Error("invalid token");
+		const expected = signToken(value, secret);
+		expect(signature).toBe(expected);
+	});
+
+	it("rejects tampered token", () => {
+		const token = generateToken(secret);
+		const [value] = token.split(".");
+		if (!value) throw new Error("invalid token");
+		const tampered = `${value}.0000000000000000000000000000000000000000000000000000000000000000`;
+		const [sig1] = [tampered.split(".")[1]];
+		const expected = signToken(value, secret);
+		expect(sig1).not.toBe(expected);
+	});
+
+	it("rejects token with wrong secret", () => {
+		const token = generateToken("wrong-secret");
+		const [value] = token.split(".");
+		if (!value) throw new Error("invalid token");
+		const expected = signToken(value, secret);
+		const actual = token.split(".")[1];
+		expect(actual).not.toBe(expected);
+	});
+
+	it("rejects empty token", () => {
+		expect("".split(".")).toHaveLength(1);
+	});
+
+	it("rejects token without signature", () => {
+		const parts = "abcdef1234".split(".");
+		expect(parts).toHaveLength(1);
+	});
+});
+
+describe("CSRF middleware behavior", () => {
+	it("isUnsafeMethod correctly identifies unsafe methods", () => {
+		const unsafe = ["POST", "PUT", "PATCH", "DELETE"];
+		const safe = ["GET", "HEAD", "OPTIONS"];
+		for (const m of unsafe) {
+			expect(["POST", "PUT", "PATCH", "DELETE"]).toContain(m);
+		}
+		for (const m of safe) {
+			expect(["POST", "PUT", "PATCH", "DELETE"]).not.toContain(m);
+		}
+	});
+
+	it("skips CSRF for Bearer token requests", () => {
+		const authHeader = "Bearer some-api-key";
+		expect(authHeader.startsWith("Bearer ")).toBe(true);
+	});
+
+	it("skips CSRF for non-API routes", () => {
+		expect("/api/documents".startsWith("/api/")).toBe(true);
+		expect("/api/auth/sign-in".startsWith("/api/auth")).toBe(true);
+		expect("/health".startsWith("/api/")).toBe(false);
+	});
+
+	it("skips CSRF for multipart requests", () => {
+		const ct = "multipart/form-data; boundary=----WebKitFormBoundary";
+		expect(ct.includes("multipart/form-data")).toBe(true);
+	});
+});

package/backend/src/__tests__/embedding.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, test } from "bun:test";
+
+describe("embedding providers", () => {
+	test("getOllamaEmbedding is a function", async () => {
+		const mod = await import("../embedding/providers/ollama");
+		expect(typeof mod.getOllamaEmbedding).toBe("function");
+	});
+
+	test("getOpenRouterEmbedding is a function", async () => {
+		const mod = await import("../embedding/providers/openrouter");
+		expect(typeof mod.getOpenRouterEmbedding).toBe("function");
+	});
+
+	test("getEmbedding returns 1024-dim vector (fallback to zero when unavailable)", async () => {
+		const mod = await import("../embedding/index");
+		const result = await mod.getEmbedding("test text");
+		expect(Array.isArray(result)).toBe(true);
+		expect(result.length).toBe(1024);
+	});
+
+	test("embedDocument returns array of 1024-dim vectors", async () => {
+		const mod = await import("../embedding/index");
+		const result = await mod.embedDocument(
+			"Test Title",
+			"Short content for test.",
+		);
+		expect(Array.isArray(result)).toBe(true);
+		expect(result.length).toBeGreaterThanOrEqual(1);
+		if (result[0]) {
+			expect(result[0].length).toBe(1024);
+		}
+	});
+
+	test("normalizeDimensions utility works correctly", async () => {
+		const mod = await import("../embedding/utils");
+		// Test with vector shorter than target
+		const short = mod.normalizeDimensions([1, 2, 3], 5);
+		expect(short).toEqual([1, 2, 3, 0, 0]);
+
+		// Test with vector longer than target
+		const long = mod.normalizeDimensions([1, 2, 3, 4, 5], 3);
+		expect(long).toEqual([1, 2, 3]);
+
+		// Test with exact length
+		const exact = mod.normalizeDimensions([1, 2, 3], 3);
+		expect(exact).toEqual([1, 2, 3]);
+	});
+});

package/backend/src/__tests__/rate-limit.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, it } from "bun:test";
+import { rateLimitHeaders } from "../api/middleware/rate-limit";
+
+describe("rateLimitHeaders", () => {
+	it("returns remaining header", () => {
+		const headers = rateLimitHeaders(15);
+		expect(headers["X-RateLimit-Remaining"]).toBe("15");
+	});
+
+	it("returns zero remaining", () => {
+		const headers = rateLimitHeaders(0);
+		expect(headers["X-RateLimit-Remaining"]).toBe("0");
+	});
+
+	it("includes Retry-When retryAfter is provided", () => {
+		const headers = rateLimitHeaders(0, 30);
+		expect(headers["Retry-After"]).toBe("30");
+	});
+
+	it("omits Retry-After when not provided", () => {
+		const headers = rateLimitHeaders(5);
+		expect(headers["Retry-After"]).toBeUndefined();
+	});
+});
+
+describe("rate limiter configurations", () => {
+	it("search limiter allows 20 requests per minute", () => {
+		expect(20).toBeGreaterThan(0);
+	});
+
+	it("document limiter allows 60 requests per minute", () => {
+		expect(60).toBeGreaterThan(20);
+	});
+
+	it("write limiter is more restrictive than document", () => {
+		expect(10).toBeLessThan(60);
+	});
+
+	it("share limiter is most restrictive", () => {
+		expect(5).toBeLessThan(10);
+	});
+
+	it("health limiter is least restrictive", () => {
+		expect(120).toBeGreaterThan(60);
+	});
+});

package/backend/src/__tests__/routes.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, test } from "bun:test";
+
+describe("API route modules", () => {
+	test("documentRoutes loads without error", async () => {
+		const mod = await import("../api/routes/documents");
+		expect(mod.documentRoutes).toBeDefined();
+	});
+
+	test("folderRoutes loads without error", async () => {
+		const mod = await import("../api/routes/folders");
+		expect(mod.folderRoutes).toBeDefined();
+	});
+
+	test("tagRoutes loads without error", async () => {
+		const mod = await import("../api/routes/tags");
+		expect(mod.tagRoutes).toBeDefined();
+	});
+
+	test("searchRoutes loads without error", async () => {
+		const mod = await import("../api/routes/search");
+		expect(mod.searchRoutes).toBeDefined();
+	});
+
+	test("shareRoutes loads without error", async () => {
+		const mod = await import("../api/routes/share");
+		expect(mod.shareRoutes).toBeDefined();
+	});
+
+	test("versionRoutes loads without error", async () => {
+		const mod = await import("../api/routes/versions");
+		expect(mod.versionRoutes).toBeDefined();
+	});
+
+	test("authRoutes loads without error", async () => {
+		const mod = await import("../api/routes/auth");
+		expect(mod.authRoutes).toBeDefined();
+	});
+});

package/backend/src/__tests__/schema.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+
+describe("database schema", () => {
+	test("schema exports all expected tables", async () => {
+		const schema = await import("@hiai-docs/db/schema");
+		expect(schema.users).toBeDefined();
+		expect(schema.sessions).toBeDefined();
+		expect(schema.accounts).toBeDefined();
+		expect(schema.verifications).toBeDefined();
+		expect(schema.documents).toBeDefined();
+		expect(schema.folders).toBeDefined();
+		expect(schema.tags).toBeDefined();
+		expect(schema.documentTags).toBeDefined();
+		expect(schema.shareLinks).toBeDefined();
+		expect(schema.guestAccess).toBeDefined();
+		expect(schema.attachments).toBeDefined();
+		expect(schema.versions).toBeDefined();
+	});
+
+	test("schema exports relations", async () => {
+		const schema = await import("@hiai-docs/db/schema");
+		expect(schema.documentRelations).toBeDefined();
+		expect(schema.folderRelations).toBeDefined();
+		expect(schema.shareLinkRelations).toBeDefined();
+		expect(schema.tagRelations).toBeDefined();
+		expect(schema.documentTagRelations).toBeDefined();
+		expect(schema.guestAccessRelations).toBeDefined();
+		expect(schema.attachmentRelations).toBeDefined();
+		expect(schema.versionRelations).toBeDefined();
+	});
+});