@hilbras/keystone 1.6.0 → 1.9.0

package/src/tests/setup/configWriter.test.ts

@@ -1,69 +0,0 @@
-import { describe, it } from "node:test";
-import assert from "node:assert";
-import fs from "node:fs/promises";
-import path from "node:path";
-import os from "node:os";
-import { EnvFileConfigWriter, JsonConfigWriter } from "../../services/setup/configWriter.js";
-
-describe("EnvFileConfigWriter", () => {
-  it("writes and reads values", async () => {
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "keystone-env-"));
-    const file = path.join(dir, ".env");
-    const writer = new EnvFileConfigWriter(file);
-
-    const result = await writer.write({ DATABASE_URL: "postgres://localhost/db", REDIS_URL: "redis://localhost" });
-    assert.strictEqual(result.success, true);
-
-    const values = await writer.read();
-    assert.strictEqual(values.DATABASE_URL, "postgres://localhost/db");
-    assert.strictEqual(values.REDIS_URL, "redis://localhost");
-
-    await fs.rm(dir, { recursive: true, force: true });
-  });
-
-  it("preserves existing comments and ordering", async () => {
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "keystone-env-"));
-    const file = path.join(dir, ".env");
-    await fs.writeFile(file, "# Database\nDATABASE_URL=old\n\n# Redis\nREDIS_URL=old\n");
-
-    const writer = new EnvFileConfigWriter(file);
-    await writer.write({ DATABASE_URL: "new" });
-
-    const content = await fs.readFile(file, "utf-8");
-    assert.ok(content.includes("# Database"));
-    assert.ok(content.includes("# Redis"));
-    assert.ok(content.includes("DATABASE_URL=new"));
-    assert.ok(content.includes("REDIS_URL=old"));
-
-    await fs.rm(dir, { recursive: true, force: true });
-  });
-
-  it("creates backups", async () => {
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "keystone-env-"));
-    const file = path.join(dir, ".env");
-    await fs.writeFile(file, "DATABASE_URL=old\n");
-
-    const writer = new EnvFileConfigWriter(file);
-    const backup = await writer.backup();
-    assert.strictEqual(backup.success, true);
-    assert.ok(backup.data);
-
-    await fs.rm(dir, { recursive: true, force: true });
-  });
-});
-
-describe("JsonConfigWriter", () => {
-  it("writes and reads values", async () => {
-    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "keystone-json-"));
-    const file = path.join(dir, "config.json");
-    const writer = new JsonConfigWriter(file);
-
-    const result = await writer.write({ DATABASE_URL: "postgres://localhost/db" });
-    assert.strictEqual(result.success, true);
-
-    const values = await writer.read();
-    assert.strictEqual(values.DATABASE_URL, "postgres://localhost/db");
-
-    await fs.rm(dir, { recursive: true, force: true });
-  });
-});

package/src/tests/setup/validation.test.ts

@@ -1,29 +0,0 @@
-import { describe, it } from "node:test";
-import assert from "node:assert";
-import { validateDatabase, validateRedis } from "../../services/setup/validation.js";
-
-describe("setup validation", () => {
-  it("rejects missing database URL", async () => {
-    const result = await validateDatabase({ databaseUrl: "" });
-    assert.strictEqual(result.success, false);
-    assert.strictEqual(result.error?.code, "MISSING_DATABASE_URL");
-  });
-
-  it("fails for unreachable database", async () => {
-    const result = await validateDatabase({ databaseUrl: "postgresql://invalid:5432/db" });
-    assert.strictEqual(result.success, false);
-    assert.strictEqual(result.error?.code, "DATABASE_VALIDATION_FAILED");
-  });
-
-  it("rejects missing redis URL", async () => {
-    const result = await validateRedis({ redisUrl: "" });
-    assert.strictEqual(result.success, false);
-    assert.strictEqual(result.error?.code, "MISSING_REDIS_URL");
-  });
-
-  it("fails for unreachable redis", async () => {
-    const result = await validateRedis({ redisUrl: "redis://invalid:6379" });
-    assert.strictEqual(result.success, false);
-    assert.strictEqual(result.error?.code, "REDIS_VALIDATION_FAILED");
-  });
-});

package/src/tests/smoke.test.ts

@@ -1,136 +0,0 @@
-import { describe, it, before, after } from "node:test";
-import assert from "node:assert";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-process.env.DATABASE_URL = process.env.DATABASE_URL || "postgresql://hilbras:hilbras@localhost:5432/hilbras";
-process.env.ZITADEL_DOMAIN = process.env.ZITADEL_DOMAIN || "http://localhost:8080";
-process.env.ZITADEL_CLIENT_ID = process.env.ZITADEL_CLIENT_ID || "test-client";
-process.env.ZITADEL_CLIENT_SECRET = process.env.ZITADEL_CLIENT_SECRET || "test-secret";
-
-// Generate an ephemeral JWT key pair so JWKS and auth tests don't need the secrets table.
-const { generateKeyPair, exportPKCS8, exportSPKI } = await import("jose");
-const jwtPair = await generateKeyPair("RS256", { extractable: true });
-process.env.JWT_PRIVATE_KEY = await exportPKCS8(jwtPair.privateKey);
-process.env.JWT_PUBLIC_KEY = await exportSPKI(jwtPair.publicKey);
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-let dbAvailable = false;
-
-before(async () => {
-  try {
-    const { migrate } = await import("drizzle-orm/postgres-js/migrator");
-    const { db } = await import("../db/index.js");
-    await migrate(db, { migrationsFolder: path.resolve(__dirname, "../db/migrations") });
-    dbAvailable = true;
-  } catch (err) {
-    console.warn("Postgres not available; skipping DB-dependent smoke tests:", (err as Error).message);
-  }
-});
-
-const { buildApp } = await import("../index.js");
-
-// The postgres pool (db/index.ts) and the shared lazy ioredis client
-// (services/redis.ts, used by the global rate limiter on every request) are
-// process-wide singletons that app.close() does not release. Without this,
-// open sockets keep the node:test process alive after all tests finish.
-after(async () => {
-  const { closeDb } = await import("../db/index.js");
-  const { redis } = await import("../services/redis.js");
-  await closeDb().catch(() => {});
-  try {
-    if (redis.status !== "end") await redis.quit();
-  } catch {
-    redis.disconnect();
-  }
-});
-
-describe("Hilbras Keystone smoke test", () => {
-  it("boots and responds to /health", async () => {
-    const app = await buildApp();
-    const res = await app.inject({ method: "GET", url: "/health" });
-    assert.strictEqual(res.statusCode, 200);
-    const body = JSON.parse(res.body);
-    assert.strictEqual(body.status, "ok");
-    await app.close();
-  });
-
-  it("serves OIDC discovery document", async () => {
-    const app = await buildApp();
-    const res = await app.inject({ method: "GET", url: "/.well-known/openid-configuration" });
-    assert.strictEqual(res.statusCode, 200);
-    const body = JSON.parse(res.body);
-    assert.strictEqual(body.response_types_supported[0], "code");
-    assert.ok(body.token_endpoint_auth_methods_supported.includes("client_secret_basic"));
-    await app.close();
-  });
-
-  it("serves JWKS", async () => {
-    const app = await buildApp();
-    const res = await app.inject({ method: "GET", url: "/.well-known/jwks.json" });
-    assert.strictEqual(res.statusCode, 200);
-    const body = JSON.parse(res.body);
-    assert.ok(Array.isArray(body.keys));
-    await app.close();
-  });
-
-  it("serves Prometheus metrics", async () => {
-    const app = await buildApp();
-    const res = await app.inject({ method: "GET", url: "/metrics" });
-    assert.strictEqual(res.statusCode, 200);
-    assert.ok(res.body.includes("keystone_http_requests_total"));
-    await app.close();
-  });
-
-  it("requires authentication for /v1/authz/check", async () => {
-    const app = await buildApp();
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/authz/check",
-      payload: { resource: "application", action: "read" },
-    });
-    assert.strictEqual(res.statusCode, 401);
-    await app.close();
-  });
-
-  it("lists federation providers", async () => {
-    const app = await buildApp();
-    const res = await app.inject({ method: "GET", url: "/federation/providers" });
-    assert.strictEqual(res.statusCode, 200);
-    const body = JSON.parse(res.body);
-    assert.ok(Array.isArray(body.providers));
-    assert.ok(body.providers.some((p: { type: string }) => p.type === "google"));
-    await app.close();
-  });
-
-  it("exposes admin permissions endpoint", async () => {
-    const app = await buildApp();
-    const res = await app.inject({ method: "GET", url: "/v1/admin/permissions" });
-    assert.strictEqual(res.statusCode, 401);
-    await app.close();
-  });
-
-  (dbAvailable ? it : it.skip)("registers and logs in a local password user without Zitadel", async () => {
-    const app = await buildApp();
-    const email = `smoke-${Date.now()}@example.com`;
-    const registerRes = await app.inject({
-      method: "POST",
-      url: "/auth/register",
-      payload: { username: `smoke${Date.now()}`, email, password: "SmokeTest123!" },
-    });
-    assert.strictEqual(registerRes.statusCode, 200);
-    const registerBody = JSON.parse(registerRes.body);
-    assert.strictEqual(registerBody.user.email, email);
-
-    const loginRes = await app.inject({
-      method: "POST",
-      url: "/auth/login",
-      payload: { email, password: "SmokeTest123!" },
-    });
-    assert.strictEqual(loginRes.statusCode, 200);
-    const loginBody = JSON.parse(loginRes.body);
-    assert.strictEqual(loginBody.user.email, email);
-    await app.close();
-  });
-});

package/src/types.ts

@@ -1,70 +0,0 @@
-import type { User, Application, Organization, OrgMembership } from "./db/schema.js";
-import type { KeystonePlugin } from "./services/plugins/types.js";
-import type { Container } from "./container.js";
-
-declare module "fastify" {
-  interface FastifyRequest {
-    user?: User;
-    state: {
-      app?: Application;
-      org?: Organization;
-      membership?: OrgMembership;
-    };
-  }
-
-  interface FastifyInstance {
-    registerPlugin(plugin: KeystonePlugin): void;
-    container: Container;
-  }
-}
-
-export interface AuthCookiePayload {
-  accessToken: string;
-  refreshToken: string;
-}
-
-export interface TokenClaims {
-  sub: string;
-  email?: string;
-  username?: string;
-  name?: string;
-  plan?: string;
-  role?: string;
-  provider?: string;
-  org_id?: string;
-  app_id?: string;
-  client_id?: string;
-  device_fingerprint?: string;
-}
-
-export interface PublicUser {
-  id: string;
-  email: string;
-  username: string;
-  name: string | null;
-  avatarUrl: string | null;
-  emailVerified: boolean;
-  phoneNumber?: string | null;
-  phoneVerified?: boolean;
-  plan: string;
-  role: string;
-  provider: string;
-  metadata: Record<string, unknown>;
-}
-
-export function toPublicUser(user: User): PublicUser {
-  return {
-    id: user.id,
-    email: user.email,
-    username: user.username,
-    name: user.name,
-    avatarUrl: user.avatarUrl,
-    emailVerified: user.emailVerified,
-    phoneNumber: user.phoneNumber,
-    phoneVerified: user.phoneVerified,
-    plan: user.plan,
-    role: user.role,
-    provider: user.provider,
-    metadata: (user.metadata ?? {}) as Record<string, unknown>,
-  };
-}