@hiyve/cli 1.0.17 → 1.0.19

package/src/utils/registryApi.test.js

@@ -0,0 +1,169 @@
+/**
+ * The CLI verifies keys and lists packages against the ONE registry npm
+ * installs from, through standard npm endpoints. These tests pin the
+ * behaviours that the live registry forced (verified 2026-09-01):
+ *
+ *  - /-/whoami answers 200 `{}` for a bad key, so validity is decided by a
+ *    gated packument fetch (200 vs 401), never by whoami.
+ *  - the catalogue comes from /-/v1/search, restricted to the @hiyve scope,
+ *    de-duplicated, sorted, and split into SDK vs component packages.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import {
+  maskApiKey,
+  verifyApiKey,
+  catalogueFromSearch,
+  fetchPackageCatalogue,
+} from './registryApi.js';
+
+const REGISTRY = 'https://registry.muziemedia.com/';
+const KEY = 'pk_live_0123456789abcdef0123456789abcdef01234567';
+
+function jsonResponse(status, body) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: () => Promise.resolve(body),
+  };
+}
+
+let fetchMock;
+beforeEach(() => {
+  fetchMock = vi.fn();
+  vi.stubGlobal('fetch', fetchMock);
+});
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('maskApiKey', () => {
+  it('keeps the prefix and last four characters only', () => {
+    expect(maskApiKey(KEY)).toBe('pk_live_...4567');
+  });
+  it('leaves a short value alone and tolerates non-strings', () => {
+    expect(maskApiKey('pk_short')).toBe('pk_short');
+    expect(maskApiKey(undefined)).toBe('');
+  });
+});
+
+describe('verifyApiKey', () => {
+  it('probes a gated packument on the registry with the key as a bearer token', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(200, { name: '@hiyve/cli' }));
+    await verifyApiKey(KEY);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(url).toBe(`${REGISTRY}@hiyve/cli`);
+    expect(init.headers.Authorization).toBe(`Bearer ${KEY}`);
+    expect(url).not.toContain('cloud.hiyve.io');
+    expect(url).not.toContain('/verify');
+  });
+
+  it('reports a masked key on success, never the raw one', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(200, {}));
+    const result = await verifyApiKey(KEY);
+    expect(result).toEqual({ ok: true, apiKey: 'pk_live_...4567' });
+    expect(JSON.stringify(result)).not.toContain(KEY);
+  });
+
+  it('treats 401 as an invalid key', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(401, {}));
+    const result = await verifyApiKey(KEY);
+    expect(result.ok).toBe(false);
+    expect(result.status).toBe(401);
+    expect(result.error).toBe('Invalid API key');
+  });
+
+  it('surfaces the registry error message when it sends one', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(403, { error: 'key revoked' }));
+    const result = await verifyApiKey(KEY);
+    expect(result).toEqual({ ok: false, status: 403, error: 'key revoked' });
+  });
+
+  it('does not misreport an outage as a bad key', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 502, json: () => Promise.reject(new Error('html')) });
+    const result = await verifyApiKey(KEY);
+    expect(result.ok).toBe(false);
+    expect(result.error).toBe('Registry returned HTTP 502');
+    expect(result.error).not.toMatch(/invalid/i);
+  });
+
+  it('lets network failures propagate for the caller to phrase', async () => {
+    const abort = Object.assign(new Error('aborted'), { name: 'AbortError' });
+    fetchMock.mockRejectedValue(abort);
+    await expect(verifyApiKey(KEY)).rejects.toBe(abort);
+  });
+});
+
+describe('catalogueFromSearch', () => {
+  const search = {
+    objects: [
+      { package: { name: '@hiyve/react-ui', version: '22.0.0' } },
+      { package: { name: '@hiyve/core', version: '7.0.0' } },
+      { package: { name: 'react', version: '19.0.0' } },          // not ours
+      { package: { name: '@hiyve/core', version: '7.0.0' } },     // duplicate
+      { package: { name: '@hiyve/whiteboard', version: '3.1.0' } },
+      { package: {} },                                            // malformed
+      {},
+    ],
+  };
+
+  it('keeps only @hiyve packages, de-duplicated and sorted', () => {
+    const cat = catalogueFromSearch(search);
+    const names = [...cat.sdk, ...cat.components].map((p) => p.name).sort();
+    expect(names).toEqual(['@hiyve/core', '@hiyve/react-ui', '@hiyve/whiteboard']);
+    expect(cat.total).toBe(3);
+  });
+
+  it('splits foundation packages from component packages', () => {
+    const cat = catalogueFromSearch(search);
+    expect(cat.sdk.map((p) => p.name)).toEqual(['@hiyve/core', '@hiyve/react-ui']);
+    expect(cat.components.map((p) => p.name)).toEqual(['@hiyve/whiteboard']);
+  });
+
+  it('carries the live version through', () => {
+    const cat = catalogueFromSearch(search);
+    expect(cat.sdk.find((p) => p.name === '@hiyve/core').version).toBe('7.0.0');
+  });
+
+  it("reads the version from Verdaccio's dist-tags.latest (its search has no `version`)", () => {
+    const cat = catalogueFromSearch({
+      objects: [{ package: { name: '@hiyve/admin', 'dist-tags': { latest: '2.3.0' } } }],
+    });
+    expect(cat.sdk).toEqual([{ name: '@hiyve/admin', version: '2.3.0' }]);
+  });
+
+  it('is empty, not broken, for a missing or empty result', () => {
+    expect(catalogueFromSearch(undefined)).toEqual({ total: 0, sdk: [], components: [] });
+    expect(catalogueFromSearch({})).toEqual({ total: 0, sdk: [], components: [] });
+  });
+});
+
+describe('fetchPackageCatalogue', () => {
+  it('searches the @hiyve scope on the registry, not the retired catalogue', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(200, { objects: [] }));
+    await fetchPackageCatalogue(KEY);
+    const [url] = fetchMock.mock.calls[0];
+    expect(url.startsWith(`${REGISTRY}-/v1/search?`)).toBe(true);
+    expect(url).toContain('text=%40hiyve');
+    expect(url).not.toContain('cloud.hiyve.io');
+    expect(url).not.toContain('/packages');
+  });
+
+  it('returns the catalogue shape the commands print', async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse(200, { objects: [{ package: { name: '@hiyve/rtc-client', version: '2.5.0' } }] }),
+    );
+    const result = await fetchPackageCatalogue(KEY);
+    expect(result).toEqual({
+      ok: true,
+      total: 1,
+      sdk: [{ name: '@hiyve/rtc-client', version: '2.5.0' }],
+      components: [],
+    });
+  });
+
+  it('reports a failed search without throwing', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(500, {}));
+    const result = await fetchPackageCatalogue(KEY);
+    expect(result).toEqual({ ok: false, status: 500, error: 'Registry returned HTTP 500' });
+  });
+});