@hot-updater/server 0.36.7 → 1.0.0-rc.1

package/src/adapters/prismaTestClient.ts

@@ -0,0 +1,396 @@
+import type {
+  BundleEventRow,
+  BundlePatchRow,
+  BundleRow,
+  ChannelRow,
+  ApiKeyRow,
+  ReleaseCatalogRow,
+  ReleaseRow,
+} from "@hot-updater/plugin-core";
+
+type Row =
+  | BundleEventRow
+  | BundlePatchRow
+  | BundleRow
+  | ChannelRow
+  | ApiKeyRow
+  | ReleaseRow
+  | ReleaseCatalogRow;
+type Table = Row[];
+type Tables = {
+  bundle_patches: Table;
+  bundles: Table;
+  bundle_events: Table;
+  channels: Table;
+  api_keys: Table;
+  releases: Table;
+  release_catalogs: Table;
+};
+
+type Hooks = {
+  beforeNextBundleUpdateMany: ((tables: Tables) => void) | undefined;
+  failNextBundleDelete: boolean;
+  transactionOptions: ({ readonly isolationLevel?: string } | undefined)[];
+};
+
+type QueryArgs = {
+  readonly orderBy?: unknown;
+  readonly skip?: number;
+  readonly take?: number;
+  readonly where?: unknown;
+};
+type CreateArgs = QueryArgs & { readonly data: Row };
+type UpdateArgs = QueryArgs & {
+  readonly data: Readonly<Record<string, unknown>>;
+};
+type UpsertArgs = QueryArgs & {
+  readonly create: Row;
+  readonly update: Partial<Row>;
+};
+
+class PrismaTestConstraintError extends Error {
+  readonly name = "PrismaTestConstraintError";
+}
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === "object" && value !== null;
+
+const compare = (left: unknown, right: unknown): number => {
+  if (typeof left === "number" && typeof right === "number") {
+    return left - right;
+  }
+  if (typeof left === "string" && typeof right === "string") {
+    return left.localeCompare(right);
+  }
+  return 0;
+};
+
+const normalize = (value: unknown, insensitive: boolean): unknown =>
+  insensitive && typeof value === "string" ? value.toLocaleLowerCase() : value;
+
+const readField = (row: Row, field: string): unknown =>
+  Object.entries(row).find(([key]) => key === field)?.[1];
+
+const rowKey = (row: Row): string => ("id" in row ? row.id : row.scope_key);
+
+const matchesCondition = (current: unknown, condition: unknown): boolean => {
+  if (!isRecord(condition)) return Object.is(current, condition);
+  const insensitive = condition["mode"] === "insensitive";
+  const value = normalize(current, insensitive);
+  if ("equals" in condition) {
+    return Object.is(value, normalize(condition["equals"], insensitive));
+  }
+  if ("not" in condition) {
+    return (
+      value !== null &&
+      value !== undefined &&
+      !Object.is(value, normalize(condition["not"], insensitive))
+    );
+  }
+  if (Array.isArray(condition["in"])) {
+    return condition["in"].some((item) => Object.is(value, item));
+  }
+  if (Array.isArray(condition["notIn"])) {
+    return (
+      condition["notIn"].length === 0 ||
+      (value !== null &&
+        value !== undefined &&
+        condition["notIn"].every((item) => !Object.is(value, item)))
+    );
+  }
+  if (value === null || value === undefined) return false;
+  if ("gt" in condition) return compare(value, condition["gt"]) > 0;
+  if ("gte" in condition) return compare(value, condition["gte"]) >= 0;
+  if ("lt" in condition) return compare(value, condition["lt"]) < 0;
+  if ("lte" in condition) return compare(value, condition["lte"]) <= 0;
+  if (typeof value !== "string") return false;
+  if (typeof condition["contains"] === "string") {
+    const target = normalize(condition["contains"], insensitive);
+    return typeof target === "string" && value.includes(target);
+  }
+  if (typeof condition["startsWith"] === "string") {
+    const target = normalize(condition["startsWith"], insensitive);
+    return typeof target === "string" && value.startsWith(target);
+  }
+  if (typeof condition["endsWith"] === "string") {
+    const target = normalize(condition["endsWith"], insensitive);
+    return typeof target === "string" && value.endsWith(target);
+  }
+  return false;
+};
+
+const matchesWhere = (row: Row, where: unknown): boolean => {
+  if (!isRecord(where)) return true;
+  const conjunction = where["AND"];
+  if (Array.isArray(conjunction)) {
+    return conjunction.every((item) => matchesWhere(row, item));
+  }
+  const disjunction = where["OR"];
+  if (Array.isArray(disjunction)) {
+    return disjunction.some((item) => matchesWhere(row, item));
+  }
+  return Object.entries(where).every(([field, condition]) =>
+    matchesCondition(readField(row, field), condition),
+  );
+};
+
+const sortRows = (rows: Row[], orderBy: unknown): Row[] => {
+  const clauses = Array.isArray(orderBy)
+    ? orderBy.filter(isRecord)
+    : isRecord(orderBy)
+      ? [orderBy]
+      : [];
+  if (clauses.length === 0) return rows;
+  return rows.toSorted((left, right) => {
+    for (const clause of clauses) {
+      const entry = Object.entries(clause)[0];
+      if (entry === undefined) continue;
+      const [field, direction] = entry;
+      const result = compare(readField(left, field), readField(right, field));
+      if (result !== 0) {
+        return direction === "desc" ? -result : result;
+      }
+    }
+    return 0;
+  });
+};
+
+const assertReferences = (
+  tables: Tables,
+  model: keyof Tables,
+  row: Row,
+): void => {
+  if (model === "bundle_patches" && "base_bundle_id" in row) {
+    const bundleIds = new Set(
+      tables.bundles.flatMap((bundle) => ("id" in bundle ? [bundle.id] : [])),
+    );
+    if (!bundleIds.has(row.bundle_id) || !bundleIds.has(row.base_bundle_id)) {
+      throw new PrismaTestConstraintError("missing patch reference");
+    }
+  }
+  if (model === "releases" && "kind" in row) {
+    if (
+      !tables.channels.some(
+        (channel) => "id" in channel && channel.id === row.channel_id,
+      ) ||
+      (row.bundle_id !== null &&
+        !tables.bundles.some(
+          (bundle) =>
+            "file_hash" in bundle &&
+            bundle.id === row.bundle_id &&
+            bundle.platform === row.platform,
+        ))
+    ) {
+      throw new PrismaTestConstraintError("missing Release reference");
+    }
+  }
+};
+
+const createDelegate = (tables: Tables, model: keyof Tables, hooks: Hooks) => ({
+  count: async (args?: QueryArgs): Promise<number> =>
+    tables[model].filter((row) => matchesWhere(row, args?.where)).length,
+  create: async ({ data }: CreateArgs): Promise<Row> => {
+    if (tables[model].some((row) => rowKey(row) === rowKey(data))) {
+      throw new PrismaTestConstraintError("duplicate id");
+    }
+    if (
+      model === "channels" &&
+      "name" in data &&
+      tables.channels.some((row) => "name" in row && row.name === data.name)
+    ) {
+      throw new PrismaTestConstraintError("duplicate channel name");
+    }
+    if (
+      model === "api_keys" &&
+      "hash" in data &&
+      tables.api_keys.some((row) => "hash" in row && row.hash === data.hash)
+    ) {
+      throw new PrismaTestConstraintError("duplicate hash");
+    }
+    assertReferences(tables, model, data);
+    tables[model].push(structuredClone(data));
+    return structuredClone(data);
+  },
+  deleteMany: async (args?: QueryArgs): Promise<void> => {
+    if (model === "bundles" && hooks.failNextBundleDelete) {
+      hooks.failNextBundleDelete = false;
+      throw new PrismaTestConstraintError("injected bundle delete failure");
+    }
+    const selected = tables[model].filter((row) =>
+      matchesWhere(row, args?.where),
+    );
+    if (model === "bundles") {
+      const ids = new Set(selected.map(rowKey));
+      if (
+        tables.releases.some(
+          (row) =>
+            "bundle_id" in row &&
+            row.bundle_id !== null &&
+            ids.has(row.bundle_id),
+        )
+      ) {
+        throw new PrismaTestConstraintError("referenced bundle");
+      }
+      tables.bundle_patches = tables.bundle_patches.filter(
+        (row) =>
+          !("base_bundle_id" in row) ||
+          (!ids.has(row.bundle_id) && !ids.has(row.base_bundle_id)),
+      );
+    }
+    tables[model] = tables[model].filter(
+      (row) => !matchesWhere(row, args?.where),
+    );
+  },
+  findFirst: async (args?: QueryArgs): Promise<Row | null> =>
+    structuredClone(
+      tables[model].find((row) => matchesWhere(row, args?.where)) ?? null,
+    ),
+  findMany: async (args?: QueryArgs): Promise<Row[]> => {
+    const filtered = tables[model].filter((row) =>
+      matchesWhere(row, args?.where),
+    );
+    const sorted = sortRows(filtered, args?.orderBy);
+    const start = args?.skip ?? 0;
+    const end = start + (args?.take ?? sorted.length);
+    return structuredClone(sorted.slice(start, end));
+  },
+  update: async ({ data, where }: UpdateArgs): Promise<Row> => {
+    const index = tables[model].findIndex((row) => matchesWhere(row, where));
+    const current = tables[model][index];
+    if (current === undefined) {
+      throw new PrismaTestConstraintError("missing update row");
+    }
+    const updated = { ...current, ...data } as Row;
+    assertReferences(tables, model, updated);
+    tables[model][index] = updated;
+    return structuredClone(updated);
+  },
+  updateMany: async ({
+    data,
+    where,
+  }: UpdateArgs): Promise<{ count: number }> => {
+    if (model === "bundles") {
+      const hook = hooks.beforeNextBundleUpdateMany;
+      hooks.beforeNextBundleUpdateMany = undefined;
+      hook?.(tables);
+    }
+    let count = 0;
+    tables[model] = tables[model].map((row) => {
+      if (!matchesWhere(row, where)) return row;
+      const updated = { ...row, ...data } as Row;
+      assertReferences(tables, model, updated);
+      count += 1;
+      return updated;
+    });
+    return { count };
+  },
+  upsert: async ({ create, update, where }: UpsertArgs): Promise<Row> => {
+    const index = tables[model].findIndex((row) => matchesWhere(row, where));
+    const current = tables[model][index];
+    if (current !== undefined) {
+      const updated = { ...current, ...update } as Row;
+      assertReferences(tables, model, updated);
+      tables[model][index] = updated;
+      return structuredClone(updated);
+    }
+    if (tables[model].some((row) => rowKey(row) === rowKey(create))) {
+      throw new PrismaTestConstraintError("duplicate id");
+    }
+    assertReferences(tables, model, create);
+    tables[model].push(structuredClone(create));
+    return structuredClone(create);
+  },
+});
+
+const createClient = (tables: Tables, hooks: Hooks) => ({
+  bundle_events: createDelegate(tables, "bundle_events", hooks),
+  bundle_patches: createDelegate(tables, "bundle_patches", hooks),
+  bundles: createDelegate(tables, "bundles", hooks),
+  channels: createDelegate(tables, "channels", hooks),
+  api_keys: createDelegate(tables, "api_keys", hooks),
+  releases: createDelegate(tables, "releases", hooks),
+  release_catalogs: createDelegate(tables, "release_catalogs", hooks),
+});
+
+export const createPrismaTestHarness = () => {
+  let tables: Tables = {
+    bundle_patches: [],
+    bundles: [],
+    bundle_events: [],
+    channels: [],
+    api_keys: [],
+    releases: [],
+    release_catalogs: [],
+  };
+  const hooks: Hooks = {
+    beforeNextBundleUpdateMany: undefined,
+    failNextBundleDelete: false,
+    transactionOptions: [],
+  };
+  let transactionQueue = Promise.resolve();
+  const client = {
+    ...createClient(tables, hooks),
+    $transaction: async <TResult>(
+      callback: (transaction: object) => Promise<TResult>,
+      options?: { readonly isolationLevel?: string },
+    ): Promise<TResult> => {
+      hooks.transactionOptions.push(options);
+      const previous = transactionQueue;
+      let release!: () => void;
+      transactionQueue = new Promise<void>((resolve) => {
+        release = resolve;
+      });
+      await previous;
+      try {
+        const transactionTables = structuredClone(tables);
+        const result = await callback(createClient(transactionTables, hooks));
+        tables.bundle_patches = transactionTables.bundle_patches;
+        tables.bundles = transactionTables.bundles;
+        tables.bundle_events = transactionTables.bundle_events;
+        tables.channels = transactionTables.channels;
+        tables.api_keys = transactionTables.api_keys;
+        tables.releases = transactionTables.releases;
+        tables.release_catalogs = transactionTables.release_catalogs;
+        return result;
+      } finally {
+        release();
+      }
+    },
+  };
+  return {
+    client,
+    clearTargetBeforeNextBundleUpdate: (
+      id: string,
+      field: "fingerprint_hash" | "target_app_version",
+    ): void => {
+      hooks.beforeNextBundleUpdateMany = (transactionTables) => {
+        for (const currentTables of new Set([tables, transactionTables])) {
+          const index = currentTables.bundles.findIndex(
+            (candidate) => "id" in candidate && candidate.id === id,
+          );
+          const row = currentTables.bundles[index];
+          if (row !== undefined && "target_app_version" in row) {
+            currentTables.bundles[index] = { ...row, [field]: null };
+          }
+        }
+      };
+    },
+    failNextBundleDelete: (): void => {
+      hooks.failNextBundleDelete = true;
+    },
+    getTransactionOptions: () => structuredClone(hooks.transactionOptions),
+    reset: (): void => {
+      hooks.failNextBundleDelete = false;
+      hooks.beforeNextBundleUpdateMany = undefined;
+      hooks.transactionOptions.length = 0;
+      transactionQueue = Promise.resolve();
+      tables.bundle_patches = [];
+      tables.bundles = [];
+      tables.bundle_events = [];
+      tables.channels = [];
+      tables.api_keys = [];
+      tables.releases = [];
+      tables.release_catalogs = [];
+    },
+  };
+};

package/src/apiKeys.integration.spec.ts

@@ -0,0 +1,192 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { createInMemoryDatabasePlugin } from "../../test-utils/test/inMemoryDatabasePlugin";
+import { registerApiKey } from "./apiKeys";
+import { API_KEY_HEADER_NAME, createHotUpdater } from "./index";
+
+const API_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
+const updateUrl =
+  "https://example.com/release-catalogs/app-version/ios/" +
+  "cHJvZHVjdGlvbg/1.0.0";
+
+const withApiKey = (url: string, init?: RequestInit) =>
+  new Request(url, {
+    ...init,
+    headers: {
+      ...Object.fromEntries(new Headers(init?.headers)),
+      [API_KEY_HEADER_NAME]: API_KEY,
+    },
+  });
+
+describe("createHotUpdater API keys", () => {
+  it("rejects an invalid API key header name", () => {
+    expect(() =>
+      createHotUpdater({
+        clientAccess: {
+          headerName: "invalid header",
+          type: "api-key",
+        },
+        database: createInMemoryDatabasePlugin(),
+      }),
+    ).toThrow("clientAccess.headerName must be a valid header name.");
+  });
+
+  it("protects only client OTA and Insights write routes", async () => {
+    const database = createInMemoryDatabasePlugin();
+    await registerApiKey({
+      apiKeys: database.models.apiKeys,
+      apiKey: API_KEY,
+      name: "App",
+    });
+    const hotUpdater = createHotUpdater({
+      clientAccess: { type: "api-key" },
+      database,
+    });
+
+    expect(
+      (await hotUpdater.handlers.client(new Request(updateUrl))).status,
+    ).toBe(401);
+    expect(
+      (await hotUpdater.handlers.client(withApiKey(updateUrl))).status,
+    ).toBe(404);
+    expect(
+      (
+        await hotUpdater.handlers.client(
+          new Request("https://example.com/version"),
+        )
+      ).status,
+    ).toBe(200);
+    expect(
+      (
+        await hotUpdater.handlers.admin(
+          withApiKey("https://example.com/installations/overview"),
+        )
+      ).status,
+    ).toBe(200);
+  });
+
+  it("creates, lists, and revokes API keys without exposing hashes", async () => {
+    const hotUpdater = createHotUpdater({
+      clientAccess: { type: "public" },
+      database: createInMemoryDatabasePlugin(),
+    });
+
+    const created = await hotUpdater.apiKeys.create({ name: "Production" });
+    expect(created.apiKey).toMatch(/^[A-Za-z0-9_-]{43}$/u);
+    expect(created.record).not.toHaveProperty("hash");
+
+    await expect(hotUpdater.apiKeys.list()).resolves.toEqual([created.record]);
+    const revoked = await hotUpdater.apiKeys.revoke({
+      id: created.record.id,
+    });
+    expect(revoked).toMatchObject({
+      id: created.record.id,
+      revoked_at_ms: expect.any(Number),
+    });
+    expect(revoked).not.toHaveProperty("hash");
+  });
+
+  it("authenticates before parsing Insights event bodies", async () => {
+    const database = createInMemoryDatabasePlugin();
+    await registerApiKey({
+      apiKeys: database.models.apiKeys,
+      apiKey: API_KEY,
+      name: "App",
+    });
+    const hotUpdater = createHotUpdater({
+      clientAccess: { type: "api-key" },
+      database,
+    });
+    const invalidBody = {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "not-json",
+    } satisfies RequestInit;
+
+    expect(
+      (
+        await hotUpdater.handlers.client(
+          new Request("https://example.com/events", invalidBody),
+        )
+      ).status,
+    ).toBe(401);
+    expect(
+      (
+        await hotUpdater.handlers.client(
+          withApiKey("https://example.com/events", invalidBody),
+        )
+      ).status,
+    ).toBe(400);
+  });
+
+  it("returns 503 when credential storage is unavailable", async () => {
+    const database = createInMemoryDatabasePlugin();
+    vi.spyOn(database.models.apiKeys, "findByHash").mockRejectedValue(
+      new Error("database offline"),
+    );
+    const hotUpdater = createHotUpdater({
+      clientAccess: { type: "api-key" },
+      database,
+    });
+
+    const response = await hotUpdater.handlers.client(withApiKey(updateUrl));
+
+    expect(response.status).toBe(503);
+    await expect(response.json()).resolves.toEqual({
+      error: "Service unavailable",
+    });
+  });
+
+  it("keeps client routes public with the public access policy", async () => {
+    const hotUpdater = createHotUpdater({
+      clientAccess: { type: "public" },
+      database: createInMemoryDatabasePlugin(),
+    });
+
+    expect(
+      (await hotUpdater.handlers.client(new Request(updateUrl))).status,
+    ).toBe(404);
+  });
+
+  it("reads API keys only from the configured header", async () => {
+    const database = createInMemoryDatabasePlugin();
+    await registerApiKey({
+      apiKeys: database.models.apiKeys,
+      apiKey: API_KEY,
+      name: "App",
+    });
+    const hotUpdater = createHotUpdater({
+      clientAccess: {
+        headerName: "X-Hot-Updater-Key",
+        type: "api-key",
+      },
+      database,
+    });
+    const invalidBody = {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: "not-json",
+    } satisfies RequestInit;
+
+    expect(
+      (
+        await hotUpdater.handlers.client(
+          withApiKey("https://example.com/events", invalidBody),
+        )
+      ).status,
+    ).toBe(401);
+    expect(
+      (
+        await hotUpdater.handlers.client(
+          new Request("https://example.com/events", {
+            ...invalidBody,
+            headers: {
+              ...invalidBody.headers,
+              "x-hot-updater-key": API_KEY,
+            },
+          }),
+        )
+      ).status,
+    ).toBe(400);
+  });
+});