@hot-updater/server 1.0.0-rc.18 → 1.0.0-rc.21

package/src/lintRules.spec.ts

@@ -1,76 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-import { afterAll, describe, expect, it } from "vitest";
-
-const root = path.resolve(import.meta.dirname, "../../..");
-const oxlint = path.join(root, "node_modules/.bin/oxlint");
-const dir = mkdtempSync(path.join(os.tmpdir(), "hot-updater-lint-"));
-
-afterAll(() => {
-  rmSync(dir, { recursive: true, force: true });
-});
-
-/**
- * The lines `hot-updater/no-filtered-find-many` reports on `source` under the
- * repo's oxlint config. oxlint lints only paths under its working directory,
- * so it runs from the scratch directory.
- */
-const reported = (file: string, source: string): number[] => {
-  writeFileSync(path.join(dir, file), source);
-  let output: string;
-  try {
-    output = execFileSync(
-      oxlint,
-      ["-c", path.join(root, ".oxlintrc.json"), "--format", "json", file],
-      { cwd: dir, encoding: "utf8" },
-    );
-  } catch (error) {
-    // oxlint exits 1 when it reports an error.
-    output = (error as { stdout: string }).stdout;
-  }
-  const { diagnostics } = JSON.parse(output) as {
-    diagnostics: {
-      code: string;
-      labels: { span: { line: number } }[];
-    }[];
-  };
-  return diagnostics
-    .filter(({ code }) => code === "hot-updater(no-filtered-find-many)")
-    .map(({ labels }) => labels[0]!.span.line);
-};
-
-const filtered = [
-  "export const a = async (db: any) =>",
-  '  (await db.findMany("t", {})).rows.filter((row: any) => row.ok);',
-  "export const b = async (db: any) => {",
-  '  const page = await db.findMany("t", {});',
-  "  return page.rows.find((row: any) => row.ok);",
-  "};",
-  "export const c = async (db: any) => {",
-  '  const { rows } = await db.findMany("t", {});',
-  "  return rows.filter(Boolean);",
-  "};",
-].join("\n");
-
-describe("hot-updater/no-filtered-find-many", () => {
-  it("reports findMany rows filtered in code", () => {
-    expect(reported("reads.ts", filtered)).toEqual([2, 5, 9]);
-  });
-
-  it("allows rows used whole, other arrays, and tests", () => {
-    expect(
-      reported(
-        "whole.ts",
-        [
-          "export const d = async (db: any) =>",
-          '  (await db.findMany("t", {})).rows.map((row: any) => row.id);',
-          "export const e = (items: number[]) => items.filter(Boolean);",
-        ].join("\n"),
-      ),
-    ).toEqual([]);
-    expect(reported("reads.spec.ts", filtered)).toEqual([]);
-  });
-});

package/src/node.spec.ts

@@ -1,119 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { toNodeHandler } from "./node";
-
-describe("server node entry", () => {
-  it("converts a Web Request handler to Node middleware", async () => {
-    const middleware = toNodeHandler(async (request: Request) =>
-      Response.json({
-        method: request.method,
-        pathname: new URL(request.url).pathname,
-      }),
-    );
-    const headers = new Map<string, string | string[]>();
-    const response = {
-      body: "",
-      statusCode: 0,
-      status(code: number) {
-        this.statusCode = code;
-        return this;
-      },
-      setHeader(name: string, value: string | string[]) {
-        headers.set(name, value);
-      },
-      send(body: Uint8Array) {
-        this.body = new TextDecoder().decode(body);
-      },
-      end() {},
-    };
-
-    await middleware(
-      {
-        method: "GET",
-        url: "/api/check",
-        headers: { host: "example.com" },
-        protocol: "https",
-        get: (name: string) => (name === "host" ? "example.com" : undefined),
-      },
-      response,
-    );
-
-    expect(response.statusCode).toBe(200);
-    expect(headers.get("content-type")).toContain("application/json");
-    expect(JSON.parse(response.body)).toEqual({
-      method: "GET",
-      pathname: "/api/check",
-    });
-  });
-
-  it("uses the mount-relative URL supplied by Express", async () => {
-    const middleware = toNodeHandler(async (request: Request) =>
-      Response.json({ pathname: new URL(request.url).pathname }),
-    );
-    const response = {
-      body: "",
-      statusCode: 0,
-      status(code: number) {
-        this.statusCode = code;
-        return this;
-      },
-      setHeader() {},
-      send(body: Uint8Array) {
-        this.body = new TextDecoder().decode(body);
-      },
-      end() {},
-    };
-
-    await middleware(
-      {
-        method: "GET",
-        url: "/channels",
-        headers: { host: "example.com" },
-        protocol: "https",
-        get: (name: string) => (name === "host" ? "example.com" : undefined),
-      },
-      response,
-    );
-
-    expect(JSON.parse(response.body)).toEqual({
-      pathname: "/channels",
-    });
-  });
-
-  it("preserves binary response bytes", async () => {
-    const bytes = new Uint8Array([0x50, 0x4b, 0x03, 0x04, 0xff, 0xfe, 0x00]);
-    const middleware = toNodeHandler(
-      async () =>
-        new Response(bytes, {
-          headers: { "content-type": "application/zip" },
-        }),
-    );
-    const response = {
-      body: new Uint8Array(),
-      statusCode: 0,
-      status(code: number) {
-        this.statusCode = code;
-        return this;
-      },
-      setHeader() {},
-      send(body: Uint8Array) {
-        this.body = new Uint8Array(body);
-      },
-      end() {},
-    };
-
-    await middleware(
-      {
-        method: "GET",
-        url: "/hot-updater/storage/token/signature",
-        headers: { host: "example.com" },
-        protocol: "https",
-        get: (name: string) => (name === "host" ? "example.com" : undefined),
-      },
-      response,
-    );
-
-    expect(response.statusCode).toBe(200);
-    expect([...response.body]).toEqual([...bytes]);
-  });
-});

package/src/node.ts

@@ -1,111 +0,0 @@
-/**
- * Node.js request/response types (compatible with Express, Connect, etc.)
- */
-interface NodeRequest {
-  method?: string;
-  url?: string;
-  headers: Record<string, string | string[] | undefined>;
-  body?: unknown;
-  protocol?: string;
-  get?(name: string): string | undefined;
-  [key: string]: unknown;
-}
-
-interface NodeResponse {
-  status(code: number): NodeResponse;
-  setHeader(name: string, value: string | string[]): void;
-  send(body: string | Uint8Array): void;
-  end(): void;
-  [key: string]: unknown;
-}
-
-export { HOT_UPDATER_SERVER_VERSION } from "./version";
-export { HOT_UPDATER_INFRASTRUCTURE_GENERATION } from "./handlerVersionRoutes";
-
-/**
- * Converts a Hot Updater handler to a Node.js-compatible middleware
- * Works with Express, Connect, and other frameworks using Node.js req/res
- *
- * @example
- * ```typescript
- * import { toNodeHandler } from "@hot-updater/server/node";
- * import express from "express";
- *
- * const app = express();
- *
- * app.use(
- *   "/hot-updater/admin",
- *   bearerMiddleware,
- *   express.json({ limit: "1mb" }),
- *   toNodeHandler(hotUpdater.handlers.admin),
- * );
- * app.use(
- *   "/hot-updater",
- *   express.json({ limit: "1mb" }),
- *   toNodeHandler(hotUpdater.handlers.client),
- * );
- * ```
- */
-export function toNodeHandler(
-  handler: HotUpdaterHandler,
-): (req: any, res: any, next?: any) => Promise<void> {
-  return async (req: NodeRequest, res: NodeResponse) => {
-    try {
-      // Build full URL
-      const protocol = req.protocol || "http";
-      const host = req.get?.("host") || "localhost";
-      const url = `${protocol}://${host}${req.url ?? "/"}`;
-
-      // Convert headers to Web Headers
-      const headers = new Headers();
-      for (const [key, value] of Object.entries(req.headers)) {
-        if (value) {
-          headers.set(key, Array.isArray(value) ? value.join(", ") : value);
-        }
-      }
-
-      // Handle request body
-      let body: string | undefined;
-      if (
-        req.method &&
-        req.method !== "GET" &&
-        req.method !== "HEAD" &&
-        req.body
-      ) {
-        // If body is already parsed (by express.json()), stringify it
-        body = JSON.stringify(req.body);
-      }
-
-      // Create Web Request
-      const webRequest = new globalThis.Request(url, {
-        method: req.method || "GET",
-        headers,
-        body,
-      });
-
-      const response = await handler(webRequest);
-
-      // Set status code
-      res.status(response.status);
-
-      // Set headers
-      response.headers.forEach((value, key) => {
-        res.setHeader(key, value);
-      });
-
-      // Send response body
-      const responseBody = Buffer.from(await response.arrayBuffer());
-      if (responseBody.length > 0) {
-        res.send(responseBody);
-      } else {
-        res.end();
-      }
-    } catch (error) {
-      // Handle errors gracefully
-      console.error("Hot Updater handler error:", error);
-      res.status(500);
-      res.send("Internal Server Error");
-    }
-  };
-}
-import type { HotUpdaterHandler } from "./handlerTypes";

package/src/plugins/api-keys/apiKeys.integration.spec.ts

@@ -1,92 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { createHotUpdater } from "../../index";
-import { createRuntimeDatabase } from "../../runtime.testFixtures";
-import { insights } from "../insights";
-import { API_KEY_HEADER_NAME, apiKeys } from "./index";
-
-const API_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
-const updateUrl =
-  "https://example.com/release-catalogs/app-version/ios/" +
-  "cHJvZHVjdGlvbg/1.0.0";
-
-const withApiKey = (url: string, init?: RequestInit) =>
-  new Request(url, {
-    ...init,
-    headers: {
-      ...Object.fromEntries(new Headers(init?.headers)),
-      [API_KEY_HEADER_NAME]: API_KEY,
-    },
-  });
-
-/** A server whose client routes the apiKeys() plugin protects, with one registered key. */
-const start = async () => {
-  const hotUpdater = createHotUpdater({
-    database: createRuntimeDatabase(),
-    plugins: [apiKeys(), insights()],
-  });
-  await hotUpdater.api.apiKeys.register({ apiKey: API_KEY, name: "App" });
-  return hotUpdater;
-};
-
-describe("createHotUpdater with the apiKeys() plugin", () => {
-  it("protects only client OTA and Insights write routes", async () => {
-    const hotUpdater = await start();
-
-    expect(
-      (await hotUpdater.handlers.client(new Request(updateUrl))).status,
-    ).toBe(401);
-    expect(
-      (await hotUpdater.handlers.client(withApiKey(updateUrl))).status,
-    ).toBe(404);
-    expect(
-      (
-        await hotUpdater.handlers.client(
-          new Request("https://example.com/version"),
-        )
-      ).status,
-    ).toBe(200);
-    expect(
-      (
-        await hotUpdater.handlers.admin(
-          new Request("https://example.com/events"),
-        )
-      ).status,
-    ).toBe(200);
-  });
-
-  it("authenticates before parsing Insights event bodies", async () => {
-    const hotUpdater = await start();
-    const invalidBody = {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: "not-json",
-    } satisfies RequestInit;
-
-    expect(
-      (
-        await hotUpdater.handlers.client(
-          new Request("https://example.com/events", invalidBody),
-        )
-      ).status,
-    ).toBe(401);
-    expect(
-      (
-        await hotUpdater.handlers.client(
-          withApiKey("https://example.com/events", invalidBody),
-        )
-      ).status,
-    ).toBe(400);
-  });
-
-  it('keeps client routes public with clientAccess: "public"', async () => {
-    const hotUpdater = createHotUpdater({
-      clientAccess: "public",
-      database: createRuntimeDatabase(),
-    });
-
-    expect(
-      (await hotUpdater.handlers.client(new Request(updateUrl))).status,
-    ).toBe(404);
-  });
-});

package/src/plugins/api-keys/apiKeys.spec.ts

@@ -1,166 +0,0 @@
-import { createMemoryAdapter } from "@hot-updater/plugin-core/internal";
-import { describe, expect, it } from "vitest";
-
-import { createDatabaseEngine } from "../../database/database";
-import { resolveSchema } from "../../database/resolveSchema";
-import {
-  API_KEY_HEADER_NAME,
-  authenticateApiKey,
-  createApiKey,
-  createApiKeyManagement,
-  hashApiKey,
-  normalizeApiKeyHeaderName,
-  provisionApiKey,
-  registerApiKey,
-} from "./apiKeys";
-import { apiKeysSchema, createApiKeyModel } from "./index";
-
-/** The api-keys plugin's table model on an empty in-memory database. */
-const createModel = () => {
-  const module = { id: "apiKeys", schema: apiKeysSchema } as const;
-  return createApiKeyModel(
-    createDatabaseEngine({
-      adapter: createMemoryAdapter(),
-      schema: resolveSchema([module]),
-    }).database(module),
-  );
-};
-
-const API_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
-
-describe("API keys", () => {
-  it("normalizes valid header names and rejects invalid names", () => {
-    expect(normalizeApiKeyHeaderName()).toBe("x-api-key");
-    expect(normalizeApiKeyHeaderName("X-Hot-Updater-Key")).toBe(
-      "x-hot-updater-key",
-    );
-    expect(() => normalizeApiKeyHeaderName("")).toThrow(
-      "apiKeys({ headerName }) must name a valid header.",
-    );
-    expect(() => normalizeApiKeyHeaderName("invalid header")).toThrow(
-      "apiKeys({ headerName }) must name a valid header.",
-    );
-  });
-
-  it("persists only the digest and metadata for a registered key", async () => {
-    const model = createModel();
-
-    const created = await registerApiKey({
-      apiKeys: model,
-      apiKey: API_KEY,
-      createdAtMs: 100,
-      name: " Production app ",
-    });
-
-    expect(created.apiKey).toBe(API_KEY);
-    expect(created.record).toEqual({
-      created_at_ms: 100,
-      id: expect.stringMatching(/^api-[A-Za-z0-9_-]{22}$/u),
-      name: "Production app",
-      prefix: "AQEBAQ",
-      revoked_at_ms: null,
-      role: "client",
-    });
-    expect(created.record).not.toHaveProperty("hash");
-    expect(created.record.id).not.toContain(await hashApiKey(API_KEY));
-    expect(await model.list()).toEqual([
-      expect.objectContaining({ hash: await hashApiKey(API_KEY) }),
-    ]);
-    expect(JSON.stringify(await model.list())).not.toContain(API_KEY);
-
-    const registeredAgain = await registerApiKey({
-      apiKeys: model,
-      apiKey: API_KEY,
-      createdAtMs: 200,
-      name: "Ignored replacement name",
-    });
-    expect(registeredAgain.record).toEqual(created.record);
-    expect(await model.list()).toHaveLength(1);
-  });
-
-  it("authenticates only active keys", async () => {
-    const model = createModel();
-    const { record } = await registerApiKey({
-      apiKeys: model,
-      apiKey: API_KEY,
-      name: "App",
-    });
-    const request = new Request("https://example.com", {
-      headers: { [API_KEY_HEADER_NAME]: API_KEY },
-    });
-
-    await expect(
-      authenticateApiKey({
-        apiKeys: model,
-        request,
-      }),
-    ).resolves.toBe(true);
-
-    await model.revoke({
-      id: record.id,
-      revokedAtMs: Date.now(),
-    });
-    await expect(
-      authenticateApiKey({
-        apiKeys: model,
-        request,
-      }),
-    ).resolves.toBe(false);
-  });
-
-  it("creates a canonical key and validates visible names", async () => {
-    const model = createModel();
-
-    const created = await createApiKey({
-      apiKeys: model,
-      name: "App",
-    });
-
-    expect(created.apiKey).toMatch(/^[A-Za-z0-9_-]{43}$/u);
-    expect(created.record.prefix).toBe(created.apiKey.slice(0, 6));
-    await expect(
-      registerApiKey({
-        apiKeys: model,
-        apiKey: API_KEY,
-        name: "   ",
-      }),
-    ).rejects.toThrow("1-64 visible characters");
-  });
-
-  it("provisions a new key once and reuses an existing managed key", async () => {
-    const model = createModel();
-
-    const created = await provisionApiKey({
-      apiKeys: model,
-      name: "Managed init",
-    });
-    const reused = await provisionApiKey({
-      apiKeys: model,
-      existingApiKey: created.apiKey,
-      name: "Managed init rerun",
-    });
-
-    expect(reused).toEqual(created);
-    expect(await model.list()).toHaveLength(1);
-  });
-
-  it("manages keys without exposing stored hashes", async () => {
-    const model = createModel();
-    const apiKeys = createApiKeyManagement({ apiKeys: model });
-
-    const created = await apiKeys.create({ name: "Production app" });
-    expect(created.apiKey).toMatch(/^[A-Za-z0-9_-]{43}$/u);
-    expect(created.record).not.toHaveProperty("hash");
-
-    const records = await apiKeys.list();
-    expect(records).toEqual([created.record]);
-    expect(records[0]).not.toHaveProperty("hash");
-
-    const revoked = await apiKeys.revoke({ id: created.record.id });
-    expect(revoked).toMatchObject({
-      id: created.record.id,
-      revoked_at_ms: expect.any(Number),
-    });
-    expect(revoked).not.toHaveProperty("hash");
-  });
-});