@jant/core 0.6.16 → 0.7.1

package/src/middleware/__tests__/auth.test.ts

@@ -36,13 +36,18 @@ function createTestHonoApp() {
 function createMockAuth(authenticated: boolean) {
   return {
     api: {
-      getSession: async () =>
-        authenticated
+      // `attachSession` reads with `returnHeaders: true` so it can write
+      // better-auth's refreshed cookies back onto the response, which puts the
+      // result in better-call's `{ headers, response }` shape.
+      getSession: async () => ({
+        headers: new Headers(),
+        response: authenticated
           ? {
               user: { id: "user-1", email: "test@test.com", name: "Test" },
               session: { id: "session-1" },
             }
           : null,
+      }),
     },
   } as AppVariables["auth"];
 }
@@ -200,9 +205,72 @@ describe("requireAuth", () => {
     expect(res.status).toBe(302);
     expect(res.headers.get("Location")).toBe("/login");
   });
+
+  it("surfaces a route handler's error instead of bouncing to signin", async () => {
+    const app = createTestHonoApp();
+    app.use("*", async (c, next) => {
+      c.set("auth", createMockAuth(true));
+      c.set("services", {
+        siteMembers: createMockSiteMembers(),
+      } as AppVariables["services"]);
+      await next();
+    });
+    app.use("*", attachSession());
+    app.get("/settings", requireAuth(), () => {
+      throw new Error("saving the post blew up");
+    });
+
+    // Rewriting this into a redirect reads to the author as being randomly
+    // signed out, and throws away whatever they were editing.
+    const res = await app.request("/settings", { redirect: "manual" });
+    expect(res.status).toBe(500);
+  });
+
+  it("surfaces a failed membership lookup instead of bouncing to signin", async () => {
+    const app = createTestHonoApp();
+    app.use("*", async (c, next) => {
+      c.set("auth", createMockAuth(true));
+      c.set("services", {
+        siteMembers: {
+          ...createMockSiteMembers(),
+          get: vi.fn(async () => {
+            throw new Error("database unavailable");
+          }),
+        },
+      } as unknown as AppVariables["services"]);
+      await next();
+    });
+    app.use("*", attachSession());
+    app.get("/settings", requireAuth(), (c) => c.text("Settings"));
+
+    // `siteMembers.get` resolves to `null` for "not a member", so a throw is
+    // always infrastructure — never a reason to claim the user is signed out.
+    const res = await app.request("/settings", { redirect: "manual" });
+    expect(res.status).toBe(500);
+  });
 });
 
 describe("requireAuthApi", () => {
+  it("surfaces a route handler's error instead of answering 401", async () => {
+    const app = createTestHonoApp();
+    app.use("*", async (c, next) => {
+      c.set("auth", createMockAuth(true));
+      c.set("services", {
+        siteMembers: createMockSiteMembers(),
+      } as AppVariables["services"]);
+      await next();
+    });
+    app.use("*", attachSession());
+    app.get("/api/data", requireAuthApi(), () => {
+      throw new Error("upstream failed");
+    });
+
+    // A 401 here would tell the client the login expired and send the author
+    // back to sign-in over what is really a server-side failure.
+    const res = await app.request("/api/data");
+    expect(res.status).toBe(500);
+  });
+
   it("allows authenticated requests via session", async () => {
     const app = createTestHonoApp();
     app.onError(errorHandler);

package/src/middleware/__tests__/cache-control.test.ts

@@ -2,12 +2,18 @@ import { describe, expect, it } from "vitest";
 import { Hono } from "hono";
 import type { Bindings } from "../../types.js";
 import type { AppVariables } from "../../types/app-context.js";
-import { defaultCacheControl } from "../cache-control.js";
+import { defaultCacheControl, noStore } from "../cache-control.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
-function buildApp(): Hono<Env> {
+function buildApp(isAuthenticated = false): Hono<Env> {
   const app = new Hono<Env>();
+  // Stands in for `attachSession()`, which runs before this middleware and is
+  // what puts `isAuthenticated` on the context.
+  app.use("*", async (c, next) => {
+    c.set("isAuthenticated", isAuthenticated);
+    await next();
+  });
   app.use("*", defaultCacheControl());
 
   // Un-annotated dynamic page — the common case.
@@ -27,11 +33,31 @@ function buildApp(): Hono<Env> {
 }
 
 describe("defaultCacheControl", () => {
-  it("defaults un-annotated responses to private, no-store", async () => {
+  it("lets an anonymous page stay in the browser's back/forward cache", async () => {
+    // `no-store` would disable it, making the back button re-request and
+    // re-render a page that is the same for everyone anyway. `private` is
+    // what keeps shared caches out, and it is still here.
     const response = await buildApp().request("/");
+    expect(response.headers.get("Cache-Control")).toBe("private, no-cache");
+  });
+
+  it("keeps a signed-in page out of every cache", async () => {
+    // The back/forward cache restores a snapshot without asking the server,
+    // so an authenticated view would survive signing out.
+    const response = await buildApp(true).request("/");
     expect(response.headers.get("Cache-Control")).toBe("private, no-store");
   });
 
+  it("never allows a shared cache to store a dynamic page", async () => {
+    for (const authed of [false, true]) {
+      const value =
+        (await buildApp(authed).request("/")).headers.get("Cache-Control") ??
+        "";
+      expect(value).toContain("private");
+      expect(value).not.toContain("public");
+    }
+  });
+
   it("leaves an explicit public cache policy untouched", async () => {
     const response = await buildApp().request("/feed");
     expect(response.headers.get("Cache-Control")).toBe("public, max-age=180");
@@ -45,6 +71,48 @@ describe("defaultCacheControl", () => {
   it("defaults not-found responses too", async () => {
     const response = await buildApp().request("/missing");
     expect(response.status).toBe(404);
+    expect(response.headers.get("Cache-Control")).toBe("private, no-cache");
+  });
+});
+
+describe("noStore", () => {
+  function buildCredentialApp(): Hono<Env> {
+    const app = new Hono<Env>();
+    app.use("*", async (c, next) => {
+      c.set("isAuthenticated", false);
+      await next();
+    });
+    app.use("*", defaultCacheControl());
+    // Mounted exactly as `app.tsx` does: after the default, before the route.
+    app.use("/reset", noStore());
+    app.use("/api/auth/*", noStore());
+
+    app.get("/reset", (c) => c.html("<form/>"));
+    // A terminal handler that never calls next(), like better-auth's.
+    app.all("/api/auth/*", (c) => c.json({ ok: true }));
+    app.get("/", (c) => c.html("<h1>home</h1>"));
+
+    return app;
+  }
+
+  it("keeps an anonymous credential page out of the browser's disk cache", async () => {
+    // The reset URL carries a one-time token, so the anonymous `no-cache`
+    // default — which lets the browser keep the page — is the wrong answer.
+    const response = await buildCredentialApp().request("/reset");
+    expect(response.headers.get("Cache-Control")).toBe("private, no-store");
+  });
+
+  it("still reaches a terminal handler that never calls next()", async () => {
+    // better-auth's `/api/auth/*` handler returns without yielding, so the
+    // middleware only runs if it was registered first.
+    const response = await buildCredentialApp().request(
+      "/api/auth/get-session",
+    );
     expect(response.headers.get("Cache-Control")).toBe("private, no-store");
   });
+
+  it("leaves every other anonymous page on the default", async () => {
+    const response = await buildCredentialApp().request("/");
+    expect(response.headers.get("Cache-Control")).toBe("private, no-cache");
+  });
 });

package/src/middleware/__tests__/onboarding.test.ts

@@ -4,28 +4,42 @@ import { requireOnboarding, resetOnboardingCache } from "../onboarding.js";
 import type { Bindings } from "../../types.js";
 import type { AppVariables } from "../../types/app-context.js";
 import { DEFAULT_TEST_SITE_ID } from "../../__tests__/helpers/db.js";
+import {
+  ONBOARDING_STATUS,
+  type OnboardingStatus,
+} from "../../lib/constants.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
-function createMockServices(complete: boolean) {
+function createMockServices(status: OnboardingStatus) {
   let callCount = 0;
   const services = {
     settings: {
-      isOnboardingComplete: async () => {
+      getOnboardingStatus: async () => {
         callCount++;
-        return complete;
+        return status;
       },
     },
   } as AppVariables["services"];
   return { services, getCallCount: () => callCount };
 }
 
-function createApp(complete: boolean) {
-  const mock = createMockServices(complete);
+function createApp(
+  status: OnboardingStatus | boolean,
+  options?: { authenticated?: boolean },
+) {
+  const resolved: OnboardingStatus =
+    typeof status === "boolean"
+      ? status
+        ? ONBOARDING_STATUS.COMPLETED
+        : ONBOARDING_STATUS.PENDING
+      : status;
+  const mock = createMockServices(resolved);
   const app = new Hono<Env>();
 
   app.use("*", async (c, next) => {
     c.set("services", mock.services);
+    c.set("isAuthenticated", options?.authenticated ?? false);
     c.set("currentSite", {
       id: DEFAULT_TEST_SITE_ID,
       key: "default",
@@ -55,6 +69,7 @@ function createApp(complete: boolean) {
   app.get("/robots.txt", (c) => c.text("robots"));
   app.get("/sitemap.xml", (c) => c.text("sitemap"));
   app.get("/media/abc.jpg", (c) => c.text("image"));
+  app.get("/compose", (c) => c.text("Compose"));
 
   return { app, getCallCount: mock.getCallCount };
 }
@@ -130,6 +145,62 @@ describe("requireOnboarding", () => {
     expect(getCallCount()).toBe(2); // queried again
   });
 
+  // A control plane already built the site and its owner, so readers must be
+  // served normally; only the author still owes setup an answer.
+  describe("provisioned sites", () => {
+    const provisioned = ONBOARDING_STATUS.PROVISIONED;
+
+    it("serves the public root to a signed-out visitor", async () => {
+      const { app } = createApp(provisioned);
+      const res = await app.request("/", { redirect: "manual" });
+      expect(res.status).toBe(200);
+      expect(await res.text()).toBe("Home");
+    });
+
+    it("serves /signin to a signed-out visitor", async () => {
+      const { app } = createApp(provisioned);
+      const res = await app.request("/signin", { redirect: "manual" });
+      expect(res.status).toBe(200);
+    });
+
+    it("redirects the signed-in author from / to /setup", async () => {
+      const { app } = createApp(provisioned, { authenticated: true });
+      const res = await app.request("/", { redirect: "manual" });
+      expect(res.status).toBe(302);
+      expect(res.headers.get("Location")).toBe("/setup");
+    });
+
+    it("redirects the signed-in author from /settings to /setup", async () => {
+      const { app } = createApp(provisioned, { authenticated: true });
+      const res = await app.request("/settings", { redirect: "manual" });
+      expect(res.status).toBe(302);
+      expect(res.headers.get("Location")).toBe("/setup");
+    });
+
+    it("redirects the signed-in author from /compose to /setup", async () => {
+      const { app } = createApp(provisioned, { authenticated: true });
+      const res = await app.request("/compose", { redirect: "manual" });
+      expect(res.status).toBe(302);
+      expect(res.headers.get("Location")).toBe("/setup");
+    });
+
+    it("leaves an archive page alone even for the author", async () => {
+      const { app } = createApp(provisioned, { authenticated: true });
+      const res = await app.request("/archive", { redirect: "manual" });
+      expect(res.status).toBe(200);
+    });
+
+    it("is not cached as complete", async () => {
+      const { app, getCallCount } = createApp(provisioned, {
+        authenticated: true,
+      });
+
+      await app.request("/", { redirect: "manual" });
+      await app.request("/settings", { redirect: "manual" });
+      expect(getCallCount()).toBe(2);
+    });
+  });
+
   describe("non-redirected paths (pass through without DB check)", () => {
     it("allows /setup", async () => {
       const { app, getCallCount } = createApp(false);

package/src/middleware/__tests__/secure-headers.test.ts

@@ -3,7 +3,7 @@ import { Hono } from "hono";
 import type { Bindings } from "../../types.js";
 import type { AppVariables } from "../../types/app-context.js";
 
-vi.mock("../../lib/version.js", () => ({
+vi.mock("../../lib/build-env.js", () => ({
   IS_VITE_DEV: false,
 }));
 

package/src/middleware/__tests__/session.test.ts

@@ -1,16 +1,16 @@
 import { describe, it, expect } from "vitest";
+import { eq } from "drizzle-orm";
 import { Hono } from "hono";
 import { attachSession } from "../session.js";
+import { createAuth } from "../../auth.js";
+import { createTestDatabase } from "../../__tests__/helpers/db.js";
+import { session as sessionTable } from "../../db/schema.js";
 import type { Bindings } from "../../types.js";
-import type { AppVariables } from "../../types/app-context.js";
+import type { AppSession, AppVariables } from "../../types/app-context.js";
 
 type Env = { Bindings: Bindings; Variables: AppVariables };
 
-function createAppWithAuth(mockAuth: AppVariables["auth"]): Hono<Env> & {
-  // ensures tests see session/isAuthenticated via c.var
-  _lastSession?: AppVariables["session"];
-  _lastIsAuthenticated?: boolean;
-} {
+function createAppWithAuth(mockAuth: AppVariables["auth"]): Hono<Env> {
   const app = new Hono<Env>();
   app.use("*", async (c, next) => {
     c.set("auth", mockAuth);
@@ -20,26 +20,40 @@ function createAppWithAuth(mockAuth: AppVariables["auth"]): Hono<Env> & {
   return app;
 }
 
+/**
+ * `attachSession` calls `getSession` with `returnHeaders: true`, so the mock
+ * has to answer in better-call's `{ headers, response }` shape.
+ */
 function buildSessionMock(
-  impl: () => Promise<AppVariables["session"]>,
+  impl: () => Promise<{ headers: Headers; response: AppSession }>,
 ): AppVariables["auth"] {
   return {
-    api: {
-      getSession: impl,
-    },
+    api: { getSession: impl },
   } as unknown as AppVariables["auth"];
 }
 
+const VALID_SESSION = {
+  user: { id: "user-1", email: "x@y.z", name: "X" },
+  session: { id: "sess-1" },
+} as unknown as AppSession;
+
+function respondWith(
+  response: AppSession,
+  setCookies: string[] = [],
+): () => Promise<{ headers: Headers; response: AppSession }> {
+  return async () => {
+    const headers = new Headers();
+    for (const cookie of setCookies) headers.append("Set-Cookie", cookie);
+    return { headers, response };
+  };
+}
+
+const REFRESHED_SESSION_COOKIE =
+  "__Secure-better-auth.session_token=fresh; Path=/; Max-Age=2592000; HttpOnly; Secure; SameSite=Lax";
+
 describe("attachSession", () => {
   it("populates c.var.session and isAuthenticated on a valid session", async () => {
-    const mockAuth = buildSessionMock(
-      async () =>
-        ({
-          user: { id: "user-1", email: "x@y.z", name: "X" },
-          session: { id: "sess-1" },
-        }) as unknown as AppVariables["session"],
-    );
-    const app = createAppWithAuth(mockAuth);
+    const app = createAppWithAuth(buildSessionMock(respondWith(VALID_SESSION)));
     app.get("/", (c) =>
       c.json({
         authed: c.var.isAuthenticated,
@@ -53,33 +67,167 @@ describe("attachSession", () => {
   });
 
   it("sets isAuthenticated=false and session=null when no session is present", async () => {
-    const mockAuth = buildSessionMock(async () => null);
-    const app = createAppWithAuth(mockAuth);
+    const app = createAppWithAuth(buildSessionMock(respondWith(null)));
     app.get("/", (c) =>
-      c.json({
-        authed: c.var.isAuthenticated,
-        session: c.var.session,
-      }),
+      c.json({ authed: c.var.isAuthenticated, session: c.var.session }),
     );
 
     const res = await app.request("/");
     expect(await res.json()).toEqual({ authed: false, session: null });
   });
 
-  it("swallows errors from getSession and treats the request as unauthenticated", async () => {
-    const mockAuth = buildSessionMock(async () => {
-      throw new Error("session lookup failed");
-    });
-    const app = createAppWithAuth(mockAuth);
-    app.get("/", (c) =>
-      c.json({
-        authed: c.var.isAuthenticated,
-        session: c.var.session,
+  it("retries once so a blipping lookup does not present as a logout", async () => {
+    let calls = 0;
+    const app = createAppWithAuth(
+      buildSessionMock(async () => {
+        calls += 1;
+        if (calls === 1) throw new Error("transient database error");
+        return { headers: new Headers(), response: VALID_SESSION };
+      }),
+    );
+    app.get("/", (c) => c.json({ authed: c.var.isAuthenticated }));
+
+    const res = await app.request("/");
+    expect(calls).toBe(2);
+    expect(await res.json()).toEqual({ authed: true });
+  });
+
+  it("swallows a persistent lookup failure and treats the request as unauthenticated", async () => {
+    let calls = 0;
+    const app = createAppWithAuth(
+      buildSessionMock(async () => {
+        calls += 1;
+        throw new Error("session lookup failed");
       }),
     );
+    app.get("/", (c) =>
+      c.json({ authed: c.var.isAuthenticated, session: c.var.session }),
+    );
 
     const res = await app.request("/");
     expect(res.status).toBe(200);
+    expect(calls).toBe(2);
     expect(await res.json()).toEqual({ authed: false, session: null });
   });
+
+  it("writes better-auth's refreshed cookies onto the response", async () => {
+    const app = createAppWithAuth(
+      buildSessionMock(respondWith(VALID_SESSION, [REFRESHED_SESSION_COOKIE])),
+    );
+    app.get("/", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/");
+    expect(res.headers.getSetCookie()).toEqual([REFRESHED_SESSION_COOKIE]);
+  });
+
+  it("never attaches cookies to a shared-cacheable response", async () => {
+    const app = createAppWithAuth(
+      buildSessionMock(respondWith(VALID_SESSION, [REFRESHED_SESSION_COOKIE])),
+    );
+    // Mirrors the media routes, which answer with a year-long public cache
+    // directive. A session cookie stored alongside that response is handed to
+    // whoever the CDN serves next.
+    app.get("/media/x.png", (c) =>
+      c.body("bytes", 200, {
+        "Cache-Control": "public, max-age=31536000, immutable",
+      }),
+    );
+
+    const res = await app.request("/media/x.png");
+    expect(res.headers.getSetCookie()).toEqual([]);
+  });
+
+  it("attaches cookies to an explicitly private response", async () => {
+    const app = createAppWithAuth(
+      buildSessionMock(respondWith(VALID_SESSION, [REFRESHED_SESSION_COOKIE])),
+    );
+    app.get("/", (c) =>
+      c.json({ ok: true }, 200, { "Cache-Control": "private, no-store" }),
+    );
+
+    const res = await app.request("/");
+    expect(res.headers.getSetCookie()).toEqual([REFRESHED_SESSION_COOKIE]);
+  });
+
+  it("lets a route's own cookie win, so sign-out is not undone by the refresh", async () => {
+    const cleared =
+      "__Secure-better-auth.session_token=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax";
+    const app = createAppWithAuth(
+      buildSessionMock(respondWith(VALID_SESSION, [REFRESHED_SESSION_COOKIE])),
+    );
+    app.post("/signout", (c) => c.body(null, 302, { "Set-Cookie": cleared }));
+
+    const res = await app.request("/signout", { method: "POST" });
+    expect(res.headers.getSetCookie()).toEqual([cleared]);
+  });
+});
+
+describe("attachSession with a real better-auth instance", () => {
+  it("re-issues the session cookie so its browser lifetime rolls forward", async () => {
+    const { db } = createTestDatabase();
+    const auth = createAuth(db, {
+      secret: "test-secret-with-enough-entropy-for-session-cookies",
+      baseURL: "https://example.com",
+      useSecureCookies: true,
+    });
+
+    const signUp = await auth.api.signUpEmail({
+      body: {
+        name: "Owner",
+        email: "owner@example.com",
+        password: "correct-horse-battery",
+      },
+      returnHeaders: true,
+    });
+    const signUpCookies = signUp.headers.getSetCookie();
+    const sessionCookie = signUpCookies.find((cookie) =>
+      cookie.includes(".session_token="),
+    );
+    expect(sessionCookie).toBeDefined();
+    // Send only the session token, not the `session_data` cache cookie: that
+    // one is written with `Max-Age=300`, so any request more than five minutes
+    // after the last one arrives without it and takes the database path. A
+    // cache hit deliberately short-circuits before any refresh.
+    const cookieHeader = sessionCookie!.split(";")[0]!;
+
+    // better-auth only re-issues the cookie once per `updateAge` (1 day). Age
+    // the stored session past that threshold so this request is the one that
+    // refreshes: with `expiresIn` at 90 days, any expiry inside the next 89
+    // days is due.
+    const rows = await db.select().from(sessionTable);
+    expect(rows).toHaveLength(1);
+    const due = new Date(Date.now() + 28 * 24 * 60 * 60 * 1000);
+    await db
+      .update(sessionTable)
+      .set({ expiresAt: due })
+      .where(eq(sessionTable.id, rows[0]!.id));
+
+    const app = new Hono<Env>();
+    app.use("*", async (c, next) => {
+      c.set("auth", auth);
+      await next();
+    });
+    app.use("*", attachSession());
+    app.get("/", (c) => c.json({ authed: c.var.isAuthenticated }));
+
+    const res = await app.request("/", { headers: { cookie: cookieHeader } });
+    expect(await res.json()).toEqual({ authed: true });
+
+    // The regression this guards: without `returnHeaders` the refreshed cookie
+    // is dropped, so the browser copy keeps the expiry it was born with and
+    // dies a fixed `expiresIn` after sign-in however active the user is.
+    // Asserted against the aged-down 28 days rather than the configured window,
+    // so this stays a test of "it rolls forward" and not of the current policy.
+    const refreshed = res.headers
+      .getSetCookie()
+      .find((cookie) => cookie.includes(".session_token="));
+    expect(refreshed).toBeDefined();
+    expect(refreshed).toMatch(/Max-Age=\d+/);
+    const maxAge = Number(/Max-Age=(\d+)/.exec(refreshed!)?.[1]);
+    expect(maxAge).toBeGreaterThan(29 * 24 * 60 * 60);
+
+    // And the database row rolled forward with it.
+    const [after] = await db.select().from(sessionTable);
+    expect(after!.expiresAt.getTime()).toBeGreaterThan(due.getTime());
+  });
 });