@jskit-ai/auth-core 0.1.97 → 0.1.100

package/test/authContract.test.js

@@ -0,0 +1,171 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  normalizeAuthCapabilities,
+  getCapabilityFeature,
+  isAuthOperationSupported
+} from "../src/shared/authCapabilities.js";
+import {
+  buildSecurityStatusFromAuthMethodsStatus,
+  normalizeAuthSecurityStatus
+} from "../src/shared/authSecurityStatus.js";
+import {
+  buildLegacyProfileFromActor,
+  normalizeAuthActor,
+  normalizeAuthResult
+} from "../src/server/authActor.js";
+import {
+  AUTH_OPERATION_UNSUPPORTED_CODE,
+  createUnsupportedAuthOperationError,
+  isUnsupportedAuthOperationError
+} from "../src/server/unsupportedOperation.js";
+
+test("normalizeAuthCapabilities returns one provider-neutral feature shape", () => {
+  const capabilities = normalizeAuthCapabilities({
+    provider: {
+      id: "LOCAL",
+      label: ""
+    },
+    features: {
+      password: {
+        login: true,
+        register: true,
+        change: true
+      },
+      passwordRecovery: {
+        request: true,
+        complete: true,
+        delivery: "smtp"
+      },
+      oauthLogin: {
+        enabled: true,
+        providers: [
+          { id: "Google", label: "Google" },
+          "github",
+          "bad provider"
+        ],
+        defaultProvider: "github"
+      },
+      providerLinking: {
+        start: true
+      },
+      securityStatus: true
+    }
+  });
+
+  assert.equal(capabilities.provider.id, "local");
+  assert.equal(capabilities.provider.label, "Local");
+  assert.equal(capabilities.features.password.login, true);
+  assert.equal(capabilities.features.password.methodToggle, false);
+  assert.equal(capabilities.features.passwordRecovery.delivery, "smtp");
+  assert.deepEqual(capabilities.features.oauthLogin.providers, [
+    { id: "google", label: "Google" },
+    { id: "github", label: "github" }
+  ]);
+  assert.equal(capabilities.features.oauthLogin.defaultProvider, "github");
+  assert.equal(getCapabilityFeature(capabilities, "providerLinking.start"), true);
+  assert.equal(isAuthOperationSupported(capabilities, "startProviderLink"), true);
+  assert.equal(isAuthOperationSupported(capabilities, "unlinkProvider"), false);
+  assert.equal(isAuthOperationSupported(capabilities, "resetPassword"), true);
+  assert.equal(
+    isAuthOperationSupported(
+      {
+        features: {
+          password: {
+            change: true
+          },
+          passwordRecovery: {
+            complete: false
+          }
+        }
+      },
+      "resetPassword"
+    ),
+    false
+  );
+});
+
+test("normalizeAuthActor builds the stable actor and legacy profile bridge", () => {
+  const actor = normalizeAuthActor({
+    authProvider: "supabase",
+    authProviderUserSid: "abc-123",
+    email: " ADA@example.COM ",
+    displayName: "Ada",
+    appUserId: 42,
+    profileSource: "users"
+  });
+
+  assert.deepEqual(actor, {
+    authIdentityId: "supabase:abc-123",
+    provider: "supabase",
+    providerUserId: "abc-123",
+    email: "ada@example.com",
+    displayName: "Ada",
+    appUserId: "42",
+    profileSource: "users"
+  });
+  assert.deepEqual(buildLegacyProfileFromActor(actor), {
+    id: "42",
+    email: "ada@example.com",
+    displayName: "Ada",
+    authProvider: "supabase",
+    authProviderUserSid: "abc-123"
+  });
+  assert.deepEqual(normalizeAuthResult({ authenticated: true, actor }).profile, buildLegacyProfileFromActor(actor));
+});
+
+test("normalizeAuthActor preserves opaque app user ids", () => {
+  const actor = normalizeAuthActor({
+    provider: "local",
+    providerUserId: "provider-user-1",
+    email: "local@example.com",
+    appUserId: "app-user-1",
+    profileSource: "users"
+  });
+
+  assert.equal(actor.appUserId, "app-user-1");
+  assert.equal(buildLegacyProfileFromActor(actor).id, "app-user-1");
+});
+
+test("normalizeAuthSecurityStatus emits policy and legacy authPolicy aliases", () => {
+  const status = buildSecurityStatusFromAuthMethodsStatus(
+    {
+      methods: [
+        {
+          id: "password",
+          kind: "password",
+          configured: true,
+          enabled: true,
+          canDisable: false
+        }
+      ],
+      minimumEnabledMethods: 1,
+      enabledMethodsCount: 1
+    },
+    {
+      actions: {
+        changePassword: true,
+        signOutOtherSessions: true
+      }
+    }
+  );
+
+  assert.deepEqual(status.policy, {
+    minimumEnabledMethods: 1,
+    enabledMethodsCount: 1
+  });
+  assert.equal(status.authPolicy, status.policy);
+  assert.equal(status.actions.changePassword, true);
+  assert.equal(status.actions.linkProvider, false);
+  assert.deepEqual(normalizeAuthSecurityStatus(status), status);
+});
+
+test("unsupported auth operation errors are stable AppErrors", () => {
+  const error = createUnsupportedAuthOperationError("oauthStart");
+  assert.equal(error.status, 501);
+  assert.equal(error.code, AUTH_OPERATION_UNSUPPORTED_CODE);
+  assert.deepEqual(error.details, {
+    operation: "oauthStart"
+  });
+  assert.equal(isUnsupportedAuthOperationError(error), true);
+});

package/test/commandValidators.test.js

@@ -104,9 +104,14 @@ test("auth session and oauth start commands expose explicit nested response sche
   assert.equal(sessionResponseSchema.properties.oauthProviders.items["x-json-rest-schema"]?.castType, "object");
   assert.equal(Array.isArray(sessionResponseSchema.properties.oauthProviders.items.allOf), true);
   assert.match(sessionResponseSchema.properties.oauthProviders.items.allOf[0]?.$ref || "", /^#\/definitions\//);
+  assert.equal(sessionResponseSchema.properties.authCapabilities["x-json-rest-schema"]?.castType, "object");
+  assert.equal(Array.isArray(sessionResponseSchema.properties.authCapabilities.allOf), true);
+  assert.match(sessionResponseSchema.properties.authCapabilities.allOf[0]?.$ref || "", /^#\/definitions\//);
   assert.equal(sessionResponseSchema.properties.authDenied["x-json-rest-schema"]?.castType, "object");
   assert.equal(Array.isArray(sessionResponseSchema.properties.authDenied.allOf), true);
   assert.match(sessionResponseSchema.properties.authDenied.allOf[0]?.$ref || "", /^#\/definitions\//);
+  assert.equal(sessionUnavailableSchema.properties.authCapabilities["x-json-rest-schema"]?.castType, "object");
+  assert.equal(Array.isArray(sessionUnavailableSchema.properties.authCapabilities.allOf), true);
   assert.equal(Array.isArray(sessionUnavailableSchema.properties.oauthDefaultProvider.anyOf), true);
   assert.equal(oauthStartResponseSchema.properties.provider.type, "string");
   assert.equal(oauthStartResponseSchema.properties.returnTo.type, "string");

package/test/providerRuntime.test.js

@@ -1,5 +1,9 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import { createApplication } from "@jskit-ai/kernel/_testable";
+import { ActionRuntimeServiceProvider } from "@jskit-ai/kernel/server/actions";
+import { AccessCoreServiceProvider } from "../src/server/providers/AccessCoreServiceProvider.js";
+import { AuthActionsServiceProvider } from "../src/server/providers/AuthActionsServiceProvider.js";
 import { FastifyAuthPolicyServiceProvider } from "../src/server/providers/FastifyAuthPolicyServiceProvider.js";
 import { AUTH_POLICY_CONTEXT_RESOLVER_TAG } from "../src/server/authPolicyContextResolverRegistry.js";
 import { createFakeFastifyPolicyRuntime } from "../../../tooling/testUtils/fakeFastify.mjs";
@@ -134,3 +138,42 @@ test("FastifyAuthPolicyServiceProvider wires optional auth policy context resolv
   assert.equal(request.membership?.roleSid, "member");
   assert.deepEqual(request.permissions, ["settings.manage", "projects.read"]);
 });
+
+test("auth-core providers boot without a selected provider and deny protected API requests", async () => {
+  const { fastify, state } = createFakeFastifyPolicyRuntime();
+  const app = createApplication();
+
+  app.instance("appConfig", {
+    surfaceModeAll: "all",
+    surfaceDefaultId: "home",
+    surfaceDefinitions: {
+      home: { id: "home", pagesRoot: "", enabled: true, requiresAuth: false, requiresWorkspace: false }
+    }
+  });
+  app.instance("jskit.fastify", fastify);
+  app.instance("jskit.env", { NODE_ENV: "test" });
+
+  await app.start({
+    providers: [
+      ActionRuntimeServiceProvider,
+      AccessCoreServiceProvider,
+      AuthActionsServiceProvider,
+      FastifyAuthPolicyServiceProvider
+    ]
+  });
+
+  const request = {
+    method: "GET",
+    raw: { url: "/api/protected" },
+    routeOptions: {
+      config: {
+        authPolicy: "required"
+      }
+    }
+  };
+
+  await assert.rejects(
+    () => state.preHandler(request, {}),
+    /Authentication required/
+  );
+});