@jskit-ai/auth-web 0.1.119 → 0.1.121

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-web",
-  "version": "0.1.119",
+  "version": "0.1.121",
   "kind": "runtime",
   "description": "Auth web module: Fastify auth routes plus web login/sign-out scaffolds.",
   "dependsOn": [
@@ -56,6 +56,10 @@ export default Object.freeze({
         {
           "subpath": "./server",
           "summary": "Exports auth web server providers, controller/service classes, route builders, and HTTP schema modules."
+        },
+        {
+          "subpath": "./test/playwright",
+          "summary": "Exports the localhost-only Playwright helper for creating a dev-auth session in the tested browser context."
         }
       ],
       "containerTokens": {
@@ -260,10 +264,10 @@ export default Object.freeze({
     "dependencies": {
       "runtime": {
         "@mdi/js": "^7.4.47",
-        "@jskit-ai/auth-core": "0.1.117",
-        "@jskit-ai/http-runtime": "0.1.118",
-        "@jskit-ai/kernel": "0.1.120",
-        "@jskit-ai/shell-web": "0.1.119"
+        "@jskit-ai/auth-core": "0.1.118",
+        "@jskit-ai/http-runtime": "0.1.119",
+        "@jskit-ai/kernel": "0.1.121",
+        "@jskit-ai/shell-web": "0.1.121"
       },
       "dev": {}
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-web",
-  "version": "0.1.119",
+  "version": "0.1.121",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -16,14 +16,15 @@
     "./client/runtime/authGuardRuntime": "./src/client/runtime/authGuardRuntime.js",
     "./client/runtime/authHttpClient": "./src/client/runtime/authHttpClient.js",
     "./client/runtime/oauthCallbackRuntime": "./src/client/runtime/oauthCallbackRuntime.js",
-    "./client/runtime/useSignOut": "./src/client/runtime/useSignOut.js"
+    "./client/runtime/useSignOut": "./src/client/runtime/useSignOut.js",
+    "./test/playwright": "./src/test/playwright.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.117",
+    "@jskit-ai/auth-core": "0.1.118",
     "@mdi/js": "^7.4.47",
-    "@jskit-ai/kernel": "0.1.120",
-    "@jskit-ai/shell-web": "0.1.119",
-    "@jskit-ai/http-runtime": "0.1.118"
+    "@jskit-ai/kernel": "0.1.121",
+    "@jskit-ai/shell-web": "0.1.121",
+    "@jskit-ai/http-runtime": "0.1.119"
   },
   "peerDependencies": {
     "@tanstack/vue-query": "^5.90.5",

package/src/test/playwright.js

@@ -0,0 +1,84 @@
+import { DEV_AUTH_SECRET_HEADER } from "@jskit-ai/auth-core/server/devAuth";
+import { AUTH_PATHS } from "@jskit-ai/auth-core/shared/authPaths";
+
+const DEFAULT_LOCAL_BASE_URL = "http://127.0.0.1:4173";
+
+function resolveLocalBaseUrl(value) {
+  const baseUrl = String(value || DEFAULT_LOCAL_BASE_URL).trim().replace(/\/+$/u, "");
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    throw new Error("loginAsExistingUser requires a valid local baseURL.");
+  }
+
+  const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/gu, "");
+  const isLocal = hostname === "localhost" ||
+    hostname.endsWith(".localhost") ||
+    hostname.startsWith("127.") ||
+    hostname === "::1";
+  if (!isLocal) {
+    throw new Error("loginAsExistingUser only sends the dev-auth secret to a local app URL.");
+  }
+
+  return baseUrl;
+}
+
+function resolveIdentity({ email = "", userId = "" } = {}) {
+  const normalizedEmail = String(email || "").trim();
+  const normalizedUserId = String(userId || "").trim();
+  if (Boolean(normalizedEmail) === Boolean(normalizedUserId)) {
+    throw new Error("loginAsExistingUser requires exactly one of email or userId.");
+  }
+  return normalizedEmail ? { email: normalizedEmail } : { userId: normalizedUserId };
+}
+
+async function responseBody(response) {
+  const body = await response.text();
+  return body ? ` ${body}` : "";
+}
+
+async function loginAsExistingUser(page, {
+  email = "",
+  userId = "",
+  secret = process.env.AUTH_DEV_BYPASS_SECRET,
+  baseURL = process.env.PLAYWRIGHT_BASE_URL || DEFAULT_LOCAL_BASE_URL
+} = {}) {
+  const context = page?.context?.();
+  if (!context?.request) {
+    throw new Error("loginAsExistingUser requires a Playwright page.");
+  }
+
+  const normalizedSecret = String(secret || "").trim();
+  if (!normalizedSecret) {
+    throw new Error("loginAsExistingUser requires AUTH_DEV_BYPASS_SECRET.");
+  }
+
+  const localBaseUrl = resolveLocalBaseUrl(baseURL);
+  const identity = resolveIdentity({ email, userId });
+  const sessionResponse = await context.request.get(`${localBaseUrl}${AUTH_PATHS.SESSION}`);
+  if (!sessionResponse.ok()) {
+    throw new Error(`Session bootstrap failed: ${sessionResponse.status()}${await responseBody(sessionResponse)}`);
+  }
+
+  const session = await sessionResponse.json();
+  const csrfToken = String(session?.csrfToken || "").trim();
+  if (!csrfToken) {
+    throw new Error("Session bootstrap did not return csrfToken.");
+  }
+
+  const loginResponse = await context.request.post(`${localBaseUrl}${AUTH_PATHS.DEV_LOGIN_AS}`, {
+    data: identity,
+    headers: {
+      "csrf-token": csrfToken,
+      [DEV_AUTH_SECRET_HEADER]: normalizedSecret
+    }
+  });
+  if (!loginResponse.ok()) {
+    throw new Error(`Dev login failed: ${loginResponse.status()}${await responseBody(loginResponse)}`);
+  }
+
+  return loginResponse.json();
+}
+
+export { loginAsExistingUser };

package/test/playwright.test.js

@@ -0,0 +1,113 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { DEV_AUTH_SECRET_HEADER } from "@jskit-ai/auth-core/server/devAuth";
+import { loginAsExistingUser } from "../src/test/playwright.js";
+
+function createResponse({ status = 200, body = {} } = {}) {
+  return {
+    ok() {
+      return status >= 200 && status < 300;
+    },
+    status() {
+      return status;
+    },
+    async json() {
+      return body;
+    },
+    async text() {
+      return JSON.stringify(body);
+    }
+  };
+}
+
+test("local Playwright login exchanges CSRF and the private secret in the page context", async () => {
+  const calls = [];
+  const request = {
+    async get(url) {
+      calls.push({ method: "GET", url });
+      return createResponse({ body: { csrfToken: "csrf-test" } });
+    },
+    async post(url, options) {
+      calls.push({ method: "POST", url, options });
+      return createResponse({ body: { ok: true, userId: "7" } });
+    }
+  };
+  const page = {
+    context() {
+      return { request };
+    },
+    evaluate() {
+      throw new Error("The private exchange must not run in browser JavaScript.");
+    }
+  };
+
+  const result = await loginAsExistingUser(page, {
+    email: "ada@example.com",
+    secret: "private-test-secret"
+  });
+
+  assert.deepEqual(result, { ok: true, userId: "7" });
+  assert.deepEqual(calls, [
+    {
+      method: "GET",
+      url: "http://127.0.0.1:4173/api/session"
+    },
+    {
+      method: "POST",
+      url: "http://127.0.0.1:4173/api/dev-auth/login-as",
+      options: {
+        data: { email: "ada@example.com" },
+        headers: {
+          "csrf-token": "csrf-test",
+          [DEV_AUTH_SECRET_HEADER]: "private-test-secret"
+        }
+      }
+    }
+  ]);
+});
+
+test("local Playwright login refuses to send the private secret to a managed URL", async () => {
+  let requestCount = 0;
+  const page = {
+    context() {
+      return {
+        request: {
+          async get() {
+            requestCount += 1;
+          }
+        }
+      };
+    }
+  };
+
+  await assert.rejects(
+    loginAsExistingUser(page, {
+      email: "ada@example.com",
+      secret: "private-test-secret",
+      baseURL: "https://preview.example.test"
+    }),
+    /only sends the dev-auth secret to a local app URL/u
+  );
+  assert.equal(requestCount, 0);
+});
+
+test("local Playwright login requires one explicit existing-user identity", async () => {
+  let requestCount = 0;
+  const page = {
+    context() {
+      return {
+        request: {
+          async get() {
+            requestCount += 1;
+          }
+        }
+      };
+    }
+  };
+
+  await assert.rejects(
+    loginAsExistingUser(page, { secret: "private-test-secret" }),
+    /exactly one of email or userId/u
+  );
+  assert.equal(requestCount, 0);
+});