@jskit-ai/console-core 0.1.87 → 0.1.88

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   packageVersion: 1,
   packageId: "@jskit-ai/console-core",
-  version: "0.1.87",
+  version: "0.1.88",
   kind: "runtime",
   description: "Console runtime: console settings schema, bootstrap flags, actions, and HTTP routes.",
   dependsOn: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/console-core",
-  "version": "0.1.87",
+  "version": "0.1.88",
   "type": "module",
   "scripts": {
     "test": "node --test"

package/src/server/consoleAuthServiceDecorator.js

@@ -40,8 +40,9 @@ function createConsoleAuthServiceDecorator({ consoleService } = {}) {
       }
 
       return Object.freeze(
-        Object.assign(Object.create(authService), {
-          async authenticateRequest(request, ...args) {
+        Object.defineProperty(Object.create(authService), "authenticateRequest", {
+          enumerable: true,
+          value: async function authenticateRequest(request, ...args) {
             const authResult = await authService.authenticateRequest(request, ...args);
             if (consoleOwnerInitialized) {
               return authResult;

package/test/consoleAuthServiceDecorator.test.js

@@ -63,3 +63,56 @@ test("console auth service decorator leaves unauthenticated session reads alone"
 
   assert.equal(result.authenticated, false);
 });
+
+test("console auth service decorator safely shadows authenticateRequest on a frozen service", async () => {
+  const calls = [];
+  const ownerSeeds = [];
+  const originalAuthenticateRequest = async function authenticateRequest(request, ...args) {
+    calls.push({ request, args });
+    return {
+      authenticated: true,
+      profile: {
+        id: request.profileId
+      }
+    };
+  };
+  const originalAuthService = Object.freeze({
+    authenticateRequest: originalAuthenticateRequest,
+    readMarker() {
+      return "original-service";
+    }
+  });
+  const decorator = createConsoleAuthServiceDecorator({
+    consoleService: {
+      async ensureInitialConsoleMember(userId) {
+        ownerSeeds.push(String(userId || ""));
+        return String(userId || "");
+      }
+    }
+  });
+
+  const decoratedAuthService = decorator.decorateAuthService(originalAuthService);
+  const result = await decoratedAuthService.authenticateRequest(
+    {
+      profileId: "42",
+      url: "/api/session"
+    },
+    "forwarded-argument"
+  );
+
+  assert.equal(Object.isFrozen(originalAuthService), true);
+  assert.equal(Object.isFrozen(decoratedAuthService), true);
+  assert.equal(Object.getPrototypeOf(decoratedAuthService), originalAuthService);
+  assert.equal(originalAuthService.authenticateRequest, originalAuthenticateRequest);
+  assert.equal(decoratedAuthService.readMarker(), "original-service");
+  assert.equal(result.profile.id, "42");
+  assert.deepEqual(ownerSeeds, ["42"]);
+  assert.equal(calls.length, 1);
+  assert.deepEqual(calls[0].args, ["forwarded-argument"]);
+  assert.deepEqual(Object.getOwnPropertyDescriptor(decoratedAuthService, "authenticateRequest"), {
+    configurable: false,
+    enumerable: true,
+    value: decoratedAuthService.authenticateRequest,
+    writable: false
+  });
+});