@kelpie/server 0.4.0 → 0.5.0

package/src/testing/client.ts

@@ -1,6 +1,9 @@
+import { eq } from 'drizzle-orm'
 import type { Hono } from 'hono'
 
 import type { AppBindings } from '../app.ts'
+import type { Database } from '../lib/database.ts'
+import { users } from '../modules/auth/schema.ts'
 
 /**
  * An HTTP client for integration tests, plus the two setups almost every suite
@@ -68,7 +71,8 @@ export function readCursor(payload: unknown): string | null {
   return payload.next_cursor
 }
 
-export function createTestClient(app: Hono<AppBindings>): TestClient {
+/** @param db Verifies a fresh signup directly, so almost every suite can start from a working owner. */
+export function createTestClient(app: Hono<AppBindings>, db: Database): TestClient {
   function send(method: string, path: string, options: TestRequestOptions = {}): Promise<Response> {
     return Promise.resolve(
       app.request(path, {
@@ -83,15 +87,31 @@ export function createTestClient(app: Hono<AppBindings>): TestClient {
     )
   }
 
+  /**
+   * Signs up and verifies directly against the database.
+   *
+   * These suites are about the CRM, not verification: going through the real
+   * emailed link for every signup would mean threading the email spy through
+   * this client too, for a step almost nothing here is testing. `auth.test.ts`
+   * and `workspace.test.ts` cover the real link.
+   */
   async function signUp(email: string): Promise<string> {
     const response = await send('POST', '/v1/auth/signup', {
-      body: { email, name: 'Someone', password: 'correct horse battery staple' },
+      body: {
+        email,
+        name: 'Someone',
+        password: 'correct horse battery staple',
+      },
     })
 
     if (response.status !== 201) {
       throw new Error(`Signing up ${email} answered ${String(response.status)}`)
     }
 
+    const accountId = readString(readRecord(await response.json()).account, 'id')
+
+    await db.update(users).set({ emailVerifiedAt: new Date() }).where(eq(users.id, accountId))
+
     // Only the cookie's name=value matters to a later request; the attributes
     // after the first semicolon are for a browser.
     return (response.headers.get('Set-Cookie') ?? '').split(';')[0] ?? ''

package/src/testing/environment.ts

@@ -16,7 +16,11 @@ import type { Environment } from '../lib/config.ts'
  */
 export const TEST_SECRET_ENCRYPTION_KEY = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
 
+/** The base URL every emailed link is built from in tests. */
+export const TEST_APP_BASE_URL = 'https://kelpie.test'
+
 export const TEST_ENVIRONMENT: Environment = {
   NODE_ENV: 'test',
   SECRET_ENCRYPTION_KEY: TEST_SECRET_ENCRYPTION_KEY,
+  APP_BASE_URL: TEST_APP_BASE_URL,
 }

package/src/webBundle.ts

@@ -25,6 +25,14 @@ import { MCP_ROUTE_PREFIX } from './modules/mcp/index.ts'
 export interface WebBundleOptions {
   /** Directory holding the built `index.html` and its assets. */
   readonly directory: string
+  /**
+   * Prefixes the assembly's own modules answer on beyond core's, via
+   * `appRoute`/`appMiddleware`. An unmatched GET under one stays a JSON
+   * error instead of becoming the app shell, the same rule `/v1` gets. The
+   * assembly names them here because only it knows which of its declared
+   * paths are API rather than pages.
+   */
+  readonly apiPrefixes?: readonly string[]
 }
 
 /** The bundle directory does not hold a build. Thrown at boot, never per request. */
@@ -36,15 +44,16 @@ export class WebBundleError extends Error {
 }
 
 /**
- * The prefixes `createApp` answers on.
+ * The prefixes `createApp` itself answers on.
  *
  * `/v1/public` needs no entry of its own: it sits under `/v1`. `MCP_ROUTE_PREFIX`
  * is imported rather than written out, so moving the endpoint moves this with it.
+ * An assembly's own API prefixes arrive through `WebBundleOptions.apiPrefixes`.
  */
-const API_PREFIXES: readonly string[] = ['/v1', MCP_ROUTE_PREFIX, '/healthz']
+const CORE_API_PREFIXES: readonly string[] = ['/v1', MCP_ROUTE_PREFIX, '/healthz']
 
-function isApiRequest(path: string): boolean {
-  return API_PREFIXES.some((prefix) => path === prefix || path.startsWith(`${prefix}/`))
+function isApiRequestFor(prefixes: readonly string[]): (path: string) => boolean {
+  return (path) => prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`))
 }
 
 /**
@@ -60,7 +69,10 @@ function isApiRequest(path: string): boolean {
  * not a page request, and only a `GET` or a `HEAD` can sensibly be answered with
  * a document.
  */
-function webRequestsOnly(handler: MiddlewareHandler): MiddlewareHandler {
+function webRequestsOnly(
+  isApiRequest: (path: string) => boolean,
+  handler: MiddlewareHandler,
+): MiddlewareHandler {
   return async (context, next) => {
     const isDocumentRequest = context.req.method === 'GET' || context.req.method === 'HEAD'
 
@@ -93,10 +105,12 @@ export function serveWebBundle(app: Hono<AppBindings>, options: WebBundleOptions
     )
   }
 
+  const isApiRequest = isApiRequestFor([...CORE_API_PREFIXES, ...(options.apiPrefixes ?? [])])
+
   // Two registrations rather than one: `serveStatic` calls `next()` when it
   // finds no file, which is exactly the signal the fallback needs. A request
   // for a real asset is answered by the first and never reaches the second.
-  app.use('*', webRequestsOnly(serveStatic({ root: directory })))
+  app.use('*', webRequestsOnly(isApiRequest, serveStatic({ root: directory })))
 
   // The single-page fallback. The app decides what to draw from the address, so
   // a deep link to `/people/per_01J…` has to return the same `index.html` even
@@ -106,5 +120,5 @@ export function serveWebBundle(app: Hono<AppBindings>, options: WebBundleOptions
   // does by default. Narrowing this by `Accept` would turn a stale asset
   // reference into a clean 404, and would also turn `curl /people/per_01J…`
   // into one, so it is left alone.
-  app.use('*', webRequestsOnly(serveStatic({ path: indexHtml })))
+  app.use('*', webRequestsOnly(isApiRequest, serveStatic({ path: indexHtml })))
 }