@libredb/studio 0.9.7

package/tests/api/ai/nl2sql.test.ts

@@ -0,0 +1,202 @@
+import { describe, test, expect, mock, beforeEach } from 'bun:test';
+import { createMockRequest, readStreamResponse, parseResponseJSON } from '../../helpers/mock-next';
+
+// ─── Mock helpers ───────────────────────────────────────────────────────────
+
+function createMockStream(text = 'mock response') {
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode(text));
+      controller.close();
+    },
+  });
+}
+
+class MockLLMError extends Error {
+  statusCode?: number;
+  constructor(msg: string, _provider?: string, code?: number) {
+    super(msg);
+    this.name = 'LLMError';
+    this.statusCode = code;
+  }
+}
+class MockLLMConfigError extends MockLLMError {
+  constructor(msg: string) { super(msg); this.name = 'LLMConfigError'; }
+}
+class MockLLMAuthError extends MockLLMError {
+  constructor(msg: string) { super(msg, undefined, 401); this.name = 'LLMAuthError'; }
+}
+class MockLLMRateLimitError extends MockLLMError {
+  constructor(msg: string) { super(msg, undefined, 429); this.name = 'LLMRateLimitError'; }
+}
+class MockLLMSafetyError extends MockLLMError {
+  constructor(msg: string) { super(msg, undefined, 400); this.name = 'LLMSafetyError'; }
+}
+class MockLLMStreamError extends MockLLMError {
+  constructor(msg: string) { super(msg); this.name = 'LLMStreamError'; }
+}
+
+// ─── Mock @/lib/llm BEFORE importing the route ─────────────────────────────
+
+const mockStream = mock(async () => createMockStream());
+const mockProvider = { stream: mockStream };
+const mockCreateLLMProvider = mock(async () => mockProvider);
+
+mock.module('@/lib/llm', () => ({
+  createLLMProvider: mockCreateLLMProvider,
+  LLMError: MockLLMError,
+  LLMConfigError: MockLLMConfigError,
+  LLMAuthError: MockLLMAuthError,
+  LLMRateLimitError: MockLLMRateLimitError,
+  LLMSafetyError: MockLLMSafetyError,
+}));
+
+mock.module('@/lib/llm/types', () => ({
+  LLMError: MockLLMError,
+  LLMConfigError: MockLLMConfigError,
+  LLMAuthError: MockLLMAuthError,
+  LLMRateLimitError: MockLLMRateLimitError,
+  LLMSafetyError: MockLLMSafetyError,
+  LLMStreamError: MockLLMStreamError,
+}));
+
+// ─── Import route handler AFTER mocking ─────────────────────────────────────
+
+const { POST } = await import('@/app/api/ai/nl2sql/route');
+
+// ─── Tests ──────────────────────────────────────────────────────────────────
+
+describe('POST /api/ai/nl2sql', () => {
+  beforeEach(() => {
+    mockCreateLLMProvider.mockClear();
+    mockStream.mockClear();
+    mockCreateLLMProvider.mockImplementation(async () => mockProvider);
+    mockStream.mockImplementation(async () => createMockStream());
+  });
+
+  test('returns streaming response with question', async () => {
+    const req = createMockRequest('/api/ai/nl2sql', {
+      method: 'POST',
+      body: { question: 'Show me all active users', databaseType: 'postgres' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toBe('text/plain; charset=utf-8');
+
+    const text = await readStreamResponse(res);
+    expect(text).toBe('mock response');
+    expect(mockCreateLLMProvider).toHaveBeenCalledTimes(1);
+    expect(mockStream).toHaveBeenCalledTimes(1);
+  });
+
+  test('returns 400 when question is missing', async () => {
+    const req = createMockRequest('/api/ai/nl2sql', {
+      method: 'POST',
+      body: { databaseType: 'postgres' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(400);
+
+    const data = await parseResponseJSON<{ error: string }>(res);
+    expect(data.error).toContain('required');
+  });
+
+  test('returns streaming response with conversation history', async () => {
+    const req = createMockRequest('/api/ai/nl2sql', {
+      method: 'POST',
+      body: {
+        question: 'And filter by active status',
+        databaseType: 'postgres',
+        conversationHistory: [
+          { role: 'user', content: 'Show me users' },
+          { role: 'assistant', content: 'SELECT * FROM users;' },
+        ],
+      },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(200);
+
+    const text = await readStreamResponse(res);
+    expect(text).toBe('mock response');
+
+    const callArgs = (mockStream.mock.calls as unknown[][])[0][0] as { messages: Array<{ role: string; content: string }> };
+    // system + 2 history + current question
+    expect(callArgs.messages.length).toBe(4);
+  });
+
+  test('returns 503 on LLMConfigError', async () => {
+    mockCreateLLMProvider.mockImplementation(async () => {
+      throw new MockLLMConfigError('LLM not configured');
+    });
+
+    const req = createMockRequest('/api/ai/nl2sql', {
+      method: 'POST',
+      body: { question: 'test' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(503);
+  });
+
+  test('returns 401 on LLMAuthError', async () => {
+    mockCreateLLMProvider.mockImplementation(async () => {
+      throw new MockLLMAuthError('Invalid API key');
+    });
+
+    const req = createMockRequest('/api/ai/nl2sql', {
+      method: 'POST',
+      body: { question: 'test' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(401);
+  });
+
+  test('returns 429 on LLMRateLimitError', async () => {
+    mockCreateLLMProvider.mockImplementation(async () => {
+      throw new MockLLMRateLimitError('Rate limit');
+    });
+
+    const req = createMockRequest('/api/ai/nl2sql', {
+      method: 'POST',
+      body: { question: 'test' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(429);
+  });
+
+  test('returns 400 on LLMSafetyError', async () => {
+    mockStream.mockImplementation(async () => {
+      throw new MockLLMSafetyError('Blocked');
+    });
+
+    const req = createMockRequest('/api/ai/nl2sql', {
+      method: 'POST',
+      body: { question: 'test' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(400);
+  });
+
+  test('returns 500 on generic error', async () => {
+    mockStream.mockImplementation(async () => {
+      throw new Error('Unexpected failure');
+    });
+
+    const req = createMockRequest('/api/ai/nl2sql', {
+      method: 'POST',
+      body: { question: 'test' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(500);
+
+    const data = await parseResponseJSON<{ error: string }>(res);
+    expect(data.error).toBe('Unexpected failure');
+  });
+});

package/tests/api/ai/query-safety.test.ts

@@ -0,0 +1,196 @@
+import { describe, test, expect, mock, beforeEach } from 'bun:test';
+import { createMockRequest, readStreamResponse, parseResponseJSON } from '../../helpers/mock-next';
+
+// ─── Mock helpers ───────────────────────────────────────────────────────────
+
+function createMockStream(text = 'mock response') {
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode(text));
+      controller.close();
+    },
+  });
+}
+
+class MockLLMError extends Error {
+  statusCode?: number;
+  constructor(msg: string, _provider?: string, code?: number) {
+    super(msg);
+    this.name = 'LLMError';
+    this.statusCode = code;
+  }
+}
+class MockLLMConfigError extends MockLLMError {
+  constructor(msg: string) { super(msg); this.name = 'LLMConfigError'; }
+}
+class MockLLMAuthError extends MockLLMError {
+  constructor(msg: string) { super(msg, undefined, 401); this.name = 'LLMAuthError'; }
+}
+class MockLLMRateLimitError extends MockLLMError {
+  constructor(msg: string) { super(msg, undefined, 429); this.name = 'LLMRateLimitError'; }
+}
+class MockLLMSafetyError extends MockLLMError {
+  constructor(msg: string) { super(msg, undefined, 400); this.name = 'LLMSafetyError'; }
+}
+class MockLLMStreamError extends MockLLMError {
+  constructor(msg: string) { super(msg); this.name = 'LLMStreamError'; }
+}
+
+// ─── Mock @/lib/llm BEFORE importing the route ─────────────────────────────
+
+const mockStream = mock(async () => createMockStream());
+const mockProvider = { stream: mockStream };
+const mockCreateLLMProvider = mock(async () => mockProvider);
+
+mock.module('@/lib/llm', () => ({
+  createLLMProvider: mockCreateLLMProvider,
+  LLMError: MockLLMError,
+  LLMConfigError: MockLLMConfigError,
+  LLMAuthError: MockLLMAuthError,
+  LLMRateLimitError: MockLLMRateLimitError,
+  LLMSafetyError: MockLLMSafetyError,
+}));
+
+mock.module('@/lib/llm/types', () => ({
+  LLMError: MockLLMError,
+  LLMConfigError: MockLLMConfigError,
+  LLMAuthError: MockLLMAuthError,
+  LLMRateLimitError: MockLLMRateLimitError,
+  LLMSafetyError: MockLLMSafetyError,
+  LLMStreamError: MockLLMStreamError,
+}));
+
+// ─── Import route handler AFTER mocking ─────────────────────────────────────
+
+const { POST } = await import('@/app/api/ai/query-safety/route');
+
+// ─── Tests ──────────────────────────────────────────────────────────────────
+
+describe('POST /api/ai/query-safety', () => {
+  beforeEach(() => {
+    mockCreateLLMProvider.mockClear();
+    mockStream.mockClear();
+    mockCreateLLMProvider.mockImplementation(async () => mockProvider);
+    mockStream.mockImplementation(async () => createMockStream());
+  });
+
+  test('returns streaming response with query', async () => {
+    const req = createMockRequest('/api/ai/query-safety', {
+      method: 'POST',
+      body: {
+        query: 'DROP TABLE users',
+        schemaContext: 'users(id, name)',
+        databaseType: 'postgres',
+      },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toBe('text/plain; charset=utf-8');
+
+    const text = await readStreamResponse(res);
+    expect(text).toBe('mock response');
+    expect(mockCreateLLMProvider).toHaveBeenCalledTimes(1);
+    expect(mockStream).toHaveBeenCalledTimes(1);
+  });
+
+  test('returns 400 when query is missing', async () => {
+    const req = createMockRequest('/api/ai/query-safety', {
+      method: 'POST',
+      body: { databaseType: 'postgres' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(400);
+
+    const data = await parseResponseJSON<{ error: string }>(res);
+    expect(data.error).toContain('required');
+  });
+
+  test('returns 503 on LLMConfigError', async () => {
+    mockCreateLLMProvider.mockImplementation(async () => {
+      throw new MockLLMConfigError('LLM not configured');
+    });
+
+    const req = createMockRequest('/api/ai/query-safety', {
+      method: 'POST',
+      body: { query: 'DELETE FROM users' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(503);
+  });
+
+  test('returns 401 on LLMAuthError', async () => {
+    mockCreateLLMProvider.mockImplementation(async () => {
+      throw new MockLLMAuthError('Invalid key');
+    });
+
+    const req = createMockRequest('/api/ai/query-safety', {
+      method: 'POST',
+      body: { query: 'DELETE FROM users' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(401);
+  });
+
+  test('returns 429 on LLMRateLimitError', async () => {
+    mockCreateLLMProvider.mockImplementation(async () => {
+      throw new MockLLMRateLimitError('Rate limit');
+    });
+
+    const req = createMockRequest('/api/ai/query-safety', {
+      method: 'POST',
+      body: { query: 'DELETE FROM users' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(429);
+  });
+
+  test('returns 400 on LLMSafetyError', async () => {
+    mockStream.mockImplementation(async () => {
+      throw new MockLLMSafetyError('Blocked');
+    });
+
+    const req = createMockRequest('/api/ai/query-safety', {
+      method: 'POST',
+      body: { query: 'DELETE FROM users' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(400);
+  });
+
+  test('returns custom status code on LLMError', async () => {
+    mockStream.mockImplementation(async () => {
+      throw new MockLLMError('Bad gateway', undefined, 502);
+    });
+
+    const req = createMockRequest('/api/ai/query-safety', {
+      method: 'POST',
+      body: { query: 'DELETE FROM users' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(502);
+  });
+
+  test('returns 500 on generic error', async () => {
+    mockStream.mockImplementation(async () => {
+      throw new Error('Unexpected');
+    });
+
+    const req = createMockRequest('/api/ai/query-safety', {
+      method: 'POST',
+      body: { query: 'DELETE FROM users' },
+    });
+
+    const res = await POST(req as never);
+    expect(res.status).toBe(500);
+
+    const data = await parseResponseJSON<{ error: string }>(res);
+    expect(data.error).toBe('Unexpected');
+  });
+});

package/tests/api/auth/login.test.ts

@@ -0,0 +1,170 @@
+import { describe, test, expect, mock, beforeEach } from 'bun:test';
+import { createMockRequest, parseResponseJSON } from '../../helpers/mock-next';
+
+// ─── Mock @/lib/auth BEFORE importing the route ─────────────────────────────
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const mockLogin = mock(async (_role: string, _email?: string) => {});
+
+mock.module('@/lib/auth', () => ({
+  login: mockLogin,
+  signJWT: mock(async () => 'mock-token'),
+  verifyJWT: mock(async () => null),
+  getSession: mock(async () => null),
+  logout: mock(async () => {}),
+}));
+
+// ─── Import route handler AFTER mocking ─────────────────────────────────────
+const { POST } = await import('@/app/api/auth/login/route');
+
+// ─── Tests ──────────────────────────────────────────────────────────────────
+describe('POST /api/auth/login', () => {
+  beforeEach(() => {
+    mockLogin.mockClear();
+  });
+
+  test('returns 200 with role admin when admin credentials are provided', async () => {
+    const req = createMockRequest('/api/auth/login', {
+      method: 'POST',
+      body: { email: 'admin@libredb.org', password: 'LibreDB.2026' },
+    });
+
+    const res = await POST(req as never);
+    const data = await parseResponseJSON<{ success: boolean; role: string }>(res);
+
+    expect(res.status).toBe(200);
+    expect(data.success).toBe(true);
+    expect(data.role).toBe('admin');
+  });
+
+  test('returns 200 with role user when user credentials are provided', async () => {
+    const req = createMockRequest('/api/auth/login', {
+      method: 'POST',
+      body: { email: 'user@libredb.org', password: 'LibreDB.2026' },
+    });
+
+    const res = await POST(req as never);
+    const data = await parseResponseJSON<{ success: boolean; role: string }>(res);
+
+    expect(res.status).toBe(200);
+    expect(data.success).toBe(true);
+    expect(data.role).toBe('user');
+  });
+
+  test('returns 401 when wrong password is provided', async () => {
+    const req = createMockRequest('/api/auth/login', {
+      method: 'POST',
+      body: { email: 'admin@libredb.org', password: 'wrong-password' },
+    });
+
+    const res = await POST(req as never);
+    const data = await parseResponseJSON<{ success: boolean; message: string }>(res);
+
+    expect(res.status).toBe(401);
+    expect(data.success).toBe(false);
+    expect(data.message).toBe('Invalid email or password');
+  });
+
+  test('returns 401 when wrong email is provided', async () => {
+    const req = createMockRequest('/api/auth/login', {
+      method: 'POST',
+      body: { email: 'unknown@example.com', password: 'LibreDB.2026' },
+    });
+
+    const res = await POST(req as never);
+    const data = await parseResponseJSON<{ success: boolean; message: string }>(res);
+
+    expect(res.status).toBe(401);
+    expect(data.success).toBe(false);
+    expect(data.message).toBe('Invalid email or password');
+  });
+
+  test('returns 401 when empty credentials are provided', async () => {
+    const req = createMockRequest('/api/auth/login', {
+      method: 'POST',
+      body: { email: '', password: '' },
+    });
+
+    const res = await POST(req as never);
+    const data = await parseResponseJSON<{ success: boolean; message: string }>(res);
+
+    expect(res.status).toBe(401);
+    expect(data.success).toBe(false);
+    expect(data.message).toBe('Invalid email or password');
+  });
+
+  test('returns 500 when body is not valid JSON', async () => {
+    const req = new Request('http://localhost:3000/api/auth/login', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: 'not-json',
+    });
+
+    const res = await POST(req as never);
+    const data = await parseResponseJSON<{ error: string; code: string; statusCode: number }>(res);
+
+    expect(res.status).toBe(500);
+    expect(data.code).toBe('INTERNAL_ERROR');
+    expect(data.statusCode).toBe(500);
+  });
+
+  test('returns 500 when body is empty', async () => {
+    const req = new Request('http://localhost:3000/api/auth/login', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: '',
+    });
+
+    const res = await POST(req as never);
+    const data = await parseResponseJSON<{ error: string; code: string; statusCode: number }>(res);
+
+    expect(res.status).toBe(500);
+    expect(data.code).toBe('INTERNAL_ERROR');
+    expect(data.statusCode).toBe(500);
+  });
+
+  test('calls login() with role and email for admin', async () => {
+    const req = createMockRequest('/api/auth/login', {
+      method: 'POST',
+      body: { email: 'admin@libredb.org', password: 'LibreDB.2026' },
+    });
+
+    await POST(req as never);
+
+    expect(mockLogin).toHaveBeenCalledTimes(1);
+    expect(mockLogin).toHaveBeenCalledWith('admin', 'admin@libredb.org');
+  });
+
+  test('calls login() with role and email for user', async () => {
+    const req = createMockRequest('/api/auth/login', {
+      method: 'POST',
+      body: { email: 'user@libredb.org', password: 'LibreDB.2026' },
+    });
+
+    await POST(req as never);
+
+    expect(mockLogin).toHaveBeenCalledTimes(1);
+    expect(mockLogin).toHaveBeenCalledWith('user', 'user@libredb.org');
+  });
+
+  test('returns 500 when production env vars are missing', async () => {
+    const origNodeEnv = process.env.NODE_ENV;
+    const origAdminEmail = process.env.ADMIN_EMAIL;
+    (process.env as Record<string, string>).NODE_ENV = 'production';
+    delete process.env.ADMIN_EMAIL;
+
+    const req = createMockRequest('/api/auth/login', {
+      method: 'POST',
+      body: { email: 'admin@libredb.org', password: 'LibreDB.2026' },
+    });
+
+    const res = await POST(req as never);
+    const data = await parseResponseJSON<{ error: string; code: string; statusCode: number }>(res);
+
+    expect(res.status).toBe(500);
+    expect(data.code).toBe('INTERNAL_ERROR');
+    expect(data.statusCode).toBe(500);
+
+    (process.env as Record<string, string>).NODE_ENV = origNodeEnv!;
+    process.env.ADMIN_EMAIL = origAdminEmail!;
+  });
+});