@o3co/auth-provider-foundation 0.5.1 → 0.5.2

package/dist/repositories/HttpUserRepository.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"HttpUserRepository.d.mts","sourceRoot":"","sources":["../../src/repositories/HttpUserRepository.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAErE,qBAAa,kBAAmB,YAAW,cAAc;IACxD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,OAAO,CAAS;gBAEZ,EACX,eAAe,EACf,sBAAsB,EACtB,OAAO,GACP,EAAE;QACF,eAAe,EAAE,MAAM,CAAC;QACxB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC;KAChB;IAMK,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAItE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YAIhD,IAAI;CAyBlB"}
+{"version":3,"file":"HttpUserRepository.d.mts","sourceRoot":"","sources":["../../src/repositories/HttpUserRepository.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAuBrE,qBAAa,kBAAmB,YAAW,cAAc;IACxD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,OAAO,CAAS;gBAEZ,EACX,eAAe,EACf,sBAAsB,EACtB,OAAO,GACP,EAAE;QACF,eAAe,EAAE,MAAM,CAAC;QACxB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC;KAChB;IAMK,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAItE,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YAIhD,IAAI;CAiClB"}

package/dist/repositories/HttpUserRepository.mjs

@@ -13,6 +13,27 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+/**
+ * Runtime guard for the upstream user-service response. The previous
+ * `(await res.json()) as User` was a compile-time cast only — a malformed
+ * upstream payload (`{ status: "ok" }`, schema migration, tampered
+ * response) silently produced a `User` with `undefined` required fields,
+ * leaking `sub: undefined` into the authentication flow.
+ *
+ * The guard accepts any object with string `id` and `username`,
+ * preserving the index-signature `[key: string]: unknown` extras that
+ * `User` allows. Empty strings pass — bcrypt compare and downstream
+ * gates prevent empty-credential authentication in practice; tightening
+ * to `.min(1)` is a Phase F follow-up if needed.
+ *
+ * Per TS-2 (Wave 5g).
+ */
+function isUser(v) {
+    if (typeof v !== "object" || v === null)
+        return false;
+    const o = v;
+    return typeof o.id === "string" && typeof o.username === "string";
+}
 export class HttpUserRepository {
     authenticateUrl;
     authenticateByTokenUrl;
@@ -39,7 +60,15 @@ export class HttpUserRepository {
                 signal: controller.signal,
             });
             if (res.ok) {
-                return (await res.json());
+                const parsed = await res.json();
+                if (!isUser(parsed)) {
+                    // Upstream returned 2xx with an unexpected shape — this is an
+                    // "upstream is broken" case, not a "user not found" case, so
+                    // throw rather than return null. The thrown error propagates
+                    // as a 500 to the client (correct: upstream-service failure).
+                    throw new Error(`HttpUserRepository: upstream ${url} returned an invalid User shape`);
+                }
+                return parsed;
             }
             if (res.status === 401 || res.status === 403) {
                 return null;

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@o3co/auth-provider-foundation",
   "description": "Production HTTP user-authentication adapter for auth.provider",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "license": "Apache-2.0",
+  "engines": {
+    "node": ">=18.19.0"
+  },
   "type": "module",
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.mts",
@@ -37,7 +40,7 @@
     "pino": "^10.3.1",
     "vitest": "^4.1.2",
     "@vitest/coverage-v8": "^4.1.2",
-    "@o3co/auth-provider-core": "0.5.1"
+    "@o3co/auth-provider-core": "0.5.2"
   },
   "scripts": {
     "prebuild": "rimraf dist",

package/dist/repositories/__tests__/HttpUserRepository.test.d.mts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=HttpUserRepository.test.d.mts.map

package/dist/repositories/__tests__/HttpUserRepository.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"HttpUserRepository.test.d.mts","sourceRoot":"","sources":["../../../src/repositories/__tests__/HttpUserRepository.test.mts"],"names":[],"mappings":""}

package/dist/repositories/__tests__/HttpUserRepository.test.mjs

@@ -1,89 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { HttpResponse, http } from "msw";
-import { setupServer } from "msw/node";
-import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
-import { HttpUserRepository } from "../HttpUserRepository.mjs";
-const BASE_URL = "http://localhost:18080";
-const mockUser = { id: "user-1", username: "alice" };
-const handlers = [
-    http.post(`${BASE_URL}/user/authenticate`, async ({ request }) => {
-        const body = (await request.json());
-        if (body.email === "alice@example.com" && body.password === "correct-pass") {
-            return HttpResponse.json(mockUser, { status: 200 });
-        }
-        return new HttpResponse(null, { status: 401 });
-    }),
-    http.post(`${BASE_URL}/user/authenticate/token`, async ({ request }) => {
-        const body = (await request.json());
-        if (body.token === "valid-token") {
-            return HttpResponse.json(mockUser, { status: 200 });
-        }
-        return new HttpResponse(null, { status: 401 });
-    }),
-];
-const server = setupServer(...handlers);
-beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
-afterEach(() => server.resetHandlers());
-afterAll(() => server.close());
-describe("HttpUserRepository", () => {
-    const repo = new HttpUserRepository({
-        authenticateUrl: `${BASE_URL}/user/authenticate`,
-        authenticateByTokenUrl: `${BASE_URL}/user/authenticate/token`,
-        timeout: 5000,
-    });
-    describe("authenticate", () => {
-        it("returns user on success", async () => {
-            const user = await repo.authenticate("alice@example.com", "correct-pass");
-            expect(user).not.toBeNull();
-            expect(user?.id).toBe("user-1");
-            expect(user?.username).toBe("alice");
-        });
-        it("sends email field (not username) in request body", async () => {
-            let capturedBody = null;
-            server.use(http.post(`${BASE_URL}/user/authenticate`, async ({ request }) => {
-                capturedBody = (await request.json());
-                return HttpResponse.json(mockUser, { status: 200 });
-            }));
-            await repo.authenticate("alice@example.com", "correct-pass");
-            expect(capturedBody).not.toBeNull();
-            expect(capturedBody).toHaveProperty("email", "alice@example.com");
-            expect(capturedBody).not.toHaveProperty("username");
-        });
-        it("returns null on 401", async () => {
-            const user = await repo.authenticate("alice@example.com", "wrong-pass");
-            expect(user).toBeNull();
-        });
-        it("throws on unexpected HTTP status", async () => {
-            server.use(http.post(`${BASE_URL}/user/authenticate`, () => {
-                return new HttpResponse(null, { status: 500 });
-            }));
-            await expect(repo.authenticate("alice@example.com", "pass")).rejects.toThrow("Unexpected HTTP status 500");
-        });
-    });
-    describe("authenticateByToken", () => {
-        it("returns user on success", async () => {
-            const user = await repo.authenticateByToken("valid-token");
-            expect(user).not.toBeNull();
-            expect(user?.id).toBe("user-1");
-            expect(user?.username).toBe("alice");
-        });
-        it("returns null on 401", async () => {
-            const user = await repo.authenticateByToken("invalid-token");
-            expect(user).toBeNull();
-        });
-    });
-});

package/dist/repositories/__tests__/registerBuiltinAdapters.test.d.mts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=registerBuiltinAdapters.test.d.mts.map

package/dist/repositories/__tests__/registerBuiltinAdapters.test.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registerBuiltinAdapters.test.d.mts","sourceRoot":"","sources":["../../../src/repositories/__tests__/registerBuiltinAdapters.test.mts"],"names":[],"mappings":""}

package/dist/repositories/__tests__/registerBuiltinAdapters.test.mjs

@@ -1,92 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { AdapterFactoryError, createAdapterFactory, } from "@o3co/auth-provider-core";
-import { HttpResponse, http } from "msw";
-import { setupServer } from "msw/node";
-import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
-import { registerBuiltinAdapters } from "#/index.mjs";
-const BASE_URL = "http://localhost:19090";
-const mockUser = { id: "u1", username: "alice" };
-const server = setupServer(http.post(`${BASE_URL}/auth`, async ({ request }) => {
-    const body = (await request.json());
-    if (body.email === "alice" && body.password === "pass") {
-        return HttpResponse.json(mockUser, { status: 200 });
-    }
-    return new HttpResponse(null, { status: 401 });
-}), http.post(`${BASE_URL}/auth/token`, async ({ request }) => {
-    const body = (await request.json());
-    if (body.token === "valid") {
-        return HttpResponse.json(mockUser, { status: 200 });
-    }
-    return new HttpResponse(null, { status: 401 });
-}));
-beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
-afterEach(() => server.resetHandlers());
-afterAll(() => server.close());
-describe("registerBuiltinAdapters", () => {
-    it("registers 'http' type in userFactory", async () => {
-        const userFactory = createAdapterFactory("UserRepository");
-        registerBuiltinAdapters({ userFactory });
-        try {
-            await userFactory.create({ type: "unknown" });
-            throw new Error("should have thrown");
-        }
-        catch (err) {
-            expect(err).toBeInstanceOf(AdapterFactoryError);
-            const e = err;
-            expect(e.reason).toBe("unknown");
-            expect(e.kind).toBe("UserRepository");
-            expect(e.registered).toContain("http");
-        }
-    });
-    it("http builder creates a working HttpUserRepository", async () => {
-        const userFactory = createAdapterFactory("UserRepository");
-        registerBuiltinAdapters({ userFactory });
-        const repo = await userFactory.create({
-            type: "http",
-            authenticateUrl: `${BASE_URL}/auth`,
-            authenticateByTokenUrl: `${BASE_URL}/auth/token`,
-            timeout: 5000,
-        });
-        const user = await repo.authenticate("alice", "pass");
-        expect(user).not.toBeNull();
-        expect(user?.username).toBe("alice");
-        const byToken = await repo.authenticateByToken("valid");
-        expect(byToken).not.toBeNull();
-        const invalid = await repo.authenticate("alice", "wrong");
-        expect(invalid).toBeNull();
-    });
-    it("http builder coerces string timeout to number (env-override path)", async () => {
-        const userFactory = createAdapterFactory("UserRepository");
-        registerBuiltinAdapters({ userFactory });
-        const repo = await userFactory.create({
-            type: "http",
-            authenticateUrl: `${BASE_URL}/auth`,
-            authenticateByTokenUrl: `${BASE_URL}/auth/token`,
-            timeout: "1234", // string, as HOCON env override produces
-        });
-        expect(repo).toBeDefined();
-        // HttpUserRepository doesn't expose timeout publicly; we verify it didn't throw
-        // and works via the MSW fixture. The coercion path is internal.
-        const user = await repo.authenticate("alice", "pass");
-        expect(user).not.toBeNull();
-    });
-    it("http builder throws when authenticateUrl is missing", async () => {
-        const userFactory = createAdapterFactory("UserRepository");
-        registerBuiltinAdapters({ userFactory });
-        await expect(userFactory.create({ type: "http", timeout: 5000 })).rejects.toThrow(/authenticateUrl/);
-    });
-});