@omg-dev/server 0.4.24

package/src/test/auto-crud.test.ts

@@ -0,0 +1,385 @@
+import { describe, it, expect, beforeEach, afterEach } from "bun:test"
+import { defineSchema, collection, fields, schemaToSQL, type Schema } from "@omg-dev/schema"
+import { openDb, setDbInstance, markScoped, type VibesDb } from "../db.ts"
+import { addClient, removeClient } from "../broker.ts"
+import { buildAutoCrudRoutes } from "../auto-crud.ts"
+import { handleRequest, type Route } from "../dispatcher.ts"
+import { ctxStore } from "../ctx.ts"
+
+// ── Fixture ──────────────────────────────────────────────────────────────────
+
+function makeSchema(): Schema {
+  return defineSchema({
+    collections: {
+      tasks: collection({
+        fields: {
+          title: fields.string(),
+          done: fields.boolean(),
+        },
+      }).scoped("global"),
+    },
+  })
+}
+
+let db: VibesDb
+let schema: Schema
+
+beforeEach(() => {
+  schema = makeSchema()
+  db = openDb(":memory:")
+  setDbInstance(db)
+  for (const sql of schemaToSQL(schema)) db.raw().exec(sql)
+})
+
+afterEach(() => {
+  db.close()
+})
+
+// ── Route shape ──────────────────────────────────────────────────────────────
+
+describe("buildAutoCrudRoutes — route shape", () => {
+  it("emits 5 routes per collection with correct verb/path", () => {
+    const routes = buildAutoCrudRoutes(schema)
+    expect(routes).toHaveLength(5)
+
+    const byKey = new Map(routes.map(r => [`${r.method} ${r.path}`, r]))
+    expect(byKey.has("GET /api/tasks")).toBe(true)
+    expect(byKey.has("GET /api/tasks/:id")).toBe(true)
+    expect(byKey.has("POST /api/tasks")).toBe(true)
+    expect(byKey.has("PATCH /api/tasks/:id")).toBe(true)
+    expect(byKey.has("DELETE /api/tasks/:id")).toBe(true)
+
+    expect(byKey.get("GET /api/tasks")!.handler).toBe("list")
+    expect(byKey.get("GET /api/tasks/:id")!.handler).toBe("get")
+    expect(byKey.get("POST /api/tasks")!.handler).toBe("create")
+    expect(byKey.get("PATCH /api/tasks/:id")!.handler).toBe("update")
+    expect(byKey.get("DELETE /api/tasks/:id")!.handler).toBe("remove")
+
+    for (const r of routes) {
+      expect(typeof r.inlineHandler).toBe("function")
+    }
+  })
+})
+
+// ── End-to-end ───────────────────────────────────────────────────────────────
+
+describe("auto-crud — end-to-end via apiHandler", () => {
+  it("supports POST → GET → PATCH → DELETE → GET", async () => {
+    const routes = buildAutoCrudRoutes(schema)
+
+    // POST
+    const createRes = await handleRequest(
+      new Request("http://x/api/tasks", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title: "x", done: false }),
+      }),
+      routes,
+    )
+    expect(createRes.status).toBe(200)
+    const created = await createRes.json() as { id: string; title: string; done: boolean }
+    expect(typeof created.id).toBe("string")
+    expect(created.title).toBe("x")
+    expect(created.done).toBe(false)
+
+    // GET list
+    const listRes1 = await handleRequest(new Request("http://x/api/tasks"), routes)
+    expect(listRes1.status).toBe(200)
+    const list1 = await listRes1.json() as Array<{ id: string; done: boolean }>
+    expect(list1).toHaveLength(1)
+    expect(list1[0].done).toBe(false)
+
+    // PATCH
+    const patchRes = await handleRequest(
+      new Request(`http://x/api/tasks/${created.id}`, {
+        method: "PATCH",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ done: true }),
+      }),
+      routes,
+    )
+    expect(patchRes.status).toBe(200)
+    const patched = await patchRes.json() as { done: boolean }
+    expect(patched.done).toBe(true)
+
+    // GET list again — done flips
+    const listRes2 = await handleRequest(new Request("http://x/api/tasks"), routes)
+    const list2 = await listRes2.json() as Array<{ done: boolean }>
+    expect(list2[0].done).toBe(true)
+
+    // DELETE
+    const delRes = await handleRequest(
+      new Request(`http://x/api/tasks/${created.id}`, { method: "DELETE" }),
+      routes,
+    )
+    expect(delRes.status).toBe(204)
+
+    // GET list — empty
+    const listRes3 = await handleRequest(new Request("http://x/api/tasks"), routes)
+    const list3 = await listRes3.json() as unknown[]
+    expect(list3).toHaveLength(0)
+  })
+
+  it("PATCH returns 404 for unknown id", async () => {
+    const routes = buildAutoCrudRoutes(schema)
+    const res = await handleRequest(
+      new Request("http://x/api/tasks/nope", {
+        method: "PATCH",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ done: true }),
+      }),
+      routes,
+    )
+    expect(res.status).toBe(404)
+  })
+
+  it("PATCH rejects unknown columns", async () => {
+    const routes = buildAutoCrudRoutes(schema)
+    const createRes = await handleRequest(
+      new Request("http://x/api/tasks", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title: "x", done: false }),
+      }),
+      routes,
+    )
+    const created = await createRes.json() as { id: string }
+    const res = await handleRequest(
+      new Request(`http://x/api/tasks/${created.id}`, {
+        method: "PATCH",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ malicious: 1 }),
+      }),
+      routes,
+    )
+    expect(res.status).toBe(400)
+  })
+})
+
+// ── Override precedence ──────────────────────────────────────────────────────
+
+describe("auto-crud — function-file precedence", () => {
+  it("explicit route at same (method, path) shadows the auto-route", async () => {
+    // Simulate the merge done in createVibesServer: explicit first.
+    const explicit: Route = {
+      method: "POST",
+      path: "/api/tasks",
+      module: "<test>",
+      handler: "create",
+      inlineHandler: async () => Response.json({ from: "explicit" }, { status: 201 }),
+    }
+
+    const auto = buildAutoCrudRoutes(schema)
+    const explicitKeys = new Set([`${explicit.method} ${explicit.path}`])
+    const merged = [...auto.filter(r => !explicitKeys.has(`${r.method} ${r.path}`)), explicit]
+
+    const res = await handleRequest(
+      new Request("http://x/api/tasks", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title: "x", done: false }),
+      }),
+      merged,
+    )
+    expect(res.status).toBe(201)
+    const body = await res.json() as { from: string }
+    expect(body.from).toBe("explicit")
+  })
+})
+
+// ── User-scoped collections ──────────────────────────────────────────────────
+
+function makeScopedSchema(): Schema {
+  return defineSchema({
+    collections: {
+      notes: collection({
+        fields: {
+          title: fields.string(),
+        },
+      }).scoped("user"),
+    },
+  })
+}
+
+describe("auto-crud — scope:user", () => {
+  let scopedDb: VibesDb
+  let scopedSchema: Schema
+
+  beforeEach(() => {
+    scopedSchema = makeScopedSchema()
+    scopedDb = openDb(":memory:")
+    setDbInstance(scopedDb)
+    for (const sql of schemaToSQL(scopedSchema)) scopedDb.raw().exec(sql)
+    markScoped("notes")
+  })
+
+  afterEach(() => {
+    scopedDb.close()
+  })
+
+  function runAs(userId: string | null, fn: () => Promise<Response>): Promise<Response> {
+    return ctxStore.run({ userId }, fn)
+  }
+
+  it("create stamps _owner from ctx and lists filter by owner", async () => {
+    const routes = buildAutoCrudRoutes(scopedSchema)
+
+    const aRes = await runAs("user-a", () => handleRequest(
+      new Request("http://x/api/notes", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title: "A's note" }),
+      }),
+      routes,
+    ))
+    expect(aRes.status).toBe(200)
+    const aRow = await aRes.json() as { id: string; _owner: string }
+    expect(aRow._owner).toBe("user-a")
+
+    await runAs("user-b", () => handleRequest(
+      new Request("http://x/api/notes", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title: "B's note" }),
+      }),
+      routes,
+    ))
+
+    const aListRes = await runAs("user-a", () => handleRequest(
+      new Request("http://x/api/notes"),
+      routes,
+    ))
+    const aList = await aListRes.json() as Array<{ title: string }>
+    expect(aList).toHaveLength(1)
+    expect(aList[0].title).toBe("A's note")
+
+    const bListRes = await runAs("user-b", () => handleRequest(
+      new Request("http://x/api/notes"),
+      routes,
+    ))
+    const bList = await bListRes.json() as Array<{ title: string }>
+    expect(bList).toHaveLength(1)
+    expect(bList[0].title).toBe("B's note")
+  })
+
+  it("returns 401 when listing scoped collection anonymously", async () => {
+    const routes = buildAutoCrudRoutes(scopedSchema)
+    const res = await runAs(null, () => handleRequest(
+      new Request("http://x/api/notes"),
+      routes,
+    ))
+    expect(res.status).toBe(401)
+  })
+
+  it("update by another user returns 404 (no leak)", async () => {
+    const routes = buildAutoCrudRoutes(scopedSchema)
+    const aRes = await runAs("user-a", () => handleRequest(
+      new Request("http://x/api/notes", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title: "A's secret" }),
+      }),
+      routes,
+    ))
+    const a = await aRes.json() as { id: string }
+
+    const patchRes = await runAs("user-b", () => handleRequest(
+      new Request(`http://x/api/notes/${a.id}`, {
+        method: "PATCH",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title: "hacked" }),
+      }),
+      routes,
+    ))
+    expect(patchRes.status).toBe(404)
+
+    // Original is untouched
+    const getRes = await runAs("user-a", () => handleRequest(
+      new Request(`http://x/api/notes/${a.id}`),
+      routes,
+    ))
+    const got = await getRes.json() as { title: string }
+    expect(got.title).toBe("A's secret")
+  })
+
+  it("get returns 404 for another user's record", async () => {
+    const routes = buildAutoCrudRoutes(scopedSchema)
+    const aRes = await runAs("user-a", () => handleRequest(
+      new Request("http://x/api/notes", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title: "private" }),
+      }),
+      routes,
+    ))
+    const a = await aRes.json() as { id: string }
+
+    const bRes = await runAs("user-b", () => handleRequest(
+      new Request(`http://x/api/notes/${a.id}`),
+      routes,
+    ))
+    expect(bRes.status).toBe(404)
+  })
+
+  it("create anonymously on scoped collection returns 401", async () => {
+    const routes = buildAutoCrudRoutes(scopedSchema)
+    const res = await runAs(null, () => handleRequest(
+      new Request("http://x/api/notes", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ title: "anon" }),
+      }),
+      routes,
+    ))
+    expect(res.status).toBe(401)
+  })
+})
+
+// ── Invalidation ─────────────────────────────────────────────────────────────
+
+describe("auto-crud — invalidation", () => {
+  it("create/update/delete each emit invalidate(<collection>)", async () => {
+    const routes = buildAutoCrudRoutes(schema)
+    const messages: string[] = []
+    const client = { readyState: 1, send(d: string) { messages.push(d) } }
+    addClient(client)
+
+    try {
+      const createRes = await handleRequest(
+        new Request("http://x/api/tasks", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ title: "x", done: false }),
+        }),
+        routes,
+      )
+      const created = await createRes.json() as { id: string }
+      expect(messages).toHaveLength(1)
+      expect(JSON.parse(messages[0]).collection).toBe("tasks")
+
+      await handleRequest(
+        new Request(`http://x/api/tasks/${created.id}`, {
+          method: "PATCH",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ done: true }),
+        }),
+        routes,
+      )
+      expect(messages).toHaveLength(2)
+
+      await handleRequest(
+        new Request(`http://x/api/tasks/${created.id}`, { method: "DELETE" }),
+        routes,
+      )
+      expect(messages).toHaveLength(3)
+
+      for (const m of messages) {
+        const ev = JSON.parse(m)
+        expect(ev.type).toBe("invalidate")
+        expect(ev.collection).toBe("tasks")
+      }
+    } finally {
+      removeClient(client)
+    }
+  })
+})

package/src/test/dispatcher.test.ts

@@ -0,0 +1,271 @@
+import { describe, it, expect } from "bun:test"
+import { handleRequest, handlerToRoute, type Route } from "../dispatcher.ts"
+import { VibesAuthRequiredError } from "../db.ts"
+import { VibesHttpError } from "../http-error.ts"
+
+// ── Response passthrough ─────────────────────────────────────────────────────
+//
+// Streaming handlers (e.g. streamText(...).toTextStreamResponse()) rely on
+// the dispatcher returning the Response untouched. Wrapping it via
+// Response.json would coerce the streaming body to "{}" / a JSON snapshot
+// and break SSE/text-stream consumers in the browser.
+
+describe("handleRequest — Response passthrough", () => {
+  it("returns the handler's Response object verbatim when one is returned", async () => {
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode("hello "))
+        controller.enqueue(new TextEncoder().encode("world"))
+        controller.close()
+      },
+    })
+
+    const route: Route = {
+      method: "POST",
+      path: "/api/echo",
+      module: "inline",
+      handler: "create",
+      mod: {
+        create: async () =>
+          new Response(stream, {
+            status: 201,
+            headers: { "Content-Type": "text/plain", "X-Custom": "ok" },
+          }),
+      },
+    }
+
+    const res = await handleRequest(
+      new Request("http://x/api/echo", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({}),
+      }),
+      [route],
+    )
+
+    expect(res.status).toBe(201)
+    expect(res.headers.get("X-Custom")).toBe("ok")
+    expect(res.headers.get("Content-Type")).toContain("text/plain")
+    expect(await res.text()).toBe("hello world")
+  })
+
+  it("still wraps non-Response values via Response.json (CRUD shape unchanged)", async () => {
+    const route: Route = {
+      method: "GET",
+      path: "/api/things",
+      module: "inline",
+      handler: "list",
+      style: "crud",
+      mod: {
+        list: async () => [{ id: "1" }, { id: "2" }],
+      },
+    }
+
+    const res = await handleRequest(new Request("http://x/api/things"), [route])
+    expect(res.status).toBe(200)
+    expect(res.headers.get("Content-Type")).toContain("application/json")
+    expect(await res.json()).toEqual([{ id: "1" }, { id: "2" }])
+  })
+})
+
+// ── Method-style handlers ────────────────────────────────────────────────────
+//
+// Handlers exported as HTTP-method names (POST, GET, ...) receive the raw
+// Request and any path params. The dispatcher must NOT pre-parse the body
+// — the handler may read a streaming body, inspect headers, etc.
+
+describe("handleRequest — method-style routes", () => {
+  it("invokes a POST handler with the raw Request and returns its Response", async () => {
+    let receivedReq: Request | null = null
+    let receivedParams: Record<string, string> | null = null
+
+    const route: Route = {
+      method: "POST",
+      path: "/api/chat",
+      module: "inline",
+      handler: "POST",
+      style: "method",
+      mod: {
+        POST: async (req: Request, params: Record<string, string>) => {
+          receivedReq = req
+          receivedParams = params
+          const body = await req.json() as { messages: string[] }
+          return new Response(`got ${body.messages.length} msgs`, {
+            headers: { "Content-Type": "text/plain" },
+          })
+        },
+      },
+    }
+
+    const res = await handleRequest(
+      new Request("http://x/api/chat", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ messages: ["a", "b", "c"] }),
+      }),
+      [route],
+    )
+    expect(res.status).toBe(200)
+    expect(await res.text()).toBe("got 3 msgs")
+    expect(receivedReq).toBeInstanceOf(Request)
+    expect(receivedParams).toEqual({})
+  })
+
+  it("handlerToRoute classifies HTTP-verb names as method-style", () => {
+    const r = handlerToRoute("chat", "POST", "/x/chat.ts")
+    expect(r.method).toBe("POST")
+    expect(r.path).toBe("/api/chat")
+    expect(r.style).toBe("method")
+  })
+
+  it("handlerToRoute classifies CRUD names with style=crud", () => {
+    const r = handlerToRoute("entries", "list", "/x/entries.ts")
+    expect(r.method).toBe("GET")
+    expect(r.path).toBe("/api/entries")
+    expect(r.style).toBe("crud")
+  })
+})
+
+// ── VibesAuthRequiredError → 401 mapping ─────────────────────────────────────
+//
+// User-authored handlers (and our own auto-crud paths) can throw
+// VibesAuthRequiredError when an unauthenticated request reaches a scoped
+// table operation. The dispatcher must map that to a 401, NOT a 500 — the
+// 500 path would still deny but mislabel the cause in dashboards and
+// surface a confusing "Internal server error" payload to the client.
+
+describe("VibesAuthRequiredError → 401", () => {
+  function makeAuthThrowingRoutes(): Route[] {
+    return [
+      {
+        method: "POST",
+        path: "/api/inline",
+        module: "inline",
+        handler: "_",
+        inlineHandler: async () => {
+          throw new VibesAuthRequiredError("notes")
+        },
+      },
+      {
+        method: "POST",
+        path: "/api/method",
+        module: "inline",
+        handler: "POST",
+        style: "method",
+        mod: {
+          POST: async () => {
+            throw new VibesAuthRequiredError("notes")
+          },
+        },
+      },
+      {
+        method: "GET",
+        path: "/api/crud",
+        module: "inline",
+        handler: "list",
+        style: "crud",
+        mod: {
+          list: async () => {
+            throw new VibesAuthRequiredError("notes")
+          },
+        },
+      },
+    ]
+  }
+
+  it("inline handler throwing VibesAuthRequiredError yields a 401", async () => {
+    const res = await handleRequest(
+      new Request("http://x/api/inline", { method: "POST" }),
+      makeAuthThrowingRoutes(),
+    )
+    expect(res.status).toBe(401)
+    const body = await res.json() as { error: string }
+    expect(body.error).toContain("requires an authenticated user")
+  })
+
+  it("method-style handler throwing VibesAuthRequiredError yields a 401", async () => {
+    const res = await handleRequest(
+      new Request("http://x/api/method", { method: "POST" }),
+      makeAuthThrowingRoutes(),
+    )
+    expect(res.status).toBe(401)
+  })
+
+  it("crud handler throwing VibesAuthRequiredError yields a 401", async () => {
+    const res = await handleRequest(
+      new Request("http://x/api/crud"),
+      makeAuthThrowingRoutes(),
+    )
+    expect(res.status).toBe(401)
+  })
+
+  it("other errors still yield a 500 (regression: don't over-eagerly map)", async () => {
+    const routes: Route[] = [{
+      method: "GET",
+      path: "/api/oops",
+      module: "inline",
+      handler: "list",
+      style: "crud",
+      mod: { list: async () => { throw new Error("boom") } },
+    }]
+    const res = await handleRequest(new Request("http://x/api/oops"), routes)
+    expect(res.status).toBe(500)
+  })
+})
+
+// ── VibesHttpError → its own status ──────────────────────────────────────────
+//
+// Expected refusals (ownership checks, proxied upstream 4xx like the
+// orchestrator's 403 "not your deploy") carry an explicit status. The
+// dispatcher must return that status with the message — NOT a 500 — so the
+// client sees the refusal instead of "Internal server error" and the logs
+// don't record a handler crash for a request that was correctly denied.
+
+describe("VibesHttpError → explicit status", () => {
+  function routesThrowing(err: Error): Route[] {
+    return [{
+      method: "GET",
+      path: "/api/guarded",
+      module: "inline",
+      handler: "list",
+      style: "crud",
+      mod: { list: async () => { throw err } },
+    }]
+  }
+
+  it("a 403 VibesHttpError keeps its status and message", async () => {
+    const res = await handleRequest(
+      new Request("http://x/api/guarded"),
+      routesThrowing(new VibesHttpError(403, "not your deploy")),
+    )
+    expect(res.status).toBe(403)
+    const body = await res.json() as { error: string }
+    expect(body.error).toBe("not your deploy")
+  })
+
+  it("a 404 VibesHttpError keeps its status", async () => {
+    const res = await handleRequest(
+      new Request("http://x/api/guarded"),
+      routesThrowing(new VibesHttpError(404, "no such thing")),
+    )
+    expect(res.status).toBe(404)
+  })
+
+  it("a 502 VibesHttpError (upstream outage) keeps its status", async () => {
+    const res = await handleRequest(
+      new Request("http://x/api/guarded"),
+      routesThrowing(new VibesHttpError(502, "Infra API 524")),
+    )
+    expect(res.status).toBe(502)
+    const body = await res.json() as { error: string }
+    expect(body.error).toBe("Infra API 524")
+  })
+
+  it("a plain Error is still a 500", async () => {
+    const res = await handleRequest(
+      new Request("http://x/api/guarded"),
+      routesThrowing(new Error("vibes-infra GET /v1/sandboxes/x: HTTP 524")),
+    )
+    expect(res.status).toBe(500)
+  })
+})