@omg-dev/server 0.4.24

package/src/test/schema-swap.test.ts

@@ -0,0 +1,252 @@
+import { describe, it, expect, afterEach } from "bun:test"
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { defineSchema, collection, fields } from "@omg-dev/schema"
+import { createVibesServer, type VibesServerInstance } from "../index.ts"
+
+// Reproduces the dev-server bug a new app hit when its template ships
+// `schema.ts` with `collections: {}` and the agent then adds collections:
+// before the fix, `instance.migrate(newSchema)` was a no-op because the
+// closure-captured `dbInstance` and `schema` were both empty at boot, so
+// the DB never opened and no auto-CRUD routes were ever mounted.
+
+let cleanups: VibesServerInstance[] = []
+const tmpDirs: string[] = []
+
+afterEach(async () => {
+  for (const inst of cleanups) inst.close()
+  cleanups = []
+  for (const dir of tmpDirs) rmSync(dir, { recursive: true, force: true })
+  tmpDirs.length = 0
+})
+
+function mkRoot(): string {
+  const dir = mkdtempSync(join(tmpdir(), "vibes-schema-swap-"))
+  // bun:sqlite's `create: true` won't create missing parent directories,
+  // and the production code joins root + ".vibes/data.db".
+  mkdirSync(join(dir, ".vibes"), { recursive: true })
+  tmpDirs.push(dir)
+  return dir
+}
+
+async function makeServer(opts: {
+  root: string
+  schema?: ReturnType<typeof defineSchema>
+}): Promise<VibesServerInstance> {
+  const inst = await createVibesServer({
+    root: opts.root,
+    db: ".vibes/data.db",
+    auth: undefined,
+    schema: opts.schema,
+  })
+  cleanups.push(inst)
+  return inst
+}
+
+describe("createVibesServer — schema swap via migrate(newSchema)", () => {
+  it("a server booted with empty collections returns 404 for /api/<col> until migrate(newSchema) lands", async () => {
+    const root = mkRoot()
+    const empty = defineSchema({ collections: {} })
+    const inst = await makeServer({ root, schema: empty })
+
+    // Before swap: no auto-routes, dispatcher 404s.
+    const before = await inst.apiHandler(new Request("http://x/api/todos"))
+    expect(before.status).toBe(404)
+
+    const withTodos = defineSchema({
+      collections: {
+        todos: collection({
+          fields: {
+            text: fields.string(),
+            done: fields.boolean(),
+          },
+        }).scoped("global"),
+      },
+    })
+    inst.migrate(withTodos)
+
+    const list = await inst.apiHandler(new Request("http://x/api/todos"))
+    expect(list.status).toBe(200)
+    expect(await list.json()).toEqual([])
+
+    const created = await inst.apiHandler(
+      new Request("http://x/api/todos", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ text: "buy milk", done: false }),
+      }),
+    )
+    expect(created.status).toBe(200)
+    const row = (await created.json()) as { id: string; text: string; done: boolean }
+    expect(row.text).toBe("buy milk")
+    expect(row.done).toBe(false)
+    expect(typeof row.id).toBe("string")
+
+    const list2 = await inst.apiHandler(new Request("http://x/api/todos"))
+    const list2Body = (await list2.json()) as Array<{ text: string }>
+    expect(list2Body).toHaveLength(1)
+    expect(list2Body[0].text).toBe("buy milk")
+  })
+
+  it("a server booted with no schema at all picks up collections via migrate(newSchema)", async () => {
+    const root = mkRoot()
+    const inst = await makeServer({ root, schema: undefined })
+
+    const before = await inst.apiHandler(new Request("http://x/api/notes"))
+    expect(before.status).toBe(404)
+
+    inst.migrate(
+      defineSchema({
+        collections: {
+          notes: collection({ fields: { body: fields.string() } }).scoped("global"),
+        },
+      }),
+    )
+
+    const created = await inst.apiHandler(
+      new Request("http://x/api/notes", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ body: "hello" }),
+      }),
+    )
+    expect(created.status).toBe(200)
+  })
+
+  it("a follow-up migrate(newSchema) adds another collection without losing the first one's data", async () => {
+    const root = mkRoot()
+    const v1 = defineSchema({
+      collections: {
+        todos: collection({ fields: { text: fields.string() } }).scoped("global"),
+      },
+    })
+    const inst = await makeServer({ root, schema: v1 })
+
+    const created = await inst.apiHandler(
+      new Request("http://x/api/todos", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ text: "first" }),
+      }),
+    )
+    expect(created.status).toBe(200)
+
+    const v2 = defineSchema({
+      collections: {
+        todos: collection({ fields: { text: fields.string() } }).scoped("global"),
+        tags: collection({ fields: { name: fields.string() } }).scoped("global"),
+      },
+    })
+    inst.migrate(v2)
+
+    // New collection now has its own auto-routes…
+    const tagPost = await inst.apiHandler(
+      new Request("http://x/api/tags", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ name: "urgent" }),
+      }),
+    )
+    expect(tagPost.status).toBe(200)
+
+    // …and the original todos row is still readable.
+    const todos = await inst.apiHandler(new Request("http://x/api/todos"))
+    const list = (await todos.json()) as Array<{ text: string }>
+    expect(list).toHaveLength(1)
+    expect(list[0].text).toBe("first")
+  })
+
+  it("a new functions/*.ts added after boot becomes reachable after reloadFunctions() rescans routes.json", async () => {
+    // Reproduces the streaming-chat 404: pi creates functions/api/chat.ts
+    // after the dev server has already booted with an empty functions/.
+    // Vite's HMR handler regenerates .vibes/routes.json and calls
+    // reloadFunctions(), but the server's in-memory route table is stale
+    // until reloadFunctions() also re-reads the file. Without that, every
+    // POST /api/chat returns 404 even though the file is on disk.
+    const root = mkRoot()
+    const inst = await makeServer({ root, schema: undefined })
+
+    // Empty functions/ at boot → no explicit routes registered.
+    const before = await inst.apiHandler(
+      new Request("http://x/api/chat", { method: "POST" }),
+    )
+    expect(before.status).toBe(404)
+
+    // Simulate what the vite plugin's HMR + regenerateRoutes does.
+    writeFileSync(
+      join(root, ".vibes", "routes.json"),
+      JSON.stringify([
+        {
+          method: "POST",
+          path: "/api/chat",
+          module: "<test>",
+          handler: "POST",
+          style: "method",
+          // inlineHandler is the dispatcher's fast path — used here so we
+          // don't need to dynamic-import a real module from a tmp dir.
+          inlineHandler: undefined,
+        },
+      ]),
+    )
+    // The dispatcher needs a runnable handler. The on-disk routes.json
+    // can't carry one (it's JSON); production resolves `module` via
+    // dynamic import. For this test we patch in an inlineHandler the
+    // same way auto-CRUD does, by handing reloadFunctions a routes file
+    // and then replacing the table entry through a second call.
+    inst.reloadFunctions()
+
+    // After reload, the route is registered but its handler can't load
+    // (no real module). Confirm the route is now wired by checking
+    // status moved off 404. A 500 from "Failed to load module" is the
+    // expected signal that the route table contains it.
+    const after = await inst.apiHandler(
+      new Request("http://x/api/chat", { method: "POST" }),
+    )
+    expect(after.status).not.toBe(404)
+  })
+
+  it("explicit function-file routes survive a schema swap and still shadow auto-routes at the same (method, path)", async () => {
+    const root = mkRoot()
+    const inst = await createVibesServer({
+      root,
+      db: ".vibes/data.db",
+      auth: undefined,
+      schema: defineSchema({ collections: {} }),
+      // Simulate a routes.json-loaded function-file handler at POST /api/todos
+      // that should keep winning even after auto-CRUD routes are mounted.
+      routes: [
+        {
+          method: "POST",
+          path: "/api/todos",
+          module: "<test>",
+          handler: "create",
+          inlineHandler: async () => Response.json({ from: "explicit" }, { status: 201 }),
+        },
+      ],
+    })
+    cleanups.push(inst)
+
+    inst.migrate(
+      defineSchema({
+        collections: {
+          todos: collection({ fields: { text: fields.string() } }).scoped("global"),
+        },
+      }),
+    )
+
+    const post = await inst.apiHandler(
+      new Request("http://x/api/todos", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ text: "x" }),
+      }),
+    )
+    expect(post.status).toBe(201)
+    expect(await post.json()).toEqual({ from: "explicit" })
+
+    // The auto-route GET /api/todos still mounted (no explicit override).
+    const list = await inst.apiHandler(new Request("http://x/api/todos"))
+    expect(list.status).toBe(200)
+  })
+})

package/src/test/security.test.ts

@@ -0,0 +1,323 @@
+import { describe, it, expect, beforeEach, afterEach } from "bun:test"
+import { openDb, markScoped, setDbInstance, VibesAuthRequiredError, type VibesDb } from "../db.ts"
+import { ctxStore } from "../ctx.ts"
+import { addClient, removeClient, invalidate, clientCount } from "../broker.ts"
+import { Database } from "bun:sqlite"
+import fs from "node:fs"
+import path from "node:path"
+import os from "node:os"
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+function tmpDbPath(): string {
+  return path.join(os.tmpdir(), `vibes-test-${crypto.randomUUID()}.db`)
+}
+
+function createTable(raw: Database, name: string, scoped: boolean) {
+  const ownerCol = scoped ? ", _owner TEXT" : ""
+  raw.exec(`CREATE TABLE ${name} (
+    id TEXT PRIMARY KEY,
+    created_at TEXT,
+    updated_at TEXT,
+    title TEXT
+    ${ownerCol}
+  )`)
+  if (scoped) markScoped(name)
+}
+
+// ── Scoped data isolation ────────────────────────────────────────────────────
+
+describe("scoped collection security", () => {
+  let db: VibesDb
+  let dbPath: string
+
+  beforeEach(() => {
+    dbPath = tmpDbPath()
+    db = openDb(dbPath)
+    setDbInstance(db)
+    createTable(db.raw(), "notes", true)
+  })
+
+  afterEach(() => {
+    db.close()
+    try { fs.unlinkSync(dbPath) } catch {}
+    try { fs.unlinkSync(dbPath + "-shm") } catch {}
+    try { fs.unlinkSync(dbPath + "-wal") } catch {}
+  })
+
+  it("insert stamps _owner from ctx.userId", async () => {
+    const record = await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("notes", { title: "secret" })
+    )
+    expect(record._owner).toBe("user-a")
+  })
+
+  it("list only returns records owned by ctx.userId", async () => {
+    await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("notes", { title: "A's note" })
+    )
+    await ctxStore.run({ userId: "user-b" }, () =>
+      db.insert("notes", { title: "B's note" })
+    )
+
+    const aResults = await ctxStore.run({ userId: "user-a" }, () =>
+      db.getAll("notes")
+    )
+    const bResults = await ctxStore.run({ userId: "user-b" }, () =>
+      db.getAll("notes")
+    )
+
+    expect(aResults).toHaveLength(1)
+    expect(aResults[0].title).toBe("A's note")
+    expect(bResults).toHaveLength(1)
+    expect(bResults[0].title).toBe("B's note")
+  })
+
+  it("get returns null for another user's record", async () => {
+    const record = await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("notes", { title: "private" })
+    )
+
+    const result = await ctxStore.run({ userId: "user-b" }, () =>
+      db.get("notes", record.id as string)
+    )
+
+    expect(result).toBeNull()
+  })
+
+  it("update returns null for another user's record", async () => {
+    const record = await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("notes", { title: "original" })
+    )
+
+    const result = await ctxStore.run({ userId: "user-b" }, () =>
+      db.update("notes", record.id as string, { title: "hacked" })
+    )
+
+    expect(result).toBeNull()
+
+    // Verify original is unchanged
+    const original = await ctxStore.run({ userId: "user-a" }, () =>
+      db.get("notes", record.id as string)
+    )
+    expect(original!.title).toBe("original")
+  })
+
+  it("delete fails for another user's record", async () => {
+    const record = await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("notes", { title: "protected" })
+    )
+
+    const deleted = await ctxStore.run({ userId: "user-b" }, () =>
+      db.delete("notes", record.id as string)
+    )
+
+    expect(deleted).toBe(false)
+
+    // Verify still exists
+    const still = await ctxStore.run({ userId: "user-a" }, () =>
+      db.get("notes", record.id as string)
+    )
+    expect(still).not.toBeNull()
+  })
+
+  // ── Unauthenticated requests against scoped tables ──────────────────────
+  //
+  // Regression coverage for the auth-bypass CVE: prior behavior was that
+  // when ctx.userId was null (legitimate for unauth requests reaching the
+  // apiHandler), the `_owner = ?` predicate was silently omitted and the
+  // operation ran against EVERY user's rows. Each op must now refuse.
+
+  it("getAll throws VibesAuthRequiredError when ctx has no userId", async () => {
+    await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("notes", { title: "secret" })
+    )
+    const attempt = ctxStore.run({ userId: null }, () => db.getAll("notes"))
+    expect(attempt).rejects.toThrow(VibesAuthRequiredError)
+  })
+
+  it("get throws VibesAuthRequiredError when ctx has no userId", async () => {
+    const r = await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("notes", { title: "secret" })
+    )
+    const attempt = ctxStore.run({ userId: null }, () =>
+      db.get("notes", r.id as string),
+    )
+    expect(attempt).rejects.toThrow(VibesAuthRequiredError)
+  })
+
+  it("insert throws VibesAuthRequiredError when ctx has no userId", async () => {
+    const attempt = ctxStore.run({ userId: null }, () =>
+      db.insert("notes", { title: "anon write" }),
+    )
+    expect(attempt).rejects.toThrow(VibesAuthRequiredError)
+  })
+
+  it("update throws VibesAuthRequiredError when ctx has no userId", async () => {
+    const r = await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("notes", { title: "original" })
+    )
+    const attempt = ctxStore.run({ userId: null }, () =>
+      db.update("notes", r.id as string, { title: "hijack" }),
+    )
+    expect(attempt).rejects.toThrow(VibesAuthRequiredError)
+  })
+
+  it("delete throws VibesAuthRequiredError when ctx has no userId", async () => {
+    const r = await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("notes", { title: "victim" })
+    )
+    const attempt = ctxStore.run({ userId: null }, () =>
+      db.delete("notes", r.id as string),
+    )
+    expect(attempt).rejects.toThrow(VibesAuthRequiredError)
+  })
+})
+
+// ── Non-scoped collections ───────────────────────────────────────────────────
+
+describe("non-scoped collection", () => {
+  let db: VibesDb
+  let dbPath: string
+
+  beforeEach(() => {
+    dbPath = tmpDbPath()
+    db = openDb(dbPath)
+    setDbInstance(db)
+    createTable(db.raw(), "posts", false)
+  })
+
+  afterEach(() => {
+    db.close()
+    try { fs.unlinkSync(dbPath) } catch {}
+    try { fs.unlinkSync(dbPath + "-shm") } catch {}
+    try { fs.unlinkSync(dbPath + "-wal") } catch {}
+  })
+
+  it("all users see all records", async () => {
+    await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("posts", { title: "public post" })
+    )
+
+    const results = await ctxStore.run({ userId: "user-b" }, () =>
+      db.getAll("posts")
+    )
+
+    expect(results).toHaveLength(1)
+    expect(results[0].title).toBe("public post")
+  })
+
+  it("any user can update any record", async () => {
+    const record = await ctxStore.run({ userId: "user-a" }, () =>
+      db.insert("posts", { title: "original" })
+    )
+
+    const updated = await ctxStore.run({ userId: "user-b" }, () =>
+      db.update("posts", record.id as string, { title: "edited by B" })
+    )
+
+    expect(updated).not.toBeNull()
+    expect(updated!.title).toBe("edited by B")
+  })
+})
+
+// ── Broker invalidation ─────────────────────────────────────────────────────
+
+describe("broker invalidation", () => {
+  it("sends invalidation signal to connected clients", () => {
+    const messages: string[] = []
+    const client = {
+      readyState: 1,
+      send(data: string) { messages.push(data) },
+    }
+
+    addClient(client)
+    invalidate("entries")
+    removeClient(client)
+
+    expect(messages).toHaveLength(1)
+    const event = JSON.parse(messages[0])
+    expect(event.type).toBe("invalidate")
+    expect(event.collection).toBe("entries")
+  })
+
+  it("does not include any record data in events", () => {
+    const messages: string[] = []
+    const client = {
+      readyState: 1,
+      send(data: string) { messages.push(data) },
+    }
+
+    addClient(client)
+    invalidate("entries")
+    removeClient(client)
+
+    const event = JSON.parse(messages[0])
+    expect(event.data).toBeUndefined()
+    expect(event.id).toBeUndefined()
+    expect(event._owner).toBeUndefined()
+  })
+
+  it("skips disconnected clients", () => {
+    const messages: string[] = []
+    const connected = { readyState: 1, send(d: string) { messages.push(d) } }
+    const disconnected = { readyState: 3, send(_d: string) { throw new Error("should not send") } }
+
+    addClient(connected)
+    addClient(disconnected)
+    invalidate("entries")
+    removeClient(connected)
+    removeClient(disconnected)
+
+    expect(messages).toHaveLength(1)
+  })
+
+  it("removes client that throws on send", () => {
+    const broken = {
+      readyState: 1,
+      send(_d: string) { throw new Error("broken pipe") },
+    }
+
+    addClient(broken)
+    invalidate("entries")
+
+    expect(clientCount()).toBe(0)
+  })
+
+  it("mutations trigger invalidation", async () => {
+    const dbPath = tmpDbPath()
+    const db = openDb(dbPath)
+    setDbInstance(db)
+    createTable(db.raw(), "items", false)
+
+    const messages: string[] = []
+    const client = { readyState: 1, send(d: string) { messages.push(d) } }
+    addClient(client)
+
+    // Insert
+    const record = await db.insert("items", { title: "test" })
+    expect(messages).toHaveLength(1)
+    expect(JSON.parse(messages[0]).collection).toBe("items")
+
+    // Update
+    await db.update("items", record.id as string, { title: "updated" })
+    expect(messages).toHaveLength(2)
+
+    // Delete
+    await db.delete("items", record.id as string)
+    expect(messages).toHaveLength(3)
+
+    // All events are invalidation-only
+    for (const msg of messages) {
+      const event = JSON.parse(msg)
+      expect(event.type).toBe("invalidate")
+      expect(event.data).toBeUndefined()
+    }
+
+    removeClient(client)
+    db.close()
+    try { fs.unlinkSync(dbPath) } catch {}
+    try { fs.unlinkSync(dbPath + "-shm") } catch {}
+    try { fs.unlinkSync(dbPath + "-wal") } catch {}
+  })
+})