@pikku/core 0.11.0 → 0.11.2

package/src/middleware/auth-bearer.test.ts

@@ -0,0 +1,447 @@
+import { describe, test, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import { authBearer } from './auth-bearer.js'
+import { resetPikkuState } from '../pikku-state.js'
+import { CoreUserSession } from '../types/core.types.js'
+import { PikkuSessionService } from '../services/user-session-service.js'
+import { InvalidSessionError } from '../errors/errors.js'
+
+beforeEach(() => {
+  resetPikkuState()
+})
+
+const createMockHTTPRequest = (headers: Record<string, string> = {}) => ({
+  header: (name: string) => {
+    // Check both lowercase and exact case
+    return headers[name.toLowerCase()] || headers[name] || null
+  },
+})
+
+const createMockHTTPResponse = () => ({
+  cookie: () => {},
+})
+
+describe('authBearer middleware', () => {
+  test('should extract and decode JWT bearer token from Authorization header', async () => {
+    const mockUserSession: CoreUserSession = { userId: 'user123' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async (token: string) => {
+        assert.equal(token, 'jwt-token')
+        return mockUserSession
+      },
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        session: SessionService,
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer jwt-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.deepEqual(SessionService.get(), mockUserSession)
+  })
+
+  test('should handle case-insensitive Authorization header', async () => {
+    const mockUserSession: CoreUserSession = { userId: 'user456' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async (token: string) => {
+        assert.equal(token, 'jwt-token-2')
+        return mockUserSession
+      },
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        session: SessionService,
+        http: {
+          request: createMockHTTPRequest({
+            Authorization: 'Bearer jwt-token-2',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.deepEqual(SessionService.get(), mockUserSession)
+  })
+
+  test('should validate static token when token option is provided', async () => {
+    const mockUserSession: CoreUserSession = {
+      userId: 'static-user',
+      role: 'admin',
+    }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => {
+        // Should not be called in static token mode
+        assert.fail('JWT decode should not be called in static token mode')
+        return null
+      },
+    }
+
+    const middleware = authBearer({
+      token: {
+        value: 'my-static-token',
+        userSession: mockUserSession,
+      },
+    })
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        session: SessionService,
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer my-static-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.deepEqual(SessionService.get(), mockUserSession)
+  })
+
+  test('should throw InvalidSessionError when scheme is not Bearer', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+
+    await assert.rejects(
+      async () => {
+        await middleware(
+          { jwt: jwtService } as any,
+          {
+            session: SessionService,
+            http: {
+              request: createMockHTTPRequest({
+                authorization: 'Basic some-token',
+              }),
+              response: createMockHTTPResponse(),
+            },
+          } as any,
+          async () => {}
+        )
+      },
+      (error: any) => {
+        assert(error instanceof InvalidSessionError)
+        return true
+      }
+    )
+  })
+
+  test('should throw InvalidSessionError when bearer token is missing', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+
+    await assert.rejects(
+      async () => {
+        await middleware(
+          { jwt: jwtService } as any,
+          {
+            session: SessionService,
+            http: {
+              request: createMockHTTPRequest({
+                authorization: 'Bearer',
+              }),
+              response: createMockHTTPResponse(),
+            },
+          } as any,
+          async () => {}
+        )
+      },
+      (error: any) => {
+        assert(error instanceof InvalidSessionError)
+        return true
+      }
+    )
+  })
+
+  test('should throw InvalidSessionError when authorization header has no space', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+
+    await assert.rejects(
+      async () => {
+        await middleware(
+          { jwt: jwtService } as any,
+          {
+            session: SessionService,
+            http: {
+              request: createMockHTTPRequest({
+                authorization: 'BearerToken',
+              }),
+              response: createMockHTTPResponse(),
+            },
+          } as any,
+          async () => {}
+        )
+      },
+      (error: any) => {
+        assert(error instanceof InvalidSessionError)
+        return true
+      }
+    )
+  })
+
+  test('should not set session when JWT decode returns null', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => null,
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        session: SessionService,
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer invalid-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should not set session when static token does not match', async () => {
+    const mockUserSession: CoreUserSession = { userId: 'static-user' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => {
+        // Should not be called when static token is provided
+        assert.fail('JWT decode should not be called in static token mode')
+        return null
+      },
+    }
+
+    const middleware = authBearer({
+      token: {
+        value: 'correct-token',
+        userSession: mockUserSession,
+      },
+    })
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        session: SessionService,
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer wrong-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should skip middleware when session already exists', async () => {
+    const existingSession: CoreUserSession = { userId: 'existing' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    SessionService.setInitial(existingSession)
+
+    let decodeCalled = false
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => {
+        decodeCalled = true
+        return { userId: 'new' }
+      },
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        session: SessionService,
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer some-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(decodeCalled, false)
+    assert.deepEqual(SessionService.get(), existingSession)
+  })
+
+  test('should skip middleware when http.request is not available', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      { session: SessionService } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should continue without session when authorization header is missing', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        session: SessionService,
+        http: {
+          request: createMockHTTPRequest({}),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should not decode when jwtService is not available in JWT mode', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: undefined } as any,
+      {
+        session: SessionService,
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer some-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should work in static token mode even when jwtService is not available', async () => {
+    const mockUserSession: CoreUserSession = { userId: 'static-user' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+
+    const middleware = authBearer({
+      token: {
+        value: 'static-token',
+        userSession: mockUserSession,
+      },
+    })
+    let nextCalled = false
+
+    await middleware(
+      { jwt: undefined } as any,
+      {
+        session: SessionService,
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer static-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.deepEqual(SessionService.get(), mockUserSession)
+  })
+})

package/src/middleware/auth-bearer.ts

@@ -40,44 +40,38 @@ export const authBearer = pikkuMiddlewareFactory<{
     userSession: CoreUserSession
   }
 }>(({ token } = {}) =>
-  pikkuMiddleware(
-    async (
-      { userSession: userSessionService, jwt: jwtService },
-      { http },
-      next
-    ) => {
-      // Skip if session already exists.
-      if (!http?.request || userSessionService.get()) {
-        return next()
-      }
-
-      const authHeader =
-        http.request.header('authorization') ||
-        http.request.header('Authorization')
+  pikkuMiddleware(async ({ jwt: jwtService }, { http, session }, next) => {
+    // Skip if session already exists.
+    if (!http?.request || !session || session.get()) {
+      return next()
+    }
 
-      if (authHeader) {
-        const [scheme, bearerToken] = authHeader.split(' ')
-        if (scheme !== 'Bearer' || !bearerToken) {
-          throw new InvalidSessionError()
-        }
+    const authHeader =
+      http.request.header('authorization') ||
+      http.request.header('Authorization')
 
-        let userSession: CoreUserSession | null = null
+    if (authHeader) {
+      const [scheme, bearerToken] = authHeader.split(' ')
+      if (scheme !== 'Bearer' || !bearerToken) {
+        throw new InvalidSessionError()
+      }
 
-        // If static token provided, validate against it
-        if (token && bearerToken === token.value) {
-          userSession = token.userSession
-        }
-        // Otherwise, default to JWT decoding
-        else if (jwtService && !token) {
-          userSession = await jwtService.decode(bearerToken)
-        }
+      let userSession: CoreUserSession | null = null
 
-        if (userSession) {
-          userSessionService.setInitial(userSession)
-        }
+      // If static token provided, validate against it
+      if (token && bearerToken === token.value) {
+        userSession = token.userSession
+      }
+      // Otherwise, default to JWT decoding
+      else if (jwtService && !token) {
+        userSession = await jwtService.decode(bearerToken)
       }
 
-      return next()
+      if (userSession) {
+        session.setInitial(userSession)
+      }
     }
-  )
+
+    return next()
+  })
 )