@pikku/core 0.11.2 → 0.12.1

package/src/middleware/remote-auth.test.ts

@@ -0,0 +1,488 @@
+import { describe, test, beforeEach } from 'node:test'
+import assert from 'node:assert'
+import { pikkuRemoteAuthMiddleware } from './remote-auth.js'
+import { UnauthorizedError } from '../errors/errors.js'
+import { resetPikkuState } from '../pikku-state.js'
+import { encryptJSON } from '../crypto-utils.js'
+
+beforeEach(() => {
+  resetPikkuState()
+})
+
+const TEST_SECRET = 'test-remote-secret-key'
+
+const createMockSecrets = (secret?: string) => ({
+  getSecret: async (key: string) => {
+    if (key === 'PIKKU_REMOTE_SECRET' && secret !== undefined) {
+      return secret
+    }
+    throw new Error(`Secret ${key} not found`)
+  },
+})
+
+const createMockJWT = (payload?: any, shouldThrow = false) => ({
+  decode: async (_token: string) => {
+    if (shouldThrow) throw new Error('Invalid token')
+    return payload
+  },
+  encode: async () => 'token',
+})
+
+const createMockRequest = (
+  headers: Record<string, string> = {},
+  path = '/api/test',
+  method = 'POST'
+) => ({
+  header: (name: string) => headers[name.toLowerCase()] || headers[name],
+  path: () => path,
+  method: () => method,
+})
+
+describe('pikkuRemoteAuthMiddleware', () => {
+  test('should call next when no http.request', async () => {
+    let nextCalled = false
+    await pikkuRemoteAuthMiddleware(
+      { secrets: createMockSecrets(TEST_SECRET) } as any,
+      { http: {} } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+    assert.strictEqual(nextCalled, true)
+  })
+
+  test('should call next when no secrets service', async () => {
+    let nextCalled = false
+    await pikkuRemoteAuthMiddleware(
+      {} as any,
+      { http: { request: createMockRequest() } } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+    assert.strictEqual(nextCalled, true)
+  })
+
+  test('should call next when PIKKU_REMOTE_SECRET not found', async () => {
+    let nextCalled = false
+    await pikkuRemoteAuthMiddleware(
+      { secrets: createMockSecrets() } as any,
+      { http: { request: createMockRequest() } } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+    assert.strictEqual(nextCalled, true)
+  })
+
+  test('should throw when PIKKU_REMOTE_SECRET set but no jwt service', async () => {
+    await assert.rejects(
+      () =>
+        pikkuRemoteAuthMiddleware(
+          { secrets: createMockSecrets(TEST_SECRET) } as any,
+          { http: { request: createMockRequest() } } as any,
+          async () => {}
+        ),
+      { message: 'PIKKU_REMOTE_SECRET set but JWT service missing' }
+    )
+  })
+
+  test('should throw UnauthorizedError when no authorization header', async () => {
+    await assert.rejects(
+      () =>
+        pikkuRemoteAuthMiddleware(
+          {
+            secrets: createMockSecrets(TEST_SECRET),
+            jwt: createMockJWT(),
+          } as any,
+          { http: { request: createMockRequest({}) } } as any,
+          async () => {}
+        ),
+      (err: any) => err instanceof UnauthorizedError
+    )
+  })
+
+  test('should throw UnauthorizedError for non-Bearer scheme', async () => {
+    await assert.rejects(
+      () =>
+        pikkuRemoteAuthMiddleware(
+          {
+            secrets: createMockSecrets(TEST_SECRET),
+            jwt: createMockJWT(),
+          } as any,
+          {
+            http: {
+              request: createMockRequest({ authorization: 'Basic abc123' }),
+            },
+          } as any,
+          async () => {}
+        ),
+      (err: any) => err instanceof UnauthorizedError
+    )
+  })
+
+  test('should throw UnauthorizedError when Bearer has no token', async () => {
+    await assert.rejects(
+      () =>
+        pikkuRemoteAuthMiddleware(
+          {
+            secrets: createMockSecrets(TEST_SECRET),
+            jwt: createMockJWT(),
+          } as any,
+          {
+            http: { request: createMockRequest({ authorization: 'Bearer' }) },
+          } as any,
+          async () => {}
+        ),
+      (err: any) => err instanceof UnauthorizedError
+    )
+  })
+
+  test('should throw UnauthorizedError when JWT decode fails', async () => {
+    await assert.rejects(
+      () =>
+        pikkuRemoteAuthMiddleware(
+          {
+            secrets: createMockSecrets(TEST_SECRET),
+            jwt: createMockJWT(null, true),
+          } as any,
+          {
+            http: {
+              request: createMockRequest({
+                authorization: 'Bearer valid-token',
+              }),
+            },
+          } as any,
+          async () => {}
+        ),
+      (err: any) => err instanceof UnauthorizedError
+    )
+  })
+
+  test('should throw UnauthorizedError when audience is not pikku-remote', async () => {
+    await assert.rejects(
+      () =>
+        pikkuRemoteAuthMiddleware(
+          {
+            secrets: createMockSecrets(TEST_SECRET),
+            jwt: createMockJWT({ aud: 'wrong-audience' }),
+          } as any,
+          {
+            http: {
+              request: createMockRequest({
+                authorization: 'Bearer valid-token',
+              }),
+            },
+          } as any,
+          async () => {}
+        ),
+      (err: any) => err instanceof UnauthorizedError
+    )
+  })
+
+  test('should throw UnauthorizedError when audience is missing', async () => {
+    await assert.rejects(
+      () =>
+        pikkuRemoteAuthMiddleware(
+          {
+            secrets: createMockSecrets(TEST_SECRET),
+            jwt: createMockJWT({}),
+          } as any,
+          {
+            http: {
+              request: createMockRequest({
+                authorization: 'Bearer valid-token',
+              }),
+            },
+          } as any,
+          async () => {}
+        ),
+      (err: any) => err instanceof UnauthorizedError
+    )
+  })
+
+  test('should call next for valid token with correct audience', async () => {
+    let nextCalled = false
+    await pikkuRemoteAuthMiddleware(
+      {
+        secrets: createMockSecrets(TEST_SECRET),
+        jwt: createMockJWT({ aud: 'pikku-remote' }),
+      } as any,
+      {
+        http: {
+          request: createMockRequest({ authorization: 'Bearer valid-token' }),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+    assert.strictEqual(nextCalled, true)
+  })
+
+  test('should accept Authorization header (capitalized)', async () => {
+    let nextCalled = false
+    await pikkuRemoteAuthMiddleware(
+      {
+        secrets: createMockSecrets(TEST_SECRET),
+        jwt: createMockJWT({ aud: 'pikku-remote' }),
+      } as any,
+      {
+        http: {
+          request: createMockRequest({ Authorization: 'Bearer valid-token' }),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+    assert.strictEqual(nextCalled, true)
+  })
+
+  describe('RPC function authorization', () => {
+    test('should throw UnauthorizedError when token fn does not match requested function', async () => {
+      await assert.rejects(
+        () =>
+          pikkuRemoteAuthMiddleware(
+            {
+              secrets: createMockSecrets(TEST_SECRET),
+              jwt: createMockJWT({ aud: 'pikku-remote', fn: 'allowedFunc' }),
+            } as any,
+            {
+              http: {
+                request: createMockRequest(
+                  { authorization: 'Bearer valid-token' },
+                  '/rpc/otherFunc'
+                ),
+              },
+            } as any,
+            async () => {}
+          ),
+        (err: any) => err instanceof UnauthorizedError
+      )
+    })
+
+    test('should allow when token fn matches requested function', async () => {
+      let nextCalled = false
+      await pikkuRemoteAuthMiddleware(
+        {
+          secrets: createMockSecrets(TEST_SECRET),
+          jwt: createMockJWT({ aud: 'pikku-remote', fn: 'myFunc' }),
+        } as any,
+        {
+          http: {
+            request: createMockRequest(
+              { authorization: 'Bearer valid-token' },
+              '/rpc/myFunc'
+            ),
+          },
+        } as any,
+        async () => {
+          nextCalled = true
+        }
+      )
+      assert.strictEqual(nextCalled, true)
+    })
+
+    test('should allow any RPC call when token has no fn claim', async () => {
+      let nextCalled = false
+      await pikkuRemoteAuthMiddleware(
+        {
+          secrets: createMockSecrets(TEST_SECRET),
+          jwt: createMockJWT({ aud: 'pikku-remote' }),
+        } as any,
+        {
+          http: {
+            request: createMockRequest(
+              { authorization: 'Bearer valid-token' },
+              '/rpc/anyFunc'
+            ),
+          },
+        } as any,
+        async () => {
+          nextCalled = true
+        }
+      )
+      assert.strictEqual(nextCalled, true)
+    })
+
+    test('should skip fn check for non-RPC paths even if fn in token', async () => {
+      let nextCalled = false
+      await pikkuRemoteAuthMiddleware(
+        {
+          secrets: createMockSecrets(TEST_SECRET),
+          jwt: createMockJWT({ aud: 'pikku-remote', fn: 'someFunc' }),
+        } as any,
+        {
+          http: {
+            request: createMockRequest(
+              { authorization: 'Bearer valid-token' },
+              '/api/other'
+            ),
+          },
+        } as any,
+        async () => {
+          nextCalled = true
+        }
+      )
+      assert.strictEqual(nextCalled, true)
+    })
+
+    test('should handle URI-encoded function names', async () => {
+      let nextCalled = false
+      await pikkuRemoteAuthMiddleware(
+        {
+          secrets: createMockSecrets(TEST_SECRET),
+          jwt: createMockJWT({ aud: 'pikku-remote', fn: 'my func' }),
+        } as any,
+        {
+          http: {
+            request: createMockRequest(
+              { authorization: 'Bearer valid-token' },
+              '/rpc/my%20func'
+            ),
+          },
+        } as any,
+        async () => {
+          nextCalled = true
+        }
+      )
+      assert.strictEqual(nextCalled, true)
+    })
+  })
+
+  describe('session decryption', () => {
+    test('should decrypt and set session when payload.session exists', async () => {
+      const sessionData = { userId: 'user-1', role: 'admin' }
+      const encryptedSession = await encryptJSON(TEST_SECRET, {
+        session: sessionData,
+      })
+      let receivedSession: any
+
+      await pikkuRemoteAuthMiddleware(
+        {
+          secrets: createMockSecrets(TEST_SECRET),
+          jwt: createMockJWT({
+            aud: 'pikku-remote',
+            session: encryptedSession,
+          }),
+        } as any,
+        {
+          http: {
+            request: createMockRequest({ authorization: 'Bearer valid-token' }),
+          },
+          setSession: async (session: any) => {
+            receivedSession = session
+          },
+        } as any,
+        async () => {}
+      )
+
+      assert.deepStrictEqual(receivedSession, sessionData)
+    })
+
+    test('should throw UnauthorizedError when session decryption fails', async () => {
+      await assert.rejects(
+        () =>
+          pikkuRemoteAuthMiddleware(
+            {
+              secrets: createMockSecrets(TEST_SECRET),
+              jwt: createMockJWT({
+                aud: 'pikku-remote',
+                session: 'invalid-encrypted-data',
+              }),
+            } as any,
+            {
+              http: {
+                request: createMockRequest({
+                  authorization: 'Bearer valid-token',
+                }),
+              },
+              setSession: async () => {},
+            } as any,
+            async () => {}
+          ),
+        (err: any) => err instanceof UnauthorizedError
+      )
+    })
+
+    test('should skip setSession when setSession is not available', async () => {
+      const encryptedSession = await encryptJSON(TEST_SECRET, {
+        session: { userId: 'u1' },
+      })
+      let nextCalled = false
+
+      await pikkuRemoteAuthMiddleware(
+        {
+          secrets: createMockSecrets(TEST_SECRET),
+          jwt: createMockJWT({
+            aud: 'pikku-remote',
+            session: encryptedSession,
+          }),
+        } as any,
+        {
+          http: {
+            request: createMockRequest({ authorization: 'Bearer valid-token' }),
+          },
+        } as any,
+        async () => {
+          nextCalled = true
+        }
+      )
+
+      assert.strictEqual(nextCalled, true)
+    })
+
+    test('should skip setSession when decrypted.session is falsy', async () => {
+      const encryptedSession = await encryptJSON(TEST_SECRET, { session: null })
+      let setSessionCalled = false
+
+      await pikkuRemoteAuthMiddleware(
+        {
+          secrets: createMockSecrets(TEST_SECRET),
+          jwt: createMockJWT({
+            aud: 'pikku-remote',
+            session: encryptedSession,
+          }),
+        } as any,
+        {
+          http: {
+            request: createMockRequest({ authorization: 'Bearer valid-token' }),
+          },
+          setSession: async () => {
+            setSessionCalled = true
+          },
+        } as any,
+        async () => {}
+      )
+
+      assert.strictEqual(setSessionCalled, false)
+    })
+
+    test('should not call setSession when no session in payload', async () => {
+      let setSessionCalled = false
+      let nextCalled = false
+
+      await pikkuRemoteAuthMiddleware(
+        {
+          secrets: createMockSecrets(TEST_SECRET),
+          jwt: createMockJWT({ aud: 'pikku-remote' }),
+        } as any,
+        {
+          http: {
+            request: createMockRequest({ authorization: 'Bearer valid-token' }),
+          },
+          setSession: async () => {
+            setSessionCalled = true
+          },
+        } as any,
+        async () => {
+          nextCalled = true
+        }
+      )
+
+      assert.strictEqual(setSessionCalled, false)
+      assert.strictEqual(nextCalled, true)
+    })
+  })
+})

package/src/middleware/remote-auth.ts

@@ -0,0 +1,68 @@
+import { UnauthorizedError } from '../errors/errors.js'
+import { pikkuMiddleware } from '../types/core.types.js'
+import { decryptJSON } from '../crypto-utils.js'
+
+export const pikkuRemoteAuthMiddleware = pikkuMiddleware(
+  async ({ secrets, jwt }, { http, setSession }, next) => {
+    if (!http?.request || !secrets) {
+      return next()
+    }
+
+    let secret: string
+    try {
+      secret = await secrets.getSecret('PIKKU_REMOTE_SECRET')
+    } catch {
+      return next()
+    }
+    if (!jwt) {
+      throw new Error('PIKKU_REMOTE_SECRET set but JWT service missing')
+    }
+
+    const authHeader =
+      http.request.header('authorization') ||
+      http.request.header('Authorization')
+
+    if (!authHeader) {
+      throw new UnauthorizedError()
+    }
+
+    const [scheme, token] = authHeader.split(' ')
+    if (scheme !== 'Bearer' || !token) {
+      throw new UnauthorizedError()
+    }
+
+    let payload: any
+    try {
+      payload = await jwt.decode(token)
+    } catch {
+      throw new UnauthorizedError()
+    }
+
+    if (payload?.aud !== 'pikku-remote') {
+      throw new UnauthorizedError()
+    }
+
+    if (payload?.fn && http.request.path().startsWith('/rpc/')) {
+      const fn = decodeURIComponent(http.request.path().slice('/rpc/'.length))
+      if (fn && payload.fn !== fn) {
+        throw new UnauthorizedError()
+      }
+    }
+
+    if (payload?.session) {
+      try {
+        const decrypted = await decryptJSON<{ session?: unknown }>(
+          secret,
+          payload.session
+        )
+        if (decrypted?.session && setSession) {
+          await setSession(decrypted.session)
+        }
+      } catch {
+        throw new UnauthorizedError()
+      }
+    }
+
+    return next()
+  }
+)

package/src/middleware-runner.test.ts

@@ -6,7 +6,7 @@ import {
   runMiddleware,
 } from './middleware-runner.js'
 import { resetPikkuState } from './pikku-state.js'
-import { CorePikkuMiddleware } from './types/core.types.js'
+import type { CorePikkuMiddleware } from './types/core.types.js'
 
 beforeEach(() => {
   resetPikkuState()
@@ -189,6 +189,128 @@ describe('combineMiddleware', () => {
     assert.equal(result[1], middleware2)
   })
 
+  test('should apply parent tag middleware to namespaced tag', () => {
+    const billingMiddleware: CorePikkuMiddleware = async (
+      services,
+      wire,
+      next
+    ) => {
+      await next()
+    }
+
+    addMiddleware('billing', [billingMiddleware])
+
+    const result = combineMiddleware('http', Math.random().toString(), {
+      wireInheritedMiddleware: [{ type: 'tag', tag: 'billing:read' }],
+    })
+
+    assert.equal(result.length, 1)
+    assert.equal(result[0], billingMiddleware)
+  })
+
+  test('should apply exact tag middleware for non-namespaced tag', () => {
+    const billingMiddleware: CorePikkuMiddleware = async (
+      services,
+      wire,
+      next
+    ) => {
+      await next()
+    }
+
+    addMiddleware('billing', [billingMiddleware])
+
+    const result = combineMiddleware('http', Math.random().toString(), {
+      wireInheritedMiddleware: [{ type: 'tag', tag: 'billing' }],
+    })
+
+    assert.equal(result.length, 1)
+    assert.equal(result[0], billingMiddleware)
+  })
+
+  test('should apply both exact and parent tag middleware (specific first)', () => {
+    const billingMiddleware: CorePikkuMiddleware = async (
+      services,
+      wire,
+      next
+    ) => {
+      await next()
+    }
+    const billingReadMiddleware: CorePikkuMiddleware = async (
+      services,
+      wire,
+      next
+    ) => {
+      await next()
+    }
+
+    addMiddleware('billing', [billingMiddleware])
+    addMiddleware('billing:read', [billingReadMiddleware])
+
+    const result = combineMiddleware('http', Math.random().toString(), {
+      wireInheritedMiddleware: [{ type: 'tag', tag: 'billing:read' }],
+    })
+
+    assert.equal(result.length, 2)
+    assert.equal(result[0], billingReadMiddleware)
+    assert.equal(result[1], billingMiddleware)
+  })
+
+  test('should resolve multi-level namespace tags', () => {
+    const billingMiddleware: CorePikkuMiddleware = async (
+      services,
+      wire,
+      next
+    ) => {
+      await next()
+    }
+    const billingReadMiddleware: CorePikkuMiddleware = async (
+      services,
+      wire,
+      next
+    ) => {
+      await next()
+    }
+    const billingReadAdminMiddleware: CorePikkuMiddleware = async (
+      services,
+      wire,
+      next
+    ) => {
+      await next()
+    }
+
+    addMiddleware('billing', [billingMiddleware])
+    addMiddleware('billing:read', [billingReadMiddleware])
+    addMiddleware('billing:read:admin', [billingReadAdminMiddleware])
+
+    const result = combineMiddleware('http', Math.random().toString(), {
+      wireInheritedMiddleware: [{ type: 'tag', tag: 'billing:read:admin' }],
+    })
+
+    assert.equal(result.length, 3)
+    assert.equal(result[0], billingReadAdminMiddleware)
+    assert.equal(result[1], billingReadMiddleware)
+    assert.equal(result[2], billingMiddleware)
+  })
+
+  test('should apply parent tag middleware via funcInheritedMiddleware', () => {
+    const billingMiddleware: CorePikkuMiddleware = async (
+      services,
+      wire,
+      next
+    ) => {
+      await next()
+    }
+
+    addMiddleware('billing', [billingMiddleware])
+
+    const result = combineMiddleware('http', Math.random().toString(), {
+      funcInheritedMiddleware: [{ type: 'tag', tag: 'billing:write' }],
+    })
+
+    assert.equal(result.length, 1)
+    assert.equal(result[0], billingMiddleware)
+  })
+
   test('should ignore non-existent tags', () => {
     const middleware: CorePikkuMiddleware = async (services, wire, next) => {
       await next()