@pikku/core 0.12.107 → 0.12.111

package/src/middleware/auth-cookie.test.ts

@@ -1,572 +0,0 @@
-import { describe, test, beforeEach } from 'node:test'
-import assert from 'node:assert/strict'
-import { authCookie } from './auth-cookie.js'
-import { resetPikkuState } from '../pikku-state.js'
-import type { CoreUserSession } from '../types/core.types.js'
-import {
-  PikkuSessionService,
-  createMiddlewareSessionWireProps,
-} from '../services/user-session-service.js'
-
-beforeEach(() => {
-  resetPikkuState()
-})
-
-const createMockHTTPRequest = (cookies: Record<string, string> = {}) => ({
-  cookie: (name: string) => cookies[name] || null,
-})
-
-const createMockHTTPResponse = () => {
-  const setCookies: Array<{
-    name: string
-    value: string
-    options: any
-  }> = []
-
-  return {
-    cookie: (name: string, value: string, options: any) => {
-      setCookies.push({ name, value, options })
-    },
-    getCookies: () => setCookies,
-  }
-}
-
-const createMockLogger = () => {
-  const logs: Array<{ level: string; message: string }> = []
-  return {
-    info: (msg: string) => logs.push({ level: 'info', message: msg }),
-    warn: (msg: string) => logs.push({ level: 'warn', message: msg }),
-    error: (msg: string) => logs.push({ level: 'error', message: msg }),
-    debug: (msg: string) => logs.push({ level: 'debug', message: msg }),
-    getLogs: () => logs,
-  }
-}
-
-describe('authCookie middleware', () => {
-  test('should decode session from cookie on request', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user123' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async (token: string) => {
-        assert.equal(token, 'cookie-jwt-value')
-        return mockUserSession
-      },
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'cookie-jwt-value' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-
-  test('should set cookie in response when session changes', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user456' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async (expiresIn: any, payload: any) => {
-        assert.deepEqual(expiresIn, { value: 7, unit: 'day' })
-        assert.deepEqual(payload, mockUserSession)
-        return 'new-encoded-jwt'
-      },
-      decode: async () => null,
-    }
-
-    const middleware = authCookie({
-      name: 'auth_token',
-      expiresIn: { value: 7, unit: 'day' },
-      options: { httpOnly: true, secure: true, sameSite: 'strict' },
-    })
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        SessionService.set(mockUserSession)
-      }
-    )
-
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 1)
-    assert.equal(setCookies[0].name, 'auth_token')
-    assert.equal(setCookies[0].value, 'new-encoded-jwt')
-    assert.equal(setCookies[0].options.httpOnly, true)
-    assert.equal(setCookies[0].options.secure, true)
-    assert.equal(setCookies[0].options.sameSite, 'strict')
-    assert(setCookies[0].options.expires instanceof Date)
-  })
-
-  test('clears the cookie on logout instead of re-minting a credential', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    let encodeCalled = false
-    const jwtService = {
-      // A JWT of an absent session still decodes to a truthy {iat,exp} the
-      // runner accepts — so encode must never be called on logout.
-      encode: async () => {
-        encodeCalled = true
-        return 'reminted-jwt'
-      },
-      decode: async () => ({ userId: 'user123' }),
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      { jwt: jwtService, logger: createMockLogger() } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'existing-jwt' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        // The logout handler clears the session.
-        SessionService.clear()
-      }
-    )
-
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 1, 'a clearing cookie must be written')
-    const cleared = setCookies[0]!
-    assert.equal(cleared.name, 'session')
-    assert.equal(cleared.value, '', 'the cookie value must be empty')
-    assert.equal(cleared.options.maxAge, 0)
-    assert.ok(
-      cleared.options.expires instanceof Date &&
-        cleared.options.expires.getTime() === 0,
-      'the cookie must expire at the epoch'
-    )
-    assert.equal(encodeCalled, false, 'must not sign an absent session')
-  })
-
-  test('should not set cookie when session does not change', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user789' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => mockUserSession,
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'existing-jwt' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        // Session is loaded but not changed
-      }
-    )
-
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 0)
-  })
-
-  test('should not decode cookie when cookie is missing', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    let decodeCalled = false
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => {
-        decodeCalled = true
-        return { userId: 'test' }
-      },
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(decodeCalled, false)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should not set session when JWT decode returns null', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => null,
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'invalid-jwt' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should skip middleware when session already exists', async () => {
-    const existingSession: CoreUserSession = { userId: 'existing' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    SessionService.setInitial(existingSession)
-
-    let decodeCalled = false
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => {
-        decodeCalled = true
-        return { userId: 'new' }
-      },
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'some-jwt' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(decodeCalled, false)
-    assert.deepEqual(SessionService.get(), existingSession)
-  })
-
-  test('should skip middleware when http.request is not available', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      { ...createMiddlewareSessionWireProps(SessionService) } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should not decode when jwtService is not available on request', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: undefined,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'some-jwt' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should warn when jwtService is not available on response and session changed', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user999' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const mockLogger = createMockLogger()
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: undefined,
-        logger: mockLogger,
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        SessionService.set(mockUserSession)
-      }
-    )
-
-    const logs = mockLogger.getLogs()
-    assert.equal(logs.length, 1)
-    assert.equal(logs[0].level, 'warn')
-    assert.equal(
-      logs[0].message,
-      'No JWT service available, unable to set cookie'
-    )
-
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 0)
-  })
-
-  test('should not set cookie when http.response is not available', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user888' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => null,
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: undefined,
-        },
-      } as any,
-      async () => {
-        SessionService.set(mockUserSession)
-      }
-    )
-
-    assert.equal(SessionService.get(), mockUserSession)
-  })
-
-  test('should handle custom cookie name', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'custom-user' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'custom-encoded-jwt',
-      decode: async (token: string) => {
-        assert.equal(token, 'custom-cookie-value')
-        return mockUserSession
-      },
-    }
-
-    const middleware = authCookie({
-      name: 'my_custom_cookie',
-      expiresIn: { value: 1, unit: 'hour' },
-      options: {},
-    })
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            my_custom_cookie: 'custom-cookie-value',
-          }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        SessionService.set({ ...mockUserSession, extra: 'data' })
-      }
-    )
-
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 1)
-    assert.equal(setCookies[0].name, 'my_custom_cookie')
-  })
-
-  test('should properly set expiration time in cookie options', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'expiry-test' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => null,
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 15, unit: 'minute' },
-      options: { httpOnly: true },
-    })
-
-    const mockResponse = createMockHTTPResponse()
-    const beforeTime = new Date()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        SessionService.set(mockUserSession)
-      }
-    )
-
-    const afterTime = new Date()
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 1)
-
-    const expiresDate = setCookies[0].options.expires
-    assert(expiresDate instanceof Date)
-
-    const expectedExpiry = new Date(beforeTime.getTime() + 15 * 60 * 1000)
-    const timeDiff = Math.abs(expiresDate.getTime() - expectedExpiry.getTime())
-    // Allow 5 second tolerance for test execution time
-    assert(timeDiff < 5000, `Time difference ${timeDiff}ms is too large`)
-  })
-})

package/src/middleware/auth-cookie.ts

@@ -1,107 +0,0 @@
-import type { SerializeOptions } from 'cookie'
-import {
-  pikkuMiddleware,
-  pikkuMiddlewareFactory,
-} from './middleware-factories.js'
-import type { RelativeTimeInput } from '../time-utils.js'
-import { getRelativeTimeOffsetFromNow } from '../time-utils.js'
-
-/** Standard JWT registered claims — present on a token even with no session. */
-const JWT_REGISTERED_CLAIMS = new Set([
-  'iat',
-  'exp',
-  'nbf',
-  'iss',
-  'aud',
-  'sub',
-  'jti',
-])
-
-/**
- * Whether a decoded payload carries an actual session, as opposed to being
- * absent or a bare JWT envelope of `{ iat, exp }`. True only for a non-null
- * object with at least one key that is not a registered JWT claim.
- */
-const hasSessionIdentity = (session: unknown): boolean => {
-  if (!session || typeof session !== 'object') return false
-  return Object.keys(session).some((key) => !JWT_REGISTERED_CLAIMS.has(key))
-}
-
-/**
- * Reads a JWT session from a cookie, and re-issues the cookie after the
- * request whenever the session changed (e.g. after login).
- *
- * @example snippet: machineAuth
- */
-export const authCookie = pikkuMiddlewareFactory<{
-  /** Cookie name to read and write. */
-  name: string
-  /** Serialize options merged over the defaults, which are httpOnly and sameSite lax. */
-  options: SerializeOptions
-  /** How long the re-issued cookie lives, as a relative time such as `'7d'`. */
-  expiresIn: RelativeTimeInput
-}>(({ name, options, expiresIn }) => {
-  const mergedOptions: SerializeOptions = {
-    httpOnly: true,
-    secure: true,
-    sameSite: 'lax',
-    path: '/',
-    ...options,
-  }
-  return pikkuMiddleware(
-    async (
-      { jwt: jwtService, logger },
-      { http, setSession, getSession, session, hasSessionChanged },
-      next
-    ) => {
-      if (!http?.request || !setSession || session) {
-        return next()
-      }
-
-      const cookieValue = http.request.cookie(name)
-      if (cookieValue && jwtService) {
-        const userSession = await jwtService.decode(cookieValue)
-        // Not just truthy: a JWT of an absent session still decodes to a
-        // `{ iat, exp }` object, which is truthy and which the function runner
-        // would accept as a session. Require at least one claim that is not a
-        // standard JWT timestamp, so an identity-less token is treated as no
-        // session rather than as an authenticated one.
-        if (userSession && hasSessionIdentity(userSession)) {
-          setSession?.(userSession)
-        }
-      }
-
-      await next()
-
-      if (!http?.response) {
-        return
-      }
-
-      if (hasSessionChanged?.()) {
-        const currentSession = await getSession?.()
-        // Logout path: `clearSession()` marks the session changed while leaving
-        // it absent. Re-signing that into a fresh, unexpired cookie would hand
-        // the browser a credential on the way out — so clear the cookie instead
-        // of minting one, and never call `encode` with an absent session.
-        if (!hasSessionIdentity(currentSession)) {
-          http.response.cookie(name, '', {
-            ...mergedOptions,
-            expires: new Date(0),
-            maxAge: 0,
-          })
-        } else if (jwtService) {
-          http.response.cookie(
-            name,
-            await jwtService.encode(expiresIn, currentSession),
-            {
-              ...mergedOptions,
-              expires: getRelativeTimeOffsetFromNow(expiresIn),
-            }
-          )
-        } else {
-          logger.warn('No JWT service available, unable to set cookie')
-        }
-      }
-    }
-  )
-})