@pikku/core 0.12.107 → 0.12.112

package/src/middleware/auth-bearer.test.ts

@@ -1,566 +0,0 @@
-import { describe, test, beforeEach } from 'node:test'
-import assert from 'node:assert/strict'
-import { authBearer } from './auth-bearer.js'
-import { resetPikkuState } from '../pikku-state.js'
-import type { CoreUserSession } from '../types/core.types.js'
-import {
-  PikkuSessionService,
-  createMiddlewareSessionWireProps,
-} from '../services/user-session-service.js'
-import { InvalidSessionError } from '../errors/errors.js'
-import { createSecretValue } from '../classification/secret-value.js'
-
-beforeEach(() => {
-  resetPikkuState()
-})
-
-const createMockHTTPRequest = (headers: Record<string, string> = {}) => ({
-  header: (name: string) => {
-    return headers[name.toLowerCase()] || headers[name] || null
-  },
-})
-
-const createMockHTTPResponse = () => ({
-  cookie: () => {},
-})
-
-describe('authBearer middleware', () => {
-  test('should extract and decode JWT bearer token from Authorization header', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user123' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async (token: string) => {
-        assert.equal(token, 'jwt-token')
-        return mockUserSession
-      },
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer jwt-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-
-  test('should handle case-insensitive Authorization header', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user456' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async (token: string) => {
-        assert.equal(token, 'jwt-token-2')
-        return mockUserSession
-      },
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            Authorization: 'Bearer jwt-token-2',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-
-  test('should validate static token when token option is provided', async () => {
-    const mockUserSession: CoreUserSession = {
-      userId: 'static-user',
-      role: 'admin',
-    }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => {
-        assert.fail('JWT decode should not be called in static token mode')
-        return null
-      },
-    }
-
-    const middleware = authBearer({
-      token: {
-        value: 'my-static-token',
-        userSession: mockUserSession,
-      },
-    })
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer my-static-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-
-  test('should throw InvalidSessionError when scheme is not Bearer', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-
-    await assert.rejects(
-      async () => {
-        await middleware(
-          { jwt: jwtService } as any,
-          {
-            ...createMiddlewareSessionWireProps(SessionService),
-            http: {
-              request: createMockHTTPRequest({
-                authorization: 'Basic some-token',
-              }),
-              response: createMockHTTPResponse(),
-            },
-          } as any,
-          async () => {}
-        )
-      },
-      (error: any) => {
-        assert(error instanceof InvalidSessionError)
-        return true
-      }
-    )
-  })
-
-  test('should throw InvalidSessionError when bearer token is missing', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-
-    await assert.rejects(
-      async () => {
-        await middleware(
-          { jwt: jwtService } as any,
-          {
-            ...createMiddlewareSessionWireProps(SessionService),
-            http: {
-              request: createMockHTTPRequest({
-                authorization: 'Bearer',
-              }),
-              response: createMockHTTPResponse(),
-            },
-          } as any,
-          async () => {}
-        )
-      },
-      (error: any) => {
-        assert(error instanceof InvalidSessionError)
-        return true
-      }
-    )
-  })
-
-  test('should throw InvalidSessionError when authorization header has no space', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-
-    await assert.rejects(
-      async () => {
-        await middleware(
-          { jwt: jwtService } as any,
-          {
-            ...createMiddlewareSessionWireProps(SessionService),
-            http: {
-              request: createMockHTTPRequest({
-                authorization: 'BearerToken',
-              }),
-              response: createMockHTTPResponse(),
-            },
-          } as any,
-          async () => {}
-        )
-      },
-      (error: any) => {
-        assert(error instanceof InvalidSessionError)
-        return true
-      }
-    )
-  })
-
-  test('should not set session when JWT decode returns null', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => null,
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer invalid-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should not set session when static token does not match', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'static-user' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => {
-        assert.fail('JWT decode should not be called in static token mode')
-        return null
-      },
-    }
-
-    const middleware = authBearer({
-      token: {
-        value: 'correct-token',
-        userSession: mockUserSession,
-      },
-    })
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer wrong-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should skip middleware when session already exists', async () => {
-    const existingSession: CoreUserSession = { userId: 'existing' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    SessionService.setInitial(existingSession)
-
-    let decodeCalled = false
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => {
-        decodeCalled = true
-        return { userId: 'new' }
-      },
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer some-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(decodeCalled, false)
-    assert.deepEqual(SessionService.get(), existingSession)
-  })
-
-  test('should skip middleware when http.request is not available', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      { ...createMiddlewareSessionWireProps(SessionService) } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should continue without session when authorization header is missing', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should not decode when jwtService is not available in JWT mode', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: undefined } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer some-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should resolve the expected token from the secrets service in secretId mode', async () => {
-    const mockUserSession: CoreUserSession = {
-      userId: 'console-token',
-      role: 'admin',
-    }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => {
-        assert.fail('JWT decode should not be called in secretId mode')
-        return null
-      },
-    }
-    const secrets = {
-      getSecret: async (secretId: string) => {
-        assert.equal(secretId, 'PIKKU_CONSOLE_TOKEN')
-        return createSecretValue('secret-token-value')
-      },
-    }
-
-    const middleware = authBearer({
-      token: {
-        secretId: 'PIKKU_CONSOLE_TOKEN',
-        userSession: mockUserSession,
-      },
-    })
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService, secrets } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer secret-token-value',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-
-  test('should continue without session when the secret is not configured', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const secrets = {
-      getSecret: async () => {
-        throw new Error('secret not found')
-      },
-    }
-
-    const middleware = authBearer({
-      token: {
-        secretId: 'PIKKU_CONSOLE_TOKEN',
-        userSession: { userId: 'console-token' },
-      },
-    })
-    let nextCalled = false
-
-    await middleware(
-      { jwt: undefined, secrets } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer anything',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should not set session when secret-resolved token does not match', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const secrets = {
-      getSecret: async () => createSecretValue('expected-token'),
-    }
-
-    const middleware = authBearer({
-      token: {
-        secretId: 'PIKKU_CONSOLE_TOKEN',
-        userSession: { userId: 'console-token' },
-      },
-    })
-    let nextCalled = false
-
-    await middleware(
-      { jwt: undefined, secrets } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer wrong-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should work in static token mode even when jwtService is not available', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'static-user' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-
-    const middleware = authBearer({
-      token: {
-        value: 'static-token',
-        userSession: mockUserSession,
-      },
-    })
-    let nextCalled = false
-
-    await middleware(
-      { jwt: undefined } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer static-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-})

package/src/middleware/auth-bearer.ts

@@ -1,83 +0,0 @@
-import { InvalidSessionError } from '../errors/errors.js'
-import type { CoreUserSession } from '../types/core.types.js'
-import {
-  pikkuMiddleware,
-  pikkuMiddlewareFactory,
-} from './middleware-factories.js'
-const constantTimeEqual = (a: string, b: string): boolean => {
-  if (a.length !== b.length) return false
-  let result = 0
-  for (let i = 0; i < a.length; i++) {
-    result |= a.charCodeAt(i) ^ b.charCodeAt(i)
-  }
-  return result === 0
-}
-
-/**
- * Validates a bearer token: JWT-decoded by default, or compared in constant
- * time against a static `value` or a `secretId` resolved through the secrets
- * service per request.
- *
- * @example snippet: machineAuth
- */
-export const authBearer = pikkuMiddlewareFactory<{
-  /** Omit to JWT-decode the token. Set it to accept one fixed token instead, matched in constant time. */
-  token?:
-    | {
-        value: string
-        userSession: CoreUserSession
-      }
-    | {
-        secretId: string
-        userSession: CoreUserSession
-      }
-}>(({ token } = {}) =>
-  pikkuMiddleware(
-    async (
-      { jwt: jwtService, secrets },
-      { http, setSession, session },
-      next
-    ) => {
-      if (!http?.request || !setSession || session) {
-        return next()
-      }
-
-      const authHeader =
-        http.request.header('authorization') ||
-        http.request.header('Authorization')
-
-      if (authHeader) {
-        const [scheme, bearerToken] = authHeader.split(' ')
-        if (scheme !== 'Bearer' || !bearerToken) {
-          throw new InvalidSessionError()
-        }
-
-        let userSession: CoreUserSession | null = null
-
-        if (token) {
-          let expected: string | undefined
-          if ('value' in token) {
-            expected = token.value
-          } else {
-            // An unset secret means the feature is off — never a request error.
-            const stored = await secrets
-              ?.getSecret<string>(token.secretId)
-              .catch(() => undefined)
-            expected = stored?.reveal()
-          }
-          if (expected && constantTimeEqual(bearerToken, expected)) {
-            userSession = token.userSession
-          }
-        } else if (jwtService) {
-          userSession = await jwtService.decode(bearerToken)
-        }
-
-        if (userSession) {
-          setSession?.(userSession)
-        }
-      }
-
-      return next()
-    }
-  )
-)