@pikku/core 0.12.107 → 0.12.112

package/src/middleware/middleware-factories.ts

@@ -1,76 +0,0 @@
-import type {
-  CoreSingletonServices,
-  CoreUserSession,
-} from '../types/core.types.js'
-import type {
-  CorePikkuChannelMiddleware,
-  CorePikkuChannelMiddlewareFactory,
-} from '../wirings/channel/channel.types.js'
-import type { PikkuAgentMiddlewareHooks } from '../wirings/agent/agent.types.js'
-import type {
-  CorePikkuMiddleware,
-  CorePikkuMiddlewareConfig,
-  CorePikkuMiddlewareFactory,
-  MiddlewarePriority,
-} from './middleware.types.js'
-
-export const pikkuMiddleware = <
-  SingletonServices extends CoreSingletonServices = CoreSingletonServices,
-  UserSession extends CoreUserSession = CoreUserSession,
->(
-  middleware:
-    | CorePikkuMiddleware<SingletonServices, UserSession>
-    | CorePikkuMiddlewareConfig<SingletonServices, UserSession>
-): CorePikkuMiddleware<SingletonServices, UserSession> => {
-  if (typeof middleware === 'function') return middleware
-  const func = middleware.func as CorePikkuMiddleware<
-    SingletonServices,
-    UserSession
-  > & { __priority?: MiddlewarePriority }
-  if (middleware.priority) {
-    func.__priority = middleware.priority
-  }
-  return func
-}
-
-export const pikkuMiddlewareFactory = <In = any>(
-  factory: CorePikkuMiddlewareFactory<In>
-): CorePikkuMiddlewareFactory<In> => {
-  return factory
-}
-
-/**
- * Declares middleware for a channel — it runs around the connection and its
- * messages rather than around a single request.
- */
-export const pikkuChannelMiddleware = <
-  SingletonServices extends CoreSingletonServices = CoreSingletonServices,
-  Event = unknown,
->(
-  middleware: CorePikkuChannelMiddleware<SingletonServices, Event>
-): CorePikkuChannelMiddleware<SingletonServices, Event> => {
-  return middleware
-}
-
-/**
- * Declares channel middleware that takes options, so one definition can be
- * wired several times with different configuration.
- *
- * @example snippet: channelMiddlewareFactory
- */
-export const pikkuChannelMiddlewareFactory = <In = any>(
-  factory: CorePikkuChannelMiddlewareFactory<In>
-): CorePikkuChannelMiddlewareFactory<In> => {
-  return factory
-}
-
-/**
- * Declares middleware for an agent run — hooks around the model call, its tool
- * calls and the run's state.
- */
-export const pikkuAgentMiddleware = <
-  State extends Record<string, unknown> = Record<string, unknown>,
-  SingletonServices extends CoreSingletonServices = CoreSingletonServices,
->(
-  hooks: PikkuAgentMiddlewareHooks<State, SingletonServices>
-): PikkuAgentMiddlewareHooks<State, SingletonServices> => hooks

package/src/middleware/middleware.types.ts

@@ -1,61 +0,0 @@
-import type {
-  CoreSingletonServices,
-  CoreUserSession,
-  PikkuWire,
-} from '../types/core.types.js'
-
-export type CorePikkuMiddleware<
-  SingletonServices extends CoreSingletonServices = CoreSingletonServices,
-  UserSession extends CoreUserSession = CoreUserSession,
-> = (
-  services: SingletonServices,
-  wires: PikkuWire,
-  next: () => Promise<void>
-) => Promise<void>
-
-/**
- * Execution order: `highest` runs first (outermost in the onion), `lowest`
- * runs last, closest to the function.
- */
-export type MiddlewarePriority =
-  'highest' | 'high' | 'medium' | 'low' | 'lowest'
-
-export type CorePikkuMiddlewareConfig<
-  SingletonServices extends CoreSingletonServices = CoreSingletonServices,
-  UserSession extends CoreUserSession = CoreUserSession,
-> = {
-  func: CorePikkuMiddleware<SingletonServices, UserSession>
-  name?: string
-  description?: string
-  /** Execution priority. Lower runs first (outermost). Defaults to 'medium'. */
-  priority?: MiddlewarePriority
-}
-
-export type CorePikkuMiddlewareFactory<
-  In = any,
-  SingletonServices extends CoreSingletonServices = CoreSingletonServices,
-  UserSession extends CoreUserSession = CoreUserSession,
-> = (input: In) => CorePikkuMiddleware<SingletonServices, UserSession>
-
-export type CorePikkuMiddlewareGroup<
-  SingletonServices extends CoreSingletonServices = CoreSingletonServices,
-  UserSession extends CoreUserSession = CoreUserSession,
-> = Array<
-  | CorePikkuMiddleware<SingletonServices, UserSession>
-  | CorePikkuMiddlewareFactory<any, SingletonServices, UserSession>
->
-
-export type MiddlewareMetadata =
-  | {
-      type: 'http'
-      route: string // Route pattern (e.g., '*' for all, '/api/*' for specific)
-    }
-  | {
-      type: 'tag'
-      tag: string
-    }
-  | {
-      type: 'wire'
-      name: string
-      inline?: boolean
-    }

package/src/middleware/remote-auth.test.ts

@@ -1,547 +0,0 @@
-import { describe, test, beforeEach } from 'node:test'
-import assert from 'node:assert'
-import { pikkuRemoteAuthMiddleware } from './remote-auth.js'
-import { UnauthorizedError } from '../errors/errors.js'
-import { resetPikkuState } from '../pikku-state.js'
-import { encryptWithKeyMaterial, REMOTE_SESSION_INFO } from '../crypto-utils.js'
-import { createSecretValue } from '../classification/secret-value.js'
-
-beforeEach(() => {
-  resetPikkuState()
-})
-
-const TEST_SECRET = 'test-remote-secret-key-with-enough-entropy'
-
-const createMockSecrets = (secret?: string) => ({
-  getSecret: async (key: string) => {
-    if (key === 'PIKKU_REMOTE_SECRET' && secret !== undefined) {
-      return createSecretValue(secret)
-    }
-    throw new Error(`Secret ${key} not found`)
-  },
-})
-
-const createMockJWT = (payload?: any, shouldThrow = false) => ({
-  decode: async (_token: string) => {
-    if (shouldThrow) throw new Error('Invalid token')
-    return payload
-  },
-  encode: async () => 'token',
-})
-
-const createMockRequest = (
-  headers: Record<string, string> = {},
-  path = '/api/test',
-  method = 'POST'
-) => ({
-  header: (name: string) => headers[name.toLowerCase()] || headers[name],
-  path: () => path,
-  method: () => method,
-})
-
-describe('pikkuRemoteAuthMiddleware', () => {
-  test('should call next when no http.request', async () => {
-    let nextCalled = false
-    await pikkuRemoteAuthMiddleware(
-      { secrets: createMockSecrets(TEST_SECRET) } as any,
-      { http: {} } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-    assert.strictEqual(nextCalled, true)
-  })
-
-  test('should call next when no secrets service', async () => {
-    let nextCalled = false
-    await pikkuRemoteAuthMiddleware(
-      {} as any,
-      { http: { request: createMockRequest() } } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-    assert.strictEqual(nextCalled, true)
-  })
-
-  test('should call next when PIKKU_REMOTE_SECRET not found', async () => {
-    let nextCalled = false
-    await pikkuRemoteAuthMiddleware(
-      { secrets: createMockSecrets() } as any,
-      { http: { request: createMockRequest() } } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-    assert.strictEqual(nextCalled, true)
-  })
-
-  test('should throw when PIKKU_REMOTE_SECRET set but no jwt service', async () => {
-    await assert.rejects(
-      () =>
-        pikkuRemoteAuthMiddleware(
-          { secrets: createMockSecrets(TEST_SECRET) } as any,
-          { http: { request: createMockRequest() } } as any,
-          async () => {}
-        ),
-      { message: 'PIKKU_REMOTE_SECRET set but JWT service missing' }
-    )
-  })
-
-  test('should throw UnauthorizedError when no authorization header', async () => {
-    await assert.rejects(
-      () =>
-        pikkuRemoteAuthMiddleware(
-          {
-            secrets: createMockSecrets(TEST_SECRET),
-            jwt: createMockJWT(),
-          } as any,
-          { http: { request: createMockRequest({}) } } as any,
-          async () => {}
-        ),
-      (err: any) => err instanceof UnauthorizedError
-    )
-  })
-
-  test('should throw UnauthorizedError for non-Bearer scheme', async () => {
-    await assert.rejects(
-      () =>
-        pikkuRemoteAuthMiddleware(
-          {
-            secrets: createMockSecrets(TEST_SECRET),
-            jwt: createMockJWT(),
-          } as any,
-          {
-            http: {
-              request: createMockRequest({ authorization: 'Basic abc123' }),
-            },
-          } as any,
-          async () => {}
-        ),
-      (err: any) => err instanceof UnauthorizedError
-    )
-  })
-
-  test('should throw UnauthorizedError when Bearer has no token', async () => {
-    await assert.rejects(
-      () =>
-        pikkuRemoteAuthMiddleware(
-          {
-            secrets: createMockSecrets(TEST_SECRET),
-            jwt: createMockJWT(),
-          } as any,
-          {
-            http: { request: createMockRequest({ authorization: 'Bearer' }) },
-          } as any,
-          async () => {}
-        ),
-      (err: any) => err instanceof UnauthorizedError
-    )
-  })
-
-  test('should throw UnauthorizedError when JWT decode fails', async () => {
-    await assert.rejects(
-      () =>
-        pikkuRemoteAuthMiddleware(
-          {
-            secrets: createMockSecrets(TEST_SECRET),
-            jwt: createMockJWT(null, true),
-          } as any,
-          {
-            http: {
-              request: createMockRequest({
-                authorization: 'Bearer valid-token',
-              }),
-            },
-          } as any,
-          async () => {}
-        ),
-      (err: any) => err instanceof UnauthorizedError
-    )
-  })
-
-  test('should throw UnauthorizedError when audience is not pikku-remote', async () => {
-    await assert.rejects(
-      () =>
-        pikkuRemoteAuthMiddleware(
-          {
-            secrets: createMockSecrets(TEST_SECRET),
-            jwt: createMockJWT({ aud: 'wrong-audience' }),
-          } as any,
-          {
-            http: {
-              request: createMockRequest({
-                authorization: 'Bearer valid-token',
-              }),
-            },
-          } as any,
-          async () => {}
-        ),
-      (err: any) => err instanceof UnauthorizedError
-    )
-  })
-
-  test('should throw UnauthorizedError when audience is missing', async () => {
-    await assert.rejects(
-      () =>
-        pikkuRemoteAuthMiddleware(
-          {
-            secrets: createMockSecrets(TEST_SECRET),
-            jwt: createMockJWT({}),
-          } as any,
-          {
-            http: {
-              request: createMockRequest({
-                authorization: 'Bearer valid-token',
-              }),
-            },
-          } as any,
-          async () => {}
-        ),
-      (err: any) => err instanceof UnauthorizedError
-    )
-  })
-
-  test('should call next for valid token with correct audience', async () => {
-    let nextCalled = false
-    await pikkuRemoteAuthMiddleware(
-      {
-        secrets: createMockSecrets(TEST_SECRET),
-        jwt: createMockJWT({ aud: 'pikku-remote' }),
-      } as any,
-      {
-        http: {
-          request: createMockRequest({ authorization: 'Bearer valid-token' }),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-    assert.strictEqual(nextCalled, true)
-  })
-
-  test('should accept Authorization header (capitalized)', async () => {
-    let nextCalled = false
-    await pikkuRemoteAuthMiddleware(
-      {
-        secrets: createMockSecrets(TEST_SECRET),
-        jwt: createMockJWT({ aud: 'pikku-remote' }),
-      } as any,
-      {
-        http: {
-          request: createMockRequest({ Authorization: 'Bearer valid-token' }),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-    assert.strictEqual(nextCalled, true)
-  })
-
-  describe('RPC function authorization', () => {
-    test('should throw UnauthorizedError when token fn does not match requested function', async () => {
-      await assert.rejects(
-        () =>
-          pikkuRemoteAuthMiddleware(
-            {
-              secrets: createMockSecrets(TEST_SECRET),
-              jwt: createMockJWT({ aud: 'pikku-remote', fn: 'allowedFunc' }),
-            } as any,
-            {
-              http: {
-                request: createMockRequest(
-                  { authorization: 'Bearer valid-token' },
-                  '/remote/rpc/otherFunc'
-                ),
-              },
-            } as any,
-            async () => {}
-          ),
-        (err: any) => err instanceof UnauthorizedError
-      )
-    })
-
-    test('enforces the fn binding even when the path prefix varies in case', async () => {
-      // The router matches /remote/rpc/ case-insensitively, so /Remote/RPC/
-      // reaches the same handler. The fn-binding check must run for it too, or
-      // a token scoped to one function invokes any other by varying the case.
-      await assert.rejects(
-        () =>
-          pikkuRemoteAuthMiddleware(
-            {
-              secrets: createMockSecrets(TEST_SECRET),
-              jwt: createMockJWT({ aud: 'pikku-remote', fn: 'allowedFunc' }),
-            } as any,
-            {
-              http: {
-                request: createMockRequest(
-                  { authorization: 'Bearer valid-token' },
-                  '/Remote/RPC/otherFunc'
-                ),
-              },
-            } as any,
-            async () => {}
-          ),
-        (err: any) => err instanceof UnauthorizedError
-      )
-    })
-
-    test('requires authorization for a case-varied remote path when no secret is set', async () => {
-      // The no-secret branch must also treat /REMOTE/RPC/ as remote, or a
-      // misconfigured mesh silently serves it unauthenticated.
-      await assert.rejects(
-        () =>
-          pikkuRemoteAuthMiddleware(
-            { secrets: createMockSecrets(undefined) } as any,
-            {
-              http: {
-                request: createMockRequest({}, '/REMOTE/RPC/anyFunc'),
-              },
-            } as any,
-            async () => {}
-          ),
-        (err: any) => err instanceof UnauthorizedError
-      )
-    })
-
-    test('should allow when token fn matches requested function', async () => {
-      let nextCalled = false
-      await pikkuRemoteAuthMiddleware(
-        {
-          secrets: createMockSecrets(TEST_SECRET),
-          jwt: createMockJWT({ aud: 'pikku-remote', fn: 'myFunc' }),
-        } as any,
-        {
-          http: {
-            request: createMockRequest(
-              { authorization: 'Bearer valid-token' },
-              '/remote/rpc/myFunc'
-            ),
-          },
-        } as any,
-        async () => {
-          nextCalled = true
-        }
-      )
-      assert.strictEqual(nextCalled, true)
-    })
-
-    test('should allow any RPC call when token has no fn claim', async () => {
-      let nextCalled = false
-      await pikkuRemoteAuthMiddleware(
-        {
-          secrets: createMockSecrets(TEST_SECRET),
-          jwt: createMockJWT({ aud: 'pikku-remote' }),
-        } as any,
-        {
-          http: {
-            request: createMockRequest(
-              { authorization: 'Bearer valid-token' },
-              '/remote/rpc/anyFunc'
-            ),
-          },
-        } as any,
-        async () => {
-          nextCalled = true
-        }
-      )
-      assert.strictEqual(nextCalled, true)
-    })
-
-    test('should skip fn check for non-RPC paths even if fn in token', async () => {
-      let nextCalled = false
-      await pikkuRemoteAuthMiddleware(
-        {
-          secrets: createMockSecrets(TEST_SECRET),
-          jwt: createMockJWT({ aud: 'pikku-remote', fn: 'someFunc' }),
-        } as any,
-        {
-          http: {
-            request: createMockRequest(
-              { authorization: 'Bearer valid-token' },
-              '/api/other'
-            ),
-          },
-        } as any,
-        async () => {
-          nextCalled = true
-        }
-      )
-      assert.strictEqual(nextCalled, true)
-    })
-
-    test('should handle URI-encoded function names', async () => {
-      let nextCalled = false
-      await pikkuRemoteAuthMiddleware(
-        {
-          secrets: createMockSecrets(TEST_SECRET),
-          jwt: createMockJWT({ aud: 'pikku-remote', fn: 'my func' }),
-        } as any,
-        {
-          http: {
-            request: createMockRequest(
-              { authorization: 'Bearer valid-token' },
-              '/remote/rpc/my%20func'
-            ),
-          },
-        } as any,
-        async () => {
-          nextCalled = true
-        }
-      )
-      assert.strictEqual(nextCalled, true)
-    })
-  })
-
-  describe('session decryption', () => {
-    test('should decrypt and set session when payload.session exists', async () => {
-      const sessionData = { userId: 'user-1', role: 'admin' }
-      const encryptedSession = await encryptWithKeyMaterial(
-        'PIKKU_REMOTE_SECRET',
-        TEST_SECRET,
-        REMOTE_SESSION_INFO,
-        {
-          session: sessionData,
-        }
-      )
-      let receivedSession: any
-
-      await pikkuRemoteAuthMiddleware(
-        {
-          secrets: createMockSecrets(TEST_SECRET),
-          jwt: createMockJWT({
-            aud: 'pikku-remote',
-            session: encryptedSession,
-          }),
-        } as any,
-        {
-          http: {
-            request: createMockRequest({ authorization: 'Bearer valid-token' }),
-          },
-          setSession: async (session: any) => {
-            receivedSession = session
-          },
-        } as any,
-        async () => {}
-      )
-
-      assert.deepStrictEqual(receivedSession, sessionData)
-    })
-
-    test('should throw UnauthorizedError when session decryption fails', async () => {
-      await assert.rejects(
-        () =>
-          pikkuRemoteAuthMiddleware(
-            {
-              secrets: createMockSecrets(TEST_SECRET),
-              jwt: createMockJWT({
-                aud: 'pikku-remote',
-                session: 'invalid-encrypted-data',
-              }),
-            } as any,
-            {
-              http: {
-                request: createMockRequest({
-                  authorization: 'Bearer valid-token',
-                }),
-              },
-              setSession: async () => {},
-            } as any,
-            async () => {}
-          ),
-        (err: any) => err instanceof UnauthorizedError
-      )
-    })
-
-    test('should skip setSession when setSession is not available', async () => {
-      const encryptedSession = await encryptWithKeyMaterial(
-        'PIKKU_REMOTE_SECRET',
-        TEST_SECRET,
-        REMOTE_SESSION_INFO,
-        {
-          session: { userId: 'u1' },
-        }
-      )
-      let nextCalled = false
-
-      await pikkuRemoteAuthMiddleware(
-        {
-          secrets: createMockSecrets(TEST_SECRET),
-          jwt: createMockJWT({
-            aud: 'pikku-remote',
-            session: encryptedSession,
-          }),
-        } as any,
-        {
-          http: {
-            request: createMockRequest({ authorization: 'Bearer valid-token' }),
-          },
-        } as any,
-        async () => {
-          nextCalled = true
-        }
-      )
-
-      assert.strictEqual(nextCalled, true)
-    })
-
-    test('should skip setSession when decrypted.session is falsy', async () => {
-      const encryptedSession = await encryptWithKeyMaterial(
-        'PIKKU_REMOTE_SECRET',
-        TEST_SECRET,
-        REMOTE_SESSION_INFO,
-        { session: null }
-      )
-      let setSessionCalled = false
-
-      await pikkuRemoteAuthMiddleware(
-        {
-          secrets: createMockSecrets(TEST_SECRET),
-          jwt: createMockJWT({
-            aud: 'pikku-remote',
-            session: encryptedSession,
-          }),
-        } as any,
-        {
-          http: {
-            request: createMockRequest({ authorization: 'Bearer valid-token' }),
-          },
-          setSession: async () => {
-            setSessionCalled = true
-          },
-        } as any,
-        async () => {}
-      )
-
-      assert.strictEqual(setSessionCalled, false)
-    })
-
-    test('should not call setSession when no session in payload', async () => {
-      let setSessionCalled = false
-      let nextCalled = false
-
-      await pikkuRemoteAuthMiddleware(
-        {
-          secrets: createMockSecrets(TEST_SECRET),
-          jwt: createMockJWT({ aud: 'pikku-remote' }),
-        } as any,
-        {
-          http: {
-            request: createMockRequest({ authorization: 'Bearer valid-token' }),
-          },
-          setSession: async () => {
-            setSessionCalled = true
-          },
-        } as any,
-        async () => {
-          nextCalled = true
-        }
-      )
-
-      assert.strictEqual(setSessionCalled, false)
-      assert.strictEqual(nextCalled, true)
-    })
-  })
-})