@pikku/core 0.12.3 → 0.12.4

package/src/middleware/auth-cookie.test.ts

@@ -1,528 +0,0 @@
-import { describe, test, beforeEach } from 'node:test'
-import assert from 'node:assert/strict'
-import { authCookie } from './auth-cookie.js'
-import { resetPikkuState } from '../pikku-state.js'
-import type { CoreUserSession } from '../types/core.types.js'
-import {
-  PikkuSessionService,
-  createMiddlewareSessionWireProps,
-} from '../services/user-session-service.js'
-
-beforeEach(() => {
-  resetPikkuState()
-})
-
-const createMockHTTPRequest = (cookies: Record<string, string> = {}) => ({
-  cookie: (name: string) => cookies[name] || null,
-})
-
-const createMockHTTPResponse = () => {
-  const setCookies: Array<{
-    name: string
-    value: string
-    options: any
-  }> = []
-
-  return {
-    cookie: (name: string, value: string, options: any) => {
-      setCookies.push({ name, value, options })
-    },
-    getCookies: () => setCookies,
-  }
-}
-
-const createMockLogger = () => {
-  const logs: Array<{ level: string; message: string }> = []
-  return {
-    info: (msg: string) => logs.push({ level: 'info', message: msg }),
-    warn: (msg: string) => logs.push({ level: 'warn', message: msg }),
-    error: (msg: string) => logs.push({ level: 'error', message: msg }),
-    debug: (msg: string) => logs.push({ level: 'debug', message: msg }),
-    getLogs: () => logs,
-  }
-}
-
-describe('authCookie middleware', () => {
-  test('should decode session from cookie on request', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user123' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async (token: string) => {
-        assert.equal(token, 'cookie-jwt-value')
-        return mockUserSession
-      },
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'cookie-jwt-value' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-
-  test('should set cookie in response when session changes', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user456' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async (expiresIn: any, payload: any) => {
-        assert.deepEqual(expiresIn, { value: 7, unit: 'day' })
-        assert.deepEqual(payload, mockUserSession)
-        return 'new-encoded-jwt'
-      },
-      decode: async () => null,
-    }
-
-    const middleware = authCookie({
-      name: 'auth_token',
-      expiresIn: { value: 7, unit: 'day' },
-      options: { httpOnly: true, secure: true, sameSite: 'strict' },
-    })
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        // Simulate session change
-        SessionService.set(mockUserSession)
-      }
-    )
-
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 1)
-    assert.equal(setCookies[0].name, 'auth_token')
-    assert.equal(setCookies[0].value, 'new-encoded-jwt')
-    assert.equal(setCookies[0].options.httpOnly, true)
-    assert.equal(setCookies[0].options.secure, true)
-    assert.equal(setCookies[0].options.sameSite, 'strict')
-    assert(setCookies[0].options.expires instanceof Date)
-  })
-
-  test('should not set cookie when session does not change', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user789' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => mockUserSession,
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'existing-jwt' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        // Session is loaded but not changed
-      }
-    )
-
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 0)
-  })
-
-  test('should not decode cookie when cookie is missing', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    let decodeCalled = false
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => {
-        decodeCalled = true
-        return { userId: 'test' }
-      },
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(decodeCalled, false)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should not set session when JWT decode returns null', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => null,
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'invalid-jwt' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should skip middleware when session already exists', async () => {
-    const existingSession: CoreUserSession = { userId: 'existing' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    SessionService.setInitial(existingSession)
-
-    let decodeCalled = false
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => {
-        decodeCalled = true
-        return { userId: 'new' }
-      },
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'some-jwt' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(decodeCalled, false)
-    assert.deepEqual(SessionService.get(), existingSession)
-  })
-
-  test('should skip middleware when http.request is not available', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      { ...createMiddlewareSessionWireProps(SessionService) } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should not decode when jwtService is not available on request', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-    let nextCalled = false
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: undefined,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({ session: 'some-jwt' }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should warn when jwtService is not available on response and session changed', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user999' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const mockLogger = createMockLogger()
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: undefined,
-        logger: mockLogger,
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        // Simulate session change
-        SessionService.set(mockUserSession)
-      }
-    )
-
-    const logs = mockLogger.getLogs()
-    assert.equal(logs.length, 1)
-    assert.equal(logs[0].level, 'warn')
-    assert.equal(
-      logs[0].message,
-      'No JWT service available, unable to set cookie'
-    )
-
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 0)
-  })
-
-  test('should not set cookie when http.response is not available', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user888' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => null,
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 30, unit: 'day' },
-      options: { httpOnly: true },
-    })
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: undefined,
-        },
-      } as any,
-      async () => {
-        // Simulate session change
-        SessionService.set(mockUserSession)
-      }
-    )
-
-    // Should complete without errors even though response is not available
-    assert.equal(SessionService.get(), mockUserSession)
-  })
-
-  test('should handle custom cookie name', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'custom-user' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'custom-encoded-jwt',
-      decode: async (token: string) => {
-        assert.equal(token, 'custom-cookie-value')
-        return mockUserSession
-      },
-    }
-
-    const middleware = authCookie({
-      name: 'my_custom_cookie',
-      expiresIn: { value: 1, unit: 'hour' },
-      options: {},
-    })
-
-    const mockResponse = createMockHTTPResponse()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            my_custom_cookie: 'custom-cookie-value',
-          }),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        // Modify session to trigger cookie setting
-        SessionService.set({ ...mockUserSession, extra: 'data' })
-      }
-    )
-
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 1)
-    assert.equal(setCookies[0].name, 'my_custom_cookie')
-  })
-
-  test('should properly set expiration time in cookie options', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'expiry-test' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'encoded-jwt',
-      decode: async () => null,
-    }
-
-    const middleware = authCookie({
-      name: 'session',
-      expiresIn: { value: 15, unit: 'minute' },
-      options: { httpOnly: true },
-    })
-
-    const mockResponse = createMockHTTPResponse()
-    const beforeTime = new Date()
-
-    await middleware(
-      {
-        jwt: jwtService,
-        logger: createMockLogger(),
-      } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: mockResponse,
-        },
-      } as any,
-      async () => {
-        SessionService.set(mockUserSession)
-      }
-    )
-
-    const afterTime = new Date()
-    const setCookies = mockResponse.getCookies()
-    assert.equal(setCookies.length, 1)
-
-    const expiresDate = setCookies[0].options.expires
-    assert(expiresDate instanceof Date)
-
-    // Expiration should be approximately 15 minutes from now
-    const expectedExpiry = new Date(beforeTime.getTime() + 15 * 60 * 1000)
-    const timeDiff = Math.abs(expiresDate.getTime() - expectedExpiry.getTime())
-    // Allow 5 second tolerance for test execution time
-    assert(timeDiff < 5000, `Time difference ${timeDiff}ms is too large`)
-  })
-})

package/src/middleware/auth-cookie.ts

@@ -1,80 +0,0 @@
-import type { SerializeOptions } from 'cookie'
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js'
-import type { RelativeTimeInput } from '../time-utils.js'
-import { getRelativeTimeOffsetFromNow } from '../time-utils.js'
-
-/**
- * Cookie-based session middleware that uses JWT for encoding/decoding session data.
- *
- * Reads session from a cookie on incoming requests and automatically updates the cookie
- * when the session changes (e.g., after login).
- *
- * @param options.name - Cookie name
- * @param options.expiresIn - Cookie expiration time (e.g., { value: 30, unit: 'day' })
- * @param options.options - Cookie serialization options (httpOnly, secure, sameSite, etc.)
- *
- * @example
- * ```typescript
- * import { authCookie } from '@pikku/core/middleware'
- *
- * addHTTPMiddleware([
- *   authCookie({
- *     name: 'session',
- *     expiresIn: { value: 30, unit: 'day' },
- *     options: {
- *       httpOnly: true,
- *       secure: true,
- *       sameSite: 'strict',
- *       path: '/'
- *     }
- *   })
- * ])
- * ```
- */
-export const authCookie = pikkuMiddlewareFactory<{
-  name: string
-  options: SerializeOptions
-  expiresIn: RelativeTimeInput
-}>(({ name, options, expiresIn }) =>
-  pikkuMiddleware(
-    async (
-      { jwt: jwtService, logger },
-      { http, setSession, getSession, session, hasSessionChanged },
-      next
-    ) => {
-      if (!http?.request || !setSession || session) {
-        return next()
-      }
-
-      const cookieValue = http.request.cookie(name)
-      if (cookieValue && jwtService) {
-        const userSession = await jwtService.decode(cookieValue)
-        if (userSession) {
-          setSession?.(userSession)
-        }
-      }
-
-      await next()
-
-      if (!http?.response) {
-        return
-      }
-
-      if (hasSessionChanged?.()) {
-        const currentSession = await getSession?.()
-        if (jwtService) {
-          http.response.cookie(
-            name,
-            await jwtService.encode(expiresIn, currentSession),
-            {
-              ...options,
-              expires: getRelativeTimeOffsetFromNow(expiresIn),
-            }
-          )
-        } else {
-          logger.warn('No JWT service available, unable to set cookie')
-        }
-      }
-    }
-  )
-)