@pikku/core 0.12.3 → 0.12.4

package/src/middleware/auth-bearer.test.ts

@@ -1,450 +0,0 @@
-import { describe, test, beforeEach } from 'node:test'
-import assert from 'node:assert/strict'
-import { authBearer } from './auth-bearer.js'
-import { resetPikkuState } from '../pikku-state.js'
-import type { CoreUserSession } from '../types/core.types.js'
-import {
-  PikkuSessionService,
-  createMiddlewareSessionWireProps,
-} from '../services/user-session-service.js'
-import { InvalidSessionError } from '../errors/errors.js'
-
-beforeEach(() => {
-  resetPikkuState()
-})
-
-const createMockHTTPRequest = (headers: Record<string, string> = {}) => ({
-  header: (name: string) => {
-    // Check both lowercase and exact case
-    return headers[name.toLowerCase()] || headers[name] || null
-  },
-})
-
-const createMockHTTPResponse = () => ({
-  cookie: () => {},
-})
-
-describe('authBearer middleware', () => {
-  test('should extract and decode JWT bearer token from Authorization header', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user123' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async (token: string) => {
-        assert.equal(token, 'jwt-token')
-        return mockUserSession
-      },
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer jwt-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-
-  test('should handle case-insensitive Authorization header', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'user456' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async (token: string) => {
-        assert.equal(token, 'jwt-token-2')
-        return mockUserSession
-      },
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            Authorization: 'Bearer jwt-token-2',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-
-  test('should validate static token when token option is provided', async () => {
-    const mockUserSession: CoreUserSession = {
-      userId: 'static-user',
-      role: 'admin',
-    }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => {
-        // Should not be called in static token mode
-        assert.fail('JWT decode should not be called in static token mode')
-        return null
-      },
-    }
-
-    const middleware = authBearer({
-      token: {
-        value: 'my-static-token',
-        userSession: mockUserSession,
-      },
-    })
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer my-static-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-
-  test('should throw InvalidSessionError when scheme is not Bearer', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-
-    await assert.rejects(
-      async () => {
-        await middleware(
-          { jwt: jwtService } as any,
-          {
-            ...createMiddlewareSessionWireProps(SessionService),
-            http: {
-              request: createMockHTTPRequest({
-                authorization: 'Basic some-token',
-              }),
-              response: createMockHTTPResponse(),
-            },
-          } as any,
-          async () => {}
-        )
-      },
-      (error: any) => {
-        assert(error instanceof InvalidSessionError)
-        return true
-      }
-    )
-  })
-
-  test('should throw InvalidSessionError when bearer token is missing', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-
-    await assert.rejects(
-      async () => {
-        await middleware(
-          { jwt: jwtService } as any,
-          {
-            ...createMiddlewareSessionWireProps(SessionService),
-            http: {
-              request: createMockHTTPRequest({
-                authorization: 'Bearer',
-              }),
-              response: createMockHTTPResponse(),
-            },
-          } as any,
-          async () => {}
-        )
-      },
-      (error: any) => {
-        assert(error instanceof InvalidSessionError)
-        return true
-      }
-    )
-  })
-
-  test('should throw InvalidSessionError when authorization header has no space', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-
-    await assert.rejects(
-      async () => {
-        await middleware(
-          { jwt: jwtService } as any,
-          {
-            ...createMiddlewareSessionWireProps(SessionService),
-            http: {
-              request: createMockHTTPRequest({
-                authorization: 'BearerToken',
-              }),
-              response: createMockHTTPResponse(),
-            },
-          } as any,
-          async () => {}
-        )
-      },
-      (error: any) => {
-        assert(error instanceof InvalidSessionError)
-        return true
-      }
-    )
-  })
-
-  test('should not set session when JWT decode returns null', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => null,
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer invalid-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should not set session when static token does not match', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'static-user' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => {
-        // Should not be called when static token is provided
-        assert.fail('JWT decode should not be called in static token mode')
-        return null
-      },
-    }
-
-    const middleware = authBearer({
-      token: {
-        value: 'correct-token',
-        userSession: mockUserSession,
-      },
-    })
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer wrong-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should skip middleware when session already exists', async () => {
-    const existingSession: CoreUserSession = { userId: 'existing' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    SessionService.setInitial(existingSession)
-
-    let decodeCalled = false
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => {
-        decodeCalled = true
-        return { userId: 'new' }
-      },
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer some-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(decodeCalled, false)
-    assert.deepEqual(SessionService.get(), existingSession)
-  })
-
-  test('should skip middleware when http.request is not available', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      { ...createMiddlewareSessionWireProps(SessionService) } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should continue without session when authorization header is missing', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-    const jwtService = {
-      encode: async () => 'token',
-      decode: async () => ({ userId: 'test' }),
-    }
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: jwtService } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({}),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should not decode when jwtService is not available in JWT mode', async () => {
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-
-    const middleware = authBearer()
-    let nextCalled = false
-
-    await middleware(
-      { jwt: undefined } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer some-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.equal(SessionService.get(), undefined)
-  })
-
-  test('should work in static token mode even when jwtService is not available', async () => {
-    const mockUserSession: CoreUserSession = { userId: 'static-user' }
-    const SessionService = new PikkuSessionService<CoreUserSession>()
-
-    const middleware = authBearer({
-      token: {
-        value: 'static-token',
-        userSession: mockUserSession,
-      },
-    })
-    let nextCalled = false
-
-    await middleware(
-      { jwt: undefined } as any,
-      {
-        ...createMiddlewareSessionWireProps(SessionService),
-        http: {
-          request: createMockHTTPRequest({
-            authorization: 'Bearer static-token',
-          }),
-          response: createMockHTTPResponse(),
-        },
-      } as any,
-      async () => {
-        nextCalled = true
-      }
-    )
-
-    assert.equal(nextCalled, true)
-    assert.deepEqual(SessionService.get(), mockUserSession)
-  })
-})

package/src/middleware/auth-bearer.ts

@@ -1,72 +0,0 @@
-import { InvalidSessionError } from '../errors/errors.js'
-import type { CoreUserSession } from '../types/core.types.js'
-import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js'
-
-/**
- * Bearer token middleware that extracts and validates tokens from the Authorization header.
- *
- * Supports two modes:
- * - JWT decoding (default): Decodes bearer tokens using the JWT service
- * - Static token: Provide a `token` object with a value and userSession for simple token validation
- *
- * @param options.token - Optional static token configuration { value: string, userSession: CoreUserSession }
- *
- * @example
- * ```typescript
- * import { authBearer } from '@pikku/core/middleware'
- *
- * // JWT mode (default)
- * addHTTPMiddleware('*', [
- *   authBearer()
- * ])
- *
- * // Static token mode
- * addHTTPMiddleware('*', [
- *   authBearer({
- *     token: {
- *       value: process.env.API_TOKEN,
- *       userSession: { userId: 'system', role: 'admin' }
- *     }
- *   })
- * ])
- * ```
- */
-export const authBearer = pikkuMiddlewareFactory<{
-  token?: {
-    value: string
-    userSession: CoreUserSession
-  }
-}>(({ token } = {}) =>
-  pikkuMiddleware(
-    async ({ jwt: jwtService }, { http, setSession, session }, next) => {
-      if (!http?.request || !setSession || session) {
-        return next()
-      }
-
-      const authHeader =
-        http.request.header('authorization') ||
-        http.request.header('Authorization')
-
-      if (authHeader) {
-        const [scheme, bearerToken] = authHeader.split(' ')
-        if (scheme !== 'Bearer' || !bearerToken) {
-          throw new InvalidSessionError()
-        }
-
-        let userSession: CoreUserSession | null = null
-
-        if (token && bearerToken === token.value) {
-          userSession = token.userSession
-        } else if (jwtService && !token) {
-          userSession = await jwtService.decode(bearerToken)
-        }
-
-        if (userSession) {
-          setSession?.(userSession)
-        }
-      }
-
-      return next()
-    }
-  )
-)