@pikku/core 0.12.4 → 0.12.5

package/src/middleware/auth-bearer.test.ts

@@ -0,0 +1,450 @@
+import { describe, test, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import { authBearer } from './auth-bearer.js'
+import { resetPikkuState } from '../pikku-state.js'
+import type { CoreUserSession } from '../types/core.types.js'
+import {
+  PikkuSessionService,
+  createMiddlewareSessionWireProps,
+} from '../services/user-session-service.js'
+import { InvalidSessionError } from '../errors/errors.js'
+
+beforeEach(() => {
+  resetPikkuState()
+})
+
+const createMockHTTPRequest = (headers: Record<string, string> = {}) => ({
+  header: (name: string) => {
+    // Check both lowercase and exact case
+    return headers[name.toLowerCase()] || headers[name] || null
+  },
+})
+
+const createMockHTTPResponse = () => ({
+  cookie: () => {},
+})
+
+describe('authBearer middleware', () => {
+  test('should extract and decode JWT bearer token from Authorization header', async () => {
+    const mockUserSession: CoreUserSession = { userId: 'user123' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async (token: string) => {
+        assert.equal(token, 'jwt-token')
+        return mockUserSession
+      },
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        ...createMiddlewareSessionWireProps(SessionService),
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer jwt-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.deepEqual(SessionService.get(), mockUserSession)
+  })
+
+  test('should handle case-insensitive Authorization header', async () => {
+    const mockUserSession: CoreUserSession = { userId: 'user456' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async (token: string) => {
+        assert.equal(token, 'jwt-token-2')
+        return mockUserSession
+      },
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        ...createMiddlewareSessionWireProps(SessionService),
+        http: {
+          request: createMockHTTPRequest({
+            Authorization: 'Bearer jwt-token-2',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.deepEqual(SessionService.get(), mockUserSession)
+  })
+
+  test('should validate static token when token option is provided', async () => {
+    const mockUserSession: CoreUserSession = {
+      userId: 'static-user',
+      role: 'admin',
+    }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => {
+        // Should not be called in static token mode
+        assert.fail('JWT decode should not be called in static token mode')
+        return null
+      },
+    }
+
+    const middleware = authBearer({
+      token: {
+        value: 'my-static-token',
+        userSession: mockUserSession,
+      },
+    })
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        ...createMiddlewareSessionWireProps(SessionService),
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer my-static-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.deepEqual(SessionService.get(), mockUserSession)
+  })
+
+  test('should throw InvalidSessionError when scheme is not Bearer', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+
+    await assert.rejects(
+      async () => {
+        await middleware(
+          { jwt: jwtService } as any,
+          {
+            ...createMiddlewareSessionWireProps(SessionService),
+            http: {
+              request: createMockHTTPRequest({
+                authorization: 'Basic some-token',
+              }),
+              response: createMockHTTPResponse(),
+            },
+          } as any,
+          async () => {}
+        )
+      },
+      (error: any) => {
+        assert(error instanceof InvalidSessionError)
+        return true
+      }
+    )
+  })
+
+  test('should throw InvalidSessionError when bearer token is missing', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+
+    await assert.rejects(
+      async () => {
+        await middleware(
+          { jwt: jwtService } as any,
+          {
+            ...createMiddlewareSessionWireProps(SessionService),
+            http: {
+              request: createMockHTTPRequest({
+                authorization: 'Bearer',
+              }),
+              response: createMockHTTPResponse(),
+            },
+          } as any,
+          async () => {}
+        )
+      },
+      (error: any) => {
+        assert(error instanceof InvalidSessionError)
+        return true
+      }
+    )
+  })
+
+  test('should throw InvalidSessionError when authorization header has no space', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+
+    await assert.rejects(
+      async () => {
+        await middleware(
+          { jwt: jwtService } as any,
+          {
+            ...createMiddlewareSessionWireProps(SessionService),
+            http: {
+              request: createMockHTTPRequest({
+                authorization: 'BearerToken',
+              }),
+              response: createMockHTTPResponse(),
+            },
+          } as any,
+          async () => {}
+        )
+      },
+      (error: any) => {
+        assert(error instanceof InvalidSessionError)
+        return true
+      }
+    )
+  })
+
+  test('should not set session when JWT decode returns null', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => null,
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        ...createMiddlewareSessionWireProps(SessionService),
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer invalid-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should not set session when static token does not match', async () => {
+    const mockUserSession: CoreUserSession = { userId: 'static-user' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => {
+        // Should not be called when static token is provided
+        assert.fail('JWT decode should not be called in static token mode')
+        return null
+      },
+    }
+
+    const middleware = authBearer({
+      token: {
+        value: 'correct-token',
+        userSession: mockUserSession,
+      },
+    })
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        ...createMiddlewareSessionWireProps(SessionService),
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer wrong-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should skip middleware when session already exists', async () => {
+    const existingSession: CoreUserSession = { userId: 'existing' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    SessionService.setInitial(existingSession)
+
+    let decodeCalled = false
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => {
+        decodeCalled = true
+        return { userId: 'new' }
+      },
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        ...createMiddlewareSessionWireProps(SessionService),
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer some-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(decodeCalled, false)
+    assert.deepEqual(SessionService.get(), existingSession)
+  })
+
+  test('should skip middleware when http.request is not available', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      { ...createMiddlewareSessionWireProps(SessionService) } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should continue without session when authorization header is missing', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+    const jwtService = {
+      encode: async () => 'token',
+      decode: async () => ({ userId: 'test' }),
+    }
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: jwtService } as any,
+      {
+        ...createMiddlewareSessionWireProps(SessionService),
+        http: {
+          request: createMockHTTPRequest({}),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should not decode when jwtService is not available in JWT mode', async () => {
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+
+    const middleware = authBearer()
+    let nextCalled = false
+
+    await middleware(
+      { jwt: undefined } as any,
+      {
+        ...createMiddlewareSessionWireProps(SessionService),
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer some-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.equal(SessionService.get(), undefined)
+  })
+
+  test('should work in static token mode even when jwtService is not available', async () => {
+    const mockUserSession: CoreUserSession = { userId: 'static-user' }
+    const SessionService = new PikkuSessionService<CoreUserSession>()
+
+    const middleware = authBearer({
+      token: {
+        value: 'static-token',
+        userSession: mockUserSession,
+      },
+    })
+    let nextCalled = false
+
+    await middleware(
+      { jwt: undefined } as any,
+      {
+        ...createMiddlewareSessionWireProps(SessionService),
+        http: {
+          request: createMockHTTPRequest({
+            authorization: 'Bearer static-token',
+          }),
+          response: createMockHTTPResponse(),
+        },
+      } as any,
+      async () => {
+        nextCalled = true
+      }
+    )
+
+    assert.equal(nextCalled, true)
+    assert.deepEqual(SessionService.get(), mockUserSession)
+  })
+})

package/src/middleware/auth-bearer.ts

@@ -0,0 +1,72 @@
+import { InvalidSessionError } from '../errors/errors.js'
+import type { CoreUserSession } from '../types/core.types.js'
+import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js'
+
+/**
+ * Bearer token middleware that extracts and validates tokens from the Authorization header.
+ *
+ * Supports two modes:
+ * - JWT decoding (default): Decodes bearer tokens using the JWT service
+ * - Static token: Provide a `token` object with a value and userSession for simple token validation
+ *
+ * @param options.token - Optional static token configuration { value: string, userSession: CoreUserSession }
+ *
+ * @example
+ * ```typescript
+ * import { authBearer } from '@pikku/core/middleware'
+ *
+ * // JWT mode (default)
+ * addHTTPMiddleware('*', [
+ *   authBearer()
+ * ])
+ *
+ * // Static token mode
+ * addHTTPMiddleware('*', [
+ *   authBearer({
+ *     token: {
+ *       value: process.env.API_TOKEN,
+ *       userSession: { userId: 'system', role: 'admin' }
+ *     }
+ *   })
+ * ])
+ * ```
+ */
+export const authBearer = pikkuMiddlewareFactory<{
+  token?: {
+    value: string
+    userSession: CoreUserSession
+  }
+}>(({ token } = {}) =>
+  pikkuMiddleware(
+    async ({ jwt: jwtService }, { http, setSession, session }, next) => {
+      if (!http?.request || !setSession || session) {
+        return next()
+      }
+
+      const authHeader =
+        http.request.header('authorization') ||
+        http.request.header('Authorization')
+
+      if (authHeader) {
+        const [scheme, bearerToken] = authHeader.split(' ')
+        if (scheme !== 'Bearer' || !bearerToken) {
+          throw new InvalidSessionError()
+        }
+
+        let userSession: CoreUserSession | null = null
+
+        if (token && bearerToken === token.value) {
+          userSession = token.userSession
+        } else if (jwtService && !token) {
+          userSession = await jwtService.decode(bearerToken)
+        }
+
+        if (userSession) {
+          setSession?.(userSession)
+        }
+      }
+
+      return next()
+    }
+  )
+)