@powersync/service-core 0.0.2

package/test/src/auth.test.ts

@@ -0,0 +1,340 @@
+import { describe, expect, test } from 'vitest';
+import { StaticKeyCollector } from '../../src/auth/StaticKeyCollector.js';
+import * as jose from 'jose';
+import { KeyStore } from '../../src/auth/KeyStore.js';
+import { KeySpec } from '../../src/auth/KeySpec.js';
+import { RemoteJWKSCollector } from '../../src/auth/RemoteJWKSCollector.js';
+import { KeyResult } from '../../src/auth/KeyCollector.js';
+import { CachedKeyCollector } from '../../src/auth/CachedKeyCollector.js';
+
+const publicKey: jose.JWK = {
+  use: 'sig',
+  kty: 'RSA',
+  e: 'AQAB',
+  kid: 'f2e82732b971a135cf1416e8b46dae04d80894e7',
+  alg: 'RS256',
+  n: 'v7wW9w5vzvACxbo2Ldqt0IHBy0LCloQvnfIr-nhEKmqgBJeBgF2cZSGz0Fe-grRaAvhhDrxaOft2JvZlbUM8vFFnxx-52dYViDBxv8vDxmV1HeEGV69DYrGxnsOLrHQWKkPSeyxtidiwGrNVYuyC21PG1heScTYppxVSHBUh_D9di56ql16Xytv97FJHeBtEYUmyzLQsWGhfzuLBwYSSuZxia4p3-azlztHisht4Ai1KYpX0HWLjh9NGIMzimk2cNdKZjIO1Mm4Tu5S1z9dCauZdocpE5csFHyeLHY3oeXFNgl9GanyM9IAg-0T5QLJA-C6M9lUO4WuVmOtLM_iGlw'
+};
+
+const sharedKey: jose.JWK = {
+  kid: 'k1',
+  alg: 'HS256',
+  kty: 'oct',
+  k: Buffer.from('mysecret1', 'utf-8').toString('base64url')
+};
+
+const sharedKey2: jose.JWK = {
+  alg: 'HS256',
+  kty: 'oct',
+  k: Buffer.from('mysecret2', 'utf-8').toString('base64url')
+};
+
+describe('JWT Auth', () => {
+  test('KeyStore basics', async () => {
+    const keys = await StaticKeyCollector.importKeys([sharedKey]);
+    const store = new KeyStore(keys);
+    const signKey = (await jose.importJWK(sharedKey)) as jose.KeyLike;
+    const signedJwt = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256', kid: 'k1' })
+      .setSubject('f1')
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('tests')
+      .setExpirationTime('5m')
+      .sign(signKey);
+
+    const verified = await store.verifyJwt(signedJwt, {
+      defaultAudiences: ['tests'],
+      maxAge: '6m'
+    });
+    expect(verified.sub).toEqual('f1');
+    await expect(
+      store.verifyJwt(signedJwt, {
+        defaultAudiences: ['other'],
+        maxAge: '6m'
+      })
+    ).rejects.toThrow('unexpected "aud" claim value');
+
+    await expect(
+      store.verifyJwt(signedJwt, {
+        defaultAudiences: [],
+        maxAge: '6m'
+      })
+    ).rejects.toThrow('unexpected "aud" claim value');
+
+    await expect(
+      store.verifyJwt(signedJwt, {
+        defaultAudiences: ['tests'],
+        maxAge: '1m'
+      })
+    ).rejects.toThrow('Token must expire in a maximum of');
+
+    const signedJwt2 = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256', kid: 'k1' })
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('tests')
+      .setExpirationTime('5m')
+      .sign(signKey);
+
+    await expect(
+      store.verifyJwt(signedJwt2, {
+        defaultAudiences: ['tests'],
+        maxAge: '5m'
+      })
+    ).rejects.toThrow('missing required "sub" claim');
+  });
+
+  test('Algorithm validation', async () => {
+    const keys = await StaticKeyCollector.importKeys([publicKey]);
+    const store = new KeyStore(keys);
+
+    // Bad attempt at signing token with rsa public key
+    const spoofedKey: jose.JWK = {
+      kty: 'oct',
+      kid: publicKey.kid!,
+      alg: 'HS256',
+      k: publicKey.n!
+    };
+    const signKey = (await jose.importJWK(spoofedKey)) as jose.KeyLike;
+
+    const signedJwt = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256', kid: publicKey.kid! })
+      .setSubject('f1')
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('tests')
+      .setExpirationTime('5m')
+      .sign(signKey);
+
+    await expect(
+      store.verifyJwt(signedJwt, {
+        defaultAudiences: ['tests'],
+        maxAge: '6m'
+      })
+    ).rejects.toThrow('Unexpected token algorithm HS256');
+  });
+
+  test('key selection for key with kid', async () => {
+    const keys = await StaticKeyCollector.importKeys([publicKey, sharedKey, sharedKey2]);
+    const store = new KeyStore(keys);
+    const signKey = (await jose.importJWK(sharedKey)) as jose.KeyLike;
+    const signKey2 = (await jose.importJWK(sharedKey2)) as jose.KeyLike;
+
+    // No kid
+    const signedJwt = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256' })
+      .setSubject('f1')
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('tests')
+      .setExpirationTime('5m')
+      .sign(signKey);
+
+    await expect(
+      store.verifyJwt(signedJwt, {
+        defaultAudiences: ['tests'],
+        maxAge: '6m'
+      })
+    ).rejects.toThrow(
+      'Could not find an appropriate key in the keystore. The key is missing or no key matched the token KID'
+    );
+
+    // Wrong kid
+    const signedJwt2 = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256', kid: 'other' })
+      .setSubject('f1')
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('tests')
+      .setExpirationTime('5m')
+      .sign(signKey);
+
+    await expect(
+      store.verifyJwt(signedJwt2, {
+        defaultAudiences: ['tests'],
+        maxAge: '6m'
+      })
+    ).rejects.toThrow(
+      'Could not find an appropriate key in the keystore. The key is missing or no key matched the token KID'
+    );
+
+    // No kid, matches sharedKey2
+    const signedJwt3 = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256' })
+      .setSubject('f1')
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('tests')
+      .setExpirationTime('5m')
+      .sign(signKey2);
+
+    await expect(
+      store.verifyJwt(signedJwt3, {
+        defaultAudiences: ['tests'],
+        maxAge: '6m'
+      })
+    ).resolves.toMatchObject({ sub: 'f1' });
+
+    // Random kid, matches sharedKey2
+    const signedJwt4 = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256', kid: 'other' })
+      .setSubject('f1')
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('tests')
+      .setExpirationTime('5m')
+      .sign(signKey2);
+
+    await expect(
+      store.verifyJwt(signedJwt4, {
+        defaultAudiences: ['tests'],
+        maxAge: '6m'
+      })
+    ).resolves.toMatchObject({ sub: 'f1' });
+  });
+
+  test('KeyOptions', async () => {
+    const keys = new StaticKeyCollector([
+      await KeySpec.importKey(sharedKey, {
+        // This overrides the default validation options
+        requiresAudience: ['other'],
+        maxLifetimeSeconds: 3600
+      })
+    ]);
+    const store = new KeyStore(keys);
+    const signKey = (await jose.importJWK(sharedKey)) as jose.KeyLike;
+    const signedJwt = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256', kid: 'k1' })
+      .setSubject('f1')
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('other')
+      .setExpirationTime('50m')
+      .sign(signKey);
+
+    const verified = await store.verifyJwt(signedJwt, {
+      defaultAudiences: ['tests'],
+      maxAge: '6m'
+    });
+    expect(verified.sub).toEqual('f1');
+
+    const signedJwt2 = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256', kid: 'k1' })
+      .setSubject('f1')
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('tests') // Doesn't match KeyOptions audience
+      .setExpirationTime('50m')
+      .sign(signKey);
+
+    await expect(
+      store.verifyJwt(signedJwt2, {
+        defaultAudiences: ['tests'],
+        maxAge: '6m'
+      })
+    ).rejects.toThrow('unexpected "aud" claim value');
+
+    const signedJwt3 = await new jose.SignJWT({})
+      .setProtectedHeader({ alg: 'HS256', kid: 'k1' })
+      .setSubject('f1')
+      .setIssuedAt()
+      .setIssuer('tester')
+      .setAudience('other')
+      .setExpirationTime('70m') // longer than KeyOptions expiration
+      .sign(signKey);
+
+    await expect(
+      store.verifyJwt(signedJwt3, {
+        defaultAudiences: ['tests'],
+        maxAge: '6m'
+      })
+    ).rejects.toThrow('Token must expire in a maximum of');
+  });
+
+  test('http', async () => {
+    // Not ideal to rely on an external endpoint for tests, but it is good to test that this
+    // one actually works.
+    const remote = new RemoteJWKSCollector(
+      'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com'
+    );
+    const { keys, errors } = await remote.getKeys();
+    expect(errors).toEqual([]);
+    expect(keys.length).toBeGreaterThanOrEqual(1);
+
+    const invalid = new RemoteJWKSCollector('https://localhost/.well-known/jwks.json', {
+      block_local_ip: true
+    });
+    expect(invalid.getKeys()).rejects.toThrow('IPs in this range are not supported');
+  });
+
+  test('http not blocking local IPs', async () => {
+    // Not ideal to rely on an external endpoint for tests, but it is good to test that this
+    // one actually works.
+    const remote = new RemoteJWKSCollector(
+      'https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com'
+    );
+    const { keys, errors } = await remote.getKeys();
+    expect(errors).toEqual([]);
+    expect(keys.length).toBeGreaterThanOrEqual(1);
+
+    const invalid = new RemoteJWKSCollector('https://localhost/.well-known/jwks.json');
+    // Should try and fetch
+    expect(invalid.getKeys()).rejects.toThrow('ECONNREFUSED');
+  });
+
+  test('caching', async () => {
+    let currentResponse: Promise<KeyResult>;
+
+    const cached = new CachedKeyCollector({
+      async getKeys() {
+        return currentResponse;
+      }
+    });
+
+    currentResponse = Promise.resolve({
+      errors: [],
+      keys: [await KeySpec.importKey(publicKey)]
+    });
+
+    let key = (await cached.getKeys()).keys[0];
+    expect(key.kid).toEqual(publicKey.kid!);
+
+    currentResponse = undefined as any;
+
+    key = (await cached.getKeys()).keys[0];
+    expect(key.kid).toEqual(publicKey.kid!);
+
+    cached.addTimeForTests(301_000);
+    currentResponse = Promise.reject('refresh failed');
+
+    // Uses the promise, refreshes in the background
+    let response = await cached.getKeys();
+    expect(response.keys[0].kid).toEqual(publicKey.kid!);
+    expect(response.errors).toEqual([]);
+
+    // Wait for refresh to finish
+    await cached.addTimeForTests(0);
+    response = await cached.getKeys();
+    // Still have the cached key, but also have the error
+    expect(response.keys[0].kid).toEqual(publicKey.kid!);
+    expect(response.errors[0].message).toMatch('Failed to fetch');
+
+    await cached.addTimeForTests(3601_000);
+    response = await cached.getKeys();
+
+    // Now the keys have expired, and the request still fails
+    expect(response.keys).toEqual([]);
+    expect(response.errors[0].message).toMatch('Failed to fetch');
+
+    currentResponse = Promise.resolve({
+      errors: [],
+      keys: [await KeySpec.importKey(publicKey)]
+    });
+
+    // After a delay, we can refresh again
+    await cached.addTimeForTests(30_000);
+    key = (await cached.getKeys()).keys[0];
+    expect(key.kid).toEqual(publicKey.kid!);
+  });
+});

package/test/src/broadcast_iterable.test.ts

@@ -0,0 +1,156 @@
+import { AsyncIterableX, interval } from 'ix/asynciterable/index.js';
+import { delayEach } from 'ix/asynciterable/operators/delayeach.js';
+import { take } from 'ix/asynciterable/operators/take.js';
+import { wrapWithAbort } from 'ix/asynciterable/operators/withabort.js';
+import { toArray } from 'ix/asynciterable/toarray.js';
+import * as timers from 'timers/promises';
+import { describe, expect, test } from 'vitest';
+import { BroadcastIterable, IterableSource } from '../../src/sync/BroadcastIterable.js';
+
+describe('BroadcastIterable', () => {
+  test('should iterate', async () => {
+    const range = AsyncIterableX.from([1, 2, 3]);
+    const broadcast = new BroadcastIterable(() => range);
+
+    const results = await toArray(broadcast);
+    expect(results).toEqual([1, 2, 3]);
+    expect(broadcast.active).toBe(false);
+  });
+
+  test('should skip values if sink is slow', async () => {
+    const range = AsyncIterableX.from([1, 2, 3]);
+    const broadcast = new BroadcastIterable(() => range);
+
+    // Delay reading each element
+    const delayed = delayEach(1)(broadcast);
+    const results = await toArray(delayed);
+
+    // We only get a single value, then done.
+    expect(results).toEqual([1]);
+    expect(broadcast.active).toBe(false);
+  });
+
+  test('should abort', async () => {
+    const range = AsyncIterableX.from([1, 2, 3]);
+    let recordedSignal: AbortSignal | undefined;
+    const broadcast = new BroadcastIterable((signal) => {
+      recordedSignal = signal;
+      return range;
+    });
+
+    const controller = new AbortController();
+    const iter = broadcast[Symbol.asyncIterator](controller.signal);
+    await iter.next();
+    controller.abort();
+    await expect(iter.next()).rejects.toThrow('The operation has been aborted');
+    expect(recordedSignal!.aborted).toEqual(true);
+  });
+
+  test('should handle indefinite sources', async () => {
+    const source: IterableSource<number> = (signal) => {
+      return wrapWithAbort(interval(1), signal);
+    };
+
+    const broadcast = new BroadcastIterable(source);
+
+    const delayed = delayEach(10)(broadcast);
+    expect(broadcast.active).toBe(false);
+    const results = await toArray(take(5)(delayed));
+
+    expect(results.length).toEqual(5);
+    expect(results[0]).toEqual(0);
+    expect(results[4]).toBeGreaterThan(10);
+    expect(results[4]).toBeLessThan(40);
+
+    expect(broadcast.active).toBe(false);
+  });
+
+  test('should handle multiple subscribers', async () => {
+    let sourceIndex = 0;
+    const source = async function* (signal: AbortSignal) {
+      // Test value out by 1000 means it may have used the wrong iteration of the source
+      const base = (sourceIndex += 1000);
+      const abortedPromise = new Promise((resolve) => {
+        signal.addEventListener('abort', resolve, { once: true });
+      });
+      for (let i = 0; !signal.aborted; i++) {
+        yield base + i;
+        await Promise.race([abortedPromise, timers.setTimeout(1)]);
+      }
+      // Test value out by 100 means this wasn't reached
+      sourceIndex += 100;
+    };
+
+    const broadcast = new BroadcastIterable(source);
+
+    const delayed1 = delayEach(9)(broadcast);
+    const delayed2 = delayEach(10)(broadcast);
+    expect(broadcast.active).toBe(false);
+    const results1Promise = toArray(take(5)(delayed1));
+    const results2Promise = toArray(take(5)(delayed2));
+    const [results1, results2] = [await results1Promise, await results2Promise];
+
+    expect(broadcast.active).toBe(false);
+
+    expect(results1.length).toEqual(5);
+    expect(results1[0]).toEqual(1000);
+    expect(results1[4]).toBeGreaterThan(1010);
+    expect(results1[4]).toBeLessThan(1045);
+
+    expect(results2.length).toEqual(5);
+    expect(results2[0]).toEqual(1000);
+    expect(results2[4]).toBeGreaterThan(1010);
+    expect(results2[4]).toBeLessThan(1045);
+
+    // This starts a new source
+    const delayed3 = delayEach(10)(broadcast);
+    const results3 = await toArray(take(5)(delayed3));
+    expect(results3.length).toEqual(5);
+    expect(results3[0]).toEqual(2100);
+    expect(results3[4]).toBeGreaterThan(2110);
+    expect(results3[4]).toBeLessThan(2145);
+  });
+
+  test('should handle errors on multiple subscribers', async () => {
+    let sourceIndex = 0;
+    const source = async function* (signal: AbortSignal) {
+      // Test value out by 1000 means it may have used the wrong iteration of the source
+      const base = (sourceIndex += 1000);
+      const abortedPromise = new Promise((resolve) => {
+        signal.addEventListener('abort', resolve, { once: true });
+      });
+      for (let i = 0; !signal.aborted; i++) {
+        if (base + i == 1005) {
+          throw new Error('simulated failure');
+        }
+        yield base + i;
+        await Promise.race([abortedPromise, timers.setTimeout(1)]);
+      }
+      // Test value out by 100 means this wasn't reached
+      sourceIndex += 100;
+    };
+
+    const broadcast = new BroadcastIterable(source);
+
+    const delayed1 = delayEach(9)(broadcast);
+    const delayed2 = delayEach(10)(broadcast);
+    expect(broadcast.active).toBe(false);
+    const results1Promise = toArray(take(5)(delayed1)) as Promise<number[]>;
+    const results2Promise = toArray(take(5)(delayed2)) as Promise<number[]>;
+
+    const [r1, r2] = await Promise.allSettled([results1Promise, results2Promise]);
+
+    expect(r1).toEqual({ status: 'rejected', reason: new Error('simulated failure') });
+    expect(r2).toEqual({ status: 'rejected', reason: new Error('simulated failure') });
+
+    expect(broadcast.active).toBe(false);
+
+    // This starts a new source
+    const delayed3 = delayEach(10)(broadcast);
+    const results3 = await toArray(take(5)(delayed3));
+    expect(results3.length).toEqual(5);
+    expect(results3[0]).toEqual(2000);
+    expect(results3[4]).toBeGreaterThan(2010);
+    expect(results3[4]).toBeLessThan(2045);
+  });
+});