@prosopo/client-example-server 2.7.171 → 2.7.172

package/src/tests/authHarness.ts

@@ -1,131 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type { KeyringPair } from "@prosopo/types";
-import type { ProsopoServerConfigOutput } from "@prosopo/types";
-import type { Request, Response } from "express";
-import type { Connection } from "mongoose";
-import { vi } from "vitest";
-import type { UserInterface } from "../models/user.js";
-
-export const SITE_KEY = "site-key-address";
-export const SECRET = "//Alice";
-export const VERIFY_ENDPOINT = "https://api.prosopo.io/siteverify";
-
-/** The subset of the config the controllers actually read. */
-export const serverConfig = (
-	options: { secret?: string } = { secret: SECRET },
-): ProsopoServerConfigOutput =>
-	({
-		account: { secret: options.secret },
-		defaultEnvironment: "development",
-		serverUrl: "https://localhost:9228",
-	}) as unknown as ProsopoServerConfigOutput;
-
-/**
- * getPair returns a real keyring pair in production; the controllers only ever
- * compare `address` and hand the pair to ProsopoServer, so a stub with the
- * address is enough to drive every branch of the site-key matching.
- */
-export const pairWithAddress = (address: string): KeyringPair =>
-	({ address }) as unknown as KeyringPair;
-
-export type FoundUser = Pick<UserInterface, "password" | "salt">;
-
-export interface UserModelStub {
-	findOne: ReturnType<typeof vi.fn>;
-	create: ReturnType<typeof vi.fn>;
-}
-
-/**
- * A mongoose connection whose `model()` hands back a stub with the two methods
- * the controllers call. The real model would need a live mongod, and its
- * query builder is chainable in ways nothing here relies on.
- */
-export const connectionWith = (
-	model: UserModelStub,
-): { connection: Connection; model: UserModelStub } => ({
-	connection: {
-		model: () => model,
-	} as unknown as Connection,
-	model,
-});
-
-export const userModel = (options: {
-	found?: FoundUser | null;
-	findOneRejects?: Error;
-	createRejects?: Error;
-}): UserModelStub => ({
-	findOne: vi.fn(() =>
-		options.findOneRejects
-			? Promise.reject(options.findOneRejects)
-			: Promise.resolve(options.found ?? null),
-	),
-	create: vi.fn(() =>
-		options.createRejects
-			? Promise.reject(options.createRejects)
-			: Promise.resolve({}),
-	),
-});
-
-export interface ResponseStub {
-	response: Response;
-	statuses: number[];
-	bodies: unknown[];
-}
-
-/** Records what the handler wrote, in order, so double-sends are visible. */
-export const responseStub = (): ResponseStub => {
-	const statuses: number[] = [];
-	const bodies: unknown[] = [];
-	const response = {
-		status: (code: number) => {
-			statuses.push(code);
-			return response;
-		},
-		json: (body: unknown) => {
-			bodies.push(body);
-			return response;
-		},
-	};
-	return {
-		response: response as unknown as Response,
-		statuses,
-		bodies,
-	};
-};
-
-export const request = (options: {
-	body?: Record<string, unknown>;
-	headers?: Record<string, string>;
-	authorization?: string;
-}): Request =>
-	({
-		body: options.body ?? {},
-		headers: options.headers ?? {},
-		get: (name: string) =>
-			name === "Authorization" ? options.authorization : undefined,
-	}) as unknown as Request;
-
-/** A body that satisfies SubscribeBodySpec. */
-export const signupBody = (
-	overrides: Record<string, unknown> = {},
-): Record<string, unknown> => ({
-	email: "user@example.com",
-	password: "hunter2",
-	name: "user",
-	siteKey: SITE_KEY,
-	"procaptcha-response": "0xtoken",
-	...overrides,
-});

package/src/tests/clientExampleServer.test-d.ts

@@ -1,146 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type { Server } from "node:http";
-import type { ProsopoServerConfigOutput } from "@prosopo/types";
-import type express from "express";
-import type { Connection } from "mongoose";
-import { assertType, describe, expectTypeOf, test } from "vitest";
-import {
-	type ProsopoVerificationType,
-	createApp,
-	isDevelopmentOrTest,
-	main,
-	resolvePort,
-	resolveVerifyEndpoint,
-	resolveVerifyType,
-	startServer,
-} from "../app.js";
-import { isAuth, login, signup } from "../controllers/auth.js";
-import type UserSchema from "../models/user.js";
-import type { UserInterface } from "../models/user.js";
-import getRoutes from "../routes/routes.js";
-import connectionFactory from "../utils/connection.js";
-import memoryServerSetup from "../utils/database.js";
-
-describe("the app module's types", () => {
-	test("the environment readers take no arguments", () => {
-		expectTypeOf(resolveVerifyEndpoint).parameters.toEqualTypeOf<[]>();
-		expectTypeOf(resolveVerifyEndpoint).returns.toEqualTypeOf<string>();
-		expectTypeOf(
-			resolveVerifyType,
-		).returns.toEqualTypeOf<ProsopoVerificationType>();
-		expectTypeOf(isDevelopmentOrTest).returns.toEqualTypeOf<boolean>();
-	});
-
-	test("the verification type is a closed set", () => {
-		expectTypeOf<`${ProsopoVerificationType}`>().toEqualTypeOf<
-			"api" | "local"
-		>();
-		// @ts-expect-error - anything else has to fall back to the API at runtime.
-		assertType<ProsopoVerificationType>("carrier-pigeon");
-	});
-
-	test("the port comes from the shared server config, not a loose object", () => {
-		expectTypeOf(resolvePort)
-			.parameter(0)
-			.toEqualTypeOf<ProsopoServerConfigOutput>();
-		expectTypeOf(resolvePort).returns.toEqualTypeOf<number>();
-	});
-
-	test("createApp yields an express app the caller can mount routes on", () => {
-		expectTypeOf(createApp).returns.toEqualTypeOf<express.Express>();
-	});
-
-	test("startServer's module directory is optional and it returns a server", () => {
-		expectTypeOf(startServer).parameter(1).toEqualTypeOf<number>();
-		expectTypeOf(startServer).parameter(2).toEqualTypeOf<string | undefined>();
-		expectTypeOf(startServer).returns.toEqualTypeOf<Server>();
-	});
-
-	test("main resolves to the server it started, so a caller can close it", () => {
-		expectTypeOf(main).parameters.toEqualTypeOf<[]>();
-		expectTypeOf(main).returns.toEqualTypeOf<Promise<Server>>();
-	});
-});
-
-describe("the router's types", () => {
-	test("routes are built from a connection, config and verification settings", () => {
-		expectTypeOf(getRoutes).parameters.toEqualTypeOf<
-			[Connection, ProsopoServerConfigOutput, string, string]
-		>();
-		expectTypeOf(getRoutes).returns.toEqualTypeOf<express.Router>();
-	});
-
-	test("every argument is required", () => {
-		// @ts-expect-error - a router with no verification settings would
-		// silently accept unverified signups.
-		getRoutes({} as Connection, {} as ProsopoServerConfigOutput, "endpoint");
-	});
-});
-
-describe("the controllers' types", () => {
-	test("signup and login are express handlers with their context bound first", () => {
-		expectTypeOf(signup).parameter(0).toEqualTypeOf<Connection>();
-		expectTypeOf(signup)
-			.parameter(1)
-			.toEqualTypeOf<ProsopoServerConfigOutput>();
-		expectTypeOf(signup).parameter(2).toEqualTypeOf<string>();
-		expectTypeOf(signup).parameter(3).toEqualTypeOf<string>();
-		expectTypeOf(signup).returns.toExtend<Promise<unknown>>();
-		expectTypeOf(login).parameter(0).toEqualTypeOf<Connection>();
-		expectTypeOf(login).returns.toEqualTypeOf<Promise<void>>();
-	});
-
-	test("isAuth needs nothing bound, so it mounts directly", () => {
-		expectTypeOf(isAuth).parameters.toEqualTypeOf<
-			[express.Request, express.Response]
-		>();
-	});
-});
-
-describe("the persistence types", () => {
-	test("connectionFactory takes a URI and returns a mongoose connection", () => {
-		expectTypeOf(connectionFactory).parameters.toEqualTypeOf<[string]>();
-		expectTypeOf(connectionFactory).returns.toEqualTypeOf<Connection>();
-	});
-
-	test("the memory server hands back a URI string", () => {
-		expectTypeOf(memoryServerSetup).parameters.toEqualTypeOf<[]>();
-		expectTypeOf(memoryServerSetup).returns.toEqualTypeOf<Promise<string>>();
-	});
-
-	test("the user schema is typed by the interface it stores", () => {
-		expectTypeOf<keyof typeof UserSchema.obj>().toEqualTypeOf<
-			keyof UserInterface
-		>();
-		expectTypeOf<UserInterface>().toEqualTypeOf<{
-			id: number;
-			email: string;
-			name: string;
-			password: string;
-			salt: string;
-		}>();
-	});
-
-	test("a user document cannot be built without credentials", () => {
-		// @ts-expect-error - salt is what makes the stored hash meaningful.
-		assertType<UserInterface>({
-			id: 1,
-			email: "user@example.com",
-			name: "user",
-			password: "0xhash",
-		});
-	});
-});

package/src/tests/routes.unit.test.ts

@@ -1,166 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type { Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import express from "express";
-import type { Connection } from "mongoose";
-import { afterEach, describe, expect, test, vi } from "vitest";
-import getRoutes from "../routes/routes.js";
-import { VERIFY_ENDPOINT, serverConfig } from "./authHarness.js";
-
-/**
- * The controllers have their own suite; here we only care that each path is
- * bound to the right handler and that the bound arguments reach it.
- */
-const mocks = vi.hoisted(() => ({
-	calls: [] as { handler: string; args: unknown[] }[],
-}));
-
-vi.mock("../controllers/auth.js", () => {
-	type Handler = (...args: unknown[]) => void;
-	const record =
-		(handler: string): Handler =>
-		(...args: unknown[]) => {
-			mocks.calls.push({ handler, args: args.slice(0, 4) });
-			const res = args[args.length - 2] as {
-				status: (code: number) => { json: (body: unknown) => void };
-			};
-			res.status(200).json({ handler });
-		};
-	return {
-		signup: record("signup"),
-		login: record("login"),
-		// isAuth is mounted directly, so it only ever gets (req, res).
-		isAuth: (_req: unknown, res: unknown) =>
-			(res as { status: (code: number) => { json: (body: unknown) => void } })
-				.status(200)
-				.json({ handler: "isAuth" }),
-	};
-});
-
-const connection: Connection = {} as unknown as Connection;
-
-let server: Server | undefined;
-
-const listen = (): Promise<string> => {
-	const app = express();
-	app.use(express.json());
-	app.use(getRoutes(connection, serverConfig(), VERIFY_ENDPOINT, "api"));
-	return new Promise((resolve) => {
-		server = app.listen(0, () => {
-			const { port } = server?.address() as AddressInfo;
-			resolve(`http://127.0.0.1:${port}`);
-		});
-	});
-};
-
-afterEach(async () => {
-	mocks.calls.length = 0;
-	await new Promise<void>((resolve) => {
-		if (!server) return resolve();
-		server.close(() => resolve());
-		server = undefined;
-	});
-});
-
-describe("the router", () => {
-	test("serves the public resource without any authentication", async () => {
-		const base = await listen();
-		const response = await fetch(`${base}/public`);
-		expect(response.status).toBe(200);
-		expect(await response.json()).toEqual({
-			message: "here is your public resource",
-		});
-	});
-
-	test("answers health checks", async () => {
-		const base = await listen();
-		const response = await fetch(`${base}/health`);
-		expect(response.status).toBe(200);
-		expect(await response.json()).toEqual({ status: "ok" });
-	});
-
-	test("routes a signup to the signup handler, with the bound context", async () => {
-		const base = await listen();
-		const response = await fetch(`${base}/signup`, {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({ email: "user@example.com" }),
-		});
-		expect(response.status).toBe(200);
-		expect(mocks.calls[0]?.handler).toBe("signup");
-		expect(mocks.calls[0]?.args).toEqual([
-			connection,
-			serverConfig(),
-			VERIFY_ENDPOINT,
-			"api",
-		]);
-	});
-
-	test("routes a login to the login handler", async () => {
-		const base = await listen();
-		await fetch(`${base}/login`, {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({}),
-		});
-		expect(mocks.calls[0]?.handler).toBe("login");
-	});
-
-	test("guards the private resource", async () => {
-		const base = await listen();
-		const response = await fetch(`${base}/private`);
-		expect(await response.json()).toEqual({ handler: "isAuth" });
-	});
-
-	test("answers anything else with a 404 body, not express's HTML", async () => {
-		const base = await listen();
-		const response = await fetch(`${base}/nope`);
-		expect(response.status).toBe(404);
-		expect(await response.json()).toEqual({ error: "page not found" });
-	});
-
-	test("a GET to a POST-only path falls through to the catch-all", async () => {
-		const base = await listen();
-		const response = await fetch(`${base}/login`);
-		expect(response.status).toBe(404);
-		expect(mocks.calls).toHaveLength(0);
-	});
-
-	test("each call builds a fresh router", async () => {
-		// The module used to share one router across calls, so a second server
-		// stacked a second set of handlers on top of the first call's bound
-		// config and answered every request with the stale one.
-		const first = getRoutes(connection, serverConfig(), "https://one", "api");
-		const second = getRoutes(connection, serverConfig(), "https://two", "api");
-		expect(first).not.toBe(second);
-		const app = express();
-		app.use(express.json());
-		app.use(second);
-		const base = await new Promise<string>((resolve) => {
-			server = app.listen(0, () => {
-				const { port } = server?.address() as AddressInfo;
-				resolve(`http://127.0.0.1:${port}`);
-			});
-		});
-		await fetch(`${base}/signup`, {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({}),
-		});
-		expect(mocks.calls).toHaveLength(1);
-		expect(mocks.calls[0]?.args[2]).toBe("https://two");
-	});
-});

package/src/tests/utils.unit.test.ts

@@ -1,169 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type { Connection, Schema } from "mongoose";
-import { beforeEach, describe, expect, test, vi } from "vitest";
-import UserSchema, { type UserInterface } from "../models/user.js";
-import connectionFactory from "../utils/connection.js";
-import memoryServerSetup from "../utils/database.js";
-
-/**
- * connectionFactory opens a real mongo connection and registers a model on
- * it. Both mongoose and the auto-increment plugin are replaced so the test
- * observes the wiring without a database.
- */
-const mocks = vi.hoisted(() => ({
-	createConnection: vi.fn(),
-	models: {} as Record<string, unknown>,
-	model: vi.fn(),
-	plugin: vi.fn(),
-	connectionOptions: vi.fn(),
-	memoryUri: "mongodb://memory:27017/",
-	memoryCreate: vi.fn(),
-}));
-
-vi.mock("mongoose", async (importOriginal) => {
-	const actual = await importOriginal<typeof import("mongoose")>();
-	return {
-		...actual,
-		default: {
-			...actual.default,
-			createConnection: (...args: unknown[]) => {
-				mocks.createConnection(...args);
-				return {
-					models: mocks.models,
-					model: mocks.model,
-				} as unknown as Connection;
-			},
-		},
-	};
-});
-
-vi.mock("@typegoose/auto-increment", () => ({
-	AutoIncrementID: "auto-increment-plugin",
-}));
-
-vi.mock("@prosopo/database", async (importOriginal) => {
-	const actual = await importOriginal<typeof import("@prosopo/database")>();
-	return {
-		...actual,
-		getMongoConnectionOptions: (args: { url: string; appName: string }) => {
-			mocks.connectionOptions(args);
-			return { appName: args.appName };
-		},
-	};
-});
-
-vi.mock("mongodb-memory-server", () => ({
-	MongoMemoryServer: {
-		create: () => {
-			mocks.memoryCreate();
-			return Promise.resolve({ getUri: () => mocks.memoryUri });
-		},
-	},
-}));
-
-beforeEach(() => {
-	mocks.createConnection.mockClear();
-	mocks.model.mockClear();
-	mocks.plugin.mockClear();
-	mocks.connectionOptions.mockClear();
-	mocks.memoryCreate.mockClear();
-	mocks.models = {};
-	vi.spyOn(UserSchema, "plugin").mockImplementation(
-		(...args: unknown[]): Schema<UserInterface> => {
-			mocks.plugin(...args);
-			return UserSchema;
-		},
-	);
-});
-
-describe("connectionFactory", () => {
-	const URI = "mongodb://localhost:27017/client-example";
-
-	test("connects to the URI it was given", () => {
-		connectionFactory(URI);
-		expect(mocks.createConnection).toHaveBeenCalledTimes(1);
-		expect(mocks.createConnection.mock.calls[0]?.[0]).toBe(URI);
-	});
-
-	test("names the connection after the module, for mongo's server logs", () => {
-		connectionFactory(URI);
-		const options = mocks.createConnection.mock.calls[0]?.[1] as {
-			appName: string;
-		};
-		expect(options.appName).toContain("connection");
-		expect(mocks.connectionOptions).toHaveBeenCalledWith({
-			url: URI,
-			appName: options.appName,
-		});
-	});
-
-	test("registers the User model with auto-incrementing ids", () => {
-		connectionFactory(URI);
-		expect(mocks.plugin).toHaveBeenCalledWith("auto-increment-plugin", {
-			field: "id",
-		});
-		expect(mocks.model).toHaveBeenCalledWith("User", UserSchema);
-	});
-
-	test("leaves an already-registered model alone", () => {
-		// Re-registering throws in mongoose (OverwriteModelError), so the
-		// factory has to be safe to call on a connection that has been set up.
-		mocks.models = { user: {} };
-		connectionFactory(URI);
-		expect(mocks.model).not.toHaveBeenCalled();
-		expect(mocks.plugin).not.toHaveBeenCalled();
-	});
-
-	test("returns the connection it created", () => {
-		const connection = connectionFactory(URI);
-		expect(connection.model).toBe(mocks.model);
-	});
-});
-
-describe("memoryServerSetup", () => {
-	test("boots an in-memory mongo and returns its URI", async () => {
-		await expect(memoryServerSetup()).resolves.toBe(mocks.memoryUri);
-		expect(mocks.memoryCreate).toHaveBeenCalledTimes(1);
-	});
-
-	test("each call gets its own server", async () => {
-		await memoryServerSetup();
-		await memoryServerSetup();
-		expect(mocks.memoryCreate).toHaveBeenCalledTimes(2);
-	});
-});
-
-describe("the User schema", () => {
-	test("requires the fields a login needs to work", () => {
-		// Without email, password and salt, a stored user cannot be logged in.
-		for (const field of ["email", "password", "salt"]) {
-			expect(UserSchema.path(field).isRequired).toBe(true);
-		}
-	});
-
-	test("leaves name and id optional", () => {
-		// `id` is filled in by the auto-increment plugin after validation.
-		expect(UserSchema.path("name").isRequired).toBeFalsy();
-		expect(UserSchema.path("id").isRequired).toBeFalsy();
-	});
-
-	test("stores the id as a number and the rest as strings", () => {
-		expect(UserSchema.path("id").instance).toBe("Number");
-		for (const field of ["email", "name", "password", "salt"]) {
-			expect(UserSchema.path(field).instance).toBe("String");
-		}
-	});
-});

package/src/utils/connection.ts

@@ -1,41 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-import { fileURLToPath } from "node:url";
-import { getMongoConnectionOptions } from "@prosopo/database";
-import {
-	AutoIncrementID,
-	type AutoIncrementIDOptions,
-} from "@typegoose/auto-increment";
-import mongoose, { type Connection } from "mongoose";
-import UserSchema from "../models/user.js";
-
-function connectionFactory(uri: string): Connection {
-	const appName = fileURLToPath(import.meta.url);
-
-	const conn = mongoose.createConnection(
-		uri,
-		getMongoConnectionOptions({
-			url: uri,
-			appName,
-		}),
-	);
-	if (!conn.models.user) {
-		UserSchema.plugin(AutoIncrementID, {
-			field: "id",
-		} as AutoIncrementIDOptions);
-		conn.model("User", UserSchema);
-	}
-	return conn;
-}
-export default connectionFactory;

package/src/utils/database.ts

@@ -1,22 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-export async function memoryServerSetup(): Promise<string> {
-	const MongoMemoryServer = (await import("mongodb-memory-server"))
-		.MongoMemoryServer;
-	const mongod = MongoMemoryServer.create();
-	const memoryServer = await mongod;
-	return memoryServer.getUri();
-}
-export default memoryServerSetup;