@rebasepro/server-core 0.0.1-canary.4d4fb3e → 0.0.1-canary.ca2cb6e

package/test/auth-middleware-hono.test.ts

@@ -1,15 +1,17 @@
+import { describe, it, expect, beforeAll, jest } from "@jest/globals";
 import { Hono, Context } from "hono";
-import { configureJwt, generateAccessToken } from "../src/auth/jwt.js";
-import { requireAuth, optionalAuth, requireAdmin, createAuthMiddleware } from "../src/auth/middleware.js";
-import type { HonoEnv } from "../src/api/types.js";
-import type { DataDriver } from "../../types/src/controllers/data_driver.js";
+import { configureJwt, generateAccessToken } from "../src/auth/jwt";
+import { requireAuth, optionalAuth, requireAdmin, createAuthMiddleware, createRequireAuth } from "../src/auth/middleware";
+import type { HonoEnv } from "../src/api/types";
+import type { DataDriver } from "../../types/src/controllers/data_driver";
 
 const TEST_SECRET = "test-secret-key-for-hono-middleware-testing-1234567890";
 
 describe("Auth Middleware (Hono)", () => {
 
     beforeAll(() => {
-        configureJwt({ secret: TEST_SECRET, accessExpiresIn: "1h" });
+        configureJwt({ secret: TEST_SECRET,
+accessExpiresIn: "1h" });
     });
 
     // ── requireAuth ─────────────────────────────────────────
@@ -28,7 +30,7 @@ describe("Auth Middleware (Hono)", () => {
             const app = createApp();
             const token = generateAccessToken("user-1", ["admin"]);
             const res = await app.request("/protected/resource", {
-                headers: { Authorization: `Bearer ${token}` },
+                headers: { Authorization: `Bearer ${token}` }
             });
             expect(res.status).toBe(200);
             const body = await res.json() as any;
@@ -47,7 +49,7 @@ describe("Auth Middleware (Hono)", () => {
         it("returns 401 for non-Bearer prefix", async () => {
             const app = createApp();
             const res = await app.request("/protected/resource", {
-                headers: { Authorization: "Basic abc123" },
+                headers: { Authorization: "Basic abc123" }
             });
             expect(res.status).toBe(401);
         });
@@ -55,7 +57,7 @@ describe("Auth Middleware (Hono)", () => {
         it("returns 401 for invalid/expired token", async () => {
             const app = createApp();
             const res = await app.request("/protected/resource", {
-                headers: { Authorization: "Bearer invalid.token.here" },
+                headers: { Authorization: "Bearer invalid.token.here" }
             });
             expect(res.status).toBe(401);
             const body = await res.json() as any;
@@ -76,7 +78,7 @@ describe("Auth Middleware (Hono)", () => {
             const bearerToken = generateAccessToken("bearer-user", ["admin"]);
             const queryToken = generateAccessToken("query-user", ["viewer"]);
             const res = await app.request(`/protected/resource?token=${queryToken}`, {
-                headers: { Authorization: `Bearer ${bearerToken}` },
+                headers: { Authorization: `Bearer ${bearerToken}` }
             });
             expect(res.status).toBe(200);
             const body = await res.json() as any;
@@ -97,7 +99,7 @@ describe("Auth Middleware (Hono)", () => {
             const app = createApp();
             const token = generateAccessToken("admin-1", ["admin"]);
             const res = await app.request("/admin/dashboard", {
-                headers: { Authorization: `Bearer ${token}` },
+                headers: { Authorization: `Bearer ${token}` }
             });
             expect(res.status).toBe(200);
         });
@@ -106,7 +108,7 @@ describe("Auth Middleware (Hono)", () => {
             const app = createApp();
             const token = generateAccessToken("schema-admin-1", ["schema-admin"]);
             const res = await app.request("/admin/dashboard", {
-                headers: { Authorization: `Bearer ${token}` },
+                headers: { Authorization: `Bearer ${token}` }
             });
             expect(res.status).toBe(200);
         });
@@ -115,7 +117,7 @@ describe("Auth Middleware (Hono)", () => {
             const app = createApp();
             const token = generateAccessToken("user-1", ["editor"]);
             const res = await app.request("/admin/dashboard", {
-                headers: { Authorization: `Bearer ${token}` },
+                headers: { Authorization: `Bearer ${token}` }
             });
             expect(res.status).toBe(403);
             const body = await res.json() as any;
@@ -139,7 +141,8 @@ describe("Auth Middleware (Hono)", () => {
             app.use("/public/*", optionalAuth);
             app.get("/public/feed", (c: Context<HonoEnv>) => {
                 const user = c.get("user");
-                return c.json({ authenticated: !!user, user: user ?? null });
+                return c.json({ authenticated: !!user,
+user: user ?? null });
             });
             return app;
         }
@@ -148,7 +151,7 @@ describe("Auth Middleware (Hono)", () => {
             const app = createApp();
             const token = generateAccessToken("opt-user", ["viewer"]);
             const res = await app.request("/public/feed", {
-                headers: { Authorization: `Bearer ${token}` },
+                headers: { Authorization: `Bearer ${token}` }
             });
             const body = await res.json() as any;
             expect(res.status).toBe(200);
@@ -168,7 +171,7 @@ describe("Auth Middleware (Hono)", () => {
         it("proceeds without user when token is invalid", async () => {
             const app = createApp();
             const res = await app.request("/public/feed", {
-                headers: { Authorization: "Bearer garbage.token.value" },
+                headers: { Authorization: "Bearer garbage.token.value" }
             });
             const body = await res.json() as any;
             expect(res.status).toBe(200);
@@ -182,12 +185,13 @@ describe("Auth Middleware (Hono)", () => {
             fetchCollection: jest.fn() as any,
             fetchEntity: jest.fn() as any,
             saveEntity: jest.fn() as any,
-            deleteEntity: jest.fn() as any,
+            deleteEntity: jest.fn() as any
         };
 
-        it("sets driver in context", async () => {
+        it("sets driver in context (requireAuth: false)", async () => {
             const app = new Hono<HonoEnv>();
-            app.use("/*", createAuthMiddleware({ driver: mockDriver }));
+            app.use("/*", createAuthMiddleware({ driver: mockDriver,
+requireAuth: false }));
             app.get("/test", (c) => {
                 const driver = c.get("driver");
                 return c.json({ hasDriver: !!driver });
@@ -199,9 +203,19 @@ describe("Auth Middleware (Hono)", () => {
             expect(body.hasDriver).toBe(true);
         });
 
+        it("enforces auth by default (requireAuth defaults to true)", async () => {
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createAuthMiddleware({ driver: mockDriver }));
+            app.get("/test", (c) => c.json({ ok: true }));
+
+            const res = await app.request("/test");
+            expect(res.status).toBe(401);
+        });
+
         it("enforces auth when requireAuth is true", async () => {
             const app = new Hono<HonoEnv>();
-            app.use("/*", createAuthMiddleware({ driver: mockDriver, requireAuth: true }));
+            app.use("/*", createAuthMiddleware({ driver: mockDriver,
+requireAuth: true }));
             app.get("/test", (c) => c.json({ ok: true }));
 
             const res = await app.request("/test");
@@ -210,7 +224,8 @@ describe("Auth Middleware (Hono)", () => {
 
         it("allows anonymous when requireAuth is false", async () => {
             const app = new Hono<HonoEnv>();
-            app.use("/*", createAuthMiddleware({ driver: mockDriver, requireAuth: false }));
+            app.use("/*", createAuthMiddleware({ driver: mockDriver,
+requireAuth: false }));
             app.get("/test", (c) => c.json({ ok: true }));
 
             const res = await app.request("/test");
@@ -219,6 +234,7 @@ describe("Auth Middleware (Hono)", () => {
 
         it("extracts JWT and sets user in context", async () => {
             const app = new Hono<HonoEnv>();
+            // Default requireAuth=true, but providing a valid token satisfies it
             app.use("/*", createAuthMiddleware({ driver: mockDriver }));
             app.get("/test", (c) => {
                 const user = c.get("user");
@@ -227,13 +243,27 @@ describe("Auth Middleware (Hono)", () => {
 
             const token = generateAccessToken("jwt-user", ["admin"]);
             const res = await app.request("/test", {
-                headers: { Authorization: `Bearer ${token}` },
+                headers: { Authorization: `Bearer ${token}` }
             });
             const body = await res.json() as any;
             expect(body.user.userId).toBe("jwt-user");
             expect(body.user.roles).toEqual(["admin"]);
         });
 
+        it("rejects invalid tokens even with requireAuth: false (fail closed)", async () => {
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createAuthMiddleware({ driver: mockDriver,
+requireAuth: false }));
+            app.get("/test", (c) => c.json({ ok: true }));
+
+            const res = await app.request("/test", {
+                headers: { Authorization: "Bearer invalid.garbage.token" }
+            });
+            expect(res.status).toBe(401);
+            const body = await res.json() as any;
+            expect(body.error.code).toBe("UNAUTHORIZED");
+        });
+
         it("uses custom validator when provided", async () => {
             const app = new Hono<HonoEnv>();
             app.use("/*", createAuthMiddleware({
@@ -241,10 +271,11 @@ describe("Auth Middleware (Hono)", () => {
                 validator: async (c: Context<HonoEnv>) => {
                     const apiKey = c.req.header("x-api-key");
                     if (apiKey === "valid-key") {
-                        return { userId: "api-user", roles: ["api"] };
+                        return { userId: "api-user",
+roles: ["api"] };
                     }
                     return false;
-                },
+                }
             }));
             app.get("/test", (c) => {
                 const user = c.get("user");
@@ -253,23 +284,24 @@ describe("Auth Middleware (Hono)", () => {
 
             // Valid API key
             const res = await app.request("/test", {
-                headers: { "x-api-key": "valid-key" },
+                headers: { "x-api-key": "valid-key" }
             });
             const body = await res.json() as any;
             expect(body.user.userId).toBe("api-user");
 
-            // Invalid API key
+            // Invalid API key — requireAuth not set, defaults to true,
+            // so unauthenticated requests are rejected
             const res2 = await app.request("/test", {
-                headers: { "x-api-key": "bad-key" },
+                headers: { "x-api-key": "bad-key" }
             });
-            expect(res2.status).toBe(200); // Not enforcing auth
+            expect(res2.status).toBe(401); // Secure by default
         });
 
         it("returns 401 when custom validator throws", async () => {
             const app = new Hono<HonoEnv>();
             app.use("/*", createAuthMiddleware({
                 driver: mockDriver,
-                validator: async () => { throw new Error("auth failed"); },
+                validator: async () => { throw new Error("auth failed"); }
             }));
             app.get("/test", (c) => c.json({ ok: true }));
 
@@ -278,10 +310,11 @@ describe("Auth Middleware (Hono)", () => {
         });
 
         it("calls withAuth on driver when available", async () => {
-            const scopedDriver = { ...mockDriver, isScopedDriver: true };
+            const scopedDriver = { ...mockDriver,
+isScopedDriver: true };
             const driverWithAuth = {
                 ...mockDriver,
-                withAuth: jest.fn().mockResolvedValue(scopedDriver),
+                withAuth: jest.fn().mockResolvedValue(scopedDriver)
             };
 
             const app = new Hono<HonoEnv>();
@@ -293,12 +326,13 @@ describe("Auth Middleware (Hono)", () => {
 
             const token = generateAccessToken("rls-user", ["editor"]);
             const res = await app.request("/test", {
-                headers: { Authorization: `Bearer ${token}` },
+                headers: { Authorization: `Bearer ${token}` }
             });
             const body = await res.json() as any;
             expect(body.scoped).toBe(true);
             expect(driverWithAuth.withAuth).toHaveBeenCalledWith(
-                expect.objectContaining({ uid: "rls-user", roles: ["editor"] })
+                expect.objectContaining({ uid: "rls-user",
+roles: ["editor"] })
             );
         });
 
@@ -306,7 +340,8 @@ describe("Auth Middleware (Hono)", () => {
             const app = new Hono<HonoEnv>();
             app.use("/*", createAuthMiddleware({
                 driver: mockDriver,
-                validator: async () => true,
+                requireAuth: false, // Explicit opt-out for this test
+                validator: async () => true
             }));
             app.get("/test", (c) => {
                 const user = c.get("user");
@@ -318,4 +353,204 @@ describe("Auth Middleware (Hono)", () => {
             expect(body.user.userId).toBe("default");
         });
     });
+
+    describe("Service Key Authentication", () => {
+        const SERVICE_KEY = "a-very-secure-service-key-that-is-at-least-32-characters-long";
+        const mockDriver: DataDriver = {
+            fetchCollection: jest.fn() as any,
+            fetchEntity: jest.fn() as any,
+            saveEntity: jest.fn() as any,
+            deleteEntity: jest.fn() as any
+        };
+
+        it("grants admin access when Bearer token matches the service key", async () => {
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createAuthMiddleware({
+                driver: mockDriver,
+                requireAuth: true,
+                serviceKey: SERVICE_KEY
+            }));
+            app.get("/test", (c) => {
+                const user = c.get("user");
+                return c.json({ user });
+            });
+
+            const res = await app.request("/test", {
+                headers: { Authorization: `Bearer ${SERVICE_KEY}` }
+            });
+            expect(res.status).toBe(200);
+            const body = await res.json() as any;
+            expect(body.user.userId).toBe("service");
+            expect(body.user.roles).toEqual(["admin"]);
+        });
+
+        it("rejects when Bearer token does not match the service key", async () => {
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createAuthMiddleware({
+                driver: mockDriver,
+                requireAuth: true,
+                serviceKey: SERVICE_KEY
+            }));
+            app.get("/test", (c) => c.json({ ok: true }));
+
+            const res = await app.request("/test", {
+                headers: { Authorization: "Bearer wrong-key-that-is-definitely-not-correct" }
+            });
+            // Wrong key is not a valid service key, and also not a valid JWT → 401
+            expect(res.status).toBe(401);
+        });
+
+        it("still accepts valid JWT tokens when service key is configured", async () => {
+            const token = generateAccessToken("jwt-user", ["editor"]);
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createAuthMiddleware({
+                driver: mockDriver,
+                requireAuth: true,
+                serviceKey: SERVICE_KEY
+            }));
+            app.get("/test", (c) => {
+                const user = c.get("user");
+                return c.json({ user });
+            });
+
+            const res = await app.request("/test", {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+            expect(res.status).toBe(200);
+            const body = await res.json() as any;
+            expect(body.user.userId).toBe("jwt-user");
+            expect(body.user.roles).toEqual(["editor"]);
+        });
+
+        it("scopes driver via withAuth with service identity", async () => {
+            const scopedDriver = { scoped: true } as unknown as DataDriver;
+            const driverWithAuth = {
+                withAuth: jest.fn().mockResolvedValue(scopedDriver)
+            } as unknown as DataDriver;
+
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createAuthMiddleware({
+                driver: driverWithAuth,
+                requireAuth: true,
+                serviceKey: SERVICE_KEY
+            }));
+            app.get("/test", (c) => {
+                const d = c.get("driver") as any;
+                return c.json({ scoped: d.scoped });
+            });
+
+            const res = await app.request("/test", {
+                headers: { Authorization: `Bearer ${SERVICE_KEY}` }
+            });
+            const body = await res.json() as any;
+            expect(body.scoped).toBe(true);
+            expect((driverWithAuth as any).withAuth).toHaveBeenCalledWith(
+                expect.objectContaining({ uid: "service",
+roles: ["admin"] })
+            );
+        });
+
+        it("does not activate service key path when no serviceKey is configured", async () => {
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createAuthMiddleware({
+                driver: mockDriver,
+                requireAuth: true
+                // No serviceKey configured
+            }));
+            app.get("/test", (c) => c.json({ ok: true }));
+
+            // Sending a random string should fail as invalid JWT
+            const res = await app.request("/test", {
+                headers: { Authorization: `Bearer ${SERVICE_KEY}` }
+            });
+            expect(res.status).toBe(401);
+        });
+    });
+
+    // ── createRequireAuth (standalone factory) ──────────────
+    describe("createRequireAuth", () => {
+        const SERVICE_KEY = "a-very-secure-service-key-that-is-at-least-32-characters-long";
+        it("returns the default requireAuth when no serviceKey is provided", async () => {
+            const middleware = createRequireAuth();
+            // The returned function should be the original requireAuth
+            expect(middleware).toBe(requireAuth);
+        });
+
+        it("returns the default requireAuth when serviceKey is undefined", async () => {
+            const middleware = createRequireAuth({ serviceKey: undefined });
+            expect(middleware).toBe(requireAuth);
+        });
+
+        it("authenticates with a valid service key", async () => {
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createRequireAuth({ serviceKey: SERVICE_KEY }));
+            app.get("/admin/users", (c) => {
+                const user = c.get("user");
+                return c.json({ userId: user?.userId,
+roles: user?.roles });
+            });
+
+            const res = await app.request("/admin/users", {
+                headers: { Authorization: `Bearer ${SERVICE_KEY}` }
+            });
+            expect(res.status).toBe(200);
+            const body = await res.json() as any;
+            expect(body.userId).toBe("service");
+            expect(body.roles).toEqual(["admin"]);
+        });
+
+        it("rejects an incorrect service key and falls back to JWT (which also fails)", async () => {
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createRequireAuth({ serviceKey: SERVICE_KEY }));
+            app.get("/admin/users", (c) => c.json({ ok: true }));
+
+            const res = await app.request("/admin/users", {
+                headers: { Authorization: "Bearer wrong-key" }
+            });
+            expect(res.status).toBe(401);
+        });
+
+        it("falls back to valid JWT when service key doesn't match", async () => {
+            const token = generateAccessToken("user-123", ["admin"]);
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createRequireAuth({ serviceKey: SERVICE_KEY }));
+            app.get("/admin/users", (c) => {
+                const user = c.get("user");
+                return c.json({ userId: user?.userId,
+roles: user?.roles });
+            });
+
+            const res = await app.request("/admin/users", {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+            expect(res.status).toBe(200);
+            const body = await res.json() as any;
+            expect(body.userId).toBe("user-123");
+            expect(body.roles).toEqual(["admin"]);
+        });
+
+        it("returns 401 when no authorization header is provided", async () => {
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createRequireAuth({ serviceKey: SERVICE_KEY }));
+            app.get("/admin/users", (c) => c.json({ ok: true }));
+
+            const res = await app.request("/admin/users");
+            expect(res.status).toBe(401);
+        });
+
+        it("works with requireAdmin for service key (admin role is granted)", async () => {
+            const app = new Hono<HonoEnv>();
+            app.use("/*", createRequireAuth({ serviceKey: SERVICE_KEY }));
+            app.get("/admin/users", requireAdmin, (c) => {
+                return c.json({ authorized: true });
+            });
+
+            const res = await app.request("/admin/users", {
+                headers: { Authorization: `Bearer ${SERVICE_KEY}` }
+            });
+            expect(res.status).toBe(200);
+            const body = await res.json() as any;
+            expect(body.authorized).toBe(true);
+        });
+    });
 });