@rebasepro/server-core 0.0.1-canary.4d4fb3e

package/test/middleware.test.ts

@@ -0,0 +1,295 @@
+import { requireAuth, optionalAuth, extractUserFromToken, requireAdmin } from "../src/auth/middleware";
+import { configureJwt, generateAccessToken } from "../src/auth/jwt";
+
+// ── Minimal Hono-context mock ────────────────────────────────────────────
+function createMockContext(opts: {
+    authHeader?: string;
+    queryToken?: string;
+    user?: any;
+} = {}) {
+    let capturedStatus: number | undefined;
+    let capturedBody: any;
+    const variables = new Map<string, any>();
+
+    if (opts.user !== undefined) variables.set("user", opts.user);
+
+    const c = {
+        req: {
+            header: (name: string) => {
+                if (name === "authorization") return opts.authHeader;
+                return undefined;
+            },
+            query: (name: string) => {
+                if (name === "token") return opts.queryToken;
+                return undefined;
+            },
+        },
+        json: (body: any, status?: number) => {
+            capturedBody = body;
+            capturedStatus = status ?? 200;
+            return new Response(JSON.stringify(body), { status: capturedStatus });
+        },
+        set: (key: string, value: any) => variables.set(key, value),
+        get: (key: string) => variables.get(key),
+    } as any;
+
+    return {
+        c,
+        getStatus: () => capturedStatus,
+        getBody: () => capturedBody,
+        getUser: () => variables.get("user"),
+    };
+}
+
+describe("Auth Middleware", () => {
+    const testSecret = "test-secret-key-for-middleware-testing";
+    const nextFn = jest.fn();
+
+    beforeAll(() => {
+        configureJwt({
+            secret: testSecret,
+            accessExpiresIn: "1h",
+            refreshExpiresIn: "30d"
+        });
+    });
+
+    beforeEach(() => {
+        nextFn.mockClear();
+    });
+
+    describe("requireAuth", () => {
+        it("should call next() and set user for valid token", async () => {
+            const token = generateAccessToken("user-123", ["admin", "editor"]);
+            const { c, getUser } = createMockContext({ authHeader: `Bearer ${token}` });
+
+            await requireAuth(c, nextFn);
+
+            expect(nextFn).toHaveBeenCalled();
+            expect(getUser()).toEqual({
+                userId: "user-123",
+                roles: ["admin", "editor"]
+            });
+        });
+
+        it("should return 401 for missing Authorization header", async () => {
+            const { c, getStatus, getBody } = createMockContext();
+
+            await requireAuth(c, nextFn);
+
+            expect(getStatus()).toBe(401);
+            expect(getBody()).toEqual({
+                error: {
+                    message: "Authorization header or token query parameter missing or invalid",
+                    code: "UNAUTHORIZED"
+                }
+            });
+            expect(nextFn).not.toHaveBeenCalled();
+        });
+
+        it("should return 401 for Authorization header without Bearer prefix", async () => {
+            const { c, getStatus } = createMockContext({ authHeader: "token-without-bearer" });
+
+            await requireAuth(c, nextFn);
+
+            expect(getStatus()).toBe(401);
+            expect(nextFn).not.toHaveBeenCalled();
+        });
+
+        it("should return 401 for invalid token", async () => {
+            const { c, getStatus, getBody } = createMockContext({ authHeader: "Bearer invalid-token" });
+
+            await requireAuth(c, nextFn);
+
+            expect(getStatus()).toBe(401);
+            expect(getBody()).toEqual({
+                error: {
+                    message: "Invalid or expired token",
+                    code: "UNAUTHORIZED"
+                }
+            });
+            expect(nextFn).not.toHaveBeenCalled();
+        });
+
+        it("should return 401 for token signed with different secret", async () => {
+            const token = generateAccessToken("user-123", ["admin"]);
+            configureJwt({ secret: "different-secret-that-is-at-least-32-chars-long" });
+            const { c, getStatus } = createMockContext({ authHeader: `Bearer ${token}` });
+
+            await requireAuth(c, nextFn);
+
+            expect(getStatus()).toBe(401);
+            expect(nextFn).not.toHaveBeenCalled();
+
+            // Reset to original secret
+            configureJwt({ secret: testSecret });
+        });
+
+        it("should handle lowercase bearer prefix", async () => {
+            const token = generateAccessToken("user-123", ["admin"]);
+            const { c, getStatus } = createMockContext({ authHeader: `bearer ${token}` });
+
+            await requireAuth(c, nextFn);
+
+            // The implementation requires "Bearer " with capital B
+            expect(getStatus()).toBe(401);
+            expect(nextFn).not.toHaveBeenCalled();
+        });
+
+        it("should accept token from query parameter", async () => {
+            const token = generateAccessToken("user-123", ["viewer"]);
+            const { c, getUser } = createMockContext({ queryToken: token });
+
+            await requireAuth(c, nextFn);
+
+            expect(nextFn).toHaveBeenCalled();
+            expect(getUser()).toEqual({
+                userId: "user-123",
+                roles: ["viewer"]
+            });
+        });
+    });
+
+    describe("optionalAuth", () => {
+        it("should set user for valid token", async () => {
+            const token = generateAccessToken("user-456", ["viewer"]);
+            const { c, getUser } = createMockContext({ authHeader: `Bearer ${token}` });
+
+            await optionalAuth(c, nextFn);
+
+            expect(nextFn).toHaveBeenCalled();
+            expect(getUser()).toEqual({
+                userId: "user-456",
+                roles: ["viewer"]
+            });
+        });
+
+        it("should call next() without setting user when no token provided", async () => {
+            const { c, getUser } = createMockContext();
+
+            await optionalAuth(c, nextFn);
+
+            expect(nextFn).toHaveBeenCalled();
+            expect(getUser()).toBeUndefined();
+        });
+
+        it("should call next() without setting user for invalid token", async () => {
+            const { c, getUser } = createMockContext({ authHeader: "Bearer invalid-token" });
+
+            await optionalAuth(c, nextFn);
+
+            expect(nextFn).toHaveBeenCalled();
+            expect(getUser()).toBeUndefined();
+        });
+
+        it("should call next() without setting user for non-Bearer auth", async () => {
+            const { c, getUser } = createMockContext({ authHeader: "Basic dXNlcjpwYXNz" });
+
+            await optionalAuth(c, nextFn);
+
+            expect(nextFn).toHaveBeenCalled();
+            expect(getUser()).toBeUndefined();
+        });
+    });
+
+    describe("requireAdmin", () => {
+        it("should return 401 if user is not authenticated", async () => {
+            const { c, getStatus, getBody } = createMockContext();
+
+            await requireAdmin(c, nextFn);
+
+            expect(getStatus()).toBe(401);
+            expect(getBody()).toEqual({
+                error: {
+                    message: "User not authenticated. requireAuth middleware is missing?",
+                    code: "UNAUTHORIZED"
+                }
+            });
+            expect(nextFn).not.toHaveBeenCalled();
+        });
+
+        it("should return 403 if user has no roles array", async () => {
+            const { c, getStatus } = createMockContext({ user: { userId: "user-123" } });
+
+            await requireAdmin(c, nextFn);
+
+            expect(getStatus()).toBe(403);
+            expect(nextFn).not.toHaveBeenCalled();
+        });
+
+        it("should return 403 if user has empty roles array", async () => {
+            const { c, getStatus } = createMockContext({ user: { userId: "user-123", roles: [] } });
+
+            await requireAdmin(c, nextFn);
+
+            expect(getStatus()).toBe(403);
+            expect(nextFn).not.toHaveBeenCalled();
+        });
+
+        it("should return 403 if user has standard roles (forbidden)", async () => {
+            const { c, getStatus } = createMockContext({ user: { userId: "user-123", roles: ["editor", "viewer"] } });
+
+            await requireAdmin(c, nextFn);
+
+            expect(getStatus()).toBe(403);
+            expect(nextFn).not.toHaveBeenCalled();
+        });
+
+        it("should allow access if user has 'admin' role", async () => {
+            const { c, getStatus } = createMockContext({ user: { userId: "user-123", roles: ["editor", "admin"] } });
+
+            await requireAdmin(c, nextFn);
+
+            expect(nextFn).toHaveBeenCalled();
+            expect(getStatus()).toBeUndefined(); // No error response
+        });
+
+        it("should allow access if user has 'schema-admin' role", async () => {
+            const { c } = createMockContext({ user: { userId: "user-123", roles: ["schema-admin"] } });
+
+            await requireAdmin(c, nextFn);
+
+            expect(nextFn).toHaveBeenCalled();
+        });
+
+        it("should block access for malformed spoofed string roles", async () => {
+            const { c, getStatus } = createMockContext({ user: { userId: "user-123", roles: ["schema-adminstration", "admins", "admin "] } });
+
+            await requireAdmin(c, nextFn);
+
+            expect(getStatus()).toBe(403);
+            expect(nextFn).not.toHaveBeenCalled();
+        });
+    });
+
+    describe("extractUserFromToken", () => {
+        it("should extract user from valid token", () => {
+            const token = generateAccessToken("ws-user-123", ["admin"]);
+            const payload = extractUserFromToken(token);
+
+            expect(payload).toEqual({
+                userId: "ws-user-123",
+                roles: ["admin"]
+            });
+        });
+
+        it("should return null for invalid token", () => {
+            const payload = extractUserFromToken("invalid-token");
+            expect(payload).toBeNull();
+        });
+
+        it("should return null for empty token", () => {
+            const payload = extractUserFromToken("");
+            expect(payload).toBeNull();
+        });
+
+        it("should work with tokens having empty roles", () => {
+            const token = generateAccessToken("user-no-roles", []);
+            const payload = extractUserFromToken(token);
+
+            expect(payload).toEqual({
+                userId: "user-no-roles",
+                roles: []
+            });
+        });
+    });
+});

package/test/password.test.ts

@@ -0,0 +1,165 @@
+import {
+    validatePasswordStrength,
+    hashPassword,
+    verifyPassword
+} from "../src/auth/password";
+
+describe("Password Utilities", () => {
+    describe("validatePasswordStrength", () => {
+        it("should accept a valid password", () => {
+            const result = validatePasswordStrength("ValidPass123");
+            expect(result.valid).toBe(true);
+            expect(result.errors).toHaveLength(0);
+        });
+
+        it("should reject password shorter than 8 characters", () => {
+            const result = validatePasswordStrength("Short1A");
+            expect(result.valid).toBe(false);
+            expect(result.errors).toContain("Password must be at least 8 characters long");
+        });
+
+        it("should reject password without uppercase letter", () => {
+            const result = validatePasswordStrength("lowercase123");
+            expect(result.valid).toBe(false);
+            expect(result.errors).toContain("Password must contain at least one uppercase letter");
+        });
+
+        it("should reject password without lowercase letter", () => {
+            const result = validatePasswordStrength("UPPERCASE123");
+            expect(result.valid).toBe(false);
+            expect(result.errors).toContain("Password must contain at least one lowercase letter");
+        });
+
+        it("should reject password without number", () => {
+            const result = validatePasswordStrength("NoNumbersHere");
+            expect(result.valid).toBe(false);
+            expect(result.errors).toContain("Password must contain at least one number");
+        });
+
+        it("should return multiple errors for multiple violations", () => {
+            const result = validatePasswordStrength("short");
+            expect(result.valid).toBe(false);
+            expect(result.errors.length).toBeGreaterThan(1);
+        });
+
+        it("should accept password with special characters", () => {
+            const result = validatePasswordStrength("Valid@Pass#123!");
+            expect(result.valid).toBe(true);
+        });
+
+        it("should accept password at exactly 8 characters", () => {
+            const result = validatePasswordStrength("Abcdefg1");
+            expect(result.valid).toBe(true);
+        });
+    });
+
+    describe("hashPassword", () => {
+        it("should return a hash in salt:hash format", async () => {
+            const hash = await hashPassword("TestPassword123");
+            expect(hash).toContain(":");
+            const [salt, hashValue] = hash.split(":");
+            expect(salt).toBeTruthy();
+            expect(hashValue).toBeTruthy();
+        });
+
+        it("should generate different hashes for the same password (due to random salt)", async () => {
+            const hash1 = await hashPassword("SamePassword123");
+            const hash2 = await hashPassword("SamePassword123");
+            expect(hash1).not.toBe(hash2);
+        });
+
+        it("should generate a 32-byte salt (64 hex chars)", async () => {
+            const hash = await hashPassword("TestPassword123");
+            const [salt] = hash.split(":");
+            expect(salt).toHaveLength(64);
+        });
+
+        it("should generate a 64-byte key (128 hex chars)", async () => {
+            const hash = await hashPassword("TestPassword123");
+            const [, hashValue] = hash.split(":");
+            expect(hashValue).toHaveLength(128);
+        });
+    });
+
+    describe("verifyPassword", () => {
+        it("should verify a correct password", async () => {
+            const password = "CorrectPassword123";
+            const hash = await hashPassword(password);
+            const isValid = await verifyPassword(password, hash);
+            expect(isValid).toBe(true);
+        });
+
+        it("should reject an incorrect password", async () => {
+            const hash = await hashPassword("CorrectPassword123");
+            const isValid = await verifyPassword("WrongPassword123", hash);
+            expect(isValid).toBe(false);
+        });
+
+        it("should return false for malformed hash (no colon)", async () => {
+            const isValid = await verifyPassword("AnyPassword", "malformedhash");
+            expect(isValid).toBe(false);
+        });
+
+        it("should return false for empty hash parts", async () => {
+            const isValid = await verifyPassword("AnyPassword", ":");
+            expect(isValid).toBe(false);
+        });
+
+        it("should be case-sensitive", async () => {
+            const hash = await hashPassword("CaseSensitive123");
+            const isValid = await verifyPassword("casesensitive123", hash);
+            expect(isValid).toBe(false);
+        });
+
+        it("should handle empty password", async () => {
+            const hash = await hashPassword("");
+            const isValid = await verifyPassword("", hash);
+            expect(isValid).toBe(true);
+        });
+
+        it("should handle unicode characters", async () => {
+            const password = "Pässwörd123日本語";
+            const hash = await hashPassword(password);
+            const isValid = await verifyPassword(password, hash);
+            expect(isValid).toBe(true);
+        });
+
+        it("should handle very long passwords", async () => {
+            const password = "A".repeat(1000) + "bcdefg1";
+            const hash = await hashPassword(password);
+            const isValid = await verifyPassword(password, hash);
+            expect(isValid).toBe(true);
+        });
+    });
+
+    describe("timing-safe comparison", () => {
+        // This test verifies that timing attacks are mitigated
+        // by checking that verification time is relatively constant
+        it("should take similar time for correct and incorrect passwords", async () => {
+            const password = "TestPassword123";
+            const hash = await hashPassword(password);
+
+            // Run multiple iterations to average out noise
+            const iterations = 10;
+
+            // Time correct password
+            const correctStart = Date.now();
+            for (let i = 0; i < iterations; i++) {
+                await verifyPassword(password, hash);
+            }
+            const correctTime = Date.now() - correctStart;
+
+            // Time incorrect password (same length)
+            const incorrectStart = Date.now();
+            for (let i = 0; i < iterations; i++) {
+                await verifyPassword("WrongPassword12", hash);
+            }
+            const incorrectTime = Date.now() - incorrectStart;
+
+            // Times should be within 50% of each other
+            // (allowing for system variance)
+            const ratio = Math.abs(correctTime - incorrectTime) / Math.max(correctTime, incorrectTime);
+            expect(ratio).toBeLessThan(0.5);
+        });
+    });
+});