@rebasepro/server-core 0.2.3 → 0.2.5

package/test/admin-routes.test.ts

@@ -43,8 +43,7 @@ function mockRole(id: string, isAdmin = false) {
 name: id.charAt(0).toUpperCase() + id.slice(1),
 isAdmin,
 defaultPermissions: null,
-collectionPermissions: null,
-config: null };
+collectionPermissions: null };
 }
 
 
@@ -56,7 +55,7 @@ function createApp(opts: { defaultRole?: string } = {}) {
         getUserByIdentity: jest.fn().mockResolvedValue(null),
         linkUserIdentity: jest.fn().mockResolvedValue(undefined),
         getUserIdentities: jest.fn().mockResolvedValue([]),
-        getUserById: jest.fn().mockResolvedValue(null),
+        getUserById: jest.fn().mockImplementation((id) => Promise.resolve(mockUser({ id }))),
         createUser: jest.fn().mockImplementation((data) =>
             Promise.resolve(mockUser({ email: data.email,
 displayName: data.displayName,
@@ -98,14 +97,12 @@ roles: [mockRole("editor")] };
 name: r.name,
 isAdmin: r.isAdmin || false,
 defaultPermissions: null,
-collectionPermissions: null,
-config: null })),
+collectionPermissions: null })),
         updateRole: jest.fn().mockImplementation((id, r) => Promise.resolve({ id,
 name: r.name,
 isAdmin: r.isAdmin || false,
 defaultPermissions: null,
-collectionPermissions: null,
-config: null })),
+collectionPermissions: null })),
         deleteRole: jest.fn().mockResolvedValue(undefined)
     } as unknown as jest.Mocked<AuthRepository>;
 
@@ -407,6 +404,8 @@ displayName: "Updated" }),
             it("updates roles when specified", async () => {
                 const app = createApp();
                 mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u1" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 2 });
                 mockAuthRepo.getUserWithRoles.mockResolvedValueOnce({
                     user: mockUser({ id: "u1" }),
                     roles: [mockRole("admin")]
@@ -421,221 +420,118 @@ displayName: "Updated" }),
                 expect(mockAuthRepo.setUserRoles).toHaveBeenCalledWith("u1", ["admin"]);
             });
 
-            it("returns 404 for non-existent user", async () => {
+            it("prevents demoting the last admin", async () => {
                 const app = createApp();
-                mockAuthRepo.getUserById.mockResolvedValueOnce(null);
+                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u1" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 1 });
 
-                const res = await app.request("/admin/users/missing", {
+                const res = await app.request("/admin/users/u1", {
                     method: "PUT",
                     headers: { "Content-Type": "application/json",
 ...adminAuth() },
-                    body: JSON.stringify({ displayName: "Updated" })
-                });
-                expect(res.status).toBe(404);
-            });
-        });
-
-        describe("DELETE /admin/users/:userId", () => {
-            it("deletes a user", async () => {
-                const app = createApp();
-                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u1" }));
-
-                const res = await app.request("/admin/users/u1", {
-                    method: "DELETE",
-                    headers: { ...adminAuth("admin-1") }
-                });
-                expect(res.status).toBe(200);
-                expect(mockAuthRepo.deleteUser).toHaveBeenCalledWith("u1");
-            });
-
-            it("prevents self-deletion", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/users/admin-1", {
-                    method: "DELETE",
-                    headers: { ...adminAuth("admin-1") }
+                    body: JSON.stringify({ roles: ["editor"] })
                 });
-                expect(res.status).toBe(400);
+                expect(res.status).toBe(403);
                 const body = await res.json() as any;
-                expect(body.error.code).toBe("SELF_DELETE");
+                expect(body.error.code).toBe("LAST_ADMIN");
+                expect(mockAuthRepo.setUserRoles).not.toHaveBeenCalled();
             });
 
-            it("returns 404 for non-existent user", async () => {
-                const app = createApp();
-                mockAuthRepo.getUserById.mockResolvedValueOnce(null);
-
-                const res = await app.request("/admin/users/missing", {
-                    method: "DELETE",
-                    headers: { ...adminAuth() }
-                });
-                expect(res.status).toBe(404);
-            });
-        });
-    });
-
-    // ── Role CRUD ───────────────────────────────────────────────────────
-    describe("Role Management", () => {
-        describe("GET /admin/roles", () => {
-            it("returns list of roles", async () => {
+            it("allows demoting an admin if there are other admins", async () => {
                 const app = createApp();
-                mockAuthRepo.listRoles.mockResolvedValueOnce([
-                    mockRole("admin", true),
-                    mockRole("editor"),
-                    mockRole("viewer")
-                ]);
-
-                const res = await app.request("/admin/roles", { headers: { ...adminAuth() } });
-                expect(res.status).toBe(200);
-                const body = await res.json() as any;
-                expect(body.roles).toHaveLength(3);
-                expect(body.roles[0].isAdmin).toBe(true);
-            });
-        });
-
-        describe("GET /admin/roles/:roleId", () => {
-            it("returns role by ID", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("admin", true));
-
-                const res = await app.request("/admin/roles/admin", { headers: { ...adminAuth() } });
-                expect(res.status).toBe(200);
-                const body = await res.json() as any;
-                expect(body.role.id).toBe("admin");
-                expect(body.role.isAdmin).toBe(true);
-            });
-
-            it("returns 404 for non-existent role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(null);
-
-                const res = await app.request("/admin/roles/missing", { headers: { ...adminAuth() } });
-                expect(res.status).toBe(404);
-            });
-        });
-
-        describe("POST /admin/roles", () => {
-            it("creates a new role", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles", {
-                    ...json({ id: "custom",
-name: "Custom Role" }),
-                    headers: { ...json({}).headers,
-...adminAuth() }
-                });
-                expect(res.status).toBe(201);
-                const body = await res.json() as any;
-                expect(body.role.id).toBe("custom");
-            });
-
-            it("returns 400 for missing id or name", async () => {
-                const app = createApp();
-
-                const res = await app.request("/admin/roles", {
-                    ...json({ id: "nope" }),
-                    headers: { ...json({}).headers,
-...adminAuth() }
-                });
-                expect(res.status).toBe(400);
-            });
-
-            it("returns 409 when role already exists", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("custom"));
-
-                const res = await app.request("/admin/roles", {
-                    ...json({ id: "custom",
-name: "Dup" }),
-                    headers: { ...json({}).headers,
-...adminAuth() }
+                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u1" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 2 });
+                mockAuthRepo.getUserWithRoles.mockResolvedValueOnce({
+                    user: mockUser({ id: "u1" }),
+                    roles: [mockRole("editor")]
                 });
-                expect(res.status).toBe(409);
-                const body = await res.json() as any;
-                expect(body.error.code).toBe("ROLE_EXISTS");
-            });
-        });
-
-        describe("PUT /admin/roles/:roleId", () => {
-            it("updates an existing role", async () => {
-                const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("editor"));
 
-                const res = await app.request("/admin/roles/editor", {
+                const res = await app.request("/admin/users/u1", {
                     method: "PUT",
                     headers: { "Content-Type": "application/json",
 ...adminAuth() },
-                    body: JSON.stringify({ name: "Super Editor" })
+                    body: JSON.stringify({ roles: ["editor"] })
                 });
                 expect(res.status).toBe(200);
-                expect(mockAuthRepo.updateRole).toHaveBeenCalledWith("editor", expect.objectContaining({
-                    name: "Super Editor"
-                }));
+                expect(mockAuthRepo.setUserRoles).toHaveBeenCalledWith("u1", ["editor"]);
             });
 
-            it("returns 404 for non-existent role", async () => {
+            it("returns 404 for non-existent user", async () => {
                 const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(null);
+                mockAuthRepo.getUserById.mockResolvedValueOnce(null);
 
-                const res = await app.request("/admin/roles/missing", {
+                const res = await app.request("/admin/users/missing", {
                     method: "PUT",
                     headers: { "Content-Type": "application/json",
 ...adminAuth() },
-                    body: JSON.stringify({ name: "Nope" })
+                    body: JSON.stringify({ displayName: "Updated" })
                 });
                 expect(res.status).toBe(404);
             });
         });
 
-        describe("DELETE /admin/roles/:roleId", () => {
-            it("deletes a custom role", async () => {
+        describe("DELETE /admin/users/:userId", () => {
+            it("deletes a user", async () => {
                 const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(mockRole("custom"));
+                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u1" }));
 
-                const res = await app.request("/admin/roles/custom", {
+                const res = await app.request("/admin/users/u1", {
                     method: "DELETE",
-                    headers: { ...adminAuth() }
+                    headers: { ...adminAuth("admin-1") }
                 });
                 expect(res.status).toBe(200);
-                expect(mockAuthRepo.deleteRole).toHaveBeenCalledWith("custom");
+                expect(mockAuthRepo.deleteUser).toHaveBeenCalledWith("u1");
             });
 
-            it("prevents deletion of built-in admin role", async () => {
+            it("prevents self-deletion", async () => {
                 const app = createApp();
 
-                const res = await app.request("/admin/roles/admin", {
+                const res = await app.request("/admin/users/admin-1", {
                     method: "DELETE",
-                    headers: { ...adminAuth() }
+                    headers: { ...adminAuth("admin-1") }
                 });
                 expect(res.status).toBe(400);
                 const body = await res.json() as any;
-                expect(body.error.code).toBe("BUILTIN_ROLE");
+                expect(body.error.code).toBe("SELF_DELETE");
             });
 
-            it("prevents deletion of built-in editor role", async () => {
+            it("prevents last-admin deletion", async () => {
                 const app = createApp();
+                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u2" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 1 });
 
-                const res = await app.request("/admin/roles/editor", {
+                const res = await app.request("/admin/users/u2", {
                     method: "DELETE",
-                    headers: { ...adminAuth() }
+                    headers: { ...adminAuth("admin-1") }
                 });
-                expect(res.status).toBe(400);
+                expect(res.status).toBe(403);
+                const body = await res.json() as any;
+                expect(body.error.code).toBe("LAST_ADMIN");
+                expect(mockAuthRepo.deleteUser).not.toHaveBeenCalled();
             });
 
-            it("prevents deletion of built-in viewer role", async () => {
+            it("allows deleting an admin if there are other admins", async () => {
                 const app = createApp();
+                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u2" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 2 });
 
-                const res = await app.request("/admin/roles/viewer", {
+                const res = await app.request("/admin/users/u2", {
                     method: "DELETE",
-                    headers: { ...adminAuth() }
+                    headers: { ...adminAuth("admin-1") }
                 });
-                expect(res.status).toBe(400);
+                expect(res.status).toBe(200);
+                expect(mockAuthRepo.deleteUser).toHaveBeenCalledWith("u2");
             });
 
-            it("returns 404 for non-existent role", async () => {
+            it("returns 404 for non-existent user", async () => {
                 const app = createApp();
-                mockAuthRepo.getRoleById.mockResolvedValueOnce(null);
+                mockAuthRepo.getUserById.mockResolvedValueOnce(null);
 
-                const res = await app.request("/admin/roles/ghost", {
+                const res = await app.request("/admin/users/missing", {
                     method: "DELETE",
                     headers: { ...adminAuth() }
                 });
@@ -643,4 +539,6 @@ name: "Dup" }),
             });
         });
     });
+
+
 });

package/test/api-generator.test.ts

@@ -168,7 +168,6 @@ values: {} } as any;
             );
         });
     });
-
     describe("Subcollection Routes", () => {
         /**
          * These tests use the flat app (no prefix nesting) to avoid

package/test/api-key-permission-guard.test.ts

@@ -0,0 +1,132 @@
+import {
+    httpMethodToOperation,
+    isOperationAllowed,
+    ApiKeyOperation
+} from "../src/auth/api-keys/api-key-permission-guard";
+import type { ApiKeyPermission } from "../src/auth/api-keys/api-key-types";
+
+describe("httpMethodToOperation", () => {
+    it("maps GET to read", () => {
+        expect(httpMethodToOperation("GET")).toBe("read");
+    });
+
+    it("maps HEAD to read", () => {
+        expect(httpMethodToOperation("HEAD")).toBe("read");
+    });
+
+    it("maps OPTIONS to read", () => {
+        expect(httpMethodToOperation("OPTIONS")).toBe("read");
+    });
+
+    it("maps POST to write", () => {
+        expect(httpMethodToOperation("POST")).toBe("write");
+    });
+
+    it("maps PUT to write", () => {
+        expect(httpMethodToOperation("PUT")).toBe("write");
+    });
+
+    it("maps PATCH to write", () => {
+        expect(httpMethodToOperation("PATCH")).toBe("write");
+    });
+
+    it("maps DELETE to delete", () => {
+        expect(httpMethodToOperation("DELETE")).toBe("delete");
+    });
+
+    it("is case-insensitive", () => {
+        expect(httpMethodToOperation("get")).toBe("read");
+        expect(httpMethodToOperation("post")).toBe("write");
+        expect(httpMethodToOperation("delete")).toBe("delete");
+        expect(httpMethodToOperation("Patch")).toBe("write");
+    });
+
+    it("defaults unknown methods to read", () => {
+        expect(httpMethodToOperation("CONNECT")).toBe("read");
+        expect(httpMethodToOperation("TRACE")).toBe("read");
+        expect(httpMethodToOperation("UNKNOWN")).toBe("read");
+    });
+});
+
+describe("isOperationAllowed", () => {
+    it("allows operation with exact collection match", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read", "write"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(true);
+    });
+
+    it("denies operation not in the operations list", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(false);
+        expect(isOperationAllowed(permissions, "users", "delete")).toBe(false);
+    });
+
+    it("denies operation for non-matching collection", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read", "write", "delete"] }
+        ];
+        expect(isOperationAllowed(permissions, "posts", "read")).toBe(false);
+    });
+
+    it("allows wildcard collection '*' to match any collection", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "*", operations: ["read"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "posts", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "anything", "read")).toBe(true);
+    });
+
+    it("wildcard collection still checks operations", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "*", operations: ["read"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(false);
+        expect(isOperationAllowed(permissions, "users", "delete")).toBe(false);
+    });
+
+    it("returns false for empty permissions array", () => {
+        expect(isOperationAllowed([], "users", "read")).toBe(false);
+    });
+
+    it("checks all permission entries and grants if any match", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read"] },
+            { collection: "posts", operations: ["write"] },
+            { collection: "comments", operations: ["read", "write", "delete"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "posts", "write")).toBe(true);
+        expect(isOperationAllowed(permissions, "comments", "delete")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(false);
+        expect(isOperationAllowed(permissions, "posts", "read")).toBe(false);
+    });
+
+    it("handles overlapping permissions correctly", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read"] },
+            { collection: "users", operations: ["write"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "delete")).toBe(false);
+    });
+
+    it("handles mixed wildcard and specific permissions", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "*", operations: ["read"] },
+            { collection: "users", operations: ["write", "delete"] }
+        ];
+        // Wildcard read for everything
+        expect(isOperationAllowed(permissions, "posts", "read")).toBe(true);
+        // Specific write/delete for users
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "delete")).toBe(true);
+        // No write for non-users
+        expect(isOperationAllowed(permissions, "posts", "write")).toBe(false);
+    });
+});

package/test/ast-schema-editor.test.ts

@@ -60,4 +60,30 @@ description: "Product name" },
         expect(newContent).toContain("target: () => categoriesCollection");
         expect(newContent).toContain('description: "Product name"');
     });
+
+    it("should safely escape string values containing quotes and prevent code injection", async () => {
+        // Setup initial file
+        const fileContent = `import { EntityCollection } from "@rebasepro/types";
+const productsCollection: EntityCollection = {
+    name: "Products",
+    slug: "products",
+    properties: {}
+};
+export default productsCollection;
+`;
+        fs.writeFileSync(path.join(testDir, "products.ts"), fileContent);
+
+        // Payload attempting breakout
+        const maliciousData = {
+            name: 'Products", description: "Injected description", breakout: "true',
+            slug: "products",
+            properties: {}
+        };
+
+        await editor.saveCollection("products", maliciousData);
+
+        const newContent = fs.readFileSync(path.join(testDir, "products.ts"), "utf-8");
+        // Verify that the quote was safely escaped and did not break out to create a new property
+        expect(newContent).toContain('name: "Products\\", description: \\"Injected description\\", breakout: \\"true"');
+    });
 });

package/test/auth-routes.test.ts

@@ -54,8 +54,7 @@ function mockRole(id: string, isAdmin = false) {
 name: id.charAt(0).toUpperCase() + id.slice(1),
 isAdmin,
 defaultPermissions: null,
-collectionPermissions: null,
-config: null };
+collectionPermissions: null };
 }
 
 let mockAuthRepo: jest.Mocked<AuthRepository>;

package/test/backend-hooks-admin.test.ts

@@ -49,8 +49,7 @@ function mockRole(id: string, isAdmin = false) {
         name: id.charAt(0).toUpperCase() + id.slice(1),
         isAdmin,
         defaultPermissions: null,
-        collectionPermissions: null,
-        config: null
+        collectionPermissions: null
     };
 }
 
@@ -98,11 +97,11 @@ function createApp(hooks?: BackendHooks) {
         getRoleById: jest.fn().mockResolvedValue(null),
         createRole: jest.fn().mockImplementation(r => Promise.resolve({
             id: r.id, name: r.name, isAdmin: r.isAdmin || false,
-            defaultPermissions: null, collectionPermissions: null, config: null
+            defaultPermissions: null, collectionPermissions: null
         })),
         updateRole: jest.fn().mockImplementation((id, r) => Promise.resolve({
             id, name: r.name, isAdmin: r.isAdmin || false,
-            defaultPermissions: null, collectionPermissions: null, config: null
+            defaultPermissions: null, collectionPermissions: null
         })),
         deleteRole: jest.fn().mockResolvedValue(undefined)
     };
@@ -363,32 +362,7 @@ describe("BackendHooks — Admin Routes", () => {
         });
     });
 
-    // ── roles.afterRead ─────────────────────────────────────────────────
-    describe("roles.afterRead", () => {
-        it("filters out roles from GET /admin/roles", async () => {
-            const hooks: BackendHooks = {
-                roles: {
-                    afterRead(role) {
-                        // Hide internal roles
-                        if (role.id === "internal") return null;
-                        return role;
-                    }
-                }
-            };
-            const app = createApp(hooks);
-            mockAuthRepo.listRoles.mockResolvedValueOnce([
-                mockRole("admin", true),
-                mockRole("internal"),
-                mockRole("editor")
-            ]);
 
-            const res = await app.request("/admin/roles", { headers: { ...adminAuth() } });
-            expect(res.status).toBe(200);
-            const body = await res.json() as any;
-            expect(body.roles).toHaveLength(2);
-            expect(body.roles.map((r: any) => r.id)).toEqual(["admin", "editor"]);
-        });
-    });
 
     // ── no hooks (passthrough) ──────────────────────────────────────────
     describe("no hooks configured", () => {

package/test/custom-auth-adapter.test.ts

@@ -143,7 +143,7 @@ describe("createCustomAuthAdapter", () => {
         expect(adapter.serviceKey).toBe("sk_live_123");
     });
 
-    it("passes through userManagement and roleManagement when provided", () => {
+    it("passes through userManagement when provided", () => {
         const userMgmt = {
             getUser: jest.fn(),
             listUsers: jest.fn(),
@@ -151,27 +151,19 @@ describe("createCustomAuthAdapter", () => {
             updateUser: jest.fn(),
             deleteUser: jest.fn(),
         };
-        const roleMgmt = {
-            listRoles: jest.fn(),
-            getUserRoles: jest.fn(),
-            setUserRoles: jest.fn(),
-        };
 
         const adapter = createCustomAuthAdapter({
             verifyRequest: async () => null,
             userManagement: userMgmt as unknown as CustomAuthAdapterOptions["userManagement"],
-            roleManagement: roleMgmt as unknown as CustomAuthAdapterOptions["roleManagement"],
         });
 
         expect(adapter.userManagement).toBe(userMgmt);
-        expect(adapter.roleManagement).toBe(roleMgmt);
     });
 
-    it("omits userManagement and roleManagement when not provided", () => {
+    it("omits userManagement when not provided", () => {
         const adapter = createCustomAuthAdapter({
             verifyRequest: async () => null,
         });
         expect(adapter.userManagement).toBeUndefined();
-        expect(adapter.roleManagement).toBeUndefined();
     });
 });