@rebasepro/server-core 0.2.3 → 0.3.0

package/test/mfa.test.ts

@@ -0,0 +1,197 @@
+import {
+    base32Encode,
+    base32Decode,
+    generateTotp,
+    verifyTotp,
+    generateTotpSecret,
+    generateRecoveryCodes,
+    hashRecoveryCode
+} from "../src/auth/mfa";
+
+describe("base32Encode / base32Decode", () => {
+    it("round-trips a known buffer", () => {
+        const original = Buffer.from("Hello, World!");
+        const encoded = base32Encode(original);
+        const decoded = base32Decode(encoded);
+        expect(decoded.toString()).toBe("Hello, World!");
+    });
+
+    it("encodes known test vectors (RFC 4648)", () => {
+        // RFC 4648 test vectors
+        expect(base32Encode(Buffer.from(""))).toBe("");
+        expect(base32Encode(Buffer.from("f"))).toBe("MY");
+        expect(base32Encode(Buffer.from("fo"))).toBe("MZXQ");
+        expect(base32Encode(Buffer.from("foo"))).toBe("MZXW6");
+        expect(base32Encode(Buffer.from("foob"))).toBe("MZXW6YQ");
+        expect(base32Encode(Buffer.from("fooba"))).toBe("MZXW6YTB");
+        expect(base32Encode(Buffer.from("foobar"))).toBe("MZXW6YTBOI");
+    });
+
+    it("decodes base32 with trailing padding characters", () => {
+        const decoded = base32Decode("MZXW6===");
+        expect(decoded.toString()).toBe("foo");
+    });
+
+    it("is case-insensitive when decoding", () => {
+        const upper = base32Decode("MZXW6YTBOI");
+        const lower = base32Decode("mzxw6ytboi");
+        expect(upper.equals(lower)).toBe(true);
+    });
+
+    it("handles single byte", () => {
+        const buf = Buffer.from([0xff]);
+        const encoded = base32Encode(buf);
+        const decoded = base32Decode(encoded);
+        expect(decoded[0]).toBe(0xff);
+    });
+
+    it("round-trips random 20-byte secret", () => {
+        const original = Buffer.from("abcdefghij1234567890");
+        const encoded = base32Encode(original);
+        const decoded = base32Decode(encoded);
+        expect(decoded.toString()).toBe(original.toString());
+    });
+});
+
+describe("generateTotp", () => {
+    it("returns a 6-digit string", () => {
+        const secret = Buffer.from("12345678901234567890");
+        const code = generateTotp(secret);
+        expect(code).toMatch(/^\d{6}$/);
+    });
+
+    it("returns consistent results for the same time step", () => {
+        const secret = Buffer.from("test-secret-1234567");
+        const code1 = generateTotp(secret);
+        const code2 = generateTotp(secret);
+        expect(code1).toBe(code2);
+    });
+
+    it("pads short codes with leading zeros", () => {
+        // Generate many codes to increase chance of seeing leading zeros behavior
+        const secret = Buffer.from("12345678901234567890");
+        const code = generateTotp(secret);
+        expect(code.length).toBe(6);
+    });
+});
+
+describe("verifyTotp", () => {
+    it("verifies a freshly generated token", () => {
+        const secret = Buffer.from("12345678901234567890");
+        const token = generateTotp(secret);
+        expect(verifyTotp(secret, token)).toBe(true);
+    });
+
+    it("rejects an incorrect token", () => {
+        const secret = Buffer.from("12345678901234567890");
+        expect(verifyTotp(secret, "000000")).toBe(false);
+    });
+
+    it("rejects token from different secret", () => {
+        const secret1 = Buffer.from("secret-one-12345678");
+        const secret2 = Buffer.from("secret-two-12345678");
+        const token = generateTotp(secret1);
+        expect(verifyTotp(secret2, token)).toBe(false);
+    });
+
+    it("uses window parameter to check adjacent time steps", () => {
+        const secret = Buffer.from("12345678901234567890");
+        const token = generateTotp(secret);
+        // Window of 0 should still pass for current step
+        expect(verifyTotp(secret, token, 0)).toBe(true);
+        // Window of 2 should also pass for current step
+        expect(verifyTotp(secret, token, 2)).toBe(true);
+    });
+});
+
+describe("generateTotpSecret", () => {
+    it("returns a base32 secret and otpauth URI", () => {
+        const result = generateTotpSecret("MyApp", "user@example.com");
+        expect(result.secret).toBeTruthy();
+        expect(result.uri).toBeTruthy();
+    });
+
+    it("generates a valid otpauth URI format", () => {
+        const result = generateTotpSecret("MyApp", "user@example.com");
+        expect(result.uri).toMatch(/^otpauth:\/\/totp\//);
+        expect(result.uri).toContain("secret=");
+        expect(result.uri).toContain("issuer=MyApp");
+        expect(result.uri).toContain("algorithm=SHA1");
+        expect(result.uri).toContain("digits=6");
+        expect(result.uri).toContain("period=30");
+    });
+
+    it("encodes special characters in issuer and account", () => {
+        const result = generateTotpSecret("My App & Co.", "user+test@example.com");
+        expect(result.uri).toContain(encodeURIComponent("My App & Co."));
+        expect(result.uri).toContain(encodeURIComponent("user+test@example.com"));
+    });
+
+    it("generates unique secrets on each call", () => {
+        const result1 = generateTotpSecret("App", "user@test.com");
+        const result2 = generateTotpSecret("App", "user@test.com");
+        expect(result1.secret).not.toBe(result2.secret);
+    });
+
+    it("secret can be decoded back to a 20-byte buffer", () => {
+        const result = generateTotpSecret("App", "user@test.com");
+        const decoded = base32Decode(result.secret);
+        expect(decoded.length).toBe(20);
+    });
+});
+
+describe("generateRecoveryCodes", () => {
+    it("generates 10 codes by default", () => {
+        const codes = generateRecoveryCodes();
+        expect(codes).toHaveLength(10);
+    });
+
+    it("generates the specified number of codes", () => {
+        const codes = generateRecoveryCodes(5);
+        expect(codes).toHaveLength(5);
+    });
+
+    it("generates codes in XXXXX-XXXXX format", () => {
+        const codes = generateRecoveryCodes();
+        for (const code of codes) {
+            expect(code).toMatch(/^[A-F0-9]{5}-[A-F0-9]{5}$/);
+        }
+    });
+
+    it("generates unique codes", () => {
+        const codes = generateRecoveryCodes(20);
+        const unique = new Set(codes);
+        expect(unique.size).toBe(codes.length);
+    });
+});
+
+describe("hashRecoveryCode", () => {
+    it("returns a hex string", () => {
+        const hash = hashRecoveryCode("ABC12-DEF34");
+        expect(hash).toMatch(/^[a-f0-9]{64}$/);
+    });
+
+    it("is deterministic", () => {
+        const hash1 = hashRecoveryCode("ABC12-DEF34");
+        const hash2 = hashRecoveryCode("ABC12-DEF34");
+        expect(hash1).toBe(hash2);
+    });
+
+    it("strips dashes before hashing", () => {
+        const withDashes = hashRecoveryCode("ABC12-DEF34");
+        const withoutDashes = hashRecoveryCode("ABC12DEF34");
+        expect(withDashes).toBe(withoutDashes);
+    });
+
+    it("normalizes to uppercase before hashing", () => {
+        const upper = hashRecoveryCode("ABC12-DEF34");
+        const lower = hashRecoveryCode("abc12-def34");
+        expect(upper).toBe(lower);
+    });
+
+    it("different codes produce different hashes", () => {
+        const hash1 = hashRecoveryCode("ABC12-DEF34");
+        const hash2 = hashRecoveryCode("XYZ98-UVW76");
+        expect(hash1).not.toBe(hash2);
+    });
+});

package/test/middleware.test.ts

@@ -67,7 +67,8 @@ describe("Auth Middleware", () => {
             expect(nextFn).toHaveBeenCalled();
             expect(getUser()).toEqual({
                 userId: "user-123",
-                roles: ["admin", "editor"]
+                roles: ["admin", "editor"],
+                aal: "aal1"
             });
         });
 
@@ -144,7 +145,8 @@ describe("Auth Middleware", () => {
             expect(nextFn).toHaveBeenCalled();
             expect(getUser()).toEqual({
                 userId: "user-123",
-                roles: ["viewer"]
+                roles: ["viewer"],
+                aal: "aal1"
             });
         });
     });
@@ -159,7 +161,8 @@ describe("Auth Middleware", () => {
             expect(nextFn).toHaveBeenCalled();
             expect(getUser()).toEqual({
                 userId: "user-456",
-                roles: ["viewer"]
+                roles: ["viewer"],
+                aal: "aal1"
             });
         });
 
@@ -273,7 +276,8 @@ roles: ["schema-adminstration", "admins", "admin "] } });
 
             expect(payload).toEqual({
                 userId: "ws-user-123",
-                roles: ["admin"]
+                roles: ["admin"],
+                aal: "aal1"
             });
         });
 
@@ -293,7 +297,8 @@ roles: ["schema-adminstration", "admins", "admin "] } });
 
             expect(payload).toEqual({
                 userId: "user-no-roles",
-                roles: []
+                roles: [],
+                aal: "aal1"
             });
         });
     });

package/test/webhook-service.test.ts

@@ -0,0 +1,249 @@
+import { WebhookDispatcher, WebhookConfig } from "../src/services/webhook-service";
+import { createHmac } from "crypto";
+
+// Mock global fetch
+const mockFetch = jest.fn();
+global.fetch = mockFetch as unknown as typeof fetch;
+
+beforeEach(() => {
+    mockFetch.mockReset();
+});
+
+function makeWebhook(overrides: Partial<WebhookConfig> = {}): WebhookConfig {
+    return {
+        id: "wh_1",
+        url: "https://example.com/webhook",
+        events: ["INSERT", "UPDATE", "DELETE"],
+        table: "users",
+        enabled: true,
+        ...overrides
+    };
+}
+
+describe("WebhookDispatcher", () => {
+    describe("setWebhooks", () => {
+        it("filters out disabled webhooks", () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([
+                makeWebhook({ id: "wh_1", enabled: true }),
+                makeWebhook({ id: "wh_2", enabled: false }),
+                makeWebhook({ id: "wh_3", enabled: true })
+            ]);
+
+            // Disabled webhook should not trigger
+            mockFetch.mockResolvedValue({
+                status: 200,
+                text: () => Promise.resolve("OK")
+            });
+
+            // This should only match enabled webhooks
+        });
+    });
+
+    describe("onEntityChange", () => {
+        it("returns empty array when no webhooks match", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook({ table: "posts" })]);
+
+            const results = await dispatcher.onEntityChange(
+                "users", "INSERT", "id_1", { id: "id_1", name: "Test" }
+            );
+            expect(results).toEqual([]);
+        });
+
+        it("matches webhooks by table AND event", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook({ table: "users", events: ["INSERT"] })]);
+
+            mockFetch.mockResolvedValue({
+                status: 200,
+                text: () => Promise.resolve("OK")
+            });
+
+            const results = await dispatcher.onEntityChange(
+                "users", "INSERT", "id_1", { id: "id_1" }
+            );
+            expect(results).toHaveLength(1);
+            expect(results[0].success).toBe(true);
+        });
+
+        it("does not match different table", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook({ table: "users" })]);
+
+            const results = await dispatcher.onEntityChange(
+                "posts", "INSERT", "id_1", { id: "id_1" }
+            );
+            expect(results).toEqual([]);
+        });
+
+        it("does not match different event", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook({ events: ["INSERT"] })]);
+
+            const results = await dispatcher.onEntityChange(
+                "users", "DELETE", "id_1", { id: "id_1" }
+            );
+            expect(results).toEqual([]);
+        });
+
+        it("includes HMAC signature when webhook has secret", async () => {
+            const secret = "my-webhook-secret";
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook({ secret })]);
+
+            mockFetch.mockResolvedValue({
+                status: 200,
+                text: () => Promise.resolve("OK")
+            });
+
+            await dispatcher.onEntityChange(
+                "users", "INSERT", "id_1", { id: "id_1" }
+            );
+
+            expect(mockFetch).toHaveBeenCalledTimes(1);
+            const [, options] = mockFetch.mock.calls[0];
+            const headers = options.headers as Record<string, string>;
+            expect(headers["X-Webhook-Signature"]).toBeDefined();
+            expect(headers["X-Webhook-Signature"]).toMatch(/^sha256=/);
+
+            // Verify the signature is correct
+            const body = options.body as string;
+            const expectedSig = createHmac("sha256", secret).update(body).digest("hex");
+            expect(headers["X-Webhook-Signature"]).toBe(`sha256=${expectedSig}`);
+        });
+
+        it("does not include signature header when no secret", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook({ secret: undefined })]);
+
+            mockFetch.mockResolvedValue({
+                status: 200,
+                text: () => Promise.resolve("OK")
+            });
+
+            await dispatcher.onEntityChange(
+                "users", "INSERT", "id_1", { id: "id_1" }
+            );
+
+            const [, options] = mockFetch.mock.calls[0];
+            const headers = options.headers as Record<string, string>;
+            expect(headers["X-Webhook-Signature"]).toBeUndefined();
+        });
+
+        it("payload includes type, table, record, and timestamp", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook()]);
+
+            mockFetch.mockResolvedValue({
+                status: 200,
+                text: () => Promise.resolve("OK")
+            });
+
+            const entity = { id: "id_1", name: "Test User" };
+            await dispatcher.onEntityChange("users", "INSERT", "id_1", entity);
+
+            const [, options] = mockFetch.mock.calls[0];
+            const payload = JSON.parse(options.body as string);
+            expect(payload.type).toBe("INSERT");
+            expect(payload.table).toBe("users");
+            expect(payload.record).toEqual(entity);
+            expect(payload.timestamp).toBeTruthy();
+            expect(payload.schema).toBe("public");
+        });
+
+        it("UPDATE payload includes old_record", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook()]);
+
+            mockFetch.mockResolvedValue({
+                status: 200,
+                text: () => Promise.resolve("OK")
+            });
+
+            const entity = { id: "id_1", name: "Updated" };
+            const previous = { id: "id_1", name: "Original" };
+            await dispatcher.onEntityChange("users", "UPDATE", "id_1", entity, previous);
+
+            const [, options] = mockFetch.mock.calls[0];
+            const payload = JSON.parse(options.body as string);
+            expect(payload.old_record).toEqual(previous);
+        });
+
+        it("returns success: false on fetch failure", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook()]);
+
+            mockFetch.mockRejectedValue(new Error("Network error"));
+
+            const results = await dispatcher.onEntityChange(
+                "users", "INSERT", "id_1", { id: "id_1" }
+            );
+
+            // After retries, last result should be failure
+            expect(results).toHaveLength(1);
+            expect(results[0].success).toBe(false);
+            expect(results[0].responseBody).toContain("Network error");
+        }, 30000);
+
+        it("returns success: false for non-2xx status codes", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([makeWebhook()]);
+
+            mockFetch.mockResolvedValue({
+                status: 500,
+                text: () => Promise.resolve("Internal Server Error")
+            });
+
+            const results = await dispatcher.onEntityChange(
+                "users", "INSERT", "id_1", { id: "id_1" }
+            );
+
+            expect(results).toHaveLength(1);
+            expect(results[0].success).toBe(false);
+            expect(results[0].statusCode).toBe(500);
+        }, 30000);
+
+        it("includes custom headers from webhook config", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([
+                makeWebhook({
+                    headers: { "X-Custom": "my-value", "Authorization": "Bearer token" }
+                })
+            ]);
+
+            mockFetch.mockResolvedValue({
+                status: 200,
+                text: () => Promise.resolve("OK")
+            });
+
+            await dispatcher.onEntityChange("users", "INSERT", "id_1", { id: "id_1" });
+
+            const [, options] = mockFetch.mock.calls[0];
+            const headers = options.headers as Record<string, string>;
+            expect(headers["X-Custom"]).toBe("my-value");
+            expect(headers["Authorization"]).toBe("Bearer token");
+        });
+
+        it("dispatches to multiple matching webhooks", async () => {
+            const dispatcher = new WebhookDispatcher();
+            dispatcher.setWebhooks([
+                makeWebhook({ id: "wh_1", url: "https://a.com/hook" }),
+                makeWebhook({ id: "wh_2", url: "https://b.com/hook" })
+            ]);
+
+            mockFetch.mockResolvedValue({
+                status: 200,
+                text: () => Promise.resolve("OK")
+            });
+
+            const results = await dispatcher.onEntityChange(
+                "users", "INSERT", "id_1", { id: "id_1" }
+            );
+
+            expect(results).toHaveLength(2);
+            expect(results[0].webhookId).toBe("wh_1");
+            expect(results[1].webhookId).toBe("wh_2");
+        });
+    });
+});

package/vite.config.ts

@@ -24,7 +24,8 @@ const CONSUMER_EXTERNALS = [
     "chokidar",
     "fsevents",
     "ws",
-    "ts-morph"
+    "ts-morph",
+    "sharp"
 ];
 const isExternal = (id: string) => {
     if (id.startsWith(".") || path.isAbsolute(id)) return false;
@@ -33,7 +34,7 @@ const isExternal = (id: string) => {
     // Externalize only deps the consumer app explicitly installs
     if (CONSUMER_EXTERNALS.some(ext => id === ext || id.startsWith(ext + "/"))) return true;
     // Externalize Node built-ins
-    if (["fs", "path", "url", "util", "crypto", "http", "https", "net", "tls", "stream", "events", "os", "child_process", "buffer", "assert", "node:"].some(b => id === b || id.startsWith("node:") || id.startsWith(b + "/"))) return true;
+    if (["fs", "path", "url", "util", "crypto", "http", "https", "net", "tls", "stream", "events", "os", "child_process", "buffer", "assert", "dns", "zlib", "querystring", "node:"].some(b => id === b || id.startsWith("node:") || id.startsWith(b + "/"))) return true;
     // Inline everything else (jsonwebtoken, ws, zod, etc.)
     return false;
 };

package/dist/index-BZoAtuqi.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-BZoAtuqi.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;"}

package/src/bootstrappers/index.ts

@@ -1 +0,0 @@
-// PostgresBootstrapper was moved to @rebasepro/server-postgresql

package/src/singleton.test.ts

@@ -1,28 +0,0 @@
-import { rebase, _initRebase } from "./singleton";
-import type { RebaseClient } from "@rebasepro/types";
-
-describe("rebase singleton", () => {
-    beforeEach(() => {
-        // Reset the singleton before each test
-        // By calling _initRebase with null (cast to bypass type checking for the reset)
-        _initRebase(null as unknown as RebaseClient);
-    });
-
-    it("should throw an error if accessed before initialization", () => {
-        expect(() => rebase.data).toThrow(
-            "rebase.data: server not initialized yet. The singleton is available after Rebase starts — don't call it at import time."
-        );
-    });
-
-    it("should return the correctly initialized instance properties", () => {
-        const mockClient = {
-            data: { test: "mockData" },
-            auth: { test: "mockAuth" }
-        } as unknown as RebaseClient;
-
-        _initRebase(mockClient);
-
-        expect(rebase.data).toEqual({ test: "mockData" });
-        expect(rebase.auth).toEqual({ test: "mockAuth" });
-    });
-});