@rebasepro/server-core 0.6.0 → 0.7.0

package/src/utils/dev-port.ts

@@ -37,6 +37,8 @@ export function listenWithPortRetry(
         maxAttempts?: number;
         /** Absolute path to write the resolved port file into.  Defaults to `process.cwd()`. */
         portFileDir?: string;
+        /** Service key to include in the state file for MCP server auto-discovery. */
+        serviceKey?: string;
     }
 ): Promise<number> {
     const host = options?.host ?? "0.0.0.0";
@@ -122,7 +124,7 @@ export function listenWithPortRetry(
 
                     // Write .rebase/state.json so external scripts can discover
                     // the running server port, URL, etc.
-                    writeStateFile(portFileDir, port);
+                    writeStateFile(portFileDir, port, options?.serviceKey);
                 }
 
                 resolve(port);
@@ -159,10 +161,11 @@ export function cleanupDevPortFile(dir: string): void {
  * Write `.rebase/state.json` with runtime info for external scripts.
  *
  * Scripts can read this file to discover:
- * - `port`      — the actual port the backend is listening on
- * - `baseUrl`   — full URL including protocol and port
- * - `pid`       — the backend process ID
- * - `startedAt` — ISO timestamp of when the server started
+ * - `port`       — the actual port the backend is listening on
+ * - `baseUrl`    — full URL including protocol and port
+ * - `pid`        — the backend process ID
+ * - `startedAt`  — ISO timestamp of when the server started
+ * - `serviceKey` — (dev only) the REBASE_SERVICE_KEY for MCP auto-discovery
  *
  * @example Reading from a script:
  * ```ts
@@ -170,19 +173,22 @@ export function cleanupDevPortFile(dir: string): void {
  * const apiUrl = state.baseUrl; // "http://localhost:3519"
  * ```
  */
-function writeStateFile(projectRoot: string, port: number): void {
+function writeStateFile(projectRoot: string, port: number, serviceKey?: string): void {
     try {
         const rebaseDir = path.join(projectRoot, ".rebase");
         if (!fs.existsSync(rebaseDir)) {
             fs.mkdirSync(rebaseDir, { recursive: true });
         }
         const stateFile = path.join(rebaseDir, "state.json");
-        const state = {
+        const state: Record<string, unknown> = {
             port,
             baseUrl: `http://localhost:${port}`,
             pid: process.pid,
             startedAt: new Date().toISOString()
         };
+        if (serviceKey) {
+            state.serviceKey = serviceKey;
+        }
         fs.writeFileSync(stateFile, JSON.stringify(state, null, 2), "utf-8");
     } catch {
         // Non-fatal

package/test/auth-routes.test.ts

@@ -17,6 +17,18 @@ import { configureJwt, generateAccessToken, hashRefreshToken } from "../src/auth
 
 jest.mock("../src/auth/password");
 
+jest.mock("../src/utils/logger", () => {
+    return {
+        logger: {
+            info: jest.fn(),
+            warn: jest.fn(),
+            error: jest.fn(),
+            debug: jest.fn(),
+            child: jest.fn().mockReturnThis()
+        }
+    };
+});
+
 // Bypass rate limiters — they share state across tests and cause 429s
 jest.mock("../src/auth/rate-limiter", () => {
     const passthrough = async (_c: unknown, next: () => Promise<void>) => next();
@@ -28,6 +40,7 @@ jest.mock("../src/auth/rate-limiter", () => {
 });
 
 import { hashPassword, verifyPassword, validatePasswordStrength } from "../src/auth/password";
+import { logger } from "../src/utils/logger";
 import { z } from "zod";
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
@@ -139,15 +152,18 @@ verifyEmailUrl: "https://app.test" } : undefined,
                     if (idToken === "link-token") return { providerId: "g-456",
 email: "existing@test.com",
 displayName: "Existing",
-photoUrl: null };
+photoUrl: null,
+emailVerified: true };
                     if (idToken === "returning-token") return { providerId: "g-789",
 email: "returning@test.com",
 displayName: "Updated Name",
-photoUrl: "https://new-photo.url" };
+photoUrl: "https://new-photo.url",
+emailVerified: true };
                     if (idToken === "valid-token") return { providerId: "g-123",
 email: "google@test.com",
 displayName: "Google User",
-photoUrl: "https://photo.url" };
+photoUrl: "https://photo.url",
+emailVerified: true };
                     return null;
                 }
             }
@@ -361,9 +377,43 @@ password: "Any1" }));
             mockAuthRepo.getUserByEmail.mockResolvedValueOnce(mockUser());
 
             await app.request("/auth/login", json({ email: "test@example.com",
-password: "ValidPass1" }));
+                password: "ValidPass1" }));
             expect(mockAuthRepo.createRefreshToken).toHaveBeenCalledTimes(1);
         });
+
+        it("emits a structured security audit log on successful login", async () => {
+            const app = createApp();
+            const user = mockUser({ passwordHash: "salt:hash" });
+            mockAuthRepo.getUserByEmail.mockResolvedValueOnce(user);
+
+            await app.request("/auth/login", json({ email: "test@example.com", password: "ValidPass1" }));
+            
+            expect(logger.info).toHaveBeenCalledWith(
+                expect.stringContaining("[Security Audit] Auth login success"),
+                expect.objectContaining({
+                    userId: "user-1",
+                    email: "test@example.com",
+                    eventType: "auth.login.success"
+                })
+            );
+        });
+
+        it("emits a structured security audit log on failed login (wrong password)", async () => {
+            const app = createApp();
+            mockAuthRepo.getUserByEmail.mockResolvedValueOnce(mockUser());
+            (verifyPassword as jest.Mock).mockResolvedValueOnce(false);
+
+            await app.request("/auth/login", json({ email: "test@example.com", password: "WrongPassword" }));
+            
+            expect(logger.warn).toHaveBeenCalledWith(
+                expect.stringContaining("[Security Audit] Auth login failure"),
+                expect.objectContaining({
+                    email: "test@example.com",
+                    userId: "user-1",
+                    eventType: "auth.login.failure"
+                })
+            );
+        });
     });
 
     // ── Google OAuth ────────────────────────────────────────────────────

package/test/custom-auth-adapter.test.ts

@@ -1,5 +1,5 @@
 import { createCustomAuthAdapter } from "../src/auth/custom-auth-adapter";
-import type { AuthenticatedUser, CustomAuthAdapterOptions } from "@rebasepro/types";
+import type { AuthenticatedUser, AuthResponsePayload, CustomAuthAdapterOptions } from "@rebasepro/types";
 
 const TEST_USER: AuthenticatedUser = {
     uid: "user-123",
@@ -118,6 +118,7 @@ describe("createCustomAuthAdapter", () => {
             sessionManagement: false,
             profileUpdate: false,
             emailVerification: false,
+            magicLink: false,
             enabledProviders: []
         });
     });
@@ -167,4 +168,22 @@ registration: true }
         });
         expect(adapter.userManagement).toBeUndefined();
     });
+
+    // ── transformAuthResponse ────────────────────────────────────────────
+
+    it("passes through transformAuthResponse when provided", () => {
+        const transformFn = jest.fn(async (response: AuthResponsePayload) => response);
+        const adapter = createCustomAuthAdapter({
+            verifyRequest: async () => null,
+            transformAuthResponse: transformFn
+        });
+        expect(adapter.transformAuthResponse).toBe(transformFn);
+    });
+
+    it("omits transformAuthResponse when not provided", () => {
+        const adapter = createCustomAuthAdapter({
+            verifyRequest: async () => null
+        });
+        expect(adapter.transformAuthResponse).toBeUndefined();
+    });
 });

package/test/env.test.ts

@@ -1,32 +1,22 @@
-import { z } from "zod";
 import { loadEnv } from "../src/env";
+import { z } from "zod";
 
 describe("env configuration and localhost validation", () => {
-    let originalEnv: NodeJS.ProcessEnv;
+    const originalEnv = { ...process.env };
 
     beforeEach(() => {
-        // Save a backup of the original process.env
-        originalEnv = { ...process.env };
-        // Clear env vars that might interfere with tests
-        delete process.env.NODE_ENV;
-        delete process.env.DATABASE_URL;
-        delete process.env.ADMIN_CONNECTION_STRING;
-        delete process.env.JWT_SECRET;
-        delete process.env.FRONTEND_URL;
-        delete process.env.CORS_ORIGINS;
-        delete process.env.ALLOW_LOCALHOST_IN_PRODUCTION;
+        // Clear process.env to ensure fresh test runs
+        process.env = {};
+        // Add basic fallback requirements to prevent bootstrap crashes
+        process.env.DATABASE_URL = "postgresql://localhost:5432/rebase";
+        process.env.JWT_SECRET = "super-secret-jwt-key-must-be-long-long-long";
     });
 
     afterEach(() => {
-        // Restore process.env after each test
-        process.env = originalEnv;
+        process.env = { ...originalEnv };
     });
 
-    it("should allow localhost URLs in development mode", () => {
-        process.env.NODE_ENV = "development";
-        process.env.DATABASE_URL = "postgresql://localhost:5432/rebase";
-        process.env.JWT_SECRET = "12345678901234567890123456789012";
-
+    it("should parse default env variables in development mode", () => {
         expect(() => loadEnv()).not.toThrow();
         const env = loadEnv();
         expect(env.DATABASE_URL).toBe("postgresql://localhost:5432/rebase");

package/test/multi-datasource-routing.test.ts

@@ -0,0 +1,113 @@
+import { describe, it, expect, beforeAll } from "@jest/globals";
+import { Hono, Context } from "hono";
+import { configureJwt, generateAccessToken } from "../src/auth/jwt";
+import { createAuthMiddleware } from "../src/auth/middleware";
+import { createAdapterAuthMiddleware } from "../src/auth/adapter-middleware";
+import type { HonoEnv } from "../src/api/types";
+import type { DataDriver, AuthAdapter } from "@rebasepro/types";
+
+const TEST_SECRET = "test-secret-key-for-multi-datasource-routing-1234567890";
+
+// A mock driver that tags itself so we can assert which one was scoped into
+// the request context. The Postgres-like one implements withAuth (RLS), the
+// Mongo-like one does not (scopeDataDriver must no-op for it).
+function mockDriver(key: string, withRls: boolean): DataDriver {
+    const base: Record<string, unknown> = {
+        key,
+        fetchCollection: async () => [],
+        fetchEntity: async () => undefined,
+        saveEntity: async () => ({ id: "x", path: key, values: {} }),
+        deleteEntity: async () => undefined
+    };
+    if (withRls) {
+        // Returns a scoped clone that keeps the same key tag.
+        base.withAuth = async () => ({ ...base, scoped: true });
+    }
+    return base as unknown as DataDriver;
+}
+
+describe("Multi-data-source request routing (middleware)", () => {
+
+    beforeAll(() => {
+        configureJwt({ secret: TEST_SECRET, accessExpiresIn: "1h" });
+    });
+
+    const pg = mockDriver("postgres", true);
+    const mongo = mockDriver("mongodb", false);
+
+    // Route by first path segment: /products → pg, /events → mongo.
+    const resolveDriver = (c: Context<HonoEnv>): DataDriver => {
+        const slug = c.req.path.replace(/^\/+/, "").split("/")[0];
+        return slug === "events" ? mongo : pg;
+    };
+
+    function createApp() {
+        const app = new Hono<HonoEnv>();
+        app.use("/*", createAuthMiddleware({ driver: pg, resolveDriver, requireAuth: false }));
+        app.get("/:slug", (c: Context<HonoEnv>) => {
+            const driver = c.get("driver") as DataDriver | undefined;
+            return c.json({ key: driver?.key });
+        });
+        return app;
+    }
+
+    it("scopes the Postgres delegate for a Postgres collection path", async () => {
+        const token = generateAccessToken("u1", ["admin"]);
+        const res = await createApp().request("/products", { headers: { Authorization: `Bearer ${token}` } });
+        const body = await res.json() as { key: string };
+        expect(body.key).toBe("postgres");
+    });
+
+    it("scopes the Mongo delegate for a Mongo collection path", async () => {
+        const token = generateAccessToken("u1", ["admin"]);
+        const res = await createApp().request("/events", { headers: { Authorization: `Bearer ${token}` } });
+        const body = await res.json() as { key: string };
+        expect(body.key).toBe("mongodb");
+    });
+
+    it("routes per request based on the resolver, not a fixed driver", async () => {
+        const token = generateAccessToken("u1", ["admin"]);
+        const app = createApp();
+        const a = await (await app.request("/events", { headers: { Authorization: `Bearer ${token}` } })).json() as { key: string };
+        const b = await (await app.request("/products", { headers: { Authorization: `Bearer ${token}` } })).json() as { key: string };
+        expect(a.key).toBe("mongodb");
+        expect(b.key).toBe("postgres");
+    });
+
+    it("falls back to the base driver when no resolver is provided", async () => {
+        const app = new Hono<HonoEnv>();
+        app.use("/*", createAuthMiddleware({ driver: mongo, requireAuth: false }));
+        app.get("/:slug", (c: Context<HonoEnv>) => c.json({ key: (c.get("driver") as DataDriver | undefined)?.key }));
+        const res = await app.request("/anything");
+        const body = await res.json() as { key: string };
+        expect(body.key).toBe("mongodb");
+    });
+
+    it("routes a nested/subcollection path by its top-level segment", async () => {
+        const token = generateAccessToken("u1", ["admin"]);
+        const app = new Hono<HonoEnv>();
+        app.use("/*", createAuthMiddleware({ driver: pg, resolveDriver, requireAuth: false }));
+        app.get("/events/:id/attendees", (c: Context<HonoEnv>) =>
+            c.json({ key: (c.get("driver") as DataDriver | undefined)?.key }));
+        const res = await app.request("/events/e1/attendees", { headers: { Authorization: `Bearer ${token}` } });
+        const body = await res.json() as { key: string };
+        expect(body.key).toBe("mongodb");
+    });
+
+    it("routes per request through the adapter auth middleware too", async () => {
+        const adapter: AuthAdapter = {
+            id: "test-adapter",
+            serviceKey: undefined,
+            verifyRequest: async () => ({ uid: "u1", roles: ["admin"] })
+        } as unknown as AuthAdapter;
+
+        const app = new Hono<HonoEnv>();
+        app.use("/*", createAdapterAuthMiddleware({ adapter, driver: pg, resolveDriver, requireAuth: false }));
+        app.get("/:slug", (c: Context<HonoEnv>) => c.json({ key: (c.get("driver") as DataDriver | undefined)?.key }));
+
+        const a = await (await app.request("/events")).json() as { key: string };
+        const b = await (await app.request("/products")).json() as { key: string };
+        expect(a.key).toBe("mongodb");
+        expect(b.key).toBe("postgres");
+    });
+});

package/test/routed-realtime-service.test.ts

@@ -0,0 +1,86 @@
+import { describe, it, expect, jest, beforeEach } from "@jest/globals";
+import { createRoutedRealtimeService } from "../src/services/routed-realtime-service";
+import type { RealtimeProvider } from "@rebasepro/types";
+
+function mockProvider() {
+    return {
+        addClient: jest.fn(),
+        handleClientMessage: jest.fn(async () => {}),
+        subscribeToCollection: jest.fn(),
+        subscribeToEntity: jest.fn(),
+        unsubscribe: jest.fn(),
+        notifyEntityUpdate: jest.fn(async () => {}),
+        onServerReady: jest.fn(),
+        destroy: jest.fn(async () => {}),
+        stopListening: jest.fn(async () => {})
+    };
+}
+
+describe("createRoutedRealtimeService", () => {
+    let pg: ReturnType<typeof mockProvider>;
+    let mongo: ReturnType<typeof mockProvider>;
+    let routed: ReturnType<typeof createRoutedRealtimeService>;
+
+    beforeEach(() => {
+        pg = mockProvider();
+        mongo = mockProvider();
+        routed = createRoutedRealtimeService({
+            providers: { "(default)": pg as unknown as RealtimeProvider, mongo: mongo as unknown as RealtimeProvider },
+            defaultKey: "(default)",
+            resolveKey: (path) => (path.split("/")[0] === "events" ? "mongo" : "(default)")
+        });
+    });
+
+    it("routes subscribe_collection to the provider owning the collection", async () => {
+        await routed.handleClientMessage("c1", { type: "subscribe_collection", payload: { path: "events", subscriptionId: "s1" } });
+        expect(mongo.handleClientMessage).toHaveBeenCalledTimes(1);
+        expect(pg.handleClientMessage).not.toHaveBeenCalled();
+    });
+
+    it("routes subscribe_entity by path", async () => {
+        await routed.handleClientMessage("c1", { type: "subscribe_entity", payload: { path: "products", subscriptionId: "s2" } });
+        expect(pg.handleClientMessage).toHaveBeenCalledTimes(1);
+        expect(mongo.handleClientMessage).not.toHaveBeenCalled();
+    });
+
+    it("forwards unsubscribe to all providers (owner acts, others no-op)", async () => {
+        await routed.handleClientMessage("c1", { type: "unsubscribe", subscriptionId: "s1" });
+        expect(pg.handleClientMessage).toHaveBeenCalledTimes(1);
+        expect(mongo.handleClientMessage).toHaveBeenCalledTimes(1);
+    });
+
+    it("sends channel/presence/broadcast to the default provider only", async () => {
+        await routed.handleClientMessage("c1", { type: "broadcast", payload: { channel: "room", event: "x" } });
+        await routed.handleClientMessage("c1", { type: "join_channel", payload: { channel: "room" } });
+        await routed.handleClientMessage("c1", { type: "presence_track", payload: { channel: "room" } });
+        expect(pg.handleClientMessage).toHaveBeenCalledTimes(3);
+        expect(mongo.handleClientMessage).not.toHaveBeenCalled();
+    });
+
+    it("addClient is forwarded to every provider", () => {
+        const ws = {};
+        routed.addClient("c1", ws);
+        expect(pg.addClient).toHaveBeenCalledWith("c1", ws);
+        expect(mongo.addClient).toHaveBeenCalledWith("c1", ws);
+    });
+
+    it("notifyEntityUpdate routes by path", async () => {
+        await routed.notifyEntityUpdate("events", "e1", null);
+        expect(mongo.notifyEntityUpdate).toHaveBeenCalledTimes(1);
+        expect(pg.notifyEntityUpdate).not.toHaveBeenCalled();
+    });
+
+    it("unknown path falls back to the default provider", async () => {
+        await routed.handleClientMessage("c1", { type: "subscribe_collection", payload: { path: "mystery", subscriptionId: "s9" } });
+        expect(pg.handleClientMessage).toHaveBeenCalledTimes(1);
+    });
+
+    it("lifecycle methods fan out to all providers", async () => {
+        routed.onServerReady?.({ port: 3000 });
+        await routed.destroy?.();
+        expect(pg.onServerReady).toHaveBeenCalledTimes(1);
+        expect(mongo.onServerReady).toHaveBeenCalledTimes(1);
+        expect(pg.destroy).toHaveBeenCalledTimes(1);
+        expect(mongo.destroy).toHaveBeenCalledTimes(1);
+    });
+});