@rebasepro/server-core 0.6.1 → 0.8.0

package/test/custom-auth-adapter.test.ts

@@ -1,5 +1,5 @@
 import { createCustomAuthAdapter } from "../src/auth/custom-auth-adapter";
-import type { AuthenticatedUser, CustomAuthAdapterOptions } from "@rebasepro/types";
+import type { AuthenticatedUser, AuthResponsePayload, CustomAuthAdapterOptions } from "@rebasepro/types";
 
 const TEST_USER: AuthenticatedUser = {
     uid: "user-123",
@@ -118,6 +118,7 @@ describe("createCustomAuthAdapter", () => {
             sessionManagement: false,
             profileUpdate: false,
             emailVerification: false,
+            magicLink: false,
             enabledProviders: []
         });
     });
@@ -167,4 +168,22 @@ registration: true }
         });
         expect(adapter.userManagement).toBeUndefined();
     });
+
+    // ── transformAuthResponse ────────────────────────────────────────────
+
+    it("passes through transformAuthResponse when provided", () => {
+        const transformFn = jest.fn(async (response: AuthResponsePayload) => response);
+        const adapter = createCustomAuthAdapter({
+            verifyRequest: async () => null,
+            transformAuthResponse: transformFn
+        });
+        expect(adapter.transformAuthResponse).toBe(transformFn);
+    });
+
+    it("omits transformAuthResponse when not provided", () => {
+        const adapter = createCustomAuthAdapter({
+            verifyRequest: async () => null
+        });
+        expect(adapter.transformAuthResponse).toBeUndefined();
+    });
 });

package/test/define-function.test.ts

@@ -0,0 +1,45 @@
+import { Hono } from "hono";
+import { defineFunction } from "../src/functions/define-function";
+
+describe("defineFunction", () => {
+    it("returns a loader-compatible Hono app (has .fetch and .routes)", () => {
+        const app = defineFunction((a) => {
+            a.get("/ping", (c) => c.text("pong"));
+        });
+
+        // These are exactly the properties the loader duck-types on.
+        expect(typeof app.fetch).toBe("function");
+        expect(Array.isArray(app.routes)).toBe(true);
+    });
+
+    it("registers routes on the provided app", async () => {
+        const app = defineFunction((a) => {
+            a.get("/hello", (c) => c.text("hi"));
+        });
+
+        const res = await app.request("/hello");
+        expect(res.status).toBe(200);
+        expect(await res.text()).toBe("hi");
+    });
+
+    it("exposes the rebase singleton via the injected context", () => {
+        let received: unknown;
+        defineFunction((_a, ctx) => {
+            received = ctx.rebase;
+        });
+        // The singleton reference is passed without being dereferenced,
+        // so no "not initialized" error is thrown at define time.
+        expect(received).toBeDefined();
+    });
+
+    it("uses a returned Hono app when the definition returns one", async () => {
+        const custom = new Hono();
+        custom.get("/custom", (c) => c.text("custom"));
+
+        const app = defineFunction(() => custom);
+
+        const res = await app.request("/custom");
+        expect(res.status).toBe(200);
+        expect(await res.text()).toBe("custom");
+    });
+});

package/test/env.test.ts

@@ -1,32 +1,22 @@
-import { z } from "zod";
 import { loadEnv } from "../src/env";
+import { z } from "zod";
 
 describe("env configuration and localhost validation", () => {
-    let originalEnv: NodeJS.ProcessEnv;
+    const originalEnv = { ...process.env };
 
     beforeEach(() => {
-        // Save a backup of the original process.env
-        originalEnv = { ...process.env };
-        // Clear env vars that might interfere with tests
-        delete process.env.NODE_ENV;
-        delete process.env.DATABASE_URL;
-        delete process.env.ADMIN_CONNECTION_STRING;
-        delete process.env.JWT_SECRET;
-        delete process.env.FRONTEND_URL;
-        delete process.env.CORS_ORIGINS;
-        delete process.env.ALLOW_LOCALHOST_IN_PRODUCTION;
+        // Clear process.env to ensure fresh test runs
+        process.env = {};
+        // Add basic fallback requirements to prevent bootstrap crashes
+        process.env.DATABASE_URL = "postgresql://localhost:5432/rebase";
+        process.env.JWT_SECRET = "super-secret-jwt-key-must-be-long-long-long";
     });
 
     afterEach(() => {
-        // Restore process.env after each test
-        process.env = originalEnv;
+        process.env = { ...originalEnv };
     });
 
-    it("should allow localhost URLs in development mode", () => {
-        process.env.NODE_ENV = "development";
-        process.env.DATABASE_URL = "postgresql://localhost:5432/rebase";
-        process.env.JWT_SECRET = "12345678901234567890123456789012";
-
+    it("should parse default env variables in development mode", () => {
         expect(() => loadEnv()).not.toThrow();
         const env = loadEnv();
         expect(env.DATABASE_URL).toBe("postgresql://localhost:5432/rebase");

package/test/multi-datasource-routing.test.ts

@@ -0,0 +1,113 @@
+import { describe, it, expect, beforeAll } from "@jest/globals";
+import { Hono, Context } from "hono";
+import { configureJwt, generateAccessToken } from "../src/auth/jwt";
+import { createAuthMiddleware } from "../src/auth/middleware";
+import { createAdapterAuthMiddleware } from "../src/auth/adapter-middleware";
+import type { HonoEnv } from "../src/api/types";
+import type { DataDriver, AuthAdapter } from "@rebasepro/types";
+
+const TEST_SECRET = "test-secret-key-for-multi-datasource-routing-1234567890";
+
+// A mock driver that tags itself so we can assert which one was scoped into
+// the request context. The Postgres-like one implements withAuth (RLS), the
+// Mongo-like one does not (scopeDataDriver must no-op for it).
+function mockDriver(key: string, withRls: boolean): DataDriver {
+    const base: Record<string, unknown> = {
+        key,
+        fetchCollection: async () => [],
+        fetchEntity: async () => undefined,
+        saveEntity: async () => ({ id: "x", path: key, values: {} }),
+        deleteEntity: async () => undefined
+    };
+    if (withRls) {
+        // Returns a scoped clone that keeps the same key tag.
+        base.withAuth = async () => ({ ...base, scoped: true });
+    }
+    return base as unknown as DataDriver;
+}
+
+describe("Multi-data-source request routing (middleware)", () => {
+
+    beforeAll(() => {
+        configureJwt({ secret: TEST_SECRET, accessExpiresIn: "1h" });
+    });
+
+    const pg = mockDriver("postgres", true);
+    const mongo = mockDriver("mongodb", false);
+
+    // Route by first path segment: /products → pg, /events → mongo.
+    const resolveDriver = (c: Context<HonoEnv>): DataDriver => {
+        const slug = c.req.path.replace(/^\/+/, "").split("/")[0];
+        return slug === "events" ? mongo : pg;
+    };
+
+    function createApp() {
+        const app = new Hono<HonoEnv>();
+        app.use("/*", createAuthMiddleware({ driver: pg, resolveDriver, requireAuth: false }));
+        app.get("/:slug", (c: Context<HonoEnv>) => {
+            const driver = c.get("driver") as DataDriver | undefined;
+            return c.json({ key: driver?.key });
+        });
+        return app;
+    }
+
+    it("scopes the Postgres delegate for a Postgres collection path", async () => {
+        const token = generateAccessToken("u1", ["admin"]);
+        const res = await createApp().request("/products", { headers: { Authorization: `Bearer ${token}` } });
+        const body = await res.json() as { key: string };
+        expect(body.key).toBe("postgres");
+    });
+
+    it("scopes the Mongo delegate for a Mongo collection path", async () => {
+        const token = generateAccessToken("u1", ["admin"]);
+        const res = await createApp().request("/events", { headers: { Authorization: `Bearer ${token}` } });
+        const body = await res.json() as { key: string };
+        expect(body.key).toBe("mongodb");
+    });
+
+    it("routes per request based on the resolver, not a fixed driver", async () => {
+        const token = generateAccessToken("u1", ["admin"]);
+        const app = createApp();
+        const a = await (await app.request("/events", { headers: { Authorization: `Bearer ${token}` } })).json() as { key: string };
+        const b = await (await app.request("/products", { headers: { Authorization: `Bearer ${token}` } })).json() as { key: string };
+        expect(a.key).toBe("mongodb");
+        expect(b.key).toBe("postgres");
+    });
+
+    it("falls back to the base driver when no resolver is provided", async () => {
+        const app = new Hono<HonoEnv>();
+        app.use("/*", createAuthMiddleware({ driver: mongo, requireAuth: false }));
+        app.get("/:slug", (c: Context<HonoEnv>) => c.json({ key: (c.get("driver") as DataDriver | undefined)?.key }));
+        const res = await app.request("/anything");
+        const body = await res.json() as { key: string };
+        expect(body.key).toBe("mongodb");
+    });
+
+    it("routes a nested/subcollection path by its top-level segment", async () => {
+        const token = generateAccessToken("u1", ["admin"]);
+        const app = new Hono<HonoEnv>();
+        app.use("/*", createAuthMiddleware({ driver: pg, resolveDriver, requireAuth: false }));
+        app.get("/events/:id/attendees", (c: Context<HonoEnv>) =>
+            c.json({ key: (c.get("driver") as DataDriver | undefined)?.key }));
+        const res = await app.request("/events/e1/attendees", { headers: { Authorization: `Bearer ${token}` } });
+        const body = await res.json() as { key: string };
+        expect(body.key).toBe("mongodb");
+    });
+
+    it("routes per request through the adapter auth middleware too", async () => {
+        const adapter: AuthAdapter = {
+            id: "test-adapter",
+            serviceKey: undefined,
+            verifyRequest: async () => ({ uid: "u1", roles: ["admin"] })
+        } as unknown as AuthAdapter;
+
+        const app = new Hono<HonoEnv>();
+        app.use("/*", createAdapterAuthMiddleware({ adapter, driver: pg, resolveDriver, requireAuth: false }));
+        app.get("/:slug", (c: Context<HonoEnv>) => c.json({ key: (c.get("driver") as DataDriver | undefined)?.key }));
+
+        const a = await (await app.request("/events")).json() as { key: string };
+        const b = await (await app.request("/products")).json() as { key: string };
+        expect(a.key).toBe("mongodb");
+        expect(b.key).toBe("postgres");
+    });
+});

package/test/routed-realtime-service.test.ts

@@ -0,0 +1,86 @@
+import { describe, it, expect, jest, beforeEach } from "@jest/globals";
+import { createRoutedRealtimeService } from "../src/services/routed-realtime-service";
+import type { RealtimeProvider } from "@rebasepro/types";
+
+function mockProvider() {
+    return {
+        addClient: jest.fn(),
+        handleClientMessage: jest.fn(async () => {}),
+        subscribeToCollection: jest.fn(),
+        subscribeToEntity: jest.fn(),
+        unsubscribe: jest.fn(),
+        notifyEntityUpdate: jest.fn(async () => {}),
+        onServerReady: jest.fn(),
+        destroy: jest.fn(async () => {}),
+        stopListening: jest.fn(async () => {})
+    };
+}
+
+describe("createRoutedRealtimeService", () => {
+    let pg: ReturnType<typeof mockProvider>;
+    let mongo: ReturnType<typeof mockProvider>;
+    let routed: ReturnType<typeof createRoutedRealtimeService>;
+
+    beforeEach(() => {
+        pg = mockProvider();
+        mongo = mockProvider();
+        routed = createRoutedRealtimeService({
+            providers: { "(default)": pg as unknown as RealtimeProvider, mongo: mongo as unknown as RealtimeProvider },
+            defaultKey: "(default)",
+            resolveKey: (path) => (path.split("/")[0] === "events" ? "mongo" : "(default)")
+        });
+    });
+
+    it("routes subscribe_collection to the provider owning the collection", async () => {
+        await routed.handleClientMessage("c1", { type: "subscribe_collection", payload: { path: "events", subscriptionId: "s1" } });
+        expect(mongo.handleClientMessage).toHaveBeenCalledTimes(1);
+        expect(pg.handleClientMessage).not.toHaveBeenCalled();
+    });
+
+    it("routes subscribe_entity by path", async () => {
+        await routed.handleClientMessage("c1", { type: "subscribe_entity", payload: { path: "products", subscriptionId: "s2" } });
+        expect(pg.handleClientMessage).toHaveBeenCalledTimes(1);
+        expect(mongo.handleClientMessage).not.toHaveBeenCalled();
+    });
+
+    it("forwards unsubscribe to all providers (owner acts, others no-op)", async () => {
+        await routed.handleClientMessage("c1", { type: "unsubscribe", subscriptionId: "s1" });
+        expect(pg.handleClientMessage).toHaveBeenCalledTimes(1);
+        expect(mongo.handleClientMessage).toHaveBeenCalledTimes(1);
+    });
+
+    it("sends channel/presence/broadcast to the default provider only", async () => {
+        await routed.handleClientMessage("c1", { type: "broadcast", payload: { channel: "room", event: "x" } });
+        await routed.handleClientMessage("c1", { type: "join_channel", payload: { channel: "room" } });
+        await routed.handleClientMessage("c1", { type: "presence_track", payload: { channel: "room" } });
+        expect(pg.handleClientMessage).toHaveBeenCalledTimes(3);
+        expect(mongo.handleClientMessage).not.toHaveBeenCalled();
+    });
+
+    it("addClient is forwarded to every provider", () => {
+        const ws = {};
+        routed.addClient("c1", ws);
+        expect(pg.addClient).toHaveBeenCalledWith("c1", ws);
+        expect(mongo.addClient).toHaveBeenCalledWith("c1", ws);
+    });
+
+    it("notifyEntityUpdate routes by path", async () => {
+        await routed.notifyEntityUpdate("events", "e1", null);
+        expect(mongo.notifyEntityUpdate).toHaveBeenCalledTimes(1);
+        expect(pg.notifyEntityUpdate).not.toHaveBeenCalled();
+    });
+
+    it("unknown path falls back to the default provider", async () => {
+        await routed.handleClientMessage("c1", { type: "subscribe_collection", payload: { path: "mystery", subscriptionId: "s9" } });
+        expect(pg.handleClientMessage).toHaveBeenCalledTimes(1);
+    });
+
+    it("lifecycle methods fan out to all providers", async () => {
+        routed.onServerReady?.({ port: 3000 });
+        await routed.destroy?.();
+        expect(pg.onServerReady).toHaveBeenCalledTimes(1);
+        expect(mongo.onServerReady).toHaveBeenCalledTimes(1);
+        expect(pg.destroy).toHaveBeenCalledTimes(1);
+        expect(mongo.destroy).toHaveBeenCalledTimes(1);
+    });
+});

package/test/storage-routes.test.ts

@@ -13,6 +13,7 @@ import { Hono } from "hono";
 import { HonoEnv } from "../src/api/types";
 import { errorHandler } from "../src/api/errors";
 import { LocalStorageController } from "../src/storage/LocalStorageController";
+import { DefaultStorageRegistry } from "../src/storage/storage-registry";
 import { createStorageRoutes, extractWildcardPath } from "../src/storage/routes";
 
 // ──────────────────────────────────────────────────────────────────────
@@ -191,6 +192,38 @@ force: true });
         });
     });
 
+    describe("GET /sources", () => {
+        it("returns the default source in single-controller mode", async () => {
+            const res = await app.fetch(new Request("http://localhost/api/storage/sources"));
+            expect(res.status).toBe(200);
+            const body = await res.json() as { success: boolean; data: Array<{ key: string; engine: string; transport: string }> };
+            expect(body.success).toBe(true);
+            expect(body.data).toEqual([
+                { key: "(default)", engine: "local", transport: "server" }
+            ]);
+        });
+
+        it("merges declared definitions, including direct sources and labels", async () => {
+            const declaredApp = new Hono<HonoEnv>();
+            declaredApp.onError(errorHandler);
+            const routes = createStorageRoutes({
+                controller,
+                requireAuth: false,
+                sources: [
+                    { key: "(default)", engine: "local", transport: "server", label: "Local" },
+                    { key: "firebase", engine: "firebase", transport: "direct", label: "Firebase Storage" }
+                ]
+            });
+            declaredApp.route("/api/storage", routes);
+
+            const res = await declaredApp.fetch(new Request("http://localhost/api/storage/sources"));
+            expect(res.status).toBe(200);
+            const body = await res.json() as { success: boolean; data: Array<{ key: string; engine: string; transport: string; label?: string }> };
+            expect(body.data).toContainEqual({ key: "(default)", engine: "local", transport: "server", label: "Local" });
+            expect(body.data).toContainEqual({ key: "firebase", engine: "firebase", transport: "direct", label: "Firebase Storage" });
+        });
+    });
+
     describe("DELETE /file/*", () => {
         it("should delete an existing file", async () => {
             // Upload another file to delete
@@ -220,3 +253,130 @@ key: "photos/deleteme.txt" });
         });
     });
 });
+
+// ──────────────────────────────────────────────────────────────────────
+// Multi-backend routing through the StorageRegistry
+// ──────────────────────────────────────────────────────────────────────
+describe("Storage routes — multi-backend routing (registry)", () => {
+    let app: Hono<HonoEnv>;
+    let defaultDir: string;
+    let secondaryDir: string;
+
+    beforeEach(async () => {
+        defaultDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "rebase-default-"));
+        secondaryDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "rebase-secondary-"));
+
+        const registry = DefaultStorageRegistry.create({
+            "(default)": new LocalStorageController({ basePath: defaultDir }),
+            secondary: new LocalStorageController({ basePath: secondaryDir })
+        });
+
+        app = new Hono<HonoEnv>();
+        app.onError(errorHandler);
+        app.route("/api/storage", createStorageRoutes({
+            registry,
+            requireAuth: false,
+            sources: [
+                { key: "(default)", engine: "local", transport: "server" },
+                { key: "secondary", engine: "local", transport: "server", label: "Secondary" }
+            ]
+        }));
+    });
+
+    afterEach(async () => {
+        await fs.promises.rm(defaultDir, { recursive: true, force: true });
+        await fs.promises.rm(secondaryDir, { recursive: true, force: true });
+    });
+
+    async function upload(storageId: string | undefined, key: string, content: string) {
+        const fd = new FormData();
+        fd.append("file", new File([Buffer.from(content)], "file.txt", { type: "text/plain" }));
+        fd.append("key", key);
+        if (storageId) fd.append("storageId", storageId);
+        return app.fetch(new Request("http://localhost/api/storage/upload", { method: "POST", body: fd }));
+    }
+
+    it("routes an upload to the backend named by storageId", async () => {
+        const res = await upload("secondary", "docs/secret.txt", "in-secondary");
+        expect(res.ok).toBe(true);
+
+        // It physically landed in the secondary backend, not the default one.
+        const inSecondary = await app.fetch(
+            new Request("http://localhost/api/storage/file/default/docs/secret.txt?storageId=secondary")
+        );
+        expect(inSecondary.status).toBe(200);
+        expect(await inSecondary.text()).toBe("in-secondary");
+
+        // The default backend does not have it.
+        const inDefault = await app.fetch(
+            new Request("http://localhost/api/storage/file/default/docs/secret.txt")
+        );
+        expect(inDefault.status).toBe(404);
+    });
+
+    it("keeps the same key isolated per backend", async () => {
+        await upload(undefined, "shared.txt", "from-default");
+        await upload("secondary", "shared.txt", "from-secondary");
+
+        const d = await app.fetch(new Request("http://localhost/api/storage/file/default/shared.txt"));
+        const s = await app.fetch(new Request("http://localhost/api/storage/file/default/shared.txt?storageId=secondary"));
+        expect(await d.text()).toBe("from-default");
+        expect(await s.text()).toBe("from-secondary");
+    });
+
+    it("serves metadata from the backend named by storageId", async () => {
+        await upload("secondary", "m.txt", "x");
+        const res = await app.fetch(
+            new Request("http://localhost/api/storage/metadata/default/m.txt?storageId=secondary")
+        );
+        expect(res.status).toBe(200);
+        const body = await res.json() as { success: boolean; data: { contentType: string } };
+        expect(body.success).toBe(true);
+        expect(body.data.contentType).toBe("text/plain");
+    });
+
+    it("lists only the targeted backend's contents", async () => {
+        await upload(undefined, "only-default.txt", "a");
+        await upload("secondary", "only-secondary.txt", "b");
+
+        const res = await app.fetch(new Request("http://localhost/api/storage/list?storageId=secondary"));
+        const body = await res.json() as { data: { items: Array<{ name: string }> } };
+        const names = body.data.items.map((i) => i.name);
+        expect(names).toContain("only-secondary.txt");
+        expect(names).not.toContain("only-default.txt");
+    });
+
+    it("deletes from the backend named by storageId", async () => {
+        await upload("secondary", "del.txt", "bye");
+
+        const del = await app.fetch(
+            new Request("http://localhost/api/storage/file/default/del.txt?storageId=secondary", { method: "DELETE" })
+        );
+        expect(del.status).toBe(200);
+
+        const after = await app.fetch(
+            new Request("http://localhost/api/storage/file/default/del.txt?storageId=secondary")
+        );
+        expect(after.status).toBe(404);
+    });
+
+    it("falls back to the default backend for an unknown storageId", async () => {
+        const res = await upload("does-not-exist", "fallback.txt", "fell-back");
+        expect(res.ok).toBe(true);
+
+        // Unknown id falls back to default, so the file is in the default backend.
+        const inDefault = await app.fetch(
+            new Request("http://localhost/api/storage/file/default/fallback.txt")
+        );
+        expect(inDefault.status).toBe(200);
+        expect(await inDefault.text()).toBe("fell-back");
+    });
+
+    it("lists both backends via GET /sources", async () => {
+        const res = await app.fetch(new Request("http://localhost/api/storage/sources"));
+        const body = await res.json() as { data: Array<{ key: string; engine: string; label?: string }> };
+        const keys = body.data.map((s) => s.key);
+        expect(keys).toEqual(expect.arrayContaining(["(default)", "secondary"]));
+        expect(body.data.find((s) => s.key === "secondary")?.label).toBe("Secondary");
+    });
+});