@rebasepro/server-core 0.7.0 → 0.9.0

package/test/mfa.test.ts

@@ -1,197 +0,0 @@
-import {
-    base32Encode,
-    base32Decode,
-    generateTotp,
-    verifyTotp,
-    generateTotpSecret,
-    generateRecoveryCodes,
-    hashRecoveryCode
-} from "../src/auth/mfa";
-
-describe("base32Encode / base32Decode", () => {
-    it("round-trips a known buffer", () => {
-        const original = Buffer.from("Hello, World!");
-        const encoded = base32Encode(original);
-        const decoded = base32Decode(encoded);
-        expect(decoded.toString()).toBe("Hello, World!");
-    });
-
-    it("encodes known test vectors (RFC 4648)", () => {
-        // RFC 4648 test vectors
-        expect(base32Encode(Buffer.from(""))).toBe("");
-        expect(base32Encode(Buffer.from("f"))).toBe("MY");
-        expect(base32Encode(Buffer.from("fo"))).toBe("MZXQ");
-        expect(base32Encode(Buffer.from("foo"))).toBe("MZXW6");
-        expect(base32Encode(Buffer.from("foob"))).toBe("MZXW6YQ");
-        expect(base32Encode(Buffer.from("fooba"))).toBe("MZXW6YTB");
-        expect(base32Encode(Buffer.from("foobar"))).toBe("MZXW6YTBOI");
-    });
-
-    it("decodes base32 with trailing padding characters", () => {
-        const decoded = base32Decode("MZXW6===");
-        expect(decoded.toString()).toBe("foo");
-    });
-
-    it("is case-insensitive when decoding", () => {
-        const upper = base32Decode("MZXW6YTBOI");
-        const lower = base32Decode("mzxw6ytboi");
-        expect(upper.equals(lower)).toBe(true);
-    });
-
-    it("handles single byte", () => {
-        const buf = Buffer.from([0xff]);
-        const encoded = base32Encode(buf);
-        const decoded = base32Decode(encoded);
-        expect(decoded[0]).toBe(0xff);
-    });
-
-    it("round-trips random 20-byte secret", () => {
-        const original = Buffer.from("abcdefghij1234567890");
-        const encoded = base32Encode(original);
-        const decoded = base32Decode(encoded);
-        expect(decoded.toString()).toBe(original.toString());
-    });
-});
-
-describe("generateTotp", () => {
-    it("returns a 6-digit string", () => {
-        const secret = Buffer.from("12345678901234567890");
-        const code = generateTotp(secret);
-        expect(code).toMatch(/^\d{6}$/);
-    });
-
-    it("returns consistent results for the same time step", () => {
-        const secret = Buffer.from("test-secret-1234567");
-        const code1 = generateTotp(secret);
-        const code2 = generateTotp(secret);
-        expect(code1).toBe(code2);
-    });
-
-    it("pads short codes with leading zeros", () => {
-        // Generate many codes to increase chance of seeing leading zeros behavior
-        const secret = Buffer.from("12345678901234567890");
-        const code = generateTotp(secret);
-        expect(code.length).toBe(6);
-    });
-});
-
-describe("verifyTotp", () => {
-    it("verifies a freshly generated token", () => {
-        const secret = Buffer.from("12345678901234567890");
-        const token = generateTotp(secret);
-        expect(verifyTotp(secret, token)).toBe(true);
-    });
-
-    it("rejects an incorrect token", () => {
-        const secret = Buffer.from("12345678901234567890");
-        expect(verifyTotp(secret, "000000")).toBe(false);
-    });
-
-    it("rejects token from different secret", () => {
-        const secret1 = Buffer.from("secret-one-12345678");
-        const secret2 = Buffer.from("secret-two-12345678");
-        const token = generateTotp(secret1);
-        expect(verifyTotp(secret2, token)).toBe(false);
-    });
-
-    it("uses window parameter to check adjacent time steps", () => {
-        const secret = Buffer.from("12345678901234567890");
-        const token = generateTotp(secret);
-        // Window of 0 should still pass for current step
-        expect(verifyTotp(secret, token, 0)).toBe(true);
-        // Window of 2 should also pass for current step
-        expect(verifyTotp(secret, token, 2)).toBe(true);
-    });
-});
-
-describe("generateTotpSecret", () => {
-    it("returns a base32 secret and otpauth URI", () => {
-        const result = generateTotpSecret("MyApp", "user@example.com");
-        expect(result.secret).toBeTruthy();
-        expect(result.uri).toBeTruthy();
-    });
-
-    it("generates a valid otpauth URI format", () => {
-        const result = generateTotpSecret("MyApp", "user@example.com");
-        expect(result.uri).toMatch(/^otpauth:\/\/totp\//);
-        expect(result.uri).toContain("secret=");
-        expect(result.uri).toContain("issuer=MyApp");
-        expect(result.uri).toContain("algorithm=SHA1");
-        expect(result.uri).toContain("digits=6");
-        expect(result.uri).toContain("period=30");
-    });
-
-    it("encodes special characters in issuer and account", () => {
-        const result = generateTotpSecret("My App & Co.", "user+test@example.com");
-        expect(result.uri).toContain(encodeURIComponent("My App & Co."));
-        expect(result.uri).toContain(encodeURIComponent("user+test@example.com"));
-    });
-
-    it("generates unique secrets on each call", () => {
-        const result1 = generateTotpSecret("App", "user@test.com");
-        const result2 = generateTotpSecret("App", "user@test.com");
-        expect(result1.secret).not.toBe(result2.secret);
-    });
-
-    it("secret can be decoded back to a 20-byte buffer", () => {
-        const result = generateTotpSecret("App", "user@test.com");
-        const decoded = base32Decode(result.secret);
-        expect(decoded.length).toBe(20);
-    });
-});
-
-describe("generateRecoveryCodes", () => {
-    it("generates 10 codes by default", () => {
-        const codes = generateRecoveryCodes();
-        expect(codes).toHaveLength(10);
-    });
-
-    it("generates the specified number of codes", () => {
-        const codes = generateRecoveryCodes(5);
-        expect(codes).toHaveLength(5);
-    });
-
-    it("generates codes in XXXXX-XXXXX format", () => {
-        const codes = generateRecoveryCodes();
-        for (const code of codes) {
-            expect(code).toMatch(/^[A-F0-9]{5}-[A-F0-9]{5}$/);
-        }
-    });
-
-    it("generates unique codes", () => {
-        const codes = generateRecoveryCodes(20);
-        const unique = new Set(codes);
-        expect(unique.size).toBe(codes.length);
-    });
-});
-
-describe("hashRecoveryCode", () => {
-    it("returns a hex string", () => {
-        const hash = hashRecoveryCode("ABC12-DEF34");
-        expect(hash).toMatch(/^[a-f0-9]{64}$/);
-    });
-
-    it("is deterministic", () => {
-        const hash1 = hashRecoveryCode("ABC12-DEF34");
-        const hash2 = hashRecoveryCode("ABC12-DEF34");
-        expect(hash1).toBe(hash2);
-    });
-
-    it("strips dashes before hashing", () => {
-        const withDashes = hashRecoveryCode("ABC12-DEF34");
-        const withoutDashes = hashRecoveryCode("ABC12DEF34");
-        expect(withDashes).toBe(withoutDashes);
-    });
-
-    it("normalizes to uppercase before hashing", () => {
-        const upper = hashRecoveryCode("ABC12-DEF34");
-        const lower = hashRecoveryCode("abc12-def34");
-        expect(upper).toBe(lower);
-    });
-
-    it("different codes produce different hashes", () => {
-        const hash1 = hashRecoveryCode("ABC12-DEF34");
-        const hash2 = hashRecoveryCode("XYZ98-UVW76");
-        expect(hash1).not.toBe(hash2);
-    });
-});

package/test/middleware.test.ts

@@ -1,305 +0,0 @@
-import { requireAuth, optionalAuth, extractUserFromToken, requireAdmin } from "../src/auth/middleware";
-import { configureJwt, generateAccessToken } from "../src/auth/jwt";
-
-// ── Minimal Hono-context mock ────────────────────────────────────────────
-function createMockContext(opts: {
-    authHeader?: string;
-    queryToken?: string;
-    user?: any;
-} = {}) {
-    let capturedStatus: number | undefined;
-    let capturedBody: any;
-    const variables = new Map<string, any>();
-
-    if (opts.user !== undefined) variables.set("user", opts.user);
-
-    const c = {
-        req: {
-            header: (name: string) => {
-                if (name === "authorization") return opts.authHeader;
-                return undefined;
-            },
-            query: (name: string) => {
-                if (name === "token") return opts.queryToken;
-                return undefined;
-            }
-        },
-        json: (body: any, status?: number) => {
-            capturedBody = body;
-            capturedStatus = status ?? 200;
-            return new Response(JSON.stringify(body), { status: capturedStatus });
-        },
-        set: (key: string, value: any) => variables.set(key, value),
-        get: (key: string) => variables.get(key)
-    } as any;
-
-    return {
-        c,
-        getStatus: () => capturedStatus,
-        getBody: () => capturedBody,
-        getUser: () => variables.get("user")
-    };
-}
-
-describe("Auth Middleware", () => {
-    const testSecret = "test-secret-key-for-middleware-testing";
-    const nextFn = jest.fn();
-
-    beforeAll(() => {
-        configureJwt({
-            secret: testSecret,
-            accessExpiresIn: "1h",
-            refreshExpiresIn: "30d"
-        });
-    });
-
-    beforeEach(() => {
-        nextFn.mockClear();
-    });
-
-    describe("requireAuth", () => {
-        it("should call next() and set user for valid token", async () => {
-            const token = generateAccessToken("user-123", ["admin", "editor"]);
-            const { c, getUser } = createMockContext({ authHeader: `Bearer ${token}` });
-
-            await requireAuth(c, nextFn);
-
-            expect(nextFn).toHaveBeenCalled();
-            expect(getUser()).toEqual({
-                userId: "user-123",
-                roles: ["admin", "editor"],
-                aal: "aal1"
-            });
-        });
-
-        it("should return 401 for missing Authorization header", async () => {
-            const { c, getStatus, getBody } = createMockContext();
-
-            await requireAuth(c, nextFn);
-
-            expect(getStatus()).toBe(401);
-            expect(getBody()).toEqual({
-                error: {
-                    message: "Authorization header or token query parameter missing or invalid",
-                    code: "UNAUTHORIZED"
-                }
-            });
-            expect(nextFn).not.toHaveBeenCalled();
-        });
-
-        it("should return 401 for Authorization header without Bearer prefix", async () => {
-            const { c, getStatus } = createMockContext({ authHeader: "token-without-bearer" });
-
-            await requireAuth(c, nextFn);
-
-            expect(getStatus()).toBe(401);
-            expect(nextFn).not.toHaveBeenCalled();
-        });
-
-        it("should return 401 for invalid token", async () => {
-            const { c, getStatus, getBody } = createMockContext({ authHeader: "Bearer invalid-token" });
-
-            await requireAuth(c, nextFn);
-
-            expect(getStatus()).toBe(401);
-            expect(getBody()).toEqual({
-                error: {
-                    message: "Invalid or expired token",
-                    code: "UNAUTHORIZED"
-                }
-            });
-            expect(nextFn).not.toHaveBeenCalled();
-        });
-
-        it("should return 401 for token signed with different secret", async () => {
-            const token = generateAccessToken("user-123", ["admin"]);
-            configureJwt({ secret: "different-secret-that-is-at-least-32-chars-long" });
-            const { c, getStatus } = createMockContext({ authHeader: `Bearer ${token}` });
-
-            await requireAuth(c, nextFn);
-
-            expect(getStatus()).toBe(401);
-            expect(nextFn).not.toHaveBeenCalled();
-
-            // Reset to original secret
-            configureJwt({ secret: testSecret });
-        });
-
-        it("should handle lowercase bearer prefix", async () => {
-            const token = generateAccessToken("user-123", ["admin"]);
-            const { c, getStatus } = createMockContext({ authHeader: `bearer ${token}` });
-
-            await requireAuth(c, nextFn);
-
-            // The implementation requires "Bearer " with capital B
-            expect(getStatus()).toBe(401);
-            expect(nextFn).not.toHaveBeenCalled();
-        });
-
-        it("should accept token from query parameter", async () => {
-            const token = generateAccessToken("user-123", ["viewer"]);
-            const { c, getUser } = createMockContext({ queryToken: token });
-
-            await requireAuth(c, nextFn);
-
-            expect(nextFn).toHaveBeenCalled();
-            expect(getUser()).toEqual({
-                userId: "user-123",
-                roles: ["viewer"],
-                aal: "aal1"
-            });
-        });
-    });
-
-    describe("optionalAuth", () => {
-        it("should set user for valid token", async () => {
-            const token = generateAccessToken("user-456", ["viewer"]);
-            const { c, getUser } = createMockContext({ authHeader: `Bearer ${token}` });
-
-            await optionalAuth(c, nextFn);
-
-            expect(nextFn).toHaveBeenCalled();
-            expect(getUser()).toEqual({
-                userId: "user-456",
-                roles: ["viewer"],
-                aal: "aal1"
-            });
-        });
-
-        it("should call next() without setting user when no token provided", async () => {
-            const { c, getUser } = createMockContext();
-
-            await optionalAuth(c, nextFn);
-
-            expect(nextFn).toHaveBeenCalled();
-            expect(getUser()).toBeUndefined();
-        });
-
-        it("should call next() without setting user for invalid token", async () => {
-            const { c, getUser } = createMockContext({ authHeader: "Bearer invalid-token" });
-
-            await optionalAuth(c, nextFn);
-
-            expect(nextFn).toHaveBeenCalled();
-            expect(getUser()).toBeUndefined();
-        });
-
-        it("should call next() without setting user for non-Bearer auth", async () => {
-            const { c, getUser } = createMockContext({ authHeader: "Basic dXNlcjpwYXNz" });
-
-            await optionalAuth(c, nextFn);
-
-            expect(nextFn).toHaveBeenCalled();
-            expect(getUser()).toBeUndefined();
-        });
-    });
-
-    describe("requireAdmin", () => {
-        it("should return 401 if user is not authenticated", async () => {
-            const { c, getStatus, getBody } = createMockContext();
-
-            await requireAdmin(c, nextFn);
-
-            expect(getStatus()).toBe(401);
-            expect(getBody()).toEqual({
-                error: {
-                    message: "User not authenticated. requireAuth middleware is missing?",
-                    code: "UNAUTHORIZED"
-                }
-            });
-            expect(nextFn).not.toHaveBeenCalled();
-        });
-
-        it("should return 403 if user has no roles array", async () => {
-            const { c, getStatus } = createMockContext({ user: { userId: "user-123" } });
-
-            await requireAdmin(c, nextFn);
-
-            expect(getStatus()).toBe(403);
-            expect(nextFn).not.toHaveBeenCalled();
-        });
-
-        it("should return 403 if user has empty roles array", async () => {
-            const { c, getStatus } = createMockContext({ user: { userId: "user-123",
-roles: [] } });
-
-            await requireAdmin(c, nextFn);
-
-            expect(getStatus()).toBe(403);
-            expect(nextFn).not.toHaveBeenCalled();
-        });
-
-        it("should return 403 if user has standard roles (forbidden)", async () => {
-            const { c, getStatus } = createMockContext({ user: { userId: "user-123",
-roles: ["editor", "viewer"] } });
-
-            await requireAdmin(c, nextFn);
-
-            expect(getStatus()).toBe(403);
-            expect(nextFn).not.toHaveBeenCalled();
-        });
-
-        it("should allow access if user has 'admin' role", async () => {
-            const { c, getStatus } = createMockContext({ user: { userId: "user-123",
-roles: ["editor", "admin"] } });
-
-            await requireAdmin(c, nextFn);
-
-            expect(nextFn).toHaveBeenCalled();
-            expect(getStatus()).toBeUndefined(); // No error response
-        });
-
-        it("should allow access if user has 'schema-admin' role", async () => {
-            const { c } = createMockContext({ user: { userId: "user-123",
-roles: ["schema-admin"] } });
-
-            await requireAdmin(c, nextFn);
-
-            expect(nextFn).toHaveBeenCalled();
-        });
-
-        it("should block access for malformed spoofed string roles", async () => {
-            const { c, getStatus } = createMockContext({ user: { userId: "user-123",
-roles: ["schema-adminstration", "admins", "admin "] } });
-
-            await requireAdmin(c, nextFn);
-
-            expect(getStatus()).toBe(403);
-            expect(nextFn).not.toHaveBeenCalled();
-        });
-    });
-
-    describe("extractUserFromToken", () => {
-        it("should extract user from valid token", () => {
-            const token = generateAccessToken("ws-user-123", ["admin"]);
-            const payload = extractUserFromToken(token);
-
-            expect(payload).toEqual({
-                userId: "ws-user-123",
-                roles: ["admin"],
-                aal: "aal1"
-            });
-        });
-
-        it("should return null for invalid token", () => {
-            const payload = extractUserFromToken("invalid-token");
-            expect(payload).toBeNull();
-        });
-
-        it("should return null for empty token", () => {
-            const payload = extractUserFromToken("");
-            expect(payload).toBeNull();
-        });
-
-        it("should work with tokens having empty roles", () => {
-            const token = generateAccessToken("user-no-roles", []);
-            const payload = extractUserFromToken(token);
-
-            expect(payload).toEqual({
-                userId: "user-no-roles",
-                roles: [],
-                aal: "aal1"
-            });
-        });
-    });
-});

package/test/multi-datasource-routing.test.ts

@@ -1,113 +0,0 @@
-import { describe, it, expect, beforeAll } from "@jest/globals";
-import { Hono, Context } from "hono";
-import { configureJwt, generateAccessToken } from "../src/auth/jwt";
-import { createAuthMiddleware } from "../src/auth/middleware";
-import { createAdapterAuthMiddleware } from "../src/auth/adapter-middleware";
-import type { HonoEnv } from "../src/api/types";
-import type { DataDriver, AuthAdapter } from "@rebasepro/types";
-
-const TEST_SECRET = "test-secret-key-for-multi-datasource-routing-1234567890";
-
-// A mock driver that tags itself so we can assert which one was scoped into
-// the request context. The Postgres-like one implements withAuth (RLS), the
-// Mongo-like one does not (scopeDataDriver must no-op for it).
-function mockDriver(key: string, withRls: boolean): DataDriver {
-    const base: Record<string, unknown> = {
-        key,
-        fetchCollection: async () => [],
-        fetchEntity: async () => undefined,
-        saveEntity: async () => ({ id: "x", path: key, values: {} }),
-        deleteEntity: async () => undefined
-    };
-    if (withRls) {
-        // Returns a scoped clone that keeps the same key tag.
-        base.withAuth = async () => ({ ...base, scoped: true });
-    }
-    return base as unknown as DataDriver;
-}
-
-describe("Multi-data-source request routing (middleware)", () => {
-
-    beforeAll(() => {
-        configureJwt({ secret: TEST_SECRET, accessExpiresIn: "1h" });
-    });
-
-    const pg = mockDriver("postgres", true);
-    const mongo = mockDriver("mongodb", false);
-
-    // Route by first path segment: /products → pg, /events → mongo.
-    const resolveDriver = (c: Context<HonoEnv>): DataDriver => {
-        const slug = c.req.path.replace(/^\/+/, "").split("/")[0];
-        return slug === "events" ? mongo : pg;
-    };
-
-    function createApp() {
-        const app = new Hono<HonoEnv>();
-        app.use("/*", createAuthMiddleware({ driver: pg, resolveDriver, requireAuth: false }));
-        app.get("/:slug", (c: Context<HonoEnv>) => {
-            const driver = c.get("driver") as DataDriver | undefined;
-            return c.json({ key: driver?.key });
-        });
-        return app;
-    }
-
-    it("scopes the Postgres delegate for a Postgres collection path", async () => {
-        const token = generateAccessToken("u1", ["admin"]);
-        const res = await createApp().request("/products", { headers: { Authorization: `Bearer ${token}` } });
-        const body = await res.json() as { key: string };
-        expect(body.key).toBe("postgres");
-    });
-
-    it("scopes the Mongo delegate for a Mongo collection path", async () => {
-        const token = generateAccessToken("u1", ["admin"]);
-        const res = await createApp().request("/events", { headers: { Authorization: `Bearer ${token}` } });
-        const body = await res.json() as { key: string };
-        expect(body.key).toBe("mongodb");
-    });
-
-    it("routes per request based on the resolver, not a fixed driver", async () => {
-        const token = generateAccessToken("u1", ["admin"]);
-        const app = createApp();
-        const a = await (await app.request("/events", { headers: { Authorization: `Bearer ${token}` } })).json() as { key: string };
-        const b = await (await app.request("/products", { headers: { Authorization: `Bearer ${token}` } })).json() as { key: string };
-        expect(a.key).toBe("mongodb");
-        expect(b.key).toBe("postgres");
-    });
-
-    it("falls back to the base driver when no resolver is provided", async () => {
-        const app = new Hono<HonoEnv>();
-        app.use("/*", createAuthMiddleware({ driver: mongo, requireAuth: false }));
-        app.get("/:slug", (c: Context<HonoEnv>) => c.json({ key: (c.get("driver") as DataDriver | undefined)?.key }));
-        const res = await app.request("/anything");
-        const body = await res.json() as { key: string };
-        expect(body.key).toBe("mongodb");
-    });
-
-    it("routes a nested/subcollection path by its top-level segment", async () => {
-        const token = generateAccessToken("u1", ["admin"]);
-        const app = new Hono<HonoEnv>();
-        app.use("/*", createAuthMiddleware({ driver: pg, resolveDriver, requireAuth: false }));
-        app.get("/events/:id/attendees", (c: Context<HonoEnv>) =>
-            c.json({ key: (c.get("driver") as DataDriver | undefined)?.key }));
-        const res = await app.request("/events/e1/attendees", { headers: { Authorization: `Bearer ${token}` } });
-        const body = await res.json() as { key: string };
-        expect(body.key).toBe("mongodb");
-    });
-
-    it("routes per request through the adapter auth middleware too", async () => {
-        const adapter: AuthAdapter = {
-            id: "test-adapter",
-            serviceKey: undefined,
-            verifyRequest: async () => ({ uid: "u1", roles: ["admin"] })
-        } as unknown as AuthAdapter;
-
-        const app = new Hono<HonoEnv>();
-        app.use("/*", createAdapterAuthMiddleware({ adapter, driver: pg, resolveDriver, requireAuth: false }));
-        app.get("/:slug", (c: Context<HonoEnv>) => c.json({ key: (c.get("driver") as DataDriver | undefined)?.key }));
-
-        const a = await (await app.request("/events")).json() as { key: string };
-        const b = await (await app.request("/products")).json() as { key: string };
-        expect(a.key).toBe("mongodb");
-        expect(b.key).toBe("postgres");
-    });
-});