@rebasepro/server-core 0.7.0 → 0.9.0

package/test/password.test.ts

@@ -1,165 +0,0 @@
-import {
-    validatePasswordStrength,
-    hashPassword,
-    verifyPassword
-} from "../src/auth/password";
-
-describe("Password Utilities", () => {
-    describe("validatePasswordStrength", () => {
-        it("should accept a valid password", () => {
-            const result = validatePasswordStrength("ValidPass123");
-            expect(result.valid).toBe(true);
-            expect(result.errors).toHaveLength(0);
-        });
-
-        it("should reject password shorter than 8 characters", () => {
-            const result = validatePasswordStrength("Short1A");
-            expect(result.valid).toBe(false);
-            expect(result.errors).toContain("Password must be at least 8 characters long");
-        });
-
-        it("should reject password without uppercase letter", () => {
-            const result = validatePasswordStrength("lowercase123");
-            expect(result.valid).toBe(false);
-            expect(result.errors).toContain("Password must contain at least one uppercase letter");
-        });
-
-        it("should reject password without lowercase letter", () => {
-            const result = validatePasswordStrength("UPPERCASE123");
-            expect(result.valid).toBe(false);
-            expect(result.errors).toContain("Password must contain at least one lowercase letter");
-        });
-
-        it("should reject password without number", () => {
-            const result = validatePasswordStrength("NoNumbersHere");
-            expect(result.valid).toBe(false);
-            expect(result.errors).toContain("Password must contain at least one number");
-        });
-
-        it("should return multiple errors for multiple violations", () => {
-            const result = validatePasswordStrength("short");
-            expect(result.valid).toBe(false);
-            expect(result.errors.length).toBeGreaterThan(1);
-        });
-
-        it("should accept password with special characters", () => {
-            const result = validatePasswordStrength("Valid@Pass#123!");
-            expect(result.valid).toBe(true);
-        });
-
-        it("should accept password at exactly 8 characters", () => {
-            const result = validatePasswordStrength("Abcdefg1");
-            expect(result.valid).toBe(true);
-        });
-    });
-
-    describe("hashPassword", () => {
-        it("should return a hash in salt:hash format", async () => {
-            const hash = await hashPassword("TestPassword123");
-            expect(hash).toContain(":");
-            const [salt, hashValue] = hash.split(":");
-            expect(salt).toBeTruthy();
-            expect(hashValue).toBeTruthy();
-        });
-
-        it("should generate different hashes for the same password (due to random salt)", async () => {
-            const hash1 = await hashPassword("SamePassword123");
-            const hash2 = await hashPassword("SamePassword123");
-            expect(hash1).not.toBe(hash2);
-        });
-
-        it("should generate a 32-byte salt (64 hex chars)", async () => {
-            const hash = await hashPassword("TestPassword123");
-            const [salt] = hash.split(":");
-            expect(salt).toHaveLength(64);
-        });
-
-        it("should generate a 64-byte key (128 hex chars)", async () => {
-            const hash = await hashPassword("TestPassword123");
-            const [, hashValue] = hash.split(":");
-            expect(hashValue).toHaveLength(128);
-        });
-    });
-
-    describe("verifyPassword", () => {
-        it("should verify a correct password", async () => {
-            const password = "CorrectPassword123";
-            const hash = await hashPassword(password);
-            const isValid = await verifyPassword(password, hash);
-            expect(isValid).toBe(true);
-        });
-
-        it("should reject an incorrect password", async () => {
-            const hash = await hashPassword("CorrectPassword123");
-            const isValid = await verifyPassword("WrongPassword123", hash);
-            expect(isValid).toBe(false);
-        });
-
-        it("should return false for malformed hash (no colon)", async () => {
-            const isValid = await verifyPassword("AnyPassword", "malformedhash");
-            expect(isValid).toBe(false);
-        });
-
-        it("should return false for empty hash parts", async () => {
-            const isValid = await verifyPassword("AnyPassword", ":");
-            expect(isValid).toBe(false);
-        });
-
-        it("should be case-sensitive", async () => {
-            const hash = await hashPassword("CaseSensitive123");
-            const isValid = await verifyPassword("casesensitive123", hash);
-            expect(isValid).toBe(false);
-        });
-
-        it("should handle empty password", async () => {
-            const hash = await hashPassword("");
-            const isValid = await verifyPassword("", hash);
-            expect(isValid).toBe(true);
-        });
-
-        it("should handle unicode characters", async () => {
-            const password = "Pässwörd123日本語";
-            const hash = await hashPassword(password);
-            const isValid = await verifyPassword(password, hash);
-            expect(isValid).toBe(true);
-        });
-
-        it("should handle very long passwords", async () => {
-            const password = "A".repeat(1000) + "bcdefg1";
-            const hash = await hashPassword(password);
-            const isValid = await verifyPassword(password, hash);
-            expect(isValid).toBe(true);
-        });
-    });
-
-    describe("timing-safe comparison", () => {
-        // This test verifies that timing attacks are mitigated
-        // by checking that verification time is relatively constant
-        it("should take similar time for correct and incorrect passwords", async () => {
-            const password = "TestPassword123";
-            const hash = await hashPassword(password);
-
-            // Run multiple iterations to average out noise
-            const iterations = 10;
-
-            // Time correct password
-            const correctStart = Date.now();
-            for (let i = 0; i < iterations; i++) {
-                await verifyPassword(password, hash);
-            }
-            const correctTime = Date.now() - correctStart;
-
-            // Time incorrect password (same length)
-            const incorrectStart = Date.now();
-            for (let i = 0; i < iterations; i++) {
-                await verifyPassword("WrongPassword12", hash);
-            }
-            const incorrectTime = Date.now() - incorrectStart;
-
-            // Times should be within 50% of each other
-            // (allowing for system variance)
-            const ratio = Math.abs(correctTime - incorrectTime) / Math.max(correctTime, incorrectTime);
-            expect(ratio).toBeLessThan(0.5);
-        });
-    });
-});

package/test/query-parser.test.ts

@@ -1,233 +0,0 @@
-import { mapOperator, parseQueryOptions } from "../src/api/rest/query-parser";
-
-// ─────────────────────────────────────────────────────────────
-// mapOperator
-// ─────────────────────────────────────────────────────────────
-describe("mapOperator", () => {
-    it("maps PostgREST operators to Rebase operators", () => {
-        expect(mapOperator("eq")).toBe("==");
-        expect(mapOperator("neq")).toBe("!=");
-        expect(mapOperator("gt")).toBe(">");
-        expect(mapOperator("gte")).toBe(">=");
-        expect(mapOperator("lt")).toBe("<");
-        expect(mapOperator("lte")).toBe("<=");
-        expect(mapOperator("in")).toBe("in");
-        expect(mapOperator("nin")).toBe("not-in");
-        expect(mapOperator("cs")).toBe("array-contains");
-        expect(mapOperator("csa")).toBe("array-contains-any");
-    });
-
-    it("returns null for unknown operators", () => {
-        expect(mapOperator("like")).toBeNull();
-        expect(mapOperator("between")).toBeNull();
-        expect(mapOperator("")).toBeNull();
-    });
-});
-
-// ─────────────────────────────────────────────────────────────
-// parseQueryOptions — Pagination
-// ─────────────────────────────────────────────────────────────
-describe("parseQueryOptions — pagination", () => {
-    it("parses limit", () => {
-        const result = parseQueryOptions({ limit: "25" });
-        expect(result.limit).toBe(25);
-    });
-
-    it("parses offset", () => {
-        const result = parseQueryOptions({ offset: "50" });
-        expect(result.offset).toBe(50);
-    });
-
-    it("calculates offset from page number", () => {
-        const result = parseQueryOptions({ page: "3",
-limit: "10" });
-        expect(result.offset).toBe(20); // (3-1) * 10
-    });
-
-    it("uses default limit of 20 for page calculation when limit not set", () => {
-        const result = parseQueryOptions({ page: "2" });
-        expect(result.offset).toBe(20); // (2-1) * 20
-    });
-
-    it("handles no pagination params", () => {
-        const result = parseQueryOptions({});
-        expect(result.limit).toBeUndefined();
-        expect(result.offset).toBeUndefined();
-    });
-});
-
-// ─────────────────────────────────────────────────────────────
-// parseQueryOptions — PostgREST Filters
-// ─────────────────────────────────────────────────────────────
-describe("parseQueryOptions — PostgREST filters", () => {
-    it("parses equality filter (implicit eq)", () => {
-        const result = parseQueryOptions({ status: "published" });
-        expect(result.where?.status).toEqual(["==", "published"]);
-    });
-
-    it("parses eq operator explicitly", () => {
-        const result = parseQueryOptions({ status: "eq.published" });
-        expect(result.where?.status).toEqual(["==", "published"]);
-    });
-
-    it("parses gt with number coercion", () => {
-        const result = parseQueryOptions({ age: "gt.18" });
-        expect(result.where?.age).toEqual([">", 18]);
-    });
-
-    it("parses gte operator", () => {
-        const result = parseQueryOptions({ price: "gte.9.99" });
-        expect(result.where?.price).toEqual([">=", 9.99]);
-    });
-
-    it("parses lt operator", () => {
-        const result = parseQueryOptions({ count: "lt.100" });
-        expect(result.where?.count).toEqual(["<", 100]);
-    });
-
-    it("parses lte operator", () => {
-        const result = parseQueryOptions({ rating: "lte.5" });
-        expect(result.where?.rating).toEqual(["<=", 5]);
-    });
-
-    it("parses neq operator", () => {
-        const result = parseQueryOptions({ status: "neq.draft" });
-        expect(result.where?.status).toEqual(["!=", "draft"]);
-    });
-
-    it("parses boolean true", () => {
-        const result = parseQueryOptions({ active: "true" });
-        expect(result.where?.active).toEqual(["==", true]);
-    });
-
-    it("parses boolean false", () => {
-        const result = parseQueryOptions({ active: "false" });
-        expect(result.where?.active).toEqual(["==", false]);
-    });
-
-    it("parses null", () => {
-        const result = parseQueryOptions({ deleted_at: "null" });
-        expect(result.where?.deleted_at).toEqual(["==", null]);
-    });
-
-    it("parses numeric strings as numbers", () => {
-        const result = parseQueryOptions({ quantity: "42" });
-        expect(result.where?.quantity).toEqual(["==", 42]);
-    });
-
-    it("parses in operator with array", () => {
-        const result = parseQueryOptions({ role: "in.(admin,editor,viewer)" });
-        expect(result.where?.role).toEqual(["in", ["admin", "editor", "viewer"]]);
-    });
-
-    it("parses in operator with numeric array", () => {
-        const result = parseQueryOptions({ priority: "in.(1,2,3)" });
-        expect(result.where?.priority).toEqual(["in", [1, 2, 3]]);
-    });
-
-    it("parses array-contains operator", () => {
-        const result = parseQueryOptions({ tags: "cs.javascript" });
-        expect(result.where?.tags).toEqual(["array-contains", "javascript"]);
-    });
-
-    it("skips reserved query keys", () => {
-        const result = parseQueryOptions({
-            limit: "10",
-            offset: "0",
-            orderBy: "name:asc",
-            status: "eq.active"
-        });
-        // Only status should be in where
-        expect(result.where?.status).toEqual(["==", "active"]);
-        expect(result.where?.limit).toBeUndefined();
-        expect(result.where?.offset).toBeUndefined();
-        expect(result.where?.orderBy).toBeUndefined();
-    });
-
-    it("handles string values with dots that are not operators (fallback to eq)", () => {
-        const result = parseQueryOptions({ email: "user@example.com" });
-        // "user@example" is not a valid operator, so fallback to eq
-        expect(result.where?.email).toBeDefined();
-    });
-
-    it("removes empty where object", () => {
-        const result = parseQueryOptions({ limit: "10" });
-        expect(result.where).toBeUndefined();
-    });
-});
-
-
-// ─────────────────────────────────────────────────────────────
-// parseQueryOptions — Sorting
-// ─────────────────────────────────────────────────────────────
-describe("parseQueryOptions — sorting", () => {
-    it("parses JSON orderBy", () => {
-        const orderBy = JSON.stringify([{ field: "name",
-direction: "asc" }]);
-        const result = parseQueryOptions({ orderBy });
-        expect(result.orderBy).toEqual([{ field: "name",
-direction: "asc" }]);
-    });
-
-    it("parses simple field:direction format", () => {
-        const result = parseQueryOptions({ orderBy: "created_at:desc" });
-        expect(result.orderBy).toEqual([{ field: "created_at",
-direction: "desc" }]);
-    });
-
-    it("defaults direction to asc", () => {
-        const result = parseQueryOptions({ orderBy: "name" });
-        expect(result.orderBy).toEqual([{ field: "name",
-direction: "asc" }]);
-    });
-
-    it("handles no orderBy", () => {
-        const result = parseQueryOptions({});
-        expect(result.orderBy).toBeUndefined();
-    });
-});
-
-// ─────────────────────────────────────────────────────────────
-// parseQueryOptions — Relation includes
-// ─────────────────────────────────────────────────────────────
-describe("parseQueryOptions — includes", () => {
-    it("parses wildcard include", () => {
-        const result = parseQueryOptions({ include: "*" });
-        expect(result.include).toEqual(["*"]);
-    });
-
-    it("parses comma-separated includes", () => {
-        const result = parseQueryOptions({ include: "author,tags,category" });
-        expect(result.include).toEqual(["author", "tags", "category"]);
-    });
-
-    it("trims whitespace in includes", () => {
-        const result = parseQueryOptions({ include: " author , tags " });
-        expect(result.include).toEqual(["author", "tags"]);
-    });
-
-    it("handles no include", () => {
-        const result = parseQueryOptions({});
-        expect(result.include).toBeUndefined();
-    });
-});
-
-// ─────────────────────────────────────────────────────────────
-// parseQueryOptions — Field selection
-// ─────────────────────────────────────────────────────────────
-describe("parseQueryOptions — fields", () => {
-    it("parses comma-separated fields", () => {
-        const result = parseQueryOptions({ fields: "id,name,email" });
-        expect(result.fields).toEqual(["id", "name", "email"]);
-    });
-
-    it("trims whitespace", () => {
-        const result = parseQueryOptions({ fields: " id , name " });
-        expect(result.fields).toEqual(["id", "name"]);
-    });
-
-    it("handles no fields", () => {
-        const result = parseQueryOptions({});
-        expect(result.fields).toBeUndefined();
-    });
-});

package/test/rate-limiter.test.ts

@@ -1,102 +0,0 @@
-import { createRateLimiter } from "../src/auth/rate-limiter";
-import { Hono } from "hono";
-import { HonoEnv } from "../src/api/types";
-
-describe("Rate Limiter", () => {
-
-    function createTestApp(options: { windowMs?: number; limit?: number } = {}) {
-        const app = new Hono<HonoEnv>();
-        const limiter = createRateLimiter({
-            windowMs: options.windowMs ?? 60 * 1000, // 1 minute
-            limit: options.limit ?? 3,
-            keyGenerator: (c) => c.req.header("x-forwarded-for") || "test-ip"
-        });
-        app.use("/api/*", limiter);
-        app.get("/api/test", (c) => c.json({ ok: true }));
-        return app;
-    }
-
-    it("allows requests under the limit", async () => {
-        const app = createTestApp({ limit: 5 });
-
-        const res = await app.request("/api/test", {
-            headers: { "x-forwarded-for": "1.2.3.4" }
-        });
-
-        expect(res.status).toBe(200);
-        expect(res.headers.get("X-RateLimit-Limit")).toBe("5");
-        expect(res.headers.get("X-RateLimit-Remaining")).toBe("4");
-    });
-
-    it("returns 429 when limit is exceeded", async () => {
-        const app = createTestApp({ limit: 2 });
-
-        // First two should pass
-        await app.request("/api/test", { headers: { "x-forwarded-for": "10.0.0.1" } });
-        await app.request("/api/test", { headers: { "x-forwarded-for": "10.0.0.1" } });
-
-        // Third should be rate limited
-        const res = await app.request("/api/test", {
-            headers: { "x-forwarded-for": "10.0.0.1" }
-        });
-
-        expect(res.status).toBe(429);
-        const body = await res.json() as any;
-        expect(body.error.code).toBe("RATE_LIMITED");
-    });
-
-    it("includes Retry-After header when rate limited", async () => {
-        const app = createTestApp({ limit: 1 });
-
-        await app.request("/api/test", { headers: { "x-forwarded-for": "10.0.0.2" } });
-        const res = await app.request("/api/test", {
-            headers: { "x-forwarded-for": "10.0.0.2" }
-        });
-
-        expect(res.headers.get("Retry-After")).toBeDefined();
-        expect(res.headers.get("X-RateLimit-Remaining")).toBe("0");
-    });
-
-    it("tracks different IPs separately", async () => {
-        const app = createTestApp({ limit: 1 });
-
-        const res1 = await app.request("/api/test", {
-            headers: { "x-forwarded-for": "ip-a" }
-        });
-        const res2 = await app.request("/api/test", {
-            headers: { "x-forwarded-for": "ip-b" }
-        });
-
-        expect(res1.status).toBe(200);
-        expect(res2.status).toBe(200);
-    });
-
-    it("decrements remaining count with each request", async () => {
-        const app = createTestApp({ limit: 3 });
-        const ip = "counter-ip";
-
-        const r1 = await app.request("/api/test", { headers: { "x-forwarded-for": ip } });
-        expect(r1.headers.get("X-RateLimit-Remaining")).toBe("2");
-
-        const r2 = await app.request("/api/test", { headers: { "x-forwarded-for": ip } });
-        expect(r2.headers.get("X-RateLimit-Remaining")).toBe("1");
-
-        const r3 = await app.request("/api/test", { headers: { "x-forwarded-for": ip } });
-        expect(r3.headers.get("X-RateLimit-Remaining")).toBe("0");
-    });
-
-    it("uses custom message", async () => {
-        const app = new Hono<HonoEnv>();
-        const limiter = createRateLimiter({
-            limit: 0,
-            message: "Slow down!",
-            keyGenerator: () => "always-same"
-        });
-        app.use("/api/*", limiter);
-        app.get("/api/test", (c) => c.json({ ok: true }));
-
-        const res = await app.request("/api/test");
-        const body = await res.json() as any;
-        expect(body.error.message).toBe("Slow down!");
-    });
-});

package/test/reset-password-admin.test.ts

@@ -1,113 +0,0 @@
-import { Hono } from "hono";
-import { createResetPasswordRoute } from "../src/auth/reset-password-admin";
-import type { AuthRepository } from "../src/auth/interfaces";
-import { configureJwt, generateAccessToken } from "../src/auth/jwt";
-import { errorHandler } from "../src/api/errors";
-
-const TEST_SECRET = "integration-test-secret-key-that-is-definitely-32-chars-long!!";
-
-describe("createResetPasswordRoute & onAdminResetPassword", () => {
-    let mockAuthRepo: jest.Mocked<AuthRepository>;
-    let mockEmailService: { send: jest.Mock; isConfigured: jest.Mock };
-
-    beforeAll(() => {
-        configureJwt({ secret: TEST_SECRET,
-accessExpiresIn: "1h" });
-    });
-
-    beforeEach(() => {
-        mockAuthRepo = {
-            getUserById: jest.fn(),
-            getUserRoleIds: jest.fn().mockResolvedValue(["admin"]),
-            updatePassword: jest.fn().mockResolvedValue(undefined),
-            createPasswordResetToken: jest.fn().mockResolvedValue(undefined)
-        } as unknown as jest.Mocked<AuthRepository>;
-
-        mockEmailService = {
-            send: jest.fn().mockResolvedValue(undefined),
-            isConfigured: jest.fn().mockReturnValue(true)
-        };
-    });
-
-    function createApp(authHooks?: any) {
-        const app = new Hono();
-        app.onError(errorHandler);
-        const adminRoutes = createResetPasswordRoute({
-            authRepo: mockAuthRepo,
-            emailService: mockEmailService as any,
-            emailConfig: {
-                from: "test@example.com",
-                resetPasswordUrl: "https://reset.com"
-            },
-            authHooks
-        });
-        app.route("/api/admin", adminRoutes);
-        return app;
-    }
-
-    it("falls back to default password reset logic when no hook is provided", async () => {
-        mockAuthRepo.getUserById.mockResolvedValue({
-            id: "user-123",
-            email: "user@example.com",
-            displayName: "User One"
-        } as any);
-
-        const app = createApp();
-        const adminToken = generateAccessToken("admin-user", ["admin"]);
-
-        const res = await app.request("/api/admin/users/user-123/reset-password", {
-            method: "POST",
-            headers: {
-                "Authorization": `Bearer ${adminToken}`
-            }
-        });
-
-        expect(res.status).toBe(200);
-        const body = await res.json() as any;
-        expect(body.invitationSent).toBe(true);
-        expect(body.user.uid).toBe("user-123");
-        expect(mockAuthRepo.createPasswordResetToken).toHaveBeenCalled();
-        expect(mockEmailService.send).toHaveBeenCalled();
-    });
-
-    it("calls onAdminResetPassword hook when provided", async () => {
-        mockAuthRepo.getUserById.mockResolvedValue({
-            id: "user-123",
-            email: "user@example.com",
-            displayName: "User One"
-        } as any);
-
-        const onAdminResetPasswordMock = jest.fn().mockResolvedValue({
-            temporaryPassword: "hook-temp-password",
-            invitationSent: false
-        });
-
-        const app = createApp({
-            onAdminResetPassword: onAdminResetPasswordMock
-        });
-        const adminToken = generateAccessToken("admin-user", ["admin"]);
-
-        const res = await app.request("/api/admin/users/user-123/reset-password", {
-            method: "POST",
-            headers: {
-                "Authorization": `Bearer ${adminToken}`
-            }
-        });
-
-        expect(res.status).toBe(200);
-        const body = await res.json() as any;
-        expect(body.invitationSent).toBe(false);
-        expect(body.temporaryPassword).toBe("hook-temp-password");
-        expect(body.user.uid).toBe("user-123");
-
-        expect(onAdminResetPasswordMock).toHaveBeenCalledWith(
-            "user-123",
-            expect.objectContaining({
-                authRepo: mockAuthRepo,
-                emailService: mockEmailService
-            })
-        );
-        expect(mockAuthRepo.createPasswordResetToken).not.toHaveBeenCalled();
-        expect(mockEmailService.send).not.toHaveBeenCalled();
-    });
-});