@rebasepro/server-postgresql 0.1.0 → 0.2.1

package/src/websocket.ts

@@ -1,6 +1,6 @@
 import { RealtimeService } from "./services/realtimeService";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
-import { DataDriver, DeleteEntityProps, FetchCollectionProps, FetchEntityProps, SaveEntityProps, TableMetadata, BranchInfo, isSQLAdmin, isSchemaAdmin } from "@rebasepro/types";
+import { DataDriver, DeleteEntityProps, FetchCollectionProps, FetchEntityProps, SaveEntityProps, TableMetadata, BranchInfo, isSQLAdmin, isSchemaAdmin, AuthAdapter } from "@rebasepro/types";
 import { WebSocketServer, WebSocket } from "ws";
 import { Server } from "http";
 import { inspect } from "util";
@@ -9,9 +9,18 @@ import { extractUserFromToken, AccessTokenPayload } from "@rebasepro/server-core
 // @ts-ignore
 import { AuthConfig } from "@rebasepro/server-core";
 
+/**
+ * Normalized user identity for WebSocket sessions.
+ */
+interface WsUserIdentity {
+    userId: string;
+    roles: string[];
+    isAdmin: boolean;
+}
+
 interface ClientSession {
     ws: WebSocket;
-    user?: AccessTokenPayload;
+    user?: WsUserIdentity;
     authenticated: boolean;
     /** Sliding window message counter for rate limiting */
     messageCount: number;
@@ -38,11 +47,31 @@ const ADMIN_ONLY_TYPES = new Set([
     "LIST_BRANCHES"
 ]);
 
+/**
+ * Recursively extract the deepest error message from an error's cause chain (e.g., Drizzle wrapping a PG error).
+ */
+function extractErrorMessage(error: unknown): string {
+    if (!error) return "Unknown error";
+    if (typeof error === "object") {
+        const err = error as Record<string, unknown> & { cause?: unknown; message?: string };
+        if (err.cause) {
+            return extractErrorMessage(err.cause);
+        }
+        if (typeof err.message === "string") {
+            return err.message;
+        }
+    }
+    return String(error);
+}
+
 /**
  * Check if the current session belongs to an admin user.
  */
 function isAdminSession(session: ClientSession | undefined): boolean {
-    if (!session?.user?.roles) return false;
+    if (!session?.user) return false;
+    // Fast path: new adapter-aware sessions set isAdmin directly
+    if (session.user.isAdmin) return true;
+    if (!session.user.roles) return false;
     return session.user.roles.some((r: unknown) => {
         if (typeof r === "string") return r === "admin";
         if (r && typeof r === "object" && "isAdmin" in r) return (r as { isAdmin: boolean }).isAdmin;
@@ -55,7 +84,8 @@ export function createPostgresWebSocket(
     server: Server,
     realtimeService: RealtimeService,
     driver: PostgresBackendDriver,
-    authConfig?: AuthConfig
+    authConfig?: AuthConfig,
+    authAdapter?: AuthAdapter
 ) {
     const isProduction = process.env.NODE_ENV === "production";
     /** Debug logger that is suppressed in production to prevent PII/data leaks */
@@ -74,7 +104,11 @@ export function createPostgresWebSocket(
         console.error("❌ [WebSocket Server] Error:", err);
     });
 
-    const requireAuth = authConfig?.requireAuth !== false && authConfig?.jwtSecret;
+    // Auth is required when either: an adapter is present (secure by default),
+    // OR the config has a jwtSecret and requireAuth !== false.
+    const requireAuth = authAdapter
+        ? true
+        : (authConfig?.requireAuth !== false && !!authConfig?.jwtSecret);
 
     wss.on("connection", (ws) => {
         const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
@@ -123,21 +157,53 @@ code } }
                         return;
                     }
 
-                    const user = extractUserFromToken(token);
-                    if (user) {
+                    // Use the auth adapter when available (custom auth, Clerk, etc.)
+                    // Fall back to JWT extraction otherwise.
+                    let verifiedUser: WsUserIdentity | null = null;
+
+                    if (authAdapter) {
+                        try {
+                            const adapterUser = authAdapter.verifyToken
+                                ? await authAdapter.verifyToken(token)
+                                : await authAdapter.verifyRequest(new Request("http://localhost/_ws_auth", {
+                                    headers: { Authorization: `Bearer ${token}` },
+                                }));
+
+                            if (adapterUser) {
+                                verifiedUser = {
+                                    userId: adapterUser.uid,
+                                    roles: adapterUser.roles,
+                                    isAdmin: adapterUser.isAdmin,
+                                };
+                            }
+                        } catch {
+                            // Adapter threw — treat as invalid token
+                        }
+                    } else {
+                        // Standard JWT path
+                        const jwtPayload = extractUserFromToken(token);
+                        if (jwtPayload) {
+                            verifiedUser = {
+                                userId: jwtPayload.userId,
+                                roles: jwtPayload.roles ?? [],
+                                isAdmin: (jwtPayload.roles ?? []).some((r: string) => r === "admin"),
+                            };
+                        }
+                    }
+
+                    if (verifiedUser) {
                         const session = clientSessions.get(clientId);
                         if (session) {
-                            session.user = user;
+                            session.user = verifiedUser;
                             session.authenticated = true;
                         }
                         wsDebug(`[WS] replying AUTH_SUCCESS for requestId ${requestId}`);
                         ws.send(JSON.stringify({
                             type: "AUTH_SUCCESS",
                             requestId,
-                            payload: { userId: user.userId,
-roles: user.roles }
+                            payload: { userId: verifiedUser.userId, roles: verifiedUser.roles }
                         }));
-                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${user.userId}`);
+                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.userId}`);
                     } else {
                         wsDebug(`[WS] replying AUTH_ERROR for requestId ${requestId} (invalid token)`);
                         sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
@@ -183,17 +249,21 @@ roles: user.roles }
                 // Helper to get correctly scoped delegate for the current request
                 const getScopedDelegate = async (): Promise<DataDriver> => {
                     const session = clientSessions.get(clientId);
-                    if (session?.user && "withAuth" in driver && typeof (driver as unknown as Record<string, unknown>).withAuth === "function") {
+                    if ("withAuth" in driver && typeof (driver as unknown as Record<string, unknown>).withAuth === "function") {
                         try {
-                            // Map AccessTokenPayload back to User interface for withAuth (roles are already string IDs from JWT)
-                            const userForAuth: Record<string, unknown> = {
-                                uid: session.user.userId,
-                                roles: session.user.roles ?? []
-                            };
+                            const userForAuth = session?.user
+                                ? {
+                                    uid: session.user.userId,
+                                    roles: session.user.roles ?? []
+                                }
+                                : {
+                                    uid: "anon",
+                                    roles: ["anon"]
+                                };
                             return await (driver as unknown as { withAuth: (user: Record<string, unknown>) => Promise<DataDriver> }).withAuth(userForAuth);
                         } catch (e) {
-                            console.error("Failed to create authenticated delegate for WS request", e);
-                            return driver;
+                            console.error("Failed to create RLS scoped delegate for WS request", e);
+                            throw new Error("Internal authentication error");
                         }
                     }
                     return driver;
@@ -306,22 +376,29 @@ colors: true }));
 
                     case "EXECUTE_SQL": {
                         const { sql, options } = payload;
-                        const delegate = await getScopedDelegate();
-                        const admin = delegate.admin;
-                        if (!isSQLAdmin(admin)) {
-                            sendError("ERROR", "NOT_SUPPORTED", "SQL execution is not available for this driver.");
-                            break;
-                        }
-                        const result = await admin.executeSql(sql, options);
-                        if (process.env.NODE_ENV !== "production") {
-                            wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
+                        try {
+                            const delegate = await getScopedDelegate();
+                            const admin = delegate.admin;
+                            if (!isSQLAdmin(admin)) {
+                                sendError("ERROR", "NOT_SUPPORTED", "SQL execution is not available for this driver.");
+                                break;
+                            }
+                            const result = await admin.executeSql(sql, options);
+                            if (process.env.NODE_ENV !== "production") {
+                                wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
+                            }
+                            const response = {
+                                type: "EXECUTE_SQL_SUCCESS",
+                                payload: { result },
+                                requestId
+                            };
+                            ws.send(JSON.stringify(response));
+                        } catch (sqlError: unknown) {
+                            // This is a query execution error (e.g., syntax error, permission denied).
+                            // We return it cleanly to the client without logging a server stack trace.
+                            const errMsg = extractErrorMessage(sqlError);
+                            sendError("ERROR", "SQL_ERROR", errMsg);
                         }
-                        const response = {
-                            type: "EXECUTE_SQL_SUCCESS",
-                            payload: { result },
-                            requestId
-                        };
-                        ws.send(JSON.stringify(response));
                     }
                         break;
 
@@ -478,9 +555,8 @@ colors: true }));
                         // Attach auth context from the WS session so RLS-aware refetches work
                         const session = clientSessions.get(clientId);
                         const authContext = session?.user
-                            ? { userId: session.user.userId,
-roles: session.user.roles ?? [] }
-                            : undefined;
+                            ? { userId: session.user.userId, roles: session.user.roles ?? [] }
+                            : { userId: "anon", roles: ["anon"] };
                         // Let RealtimeService handle these messages
                         await realtimeService.handleClientMessage(clientId, {
                             type,

package/test/auth-services.test.ts

@@ -1,19 +1,45 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { UserService, RoleService, RefreshTokenService, PasswordResetTokenService, Role } from "../src/auth/services";
-import { users, refreshTokens, passwordResetTokens, User } from "../src/schema/auth-schema";
+import { users, refreshTokens, passwordResetTokens } from "../src/schema/auth-schema";
+import { UserData } from "@rebasepro/server-core";
 
 // Mock the drizzle-orm functions
-jest.mock("drizzle-orm", () => ({
-    eq: jest.fn((field, value) => ({ field,
-value,
-type: "eq" })),
-    sql: jest.fn((strings: TemplateStringsArray, ...values: unknown[]) => ({
-        strings,
-        values,
-        type: "sql"
-    })),
-    relations: jest.fn(() => ({}))
-}));
+jest.mock("drizzle-orm", () => {
+    const actual = jest.requireActual("drizzle-orm");
+    return {
+        ...actual,
+        eq: jest.fn((field, value) => ({ field, value, type: "eq" })),
+        sql: Object.assign(
+            jest.fn((strings: TemplateStringsArray, ...values: unknown[]) => ({
+                strings,
+                values,
+                type: "sql"
+            })),
+            {
+                raw: jest.fn((val: string) => ({ val, type: "sql-raw" })),
+                join: jest.fn((parts: unknown[], separator: unknown) => ({ parts, separator, type: "sql-join" }))
+            }
+        ),
+        relations: jest.fn(() => ({}))
+    };
+});
+
+function mockUserData(overrides: Partial<UserData>): UserData {
+    return {
+        id: "user-123",
+        email: "test@example.com",
+        passwordHash: null,
+        displayName: null,
+        photoUrl: null,
+        emailVerified: false,
+        emailVerificationToken: null,
+        emailVerificationSentAt: null,
+        createdAt: expect.any(Date),
+        updatedAt: expect.any(Date),
+        metadata: {},
+        ...overrides
+    };
+}
 
 describe("Auth Services", () => {
     let db: jest.Mocked<NodePgDatabase<Record<string, unknown>>>;
@@ -37,9 +63,7 @@ describe("Auth Services", () => {
         });
 
         mockSelectWhere = jest.fn().mockResolvedValue([]);
-        mockSelectFrom = jest.fn().mockReturnValue({
-            where: mockSelectWhere
-        });
+        mockSelectFrom = jest.fn();
 
         mockUpdateReturning = jest.fn().mockResolvedValue([]);
         mockUpdateWhere = jest.fn().mockReturnValue({ returning: mockUpdateReturning });
@@ -49,13 +73,50 @@ describe("Auth Services", () => {
 
         mockExecute = jest.fn().mockResolvedValue({ rows: [] });
 
+        // Set up chainable mock for db.select()
+        const mockChain: any = {};
+        mockChain.from = jest.fn().mockImplementation((...args) => {
+            const result = mockSelectFrom(...args);
+            if (result && typeof result.then === "function") {
+                return result; // If listUsers mocks selectFrom to return a promise, return it directly
+            }
+            return mockChain;
+        });
+        mockChain.innerJoin = jest.fn().mockReturnValue(mockChain);
+        mockChain.where = jest.fn().mockImplementation((...args) => {
+            mockChain.wherePromise = mockSelectWhere(...args);
+            return mockChain;
+        });
+        mockChain.limit = jest.fn().mockReturnValue(mockChain);
+        mockChain.offset = jest.fn().mockReturnValue(mockChain);
+        mockChain.orderBy = jest.fn().mockReturnValue(mockChain);
+        mockChain.then = jest.fn().mockImplementation(async (onFulfilled) => {
+            let val;
+            if (mockChain.wherePromise) {
+                val = await mockChain.wherePromise;
+                mockChain.wherePromise = null;
+            } else if (mockSelectWhere.mock.calls.length > 0) {
+                const result = mockSelectWhere.mock.results[mockSelectWhere.mock.results.length - 1];
+                val = result.type === "return" ? result.value : undefined;
+                if (val && typeof val.then === "function") {
+                    val = await val;
+                }
+            } else {
+                val = [];
+            }
+            return onFulfilled(val || []);
+        });
+
         db = {
             insert: jest.fn().mockReturnValue({ values: mockInsertValues }),
-            select: jest.fn().mockReturnValue({ from: mockSelectFrom }),
+            select: jest.fn().mockReturnValue(mockChain),
             update: jest.fn().mockReturnValue({ set: mockUpdateSet }),
             delete: jest.fn().mockReturnValue({ where: mockDeleteWhere }),
             execute: mockExecute
         } as unknown as jest.Mocked<NodePgDatabase<Record<string, unknown>>>;
+
+        // Set default return value for mockSelectFrom to return mockChain (chainable)
+        mockSelectFrom.mockReturnValue(mockChain);
     });
 
     describe("UserService", () => {
@@ -71,30 +132,34 @@ describe("Auth Services", () => {
                     email: "test@example.com",
                     displayName: "Test User"
                 };
-                const createdUser = { id: "user-123",
-...newUser,
-createdAt: new Date(),
-updatedAt: new Date() };
-                mockInsertReturning.mockResolvedValueOnce([createdUser]);
+                const dbReturnedUser = { 
+                    id: "user-123",
+                    ...newUser,
+                    createdAt: new Date(),
+                    updatedAt: new Date() 
+                };
+                mockInsertReturning.mockResolvedValueOnce([dbReturnedUser]);
 
                 const result = await userService.createUser(newUser);
 
                 expect(db.insert).toHaveBeenCalledWith(users);
-                expect(mockInsertValues).toHaveBeenCalledWith(newUser);
-                expect(result).toEqual(createdUser);
+                expect(mockInsertValues).toHaveBeenCalledWith({
+                    ...newUser,
+                    metadata: {}
+                });
+                expect(result).toEqual(mockUserData({ displayName: "Test User" }));
             });
         });
 
         describe("getUserById", () => {
             it("should return user when found", async () => {
-                const mockUser = { id: "user-123",
-email: "test@example.com" };
+                const mockUser = { id: "user-123", email: "test@example.com" };
                 mockSelectWhere.mockResolvedValueOnce([mockUser]);
 
                 const result = await userService.getUserById("user-123");
 
                 expect(db.select).toHaveBeenCalled();
-                expect(result).toEqual(mockUser);
+                expect(result).toEqual(mockUserData({}));
             });
 
             it("should return null when user not found", async () => {
@@ -108,13 +173,12 @@ email: "test@example.com" };
 
         describe("getUserByEmail", () => {
             it("should return user when found by email", async () => {
-                const mockUser = { id: "user-123",
-email: "test@example.com" };
+                const mockUser = { id: "user-123", email: "test@example.com" };
                 mockSelectWhere.mockResolvedValueOnce([mockUser]);
 
                 const result = await userService.getUserByEmail("test@example.com");
 
-                expect(result).toEqual(mockUser);
+                expect(result).toEqual(mockUserData({}));
             });
 
             it("should lowercase email for lookup", async () => {
@@ -128,14 +192,14 @@ email: "test@example.com" };
         });
 
         describe("getUserByIdentity", () => {
-            it("should execute sql for identity lookup", async () => {
-                const mockUser = { id: "user-123" };
-                // execute mock instead of select
-                mockExecute.mockResolvedValueOnce({ rows: [mockUser] });
+            it("should fetch user by identity", async () => {
+                const mockUser = { id: "user-123", email: "test@example.com" };
+                mockSelectWhere.mockResolvedValueOnce([{ user: mockUser }]);
 
                 const result = await userService.getUserByIdentity("google", "google-abc");
 
-                expect(mockExecute).toHaveBeenCalled();
+                expect(db.select).toHaveBeenCalled();
+                expect(result).toEqual(expect.objectContaining({ id: "user-123", email: "test@example.com" }));
             });
         });
 
@@ -158,9 +222,11 @@ email: "test@example.com" };
 
         describe("updateUser", () => {
             it("should update user and return updated record", async () => {
-                const updatedUser = { id: "user-123",
-email: "test@example.com",
-displayName: "Updated Name" };
+                const updatedUser = { 
+                    id: "user-123",
+                    email: "test@example.com",
+                    displayName: "Updated Name" 
+                };
                 mockUpdateReturning.mockResolvedValueOnce([updatedUser]);
 
                 const result = await userService.updateUser("user-123", { displayName: "Updated Name" });
@@ -170,7 +236,7 @@ displayName: "Updated Name" };
                     displayName: "Updated Name",
                     updatedAt: expect.any(Date)
                 }));
-                expect(result).toEqual(updatedUser);
+                expect(result).toEqual(mockUserData({ displayName: "Updated Name" }));
             });
 
             it("should return null when user not found", async () => {
@@ -194,17 +260,18 @@ displayName: "Updated Name" };
         describe("listUsers", () => {
             it("should return all users", async () => {
                 const mockUsers = [
-                    { id: "user-1",
-email: "user1@example.com" },
-                    { id: "user-2",
-email: "user2@example.com" }
+                    { id: "user-1", email: "user1@example.com" },
+                    { id: "user-2", email: "user2@example.com" }
                 ];
                 mockSelectFrom.mockReturnValueOnce(Promise.resolve(mockUsers));
 
                 const result = await userService.listUsers();
 
                 expect(db.select).toHaveBeenCalled();
-                expect(result).toEqual(mockUsers);
+                expect(result).toEqual([
+                    mockUserData({ id: "user-1", email: "user1@example.com" }),
+                    mockUserData({ id: "user-2", email: "user2@example.com" })
+                ]);
             });
         });
 
@@ -264,13 +331,12 @@ email: "user2@example.com" }
 
         describe("getUserByVerificationToken", () => {
             it("should find user by verification token", async () => {
-                const mockUser = { id: "user-123",
-email: "test@example.com" };
+                const mockUser = { id: "user-123", email: "test@example.com" };
                 mockSelectWhere.mockResolvedValueOnce([mockUser]);
 
                 const result = await userService.getUserByVerificationToken("token-abc");
 
-                expect(result).toEqual(mockUser);
+                expect(result).toEqual(mockUserData({}));
             });
         });
 
@@ -279,17 +345,17 @@ email: "test@example.com" };
                 mockExecute.mockResolvedValueOnce({
                     rows: [
                         { id: "admin",
-name: "Admin",
-is_admin: true,
-default_permissions: null,
-collection_permissions: null,
-config: null },
+                            name: "Admin",
+                            is_admin: true,
+                            default_permissions: null,
+                            collection_permissions: null,
+                            config: null },
                         { id: "editor",
-name: "Editor",
-is_admin: false,
-default_permissions: { edit: true },
-collection_permissions: null,
-config: null }
+                            name: "Editor",
+                            is_admin: false,
+                            default_permissions: { edit: true },
+                            collection_permissions: null,
+                            config: null }
                     ]
                 });
 
@@ -312,11 +378,11 @@ config: null }
                 mockExecute.mockResolvedValueOnce({
                     rows: [
                         { id: "admin",
-name: "Admin",
-is_admin: true,
-default_permissions: null,
-collection_permissions: null,
-config: null }
+                            name: "Admin",
+                            is_admin: true,
+                            default_permissions: null,
+                            collection_permissions: null,
+                            config: null }
                     ]
                 });
 
@@ -353,28 +419,27 @@ config: null }
 
         describe("getUserWithRoles", () => {
             it("should return user with roles", async () => {
-                const mockUser = { id: "user-123",
-email: "test@example.com" };
+                const mockUser = { id: "user-123", email: "test@example.com" };
                 mockSelectWhere.mockResolvedValueOnce([mockUser]);
                 mockExecute.mockResolvedValueOnce({
                     rows: [{ id: "admin",
-name: "Admin",
-is_admin: true,
-default_permissions: null,
-collection_permissions: null,
-config: null }]
+                        name: "Admin",
+                        is_admin: true,
+                        default_permissions: null,
+                        collection_permissions: null,
+                        config: null }]
                 });
 
                 const result = await userService.getUserWithRoles("user-123");
 
                 expect(result).toEqual({
-                    user: mockUser,
+                    user: mockUserData({}),
                     roles: [{ id: "admin",
-name: "Admin",
-isAdmin: true,
-defaultPermissions: null,
-collectionPermissions: null,
-config: null }]
+                        name: "Admin",
+                        isAdmin: true,
+                        defaultPermissions: null,
+                        collectionPermissions: null,
+                        config: null }]
                 });
             });
 
@@ -386,6 +451,30 @@ config: null }]
                 expect(result).toBeNull();
             });
         });
+
+        describe("listUsersPaginated", () => {
+            it("should return paginated and filtered users list", async () => {
+                mockExecute
+                    .mockResolvedValueOnce({ rows: [{ total: 1 }] })
+                    .mockResolvedValueOnce({ rows: [{ id: "user-123", email: "test@example.com" }] });
+
+                const result = await userService.listUsersPaginated({
+                    limit: 10,
+                    offset: 0,
+                    search: "test",
+                    orderBy: "email",
+                    orderDir: "asc"
+                });
+
+                expect(mockExecute).toHaveBeenCalledTimes(2);
+                expect(result).toEqual({
+                    users: [mockUserData({ id: "user-123", email: "test@example.com" })],
+                    total: 1,
+                    limit: 10,
+                    offset: 0
+                });
+            });
+        });
     });
 
     describe("RoleService", () => {

package/test/data-transformer-hardening.test.ts

@@ -415,3 +415,60 @@ describe("structural dunder guard", () => {
         expect(dunderKeys).toEqual([]);
     });
 });
+
+// ─────────────────────────────────────────────────────────────
+// parsePropertyFromServer — vector parsing
+// ─────────────────────────────────────────────────────────────
+describe("parsePropertyFromServer vector parsing", () => {
+    const targetCollection = makeCollection("items", {
+        embedding: {
+            type: "vector",
+            dimensions: 3,
+            name: "Embedding"
+        } as unknown as Property
+    });
+
+    it("parses string representation '[0.1,-0.2,3.14]' from postgres into wrapped vector", () => {
+        const property = targetCollection.properties.embedding as Property;
+        const result = parsePropertyFromServer("[0.1,-0.2,3.14]", property, targetCollection, "embedding");
+        expect(result).toEqual({
+            __type: "Vector",
+            value: [0.1, -0.2, 3.14]
+        });
+    });
+
+    it("parses numeric array [0.1,-0.2,3.14] into wrapped vector", () => {
+        const property = targetCollection.properties.embedding as Property;
+        const result = parsePropertyFromServer([0.1, -0.2, 3.14], property, targetCollection, "embedding");
+        expect(result).toEqual({
+            __type: "Vector",
+            value: [0.1, -0.2, 3.14]
+        });
+    });
+});
+
+// ─────────────────────────────────────────────────────────────
+// parsePropertyFromServer — binary parsing
+// ─────────────────────────────────────────────────────────────
+describe("parsePropertyFromServer binary parsing", () => {
+    const targetCollection = makeCollection("items", {
+        data: {
+            type: "binary",
+            name: "Data"
+        } as unknown as Property
+    });
+
+    it("parses database Buffer into a base64 data URL string", () => {
+        const property = targetCollection.properties.data as Property;
+        const buffer = Buffer.from("hello");
+        const result = parsePropertyFromServer(buffer, property, targetCollection, "data");
+        expect(result).toBe("data:application/octet-stream;base64,aGVsbG8=");
+    });
+
+    it("parses Buffer object (JSON serialization) into a base64 data URL string", () => {
+        const property = targetCollection.properties.data as Property;
+        const bufferObj = { type: "Buffer", data: Array.from(Buffer.from("hello")) };
+        const result = parsePropertyFromServer(bufferObj, property, targetCollection, "data");
+        expect(result).toBe("data:application/octet-stream;base64,aGVsbG8=");
+    });
+});