@reventlessdev/reventless-local 3.0.0-alpha.113

package/tests/adapter/LocalAuthHttpTest.res

@@ -0,0 +1,224 @@
+// Stage A4 — end-to-end test for the POST /__inmemory/login + /logout HTTP
+// endpoints. Boots a real DomainGraphQL_Server on a private port, posts
+// credentials with the global `fetch` (Node 22+), then stops the server.
+
+@@warning("-44")
+
+open JestGlobals
+
+let _ = TestRunner.setup()
+
+let port = 4321
+
+// ── Minimal node:http POST helper ──────────────────────────────────────────
+// Jest 27's VM context strips Node's global `fetch` (and undici needs more
+// polyfills than we want to maintain), so the test talks to the server via
+// `node:http` directly. Same wire format — the SPA still uses fetch.
+
+type httpRequestOptions = {
+  hostname: string,
+  port: int,
+  path: string,
+  method: string,
+  headers: dict<string>,
+}
+type httpReq
+type httpRes
+@module("node:http") external _request: (httpRequestOptions, httpRes => unit) => httpReq = "request"
+@send external _reqWrite: (httpReq, string) => unit = "write"
+@send external _reqEnd: (httpReq, @as(json`null`) _) => unit = "end"
+@send external _reqOnError: (httpReq, @as("error") _, 'err => unit) => unit = "on"
+@send external _resOnData: (httpRes, @as("data") _, 'chunk => unit) => unit = "on"
+@send external _resOnEnd: (httpRes, @as("end") _, unit => unit) => unit = "on"
+@send external _resSetEncoding: (httpRes, string) => unit = "setEncoding"
+@get external _resStatusCode: httpRes => int = "statusCode"
+
+let postJson = (path: string, body: dict<JSON.t>): promise<(int, JSON.t)> =>
+  Promise.make((resolve, reject) => {
+    let bodyStr = body->JSON.Encode.object->JSON.stringify
+    let req =
+      _request(
+        {
+          hostname: "localhost",
+          port,
+          path,
+          method: "POST",
+          headers: Dict.fromArray([
+            ("content-type", "application/json"),
+            ("content-length", bodyStr->String.length->Int.toString),
+          ]),
+        },
+        res => {
+          let status = _resStatusCode(res)
+          let buf = ref("")
+          res->_resSetEncoding("utf8")
+          res->_resOnData(chunk => buf := buf.contents ++ Obj.magic(chunk))
+          res->_resOnEnd(() => {
+            let parsed = try {
+              buf.contents->JSON.parseOrThrow
+            } catch {
+            | _ => JSON.Encode.null
+            }
+            resolve((status, parsed))
+          })
+        },
+      )
+    req->_reqOnError(err => reject(Obj.magic(err)))
+    req->_reqWrite(bodyStr)
+    req->_reqEnd
+  })
+
+let postEmpty = (path: string): promise<int> =>
+  Promise.make((resolve, reject) => {
+    let req =
+      _request(
+        {hostname: "localhost", port, path, method: "POST", headers: Dict.make()},
+        res => {
+          let status = _resStatusCode(res)
+          // Drain (otherwise the socket may stay open under HTTP keep-alive).
+          res->_resOnData(_ => ())
+          res->_resOnEnd(() => resolve(status))
+        },
+      )
+    req->_reqOnError(err => reject(Obj.magic(err)))
+    req->_reqEnd
+  })
+
+let postRaw = (path: string, body: string): promise<int> =>
+  Promise.make((resolve, reject) => {
+    let req =
+      _request(
+        {
+          hostname: "localhost",
+          port,
+          path,
+          method: "POST",
+          headers: Dict.fromArray([
+            ("content-type", "application/json"),
+            ("content-length", body->String.length->Int.toString),
+          ]),
+        },
+        res => {
+          let status = _resStatusCode(res)
+          res->_resOnData(_ => ())
+          res->_resOnEnd(() => resolve(status))
+        },
+      )
+    req->_reqOnError(err => reject(Obj.magic(err)))
+    req->_reqWrite(body)
+    req->_reqEnd
+  })
+
+let getJsonField = (j: JSON.t, k: string): option<JSON.t> =>
+  j->JSON.Decode.object->Option.flatMap(d => d->Dict.get(k))
+
+let getString = (j: JSON.t, k: string): string =>
+  getJsonField(j, k)->Option.flatMap(JSON.Decode.string)->Option.getOr("")
+
+// ── Lifecycle ──────────────────────────────────────────────────────────────
+
+beforeAllAsync(async () => {
+  LocalAuth.resetUsers()
+  LocalAuth.Login.resetStore()
+  LocalAuth.Login.setTokenSecret("http-test-secret")
+  LocalAuth.Login.setCredentials(
+    ~username="alice",
+    ~password="alice-pw",
+    ~identity={
+      userId: "u-alice",
+      username: "alice",
+      groups: ["Editor"],
+      provider: InMemory,
+    },
+  )
+  DomainGraphQL_Server.reset()
+  DomainGraphQL_Server.start(~port, ())
+  // Give the listener a tick to bind.
+  await Promise.make((resolve, _) => setTimeout(() => resolve(), 50)->ignore)
+})
+
+afterAll(() => {
+  DomainGraphQL_Server.stop()
+})
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+testPromise("POST /__inmemory/login returns {token, identity} for valid credentials", async () => {
+  let (status, body) =
+    await postJson(
+      "/__inmemory/login",
+      Dict.fromArray([
+        ("username", JSON.Encode.string("alice")),
+        ("password", JSON.Encode.string("alice-pw")),
+      ]),
+    )
+  expect(status)->toEqual(200)
+  let token = getString(body, "token")
+  expect(token->String.length > 0)->toEqual(true)
+  expect(token->String.includes("."))->toEqual(true)
+  // The echoed identity matches what LocalAuth.lookupUser returns.
+  switch getJsonField(body, "identity") {
+  | Some(idJson) =>
+    let id = idJson->S.parseJsonOrThrow(Reventless.Identity.schema)
+    expect(id.username)->toEqual("alice")
+    expect(id.groups)->toEqual(["Editor"])
+  | None => JsError.throwWithMessage("response missing identity field")
+  }
+})
+
+testPromise("POST /__inmemory/login returns 401 for wrong password", async () => {
+  let (status, body) =
+    await postJson(
+      "/__inmemory/login",
+      Dict.fromArray([
+        ("username", JSON.Encode.string("alice")),
+        ("password", JSON.Encode.string("WRONG")),
+      ]),
+    )
+  expect(status)->toEqual(401)
+  expect(getString(body, "error")->String.length > 0)->toEqual(true)
+})
+
+testPromise("POST /__inmemory/login returns 401 for missing user", async () => {
+  let (status, _) =
+    await postJson(
+      "/__inmemory/login",
+      Dict.fromArray([
+        ("username", JSON.Encode.string("ghost")),
+        ("password", JSON.Encode.string("x")),
+      ]),
+    )
+  expect(status)->toEqual(401)
+})
+
+testPromise("POST /__inmemory/login returns 401 for malformed JSON body", async () => {
+  let status = await postRaw("/__inmemory/login", "not-json")
+  expect(status)->toEqual(401)
+})
+
+testPromise("POST /__inmemory/logout always returns 204", async () => {
+  let status = await postEmpty("/__inmemory/logout")
+  expect(status)->toEqual(204)
+})
+
+testPromise("Bearer token issued via HTTP round-trips through authenticate", async () => {
+  let (_, body) =
+    await postJson(
+      "/__inmemory/login",
+      Dict.fromArray([
+        ("username", JSON.Encode.string("alice")),
+        ("password", JSON.Encode.string("alice-pw")),
+      ]),
+    )
+  let token = getString(body, "token")
+  let result =
+    await LocalAuth.authenticate({
+      headers: Dict.fromArray([("authorization", "Bearer " ++ token)]),
+    })
+  switch result {
+  | Authenticated(identity) =>
+    expect(identity.username)->toEqual("alice")
+    expect(identity.groups)->toEqual(["Editor"])
+  | _ => JsError.throwWithMessage("expected Authenticated(alice) from issued token")
+  }
+})

package/tests/adapter/LocalAuthHttpTest.res.mjs

@@ -0,0 +1,237 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Nodehttp from "node:http";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
+import * as TestRunner$ReventlessLocal from "../../src/test/TestRunner.res.mjs";
+import * as DomainGraphQL_Server$ReventlessLocal from "../../src/adapter/DomainGraphQL_Server.res.mjs";
+
+TestRunner$ReventlessLocal.setup();
+
+function postJson(path, body) {
+  return new Promise((resolve, reject) => {
+    let bodyStr = JSON.stringify(body);
+    let req = Nodehttp.request({
+      hostname: "localhost",
+      port: 4321,
+      path: path,
+      method: "POST",
+      headers: Object.fromEntries([
+        [
+          "content-type",
+          "application/json"
+        ],
+        [
+          "content-length",
+          bodyStr.length.toString()
+        ]
+      ])
+    }, res => {
+      let status = res.statusCode;
+      let buf = {
+        contents: ""
+      };
+      res.setEncoding("utf8");
+      res.on("data", chunk => {
+        buf.contents = buf.contents + chunk;
+      });
+      res.on("end", () => {
+        let parsed;
+        try {
+          parsed = JSON.parse(buf.contents);
+        } catch (exn) {
+          parsed = null;
+        }
+        resolve([
+          status,
+          parsed
+        ]);
+      });
+    });
+    req.on("error", err => reject(err));
+    req.write(bodyStr);
+    req.end(null);
+  });
+}
+
+function postEmpty(path) {
+  return new Promise((resolve, reject) => {
+    let req = Nodehttp.request({
+      hostname: "localhost",
+      port: 4321,
+      path: path,
+      method: "POST",
+      headers: {}
+    }, res => {
+      let status = res.statusCode;
+      res.on("data", param => {});
+      res.on("end", () => resolve(status));
+    });
+    req.on("error", err => reject(err));
+    req.end(null);
+  });
+}
+
+function postRaw(path, body) {
+  return new Promise((resolve, reject) => {
+    let req = Nodehttp.request({
+      hostname: "localhost",
+      port: 4321,
+      path: path,
+      method: "POST",
+      headers: Object.fromEntries([
+        [
+          "content-type",
+          "application/json"
+        ],
+        [
+          "content-length",
+          body.length.toString()
+        ]
+      ])
+    }, res => {
+      let status = res.statusCode;
+      res.on("data", param => {});
+      res.on("end", () => resolve(status));
+    });
+    req.on("error", err => reject(err));
+    req.write(body);
+    req.end(null);
+  });
+}
+
+function getJsonField(j, k) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(j), d => d[k]);
+}
+
+function getString(j, k) {
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(getJsonField(j, k), Stdlib_JSON.Decode.string), "");
+}
+
+globalThis.beforeAll(async () => {
+  LocalAuth$ReventlessLocal.resetUsers();
+  LocalAuth$ReventlessLocal.Login.resetStore();
+  LocalAuth$ReventlessLocal.Login.setTokenSecret("http-test-secret");
+  LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", {
+    userId: "u-alice",
+    username: "alice",
+    groups: ["Editor"],
+    provider: "InMemory"
+  });
+  DomainGraphQL_Server$ReventlessLocal.reset();
+  DomainGraphQL_Server$ReventlessLocal.start(4321, undefined, undefined);
+  return await new Promise((resolve, param) => {
+    setTimeout(() => resolve(), 50);
+  });
+});
+
+globalThis.afterAll(() => DomainGraphQL_Server$ReventlessLocal.stop());
+
+globalThis.test("POST /__inmemory/login returns {token, identity} for valid credentials", async () => {
+  let match = await postJson("/__inmemory/login", Object.fromEntries([
+    [
+      "username",
+      "alice"
+    ],
+    [
+      "password",
+      "alice-pw"
+    ]
+  ]));
+  let body = match[1];
+  globalThis.expect(match[0]).toEqual(200);
+  let token = getString(body, "token");
+  globalThis.expect(token.length > 0).toEqual(true);
+  globalThis.expect(token.includes(".")).toEqual(true);
+  let idJson = getJsonField(body, "identity");
+  if (idJson === undefined) {
+    return Stdlib_JsError.throwWithMessage("response missing identity field");
+  }
+  let id = S.parseJsonOrThrow(idJson, Identity$Reventless.schema);
+  globalThis.expect(id.username).toEqual("alice");
+  globalThis.expect(id.groups).toEqual(["Editor"]);
+});
+
+globalThis.test("POST /__inmemory/login returns 401 for wrong password", async () => {
+  let match = await postJson("/__inmemory/login", Object.fromEntries([
+    [
+      "username",
+      "alice"
+    ],
+    [
+      "password",
+      "WRONG"
+    ]
+  ]));
+  globalThis.expect(match[0]).toEqual(401);
+  globalThis.expect(getString(match[1], "error").length > 0).toEqual(true);
+});
+
+globalThis.test("POST /__inmemory/login returns 401 for missing user", async () => {
+  let match = await postJson("/__inmemory/login", Object.fromEntries([
+    [
+      "username",
+      "ghost"
+    ],
+    [
+      "password",
+      "x"
+    ]
+  ]));
+  globalThis.expect(match[0]).toEqual(401);
+});
+
+globalThis.test("POST /__inmemory/login returns 401 for malformed JSON body", async () => {
+  let status = await postRaw("/__inmemory/login", "not-json");
+  globalThis.expect(status).toEqual(401);
+});
+
+globalThis.test("POST /__inmemory/logout always returns 204", async () => {
+  let status = await postEmpty("/__inmemory/logout");
+  globalThis.expect(status).toEqual(204);
+});
+
+globalThis.test("Bearer token issued via HTTP round-trips through authenticate", async () => {
+  let match = await postJson("/__inmemory/login", Object.fromEntries([
+    [
+      "username",
+      "alice"
+    ],
+    [
+      "password",
+      "alice-pw"
+    ]
+  ]));
+  let token = getString(match[1], "token");
+  let result = await LocalAuth$ReventlessLocal.authenticate({
+    headers: Object.fromEntries([[
+        "authorization",
+        "Bearer " + token
+      ]])
+  });
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated(alice) from issued token");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected Authenticated(alice) from issued token");
+  }
+  let identity = result._0;
+  globalThis.expect(identity.username).toEqual("alice");
+  globalThis.expect(identity.groups).toEqual(["Editor"]);
+});
+
+let port = 4321;
+
+export {
+  port,
+  postJson,
+  postEmpty,
+  postRaw,
+  getJsonField,
+  getString,
+}
+/*  Not a pure module */

package/tests/adapter/LocalAuthLoginTest.res

@@ -0,0 +1,180 @@
+// Stage A4 — LocalAuth.Login (token issuance) + Bearer-token recognition
+// in LocalAuth.authenticate.
+
+@@warning("-44")
+
+open JestGlobals
+
+let alice: Reventless.Identity.t = {
+  userId: "u-alice",
+  username: "alice",
+  groups: ["Editor"],
+  provider: InMemory,
+}
+
+let bob: Reventless.Identity.t = {
+  userId: "u-bob",
+  username: "bob",
+  groups: ["Viewer"],
+  provider: InMemory,
+}
+
+let buildContext = (headers: array<(string, string)>): ReventlessCore.Auth_Adapter.requestContext => {
+  headers: Dict.fromArray(headers),
+}
+
+let resetAll = () => {
+  LocalAuth.resetUsers()
+  LocalAuth.Login.resetStore()
+  LocalAuth.Login.setTokenSecret("test-secret-deterministic")
+}
+
+testPromise("issue returns Ok(token) for valid credentials", async () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="alice", ~password="alice-pw", ~identity=alice)
+  let result = await LocalAuth.Login.issue(~username="alice", ~password="alice-pw")
+  switch result {
+  | Ok(token) =>
+    // Token shape: <base64url-payload>.<base64url-sig>
+    let parts = token->String.split(".")
+    expect(parts->Array.length)->toEqual(2)
+  | Error(msg) => JsError.throwWithMessage("unexpected Error: " ++ msg)
+  }
+})
+
+testPromise("issue returns Error for unknown username", async () => {
+  resetAll()
+  let result = await LocalAuth.Login.issue(~username="ghost", ~password="x")
+  switch result {
+  | Error(_) => ()
+  | Ok(_) => JsError.throwWithMessage("expected Error")
+  }
+})
+
+testPromise("issue returns Error for wrong password", async () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="alice", ~password="alice-pw", ~identity=alice)
+  let result = await LocalAuth.Login.issue(~username="alice", ~password="WRONG")
+  switch result {
+  | Error(_) => ()
+  | Ok(_) => JsError.throwWithMessage("expected Error")
+  }
+})
+
+testPromise("verifyAndDecode round-trips the identity for a fresh token", async () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="alice", ~password="alice-pw", ~identity=alice)
+  let token = switch await LocalAuth.Login.issue(~username="alice", ~password="alice-pw") {
+  | Ok(t) => t
+  | Error(msg) => JsError.throwWithMessage("issue failed: " ++ msg)
+  }
+  switch LocalAuth.Login.verifyAndDecode(token) {
+  | Some(identity) =>
+    expect(identity.username)->toEqual("alice")
+    expect(identity.groups)->toEqual(["Editor"])
+    expect(identity.userId)->toEqual("u-alice")
+  | None => JsError.throwWithMessage("verifyAndDecode returned None")
+  }
+})
+
+testPromise("verifyAndDecode rejects a tampered payload", async () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="alice", ~password="alice-pw", ~identity=alice)
+  let token = switch await LocalAuth.Login.issue(~username="alice", ~password="alice-pw") {
+  | Ok(t) => t
+  | Error(msg) => JsError.throwWithMessage("issue failed: " ++ msg)
+  }
+  // Flip the first character of the payload — signature should no longer verify.
+  let parts = token->String.split(".")
+  let payload = parts->Array.getUnsafe(0)
+  let sig = parts->Array.getUnsafe(1)
+  let firstChar = payload->String.charAt(0)
+  let replacement = firstChar == "A" ? "B" : "A"
+  let tamperedPayload = replacement ++ payload->String.slice(~start=1, ~end=payload->String.length)
+  let tampered = `${tamperedPayload}.${sig}`
+  switch LocalAuth.Login.verifyAndDecode(tampered) {
+  | None => ()
+  | Some(_) => JsError.throwWithMessage("expected verifyAndDecode to reject tampered payload")
+  }
+})
+
+testPromise("verifyAndDecode rejects a tampered signature", async () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="alice", ~password="alice-pw", ~identity=alice)
+  let token = switch await LocalAuth.Login.issue(~username="alice", ~password="alice-pw") {
+  | Ok(t) => t
+  | Error(msg) => JsError.throwWithMessage("issue failed: " ++ msg)
+  }
+  // Append a junk char to the signature.
+  switch LocalAuth.Login.verifyAndDecode(token ++ "x") {
+  | None => ()
+  | Some(_) => JsError.throwWithMessage("expected verifyAndDecode to reject tampered signature")
+  }
+})
+
+testPromise("verifyAndDecode rejects a malformed token (no dot)", async () => {
+  resetAll()
+  switch LocalAuth.Login.verifyAndDecode("not-a-real-token") {
+  | None => ()
+  | Some(_) => JsError.throwWithMessage("expected None for malformed token")
+  }
+})
+
+testPromise("authenticate accepts a valid Bearer token", async () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="bob", ~password="bob-pw", ~identity=bob)
+  let token = switch await LocalAuth.Login.issue(~username="bob", ~password="bob-pw") {
+  | Ok(t) => t
+  | Error(msg) => JsError.throwWithMessage("issue failed: " ++ msg)
+  }
+  let result = await LocalAuth.authenticate(
+    buildContext([("authorization", "Bearer " ++ token)]),
+  )
+  switch result {
+  | Authenticated(identity) =>
+    expect(identity.username)->toEqual("bob")
+    expect(identity.groups)->toEqual(["Viewer"])
+  | _ => JsError.throwWithMessage("expected Authenticated(bob)")
+  }
+})
+
+testPromise("authenticate rejects invalid Bearer even when X-User is present", async () => {
+  resetAll()
+  // A present-but-unverifiable Bearer must reject with AuthError so the
+  // host-shell `on401` logout path fires. X-User is ignored.
+  let result = await LocalAuth.authenticate(
+    buildContext([("authorization", "Bearer not-a-token"), ("x-user", "admin")]),
+  )
+  switch result {
+  | AuthError(_) => ()
+  | _ => JsError.throwWithMessage("expected AuthError for invalid Bearer")
+  }
+})
+
+testPromise("Bearer outranks X-User when both present and Bearer is valid", async () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="bob", ~password="bob-pw", ~identity=bob)
+  let token = switch await LocalAuth.Login.issue(~username="bob", ~password="bob-pw") {
+  | Ok(t) => t
+  | Error(msg) => JsError.throwWithMessage("issue failed: " ++ msg)
+  }
+  let result = await LocalAuth.authenticate(
+    buildContext([("authorization", "Bearer " ++ token), ("x-user", "admin")]),
+  )
+  switch result {
+  | Authenticated(identity) => expect(identity.username)->toEqual("bob")
+  | _ => JsError.throwWithMessage("expected Bearer to outrank X-User")
+  }
+})
+
+testPromise("setCredentials mirrors identity into the X-User registry", async () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="alice", ~password="alice-pw", ~identity=alice)
+  let result = await LocalAuth.authenticate(buildContext([("x-user", "alice")]))
+  switch result {
+  | Authenticated(identity) =>
+    expect(identity.userId)->toEqual("u-alice")
+    expect(identity.groups)->toEqual(["Editor"])
+  | _ => JsError.throwWithMessage("expected Authenticated(alice) via X-User")
+  }
+})