@robodev-ai/runtime 0.1.0

package/src/local-auth.test.ts

@@ -0,0 +1,412 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { handleLocalAuth, isLocalAuthPath, resolveLocalUser } from "./local-auth.js";
+import type { AuthQueryable } from "./auth-core.js";
+
+type UserRow = {
+  id: string;
+  email: string;
+  password_hash: string | null;
+  name: string | null;
+  google_subject: string | null;
+};
+type RefreshRow = { id: string; user_id: string; token_hash: string; expires_at: Date };
+type NonceRow = {
+  id: string;
+  user_id: string;
+  code: string;
+  type: string;
+  expires_at: Date;
+  used_at: Date | null;
+};
+
+/** In-memory stand-in for the `robodev_auth` schema, matching the SQL `auth-core` emits. */
+class MemoryAuthDb implements AuthQueryable {
+  users: UserRow[] = [];
+  refresh: RefreshRow[] = [];
+  nonces: NonceRow[] = [];
+
+  async query<T extends Record<string, unknown> = Record<string, unknown>>(
+    sql: string,
+    params: unknown[] = [],
+  ): Promise<{ rows: T[] }> {
+    const s = sql.replace(/\s+/g, " ").trim();
+    const rows = (value: unknown[]) => ({ rows: value as T[] });
+
+    if (/^(CREATE SCHEMA|CREATE TABLE|ALTER TABLE)/.test(s)) return rows([]);
+
+    if (s.includes("FROM robodev_auth.users WHERE email")) {
+      const row = this.users.find((user) => user.email === params[0]);
+      return rows(row ? [row] : []);
+    }
+    if (s.includes("FROM robodev_auth.users WHERE id")) {
+      const row = this.users.find((user) => user.id === params[0]);
+      return rows(row ? [row] : []);
+    }
+    if (s.startsWith("INSERT INTO robodev_auth.users")) {
+      this.users.push({
+        id: String(params[0]),
+        email: String(params[1]),
+        password_hash: (params[2] as string | null) ?? null,
+        name: (params[3] as string | null) ?? null,
+        google_subject: null,
+      });
+      return rows([]);
+    }
+    if (s.includes("UPDATE robodev_auth.users SET name = $1, email = $2")) {
+      const user = this.users.find((row) => row.id === params[2]);
+      if (user) {
+        user.name = params[0] as string | null;
+        user.email = String(params[1]);
+      }
+      return rows([]);
+    }
+    if (s.includes("UPDATE robodev_auth.users SET password_hash")) {
+      const user = this.users.find((row) => row.id === params[1]);
+      if (user) user.password_hash = String(params[0]);
+      return rows([]);
+    }
+    if (s.startsWith("INSERT INTO robodev_auth.refresh_tokens")) {
+      this.refresh.push({
+        id: String(params[0]),
+        user_id: String(params[1]),
+        token_hash: String(params[2]),
+        expires_at: new Date(String(params[3])),
+      });
+      return rows([]);
+    }
+    if (s.includes("FROM robodev_auth.refresh_tokens r")) {
+      const row = this.refresh.find((item) => item.token_hash === params[0]);
+      const user = row ? this.users.find((item) => item.id === row.user_id) : undefined;
+      if (!row || !user) return rows([]);
+      return rows([
+        {
+          id: row.id,
+          user_id: row.user_id,
+          expires_at: row.expires_at,
+          email: user.email,
+          name: user.name,
+          password_hash: user.password_hash,
+          google_subject: user.google_subject,
+        },
+      ]);
+    }
+    if (s.includes("DELETE FROM robodev_auth.refresh_tokens WHERE id")) {
+      this.refresh = this.refresh.filter((row) => row.id !== params[0]);
+      return rows([]);
+    }
+    if (s.includes("DELETE FROM robodev_auth.refresh_tokens WHERE token_hash")) {
+      this.refresh = this.refresh.filter((row) => row.token_hash !== params[0]);
+      return rows([]);
+    }
+    if (s.startsWith("INSERT INTO robodev_auth.authn_nonces")) {
+      this.nonces.push({
+        id: String(params[0]),
+        user_id: String(params[1]),
+        code: String(params[2]),
+        type: String(params[3]),
+        expires_at: new Date(String(params[4])),
+        used_at: null,
+      });
+      return rows([]);
+    }
+    if (s.includes("FROM robodev_auth.authn_nonces WHERE code")) {
+      const row = this.nonces.find((item) => item.code === params[0]);
+      return rows(row ? [row] : []);
+    }
+    if (s.includes("UPDATE robodev_auth.authn_nonces SET used_at")) {
+      const row = this.nonces.find((item) => item.id === params[0]);
+      if (row) row.used_at = new Date();
+      return rows([]);
+    }
+    throw new Error(`unhandled sql: ${s}`);
+  }
+}
+
+type Delivered = { to: string; type: string; code: string };
+
+function setup() {
+  const db = new MemoryAuthDb();
+  const delivered: Delivered[] = [];
+  const options = {
+    db,
+    projectId: "prj-local",
+    jwtSecret: "test-secret",
+    deliverCode: (input: Delivered) => delivered.push(input),
+  };
+  return { db, delivered, options };
+}
+
+const PASSWORD = "a-long-enough-password";
+
+async function register(options: ReturnType<typeof setup>["options"], email = "a@b.com") {
+  return handleLocalAuth(
+    {
+      method: "POST",
+      pathname: "/api/user/auth/register",
+      body: { email, password: PASSWORD, name: "A" },
+    },
+    options,
+  );
+}
+
+test("isLocalAuthPath covers the reserved Auth surface only", () => {
+  assert.equal(isLocalAuthPath("/api/user"), true);
+  assert.equal(isLocalAuthPath("/api/user/me"), true);
+  assert.equal(isLocalAuthPath("/api/user/auth/login"), true);
+  assert.equal(isLocalAuthPath("/api/planets"), false);
+  assert.equal(isLocalAuthPath("/api/users"), false);
+});
+
+test("register issues a token pair and rejects a duplicate email", async () => {
+  const { options } = setup();
+  const created = await register(options);
+  assert.equal(created.status, 201);
+  assert.ok(created.body.accessToken);
+  assert.ok(created.body.refreshToken);
+
+  const again = await register(options);
+  assert.equal(again.status, 409);
+  assert.equal(again.body.code, "identity-already-exists");
+});
+
+test("register rejects a short password without touching the database", async () => {
+  const { db, options } = setup();
+  const result = await handleLocalAuth(
+    {
+      method: "POST",
+      pathname: "/api/user/auth/register",
+      body: { email: "a@b.com", password: "short" },
+    },
+    options,
+  );
+  assert.equal(result.status, 400);
+  assert.equal(result.body.code, "invalid-request");
+  assert.equal(db.users.length, 0);
+});
+
+test("login accepts the right password and rejects the wrong one", async () => {
+  const { options } = setup();
+  await register(options);
+
+  const ok = await handleLocalAuth(
+    {
+      method: "POST",
+      pathname: "/api/user/auth/login",
+      body: { email: "a@b.com", password: PASSWORD },
+    },
+    options,
+  );
+  assert.equal(ok.status, 200);
+  assert.ok(ok.body.accessToken);
+
+  const bad = await handleLocalAuth(
+    {
+      method: "POST",
+      pathname: "/api/user/auth/login",
+      body: { email: "a@b.com", password: "nope-nope-nope" },
+    },
+    options,
+  );
+  assert.equal(bad.status, 401);
+  assert.equal(bad.body.code, "invalid-credentials");
+
+  const missing = await handleLocalAuth(
+    {
+      method: "POST",
+      pathname: "/api/user/auth/login",
+      body: { email: "no@b.com", password: PASSWORD },
+    },
+    options,
+  );
+  assert.equal(missing.status, 401);
+});
+
+test("refresh rotates the token and refuses the old one", async () => {
+  const { options } = setup();
+  const created = await register(options);
+  const first = String(created.body.refreshToken);
+
+  const rotated = await handleLocalAuth(
+    { method: "POST", pathname: "/api/user/auth/refresh", body: { refreshToken: first } },
+    options,
+  );
+  assert.equal(rotated.status, 200);
+  assert.notEqual(rotated.body.refreshToken, first);
+
+  const reused = await handleLocalAuth(
+    { method: "POST", pathname: "/api/user/auth/refresh", body: { refreshToken: first } },
+    options,
+  );
+  assert.equal(reused.status, 401);
+  assert.equal(reused.body.code, "identity-not-found");
+});
+
+test("refresh with revoke signs the session out", async () => {
+  const { db, options } = setup();
+  const created = await register(options);
+  const result = await handleLocalAuth(
+    {
+      method: "POST",
+      pathname: "/api/user/auth/refresh",
+      body: { refreshToken: created.body.refreshToken, revoke: true },
+    },
+    options,
+  );
+  assert.equal(result.status, 200);
+  assert.equal(result.body.code, "ok");
+  assert.equal(db.refresh.length, 0);
+});
+
+test("me reads and updates the signed-in user", async () => {
+  const { options } = setup();
+  const created = await register(options);
+  const authorization = `Bearer ${created.body.accessToken}`;
+
+  const me = await handleLocalAuth(
+    { method: "GET", pathname: "/api/user/me", authorization },
+    options,
+  );
+  assert.equal(me.status, 200);
+  assert.equal(me.body.email, "a@b.com");
+  assert.equal(me.body.name, "A");
+
+  const updated = await handleLocalAuth(
+    { method: "PUT", pathname: "/api/user/me", authorization, body: { name: "B" } },
+    options,
+  );
+  assert.equal(updated.status, 200);
+  assert.equal(updated.body.name, "B");
+});
+
+test("me rejects a missing or foreign token", async () => {
+  const { options } = setup();
+  await register(options);
+
+  const anonymous = await handleLocalAuth({ method: "GET", pathname: "/api/user/me" }, options);
+  assert.equal(anonymous.status, 401);
+
+  const created = await register(options, "c@d.com");
+  const otherProject = await handleLocalAuth(
+    {
+      method: "GET",
+      pathname: "/api/user/me",
+      authorization: `Bearer ${created.body.accessToken}`,
+    },
+    { ...options, jwtSecret: "different-secret" },
+  );
+  assert.equal(otherProject.status, 401);
+});
+
+test("me rejects an email already taken by someone else", async () => {
+  const { options } = setup();
+  const first = await register(options, "a@b.com");
+  await register(options, "c@d.com");
+  const result = await handleLocalAuth(
+    {
+      method: "PUT",
+      pathname: "/api/user/me",
+      authorization: `Bearer ${first.body.accessToken}`,
+      body: { email: "c@d.com" },
+    },
+    options,
+  );
+  assert.equal(result.status, 409);
+});
+
+test("magic link delivers a code to the terminal and exchanges it once", async () => {
+  const { delivered, options } = setup();
+  await register(options);
+
+  const requested = await handleLocalAuth(
+    { method: "GET", pathname: "/api/user/auth/magic-link", query: { email: "a@b.com" } },
+    options,
+  );
+  assert.equal(requested.status, 200);
+  assert.equal(delivered.length, 1);
+  assert.equal(delivered[0]?.type, "magic");
+
+  const code = String(delivered[0]?.code);
+  const exchanged = await handleLocalAuth(
+    { method: "GET", pathname: "/api/user/auth/magic-link/callback", query: { code } },
+    options,
+  );
+  assert.equal(exchanged.status, 200);
+  assert.ok(exchanged.body.accessToken);
+
+  const replay = await handleLocalAuth(
+    { method: "GET", pathname: "/api/user/auth/magic-link/callback", query: { code } },
+    options,
+  );
+  assert.equal(replay.status, 400);
+});
+
+test("magic link stays generic for an unknown email", async () => {
+  const { delivered, options } = setup();
+  const result = await handleLocalAuth(
+    { method: "GET", pathname: "/api/user/auth/magic-link", query: { email: "nobody@b.com" } },
+    options,
+  );
+  assert.equal(result.status, 200);
+  assert.equal(result.body.code, "ok");
+  assert.equal(delivered.length, 0);
+});
+
+test("forgot password resets and the new password logs in", async () => {
+  const { delivered, options } = setup();
+  await register(options);
+
+  await handleLocalAuth(
+    { method: "POST", pathname: "/api/user/auth/forgot-password", body: { email: "a@b.com" } },
+    options,
+  );
+  const code = String(delivered.at(-1)?.code);
+
+  const reset = await handleLocalAuth(
+    {
+      method: "POST",
+      pathname: "/api/user/auth/forgot-password/callback",
+      body: { code, password: "a-brand-new-password" },
+    },
+    options,
+  );
+  assert.equal(reset.status, 200);
+
+  const login = await handleLocalAuth(
+    {
+      method: "POST",
+      pathname: "/api/user/auth/login",
+      body: { email: "a@b.com", password: "a-brand-new-password" },
+    },
+    options,
+  );
+  assert.equal(login.status, 200);
+});
+
+test("google sign-in points at hosted Starbase", async () => {
+  const { options } = setup();
+  const result = await handleLocalAuth(
+    { method: "GET", pathname: "/api/user/auth/google", query: { redirect_uri: "http://x" } },
+    options,
+  );
+  assert.equal(result.status, 503);
+  assert.match(String(result.body.message), /hosted Starbase/);
+});
+
+test("unknown Auth routes 404", async () => {
+  const { options } = setup();
+  const result = await handleLocalAuth({ method: "GET", pathname: "/api/user/auth/nope" }, options);
+  assert.equal(result.status, 404);
+  assert.equal(result.body.code, "not_found");
+});
+
+test("resolveLocalUser verifies project-scoped tokens", async () => {
+  const { options } = setup();
+  const created = await register(options);
+  const user = await resolveLocalUser(options, `Bearer ${created.body.accessToken}`);
+  assert.equal(user?.email, "a@b.com");
+
+  assert.equal(await resolveLocalUser(options, undefined), null);
+  assert.equal(await resolveLocalUser(options, "Bearer garbage"), null);
+  assert.equal(await resolveLocalUser(options, String(created.body.accessToken)), null);
+});

package/src/local-auth.ts

@@ -0,0 +1,215 @@
+import { ZodError } from "zod";
+import {
+  consumeNonce,
+  createNonce,
+  ensureAuthSchema,
+  insertPasswordUser,
+  issueProjectTokenPair,
+  loadRefreshSession,
+  loadUserByEmail,
+  loadUserById,
+  passwordMatches,
+  revokeRefresh,
+  rotateRefresh,
+  toAuthUser,
+  updateUserPassword,
+  updateUserProfile,
+  type AuthQueryable,
+} from "./auth-core.js";
+import {
+  forgotCallbackBody,
+  forgotRequestBody,
+  GENERIC_STATUS_MESSAGE,
+  loginBody,
+  magicConsumeQuery,
+  magicGenerateQuery,
+  meUpdateBody,
+  refreshBody,
+  registerBody,
+  statusOk,
+} from "./auth-schemas.js";
+import { bearerToken, verifyProjectUserToken } from "./project-jwt.js";
+
+export type LocalAuthResult = {
+  status: number;
+  body: Record<string, unknown>;
+};
+
+export type LocalAuthRequest = {
+  method: string;
+  pathname: string;
+  body?: unknown;
+  query?: unknown;
+  authorization?: string;
+};
+
+export type LocalAuthOptions = {
+  db: AuthQueryable;
+  projectId: string;
+  jwtSecret: string;
+  /**
+   * Where a magic-link / reset code is delivered. `robodev dev` prints it to the
+   * terminal instead of sending mail.
+   */
+  deliverCode: (input: { to: string; type: string; code: string }) => void;
+};
+
+function fail(status: number, code: string, message?: string): LocalAuthResult {
+  return { status, body: { code, ...(message ? { message } : {}) } };
+}
+
+/** True for the reserved Auth surface `robodev dev` serves itself. */
+export function isLocalAuthPath(pathname: string): boolean {
+  return pathname === "/api/user" || pathname.startsWith("/api/user/");
+}
+
+export async function resolveLocalUser(
+  options: Pick<LocalAuthOptions, "projectId" | "jwtSecret">,
+  authorization?: string,
+) {
+  const token = bearerToken(authorization);
+  if (!token) return null;
+  try {
+    return await verifyProjectUserToken(token, options.projectId, options.jwtSecret);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Password auth for a single local project: register, login, refresh, magic link,
+ * forgot password, and `/api/user/me`. Every operation runs through `auth-core`, the
+ * same code hosted Starbase Auth uses, so a local login behaves like a deployed one.
+ * Google OAuth and real SMTP stay hosted-only.
+ */
+export async function handleLocalAuth(
+  request: LocalAuthRequest,
+  options: LocalAuthOptions,
+): Promise<LocalAuthResult> {
+  const { db, projectId, jwtSecret } = options;
+  await ensureAuthSchema(db);
+  const method = request.method.toUpperCase();
+  const pathname = request.pathname;
+  const query = (request.query ?? {}) as Record<string, unknown>;
+
+  try {
+    if (method === "POST" && pathname === "/api/user/auth/register") {
+      const body = registerBody.parse(request.body);
+      if (await loadUserByEmail(db, body.email)) {
+        return fail(409, "identity-already-exists", "Email already registered");
+      }
+      const row = await insertPasswordUser(db, body);
+      const tokens = await issueProjectTokenPair(db, projectId, toAuthUser(row), jwtSecret);
+      return { status: 201, body: tokens };
+    }
+
+    if (method === "POST" && pathname === "/api/user/auth/login") {
+      const body = loginBody.parse(request.body);
+      const row = await loadUserByEmail(db, body.email);
+      if (!row || !(await passwordMatches(row, body.password))) {
+        return fail(401, "invalid-credentials", "Invalid email or password");
+      }
+      const tokens = await issueProjectTokenPair(db, projectId, toAuthUser(row), jwtSecret);
+      return { status: 200, body: tokens };
+    }
+
+    if (method === "POST" && pathname === "/api/user/auth/refresh") {
+      const body = refreshBody.parse(request.body);
+      if (body.revoke) {
+        await loadRefreshSession(db, body.refreshToken);
+        await revokeRefresh(db, body.refreshToken);
+        return { status: 200, body: statusOk("Signed out") };
+      }
+      const rotated = await rotateRefresh(db, projectId, body.refreshToken, jwtSecret);
+      if (rotated === "reuse") {
+        return fail(401, "identity-not-found", "Invalid refresh token");
+      }
+      return { status: 200, body: rotated };
+    }
+
+    if (method === "GET" && pathname === "/api/user/auth/magic-link") {
+      const q = magicGenerateQuery.parse(query);
+      const row = await loadUserByEmail(db, q.email);
+      if (row) {
+        const code = await createNonce(db, row.id, "magic");
+        options.deliverCode({ to: row.email, type: "magic", code });
+      }
+      return { status: 200, body: statusOk(GENERIC_STATUS_MESSAGE) };
+    }
+
+    if (method === "GET" && pathname === "/api/user/auth/magic-link/callback") {
+      const q = magicConsumeQuery.parse(query);
+      const row = await consumeNonce(db, q.code, "magic");
+      if (!row) {
+        return fail(400, "nonce-invalid", "Invalid or expired code");
+      }
+      const tokens = await issueProjectTokenPair(db, projectId, toAuthUser(row), jwtSecret);
+      return { status: 200, body: tokens };
+    }
+
+    if (method === "POST" && pathname === "/api/user/auth/forgot-password") {
+      const body = forgotRequestBody.parse(request.body);
+      const row = await loadUserByEmail(db, body.email);
+      if (row) {
+        const code = await createNonce(db, row.id, "forgot-password");
+        options.deliverCode({ to: row.email, type: "forgot-password", code });
+      }
+      return { status: 200, body: statusOk(GENERIC_STATUS_MESSAGE) };
+    }
+
+    if (method === "POST" && pathname === "/api/user/auth/forgot-password/callback") {
+      const body = forgotCallbackBody.parse(request.body);
+      const row = await consumeNonce(db, body.code, "forgot-password");
+      if (!row) {
+        return fail(400, "nonce-invalid", "Invalid or expired code");
+      }
+      await updateUserPassword(db, row.id, body.password);
+      return { status: 200, body: statusOk("Password updated") };
+    }
+
+    if (pathname === "/api/user/me" && (method === "GET" || method === "PUT")) {
+      const user = await resolveLocalUser(options, request.authorization);
+      const row = user ? await loadUserById(db, user.id) : undefined;
+      if (!row) {
+        return fail(401, "identity-not-found", "missing or invalid access token");
+      }
+      if (method === "GET") {
+        return { status: 200, body: { id: row.id, name: row.name, email: row.email } };
+      }
+      const body = meUpdateBody.parse(request.body ?? {});
+      let nextName = row.name;
+      let nextEmail = row.email;
+      if (body.name !== undefined) nextName = body.name || null;
+      if (body.email !== undefined && body.email !== row.email) {
+        const clash = await loadUserByEmail(db, body.email);
+        if (clash && clash.id !== row.id) {
+          return fail(409, "identity-already-exists", "Email already registered");
+        }
+        nextEmail = body.email;
+      }
+      await updateUserProfile(db, row.id, { name: nextName, email: nextEmail });
+      return { status: 200, body: { id: row.id, name: nextName, email: nextEmail } };
+    }
+
+    if (method === "GET" && pathname === "/api/user/auth/google") {
+      return fail(
+        503,
+        "google_oauth_disabled",
+        "Google sign-in needs hosted Starbase. Deploy the project to use it.",
+      );
+    }
+  } catch (error) {
+    if (error instanceof ZodError) {
+      return fail(400, "invalid-request", "Invalid request");
+    }
+    throw error;
+  }
+
+  return {
+    status: 404,
+    body: {
+      code: "not_found",
+      message: `${method} ${pathname} is not a Robodev Auth route`,
+    },
+  };
+}

package/src/multipart.ts

@@ -0,0 +1,60 @@
+import { Readable } from "node:stream";
+import busboy from "busboy";
+import type { UploadedFile } from "@robodev-ai/sdk";
+
+/** Default per-file ceiling. Starbase passes its own storage limit. */
+export const MAX_MULTIPART_FILE_BYTES = 25 * 1024 * 1024;
+
+export async function parseMultipart(
+  raw: Buffer,
+  contentType: string,
+  maxFileBytes = MAX_MULTIPART_FILE_BYTES,
+): Promise<{ files: UploadedFile[]; fields: Record<string, string> }> {
+  return new Promise((resolve, reject) => {
+    const files: UploadedFile[] = [];
+    const fields: Record<string, string> = {};
+    const pending: Promise<void>[] = [];
+    const parser = busboy({
+      headers: { "content-type": contentType },
+      limits: { files: 20, fileSize: maxFileBytes },
+    });
+    parser.on("file", (fieldname, stream, info) => {
+      pending.push(
+        new Promise<void>((done, fail) => {
+          const chunks: Buffer[] = [];
+          stream.on("data", (chunk: Buffer) => chunks.push(chunk));
+          stream.on("limit", () =>
+            fail(Object.assign(new Error("payload_too_large"), { statusCode: 413 })),
+          );
+          stream.on("error", fail);
+          stream.on("end", () => {
+            files.push({
+              fieldname,
+              filename: info.filename,
+              mimetype: info.mimeType,
+              data: Buffer.concat(chunks),
+            });
+            done();
+          });
+        }),
+      );
+    });
+    parser.on("field", (name, value) => {
+      fields[name] = value;
+    });
+    parser.on("error", reject);
+    parser.on("finish", () => {
+      Promise.all(pending).then(() => resolve({ files, fields }), reject);
+    });
+    Readable.from(raw).pipe(parser);
+  });
+}
+
+export function mediaType(contentType?: string): string {
+  return (contentType ?? "").split(";")[0]?.trim().toLowerCase() ?? "";
+}
+
+export function parseUrlEncoded(raw: Buffer): Record<string, string> {
+  const params = new URLSearchParams(raw.toString("utf8"));
+  return Object.fromEntries(params.entries());
+}