@saluzi/saluzi-edu 0.2.9 → 0.2.11

package/packages/remote-control-server/src/__tests__/middleware.test.ts

@@ -1,24 +1,10 @@
 import { describe, test, expect, beforeEach, afterAll, mock } from 'bun:test'
+import { mockConfigModule } from './helpers/mock-config'
 
 // Mock config before imports
-const mockConfig = {
-  port: 3000,
-  host: '0.0.0.0',
-  apiKeys: ['test-api-key'],
-  baseUrl: 'http://localhost:3000',
-  pollTimeout: 8,
-  heartbeatInterval: 20,
-  jwtExpiresIn: 3600,
-  disconnectTimeout: 300,
-  webCorsOrigins: ['https://dashboard.example'],
-  wsIdleTimeout: 30,
-  wsKeepaliveInterval: 20,
-}
-
-mock.module('../config', () => ({
-  config: mockConfig,
-  getBaseUrl: () => 'http://localhost:3000',
-}))
+mock.module('../config', () =>
+  mockConfigModule({ webCorsOrigins: ['https://dashboard.example'] }),
+)
 
 import { Hono } from 'hono'
 import { cors } from 'hono/cors'
@@ -27,10 +13,7 @@ import {
   apiKeyAuth,
   encodeWebSocketAuthProtocol,
   extractWebSocketAuthToken,
-  requireWorkerToken,
   sessionIngressAuth,
-  uuidAuth,
-  getUuidFromRequest,
 } from '../auth/middleware'
 import { issueToken } from '../auth/token'
 import { generateWorkerJwt } from '../auth/jwt'
@@ -54,25 +37,10 @@ function createTestApp() {
     return c.json({ ok: true, jwtPayload: c.get('jwtPayload') || null })
   })
 
-  // Test route for uuidAuth
-  app.get('/uuid-test', uuidAuth, c => {
-    return c.json({ uuid: c.get('uuid') })
-  })
-
-  // Test route for getUuidFromRequest
-  app.get('/uuid-extract', c => {
-    return c.json({ uuid: getUuidFromRequest(c) })
-  })
-
   app.get('/ws-auth-token', c => {
     return c.json({ token: extractWebSocketAuthToken(c) ?? null })
   })
 
-  // Test route for requireWorkerToken
-  app.get('/worker-token-test/:id', requireWorkerToken, c => {
-    return c.json({ ok: true })
-  })
-
   return app
 }
 
@@ -194,37 +162,6 @@ describe('Auth Middleware', () => {
     })
   })
 
-  describe('requireWorkerToken', () => {
-    const originalKeys = process.env.RCS_API_KEYS
-    beforeEach(() => {
-      process.env.RCS_API_KEYS = 'test-api-key'
-    })
-    afterAll(() => {
-      process.env.RCS_API_KEYS = originalKeys
-    })
-
-    test('admin API key via Authorization Bearer bypasses worker token', async () => {
-      const res = await app.request('/worker-token-test/ses_123', {
-        headers: { Authorization: 'Bearer test-api-key' },
-      })
-      expect(res.status).toBe(200)
-    })
-
-    test('admin API key via X-Worker-Token header bypasses worker token', async () => {
-      const res = await app.request('/worker-token-test/ses_123', {
-        headers: { 'X-Worker-Token': 'test-api-key' },
-      })
-      expect(res.status).toBe(200)
-    })
-
-    test('admin API key via worker_token query param bypasses worker token', async () => {
-      const res = await app.request(
-        '/worker-token-test/ses_123?worker_token=test-api-key',
-      )
-      expect(res.status).toBe(200)
-    })
-  })
-
   describe('extractWebSocketAuthToken', () => {
     test('does not read tokens from query params', async () => {
       const res = await app.request('/ws-auth-token?token=test-api-key')
@@ -242,51 +179,6 @@ describe('Auth Middleware', () => {
       expect(body.token).toBe('test-api-key')
     })
   })
-
-  describe('uuidAuth', () => {
-    test('accepts UUID from query param', async () => {
-      const res = await app.request('/uuid-test?uuid=test-uuid-1')
-      expect(res.status).toBe(200)
-      const body = await res.json()
-      expect(body.uuid).toBe('test-uuid-1')
-    })
-
-    test('accepts UUID from header', async () => {
-      const res = await app.request('/uuid-test', {
-        headers: { 'X-UUID': 'test-uuid-2' },
-      })
-      expect(res.status).toBe(200)
-      const body = await res.json()
-      expect(body.uuid).toBe('test-uuid-2')
-    })
-
-    test('rejects missing UUID', async () => {
-      const res = await app.request('/uuid-test')
-      expect(res.status).toBe(401)
-    })
-  })
-
-  describe('getUuidFromRequest', () => {
-    test('extracts from query param', async () => {
-      const res = await app.request('/uuid-extract?uuid=from-query')
-      const body = await res.json()
-      expect(body.uuid).toBe('from-query')
-    })
-
-    test('extracts from header', async () => {
-      const res = await app.request('/uuid-extract', {
-        headers: { 'X-UUID': 'from-header' },
-      })
-      const body = await res.json()
-      expect(body.uuid).toBe('from-header')
-    })
-
-    test('returns undefined when no UUID', async () => {
-      const res = await app.request('/uuid-extract')
-      const body = await res.json()
-      expect(body.uuid).toBeUndefined()
-    })
-  })
 })
 
 describe('Web CORS', () => {

package/packages/remote-control-server/src/__tests__/password.test.ts

@@ -0,0 +1,76 @@
+import { describe, test, expect } from 'bun:test'
+
+// Dynamic import — module may not exist yet (TDD)
+let hashPassword: ((password: string) => string) | undefined
+let verifyPassword: ((password: string, hash: string) => boolean) | undefined
+
+try {
+  const mod = await import('../auth/password')
+  hashPassword = mod.hashPassword
+  verifyPassword = mod.verifyPassword
+} catch {
+  // Module not implemented yet — tests will fail on assertions
+}
+
+describe('hashPassword', () => {
+  test('returns a string containing argon2id identifier', () => {
+    expect(hashPassword).toBeDefined()
+    const hash = hashPassword!('my-secure-password')
+    expect(typeof hash).toBe('string')
+    expect(hash).toContain('argon2id')
+  })
+
+  test('same password hashed twice produces different results (different salt)', () => {
+    expect(hashPassword).toBeDefined()
+    const hash1 = hashPassword!('same-password')
+    const hash2 = hashPassword!('same-password')
+    expect(hash1).not.toBe(hash2)
+  })
+
+  test('hash length is reasonable (between 50 and 200 chars)', () => {
+    expect(hashPassword).toBeDefined()
+    const hash = hashPassword!('test-password-123')
+    expect(hash.length).toBeGreaterThan(50)
+    expect(hash.length).toBeLessThan(200)
+  })
+})
+
+describe('verifyPassword', () => {
+  test('returns true for correct password', () => {
+    expect(hashPassword).toBeDefined()
+    expect(verifyPassword).toBeDefined()
+    const password = 'correct-horse-battery-staple'
+    const hash = hashPassword!(password)
+    expect(verifyPassword!(password, hash)).toBe(true)
+  })
+
+  test('returns false for wrong password', () => {
+    expect(hashPassword).toBeDefined()
+    expect(verifyPassword).toBeDefined()
+    const hash = hashPassword!('correct-password')
+    expect(verifyPassword!('wrong-password', hash)).toBe(false)
+  })
+
+  test('returns false for empty token', () => {
+    expect(hashPassword).toBeDefined()
+    expect(verifyPassword).toBeDefined()
+    const hash = hashPassword!('some-password')
+    expect(verifyPassword!('', hash)).toBe(false)
+  })
+
+  test('returns false for tampered hash', () => {
+    expect(hashPassword).toBeDefined()
+    expect(verifyPassword).toBeDefined()
+    const hash = hashPassword!('my-password')
+    // Tamper with the hash by changing a character in the encoded part
+    const parts = hash.split('$')
+    // Argon2id format: $argon2id$v=19$m=...,t=...,p=...$<salt>$<hash>
+    // Tamper with the last segment (the actual hash)
+    const lastPart = parts[parts.length - 1]
+    const tampered =
+      lastPart.length > 4
+        ? parts.slice(0, -1).join('$') + '$' + 'XXXX' + lastPart.slice(4)
+        : hash + 'x'
+    expect(verifyPassword!('my-password', tampered)).toBe(false)
+  })
+})

package/packages/remote-control-server/src/__tests__/phase4-cleanup.test.ts

@@ -0,0 +1,290 @@
+import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { mockConfigModule } from './helpers/mock-config'
+
+// ---------------------------------------------------------------------------
+// Mock config before any other imports
+// ---------------------------------------------------------------------------
+mock.module('../config', () => mockConfigModule({ pollTimeout: 1 }))
+
+import { Hono } from 'hono'
+import { storeReset } from '../store'
+import { issueToken } from '../auth/token'
+import { hasAcpRelayAuth } from '../routes/acp'
+import { sessionAuth } from '../auth/middleware'
+
+// Source file paths for static analysis
+const STORE_PATH = resolve(import.meta.dir, '../store.ts')
+const ACP_INDEX_PATH = resolve(import.meta.dir, '../routes/acp/index.ts')
+const MIDDLEWARE_PATH = resolve(import.meta.dir, '../auth/middleware.ts')
+
+// ---------------------------------------------------------------------------
+// Test app for sessionAuth behavior
+// ---------------------------------------------------------------------------
+function createTestApp() {
+  const app = new Hono()
+
+  app.get('/protected', async (c, next) => {
+    const result = await sessionAuth(c, next)
+    if (result) return result
+    return c.json({ userId: c.get('userId'), isAdmin: c.get('isAdmin') })
+  })
+
+  return app
+}
+
+// ---------------------------------------------------------------------------
+// 1. sessionOwners Map removed
+// ---------------------------------------------------------------------------
+describe('sessionOwners Map removed', () => {
+  const storeSource = readFileSync(STORE_PATH, 'utf8')
+
+  test('store.ts does not declare a sessionOwners Map variable', () => {
+    // Match `const sessionOwners = new Map` or similar declarations
+    const hasMapDecl = /(?:const|let|var)\s+sessionOwners\s*=\s*new\s+Map/.test(
+      storeSource,
+    )
+    expect(hasMapDecl).toBe(false)
+  })
+
+  test('storeBindSession uses SQLite instead of in-memory Map', () => {
+    // The function should reference db/sqlite or a SQL INSERT statement,
+    // NOT sessionOwners.set or sessionOwners.get
+    const bindFnMatch = storeSource.match(
+      /export\s+function\s+storeBindSession[\s\S]*?^}/m,
+    )
+    if (!bindFnMatch) {
+      // If function was removed entirely, that's also acceptable
+      expect(true).toBe(true)
+      return
+    }
+    const fnBody = bindFnMatch[0]
+    // Should NOT use sessionOwners Map
+    expect(/sessionOwners\.(set|get)/.test(fnBody)).toBe(false)
+  })
+
+  test('storeListSessionsByOwnerUuid is removed or migrated to SQLite', () => {
+    // If the function still exists, it must NOT iterate over sessionOwners Map
+    const fnMatch = storeSource.match(
+      /export\s+function\s+storeListSessionsByOwnerUuid[\s\S]*?^}/m,
+    )
+    if (!fnMatch) {
+      // Function removed entirely — acceptable
+      expect(true).toBe(true)
+      return
+    }
+    const fnBody = fnMatch[0]
+    // Should NOT reference sessionOwners Map
+    expect(/sessionOwners\.(get|has|entries|forEach)/.test(fnBody)).toBe(false)
+  })
+
+  test('storeIsSessionOwner uses SQLite instead of in-memory Map', () => {
+    const fnMatch = storeSource.match(
+      /export\s+function\s+storeIsSessionOwner[\s\S]*?^}/m,
+    )
+    if (!fnMatch) {
+      expect(true).toBe(true)
+      return
+    }
+    const fnBody = fnMatch[0]
+    expect(/sessionOwners\.(get|has)/.test(fnBody)).toBe(false)
+  })
+
+  test('storeGetSessionOwners uses SQLite instead of in-memory Map', () => {
+    const fnMatch = storeSource.match(
+      /export\s+function\s+storeGetSessionOwners[\s\S]*?^}/m,
+    )
+    if (!fnMatch) {
+      expect(true).toBe(true)
+      return
+    }
+    const fnBody = fnMatch[0]
+    expect(/sessionOwners\.(get|has)/.test(fnBody)).toBe(false)
+  })
+
+  test('storeReset does not reference sessionOwners.clear()', () => {
+    const resetMatch = storeSource.match(
+      /export\s+function\s+storeReset[\s\S]*?^}/m,
+    )
+    if (!resetMatch) {
+      expect(true).toBe(true)
+      return
+    }
+    expect(/sessionOwners\.clear\(\)/.test(resetMatch[0])).toBe(false)
+  })
+})
+
+// ---------------------------------------------------------------------------
+// 2. ACP relay WS UUID bypass removed
+// ---------------------------------------------------------------------------
+describe('ACP relay WS UUID bypass removed', () => {
+  const acpSource = readFileSync(ACP_INDEX_PATH, 'utf8')
+
+  test('hasAcpRelayAuth does not accept any non-empty token as UUID', () => {
+    // The current implementation has a comment "Treat any other non-empty token
+    // as a web UI UUID" and returns true unconditionally after validateApiKey.
+    // After cleanup, it should NOT have this pattern.
+    const fnMatch = acpSource.match(
+      /export\s+function\s+hasAcpRelayAuth[\s\S]*?^}/m,
+    )
+    expect(fnMatch).not.toBeNull()
+    const fnBody = fnMatch![0]
+
+    // Should NOT contain the UUID bypass comment or unconditional return true
+    const hasUuidBypass =
+      /Treat any other non-empty token as a.*UUID/i.test(fnBody) ||
+      /web UI UUID/i.test(fnBody)
+    expect(hasUuidBypass).toBe(false)
+  })
+
+  test('hasAcpRelayAuth rejects when no token is provided', () => {
+    // Create a mock context with no auth
+    const c = {
+      req: {
+        header: (name: string) => undefined,
+      },
+    } as any
+
+    const result = hasAcpRelayAuth(c)
+    expect(result).toBe(false)
+  })
+
+  test('hasAcpRelayAuth accepts valid admin API key', () => {
+    const c = {
+      req: {
+        header: (name: string) => {
+          if (name === 'Authorization') return 'Bearer test-api-key'
+          return undefined
+        },
+      },
+    } as any
+
+    const result = hasAcpRelayAuth(c)
+    expect(result).toBe(true)
+  })
+
+  test('hasAcpRelayAuth rejects invalid non-empty token that is not an API key or session token', () => {
+    // After cleanup, an arbitrary string like a UUID should NOT be accepted
+    const c = {
+      req: {
+        header: (name: string) => {
+          if (name === 'Authorization')
+            return 'Bearer some-random-uuid-not-an-api-key'
+          return undefined
+        },
+      },
+    } as any
+
+    // This test verifies the function no longer blindly accepts non-empty tokens.
+    // After cleanup: only admin API key or valid session token should pass.
+    const result = hasAcpRelayAuth(c)
+    expect(result).toBe(false)
+  })
+})
+
+// ---------------------------------------------------------------------------
+// 3. uuidAuth middleware removed / sessionAuth UUID fallback removed
+// ---------------------------------------------------------------------------
+describe('uuidAuth middleware removed', () => {
+  const middlewareSource = readFileSync(MIDDLEWARE_PATH, 'utf8')
+
+  test('uuidAuth function does not exist in middleware.ts', () => {
+    const hasUuidAuthExport = /export\s+(?:async\s+)?function\s+uuidAuth/.test(
+      middlewareSource,
+    )
+    expect(hasUuidAuthExport).toBe(false)
+  })
+
+  test('sessionAuth does not have UUID fallback', () => {
+    const sessionAuthMatch = middlewareSource.match(
+      /export\s+async\s+function\s+sessionAuth[\s\S]*?^}/m,
+    )
+    if (!sessionAuthMatch) {
+      // If sessionAuth doesn't exist, something is very wrong
+      expect(true).toBe(false)
+      return
+    }
+    const fnBody = sessionAuthMatch[0]
+
+    // Should NOT contain UUID backward compatibility code
+    const hasUuidFallback =
+      /Phase 1 backward compatibility.*UUID/i.test(fnBody) ||
+      /getUuidFromRequest/.test(fnBody)
+    expect(hasUuidFallback).toBe(false)
+  })
+
+  test('getUuidFromRequest function does not exist in middleware.ts', () => {
+    const hasGetUuid =
+      /export\s+(?:async\s+)?function\s+getUuidFromRequest/.test(
+        middlewareSource,
+      )
+    expect(hasGetUuid).toBe(false)
+  })
+})
+
+// ---------------------------------------------------------------------------
+// 3b. sessionAuth behavioral tests (anonymous / UUID → 401)
+// ---------------------------------------------------------------------------
+describe('sessionAuth blocks anonymous and UUID-only access', () => {
+  let app: Hono
+
+  beforeEach(() => {
+    storeReset()
+    app = createTestApp()
+  })
+
+  test('anonymous request (no cookie, no Bearer, no UUID) returns 401', async () => {
+    const res = await app.request('/protected')
+    expect(res.status).toBe(401)
+  })
+
+  test('request with ?uuid=xxx but no token returns 401', async () => {
+    const res = await app.request('/protected?uuid=some-uuid-value')
+    expect(res.status).toBe(401)
+  })
+
+  test('request with X-UUID header but no token returns 401', async () => {
+    const res = await app.request('/protected', {
+      headers: { 'X-UUID': 'some-uuid-value' },
+    })
+    expect(res.status).toBe(401)
+  })
+
+  test('valid admin API key Bearer returns 200', async () => {
+    const res = await app.request('/protected', {
+      headers: { Authorization: 'Bearer test-api-key' },
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.userId).toBe('__system__')
+    expect(body.isAdmin).toBe(true)
+  })
+
+  test('valid session token via Bearer returns 200', async () => {
+    const { token } = issueToken('testuser')
+    const res = await app.request('/protected', {
+      headers: { Authorization: `Bearer ${token}` },
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.userId).toBe('testuser')
+  })
+
+  test('valid session token via cookie returns 200', async () => {
+    const { token } = issueToken('cookieuser')
+    const res = await app.request('/protected', {
+      headers: { Cookie: `rcs_access=${token}` },
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.userId).toBe('cookieuser')
+  })
+
+  test('invalid Bearer token returns 401', async () => {
+    const res = await app.request('/protected', {
+      headers: { Authorization: 'Bearer invalid-token-xyz' },
+    })
+    expect(res.status).toBe(401)
+  })
+})