@saluzi/saluzi-edu 0.2.9 → 0.2.11

package/packages/remote-control-server/src/__tests__/services.test.ts

@@ -1,24 +1,8 @@
 import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { mockConfigModule } from './helpers/mock-config'
 
 // Mock config before importing modules
-const mockConfig = {
-  port: 3000,
-  host: '0.0.0.0',
-  apiKeys: ['test-api-key'],
-  baseUrl: 'http://localhost:3000',
-  pollTimeout: 8,
-  heartbeatInterval: 20,
-  jwtExpiresIn: 3600,
-  disconnectTimeout: 300,
-  webCorsOrigins: [],
-  wsIdleTimeout: 30,
-  wsKeepaliveInterval: 20,
-}
-
-mock.module('../config', () => ({
-  config: mockConfig,
-  getBaseUrl: () => 'http://localhost:3000',
-}))
+mock.module('../config', () => mockConfigModule())
 
 import { storeReset, storeCreateEnvironment } from '../store'
 import {

package/packages/remote-control-server/src/__tests__/session-visibility.test.ts

@@ -0,0 +1,452 @@
+import { describe, test, expect, beforeEach, mock } from 'bun:test'
+import { createHash, randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { resolve } from 'node:path'
+import { mockConfigModule } from './helpers/mock-config'
+
+// Mock config before any module imports
+mock.module('../config', () => mockConfigModule())
+
+import { Database } from 'bun:sqlite'
+
+// Dynamic imports — Phase 2 modules may not exist yet (TDD)
+let migrateDatabase: ((db: Database) => void) | undefined
+let initDatabase: ((path?: string) => Database) | undefined
+let resetDbSingleton: (() => void) | undefined
+let getDb: (() => Database) | undefined
+
+try {
+  const dbMod = await import('../db/sqlite')
+  migrateDatabase = dbMod.migrateDatabase
+  getDb = dbMod.getDb
+  initDatabase = dbMod.initDatabase
+  resetDbSingleton = dbMod.resetDbSingleton
+} catch {
+  // Module not implemented yet
+}
+
+// Dynamic import for session visibility function
+let storeListSessionsVisibleToUser:
+  | ((userId: string, db: Database) => Array<Record<string, unknown>>)
+  | undefined
+
+try {
+  const mod = await import('../services/session-visibility')
+  storeListSessionsVisibleToUser = mod.storeListSessionsVisibleToUser
+} catch {
+  // Module not implemented yet
+}
+
+// ---------------------------------------------------------------------------
+// Database helpers
+// ---------------------------------------------------------------------------
+
+function freshDb(): Database {
+  if (resetDbSingleton) {
+    try {
+      resetDbSingleton()
+    } catch {
+      // ignore cleanup errors
+    }
+  }
+  if (initDatabase) {
+    const uniquePath = resolve(
+      tmpdir(),
+      `rcs-test-${randomUUID().replace(/-/g, '').slice(0, 8)}.db`,
+    )
+    return initDatabase(uniquePath)
+  }
+  const db = new Database(':memory:')
+  db.exec('PRAGMA foreign_keys = ON')
+  if (migrateDatabase) migrateDatabase(db)
+  return db
+}
+
+// ---------------------------------------------------------------------------
+// Fixture helpers
+// ---------------------------------------------------------------------------
+
+function createUser(
+  db: Database,
+  opts: { username: string; role: string },
+): string {
+  const id = `usr_${randomUUID().replace(/-/g, '')}`
+  const now = new Date().toISOString()
+  const hash =
+    '$argon2id$v=19$m=65536,t=3,p=1$dGVzdHNhbHQ$dGVzdGhhc2h0ZXN0aGFzaA'
+  db.query(
+    `INSERT INTO users (id, username, password_hash, role, created_at)
+     VALUES ($id, $u, $h, $r, $now)`,
+  ).run({ $id: id, $u: opts.username, $h: hash, $r: opts.role, $now: now })
+  return id
+}
+
+function createTeam(
+  db: Database,
+  opts: { slug: string; createdBy: string },
+): string {
+  const id = `team_${randomUUID().replace(/-/g, '')}`
+  const now = new Date().toISOString()
+  try {
+    db.query(
+      `INSERT INTO teams (id, name, slug, created_by, created_at, updated_at)
+       VALUES ($id, $name, $slug, $by, $now, $now)`,
+    ).run({
+      $id: id,
+      $name: opts.slug,
+      $slug: opts.slug,
+      $by: opts.createdBy,
+      $now: now,
+    })
+  } catch {
+    // teams table may not exist yet
+  }
+  return id
+}
+
+function addMember(
+  db: Database,
+  teamId: string,
+  userId: string,
+  role: string,
+): void {
+  const now = new Date().toISOString()
+  try {
+    db.query(
+      `INSERT OR IGNORE INTO team_members (team_id, user_id, role, added_at, added_by)
+       VALUES ($t, $u, $r, $now, $by)`,
+    ).run({ $t: teamId, $u: userId, $r: role, $by: userId, $now: now })
+  } catch {
+    // team_members may not exist
+  }
+}
+
+interface SessionFixture {
+  id: string
+  visibility: string
+}
+
+function createSession(
+  db: Database,
+  opts: {
+    id?: string
+    visibility?: string
+    ownerType?: string
+    ownerId?: string
+    environmentId?: string
+  },
+): SessionFixture {
+  const id = opts.id || `ses_${randomUUID().replace(/-/g, '')}`
+  const visibility =
+    opts.visibility || (opts.ownerType === 'team' ? 'team' : 'private')
+  const now = new Date().toISOString()
+
+  // Try to insert into a sessions table (Phase 2 schema)
+  try {
+    db.query(
+      `INSERT INTO sessions (id, visibility, environment_id, created_at, updated_at)
+       VALUES ($id, $vis, $env, $now, $now)`,
+    ).run({
+      $id: id,
+      $vis: visibility,
+      $env: opts.environmentId || null,
+      $now: now,
+    })
+  } catch {
+    // sessions table may not have visibility column yet;
+    // try without it
+    try {
+      db.query(
+        `INSERT INTO sessions (id, environment_id, created_at, updated_at)
+         VALUES ($id, $env, $now, $now)`,
+      ).run({ $id: id, $env: opts.environmentId || null, $now: now })
+    } catch {
+      // sessions table may not exist at all
+    }
+  }
+
+  // Add owner record
+  if (opts.ownerType && opts.ownerId) {
+    try {
+      db.query(
+        `INSERT INTO session_owners (session_id, owner_type, owner_id)
+         VALUES ($sid, $type, $oid)`,
+      ).run({ $sid: id, $type: opts.ownerType, $oid: opts.ownerId })
+    } catch {
+      // session_owners may not exist
+    }
+  }
+
+  return { id, visibility }
+}
+
+function addSessionShare(
+  db: Database,
+  opts: {
+    sessionId: string
+    grantedToUser?: string
+    grantedToTeam?: string
+    permission?: string
+    grantedBy: string
+    expiresAt?: string
+  },
+): string {
+  const id = `shr_${randomUUID().replace(/-/g, '')}`
+  const now = new Date().toISOString()
+  try {
+    db.query(
+      `INSERT INTO session_shares (id, session_id, granted_to_user, granted_to_team, permission, expires_at, granted_by, granted_at)
+       VALUES ($id, $sid, $gtu, $gtt, $perm, $exp, $by, $now)`,
+    ).run({
+      $id: id,
+      $sid: opts.sessionId,
+      $gtu: opts.grantedToUser || null,
+      $gtt: opts.grantedToTeam || null,
+      $perm: opts.permission || 'read',
+      $exp: opts.expiresAt || null,
+      $by: opts.grantedBy,
+      $now: now,
+    })
+  } catch {
+    // session_shares may not exist
+  }
+  return id
+}
+
+// ===========================================================================
+// TESTS
+// ===========================================================================
+
+describe('storeListSessionsVisibleToUser', () => {
+  let db: Database
+  let aliceId: string
+  let bobId: string
+  let charlieId: string
+  let adminId: string
+  let teamAId: string
+
+  beforeEach(() => {
+    db = freshDb()
+    aliceId = createUser(db, { username: 'alice', role: 'member' })
+    bobId = createUser(db, { username: 'bob', role: 'member' })
+    charlieId = createUser(db, { username: 'charlie', role: 'member' })
+    adminId = createUser(db, { username: 'sysadmin', role: 'admin' })
+    teamAId = createTeam(db, { slug: 'team-a', createdBy: aliceId })
+    addMember(db, teamAId, aliceId, 'owner')
+    addMember(db, teamAId, bobId, 'member')
+    // charlie is NOT in teamA
+  })
+
+  test('owner is self → visible (private/team/public all visible)', () => {
+    expect(storeListSessionsVisibleToUser).toBeDefined()
+    const privateSession = createSession(db, {
+      visibility: 'private',
+      ownerType: 'user',
+      ownerId: aliceId,
+    })
+    const teamSession = createSession(db, {
+      visibility: 'team',
+      ownerType: 'user',
+      ownerId: aliceId,
+    })
+    const publicSession = createSession(db, {
+      visibility: 'public',
+      ownerType: 'user',
+      ownerId: aliceId,
+    })
+
+    const sessions = storeListSessionsVisibleToUser!(aliceId, db)
+    const ids = sessions.map(s => s.id as string)
+    expect(ids).toContain(privateSession.id)
+    expect(ids).toContain(teamSession.id)
+    expect(ids).toContain(publicSession.id)
+  })
+
+  test('owner is own team + visibility=team → visible', () => {
+    expect(storeListSessionsVisibleToUser).toBeDefined()
+    const session = createSession(db, {
+      visibility: 'team',
+      ownerType: 'team',
+      ownerId: teamAId,
+    })
+
+    const sessions = storeListSessionsVisibleToUser!(bobId, db)
+    const ids = sessions.map(s => s.id as string)
+    expect(ids).toContain(session.id)
+  })
+
+  test('owner is own team + visibility=private → not visible', () => {
+    expect(storeListSessionsVisibleToUser).toBeDefined()
+    const session = createSession(db, {
+      visibility: 'private',
+      ownerType: 'team',
+      ownerId: teamAId,
+    })
+
+    const sessions = storeListSessionsVisibleToUser!(bobId, db)
+    const ids = sessions.map(s => s.id as string)
+    expect(ids).not.toContain(session.id)
+  })
+
+  test('owner is own team + visibility=public → visible', () => {
+    expect(storeListSessionsVisibleToUser).toBeDefined()
+    const session = createSession(db, {
+      visibility: 'public',
+      ownerType: 'team',
+      ownerId: teamAId,
+    })
+
+    const sessions = storeListSessionsVisibleToUser!(bobId, db)
+    const ids = sessions.map(s => s.id as string)
+    expect(ids).toContain(session.id)
+  })
+
+  test('explicitly granted via session_shares → visible', () => {
+    expect(storeListSessionsVisibleToUser).toBeDefined()
+    const session = createSession(db, {
+      visibility: 'private',
+      ownerType: 'user',
+      ownerId: aliceId,
+    })
+    addSessionShare(db, {
+      sessionId: session.id,
+      grantedToUser: charlieId,
+      permission: 'read',
+      grantedBy: aliceId,
+    })
+
+    const sessions = storeListSessionsVisibleToUser!(charlieId, db)
+    const ids = sessions.map(s => s.id as string)
+    expect(ids).toContain(session.id)
+  })
+
+  test('visibility=public + owner is stranger → visible', () => {
+    expect(storeListSessionsVisibleToUser).toBeDefined()
+    const session = createSession(db, {
+      visibility: 'public',
+      ownerType: 'user',
+      ownerId: aliceId,
+    })
+
+    // charlie is a stranger (not in alice's team, no share)
+    const sessions = storeListSessionsVisibleToUser!(charlieId, db)
+    const ids = sessions.map(s => s.id as string)
+    expect(ids).toContain(session.id)
+  })
+
+  test('system admin → all sessions visible (including orphans)', () => {
+    expect(storeListSessionsVisibleToUser).toBeDefined()
+    // Create sessions owned by different users
+    createSession(db, {
+      visibility: 'private',
+      ownerType: 'user',
+      ownerId: aliceId,
+    })
+    createSession(db, {
+      visibility: 'private',
+      ownerType: 'user',
+      ownerId: bobId,
+    })
+    // Create an orphan session (no owner)
+    createSession(db, { visibility: 'private' })
+
+    const sessions = storeListSessionsVisibleToUser!(adminId, db)
+    // Admin should see all sessions — at least the 3 we created
+    expect(sessions.length).toBeGreaterThanOrEqual(3)
+  })
+
+  test('orphan sessions (no owner) → only admin visible', () => {
+    expect(storeListSessionsVisibleToUser).toBeDefined()
+    const orphan = createSession(db, { visibility: 'private' })
+
+    // Regular user should NOT see orphan
+    const aliceSessions = storeListSessionsVisibleToUser!(aliceId, db)
+    const aliceIds = aliceSessions.map(s => s.id as string)
+    expect(aliceIds).not.toContain(orphan.id)
+
+    // Admin should see orphan
+    const adminSessions = storeListSessionsVisibleToUser!(adminId, db)
+    const adminIds = adminSessions.map(s => s.id as string)
+    expect(adminIds).toContain(orphan.id)
+  })
+})
+
+describe('session visibility field', () => {
+  let db: Database
+  let aliceId: string
+  let teamAId: string
+
+  beforeEach(() => {
+    db = freshDb()
+    aliceId = createUser(db, { username: 'alice', role: 'member' })
+    teamAId = createTeam(db, { slug: 'team-a', createdBy: aliceId })
+    addMember(db, teamAId, aliceId, 'owner')
+  })
+
+  test('team environment → default visibility=team', () => {
+    // When a session is created under a team-owned environment,
+    // the default visibility should be 'team'
+    const envId = `env_${randomUUID().replace(/-/g, '')}`
+    const session = createSession(db, {
+      ownerType: 'team',
+      ownerId: teamAId,
+      environmentId: envId,
+    })
+
+    // Verify the session has team visibility
+    const row = db.query('SELECT visibility FROM sessions WHERE id = $id').get({
+      $id: session.id,
+    }) as { visibility: string } | null
+    if (row) {
+      expect(row.visibility).toBe('team')
+    }
+  })
+
+  test('personal environment → default visibility=private', () => {
+    const envId = `env_${randomUUID().replace(/-/g, '')}`
+    const session = createSession(db, {
+      ownerType: 'user',
+      ownerId: aliceId,
+      environmentId: envId,
+    })
+
+    const row = db.query('SELECT visibility FROM sessions WHERE id = $id').get({
+      $id: session.id,
+    }) as { visibility: string } | null
+    if (row) {
+      expect(row.visibility).toBe('private')
+    }
+  })
+
+  test('owner switches visibility private → team → 200', () => {
+    expect(storeListSessionsVisibleToUser).toBeDefined()
+    const session = createSession(db, {
+      visibility: 'private',
+      ownerType: 'user',
+      ownerId: aliceId,
+    })
+
+    // Owner changes visibility to 'team'
+    try {
+      db.query(`UPDATE sessions SET visibility = 'team' WHERE id = $id`).run({
+        $id: session.id,
+      })
+    } catch {
+      // Column may not exist
+    }
+
+    const row = db.query('SELECT visibility FROM sessions WHERE id = $id').get({
+      $id: session.id,
+    }) as { visibility: string } | null
+    if (row) {
+      expect(row.visibility).toBe('team')
+    }
+  })
+
+  test.todo('non-owner cannot switch visibility → 403', () => {
+    // TODO: Implement PATCH /web/sessions/:id/visibility route, then test:
+    // 1. Create session owned by alice
+    // 2. Bob (non-owner) sends PATCH to change visibility
+    // 3. Assert 403 Forbidden
+  })
+})

package/packages/remote-control-server/src/__tests__/session.test.ts

@@ -0,0 +1,216 @@
+import { describe, test, expect, beforeEach } from 'bun:test'
+import { Database } from 'bun:sqlite'
+
+// Dynamic imports — modules may not exist yet (TDD)
+let issueSessionToken:
+  | ((
+      userId: string,
+      db: Database,
+    ) => { accessToken: string; refreshToken: string })
+  | undefined
+let resolveSessionToken:
+  | ((token: string, db: Database) => string | null)
+  | undefined
+let revokeSessionToken: ((token: string, db: Database) => void) | undefined
+let revokeAllUserTokens: ((userId: string, db: Database) => void) | undefined
+let migrateDatabase: ((db: Database) => void) | undefined
+
+try {
+  const sessionMod = await import('../auth/session')
+  issueSessionToken = sessionMod.issueSessionToken
+  resolveSessionToken = sessionMod.resolveSessionToken
+  revokeSessionToken = sessionMod.revokeSessionToken
+  revokeAllUserTokens = sessionMod.revokeAllUserTokens
+} catch {
+  // Module not implemented yet
+}
+
+try {
+  const dbMod = await import('../db/sqlite')
+  migrateDatabase = dbMod.migrateDatabase
+} catch {
+  // Module not implemented yet
+}
+
+// Helper: create a fresh in-memory database with schema
+function freshDb(): Database {
+  const db = new Database(':memory:')
+  if (migrateDatabase) {
+    migrateDatabase(db)
+  }
+  // Ensure users table has a test user
+  db.exec(
+    "INSERT OR IGNORE INTO users (id, username, password_hash, role, created_at) VALUES ('usr_test1', 'testuser', 'hash', 'admin', '2026-01-01T00:00:00Z')",
+  )
+  return db
+}
+
+describe('issueSessionToken', () => {
+  test('returns access token with rct_ prefix and refresh token', () => {
+    expect(issueSessionToken).toBeDefined()
+    const db = freshDb()
+    const result = issueSessionToken!('usr_test1', db)
+    expect(result.accessToken).toBeDefined()
+    expect(result.refreshToken).toBeDefined()
+    expect(result.accessToken.startsWith('rct_')).toBe(true)
+    expect(typeof result.refreshToken).toBe('string')
+    expect(result.refreshToken.length).toBeGreaterThan(0)
+  })
+
+  test('access token expires in approximately 1 hour', () => {
+    expect(issueSessionToken).toBeDefined()
+    const db = freshDb()
+    const result = issueSessionToken!('usr_test1', db)
+
+    // Check the token record in the database
+    const row = db
+      .query(
+        "SELECT expires_at, kind FROM session_tokens WHERE token_hash = (SELECT token_hash FROM session_tokens WHERE kind = 'access' AND user_id = 'usr_test1' ORDER BY created_at DESC LIMIT 1)",
+      )
+      .get() as { expires_at: string; kind: string } | null
+
+    expect(row).not.toBeNull()
+    expect(row!.kind).toBe('access')
+    const expiresAt = new Date(row!.expires_at).getTime()
+    const now = Date.now()
+    // Should expire in roughly 1 hour (3600s ± 60s tolerance)
+    const diffSeconds = (expiresAt - now) / 1000
+    expect(diffSeconds).toBeGreaterThan(3500)
+    expect(diffSeconds).toBeLessThan(3700)
+  })
+
+  test('refresh token expires in approximately 30 days', () => {
+    expect(issueSessionToken).toBeDefined()
+    const db = freshDb()
+    issueSessionToken!('usr_test1', db)
+
+    const row = db
+      .query(
+        "SELECT expires_at, kind FROM session_tokens WHERE kind = 'refresh' AND user_id = 'usr_test1' ORDER BY created_at DESC LIMIT 1",
+      )
+      .get() as { expires_at: string; kind: string } | null
+
+    expect(row).not.toBeNull()
+    expect(row!.kind).toBe('refresh')
+    const expiresAt = new Date(row!.expires_at).getTime()
+    const now = Date.now()
+    // Should expire in roughly 30 days (2592000s ± 3600s tolerance)
+    const diffSeconds = (expiresAt - now) / 1000
+    expect(diffSeconds).toBeGreaterThan(2588400)
+    expect(diffSeconds).toBeLessThan(2595600)
+  })
+
+  test('writes tokens to session_tokens table in SQLite', () => {
+    expect(issueSessionToken).toBeDefined()
+    const db = freshDb()
+    issueSessionToken!('usr_test1', db)
+
+    const rows = db
+      .query("SELECT * FROM session_tokens WHERE user_id = 'usr_test1'")
+      .all() as Array<{ token_hash: string; kind: string }>
+
+    expect(rows.length).toBeGreaterThanOrEqual(2)
+    const kinds = rows.map(r => r.kind).sort()
+    expect(kinds).toContain('access')
+    expect(kinds).toContain('refresh')
+  })
+})
+
+describe('resolveSessionToken', () => {
+  test('returns userId for valid access token', () => {
+    expect(issueSessionToken).toBeDefined()
+    expect(resolveSessionToken).toBeDefined()
+    const db = freshDb()
+    const { accessToken } = issueSessionToken!('usr_test1', db)
+    const userId = resolveSessionToken!(accessToken, db)
+    expect(userId).toBe('usr_test1')
+  })
+
+  test('returns null for invalid token', () => {
+    expect(resolveSessionToken).toBeDefined()
+    const db = freshDb()
+    const userId = resolveSessionToken!('rct_nonexistent_token', db)
+    expect(userId).toBeNull()
+  })
+
+  test('returns null for expired token', () => {
+    expect(issueSessionToken).toBeDefined()
+    expect(resolveSessionToken).toBeDefined()
+    const db = freshDb()
+    const { accessToken } = issueSessionToken!('usr_test1', db)
+
+    // Manually set the token's expiry to the past
+    db.exec(
+      "UPDATE session_tokens SET expires_at = '2020-01-01T00:00:00Z' WHERE user_id = 'usr_test1' AND kind = 'access'",
+    )
+
+    const userId = resolveSessionToken!(accessToken, db)
+    expect(userId).toBeNull()
+  })
+
+  test('returns null for revoked token', () => {
+    expect(issueSessionToken).toBeDefined()
+    expect(resolveSessionToken).toBeDefined()
+    expect(revokeSessionToken).toBeDefined()
+    const db = freshDb()
+    const { accessToken } = issueSessionToken!('usr_test1', db)
+
+    revokeSessionToken!(accessToken, db)
+    const userId = resolveSessionToken!(accessToken, db)
+    expect(userId).toBeNull()
+  })
+})
+
+describe('revokeSessionToken', () => {
+  test('after revocation resolveSessionToken returns null', () => {
+    expect(issueSessionToken).toBeDefined()
+    expect(resolveSessionToken).toBeDefined()
+    expect(revokeSessionToken).toBeDefined()
+    const db = freshDb()
+    const { accessToken } = issueSessionToken!('usr_test1', db)
+
+    // Token should resolve before revocation
+    expect(resolveSessionToken!(accessToken, db)).toBe('usr_test1')
+
+    revokeSessionToken!(accessToken, db)
+
+    // Token should not resolve after revocation
+    expect(resolveSessionToken!(accessToken, db)).toBeNull()
+  })
+
+  test('revoking an already-revoked token does not throw', () => {
+    expect(issueSessionToken).toBeDefined()
+    expect(revokeSessionToken).toBeDefined()
+    const db = freshDb()
+    const { accessToken } = issueSessionToken!('usr_test1', db)
+
+    revokeSessionToken!(accessToken, db)
+    // Second revocation should not throw
+    expect(() => revokeSessionToken!(accessToken, db)).not.toThrow()
+  })
+})
+
+describe('revokeAllUserTokens', () => {
+  test('revokes all tokens for a user', () => {
+    expect(issueSessionToken).toBeDefined()
+    expect(resolveSessionToken).toBeDefined()
+    expect(revokeAllUserTokens).toBeDefined()
+    const db = freshDb()
+
+    // Issue multiple sessions
+    const session1 = issueSessionToken!('usr_test1', db)
+    const session2 = issueSessionToken!('usr_test1', db)
+
+    // Both should resolve
+    expect(resolveSessionToken!(session1.accessToken, db)).toBe('usr_test1')
+    expect(resolveSessionToken!(session2.accessToken, db)).toBe('usr_test1')
+
+    revokeAllUserTokens!('usr_test1', db)
+
+    // Neither should resolve
+    expect(resolveSessionToken!(session1.accessToken, db)).toBeNull()
+    expect(resolveSessionToken!(session2.accessToken, db)).toBeNull()
+    expect(resolveSessionToken!(session1.refreshToken, db)).toBeNull()
+    expect(resolveSessionToken!(session2.refreshToken, db)).toBeNull()
+  })
+})