@selvajs/platform 0.14.2 → 0.15.0-beta.1

package/src/testing/suites/authProviderSuite.ts

@@ -1,207 +0,0 @@
-// Conformance suite for IAuthProvider: token round-trips, identity, password auth, admin management.
-
-import { describe, it, expect } from 'vitest';
-import type { IAuthProvider } from '../../auth/index.js';
-import { makeUuid } from './helpers.js';
-
-export interface AuthProviderConformanceOptions {
-	/** Name to show in test output (e.g. "LocalAuthProvider"). */
-	name: string;
-	/**
-	 * Factory returning a fresh provider configured with a known password.
-	 * `adminPassword` must work with `passwordAuth.verifyLogin(adminEmail, adminPassword)`
-	 * for password-capable providers. The factory is responsible for seeding
-	 * the admin user (e.g. via `createUserWithPassword`) before returning.
-	 *
-	 * `adminEmail` defaults to `''` for legacy reasons; new providers should
-	 * always return the seeded admin's email.
-	 */
-	createProvider: () =>
-		| Promise<{ provider: IAuthProvider; adminPassword: string; adminEmail?: string }>
-		| { provider: IAuthProvider; adminPassword: string; adminEmail?: string };
-	/**
-	 * Set to true when the provider is wired with a backend so that
-	 * createUser / listUsers / updateUserPlatformPermissions / deleteUser tests run.
-	 * When false those methods are expected to return null / 'not_supported'.
-	 */
-	userManagement?: boolean;
-}
-
-export function runAuthProviderConformance(opts: AuthProviderConformanceOptions): void {
-	const { name, createProvider, userManagement = false } = opts;
-
-	describe(`IAuthProvider conformance: ${name}`, () => {
-		// Token round-trips
-		it('verifyLogin returns a session token that verifyToken accepts', async () => {
-			const { provider, adminPassword, adminEmail = '' } = await createProvider();
-			const result = await provider.passwordAuth!.verifyLogin(adminEmail, adminPassword);
-			expect(result.kind).toBe('success');
-			if (result.kind !== 'success') return;
-			const verified = await provider.verifyToken(result.sessionToken);
-			expect(verified?.id).toBe(result.user.id);
-		});
-
-		it('verifyToken returns null for a garbage token', async () => {
-			const { provider } = await createProvider();
-			const result = await provider.verifyToken('not-a-valid-token');
-			expect(result).toBeNull();
-		});
-
-		it('verifyToken returns null for an empty string', async () => {
-			const { provider } = await createProvider();
-			const result = await provider.verifyToken('');
-			expect(result).toBeNull();
-		});
-
-		// Password auth (only runs when passwordAuth is present)
-		it('verifyLogin returns success with correct password', async () => {
-			const { provider, adminPassword, adminEmail = '' } = await createProvider();
-			if (!provider.passwordAuth) return;
-			const result = await provider.passwordAuth.verifyLogin(adminEmail, adminPassword);
-			expect(result.kind).toBe('success');
-			if (result.kind !== 'success') return;
-			// Identity-only — platform permissions live on IPlatformPermissionStore now.
-			expect(result.user.id).toBeTruthy();
-			expect(typeof result.sessionToken).toBe('string');
-			expect(result.sessionToken.length).toBeGreaterThan(0);
-		});
-
-		it('verifyLogin returns failed for wrong password', async () => {
-			const { provider, adminEmail = '' } = await createProvider();
-			if (!provider.passwordAuth) return;
-			const result = await provider.passwordAuth.verifyLogin(adminEmail, 'wrong-password-xyz');
-			expect(result.kind).toBe('failed');
-		});
-
-		// getUser
-		it('getUser returns null for unknown id', async () => {
-			const { provider } = await createProvider();
-			// Valid UUID shape but not an actual user — stricter backends (Postgres
-			// uuid columns) reject non-UUID ids outright, so we never send those.
-			const result = await provider.getUser(makeUuid());
-			expect(result).toBeNull();
-		});
-
-		// ============================================================================
-		// User management (opt-in)
-		// ============================================================================
-
-		if (userManagement) {
-			it('passwordAuth.createUserWithPassword + getUser returns the created user', async () => {
-				const { provider } = await createProvider();
-				const email = `test-${makeUuid()}@example.com`;
-				const created = await provider.passwordAuth!.createUserWithPassword(email, 'password1234');
-				expect(created).toBeTruthy();
-				const fetched = await provider.getUser(created.id);
-				expect(fetched?.id).toBe(created.id);
-				expect(fetched?.email).toBe(email);
-			});
-
-			it('createUserWithPassword allows login with the new credentials', async () => {
-				const { provider } = await createProvider();
-				const email = `login-${makeUuid()}@example.com`;
-				await provider.passwordAuth!.createUserWithPassword(email, 'secret9999');
-				const result = await provider.passwordAuth!.verifyLogin(email, 'secret9999');
-				expect(result.kind).toBe('success');
-				if (result.kind !== 'success') return;
-				expect(result.user.email).toBe(email);
-			});
-
-			it('listUsers returns created users', async () => {
-				const { provider } = await createProvider();
-				const a = `a-${makeUuid()}@example.com`;
-				const b = `b-${makeUuid()}@example.com`;
-				await provider.passwordAuth!.createUserWithPassword(a, 'pass12345678');
-				await provider.passwordAuth!.createUserWithPassword(b, 'pass12345678');
-				const page = await provider.listUsers({ limit: 200 });
-				expect(page).toBeTruthy();
-				const emails = page!.items.map((u) => u.email);
-				expect(emails).toContain(a);
-				expect(emails).toContain(b);
-			});
-
-			it('deleteUser removes the user', async () => {
-				const { provider } = await createProvider();
-				const email = `del-${makeUuid()}@example.com`;
-				const created = await provider.passwordAuth!.createUserWithPassword(email, 'pass12345678');
-				const result = await provider.deleteUser(created.id);
-				expect(result).toBe('ok');
-				const fetched = await provider.getUser(created.id);
-				expect(fetched).toBeNull();
-			});
-
-			it('deleteUser returns not_found for unknown user', async () => {
-				const { provider } = await createProvider();
-				const result = await provider.deleteUser(makeUuid());
-				expect(result).toBe('not_found');
-			});
-
-			// Note: the §2 sole-`instance_admin` invariant is no longer enforced
-			// by IAuthProvider — it lives on IPlatformPermissionStore now and
-			// callers consult `countInstanceAdminsExcluding` before destructive
-			// ops. Auth-side delete/disable just deletes the identity and
-			// trusts the caller. See `runPlatformPermissionStoreConformance`
-			// for the invariant tests.
-
-			it('createUserWithPassword returns an identity record without profile fields', async () => {
-				const { provider } = await createProvider();
-				const user = await provider.passwordAuth!.createUserWithPassword(
-					`new-${makeUuid()}@example.com`,
-					'pass12345678'
-				);
-				// Profile state (starred, recentRuns, displayName) lives on
-				// IUserProfileStore. Platform permissions live on
-				// IPlatformPermissionStore. AuthUser is identity-only.
-				expect(
-					(user as unknown as { starredDefinitions?: unknown }).starredDefinitions
-				).toBeUndefined();
-				expect((user as unknown as { recentRuns?: unknown }).recentRuns).toBeUndefined();
-				expect((user as unknown as { displayName?: unknown }).displayName).toBeUndefined();
-				expect(
-					(user as unknown as { platformPermissions?: unknown }).platformPermissions
-				).toBeUndefined();
-			});
-
-			it('disableUser disables a user', async () => {
-				const { provider } = await createProvider();
-				const created = await provider.passwordAuth!.createUserWithPassword(
-					`disable-${makeUuid()}@example.com`,
-					'pass12345678'
-				);
-				const result = await provider.disableUser(created.id);
-				expect(result).toBe('ok');
-				const fetched = await provider.getUser(created.id);
-				expect(fetched?.disabled).toBe(true);
-			});
-
-			it('disableUser returns not_found for unknown user', async () => {
-				const { provider } = await createProvider();
-				const result = await provider.disableUser(makeUuid());
-				expect(result).toBe('not_found');
-			});
-		} else {
-			it('listUsers returns null when user management is not supported', async () => {
-				const { provider } = await createProvider();
-				const result = await provider.listUsers();
-				expect(result).toBeNull();
-			});
-
-			it('createUser (allowlist) is undefined when user management is not supported', async () => {
-				const { provider } = await createProvider();
-				expect(provider.createUser).toBeUndefined();
-			});
-
-			it('deleteUser returns not_supported', async () => {
-				const { provider } = await createProvider();
-				const result = await provider.deleteUser(makeUuid());
-				expect(result).toBe('not_supported');
-			});
-
-			it('disableUser returns not_supported', async () => {
-				const { provider } = await createProvider();
-				const result = await provider.disableUser(makeUuid());
-				expect(result).toBe('not_supported');
-			});
-		}
-	});
-}

package/src/testing/suites/computeServerStoreSuite.ts

@@ -1,195 +0,0 @@
-/**
- * Adapter conformance suite for IComputeServerStore.
- *
- * Architecture spec §4.8 — servers are scoped (platform vs. org-private), with a global
- * `defaultServerId` and per-org `orgDefaults`. The store surface exposes
- * scope-targeted mutations; visibility filtering is done by callers via
- * the pure helpers in `@selvajs/platform`.
- */
-
-import { describe, it, expect } from 'vitest';
-import type { IComputeServerStore } from '../../computeServer/interface.js';
-import type {
-	ComputeServerConfig,
-	OrgComputeServer,
-	PlatformComputeServer
-} from '../../computeServer/types.js';
-import { isOrgServer, isPlatformServer } from '../../computeServer/types.js';
-import { SYSTEM_CONTEXT } from '../../context.js';
-import { makeUuid } from './helpers.js';
-
-export interface ComputeServerStoreConformanceOptions {
-	name: string;
-	createStore: () => Promise<IComputeServerStore> | IComputeServerStore;
-	/**
-	 * Optional hook adapters with FK constraints use to seed an `orgs` row
-	 * before the suite writes an org-scoped compute config that FK-references
-	 * it. Adapters without org FKs (local JSON) can omit this.
-	 */
-	seedOrg?: (orgId: string) => Promise<void>;
-}
-
-function platformServer(
-	overrides: Partial<Omit<PlatformComputeServer, 'scope'>> = {}
-): PlatformComputeServer {
-	return {
-		id: overrides.id ?? makeUuid(),
-		scope: 'platform',
-		sharedWith: overrides.sharedWith ?? 'all',
-		label: overrides.label ?? 'Test Server',
-		serverUrl: overrides.serverUrl ?? 'http://localhost:5000',
-		apiKey: overrides.apiKey,
-		timeoutMs: overrides.timeoutMs,
-		retryCount: overrides.retryCount
-	};
-}
-
-function orgServer(
-	ownerOrgId: string,
-	overrides: Partial<Omit<OrgComputeServer, 'scope' | 'ownerOrgId'>> = {}
-): OrgComputeServer {
-	return {
-		id: overrides.id ?? makeUuid(),
-		scope: 'org',
-		ownerOrgId,
-		label: overrides.label ?? 'Org Server',
-		serverUrl: overrides.serverUrl ?? 'http://localhost:5001',
-		apiKey: overrides.apiKey,
-		timeoutMs: overrides.timeoutMs,
-		retryCount: overrides.retryCount
-	};
-}
-
-export function runComputeServerStoreConformance(opts: ComputeServerStoreConformanceOptions): void {
-	const { name, createStore, seedOrg } = opts;
-	const seed = async (): Promise<string> => {
-		const id = makeUuid();
-		if (seedOrg) await seedOrg(id);
-		return id;
-	};
-
-	describe(`IComputeServerStore conformance: ${name}`, () => {
-		it('savePlatformServers + getConfig round-trips servers and defaultServerId', async () => {
-			const store = await createStore();
-			const s1 = platformServer({ label: 'Primary' });
-			const s2 = platformServer({ label: 'Secondary', apiKey: 'secret' });
-			await store.savePlatformServers(SYSTEM_CONTEXT, [s1, s2], s1.id);
-
-			const got = await store.getConfig(SYSTEM_CONTEXT);
-			const platformIds = got.servers.filter(isPlatformServer).map((s) => s.id);
-			expect(platformIds.sort()).toEqual([s1.id, s2.id].sort());
-			expect(got.defaultServerId).toBe(s1.id);
-		});
-
-		it('savePlatformServers replaces the previous platform set', async () => {
-			const store = await createStore();
-			await store.savePlatformServers(
-				SYSTEM_CONTEXT,
-				[platformServer({ label: 'Old' })],
-				undefined
-			);
-
-			const newS = platformServer({ label: 'New' });
-			await store.savePlatformServers(SYSTEM_CONTEXT, [newS], newS.id);
-
-			const got = await store.getConfig(SYSTEM_CONTEXT);
-			const platformIds = got.servers.filter(isPlatformServer).map((s) => s.id);
-			expect(platformIds).toEqual([newS.id]);
-		});
-
-		it('getConfig on empty returns an empty servers list', async () => {
-			const store = await createStore();
-			const got = await store.getConfig(SYSTEM_CONTEXT);
-			expect(Array.isArray(got.servers)).toBe(true);
-		});
-
-		// ============================================================================
-		// Org-private servers + orgDefaults (Architecture spec §4.8)
-		// ============================================================================
-
-		it('saveOrgServers stores rows owned by the org', async () => {
-			const store = await createStore();
-			const orgId = await seed();
-			const s = orgServer(orgId, { label: "Org's BYO" });
-			await store.saveOrgServers(SYSTEM_CONTEXT, orgId, [s], s.id);
-
-			const got = await store.getConfig(SYSTEM_CONTEXT);
-			const ownRows = got.servers.filter(
-				(row): row is OrgComputeServer => isOrgServer(row) && row.ownerOrgId === orgId
-			);
-			expect(ownRows.map((r) => r.id)).toEqual([s.id]);
-			expect(got.orgDefaults?.[orgId]).toBe(s.id);
-		});
-
-		it('saveOrgServers does not clobber platform rows (and vice versa)', async () => {
-			const store = await createStore();
-			const orgId = await seed();
-			const platS = platformServer({ label: 'Platform' });
-			const orgS = orgServer(orgId, { label: 'Org' });
-
-			await store.savePlatformServers(SYSTEM_CONTEXT, [platS], platS.id);
-			await store.saveOrgServers(SYSTEM_CONTEXT, orgId, [orgS], orgS.id);
-
-			// Replacing the platform set should leave org rows untouched.
-			const replacement = platformServer({ label: 'Replacement' });
-			await store.savePlatformServers(SYSTEM_CONTEXT, [replacement], replacement.id);
-
-			const got = await store.getConfig(SYSTEM_CONTEXT);
-			const platformIds = got.servers.filter(isPlatformServer).map((s) => s.id);
-			expect(platformIds).toEqual([replacement.id]);
-			const orgIds = got.servers
-				.filter((s): s is OrgComputeServer => isOrgServer(s) && s.ownerOrgId === orgId)
-				.map((s) => s.id);
-			expect(orgIds).toEqual([orgS.id]);
-			expect(got.defaultServerId).toBe(replacement.id);
-			expect(got.orgDefaults?.[orgId]).toBe(orgS.id);
-		});
-
-		it('setOrgDefault updates and clears the per-org default', async () => {
-			const store = await createStore();
-			const orgId = await seed();
-			const s = orgServer(orgId);
-			await store.saveOrgServers(SYSTEM_CONTEXT, orgId, [s]);
-
-			await store.setOrgDefault(SYSTEM_CONTEXT, orgId, s.id);
-			let got = await store.getConfig(SYSTEM_CONTEXT);
-			expect(got.orgDefaults?.[orgId]).toBe(s.id);
-
-			await store.setOrgDefault(SYSTEM_CONTEXT, orgId, null);
-			got = await store.getConfig(SYSTEM_CONTEXT);
-			expect(got.orgDefaults?.[orgId]).toBeUndefined();
-		});
-
-		it('deleteByOrg removes org-private rows and the orgDefaults entry', async () => {
-			const store = await createStore();
-			const orgId = await seed();
-			const orgS = orgServer(orgId);
-			await store.saveOrgServers(SYSTEM_CONTEXT, orgId, [orgS], orgS.id);
-
-			await store.deleteByOrg(SYSTEM_CONTEXT, orgId);
-
-			const got = await store.getConfig(SYSTEM_CONTEXT);
-			const remaining = got.servers.filter(
-				(s): s is ComputeServerConfig => isOrgServer(s) && s.ownerOrgId === orgId
-			);
-			expect(remaining).toEqual([]);
-			expect(got.orgDefaults?.[orgId]).toBeUndefined();
-		});
-
-		it('deleteByOrg strips this org from platform sharedWith allowlists', async () => {
-			const store = await createStore();
-			const orgId = await seed();
-			const otherOrgId = await seed();
-			const platS = platformServer({ sharedWith: [orgId, otherOrgId] });
-			await store.savePlatformServers(SYSTEM_CONTEXT, [platS], platS.id);
-
-			await store.deleteByOrg(SYSTEM_CONTEXT, orgId);
-
-			const got = await store.getConfig(SYSTEM_CONTEXT);
-			const found = got.servers.find(
-				(s): s is PlatformComputeServer => isPlatformServer(s) && s.id === platS.id
-			);
-			expect(found?.sharedWith).toEqual([otherOrgId]);
-		});
-	});
-}