@server/next 0.20.9 → 0.20.10

package/index.d.ts

@@ -15,6 +15,7 @@ type ServerOptions = {
   views?: string | Bucket;
   public?: string | Bucket;
   uploads?: string | Bucket;
+  auth?: string | { type: string; provider: string };
 };
 
 type Context = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.20.9",
+  "version": "0.20.10",
   "description": "An experimental reimplementation of server.js focused on the DX",
   "homepage": "https://node-server.com/",
   "repository": "https://github.com/franciscop/server-next.git",
@@ -9,7 +9,6 @@
   "author": "Francisco Presencia <public@francisco.io> (https://francisco.io/)",
   "license": "UNLICENSED",
   "scripts": {
-    "demo": "nodemon ./demo/src/index.js",
     "start": "bun test --watch",
     "test": "bun test",
     "test:jest": "node --experimental-vm-modules node_modules/jest/bin/jest.js"

package/readme.md

@@ -2,8 +2,6 @@
 
 > **⚠️ WIP** This is an **experimental library** right now!
 
-[**Documentation Here**](https://node-server.com/documentation/)
-
 A fully-fledged web server for Bun and Node.js, with all the basics covered for you:
 
 ```js
@@ -26,11 +24,11 @@ It includes all the things you would expect from a modern Server framework, like
 ```js
 // Easy testing as well - index.test.js
 import app from "./";
+const api = app.test();  // Very convenient helper, AXIOS-like interface
 
 it("can retrieve the homepage", async () => {
-  const res = await app.fetch(new Request("http://localhost:3000/books/"));
-  const books = await res.json();
-  expect(books[0]).toEqual({ id: 0, name: 'The Catcher In The Rye', ... });
+  const { data: books } = await api.get("/books/");
+  expect(books[0]).toEqual({ id: 0, name: ... });
 });
 ```
 
@@ -56,6 +54,8 @@ Why? We live in the era of multi-cloud (Heroku, Workers, Lambda, etc) and multi-
   - A readStream and it'll be piped to the response
   - An object with `status`, `body` and `headers` and it'll be set raw.
 - Response compression works
+- Zod light integration
+- Auth work
 
 ## Examples
 

package/src/auth/NoSession.js

@@ -0,0 +1,18 @@
+import { ServerError } from "../index.js";
+
+class NoSession {}
+
+export default new Proxy(NoSession, {
+  get(target, key) {
+    if (target[key]) return target[key];
+    if (key === "then") return target[key];
+    throw ServerError.NO_STORE_READ({ key });
+  },
+  set(target, key, value) {
+    if (target[key] || key === "then") {
+      target[key] = value;
+    } else {
+      throw ServerError.NO_STORE_WRITE({ key });
+    }
+  },
+});

package/src/auth/auth-cookie.test.js

@@ -0,0 +1,41 @@
+import "../test/toSucceed.js";
+
+import kv from "polystore";
+
+import server from "../index.js";
+
+describe("user creation flow", () => {
+  // These are obviously mock data
+  const EMAIL = "abc@test.com";
+  const PASS = "11111111";
+  const CREDENTIALS = { email: EMAIL, password: PASS };
+
+  const store = kv(new Map());
+  const api = server({ store, auth: "cookie:email" })
+    .get("/me", (ctx) => ctx.user || "No data")
+    .test();
+
+  it("can create a new user", async () => {
+    const register = await api.post("/auth/register/email", CREDENTIALS);
+    expect(register).toSucceed();
+    expect(await store.keys()).toEqual([
+      "user:abc@test.com",
+      "auth:" + register.headers["set-cookie"].split("=")[1],
+    ]);
+
+    const me = await api.get("/me");
+    expect(me).toSucceed();
+    expect(me.data.email).toEqual(EMAIL);
+
+    const logout = await api.post("/auth/logout");
+    expect(logout).toSucceed();
+    expect(await store.keys()).toEqual(["user:abc@test.com"]);
+
+    const login = await api.post("/auth/login/email", CREDENTIALS);
+    expect(login).toSucceed();
+    expect(await store.keys()).toEqual([
+      "user:abc@test.com",
+      "auth:" + login.headers["set-cookie"].split("=")[1],
+    ]);
+  });
+});

package/src/auth/auth-token.test.js

@@ -0,0 +1,42 @@
+import "../test/toSucceed.js";
+
+import kv from "polystore";
+
+import server from "../index.js";
+
+describe("user creation flow", () => {
+  // These are obviously mock data
+  const EMAIL = "abc@test.com";
+  const PASS = "11111111";
+  const CREDENTIALS = { email: EMAIL, password: PASS };
+
+  const store = kv(new Map());
+  const api = server({ store, auth: "token:email" })
+    .get("/me", (ctx) => ctx.user || "No data")
+    .test();
+
+  it("can create a new user", async () => {
+    const register = await api.post("/auth/register/email", CREDENTIALS);
+    expect(register).toSucceed();
+    expect(await store.keys()).toEqual([
+      "user:abc@test.com",
+      "auth:" + register.data.token,
+    ]);
+
+    const headers = { authorization: "Bearer " + register.data.token };
+    const me = await api.get("/me", { headers });
+    expect(me).toSucceed();
+    expect(me.data.email).toEqual(EMAIL);
+
+    const logout = await api.post("/auth/logout", {}, { headers });
+    expect(logout).toSucceed();
+    expect(await store.keys()).toEqual(["user:abc@test.com"]);
+
+    const login = await api.post("/auth/login/email", CREDENTIALS);
+    expect(login).toSucceed();
+    expect(await store.keys()).toEqual([
+      "user:abc@test.com",
+      "auth:" + login.data.token,
+    ]);
+  });
+});

package/src/auth/auth.js

@@ -0,0 +1,52 @@
+import { ServerError } from "../index.js";
+
+const validateToken = (authorization) => {
+  const [type, id] = authorization.trim().split(" ");
+  if (type.toLowerCase() !== "bearer") {
+    throw ServerError.AUTH_INVALID_TYPE({ type });
+  }
+  if (id.length !== 24) {
+    throw ServerError.AUTH_INVALID_TOKEN();
+  }
+  return id;
+};
+
+const validateCookie = (authorization) => {
+  if (authorization.length !== 24) {
+    throw ServerError.AUTH_INVALID_COOKIE();
+  }
+  return authorization;
+};
+
+const findSessionId = (ctx) => {
+  const type = ctx.options.auth.type;
+
+  if (type === "token") {
+    // If the user is not authenticated, there's no auth to retrieve
+    if (!ctx.headers.authorization) return;
+
+    // Check the authentication header
+    return validateToken(ctx.headers.authorization);
+  }
+
+  if (type === "cookie") {
+    // If the user is not authenticated, there's no auth to retrieve
+    if (!ctx.cookies.authorization) return;
+
+    return validateCookie(ctx.cookies.authorization);
+  }
+
+  throw new Error("Invalid auth type " + type);
+};
+
+export default async function findAuth(ctx) {
+  if (!ctx.options.auth) return; // NO AUTH AT ALL; nothing to do here
+  const options = ctx.options.auth;
+
+  const sessionId = findSessionId(ctx);
+  if (!sessionId) return; // NO SESSION FOUND; no auth
+
+  const auth = await options.session.get(sessionId);
+  if (!auth) throw ServerError.AUTH_NO_SESSION();
+  return auth;
+}

package/src/auth/index.js

@@ -0,0 +1,24 @@
+import auth from "./auth.js";
+import logout from "./logout.js";
+import providers from "./providers/index.js";
+import session from "./session.js";
+import user from "./user.js";
+
+const load = async (ctx) => {
+  ctx.session = await session(ctx);
+  ctx.auth = await auth(ctx);
+  ctx.user = await user(ctx);
+};
+
+const middle = async (ctx) => {
+  if (ctx.options.auth) {
+    ctx.app.post("/auth/logout", logout);
+
+    if (ctx.options.auth.provider.includes("email")) {
+      ctx.app.post("/auth/register/email", providers.email.register);
+      ctx.app.post("/auth/login/email", providers.email.login);
+    }
+  }
+};
+
+export default { load, middle };

package/src/auth/index.test.js

@@ -0,0 +1,123 @@
+import "../test/toSucceed.js";
+
+import kv from "polystore";
+
+import server from "../index.js";
+
+const ID = "REqA2l022l8Q0tuIRtqLOPUy";
+
+describe("auth", () => {
+  it("requires a provider", () => {
+    const store = kv(new Map());
+    const api = server({ store, auth: "token:email" })
+      .get("/", (ctx) => ctx.auth)
+      .test();
+  });
+
+  it("provider must belong", async () => {
+    const store = kv(new Map());
+    const api = server({ store, auth: "token:email" })
+      .get("/", (ctx) => ctx.auth)
+      .test();
+
+    store.set(`auth:${ID}`, {
+      id: ID,
+      type: "token",
+      provider: "wrong",
+      user: "QypOn5SQApyOPdUpIZsO9u2O",
+      email: "abc@test.com",
+      time: "2024-07-01T03:21:40Z",
+    });
+    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed(
+      'Invalid provider "wrong", valid ones are: "email"'
+    );
+  });
+});
+
+describe("token", () => {
+  const store = kv(new Map());
+  const api = server({ store, auth: "token:email" })
+    .get("/", (ctx) => ctx.auth)
+    .test();
+
+  afterEach(async () => {
+    await store.del(`auth:${ID}`);
+  });
+
+  it("should be Bearer", async () => {
+    const authorization = "Basic REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed("Invalid Authorization type, 'Basic'");
+  });
+
+  it("should have the proper token", async () => {
+    const authorization = "Bearer hola";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed("Invalid Authorization token");
+  });
+
+  it("cannot get the session", async () => {
+    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed("Invalid session");
+  });
+
+  it("cannot get the user", async () => {
+    store.set(`auth:${ID}`, {
+      id: ID,
+      type: "token",
+      provider: "email",
+      user: "QypOn5SQApyOPdUpIZsO9u2O",
+      email: "abc@test.com",
+      time: "2024-07-01T03:21:40Z",
+    });
+    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).not.toSucceed("Credentials do not correspond to a user");
+  });
+
+  it("cannot get the user", async () => {
+    store.set("auth:REqA2l022l8Q0tuIRtqLOPUy", {
+      id: "REqA2l022l8Q0tuIRtqLOPUy",
+      type: "token",
+      provider: "email",
+      user: "QypOn5SQApyOPdUpIZsO9u2O",
+      email: "abc@test.com",
+      time: "2024-07-01T03:21:40Z",
+    });
+    store.set("user:abc@test.com", {
+      id: "QypOn5SQApyOPdUpIZsO9u2O",
+      email: "abc@test.com",
+    });
+    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { authorization } });
+    expect(req).toSucceed();
+  });
+});
+
+describe("cookie", () => {
+  const store = kv(new Map());
+  const api = server({ store, auth: "cookie:email" })
+    .get("/", (ctx) => ctx.auth)
+    .test();
+
+  it("should have the proper token in email", async () => {
+    const cookie = "authorization=hello";
+    const req = await api.get("/", { headers: { cookie } });
+    expect(req).not.toSucceed("Invalid Authorization cookie");
+  });
+
+  it("can get the proper session", async () => {
+    const cookie = "authorization=REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { cookie } });
+    expect(req).not.toSucceed("Invalid session");
+  });
+
+  it("can get the proper session", async () => {
+    const cookie = "authorization=REqA2l022l8Q0tuIRtqLOPUy";
+    const req = await api.get("/", { headers: { cookie } });
+    expect(req).not.toSucceed();
+  });
+});

package/src/auth/logout.js

@@ -0,0 +1,18 @@
+import { cookies } from "../reply.js";
+
+export default async function logout(ctx) {
+  const { id, type } = ctx.auth;
+  await ctx.options.auth.session.del(id);
+
+  if (type === "token") {
+    return { token: null };
+  } else if (type === "cookie") {
+    return cookies({ authorization: null }).send({});
+  } else if (type === "jwt") {
+    throw new Error("JWT auth not supported yet");
+  } else if (type === "key") {
+    throw new Error("Key auth not supported yet");
+  } else {
+    throw new Error("Unknown auth type");
+  }
+}

package/src/auth/providers/email.js

@@ -0,0 +1,73 @@
+import argon2 from "argon2";
+
+import { createId } from "../../helpers/index.js";
+import { ServerError, status } from "../../index.js";
+
+const createSession = async (user, ctx) => {
+  const { type, session, cleanUser } = ctx.options.auth;
+  user = cleanUser(user);
+  const token = createId();
+  const provider = "email";
+  const time = new Date().toISOString().replace(/\.[0-9]*/, "");
+  ctx.auth = {
+    id: token,
+    type,
+    provider,
+    user: user.id,
+    email: user.email,
+    time,
+  };
+  await session.set(token, ctx.auth, { expires: "1w" });
+
+  if (type === "token") {
+    return status(201).json({ ...user, token });
+  } else if (type === "cookie") {
+    return status(201).cookies({ authorization: token }).send(user);
+  } else if (type === "jwt") {
+    throw new Error("JWT auth not supported yet");
+  } else if (type === "key") {
+    throw new Error("Key auth not supported yet");
+  } else {
+    throw new Error("Unknown auth type");
+  }
+};
+
+async function login(ctx) {
+  const { email, password } = ctx.body;
+  if (!email) throw ServerError.LOGIN_NO_EMAIL();
+  if (!/@/.test(email)) throw ServerError.LOGIN_INVALID_EMAIL();
+  if (!password) throw ServerError.LOGIN_NO_PASSWORD();
+  if (password.length < 8) throw ServerError.LOGIN_INVALID_PASSWORD();
+
+  const store = ctx.options.auth.store;
+  if (!(await store.has(email))) throw ServerError.LOGIN_WRONG_EMAIL();
+
+  const user = await store.get(email);
+  const isValid = await argon2.verify(user.password, password);
+  if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();
+
+  return createSession(user, ctx);
+}
+
+async function register(ctx) {
+  const { email, password, ...data } = ctx.body;
+  if (!email) throw ServerError.REGISTER_NO_EMAIL();
+  if (!/@/.test(email)) throw ServerError.REGISTER_INVALID_EMAIL();
+  if (!password) throw ServerError.REGISTER_NO_PASSWORD();
+  if (password.length < 8) throw ServerError.REGISTER_INVALID_PASSWORD();
+
+  const store = ctx.options.auth.store;
+  if (await store.has(email)) throw ServerError.REGISTER_EMAIL_EXISTS();
+
+  const user = {
+    id: createId(),
+    email,
+    password: await argon2.hash(password),
+    ...data,
+  };
+  await store.set(email, user);
+
+  return createSession(user, ctx);
+}
+
+export default { login, register };

package/src/auth/providers/index.js

@@ -0,0 +1,3 @@
+import { default as email } from "./email.js";
+
+export default { email };

package/src/auth/session.js

@@ -0,0 +1,18 @@
+import NoSession from "./NoSession.js";
+
+export default async function session(ctx) {
+  const store = ctx.options.session?.store;
+
+  // If there's no store at all, we don't have session available;
+  // but that's okay, since it's only a problem if you try to use it
+  if (!store) return NoSession;
+
+  // There's a session cookie; use it as the key to get the data
+  // from the store
+  if (ctx.cookies.session) {
+    const session = await store.get(ctx.cookies.session);
+    if (session) return session;
+  }
+
+  return {};
+}

package/src/auth/user.js

@@ -0,0 +1,21 @@
+import ServerError from "../ServerError";
+
+const findUser = async (auth, options) => {
+  if (!auth.provider) throw ServerError.AUTH_NO_PROVIDER();
+  if (!options.provider.includes(auth.provider)) {
+    const valid = JSON.stringify(options.provider);
+    throw ServerError.AUTH_INVALID_PROVIDER({ provider: auth.provider, valid });
+  }
+
+  if (auth.provider === "email") {
+    return await options.store.get(auth.email);
+  }
+};
+
+export default async function user(ctx) {
+  if (!ctx.auth) return;
+
+  const user = await findUser(ctx.auth, ctx.options.auth);
+  if (!user) throw ServerError.AUTH_NO_USER();
+  return ctx.options.auth.cleanUser(user);
+}

package/src/context/node.js

@@ -1,9 +1,14 @@
+import auth from "../auth/index.js";
 import { define } from "../helpers/index.js";
-import findAuth from "./findAuth.js";
-import findSession from "./findSession.js";
 import parseBody from "./parseBody.js";
 import parseCookies from "./parseCookies.js";
 
+// https://stackoverflow.com/a/54029307/938236
+const chunkArray = (arr, size) =>
+  arr.length > size
+    ? [arr.slice(0, size), ...chunkArray(arr.slice(size), size)]
+    : [arr];
+
 export default async (request, options = {}, app) => {
   const ctx = {};
   ctx.options = options;
@@ -11,10 +16,9 @@ export default async (request, options = {}, app) => {
   ctx.res = { status: null, headers: {}, cookies: {} };
   ctx.method = request.method.toLowerCase();
 
-  ctx.headers = request.headers;
+  ctx.headers = parseHeaders(new Headers(chunkArray(request.rawHeaders, 2)));
   ctx.cookies = parseCookies(ctx.headers.cookie);
-  ctx.session = await findSession(ctx);
-  await findAuth(ctx);
+  await auth.load(ctx);
 
   const https = request.connection.encrypted ? "https" : "http";
   const host = ctx.headers.host || "localhost" + options.port;

package/src/context/winter.js

@@ -1,6 +1,5 @@
-import { define } from "../helpers/index.js";
-import findAuth from "./findAuth.js";
-import findSession from "./findSession.js";
+import auth from "../auth/index.js";
+import { define, parseHeaders } from "../helpers/index.js";
 import parseBody from "./parseBody.js";
 import parseCookies from "./parseCookies.js";
 
@@ -11,10 +10,9 @@ export default async (request, options = {}, app) => {
   ctx.res = { status: null, headers: {}, cookies: {} };
   ctx.method = request.method.toLowerCase();
 
-  ctx.headers = Object.fromEntries(request.headers.entries());
+  ctx.headers = parseHeaders(request.headers);
   ctx.cookies = parseCookies(ctx.headers.cookie);
-  ctx.session = await findSession(ctx);
-  await findAuth(ctx);
+  await auth.load(ctx);
 
   ctx.url = new URL(request.url.replace(/\/$/, ""));
   define(ctx.url, "query", (url) =>

package/src/errors/index.js

@@ -6,6 +6,14 @@ ServerError.extend({
   NO_STORE_READ: `You need a 'store' to read 'ctx.session.{key}'`,
   AUTH_INVALID_TYPE: `Invalid Authorization type, '{type}'`,
   AUTH_INVALID_TOKEN: `Invalid Authorization token`,
+  AUTH_INVALID_COOKIE: `Invalid Authorization cookie`,
+  AUTH_NO_PROVIDER: `No provider passed to the option "auth.provider"`,
+  AUTH_INVALID_PROVIDER: `Invalid provider "{provider}", valid ones are: {valid}`,
+  AUTH_NO_SESSION: { status: 401, message: "Invalid session" },
+  AUTH_NO_USER: {
+    status: 401,
+    message: "Credentials do not correspond to a user",
+  },
 
   LOGIN_NO_EMAIL: "The email is required to log in",
   LOGIN_INVALID_EMAIL: "The email you wrote is not correct",
@@ -13,6 +21,12 @@ ServerError.extend({
   LOGIN_INVALID_PASSWORD: "The email you wrote is not correct",
   LOGIN_WRONG_ACCOUNT: `That email does not correspond to any account`,
   LOGIN_WRONG_PASSWORD: `That is not the valid password`,
+
+  REGISTER_NO_EMAIL: `Email needed`,
+  REGISTER_INVALID_EMAIL: "The email you wrote is not correct",
+  REGISTER_NO_PASSWORD: `Password needed`,
+  REGISTER_INVALID_PASSWORD: "The email you wrote is not correct",
+  REGISTER_EMAIL_EXISTS: `Email is already registered`,
 });
 
 export default ServerError;

package/src/helpers/createCookies.js

@@ -2,10 +2,15 @@
 export default function createCookies(cookies) {
   if (!cookies || !Object.keys(cookies).length) return [];
   return Object.entries(cookies).map(([key, val]) => {
+    if (!val) {
+      val = { value: "", expires: new Date(0).toUTCString() };
+    }
     if (typeof val === "string") {
-      val = { value: val, path };
+      val = { value: val };
     }
-    const { value, path } = val;
-    return `${key}=${value}${path ? ";Path=" + path : ""}`;
+    const { value, path, expires } = val;
+    const pathPart = path ? ";Path=" + path : "";
+    const expiresPart = expires ? ";Expires=" + expires : "";
+    return `${key}=${value || ""}${pathPart}${expiresPart}`;
   });
 }

package/src/helpers/index.js

@@ -4,4 +4,5 @@ export { default as define } from "./define.js";
 export { default as getMachine } from "./getMachine.js";
 export { default as handleRequest } from "./handleRequest.js";
 export { default as iterate } from "./iterate.js";
+export { default as parseHeaders } from "./parseHeaders.js";
 export { default as types } from "./types.js";

package/src/helpers/parseHeaders.js

@@ -0,0 +1,15 @@
+export default (raw) => {
+  const headers = {};
+  for (let [key, value] of raw.entries()) {
+    key = key.toLowerCase();
+    if (headers[key]) {
+      if (!Array.isArray(headers[key])) {
+        headers[key] = [headers[key]];
+      }
+      headers[key].push(value);
+    } else {
+      headers[key] = value;
+    }
+  }
+  return headers;
+};

package/src/index.js

@@ -10,6 +10,7 @@ import {
   getMachine,
   handleRequest,
   iterate,
+  parseHeaders,
 } from "./helpers/index.js";
 import middle from "./middle/index.js";
 
@@ -59,13 +60,34 @@ const validateOptions = (options, env = {}) => {
   if (options.store && options.cookies) {
     options.session = { store: options.store.prefix("session:") };
   }
-  options.auth = options.auth || {};
+
+  // AUTH
+  options.auth = options.auth || env.AUTH || null;
   if (options.auth) {
     if (typeof options.auth !== "object") {
-      options.auth = { type: options.auth };
+      const [type, provider] = options.auth.split(":");
+      options.auth = { type, provider };
+    }
+    if (typeof options.auth.provider === "string") {
+      options.auth.provider === options.auth.provider.split("|");
+    }
+    if (!options.auth.type) {
+      throw new Error("Auth options needs a type");
+    }
+    if (!options.auth.provider) {
+      throw new Error("Auth options needs a provider");
+    }
+    if (!options.auth.session && options.store) {
+      options.auth.session = options.store.prefix("auth:");
     }
     if (!options.auth.store && options.store) {
-      options.auth.store = options.store.prefix("auth:");
+      options.auth.store = options.store.prefix("user:");
+    }
+    if (!options.auth.cleanUser) {
+      options.auth.cleanUser = (fullUser) => {
+        const { password, ...user } = fullUser;
+        return user;
+      };
     }
   }
 
@@ -212,17 +234,7 @@ server.prototype.test = function () {
       new Request("http://localhost:3000" + path, options)
     );
 
-    const headers = {};
-    for (const [key, value] of res.headers.entries()) {
-      if (headers[key]) {
-        if (!Array.isArray(headers[key])) {
-          headers[key] = [headers[key]];
-        }
-        headers[key].push(value);
-      } else {
-        headers[key] = value;
-      }
-    }
+    const headers = parseHeaders(res.headers);
     let data;
     if (headers["set-cookie"]) {
       // TODO: this should really be a smart merge of the 2
@@ -236,6 +248,7 @@ server.prototype.test = function () {
     return { status: res.status, headers, data };
   };
   return {
+    app: this,
     get: (path, options) => fetch(path, { method: "get", ...options }),
     head: (path, options) => fetch(path, { method: "head", ...options }),
     post: (path, body, options) =>

package/src/index.test.js

@@ -1,3 +1,5 @@
+import "./test/toSucceed.js";
+
 import server, { status } from "./index.js";
 
 describe("return different types", () => {
@@ -20,13 +22,14 @@ describe("return different types", () => {
   });
 
   it("can get the object", async () => {
-    const { data } = await api.get("/object");
-    expect(data).toEqual({ hello: "world" });
+    const req = await api.get("/object");
+    expect(req).toSucceed({ hello: "world" });
   });
 
   it("can get the status", async () => {
-    const { status } = await api.get("/status");
-    expect(status).toBe(201);
+    const req = await api.get("/status");
+    expect(req).toSucceed();
+    expect(req.status).toBe(201);
   });
 });
 

package/src/middle/assets.js

@@ -0,0 +1,12 @@
+import { type } from "../reply.js";
+
+export default async function assets(ctx) {
+  try {
+    // TODO: streaming
+    const asset = await ctx.options.public.read(ctx.url.pathname);
+    if (!asset) return;
+    return type(ctx.url.pathname.split(".").pop()).send(asset);
+  } catch (error) {
+    // NO-OP; if there's no file, keep going the normal flow
+  }
+}

package/src/middle/index.js

@@ -1,71 +1,12 @@
-import argon2 from "argon2";
+import auth from "../auth/index.js";
+import assets from "./assets.js";
 
-import { createId } from "../helpers/index.js";
-import { status, type } from "../reply.js";
-import ServerError from "../ServerError.js";
-
-export default function middle(ctx) {
+export default async function middle(ctx) {
+  // Serve assets
   if (ctx.options.public) {
-    ctx.app.handlers.get.unshift([
-      "*",
-      "*",
-      async function publicFolder(ctx) {
-        try {
-          const asset = await ctx.options.public.read(ctx.url.pathname);
-          if (asset) {
-            return type(ctx.url.pathname.split(".").pop()).send(asset);
-          }
-        } catch (error) {}
-      },
-    ]);
+    // We need these before other endpoints
+    ctx.app.handlers.get.unshift(["*", "*", assets]);
   }
 
-  if (!ctx.auth) return;
-  if (ctx.auth?.providers?.includes("email")) {
-    ctx.app.post("/auth/register/email", async (ctx) => {
-      const { email, password, ...data } = ctx.body;
-      if (!email || !/@/.test(email)) throw new Error("Email needed");
-      if (!password || password.length < 8) throw new Error("Password needed");
-      if (await ctx.auth.store.has(email)) {
-        throw new Error("Email is already registered");
-      }
-      const id = createId();
-      const time = new Date().toISOString();
-      const pass = await argon2.hash(password);
-      await ctx.auth.store.set(email, { id, email, password: pass, ...data });
-
-      // TYPE GOES HERE
-      const token = await ctx.options.session.store.add({ id, email, time });
-      return status(201).json({ id, token, email, ...data });
-    });
-
-    ctx.app.post("/auth/logout", async (ctx) => {
-      if (ctx.auth.id) {
-        await ctx.options.session.store.del(ctx.auth.id);
-      }
-      return status(200).send();
-    });
-
-    ctx.app.post("/auth/login/email", async (ctx) => {
-      const { email, password } = ctx.body;
-      if (!email) throw ServerError.LOGIN_NO_EMAIL();
-      if (!/@/.test(email)) throw ServerError.LOGIN_INVALID_EMAIL();
-      if (!password) throw ServerError.LOGIN_NO_PASSWORD();
-      if (password.length < 8) throw ServerError.LOGIN_INVALID_PASSWORD();
-
-      const time = new Date().toISOString();
-      const user = await ctx.auth.store.get(email);
-      if (!user) throw ServerError.LOGIN_WRONG_EMAIL();
-      const isValid = await argon2.verify(user.password, password);
-      if (!isValid) throw ServerError.LOGIN_WRONG_PASSWORD();
-
-      // TYPE GOES HERE
-      const token = await ctx.options.session.store.add({
-        id: user.id,
-        email,
-        time,
-      });
-      return { id: user.id, token, email };
-    });
-  }
+  await auth.middle(ctx);
 }

package/src/test/toSucceed.js

@@ -0,0 +1,64 @@
+import { expect } from "@jest/globals";
+
+const reset = "\x1b[0m";
+
+const spaceOrEnter = (msg) => {
+  if (typeof msg === "string") {
+    return " ";
+  }
+  return "\n";
+};
+
+export default function toSucceed(request, message) {
+  const pass = request.status >= 200 && request.status < 300;
+
+  if (message && JSON.stringify(request.data) !== JSON.stringify(message)) {
+    if (pass) {
+      return {
+        message: () =>
+          `${reset}Expected body:${spaceOrEnter(
+            message
+          )}${this.utils.printExpected(message)}\nReceived body:${spaceOrEnter(
+            request.data
+          )}${this.utils.printReceived(request.data)}`,
+        pass,
+      };
+    }
+
+    return {
+      message: () =>
+        `${reset}Expected error:${spaceOrEnter(
+          message
+        )}${this.utils.printExpected(message)}\nReceived error:${spaceOrEnter(
+          request.data
+        )}${this.utils.printReceived(request.data)}`,
+      pass: !pass,
+    };
+  }
+
+  if (pass) {
+    return {
+      message: () =>
+        `${reset}Expected ${this.utils.printExpected(
+          request.status
+        )} to be an error code, received body:\n${this.utils.printExpected(
+          request.data
+        )}`,
+      pass: true,
+    };
+  }
+
+  return {
+    message: () =>
+      `${reset}Expected ${this.utils.printReceived(
+        request.status
+      )} to succeed, received body:\n${this.utils.printReceived(
+        request.data,
+        null,
+        2
+      )}`,
+    pass: false,
+  };
+}
+
+expect.extend({ toSucceed });

package/src/auth.test.js

@@ -1,62 +0,0 @@
-import kv from "polystore";
-
-import server from "./index.js";
-
-describe("auth", () => {
-  const store = kv(new Map());
-  const api = server({ store })
-    .get("/", (ctx) => ctx.headers.authorization)
-    .test();
-
-  it("should be Bearer", async () => {
-    const authorization = "Basic REqA2l022l8Q0tuIRtqLOPUy";
-    const { data } = await api.get("/", { headers: { authorization } });
-    expect(data).toBe("Invalid Authorization type, 'Basic'");
-  });
-
-  it("should have the proper token", async () => {
-    const authorization = "Bearer hola";
-    const { data } = await api.get("/", { headers: { authorization } });
-    expect(data).toBe("Invalid Authorization token");
-  });
-
-  it("can get the nested get", async () => {
-    const authorization = "Bearer REqA2l022l8Q0tuIRtqLOPUy";
-    const { data } = await api.get("/", { headers: { authorization } });
-    expect(data).toBe("Bearer REqA2l022l8Q0tuIRtqLOPUy");
-  });
-});
-
-describe("user creation flow", () => {
-  // These are obviously mock data
-  const EMAIL = "abc@test.com";
-  const PASS = "11111111";
-  const CREDENTIALS = { email: EMAIL, password: PASS };
-
-  const store = kv(new Map());
-  const auth = { type: "token", providers: "email" };
-  const api = server({ auth, store }).test();
-
-  it("can create a new user", async () => {
-    const register = await api.post("/auth/register/email", CREDENTIALS);
-    expect(register.status).toBe(201);
-    expect(await store.keys()).toEqual([
-      "auth:abc@test.com",
-      "session:" + register.data.token,
-    ]);
-
-    const authorization = "Bearer " + register.data.token;
-    const headers = { authorization };
-    const logout = await api.post("/auth/logout", {}, { headers });
-
-    expect(logout.status).toBe(200);
-    expect(await store.keys()).toEqual(["auth:abc@test.com"]);
-
-    const login = await api.post("/auth/login/email", CREDENTIALS);
-    expect(login.status).toBe(200);
-    expect(await store.keys()).toEqual([
-      "auth:abc@test.com",
-      "session:" + login.data.token,
-    ]);
-  });
-});

package/src/context/findAuth.js

@@ -1,32 +0,0 @@
-import { ServerError } from "../index.js";
-
-export default async function findAuth(ctx) {
-  // NO AUTH AT ALL
-  // If there's no even auth option, nothing to do
-  const store = ctx.options.auth?.store;
-  if (!store) return;
-
-  // AUTHENTICATION IS AVAILABLE
-  ctx.auth = {
-    type: ctx.options.auth.type,
-    providers: ctx.options.auth.providers,
-    store,
-  };
-
-  // If the user is not authenticated, there's no auth to retrieve
-  if (!ctx.headers.authorization) return;
-
-  // AUTHENTICATED REQUEST
-  // Check the authentication header
-  const [type, id] = ctx.headers.authorization.trim().split(" ");
-  if (type.toLowerCase() !== "bearer") {
-    throw ServerError.AUTH_INVALID_TYPE({ type });
-  }
-  if (id.length !== 24) {
-    throw ServerError.AUTH_INVALID_TOKEN();
-  }
-
-  // Extend the basics
-  ctx.auth.id = id;
-  ctx.user = await store.get(id);
-}

package/src/context/findSession.js

@@ -1,34 +0,0 @@
-import { ServerError } from "../index.js";
-
-class NoSession {}
-
-export default async function findSession(ctx) {
-  const store = ctx.options.session?.store;
-
-  // If there's no store at all, we don't have session available;
-  // but that's okay, since it's only a problem if you try to use it
-  if (!store) {
-    return new Proxy(new NoSession(), {
-      get(target, key) {
-        if (target[key]) return target[key];
-        if (key === "then") return target[key];
-        throw ServerError.NO_STORE_READ({ key });
-      },
-      set(target, key, value) {
-        if (target[key] || key === "then") {
-          target[key] = value;
-        } else {
-          throw ServerError.NO_STORE_WRITE({ key });
-        }
-      },
-    });
-  }
-
-  // There's a session cookie; use it as the key to get the data
-  // from the store
-  if (ctx.cookies.session) {
-    return (await store.get(ctx.cookies.session)) || {};
-  }
-
-  return {};
-}