@specific.dev/spectest 0.45.0 → 0.46.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/supabase-config.test.ts

@@ -0,0 +1,261 @@
+import { describe, expect, test } from "bun:test";
+
+import { mapSupabaseConfig } from "./supabase-config.js";
+
+const toml = (s: string): unknown =>
+  (globalThis as unknown as { Bun: { TOML: { parse(s: string): unknown } } }).Bun.TOML.parse(s);
+
+describe("mapSupabaseConfig", () => {
+  test("maps the auth settings a test can observe", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth]
+jwt_expiry = 7200
+minimum_password_length = 10
+
+[auth.email]
+otp_length = 8
+
+[auth.hook.before_user_created]
+enabled = true
+uri = "pg-functions://postgres/public/hook_restrict_signup"
+`),
+    );
+
+    expect(out.auth).toMatchObject({
+      GOTRUE_JWT_EXP: "7200",
+      GOTRUE_PASSWORD_MIN_LENGTH: "10",
+      GOTRUE_MAILER_OTP_LENGTH: "8",
+      GOTRUE_HOOK_BEFORE_USER_CREATED_ENABLED: "true",
+      GOTRUE_HOOK_BEFORE_USER_CREATED_URI: "pg-functions://postgres/public/hook_restrict_signup",
+    });
+    expect(out.warnings).toEqual([]);
+  });
+
+  // The two mappings a copy-paste gets backwards without anyone noticing.
+  test("negates enable_signup and enable_confirmations", () => {
+    const on = mapSupabaseConfig(
+      toml(`
+[auth]
+enable_signup = true
+[auth.email]
+enable_confirmations = true
+`),
+    );
+    expect(on.auth.GOTRUE_DISABLE_SIGNUP).toBe("false");
+    expect(on.auth.GOTRUE_MAILER_AUTOCONFIRM).toBe("false");
+
+    const off = mapSupabaseConfig(
+      toml(`
+[auth]
+enable_signup = false
+[auth.email]
+enable_confirmations = false
+`),
+    );
+    expect(off.auth.GOTRUE_DISABLE_SIGNUP).toBe("true");
+    expect(off.auth.GOTRUE_MAILER_AUTOCONFIRM).toBe("true");
+  });
+
+  test("collects mail templates by id", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.email.template.invite]
+subject = "You've been invited"
+content_path = "./supabase/templates/invite.html"
+`),
+    );
+    expect(out.templates.invite).toEqual({
+      path: "./supabase/templates/invite.html",
+      subject: "You've been invited",
+    });
+  });
+
+  // A subject with no content_path is how the CLI spells "default body, custom
+  // subject" — it must not invent a template path.
+  test("keeps a subject-only template out of the served set", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.email.template.recovery]
+subject = "Reset it"
+content_path = ""
+`),
+    );
+    expect(out.templates.recovery).toEqual({ path: "", subject: "Reset it" });
+  });
+
+  test("reads per-function verify_jwt and the api schemas", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[api]
+schemas = ["public", "graphql_public"]
+max_rows = 500
+port = 54321
+
+[functions.invoice-api]
+verify_jwt = false
+[functions.account-api]
+verify_jwt = true
+`),
+    );
+    expect(out.functionVerifyJwt).toEqual({ "invoice-api": false, "account-api": true });
+    expect(out.rest).toEqual({ PGRST_DB_SCHEMAS: "public,graphql_public", PGRST_DB_MAX_ROWS: "500" });
+  });
+
+  // Addresses are this environment's, not the file's: its URLs name the
+  // developer's machine, where nothing is listening inside a VM.
+  test("never takes site_url or the redirect allow list from the file", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth]
+site_url = "http://localhost:3000"
+additional_redirect_urls = ["http://localhost:3000/**"]
+`),
+    );
+    expect(out.auth).toEqual({});
+    expect(out.unsupported).toEqual([]);
+    expect(out.warnings).toEqual([]);
+  });
+
+  // Reported, never fatal — the file belongs to the project and describes more
+  // environments than this one.
+  test("reports a setting it cannot apply, with the reason", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.captcha]
+enabled = true
+provider = "hcaptcha"
+secret = "env(HCAPTCHA_SECRET)"
+`),
+    );
+    expect(out.unsupported).toHaveLength(1);
+    expect(out.unsupported[0]!.key).toBe("auth.captcha");
+    expect(out.unsupported[0]!.reason).toMatch(/captcha/);
+  });
+
+  // Social sign-in is collected, not refused: the component serves each
+  // provider it has an emulator for at that provider's real endpoints.
+  test("collects the social providers and where their credentials come from", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.external.google]
+enabled = true
+client_id = "env(GOOGLE_OAUTH_CLIENT_ID)"
+secret = "env(GOOGLE_OAUTH_SECRET)"
+
+[auth.external.azure]
+enabled = true
+client_id = "literal-azure-id"
+url = "https://login.microsoftonline.com/tenant-1/v2.0"
+
+[auth.external.facebook]
+enabled = false
+`),
+    );
+    expect(out.externalProviders.google).toEqual({
+      enabled: true,
+      clientIdFrom: "GOOGLE_OAUTH_CLIENT_ID",
+      secretFrom: "GOOGLE_OAUTH_SECRET",
+    });
+    expect(out.externalProviders.azure).toEqual({
+      enabled: true,
+      clientId: "literal-azure-id",
+      url: "https://login.microsoftonline.com/tenant-1/v2.0",
+    });
+    expect(out.externalProviders.facebook!.enabled).toBe(false);
+    expect(out.unsupported).toEqual([]);
+  });
+
+  // The common shape: a config lists a dozen providers with every one off.
+  // Nothing is lost by not applying them, so nothing is said.
+  test("stays quiet about an unsupported feature that is switched off", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.captcha]
+enabled = false
+provider = "hcaptcha"
+
+[auth.sms]
+enable_signup = false
+template = "code {{ .Code }}"
+`),
+    );
+    expect(out.unsupported).toEqual([]);
+  });
+
+  test("reports a section where only one feature is enabled", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.mfa.phone]
+enroll_enabled = true
+verify_enabled = false
+`),
+    );
+    expect(out.unsupported.map((u) => u.key)).toEqual(["auth.mfa.phone"]);
+  });
+
+  // Both ways the file defers a value to the surrounding environment. Passing
+  // either through would hand a function the string `env(NAME)` or a base64
+  // ciphertext — the latter looking enough like a value to go unnoticed.
+  test("separates literal secrets from the two deferred forms", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[edge_runtime.secrets]
+FEATURE_FLAG = "true"
+STRIPE_KEY = "env(STRIPE_SECRET_KEY)"
+SENDGRID_KEY = "encrypted:c2VjcmV0LXZhbHVl"
+`),
+    );
+    expect(out.functionSecrets).toEqual({ FEATURE_FLAG: "true" });
+    // `env(NAME)` records the name to read it from…
+    expect(out.deferredSecrets).toEqual({ STRIPE_KEY: "STRIPE_SECRET_KEY" });
+    // …while an inline ciphertext names nothing and cannot be supplied here.
+    expect(out.encryptedValues).toEqual(["edge_runtime.secrets.SENDGRID_KEY"]);
+  });
+
+  // A provider credential reads from the same `.env` as everything else — it
+  // is a field on the project's auth settings rather than a named secret, but
+  // the value gets there the same way.
+  test("records where a provider credential is read from", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+[auth.external.google]
+enabled = true
+client_id = "env(GOOGLE_OAUTH_CLIENT_ID)"
+secret = "encrypted:c2hoaA=="
+`),
+    );
+    expect(out.externalProviders.google).toEqual({
+      enabled: true,
+      clientIdFrom: "GOOGLE_OAUTH_CLIENT_ID",
+    });
+    // The ciphertext names nothing, so it is reported instead of guessed at.
+    expect(out.encryptedValues).toEqual(["auth.external.google.secret"]);
+  });
+
+  test("warns rather than fails on a key it has never seen", () => {
+    const out = mapSupabaseConfig(toml(`\n[auth]\nfuture_option = true\n`));
+    expect(out.warnings).toEqual(["auth.future_option"]);
+  });
+
+  // Sections spectest owns outright never reach the user as noise.
+  test("drops the topology sections in silence", () => {
+    const out = mapSupabaseConfig(
+      toml(`
+project_id = "test"
+[db]
+port = 54322
+[db.pooler]
+enabled = true
+[studio]
+port = 54323
+[inbucket]
+port = 54324
+[remotes.production.auth]
+site_url = "https://example.com"
+`),
+    );
+    expect(out.warnings).toEqual([]);
+    expect(out.auth).toEqual({});
+  });
+});