@stjoseph/prumo 0.3.0 → 0.4.0

package/templates/api/test/infra/http/controllers/auth-email.controller.spec.ts

@@ -0,0 +1,92 @@
+import type { FakeMailer } from '@test/support/fakes/fake-mailer'
+import { ORIGIN, PASSWORD, testApp } from '@test/support/test-app'
+import type { FastifyInstance } from 'fastify'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+const BEARER = { 'x-auth-transport': 'bearer' }
+
+let app: FastifyInstance
+let mailer: FakeMailer
+
+const post = (
+  url: string,
+  payload: Record<string, string>,
+  headers: Record<string, string> = BEARER,
+) => app.inject({ method: 'POST', url, headers, payload })
+
+beforeEach(async () => {
+  ;({ app, mailer } = await testApp())
+})
+
+afterEach(async () => {
+  await app.close()
+})
+
+describe('email verification over HTTP', () => {
+  it('opens no session at sign-up, refuses sign-in, and signs in once the code is entered', async () => {
+    const email = 'ana@example.com'
+    const signUp = await post('/api/auth/sign-up', { name: 'Ana', email, password: PASSWORD })
+    const refused = await post('/api/auth/sign-in', { email, password: PASSWORD })
+
+    expect(signUp.statusCode).toBe(201)
+    expect(signUp.json()).toEqual({ verificationRequired: true })
+    expect(refused.statusCode).toBe(403)
+    expect(refused.json()).toMatchObject({ code: 'email_not_verified' })
+
+    await post('/api/auth/email/verification', { email })
+    const verified = await post('/api/auth/email/verify', { email, code: mailer.lastCode(email) })
+
+    expect(verified.statusCode).toBe(200)
+    expect(verified.json().accessToken).toEqual(expect.any(String))
+  })
+
+  it('delivers the web its cookies once the code is entered', async () => {
+    const email = 'ana@example.com'
+    await post('/api/auth/sign-up', { name: 'Ana', email, password: PASSWORD }, { origin: ORIGIN })
+
+    const verified = await post(
+      '/api/auth/email/verify',
+      { email, code: mailer.lastCode(email) },
+      { origin: ORIGIN },
+    )
+
+    expect(verified.statusCode).toBe(204)
+    expect(verified.cookies.map((cookie) => cookie.name).sort()).toEqual([
+      'access_token',
+      'refresh_token',
+    ])
+  })
+
+  it('answers a wrong code with invalid_code, and an unknown email with 204 and no mail', async () => {
+    await post('/api/auth/sign-up', { name: 'Ana', email: 'ana@example.com', password: PASSWORD })
+
+    const wrong = await post('/api/auth/email/verify', { email: 'ana@example.com', code: '000000' })
+    const unknown = await post('/api/auth/email/verification', { email: 'nobody@example.com' })
+
+    expect(wrong.statusCode).toBe(422)
+    expect(wrong.json()).toMatchObject({ code: 'invalid_code' })
+    expect(unknown.statusCode).toBe(204)
+    expect(mailer.sent.map((mail) => mail.to)).not.toContain('nobody@example.com')
+  })
+})
+
+describe('password reset over HTTP', () => {
+  it('resets the password with the mailed code and signs in with the new one', async () => {
+    const email = 'ana@example.com'
+    await post('/api/auth/sign-up', { name: 'Ana', email, password: PASSWORD })
+
+    const forgot = await post('/api/auth/password/forgot', { email })
+    const reset = await post('/api/auth/password/reset', {
+      email,
+      code: mailer.lastCode(email),
+      password: 'another-good-password',
+    })
+    const old = await post('/api/auth/sign-in', { email, password: PASSWORD })
+    const fresh = await post('/api/auth/sign-in', { email, password: 'another-good-password' })
+
+    expect(forgot.statusCode).toBe(204)
+    expect(reset.statusCode).toBe(200)
+    expect(old.statusCode).toBe(401)
+    expect(fresh.statusCode).toBe(200)
+  })
+})

package/templates/api/test/infra/http/controllers/auth.controller.spec.ts

@@ -1,19 +1,11 @@
-import { testEnv, testOrm } from '@test/support/setup'
+import { ORIGIN, PASSWORD, testApp } from '@test/support/test-app'
 import type { FastifyInstance, LightMyRequestResponse } from 'fastify'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { createContainer } from '@/infra/di'
-import { buildApp } from '@/infra/http/app'
 
-const ORIGIN = 'http://localhost:5173'
 const BEARER = { 'x-auth-transport': 'bearer' }
 
 let app: FastifyInstance
-
-const account = () => ({
-  name: 'Ana',
-  email: `${crypto.randomUUID()}@example.com`,
-  password: 'correct-horse-battery',
-})
+let signUp: Awaited<ReturnType<typeof testApp>>['signUp']
 
 function cookiesOf(response: LightMyRequestResponse): Record<string, string> {
   return Object.fromEntries(response.cookies.map((cookie) => [cookie.name, cookie.value]))
@@ -24,7 +16,7 @@ function setCookie(response: LightMyRequestResponse, name: string) {
 }
 
 beforeEach(async () => {
-  app = await buildApp(createContainer({ env: testEnv(), orm: testOrm() }))
+  ;({ app, signUp } = await testApp())
 })
 
 afterEach(async () => {
@@ -32,15 +24,9 @@ afterEach(async () => {
 })
 
 describe('auth controller, on the web', () => {
-  it('signs up into httpOnly cookies, the refresh one sent only to its route', async () => {
-    const response = await app.inject({
-      method: 'POST',
-      url: '/api/auth/sign-up',
-      headers: { origin: ORIGIN },
-      payload: account(),
-    })
+  it('starts a session in httpOnly cookies, the refresh one sent only to its route', async () => {
+    const { response } = await signUp()
 
-    expect(response.statusCode).toBe(201)
     expect(response.body).toBe('')
     expect(setCookie(response, 'access_token')).toMatchObject({
       httpOnly: true,
@@ -54,13 +40,7 @@ describe('auth controller, on the web', () => {
   })
 
   it('reads the session from the cookie, refreshes it, and signs out', async () => {
-    const signUp = await app.inject({
-      method: 'POST',
-      url: '/api/auth/sign-up',
-      headers: { origin: ORIGIN },
-      payload: account(),
-    })
-    const { access_token, refresh_token } = cookiesOf(signUp)
+    const { access_token, refresh_token } = cookiesOf((await signUp()).response)
 
     const session = await app.inject({
       url: '/api/auth/session',
@@ -92,13 +72,7 @@ describe('auth controller, on the web', () => {
   })
 
   it('refuses a request that leans on a cookie from another origin, or from none', async () => {
-    const signUp = await app.inject({
-      method: 'POST',
-      url: '/api/auth/sign-up',
-      headers: { origin: ORIGIN },
-      payload: account(),
-    })
-    const cookie = `access_token=${cookiesOf(signUp).access_token}`
+    const cookie = `access_token=${cookiesOf((await signUp()).response).access_token}`
 
     for (const headers of [{ cookie, origin: 'https://evil.example' }, { cookie }]) {
       const response = await app.inject({ method: 'POST', url: '/api/auth/sign-out', headers })
@@ -111,16 +85,10 @@ describe('auth controller, on the web', () => {
 
 describe('auth controller, for a native client', () => {
   it('hands the tokens over in the body, and accepts them as a bearer', async () => {
-    const signUp = await app.inject({
-      method: 'POST',
-      url: '/api/auth/sign-up',
-      headers: BEARER,
-      payload: account(),
-    })
-    const tokens = signUp.json()
+    const { response } = await signUp({ bearer: true })
+    const tokens = response.json()
 
-    expect(signUp.statusCode).toBe(201)
-    expect(signUp.cookies).toEqual([])
+    expect(response.cookies).toEqual([])
     expect(tokens).toEqual({
       accessToken: expect.any(String),
       refreshToken: expect.any(String),
@@ -146,20 +114,19 @@ describe('auth controller, for a native client', () => {
 
 describe('auth controller, refusing', () => {
   it('answers a wrong password with 401 and a taken email with 409, as problem+json', async () => {
-    const ana = account()
-    await app.inject({ method: 'POST', url: '/api/auth/sign-up', headers: BEARER, payload: ana })
+    const { email } = await signUp({ bearer: true })
 
     const wrong = await app.inject({
       method: 'POST',
       url: '/api/auth/sign-in',
       headers: BEARER,
-      payload: { email: ana.email, password: 'wrong-password' },
+      payload: { email, password: 'wrong-password' },
     })
     const taken = await app.inject({
       method: 'POST',
       url: '/api/auth/sign-up',
       headers: BEARER,
-      payload: ana,
+      payload: { name: 'Ana', email, password: PASSWORD },
     })
 
     expect(wrong.statusCode).toBe(401)

package/templates/api/test/infra/http/controllers/mcp.controller.spec.ts

@@ -1,13 +1,13 @@
 import { createHash, randomBytes } from 'node:crypto'
 import { createServer } from 'node:net'
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client'
-import { testEnv, testOrm } from '@test/support/setup'
+import { testEnv } from '@test/support/setup'
+import { cookieHeader, testApp } from '@test/support/test-app'
 import type { FastifyInstance } from 'fastify'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { InvalidClientError } from '@/domain/oauth/errors/invalid-client.error'
 import { CLIENT_METADATA, type ClientMetadata } from '@/domain/oauth/ports/client-metadata.port'
-import { createContainer } from '@/infra/di'
-import { buildApp } from '@/infra/http/app'
+import { TOOL_SCOPES } from '@/infra/mcp/mcp.scopes'
 import { mcpResource } from '@/infra/mcp/mcp.server'
 
 const ORIGIN = 'http://localhost:5173'
@@ -17,6 +17,7 @@ const REDIRECT = 'https://client.example.com/callback'
 
 let app: FastifyInstance
 let env: ReturnType<typeof testEnv>
+let register: Awaited<ReturnType<typeof testApp>>['signUp']
 
 function freePort(): Promise<number> {
   return new Promise((resolve) => {
@@ -42,10 +43,10 @@ const clients = {
 beforeEach(async () => {
   const port = await freePort()
   env = { ...testEnv(), API_URL: `http://127.0.0.1:${port}` }
-  const container = createContainer({ env, orm: testOrm() })
-
-  container.register(CLIENT_METADATA, { useValue: clients })
-  app = await buildApp(container)
+  ;({ app, signUp: register } = await testApp({
+    env,
+    configure: (container) => container.register(CLIENT_METADATA, { useValue: clients }),
+  }))
   await app.listen({ port, host: '127.0.0.1' })
 })
 
@@ -54,18 +55,7 @@ afterEach(async () => {
 })
 
 async function signUp(): Promise<string> {
-  const response = await app.inject({
-    method: 'POST',
-    url: '/api/auth/sign-up',
-    headers: { origin: ORIGIN },
-    payload: {
-      name: 'Ana',
-      email: `${crypto.randomUUID()}@example.com`,
-      password: 'correct-horse-battery',
-    },
-  })
-
-  return response.cookies.map((cookie) => `${cookie.name}=${cookie.value}`).join('; ')
+  return cookieHeader((await register()).response)
 }
 
 function pkce() {
@@ -105,9 +95,9 @@ function token(form: Record<string, string>) {
 }
 
 // The path an MCP client takes: authorize with PKCE, the user consents on the web, the code becomes tokens.
-async function authorize(cookie: string, accept = true) {
+async function authorize(cookie: string, accept = true, scope?: string) {
   const { verifier, challenge } = pkce()
-  const started = await app.inject({ url: authorizeUrl({}, challenge) })
+  const started = await app.inject({ url: authorizeUrl({ scope }, challenge) })
   const consent = new URL(started.headers.location as string)
   const id = consent.searchParams.get('request') ?? ''
   const view = await app.inject({ url: `/api/oauth/authorizations/${id}`, headers: { cookie } })
@@ -121,8 +111,8 @@ async function authorize(cookie: string, accept = true) {
   return { started, consent, view, redirect: new URL(decision.json().redirectTo), verifier }
 }
 
-async function tokens(cookie: string) {
-  const { redirect, verifier } = await authorize(cookie)
+async function tokens(cookie: string, scope?: string) {
+  const { redirect, verifier } = await authorize(cookie, true, scope)
   const response = await token({
     grant_type: 'authorization_code',
     code: redirect.searchParams.get('code') ?? '',
@@ -183,6 +173,11 @@ describe('authorization', () => {
       clientHost: 'client.example.com',
       redirectHost: 'client.example.com',
       redirectsToThisDevice: false,
+      // Asked for nothing, so offered everything, each scope worded for a person.
+      scopes: [
+        { scope: 'profile:read', description: 'Read your profile' },
+        { scope: 'profile:write', description: 'Change your display name, language and timezone' },
+      ],
     })
     expect(`${redirect.origin}${redirect.pathname}`).toBe(REDIRECT)
     expect(redirect.searchParams.get('state')).toBe('xyz')
@@ -225,6 +220,75 @@ describe('authorization', () => {
   })
 })
 
+describe('scopes', () => {
+  it('are advertised, and named in the 401 a client starts from', async () => {
+    const refused = await app.inject({ method: 'POST', url: '/api/mcp', payload: {} })
+    const resource = await app.inject({ url: '/.well-known/oauth-protected-resource/api/mcp' })
+    const server = await app.inject({ url: '/.well-known/oauth-authorization-server' })
+
+    expect(refused.headers['www-authenticate']).toContain('scope="profile:read profile:write"')
+    expect(resource.json().scopes_supported).toEqual(['profile:read', 'profile:write'])
+    expect(server.json().scopes_supported).toEqual(['profile:read', 'profile:write'])
+  })
+
+  it('let a read-only token read, and refuse its write with the scope it needs', async () => {
+    const { response } = await tokens(await signUp(), 'profile:read')
+    const { access_token, scope } = response.json()
+    const client = await connect(access_token)
+    const read = await client.callTool({ name: 'get_profile', arguments: {} })
+    const write = await app.inject({
+      method: 'POST',
+      url: '/api/mcp',
+      headers: {
+        authorization: `Bearer ${access_token}`,
+        accept: 'application/json, text/event-stream',
+      },
+      payload: {
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/call',
+        params: { name: 'update_profile', arguments: { timezone: 'UTC' } },
+      },
+    })
+
+    expect(scope).toBe('profile:read')
+    expect(read.structuredContent).toMatchObject({ displayName: 'Ana' })
+    expect(write.statusCode).toBe(403)
+    expect(write.headers['www-authenticate']).toContain('error="insufficient_scope"')
+    expect(write.headers['www-authenticate']).toContain('scope="profile:write"')
+
+    await client.close()
+  })
+
+  // A tool missing from TOOL_SCOPES would answer any token, so every tool the server lists must be there.
+  it('cover every tool the server offers', async () => {
+    const client = await connect((await tokens(await signUp())).response.json().access_token)
+    const { tools } = await client.listTools()
+
+    expect(tools.length).toBeGreaterThan(0)
+    for (const tool of tools) {
+      expect(TOOL_SCOPES[tool.name], tool.name).toBeDefined()
+    }
+
+    await client.close()
+  })
+
+  it('keep the scope through a refresh, and refuse one the server does not offer', async () => {
+    const { response } = await tokens(await signUp(), 'profile:read')
+    const refreshed = await token({
+      grant_type: 'refresh_token',
+      refresh_token: response.json().refresh_token,
+      client_id: CLIENT_ID,
+    })
+    const unknown = await app.inject({ url: authorizeUrl({ scope: 'billing:write' }) })
+
+    expect(refreshed.json().scope).toBe('profile:read')
+    expect(new URL(unknown.headers.location as string).searchParams.get('error')).toBe(
+      'invalid_scope',
+    )
+  })
+})
+
 describe('token', () => {
   it('runs a tool for the user who authorized the client, with public fields only', async () => {
     const { response } = await tokens(await signUp())

package/templates/api/test/infra/http/controllers/social.controller.spec.ts

@@ -0,0 +1,108 @@
+import { FakeIdentityProviders } from '@test/support/fakes/social-fakes'
+import { testEnv } from '@test/support/setup'
+import { testApp } from '@test/support/test-app'
+import type { FastifyInstance, LightMyRequestResponse } from 'fastify'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { IDENTITY_PROVIDERS } from '@/domain/auth/ports/identity-providers.port'
+
+const WEB = 'http://localhost:5173'
+
+// Whichever provider the project kept: the flow is the same for each.
+const PROVIDER = [
+  'google', // prumo:google
+  'apple', // prumo:apple
+][0]
+
+let app: FastifyInstance
+
+function browserCookie(response: LightMyRequestResponse): string {
+  const cookie = response.cookies.find((each) => each.name === 'social_sign_in')
+  return `social_sign_in=${cookie?.value ?? ''}`
+}
+
+function stateOf(response: LightMyRequestResponse): string {
+  return new URL(response.headers.location as string).searchParams.get('state') ?? ''
+}
+
+beforeEach(async () => {
+  ;({ app } = await testApp({
+    env: { ...testEnv(), MOBILE_APP_SCHEME: 'acme' },
+    configure: (container) =>
+      container.register(IDENTITY_PROVIDERS, { useValue: new FakeIdentityProviders() }),
+  }))
+})
+
+afterEach(async () => {
+  await app.close()
+})
+
+describe('social sign-in on the web', () => {
+  it('sends the browser to the provider and back into the app, signed in', async () => {
+    const started = await app.inject({ url: `/api/auth/social/${PROVIDER}?returnTo=/orders` })
+    const back = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+      headers: { cookie: browserCookie(started) },
+    })
+
+    expect(started.statusCode).toBe(302)
+    expect(started.headers.location).toMatch(/^https:\/\/\w+\.test\/authorize/)
+    expect(back.statusCode).toBe(302)
+    expect(back.headers.location).toBe(`${WEB}/orders`)
+    expect(back.cookies.map((cookie) => cookie.name)).toEqual(
+      expect.arrayContaining(['access_token', 'refresh_token']),
+    )
+  })
+
+  it('refuses a return without the browser that started it, and a foreign returnTo', async () => {
+    const started = await app.inject({
+      url: `/api/auth/social/${PROVIDER}?returnTo=//evil.example`,
+    })
+    const forwarded = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+    })
+    const back = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+      headers: { cookie: browserCookie(started) },
+    })
+
+    expect(forwarded.headers.location).toBe(`${WEB}/sign-in?error=social_sign_in_failed`)
+    expect(back.headers.location).toBe(`${WEB}/`)
+  })
+
+  it('turns a form post, as Apple sends, into a redirect the browser’s cookie comes with', async () => {
+    const posted = await app.inject({
+      method: 'POST',
+      url: `/api/auth/social/${PROVIDER}/callback`,
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      payload: 'code=c&state=s&user=%7B%7D',
+    })
+
+    expect(posted.statusCode).toBe(303)
+    expect(posted.headers.location).toBe(
+      `http://localhost:3000/api/auth/social/${PROVIDER}/callback?code=c&state=s&user=%7B%7D`,
+    )
+  })
+})
+
+describe('social sign-in on mobile', () => {
+  it('sends the app a code, which it trades once for its tokens', async () => {
+    const started = await app.inject({ url: `/api/auth/social/${PROVIDER}?client=mobile` })
+    const back = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+      headers: { cookie: browserCookie(started) },
+    })
+    const location = new URL(back.headers.location as string)
+    const code = location.searchParams.get('code') ?? ''
+    const exchange = () =>
+      app.inject({
+        method: 'POST',
+        url: '/api/auth/social/exchange',
+        headers: { 'x-auth-transport': 'bearer' },
+        payload: { code },
+      })
+
+    expect(`${location.protocol}//${location.host}`).toBe('acme://social')
+    expect((await exchange()).json().accessToken).toEqual(expect.any(String))
+    expect((await exchange()).statusCode).toBe(401)
+  })
+})

package/templates/api/test/infra/http/controllers/users.controller.spec.ts

@@ -1,37 +1,16 @@
-import { testEnv, testOrm } from '@test/support/setup'
+import { cookieHeader, ORIGIN, testApp } from '@test/support/test-app'
 import type { FastifyInstance } from 'fastify'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { createContainer } from '@/infra/di'
-import { buildApp } from '@/infra/http/app'
-
-const ORIGIN = 'http://localhost:5173'
 
 let app: FastifyInstance
+let signUp: Awaited<ReturnType<typeof testApp>>['signUp']
 
-async function signUp(): Promise<string[]> {
-  const response = await app.inject({
-    method: 'POST',
-    url: '/api/auth/sign-up',
-    headers: { origin: ORIGIN },
-    payload: {
-      name: 'Ana',
-      email: `${crypto.randomUUID()}@example.com`,
-      password: 'correct-horse-battery',
-    },
-  })
-
-  expect(response.statusCode).toBe(201)
-
-  const cookies = response.headers['set-cookie']
-  return Array.isArray(cookies) ? cookies : [cookies ?? '']
-}
-
-function cookieHeader(cookies: string[]): string {
-  return cookies.map((cookie) => cookie.split(';')[0]).join('; ')
+async function signedIn(): Promise<string> {
+  return cookieHeader((await signUp()).response)
 }
 
 beforeEach(async () => {
-  app = await buildApp(createContainer({ env: testEnv(), orm: testOrm() }))
+  ;({ app, signUp } = await testApp())
 })
 
 afterEach(async () => {
@@ -47,8 +26,10 @@ describe('users controller', () => {
   })
 
   it('returns the profile created at sign-up, and only its public fields', async () => {
-    const cookie = cookieHeader(await signUp())
-    const response = await app.inject({ url: '/api/v1/users/me', headers: { cookie } })
+    const response = await app.inject({
+      url: '/api/v1/users/me',
+      headers: { cookie: await signedIn() },
+    })
 
     expect(response.statusCode).toBe(200)
     expect(Object.keys(response.json()).sort()).toEqual(
@@ -58,11 +39,10 @@ describe('users controller', () => {
   })
 
   it('updates the profile', async () => {
-    const cookie = cookieHeader(await signUp())
     const response = await app.inject({
       method: 'PATCH',
       url: '/api/v1/users/me',
-      headers: { cookie, origin: ORIGIN },
+      headers: { cookie: await signedIn(), origin: ORIGIN },
       payload: { timezone: 'America/Sao_Paulo' },
     })
 
@@ -71,11 +51,10 @@ describe('users controller', () => {
   })
 
   it('names every rejected field, including one the schema does not know', async () => {
-    const cookie = cookieHeader(await signUp())
     const response = await app.inject({
       method: 'PATCH',
       url: '/api/v1/users/me',
-      headers: { cookie, origin: ORIGIN },
+      headers: { cookie: await signedIn(), origin: ORIGIN },
       payload: { displayName: '', role: 'admin' },
     })
 
@@ -87,11 +66,10 @@ describe('users controller', () => {
   })
 
   it('signs out', async () => {
-    const cookie = cookieHeader(await signUp())
     const response = await app.inject({
       method: 'POST',
       url: '/api/auth/sign-out',
-      headers: { cookie, origin: ORIGIN },
+      headers: { cookie: await signedIn(), origin: ORIGIN },
     })
 
     expect(response.statusCode).toBe(204)