@stjoseph/prumo 0.5.0 → 0.6.0

package/templates/api/src/infra/http/hooks/origin.hook.ts

@@ -4,9 +4,9 @@ import { HttpError } from '@/infra/http/errors/http-error'
 const SAFE = new Set(['GET', 'HEAD', 'OPTIONS'])
 
 // A cookie is sent by the browser whoever wrote the page, so a request that changes something and leans on one must
-// come from the web app. Without a cookie there is nothing for another site to borrow: a native app and an MCP
-// client send a bearer, and pass.
-export function registerOriginCheck(app: FastifyInstance, webOrigin: string): void {
+// come from one of the web apps. Without a cookie there is nothing for another site to borrow: a native app and an
+// MCP client send a bearer, and pass.
+export function registerOriginCheck(app: FastifyInstance, webOrigins: string[]): void {
   app.addHook('onRequest', async (request) => {
     const leansOnCookie =
       request.headers.cookie !== undefined && request.headers.authorization === undefined
@@ -15,7 +15,7 @@ export function registerOriginCheck(app: FastifyInstance, webOrigin: string): vo
       return
     }
 
-    if (request.headers.origin !== webOrigin) {
+    if (request.headers.origin === undefined || !webOrigins.includes(request.headers.origin)) {
       throw new HttpError(403, 'Cross-origin request refused')
     }
   })

package/templates/api/src/infra/social/openid-identity-providers.adapter.ts

@@ -1,4 +1,4 @@
-import { importPKCS8, SignJWT } from 'jose'
+import { importPKCS8, SignJWT } from 'jose' // prumo:apple
 import * as oidc from 'openid-client'
 import { SocialSignInFailedError } from '@/domain/auth/errors/social-sign-in-failed.error'
 import type {

package/templates/api/test/infra/config/env.spec.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest'
+import { validate } from '@/infra/config/env'
+
+const RAW = {
+  NODE_ENV: 'test',
+  PORT: '3000',
+  DATABASE_URL: 'postgres://app:app@localhost:5432/app',
+  JWT_SECRET: 'test-secret-that-is-at-least-32-characters',
+  API_URL: 'http://localhost:3000',
+  LOG_LEVEL: 'error',
+}
+
+describe('WEB_ORIGIN', () => {
+  it('holds every web app, comma-separated, written as a browser sends its origin', () => {
+    const env = validate({ ...RAW, WEB_ORIGIN: 'http://localhost:5173, http://localhost:5174/' })
+
+    expect(env.WEB_ORIGIN).toEqual(['http://localhost:5173', 'http://localhost:5174'])
+  })
+
+  it('refuses an empty list and an entry that is not a URL', () => {
+    expect(() => validate({ ...RAW, WEB_ORIGIN: '' })).toThrow('WEB_ORIGIN')
+    expect(() => validate({ ...RAW, WEB_ORIGIN: 'http://localhost:5173,backoffice' })).toThrow(
+      'WEB_ORIGIN',
+    )
+  })
+})

package/templates/api/test/infra/http/controllers/auth.controller.spec.ts

@@ -1,3 +1,4 @@
+import { testEnv } from '@test/support/setup'
 import { ORIGIN, PASSWORD, testApp } from '@test/support/test-app'
 import type { FastifyInstance, LightMyRequestResponse } from 'fastify'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -83,6 +84,29 @@ describe('auth controller, on the web', () => {
   })
 })
 
+describe('auth controller, with several web apps', () => {
+  it('lets each of them lean on its cookie, and tells the browser so', async () => {
+    const backoffice = 'http://localhost:5174'
+    const several = await testApp({ env: { ...testEnv(), WEB_ORIGIN: [ORIGIN, backoffice] } })
+    const cookie = `access_token=${cookiesOf((await several.signUp()).response).access_token}`
+    const signedOut = await several.app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-out',
+      headers: { cookie, origin: backoffice },
+    })
+    const preflight = await several.app.inject({
+      method: 'OPTIONS',
+      url: '/api/auth/sign-out',
+      headers: { origin: backoffice, 'access-control-request-method': 'POST' },
+    })
+
+    expect(signedOut.statusCode).toBe(204)
+    expect(preflight.headers['access-control-allow-origin']).toBe(backoffice)
+
+    await several.app.close()
+  })
+})
+
 describe('auth controller, for a native client', () => {
   it('hands the tokens over in the body, and accepts them as a bearer', async () => {
     const { response } = await signUp({ bearer: true })

package/templates/api/test/infra/http/controllers/social.controller.spec.ts

@@ -6,6 +6,7 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { IDENTITY_PROVIDERS } from '@/domain/auth/ports/identity-providers.port'
 
 const WEB = 'http://localhost:5173'
+const BACKOFFICE = 'http://localhost:5174'
 
 // Whichever provider the project kept: the flow is the same for each.
 const PROVIDER = [
@@ -26,7 +27,7 @@ function stateOf(response: LightMyRequestResponse): string {
 
 beforeEach(async () => {
   ;({ app } = await testApp({
-    env: { ...testEnv(), MOBILE_APP_SCHEME: 'acme' },
+    env: { ...testEnv(), WEB_ORIGIN: [WEB, BACKOFFICE], MOBILE_APP_SCHEME: 'acme' },
     configure: (container) =>
       container.register(IDENTITY_PROVIDERS, { useValue: new FakeIdentityProviders() }),
   }))
@@ -69,6 +70,27 @@ describe('social sign-in on the web', () => {
     expect(back.headers.location).toBe(`${WEB}/`)
   })
 
+  it('sends each web app back to itself, and refuses an origin it does not trust', async () => {
+    const started = await app.inject({
+      url: `/api/auth/social/${PROVIDER}?returnTo=/orders&origin=${encodeURIComponent(BACKOFFICE)}`,
+    })
+    const back = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+      headers: { cookie: browserCookie(started) },
+    })
+    const failed = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?error=access_denied`,
+      headers: { cookie: browserCookie(started) },
+    })
+    const foreign = await app.inject({
+      url: `/api/auth/social/${PROVIDER}?origin=${encodeURIComponent('https://evil.example')}`,
+    })
+
+    expect(back.headers.location).toBe(`${BACKOFFICE}/orders`)
+    expect(failed.headers.location).toBe(`${BACKOFFICE}/sign-in?error=social_sign_in_failed`)
+    expect(foreign.statusCode).toBe(422)
+  })
+
   it('turns a form post, as Apple sends, into a redirect the browser’s cookie comes with', async () => {
     const posted = await app.inject({
       method: 'POST',

package/templates/api/test/support/setup.ts

@@ -25,7 +25,7 @@ export function testEnv(): Env {
     DATABASE_URL: databaseUrl,
     JWT_SECRET: 'test-secret-that-is-at-least-32-characters',
     API_URL: 'http://localhost:3000',
-    WEB_ORIGIN: 'http://localhost:5173',
+    WEB_ORIGIN: ['http://localhost:5173'],
     LOG_LEVEL: 'error',
   }
 }

package/templates/mobile/scripts/ports.mjs

@@ -14,22 +14,23 @@ import { basename, dirname, join, resolve } from 'node:path'
 import { createInterface } from 'node:readline/promises'
 import { parseArgs } from 'node:util'
 
-// Where each app keeps its port, what it falls back to, and how its dev command is told about it.
-const APPS = {
+// Where an app of each type keeps its port, what it falls back to, and how its dev command is told about it.
+const TYPES = {
   api: { key: 'PORT', fallback: 3000, flag: [] },
   web: { key: 'WEB_PORT', fallback: 5173, flag: ['--port', '--strictPort'] },
   site: { key: 'SITE_PORT', fallback: 3200, flag: ['--port'] },
   mobile: { key: 'METRO_PORT', fallback: 8081, flag: ['--port'] },
 }
 
-// A port that moves takes these with it: the key to write, in which app, from which app's port.
+// A port that moves takes these with it: the key to write, in every app of which type. A list holds one URL per app,
+// so only the moving app's entry changes.
 const FOLLOWERS = {
   api: [
-    { app: 'api', key: 'API_URL' },
-    { app: 'web', key: 'VITE_API_URL' },
-    { app: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
+    { type: 'api', key: 'API_URL' },
+    { type: 'web', key: 'VITE_API_URL' },
+    { type: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
   ],
-  web: [{ app: 'api', key: 'WEB_ORIGIN' }],
+  web: [{ type: 'api', key: 'WEB_ORIGIN', list: true }],
   site: [],
   mobile: [],
 }
@@ -117,36 +118,43 @@ function projectRoot() {
 const root = projectRoot()
 const workspace = existsSync(join(root, 'apps'))
 
-function directoryOf(type) {
-  return workspace ? join(root, 'apps', type) : root
+function readConfig() {
+  const path = join(root, '.prumo', 'config.json')
+
+  return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : {}
 }
 
-function typeOf(directory) {
-  const name = basename(directory)
+// Every app of the project, as { name, type, directory }. A workspace lists its apps in .prumo/config.json; one written
+// before apps had names holds one per type, named after it. An alone project is its one app, named after its type.
+function projectApps() {
+  const config = readConfig()
+
+  if (!workspace) {
+    // A project is named by its author, so only .prumo/config.json says what it is.
+    const type = TYPES[basename(root)] !== undefined ? basename(root) : config.types?.[0]
 
-  if (APPS[name] !== undefined) {
-    return name
+    return type === undefined ? [] : [{ name: type, type, directory: root }]
   }
 
-  // An alone project is named by its author, so only .prumo/config.json says what it is.
-  const config = join(root, '.prumo', 'config.json')
-  const types = existsSync(config) ? JSON.parse(readFileSync(config, 'utf8')).types : []
+  const listed = config.apps ?? (config.types ?? []).map((type) => ({ name: type, type }))
 
-  return types[0]
+  return listed
+    .map((app) => ({ ...app, directory: join(root, 'apps', app.name) }))
+    .filter(
+      (app) => TYPES[app.type] !== undefined && existsSync(join(app.directory, 'package.json')),
+    )
 }
 
-function typesToCheck() {
-  if (!values.all) {
-    return [typeOf(here)]
-  }
+const apps = projectApps()
 
-  return Object.keys(APPS).filter((type) => existsSync(join(directoryOf(type), 'package.json')))
+function appsToCheck() {
+  return values.all ? apps : apps.filter((app) => app.directory === here)
 }
 
-function portOf(type) {
-  const app = APPS[type]
+function portOf(app) {
+  const { key, fallback } = TYPES[app.type]
 
-  return Number(envValue(readEnv(directoryOf(type)), app.key) ?? app.fallback)
+  return Number(envValue(readEnv(app.directory), key) ?? fallback)
 }
 
 function listening(host, port) {
@@ -269,22 +277,31 @@ async function nextFree(from) {
   throw new Failure('port_busy', `No free port between ${from + 1} and ${from + PORTS_TRIED - 1}.`)
 }
 
-function movePort(type, port) {
-  const app = APPS[type]
+function movePort(app, from, port) {
+  const before = `http://localhost:${from}`
+  const after = `http://localhost:${port}`
 
-  writeEnvValue(directoryOf(type), app.key, port)
+  writeEnvValue(app.directory, TYPES[app.type].key, port)
 
-  for (const follower of FOLLOWERS[type]) {
-    const directory = directoryOf(follower.app)
+  for (const follower of FOLLOWERS[app.type]) {
+    for (const other of apps.filter((each) => each.type === follower.type)) {
+      const current = envValue(readEnv(other.directory), follower.key)
+      const entries = (current ?? '').split(',').map((entry) => entry.trim())
+      const value =
+        follower.list && current !== undefined
+          ? (entries.includes(before)
+              ? entries.map((entry) => (entry === before ? after : entry))
+              : [...entries, after]
+            ).join(',')
+          : after
 
-    if (existsSync(join(directory, 'package.json'))) {
-      writeEnvValue(directory, follower.key, `http://localhost:${port}`)
+      writeEnvValue(other.directory, follower.key, value)
     }
   }
 }
 
-async function settle(type) {
-  const port = portOf(type)
+async function settle(app) {
+  const port = portOf(app)
 
   if (!(await taken(port))) {
     return port
@@ -292,12 +309,12 @@ async function settle(type) {
 
   const found = holders(port)
 
-  say(`${type} wants port ${port}, held by ${describe(found)}.`)
+  say(`${app.name} wants port ${port}, held by ${describe(found)}.`)
 
   const moved = async () => {
     const free = await nextFree(port)
-    movePort(type, free)
-    say(`${type} moved to port ${free}, written to .env.`)
+    movePort(app, port, free)
+    say(`${app.name} moved to port ${free}, written to .env.`)
     return free
   }
 
@@ -311,7 +328,7 @@ async function settle(type) {
   if (!interactive) {
     throw new Failure(
       'port_busy',
-      `Port ${port} is in use by ${describe(found)}. Pass --kill to stop it, or --change to move ${type} to the next free port.`,
+      `Port ${port} is in use by ${describe(found)}. Pass --kill to stop it, or --change to move ${app.name} to the next free port.`,
     )
   }
 
@@ -669,10 +686,8 @@ async function main() {
   const starting = command === undefined ? undefined : startJob()
 
   try {
-    for (const type of typesToCheck()) {
-      if (type !== undefined) {
-        ports[type] = await settle(type)
-      }
+    for (const app of appsToCheck()) {
+      ports[app.name] = await settle(app)
     }
   } catch (error) {
     ;(await starting)?.close()
@@ -685,10 +700,10 @@ async function main() {
 
   // Only an app tells its command which port to use. A workspace root wraps `pnpm`, which would pass a stray
   // `--port` on to every app it runs.
-  const [type] = values.all ? [] : Object.keys(ports)
-  const flag = APPS[type ?? '']?.flag ?? []
+  const [app] = values.all ? [] : appsToCheck()
+  const flag = app === undefined ? [] : TYPES[app.type].flag
   const withPort = flag.flatMap((entry) =>
-    entry === '--port' ? ['--port', String(ports[type])] : [entry],
+    entry === '--port' ? ['--port', String(ports[app.name])] : [entry],
   )
   // Before the command starts, so that it and everything it starts are members from their first instant.
   const job = await starting

package/templates/mobile/src/api-contract/auth.ts

@@ -178,9 +178,21 @@ export function createAuthClient({
     // prumo:end-email
     // prumo:social
     // Where to send the browser to sign in with a provider: the API takes it there and back. The web comes back
-    // signed in; a mobile app comes back with a code to exchange.
-    socialSignInUrl: (provider: SocialProvider, client: 'web' | 'mobile', returnTo = '/') =>
-      `${url(`/social/${provider}`)}?${new URLSearchParams({ client, returnTo })}`,
+    // signed in, to the origin it names when the API trusts several; a mobile app comes back with a code to exchange.
+    socialSignInUrl: (
+      provider: SocialProvider,
+      client: 'web' | 'mobile',
+      returnTo = '/',
+      origin?: string,
+    ) => {
+      const query = new URLSearchParams({ client, returnTo })
+
+      if (origin !== undefined) {
+        query.set('origin', origin)
+      }
+
+      return `${url(`/social/${provider}`)}?${query}`
+    },
 
     exchangeSocialCode: async (code: string): Promise<void> => {
       await begin('/social/exchange', { code })

package/templates/mobile/test/features/auth/authenticated-layout.spec.tsx

@@ -1,6 +1,7 @@
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { QueryClientProvider } from '@tanstack/react-query'
 import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { memoryTokenStore } from '@test/support/memory-token-store'
+import { createTestQueryClient } from '@test/support/query-client'
 import { renderRouter, screen } from 'expo-router/testing-library'
 import type { ReactNode } from 'react'
 import { Text } from 'react-native'
@@ -23,7 +24,7 @@ async function renderAt(getSession: () => Response | Promise<Response>) {
     tokens: memoryTokenStore(TOKENS),
   })
   const clients = { auth, api: createClient({ baseUrl: API_URL, fetch: auth.fetch }) }
-  const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+  const queryClient = createTestQueryClient()
 
   function Providers({ children }: { children: ReactNode }) {
     return (

package/templates/mobile/test/features/auth/email-flows.spec.tsx

@@ -1,6 +1,7 @@
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { QueryClientProvider } from '@tanstack/react-query'
 import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { memoryTokenStore } from '@test/support/memory-token-store'
+import { createTestQueryClient } from '@test/support/query-client'
 import { userEvent } from '@testing-library/react-native'
 import { renderRouter, screen } from 'expo-router/testing-library'
 import type { ReactNode } from 'react'
@@ -18,7 +19,7 @@ async function renderAt(initialUrl: string, routes: Parameters<typeof fakeTransp
   const transport = fakeTransport(routes)
   const auth = createAuthClient({ baseUrl: API_URL, fetch: transport, tokens: memoryTokenStore() })
   const clients = { auth, api: createClient({ baseUrl: API_URL, fetch: auth.fetch }) }
-  const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+  const queryClient = createTestQueryClient()
 
   function Providers({ children }: { children: ReactNode }) {
     return (

package/templates/mobile/test/features/auth/sign-in-form.spec.tsx

@@ -1,6 +1,7 @@
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { QueryClientProvider } from '@tanstack/react-query'
 import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { memoryTokenStore } from '@test/support/memory-token-store'
+import { createTestQueryClient } from '@test/support/query-client'
 import { render, screen, userEvent } from '@testing-library/react-native'
 import { createAuthClient } from '@/api-contract'
 import { SignInForm } from '@/features/auth/sign-in-form'
@@ -23,7 +24,7 @@ describe('SignInForm', () => {
     const user = userEvent.setup()
 
     await render(
-      <QueryClientProvider client={new QueryClient()}>
+      <QueryClientProvider client={createTestQueryClient()}>
         <SignInForm auth={auth} onSignedIn={onSignedIn} />
       </QueryClientProvider>,
     )

package/templates/mobile/test/features/auth/sign-out-button.spec.tsx

@@ -1,6 +1,7 @@
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { QueryClientProvider } from '@tanstack/react-query'
 import { API_URL, fakeTransport } from '@test/support/fake-transport'
 import { memoryTokenStore } from '@test/support/memory-token-store'
+import { createTestQueryClient } from '@test/support/query-client'
 import { render, screen, userEvent, waitFor } from '@testing-library/react-native'
 import { createAuthClient } from '@/api-contract'
 import { SignOutButton } from '@/features/auth/sign-out-button'
@@ -10,7 +11,7 @@ import { clearUserData } from '@/features/storage/storage'
 jest.mock('@/features/storage/storage', () => ({ clearUserData: jest.fn() }))
 
 async function signOutWith(signOut: () => Response | Promise<Response>) {
-  const queryClient = new QueryClient()
+  const queryClient = createTestQueryClient()
   const onSignedOut = jest.fn()
   const auth = createAuthClient({
     baseUrl: API_URL,

package/templates/mobile/test/features/auth/social-buttons.spec.tsx

@@ -1,6 +1,7 @@
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { QueryClientProvider } from '@tanstack/react-query'
 import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { memoryTokenStore } from '@test/support/memory-token-store'
+import { createTestQueryClient } from '@test/support/query-client'
 import { render, screen, userEvent, waitFor } from '@testing-library/react-native'
 import * as WebBrowser from 'expo-web-browser'
 import { createAuthClient } from '@/api-contract'
@@ -28,7 +29,7 @@ async function renderButtons(exchange: () => Response) {
   })
 
   await render(
-    <QueryClientProvider client={new QueryClient()}>
+    <QueryClientProvider client={createTestQueryClient()}>
       <SocialButtons auth={auth} onSignedIn={onSignedIn} />
     </QueryClientProvider>,
   )

package/templates/mobile/test/features/profile/profile-form.spec.tsx

@@ -1,5 +1,6 @@
-import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { QueryClientProvider } from '@tanstack/react-query'
 import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
+import { createTestQueryClient } from '@test/support/query-client'
 import { render, screen, userEvent, within } from '@testing-library/react-native'
 import { createClient, type Profile } from '@/api-contract'
 import { ProfileForm } from '@/features/profile/profile-form'
@@ -36,9 +37,7 @@ describe('ProfileForm', () => {
       }),
     })
 
-    // A mutation left without an observer starts a five-minute garbage-collection timer, and Jest's worker would wait
-    // it out. Infinity schedules none, as TanStack Query's testing guide advises.
-    const queryClient = new QueryClient({ defaultOptions: { mutations: { gcTime: Infinity } } })
+    const queryClient = createTestQueryClient()
 
     await render(
       <QueryClientProvider client={queryClient}>

package/templates/mobile/test/support/query-client.ts

@@ -0,0 +1,14 @@
+import { QueryClient } from '@tanstack/react-query'
+
+// Every test builds its QueryClient here, with the defaults TanStack Query's testing guide gives. A failed query
+// fails at once instead of retrying three times with backoff. And gcTime Infinity schedules no garbage-collection
+// timer: once a test unmounts, a query or mutation left without an observer would otherwise start a real five-minute
+// setTimeout, and Jest's worker waits on it until it is force-exited.
+export function createTestQueryClient(): QueryClient {
+  return new QueryClient({
+    defaultOptions: {
+      queries: { retry: false, gcTime: Infinity },
+      mutations: { gcTime: Infinity },
+    },
+  })
+}