@stonecrop/casl-middleware 0.7.1 → 0.7.3

package/dist/tests/ability.test.js

@@ -1,6 +1,6 @@
 import { AbilityBuilder, PureAbility, subject } from '@casl/ability';
-import { describe, it, expect } from 'vitest';
-import { createAbility, detectSubjectType } from '../src/middleware/ability';
+import { describe, it, expect, vi } from 'vitest';
+import { createAbility, detectSubjectType, defaultAbilityBuilder, createDatabaseAbilityBuilder, createConfigBasedAbilityBuilder, createAbilityFactory, } from '../src/middleware/ability';
 const Ability = PureAbility;
 describe('Ability Creation', () => {
     describe('createAbility', () => {
@@ -122,4 +122,281 @@ describe('Ability Creation', () => {
             expect(ability.can('update', subject('Post', { authorId: '456' }))).toBe(false);
         });
     });
+    describe('detectSubjectType', () => {
+        it('should detect __caslSubjectType__ property', () => {
+            const obj = { __caslSubjectType__: 'CustomType', data: 'test' };
+            expect(detectSubjectType(obj)).toBe('CustomType');
+        });
+        it('should fallback to type property', () => {
+            const obj = { type: 'Post', title: 'Test' };
+            expect(detectSubjectType(obj)).toBe('Post');
+        });
+        it('should fallback to constructor name', () => {
+            class User {
+                name;
+                constructor(name) {
+                    this.name = name;
+                }
+            }
+            const user = new User('John');
+            expect(detectSubjectType(user)).toBe('User');
+        });
+        it('should return Unknown for plain objects', () => {
+            const obj = { data: 'test' };
+            expect(detectSubjectType(obj)).toBe('Unknown');
+        });
+        it('should return Unknown for null or undefined', () => {
+            expect(detectSubjectType(null)).toBe('Unknown');
+            expect(detectSubjectType(undefined)).toBe('Unknown');
+        });
+        it('should return Unknown for primitives', () => {
+            expect(detectSubjectType('string')).toBe('Unknown');
+            expect(detectSubjectType(123)).toBe('Unknown');
+            expect(detectSubjectType(true)).toBe('Unknown');
+        });
+    });
+    describe('defaultAbilityBuilder', () => {
+        it('should create ability with only Query read access for no user', () => {
+            const ability = defaultAbilityBuilder();
+            expect(ability.can('read', 'Query')).toBe(true);
+            expect(ability.can('read', 'Mutation')).toBe(false);
+            expect(ability.can('manage', 'all')).toBe(false);
+        });
+        it('should create ability with only Query read access for user without roles', () => {
+            const user = { id: '123', roles: [] };
+            const ability = defaultAbilityBuilder(user);
+            expect(ability.can('read', 'Query')).toBe(true);
+            expect(ability.can('read', 'Mutation')).toBe(false);
+        });
+    });
+    describe('createDatabaseAbilityBuilder', () => {
+        it('should build ability from database rules', async () => {
+            const mockFetchRules = vi.fn().mockResolvedValue([
+                { action: 'read', subject: 'Post', inverted: false },
+                { action: 'create', subject: 'Post', inverted: false },
+                { action: 'update', subject: 'Post', fields: ['title'], inverted: false },
+                { action: 'delete', subject: 'Post', inverted: true },
+            ]);
+            const builder = createDatabaseAbilityBuilder(mockFetchRules);
+            const user = { id: '123', roles: ['user'] };
+            const ability = await builder(user);
+            expect(mockFetchRules).toHaveBeenCalledWith('123');
+            expect(ability.can('read', 'Post')).toBe(true);
+            expect(ability.can('create', 'Post')).toBe(true);
+            expect(ability.can('update', 'Post', 'title')).toBe(true);
+            expect(ability.can('delete', 'Post')).toBe(false);
+        });
+        it('should handle rules with conditions', async () => {
+            const mockFetchRules = vi.fn().mockResolvedValue([
+                {
+                    action: 'update',
+                    subject: 'Post',
+                    conditions: { authorId: '123' },
+                    inverted: false,
+                },
+            ]);
+            const builder = createDatabaseAbilityBuilder(mockFetchRules);
+            const user = { id: '123', roles: ['user'] };
+            const ability = await builder(user);
+            expect(ability.can('update', subject('Post', { authorId: '123' }))).toBe(true);
+            expect(ability.can('update', subject('Post', { authorId: '456' }))).toBe(false);
+        });
+        it('should only allow Query read for user without id', async () => {
+            const mockFetchRules = vi.fn();
+            const builder = createDatabaseAbilityBuilder(mockFetchRules);
+            const ability = await builder();
+            expect(mockFetchRules).not.toHaveBeenCalled();
+            expect(ability.can('read', 'Query')).toBe(true);
+            expect(ability.can('read', 'Post')).toBe(false);
+        });
+        it('should handle empty rules array', async () => {
+            const mockFetchRules = vi.fn().mockResolvedValue([]);
+            const builder = createDatabaseAbilityBuilder(mockFetchRules);
+            const user = { id: '123', roles: [] };
+            const ability = await builder(user);
+            expect(mockFetchRules).toHaveBeenCalledWith('123');
+            expect(ability.can('read', 'Query')).toBe(false);
+        });
+    });
+    describe('createConfigBasedAbilityBuilder', () => {
+        it('should build ability from role-based config', async () => {
+            const config = {
+                roles: {
+                    editor: [
+                        { action: 'read', subject: 'Post' },
+                        { action: 'create', subject: 'Post' },
+                        { action: 'update', subject: 'Post' },
+                    ],
+                    viewer: [{ action: 'read', subject: 'Post' }],
+                },
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const user = { id: '123', roles: ['editor'] };
+            const ability = await builder(user);
+            expect(ability.can('read', 'Post')).toBe(true);
+            expect(ability.can('create', 'Post')).toBe(true);
+            expect(ability.can('update', 'Post')).toBe(true);
+            expect(ability.can('delete', 'Post')).toBe(false);
+        });
+        it('should apply default rules', async () => {
+            const config = {
+                roles: {},
+                defaultRules: [
+                    { action: 'read', subject: 'Query' },
+                    { action: 'read', subject: 'PublicData' },
+                ],
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const ability = await builder();
+            expect(ability.can('read', 'Query')).toBe(true);
+            expect(ability.can('read', 'PublicData')).toBe(true);
+        });
+        it('should combine multiple roles', async () => {
+            const config = {
+                roles: {
+                    editor: [
+                        { action: 'create', subject: 'Post' },
+                        { action: 'update', subject: 'Post' },
+                    ],
+                    moderator: [
+                        { action: 'delete', subject: 'Comment' },
+                        { action: 'update', subject: 'Comment' },
+                    ],
+                },
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const user = { id: '123', roles: ['editor', 'moderator'] };
+            const ability = await builder(user);
+            expect(ability.can('create', 'Post')).toBe(true);
+            expect(ability.can('update', 'Post')).toBe(true);
+            expect(ability.can('delete', 'Comment')).toBe(true);
+            expect(ability.can('update', 'Comment')).toBe(true);
+        });
+        it('should handle field-level permissions', async () => {
+            const config = {
+                roles: {
+                    user: [
+                        { action: 'update', subject: 'User', fields: ['name', 'email'] },
+                        { action: 'update', subject: 'User', fields: 'role', inverted: true },
+                    ],
+                },
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const user = { id: '123', roles: ['user'] };
+            const ability = await builder(user);
+            expect(ability.can('update', 'User', 'name')).toBe(true);
+            expect(ability.can('update', 'User', 'email')).toBe(true);
+            expect(ability.can('update', 'User', 'role')).toBe(false);
+        });
+        it('should process userId template variables in conditions', async () => {
+            const config = {
+                roles: {
+                    user: [
+                        {
+                            action: 'update',
+                            subject: 'Post',
+                            conditions: { authorId: '{{userId}}' },
+                        },
+                    ],
+                },
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const user = { id: '123', roles: ['user'] };
+            const ability = await builder(user);
+            expect(ability.can('update', subject('Post', { authorId: '123' }))).toBe(true);
+            expect(ability.can('update', subject('Post', { authorId: '456' }))).toBe(false);
+        });
+        it('should handle user without roles', async () => {
+            const config = {
+                roles: {
+                    user: [{ action: 'read', subject: 'Post' }],
+                },
+                defaultRules: [{ action: 'read', subject: 'Query' }],
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const ability = await builder({ id: '123', roles: [] });
+            expect(ability.can('read', 'Query')).toBe(true);
+            expect(ability.can('read', 'Post')).toBe(false);
+        });
+        it('should handle undefined user', async () => {
+            const config = {
+                roles: {
+                    user: [{ action: 'read', subject: 'Post' }],
+                },
+                defaultRules: [{ action: 'read', subject: 'Query' }],
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const ability = await builder();
+            expect(ability.can('read', 'Query')).toBe(true);
+            expect(ability.can('read', 'Post')).toBe(false);
+        });
+        it('should handle role not defined in config', async () => {
+            const config = {
+                roles: {
+                    admin: [{ action: 'manage', subject: 'all' }],
+                },
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const user = { id: '123', roles: ['unknownRole'] };
+            const ability = await builder(user);
+            expect(ability.can('manage', 'all')).toBe(false);
+        });
+        it('should handle conditions without userId in template', async () => {
+            const config = {
+                roles: {
+                    user: [
+                        {
+                            action: 'update',
+                            subject: 'Post',
+                            conditions: { status: 'draft' },
+                        },
+                    ],
+                },
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const user = { id: '123', roles: ['user'] };
+            const ability = await builder(user);
+            expect(ability.can('update', subject('Post', { status: 'draft' }))).toBe(true);
+            expect(ability.can('update', subject('Post', { status: 'published' }))).toBe(false);
+        });
+    });
+    describe('createAbilityFactory', () => {
+        it('should create a factory function', () => {
+            const builderFn = (user) => {
+                const { can, build } = new AbilityBuilder(Ability);
+                can('read', 'Query');
+                if (user?.roles?.includes('admin')) {
+                    can('manage', 'all');
+                }
+                return build({ detectSubjectType });
+            };
+            const factory = createAbilityFactory(builderFn);
+            expect(typeof factory).toBe('function');
+            const ability1 = factory();
+            expect(ability1.can('read', 'Query')).toBe(true);
+            expect(ability1.can('manage', 'all')).toBe(false);
+            const ability2 = factory({ id: '123', roles: ['admin'] });
+            expect(ability2.can('manage', 'all')).toBe(true);
+        });
+    });
+    describe('createAbility with different builders', () => {
+        it('should work with database builder', async () => {
+            const mockFetchRules = vi.fn().mockResolvedValue([{ action: 'read', subject: 'Post', inverted: false }]);
+            const builder = createDatabaseAbilityBuilder(mockFetchRules);
+            const user = { id: '123', roles: ['user'] };
+            const ability = await createAbility(user, builder);
+            expect(ability.can('read', 'Post')).toBe(true);
+        });
+        it('should work with config-based builder', async () => {
+            const config = {
+                roles: {
+                    admin: [{ action: 'manage', subject: 'all' }],
+                },
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            const user = { id: '123', roles: ['admin'] };
+            const ability = await createAbility(user, builder);
+            expect(ability.can('manage', 'all')).toBe(true);
+        });
+    });
 });

package/dist/tests/jwt.test.js

@@ -369,3 +369,332 @@ describe('JWT Configuration Validation', () => {
         }).not.toThrow();
     });
 });
+describe('JWT Middleware - Advanced Tests', () => {
+    const SECRET = 'test-secret-key';
+    beforeEach(() => {
+        vi.clearAllMocks();
+        // Clear environment for tests
+        delete process.env.NODE_ENV;
+    });
+    describe('Configuration validation', () => {
+        it('should throw error when enabled without secret or publicKey', () => {
+            expect(() => createJWTMiddleware({ enabled: true })).toThrow('JWT middleware requires either secret or publicKey');
+        });
+        it('should not throw when disabled without secret', () => {
+            expect(() => createJWTMiddleware({ enabled: false })).not.toThrow();
+        });
+        it('should accept publicKey instead of secret', () => {
+            const publicKey = '-----BEGIN PUBLIC KEY-----\ntest\n-----END PUBLIC KEY-----';
+            expect(() => createJWTMiddleware({ enabled: true, publicKey })).not.toThrow();
+        });
+    });
+    describe('Token extraction from different header sources', () => {
+        it('should extract token from req.headers.get', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
+            const context = {
+                req: {
+                    headers: {
+                        get: vi.fn((name) => (name === 'authorization' ? `Bearer ${token}` : null)),
+                    },
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toEqual({ id: '123', roles: ['user'], sub: '123', iat: expect.any(Number) });
+            expect(next).toHaveBeenCalled();
+        });
+        it('should extract token from request.headers.get', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
+            const context = {
+                request: {
+                    headers: {
+                        get: vi.fn((name) => (name === 'authorization' ? `Bearer ${token}` : null)),
+                    },
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toEqual({ id: '123', roles: ['user'], sub: '123', iat: expect.any(Number) });
+            expect(next).toHaveBeenCalled();
+        });
+        it('should extract token from context.headers object', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toEqual({ id: '123', roles: ['user'], sub: '123', iat: expect.any(Number) });
+            expect(next).toHaveBeenCalled();
+        });
+        it('should use custom header name', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, headerName: 'x-auth-token' });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
+            const context = {
+                headers: {
+                    'x-auth-token': `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toBeDefined();
+            expect(next).toHaveBeenCalled();
+        });
+    });
+    describe('Token prefix handling', () => {
+        it('should handle token without Bearer prefix', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, tokenPrefix: '' });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
+            const context = {
+                headers: {
+                    authorization: token,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toBeDefined();
+            expect(next).toHaveBeenCalled();
+        });
+        it('should handle custom token prefix', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, tokenPrefix: 'Token ' });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
+            const context = {
+                headers: {
+                    authorization: `Token ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toBeDefined();
+            expect(next).toHaveBeenCalled();
+        });
+    });
+    describe('Optional mode', () => {
+        it('should continue without error when optional and no token provided', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, optional: true });
+            const context = {
+                headers: {},
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            const result = await middleware(context, next);
+            expect(result).toBe('success');
+            expect(context.user).toBeUndefined();
+            expect(next).toHaveBeenCalled();
+        });
+        it('should log warning in development mode when token is invalid', async () => {
+            process.env.NODE_ENV = 'development';
+            const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => { });
+            const middleware = createJWTMiddleware({ secret: SECRET, optional: true });
+            const context = {
+                headers: {
+                    authorization: 'Bearer invalid-token',
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(consoleSpy).toHaveBeenCalled();
+            expect(next).toHaveBeenCalled();
+            consoleSpy.mockRestore();
+        });
+        it('should not log warning in production mode when token is invalid', async () => {
+            process.env.NODE_ENV = 'production';
+            const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => { });
+            const middleware = createJWTMiddleware({ secret: SECRET, optional: true });
+            const context = {
+                headers: {
+                    authorization: 'Bearer invalid-token',
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(consoleSpy).not.toHaveBeenCalled();
+            expect(next).toHaveBeenCalled();
+            consoleSpy.mockRestore();
+        });
+    });
+    describe('Token verification options', () => {
+        it('should verify token with issuer', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, issuer: 'test-issuer' });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { issuer: 'test-issuer' });
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toBeDefined();
+            expect(next).toHaveBeenCalled();
+        });
+        it('should reject token with wrong issuer', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, issuer: 'expected-issuer' });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { issuer: 'wrong-issuer' });
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn();
+            await expect(middleware(context, next)).rejects.toThrow();
+        });
+        it('should verify token with audience', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, audience: 'test-audience' });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { audience: 'test-audience' });
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toBeDefined();
+            expect(next).toHaveBeenCalled();
+        });
+        it('should handle maxAge verification', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, maxAge: '1h' });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toBeDefined();
+            expect(next).toHaveBeenCalled();
+        });
+        it('should use custom algorithms', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, algorithms: ['HS384'] });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { algorithm: 'HS384' });
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toBeDefined();
+            expect(next).toHaveBeenCalled();
+        });
+    });
+    describe('Custom user extractor', () => {
+        it('should use custom extractUser function', async () => {
+            const customExtractor = (payload) => ({
+                id: payload.user_id,
+                roles: payload.user_roles,
+                email: payload.email,
+            });
+            const middleware = createJWTMiddleware({ secret: SECRET, extractUser: customExtractor });
+            const token = jwt.sign({ user_id: '123', user_roles: ['admin'], email: 'test@example.com' }, SECRET);
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toEqual({
+                id: '123',
+                roles: ['admin'],
+                email: 'test@example.com',
+            });
+            expect(next).toHaveBeenCalled();
+        });
+        it('should handle extractUser returning undefined', async () => {
+            const customExtractor = () => undefined;
+            const middleware = createJWTMiddleware({ secret: SECRET, extractUser: customExtractor });
+            const token = jwt.sign({ sub: '123' }, SECRET);
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.user).toBeUndefined();
+            // jwtPayload is only set when user is defined
+            expect(context.jwtPayload).toBeUndefined();
+            expect(next).toHaveBeenCalled();
+        });
+    });
+    describe('Error handling', () => {
+        it('should throw error when required and no token provided', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET, optional: false });
+            const context = {
+                headers: {},
+            };
+            const next = vi.fn();
+            await expect(middleware(context, next)).rejects.toThrow('No authorization header found');
+        });
+        it('should throw specific error for expired token', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { expiresIn: '-1s' });
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn();
+            await expect(middleware(context, next)).rejects.toThrow('Token has expired');
+        });
+        it('should throw specific error for invalid signature', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET });
+            const token = jwt.sign({ sub: '123', roles: ['user'] }, 'wrong-secret');
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn();
+            await expect(middleware(context, next)).rejects.toThrow('Invalid token');
+        });
+        it('should throw error for malformed token', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET });
+            const context = {
+                headers: {
+                    authorization: 'Bearer malformed.token',
+                },
+            };
+            const next = vi.fn();
+            await expect(middleware(context, next)).rejects.toThrow();
+        });
+    });
+    describe('JWT payload storage', () => {
+        it('should store JWT payload in context', async () => {
+            const middleware = createJWTMiddleware({ secret: SECRET });
+            const payload = { sub: '123', roles: ['user'], custom: 'data' };
+            const token = jwt.sign(payload, SECRET);
+            const context = {
+                headers: {
+                    authorization: `Bearer ${token}`,
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            await middleware(context, next);
+            expect(context.jwtPayload).toBeDefined();
+            expect(context.jwtPayload.sub).toBe('123');
+            expect(context.jwtPayload.custom).toBe('data');
+            expect(next).toHaveBeenCalled();
+        });
+    });
+    describe('Disabled mode', () => {
+        it('should skip JWT verification when disabled', async () => {
+            const middleware = createJWTMiddleware({ enabled: false, secret: SECRET });
+            const context = {
+                headers: {
+                    authorization: 'Bearer invalid-token',
+                },
+            };
+            const next = vi.fn().mockResolvedValue('success');
+            const result = await middleware(context, next);
+            expect(result).toBe('success');
+            expect(context.user).toBeUndefined();
+            expect(next).toHaveBeenCalled();
+        });
+    });
+});

package/dist/tests/types.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.test.d.ts.map

package/dist/tests/types.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.test.d.ts","sourceRoot":"","sources":["../../tests/types.test.ts"],"names":[],"mappings":""}

package/dist/tests/types.test.js

@@ -0,0 +1,143 @@
+import { describe, it, expectTypeOf } from 'vitest';
+import { createAbility, detectSubjectType, defaultAbilityBuilder, createDatabaseAbilityBuilder, createConfigBasedAbilityBuilder, } from '../src/middleware/ability';
+import { createJWTMiddleware, createJWT } from '../src/middleware/jwt';
+import { createCaslMiddleware } from '../src/middleware/graphql';
+describe('Type Safety Tests', () => {
+    describe('Ability Types', () => {
+        it('should have correct AppAbility type structure', () => {
+            expectTypeOf().toExtend(); // AppAbility extends PureAbility base type
+        });
+        it('should infer correct return type for createAbility', async () => {
+            const ability = await createAbility({ id: '1', roles: ['user'] });
+            expectTypeOf(ability).toEqualTypeOf();
+        });
+        it('should accept AbilityBuilderFunction as parameter', () => {
+            const builder = user => defaultAbilityBuilder(user);
+            expectTypeOf(builder).parameter(0).toEqualTypeOf();
+            expectTypeOf(builder).returns.resolves.toEqualTypeOf();
+        });
+        it('should have correct detectSubjectType signature', () => {
+            expectTypeOf(detectSubjectType).parameter(0).toEqualTypeOf();
+            expectTypeOf(detectSubjectType).returns.toEqualTypeOf();
+        });
+        it('should type database ability builder correctly', () => {
+            const fetchRules = async (userId) => [];
+            const builder = createDatabaseAbilityBuilder(fetchRules);
+            expectTypeOf(builder).parameter(0).toEqualTypeOf();
+            expectTypeOf(builder).returns.resolves.toEqualTypeOf();
+        });
+        it('should type config-based ability builder correctly', () => {
+            const config = {
+                roles: {
+                    admin: [{ action: 'manage', subject: 'all' }],
+                },
+            };
+            const builder = createConfigBasedAbilityBuilder(config);
+            expectTypeOf(builder).parameter(0).toEqualTypeOf();
+            // Builder returns AppAbility synchronously
+            expectTypeOf(builder).toBeFunction();
+        });
+    });
+    describe('JWT Types', () => {
+        it('should have correct JWTConfig type structure', () => {
+            const config = {
+                secret: 'test',
+                enabled: true,
+                optional: false,
+            };
+            expectTypeOf(config).toExtend(); // Check config has at least these properties
+        });
+        it('should have correct JWTPayload structure', () => {
+            expectTypeOf().toHaveProperty('sub');
+            expectTypeOf().toHaveProperty('iat');
+        });
+        it('should infer correct return type for createJWT', () => {
+            const user = { id: '1', roles: ['user'] };
+            const token = createJWT(user, { secret: 'test' });
+            expectTypeOf(token).toBeString();
+        });
+        it('should type middleware correctly', () => {
+            const middleware = createJWTMiddleware({ secret: 'test' });
+            expectTypeOf(middleware).parameter(0).toEqualTypeOf();
+            expectTypeOf(middleware).parameter(1).toBeFunction();
+            expectTypeOf(middleware).returns.toEqualTypeOf();
+        });
+    });
+    describe('GraphQL Middleware Types', () => {
+        it('should have correct MiddlewareOptions type structure', () => {
+            const options = {
+                subjectMap: {},
+                actionMap: {},
+                fieldPermissions: {},
+                debug: false,
+            };
+            expectTypeOf(options).toExtend(); // Check options has at least these properties
+        });
+        it('should type middleware function correctly', () => {
+            const middleware = createCaslMiddleware();
+            expectTypeOf(middleware).toBeFunction();
+            expectTypeOf(middleware).parameter(0).toBeFunction(); // resolve
+            expectTypeOf(middleware).parameter(1).toBeAny(); // root
+            expectTypeOf(middleware).parameter(2).toBeAny(); // args
+            expectTypeOf(middleware).parameter(3).toEqualTypeOf(); // context
+            expectTypeOf(middleware).returns.toEqualTypeOf();
+        });
+    });
+    describe('Context Types', () => {
+        it('should have correct Context type structure', () => {
+            expectTypeOf().toHaveProperty('ability');
+            expectTypeOf().toHaveProperty('user');
+        });
+        it('should have correct User type structure', () => {
+            expectTypeOf().toHaveProperty('id');
+            expectTypeOf().toHaveProperty('roles');
+            const user = { id: '1', roles: ['admin'] };
+            expectTypeOf(user.id).toBeString();
+            // roles is optional, so check the array type when present
+            if (user.roles) {
+                expectTypeOf(user.roles).toEqualTypeOf();
+            }
+        });
+        it('should allow optional properties on User', () => {
+            const userWithOptionals = {
+                id: '1',
+                roles: ['user'],
+                email: 'test@example.com',
+            };
+            expectTypeOf(userWithOptionals).toExtend(); // Check that object is assignable to User type
+        });
+    });
+    describe('Ability Rule Types', () => {
+        it('should correctly type ability actions', () => {
+            const ability = defaultAbilityBuilder({ id: '1', roles: ['user'] });
+            // Type checking that these calls are valid
+            expectTypeOf(ability.can).parameter(0).toBeString();
+            expectTypeOf(ability.can).parameter(1).toEqualTypeOf();
+        });
+        it('should support subject type checking', () => {
+            const ability = defaultAbilityBuilder({ id: '1', roles: ['user'] });
+            // Verify can() method signature accepts string action and optional subject
+            expectTypeOf(ability.can).parameter(0).toBeString();
+            expectTypeOf(ability.can).toBeCallableWith('read', 'Post');
+            expectTypeOf(ability.can).toBeCallableWith('read', undefined);
+        });
+    });
+    describe('Builder Function Types', () => {
+        it('should accept sync and async builder functions', () => {
+            const syncBuilder = () => defaultAbilityBuilder();
+            const asyncBuilder = async () => defaultAbilityBuilder();
+            // Both should be valid builder functions
+            expectTypeOf(syncBuilder).toBeFunction();
+            expectTypeOf(asyncBuilder).toBeFunction();
+            expectTypeOf(asyncBuilder).returns.resolves.toEqualTypeOf();
+        });
+        it('should enforce correct parameter types for builders', () => {
+            const builder = user => {
+                expectTypeOf(user).toEqualTypeOf();
+                return defaultAbilityBuilder(user);
+            };
+            expectTypeOf(builder).toBeCallableWith(undefined);
+            expectTypeOf(builder).toBeCallableWith({ id: '1', roles: [] });
+        });
+    });
+});

package/dist/tests/yoga-plugin.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
-import { yogaCaslPlugin } from '../src/middleware/yoga';
+import { yogaCaslPlugin, createYogaPlugin } from '../src/middleware/yoga';
 describe('Yoga CASL Plugin', () => {
     it('should be a valid Yoga plugin', () => {
         expect(yogaCaslPlugin).toBeDefined();
@@ -44,4 +44,82 @@ describe('Yoga CASL Plugin', () => {
         const ability = extendedData.ability;
         expect(ability.can('read', 'Query')).toBe(true);
     });
+    describe('createYogaPlugin', () => {
+        it('should create a plugin with default options', () => {
+            const plugin = createYogaPlugin();
+            expect(plugin).toBeDefined();
+            expect(plugin).toHaveProperty('onExecute');
+            expect(typeof plugin.onExecute).toBe('function');
+        });
+        it('should create a plugin with custom options', () => {
+            const customBuilder = async () => {
+                const { defaultAbilityBuilder } = await import('../src/middleware/ability');
+                return defaultAbilityBuilder();
+            };
+            const plugin = createYogaPlugin({
+                abilityBuilder: customBuilder,
+            });
+            expect(plugin).toBeDefined();
+            expect(plugin).toHaveProperty('onExecute');
+        });
+        it('should log message when onExecute is called', async () => {
+            const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => { });
+            const plugin = createYogaPlugin();
+            const mockArgs = {
+                args: {
+                    schema: {},
+                    document: {},
+                    contextValue: {},
+                },
+            };
+            await plugin.onExecute(mockArgs);
+            expect(consoleSpy).toHaveBeenCalledWith('Yoga plugin not yet implemented');
+            consoleSpy.mockRestore();
+        });
+    });
+    describe('yogaCaslPlugin edge cases', () => {
+        it('should handle missing onContextBuilding gracefully', async () => {
+            // Test that the plugin has the expected property
+            expect(yogaCaslPlugin.onContextBuilding).toBeDefined();
+        });
+        it('should extend context even with empty initial context', async () => {
+            let extendedData = {};
+            const extendContext = vi.fn(extension => {
+                extendedData = extension;
+            });
+            const contextParams = {
+                context: {},
+                extendContext,
+            };
+            await yogaCaslPlugin.onContextBuilding(contextParams);
+            expect(extendContext).toHaveBeenCalled();
+            expect(extendedData).toHaveProperty('ability');
+            expect(extendedData).toHaveProperty('user');
+        });
+        it('should create ability with default permissions', async () => {
+            let extendedData = {};
+            const extendContext = vi.fn(extension => {
+                extendedData = extension;
+            });
+            const contextParams = {
+                context: {},
+                extendContext,
+            };
+            await yogaCaslPlugin.onContextBuilding(contextParams);
+            const ability = extendedData.ability;
+            // Default ability should have Query read access
+            expect(ability.can('read', 'Query')).toBe(true);
+        });
+        it('should handle context extension errors', async () => {
+            const extendContext = vi.fn(() => {
+                throw new Error('Extension failed');
+            });
+            const contextParams = {
+                context: {},
+                extendContext,
+            };
+            // Should not throw, but let the error propagate
+            await expect(yogaCaslPlugin.onContextBuilding(contextParams)).rejects.toThrow('Extension failed');
+        });
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stonecrop/casl-middleware",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "license": "MIT",
   "type": "module",
   "homepage": "https://github.com/agritheory/stonecrop#readme",