@terreno/api 0.10.0 → 0.11.1

package/bunfig.toml

@@ -2,6 +2,9 @@
 preload = ["./src/tests/bunSetup.ts"]
 root = "./src"
 coverage = true
-coverageExclude = ["dist/**", "**/*.test.ts", "**/tests/**"]
-coverageThreshold = { line = 80, function = 80 }
+coveragePathIgnorePatterns = ["dist/**", "**/*.test.ts", "**/tests/**", "**/vendor/**", "../**"]
+# Enforced by scripts/check-coverage.ts; Bun parses this key but does not
+# fail the run when coverage is below threshold. See
+# https://github.com/oven-sh/bun/issues/7367 and https://github.com/oven-sh/bun/pull/27933.
+coverageThreshold = { line = 95, function = 95 }
 

package/dist/auth.test.js

@@ -910,4 +910,261 @@ var utils_1 = require("./utils");
             }
         });
     }); });
+    (0, bun_test_1.it)("throws when TOKEN_SECRET is not set", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var caught, error_1;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.TOKEN_SECRET = "";
+                    _a.label = 1;
+                case 1:
+                    _a.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, (0, auth_1.generateTokens)({ _id: "user-123" })];
+                case 2:
+                    _a.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_1 = _a.sent();
+                    caught = error_1;
+                    return [3 /*break*/, 4];
+                case 4:
+                    (0, bun_test_1.expect)(caught).toBeDefined();
+                    (0, bun_test_1.expect)(caught.message).toBe("TOKEN_SECRET must be set in env.");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("uses TOKEN_EXPIRES_IN from env when valid", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var jwtLib, result, decoded, expectedExp;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("jsonwebtoken")); })];
+                case 1:
+                    jwtLib = _a.sent();
+                    process.env.TOKEN_EXPIRES_IN = "2h";
+                    return [4 /*yield*/, (0, auth_1.generateTokens)({ _id: "user-123" })];
+                case 2:
+                    result = _a.sent();
+                    decoded = jwtLib.decode(result.token);
+                    expectedExp = Math.floor(Date.now() / 1000) + 2 * 3600;
+                    (0, bun_test_1.expect)(decoded.exp).toBeGreaterThan(expectedExp - 10);
+                    (0, bun_test_1.expect)(decoded.exp).toBeLessThan(expectedExp + 10);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("uses REFRESH_TOKEN_EXPIRES_IN from env when valid", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var jwtLib, result, decoded, expectedExp;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("jsonwebtoken")); })];
+                case 1:
+                    jwtLib = _a.sent();
+                    process.env.REFRESH_TOKEN_EXPIRES_IN = "1h";
+                    return [4 /*yield*/, (0, auth_1.generateTokens)({ _id: "user-123" })];
+                case 2:
+                    result = _a.sent();
+                    decoded = jwtLib.decode(result.refreshToken);
+                    expectedExp = Math.floor(Date.now() / 1000) + 3600;
+                    (0, bun_test_1.expect)(decoded.exp).toBeGreaterThan(expectedExp - 10);
+                    (0, bun_test_1.expect)(decoded.exp).toBeLessThan(expectedExp + 10);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("does not issue refresh token when REFRESH_TOKEN_SECRET is not set", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.REFRESH_TOKEN_SECRET = "";
+                    return [4 /*yield*/, (0, auth_1.generateTokens)({ _id: "user-123" })];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result.token).toBeDefined();
+                    (0, bun_test_1.expect)(result.refreshToken).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("addAuthRoutes /refresh_token error paths", function () {
+    var app;
+    var agent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, bun_test_1.setSystemTime)();
+                    return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _a.sent();
+                    app = (0, expressServer_1.setupServer)({
+                        addRoutes: function () { },
+                        skipListen: true,
+                        userModel: tests_1.UserModel,
+                    });
+                    agent = supertest_1.default.agent(app);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.afterEach)(function () {
+        (0, bun_test_1.setSystemTime)();
+    });
+    (0, bun_test_1.it)("returns 401 when no refreshToken in body", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.post("/auth/refresh_token").send({}).expect(401)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.message).toContain("No refresh token provided");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns 401 when refresh token is invalid", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/refresh_token")
+                        .send({ refreshToken: "not-a-valid-jwt" })
+                        .expect(401)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.message).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns 401 when refresh token is signed with wrong secret", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var jwtLib, bogusToken, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("jsonwebtoken")); })];
+                case 1:
+                    jwtLib = (_a.sent()).default;
+                    bogusToken = jwtLib.sign({ id: "abc" }, "different-secret");
+                    return [4 /*yield*/, agent
+                            .post("/auth/refresh_token")
+                            .send({ refreshToken: bogusToken })
+                            .expect(401)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.message).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns 401 when refresh token has no id", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var jwtLib, tokenNoId, res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("jsonwebtoken")); })];
+                case 1:
+                    jwtLib = (_a.sent()).default;
+                    tokenNoId = jwtLib.sign({ foo: "bar" }, process.env.REFRESH_TOKEN_SECRET);
+                    return [4 /*yield*/, agent.post("/auth/refresh_token").send({ refreshToken: tokenNoId }).expect(401)];
+                case 2:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.message).toBe("Invalid refresh token");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("issues new tokens on valid refresh", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, adminUser, jwtLib, validToken, res;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _a = __read.apply(void 0, [_b.sent(), 1]), adminUser = _a[0];
+                    return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("jsonwebtoken")); })];
+                case 2:
+                    jwtLib = (_b.sent()).default;
+                    validToken = jwtLib.sign({ id: adminUser._id.toString() }, process.env.REFRESH_TOKEN_SECRET);
+                    return [4 /*yield*/, agent
+                            .post("/auth/refresh_token")
+                            .send({ refreshToken: validToken })
+                            .expect(200)];
+                case 3:
+                    res = _b.sent();
+                    (0, bun_test_1.expect)(res.body.data.token).toBeDefined();
+                    (0, bun_test_1.expect)(res.body.data.refreshToken).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("addMeRoutes edge cases", function () {
+    var app;
+    var agent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, bun_test_1.setSystemTime)();
+                    return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _a.sent();
+                    app = (0, expressServer_1.setupServer)({
+                        addRoutes: function () { },
+                        skipListen: true,
+                        userModel: tests_1.UserModel,
+                    });
+                    agent = supertest_1.default.agent(app);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.afterEach)(function () {
+        (0, bun_test_1.setSystemTime)();
+    });
+    (0, bun_test_1.it)("GET /auth/me returns 401 without auth", function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.get("/auth/me").expect(401)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("PATCH /auth/me returns 401 without auth", function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent.patch("/auth/me").send({ email: "x@x.com" }).expect(401)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("GET /auth/me returns 404 when user is deleted after auth", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _admin, notAdmin, jwtLib, token, res;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _a = __read.apply(void 0, [_b.sent(), 2]), _admin = _a[0], notAdmin = _a[1];
+                    return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("jsonwebtoken")); })];
+                case 2:
+                    jwtLib = (_b.sent()).default;
+                    token = jwtLib.sign({ id: notAdmin._id.toString() }, process.env.TOKEN_SECRET, { issuer: process.env.TOKEN_ISSUER });
+                    // Delete the user so findById returns null
+                    return [4 /*yield*/, tests_1.UserModel.deleteOne({ _id: notAdmin._id })];
+                case 3:
+                    // Delete the user so findById returns null
+                    _b.sent();
+                    return [4 /*yield*/, agent.get("/auth/me").set("authorization", "Bearer ".concat(token))];
+                case 4:
+                    res = _b.sent();
+                    // Either 404 (user not found in /me handler) or 401 (auth middleware rejects)
+                    (0, bun_test_1.expect)([401, 404]).toContain(res.status);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
 });

package/dist/consentApp.test.js

@@ -1065,6 +1065,251 @@ var buildApp = function (consentAppOptions) {
             });
         }); });
     });
+    (0, bun_test_1.describe)("POST /consent-forms/generate (aiConfig)", function () {
+        var aiConfig = {
+            generateContent: function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {
+                var type = _b.type, description = _b.description, locale = _b.locale;
+                return __generator(this, function (_c) {
+                    return [2 /*return*/, "Generated ".concat(type, " content (").concat(locale, ") for: ").concat(description)];
+                });
+            }); },
+            translateContent: function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {
+                var content = _b.content, fromLocale = _b.fromLocale, toLocale = _b.toLocale;
+                return __generator(this, function (_c) {
+                    return [2 /*return*/, "[".concat(fromLocale, "->").concat(toLocale, "] ").concat(content)];
+                });
+            }); },
+        };
+        (0, bun_test_1.it)("generates consent form content for admins", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiAdmin, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "admin")];
+                    case 1:
+                        aiAdmin = _a.sent();
+                        return [4 /*yield*/, aiAdmin
+                                .post("/consent-forms/generate")
+                                .send({ description: "Privacy policy for a health app", locale: "es", type: "privacy" })
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.content).toBe("Generated privacy content (es) for: Privacy policy for a health app");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("defaults locale to en when not provided", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiAdmin, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "admin")];
+                    case 1:
+                        aiAdmin = _a.sent();
+                        return [4 /*yield*/, aiAdmin
+                                .post("/consent-forms/generate")
+                                .send({ description: "Terms", type: "terms" })
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.content).toContain("(en)");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 403 for non-admin users", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiUser;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "notAdmin")];
+                    case 1:
+                        aiUser = _a.sent();
+                        return [4 /*yield*/, aiUser
+                                .post("/consent-forms/generate")
+                                .send({ description: "Privacy", type: "privacy" })
+                                .expect(403)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when type is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiAdmin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "admin")];
+                    case 1:
+                        aiAdmin = _a.sent();
+                        return [4 /*yield*/, aiAdmin.post("/consent-forms/generate").send({ description: "Privacy" }).expect(400)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when description is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiAdmin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "admin")];
+                    case 1:
+                        aiAdmin = _a.sent();
+                        return [4 /*yield*/, aiAdmin.post("/consent-forms/generate").send({ type: "privacy" }).expect(400)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 404 when aiConfig is not provided", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent
+                            .post("/consent-forms/generate")
+                            .send({ description: "Privacy", type: "privacy" })
+                            .expect(404)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    (0, bun_test_1.describe)("POST /consent-forms/translate (aiConfig)", function () {
+        var aiConfig = {
+            generateContent: function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {
+                var type = _b.type, description = _b.description, locale = _b.locale;
+                return __generator(this, function (_c) {
+                    return [2 /*return*/, "Generated ".concat(type, " content (").concat(locale, ") for: ").concat(description)];
+                });
+            }); },
+            translateContent: function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {
+                var content = _b.content, fromLocale = _b.fromLocale, toLocale = _b.toLocale;
+                return __generator(this, function (_c) {
+                    return [2 /*return*/, "[".concat(fromLocale, "->").concat(toLocale, "] ").concat(content)];
+                });
+            }); },
+        };
+        (0, bun_test_1.it)("translates consent form content for admins", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiAdmin, res;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "admin")];
+                    case 1:
+                        aiAdmin = _a.sent();
+                        return [4 /*yield*/, aiAdmin
+                                .post("/consent-forms/translate")
+                                .send({ content: "Hello world", fromLocale: "en", toLocale: "es" })
+                                .expect(200)];
+                    case 2:
+                        res = _a.sent();
+                        (0, bun_test_1.expect)(res.body.data.content).toBe("[en->es] Hello world");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 403 for non-admin users", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiUser;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "notAdmin")];
+                    case 1:
+                        aiUser = _a.sent();
+                        return [4 /*yield*/, aiUser
+                                .post("/consent-forms/translate")
+                                .send({ content: "Hello", fromLocale: "en", toLocale: "es" })
+                                .expect(403)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when content is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiAdmin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "admin")];
+                    case 1:
+                        aiAdmin = _a.sent();
+                        return [4 /*yield*/, aiAdmin
+                                .post("/consent-forms/translate")
+                                .send({ fromLocale: "en", toLocale: "es" })
+                                .expect(400)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when fromLocale is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiAdmin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "admin")];
+                    case 1:
+                        aiAdmin = _a.sent();
+                        return [4 /*yield*/, aiAdmin
+                                .post("/consent-forms/translate")
+                                .send({ content: "Hello", toLocale: "es" })
+                                .expect(400)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 400 when toLocale is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+            var aiApp, aiAdmin;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        aiApp = buildApp({ aiConfig: aiConfig });
+                        return [4 /*yield*/, (0, tests_1.authAsUser)(aiApp, "admin")];
+                    case 1:
+                        aiAdmin = _a.sent();
+                        return [4 /*yield*/, aiAdmin
+                                .post("/consent-forms/translate")
+                                .send({ content: "Hello", fromLocale: "en" })
+                                .expect(400)];
+                    case 2:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        (0, bun_test_1.it)("returns 404 when aiConfig is not provided", function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, adminAgent
+                            .post("/consent-forms/translate")
+                            .send({ content: "Hello", fromLocale: "en", toLocale: "es" })
+                            .expect(404)];
+                    case 1:
+                        _a.sent();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
     (0, bun_test_1.describe)("GET /consents/audit/:userId", function () {
         (0, bun_test_1.it)("returns audit history for a user when auditTrail is enabled", function () { return __awaiter(void 0, void 0, void 0, function () {
             var form, res;