@tumbaland/backend-core 1.44.0 → 1.45.0

package/src/middleware/internalServiceAuth.test.ts

@@ -1,173 +0,0 @@
-import { Request, Response } from 'express';
-
-jest.mock('../logging/logger', () => ({
-  __esModule: true,
-  default: { error: jest.fn(), warn: jest.fn(), info: jest.fn(), debug: jest.fn(), http: jest.fn() }
-}));
-
-import {
-  allowUserOrInternalService,
-  internalServiceTokenBypass,
-  requireInternalServiceToken,
-  verifyInternalToken
-} from './internalServiceAuth';
-
-function mockRes(): Response {
-  const res: Partial<Response> = {};
-  res.status = jest.fn().mockReturnValue(res);
-  res.json = jest.fn().mockReturnValue(res);
-  return res as Response;
-}
-
-function mockReq(headers: Record<string, string> = {}): Request {
-  return { headers, originalUrl: '/internal/entitlements' } as unknown as Request;
-}
-
-const ORIGINAL_ENV = process.env;
-
-beforeEach(() => {
-  process.env = { ...ORIGINAL_ENV, INTERNAL_SERVICE_TOKEN: 'test-internal-token' };
-});
-
-afterAll(() => {
-  process.env = ORIGINAL_ENV;
-});
-
-describe('verifyInternalToken', () => {
-  it('accepts only an exact match', () => {
-    expect(verifyInternalToken('test-internal-token')).toBe(true);
-    expect(verifyInternalToken('test-internal-tokeN')).toBe(false);
-  });
-
-  it('rejects a prefix or an extension without throwing on the length mismatch', () => {
-    expect(verifyInternalToken('test')).toBe(false);
-    expect(verifyInternalToken('test-internal-token-and-more')).toBe(false);
-  });
-
-  it('rejects anything that is not a non-empty string', () => {
-    expect(verifyInternalToken(undefined)).toBe(false);
-    expect(verifyInternalToken('')).toBe(false);
-    expect(verifyInternalToken(['test-internal-token'])).toBe(false);
-  });
-
-  it('rejects everything when no token is configured', () => {
-    delete process.env.INTERNAL_SERVICE_TOKEN;
-
-    expect(verifyInternalToken('test-internal-token')).toBe(false);
-  });
-});
-
-describe('requireInternalServiceToken', () => {
-  it('marks the request internal and continues on a valid token', () => {
-    const req = mockReq({ 'x-internal-token': 'test-internal-token', 'x-service-id': 'album-service' });
-    const next = jest.fn();
-
-    requireInternalServiceToken(req, mockRes(), next);
-
-    expect(req.isInternalService).toBe(true);
-    expect(req.serviceIdentifier).toBe('album-service');
-    expect(next).toHaveBeenCalledTimes(1);
-  });
-
-  it('defaults the service identifier when the header is absent', () => {
-    const req = mockReq({ 'x-internal-token': 'test-internal-token' });
-
-    requireInternalServiceToken(req, mockRes(), jest.fn());
-
-    expect(req.serviceIdentifier).toBe('unknown');
-  });
-
-  it('rejects a missing token with 401', () => {
-    const res = mockRes();
-    const next = jest.fn();
-
-    requireInternalServiceToken(mockReq(), res, next);
-
-    expect(res.status).toHaveBeenCalledWith(401);
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('rejects a wrong token with 401', () => {
-    const res = mockRes();
-    const next = jest.fn();
-
-    requireInternalServiceToken(mockReq({ 'x-internal-token': 'wrong' }), res, next);
-
-    expect(res.status).toHaveBeenCalledWith(401);
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('fails with 500 rather than open when the deployment has no token configured', () => {
-    delete process.env.INTERNAL_SERVICE_TOKEN;
-    const res = mockRes();
-    const next = jest.fn();
-
-    requireInternalServiceToken(mockReq({ 'x-internal-token': 'anything' }), res, next);
-
-    expect(res.status).toHaveBeenCalledWith(500);
-    expect(next).not.toHaveBeenCalled();
-  });
-});
-
-describe('internalServiceTokenBypass', () => {
-  it('passes a request with no internal header through untouched, for normal user auth', () => {
-    const req = mockReq();
-    const next = jest.fn();
-
-    internalServiceTokenBypass(req, mockRes(), next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(req.isInternalService).toBeUndefined();
-  });
-
-  it('rejects a bogus token instead of letting it stand in for authentication', () => {
-    // The bug this replaces: the header's mere presence used to skip JWT
-    // verification, so `x-internal-token: anything` reached the controller
-    // unauthenticated on any route that did not mount a second middleware.
-    const res = mockRes();
-    const next = jest.fn();
-
-    internalServiceTokenBypass(mockReq({ 'x-internal-token': 'anything' }), res, next);
-
-    expect(res.status).toHaveBeenCalledWith(401);
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('marks a valid internal call and continues', () => {
-    const req = mockReq({ 'x-internal-token': 'test-internal-token' });
-    const next = jest.fn();
-
-    internalServiceTokenBypass(req, mockRes(), next);
-
-    expect(req.isInternalService).toBe(true);
-    expect(next).toHaveBeenCalledTimes(1);
-  });
-});
-
-describe('allowUserOrInternalService', () => {
-  it('allows an internal service', () => {
-    const next = jest.fn();
-
-    allowUserOrInternalService({ isInternalService: true } as Request, mockRes(), next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-  });
-
-  it('allows an authenticated user', () => {
-    const next = jest.fn();
-
-    allowUserOrInternalService({ user: { email: 'u@example.com' } } as Request, mockRes(), next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-  });
-
-  it('rejects anyone else with 401', () => {
-    const res = mockRes();
-    const next = jest.fn();
-
-    allowUserOrInternalService({} as Request, res, next);
-
-    expect(res.status).toHaveBeenCalledWith(401);
-    expect(next).not.toHaveBeenCalled();
-  });
-});

package/src/middleware/internalServiceAuth.ts

@@ -1,96 +0,0 @@
-import { Request, RequestHandler } from 'express';
-import { timingSafeEqual } from 'crypto';
-import logger from '../logging/logger';
-
-/**
- * Fields set by the internal-service middlewares below. Declared globally so
- * routers and controllers read `req.isInternalService` off the same `Request`
- * type Express itself uses, with no cast at the call site.
- */
-declare global {
-  namespace Express {
-    interface Request {
-      isInternalService?: boolean;
-      serviceIdentifier?: string;
-    }
-  }
-}
-
-export const INTERNAL_TOKEN_HEADER = 'x-internal-token';
-export const SERVICE_ID_HEADER = 'x-service-id';
-
-/**
- * Constant-time comparison of the presented token against the configured one.
- *
- * `===` on secrets leaks their prefix through timing, and `timingSafeEqual`
- * throws on a length mismatch (which is itself a leak), so length is compared
- * first and both buffers are hashed to a fixed width — a token of the wrong
- * length takes the same path as one of the right length with wrong bytes.
- */
-export function verifyInternalToken(presented: unknown): boolean {
-  const expected = process.env.INTERNAL_SERVICE_TOKEN;
-  if (!expected) return false;
-  if (typeof presented !== 'string' || presented.length === 0) return false;
-
-  const a = Buffer.from(presented, 'utf8');
-  const b = Buffer.from(expected, 'utf8');
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(a, b);
-}
-
-function markInternal(req: Request): void {
-  req.isInternalService = true;
-  req.serviceIdentifier = (req.headers[SERVICE_ID_HEADER] as string) || 'unknown';
-}
-
-/**
- * Hard gate for endpoints that are only ever called service-to-service.
- * No user-JWT fallback: a missing or wrong token is always a 401.
- */
-export const requireInternalServiceToken: RequestHandler = (req, res, next) => {
-  if (!process.env.INTERNAL_SERVICE_TOKEN) {
-    logger.error('INTERNAL_SERVICE_TOKEN not configured');
-    res.status(500).json({ success: false, message: 'Internal service authentication not configured' });
-    return;
-  }
-
-  if (!verifyInternalToken(req.headers[INTERNAL_TOKEN_HEADER])) {
-    logger.warn('Rejected internal service request', {
-      serviceId: (req.headers[SERVICE_ID_HEADER] as string) || 'unknown',
-      path: req.originalUrl
-    });
-    res.status(401).json({ success: false, message: 'Invalid or missing internal service token' });
-    return;
-  }
-
-  markInternal(req);
-  next();
-};
-
-/**
- * For routers that serve both browsers and services: when the internal-token
- * header is present it is *verified here*, and a bad token is rejected rather
- * than passed along.
- *
- * The bug this replaces: treating the mere presence of the header as grounds to
- * skip JWT verification, leaving the real check to a second middleware mounted
- * per-router — so any route that forgot to mount the second one was reachable
- * by sending `x-internal-token: anything`.
- */
-export const internalServiceTokenBypass: RequestHandler = (req, res, next) => {
-  const presented = req.headers[INTERNAL_TOKEN_HEADER];
-  if (presented === undefined) {
-    next();
-    return;
-  }
-  requireInternalServiceToken(req, res, next);
-};
-
-/** Allows a request that authenticated as either a user or an internal service. */
-export const allowUserOrInternalService: RequestHandler = (req, res, next) => {
-  if (req.isInternalService || req.user) {
-    next();
-    return;
-  }
-  res.status(401).json({ success: false, message: 'Authentication required' });
-};

package/src/middleware/requestLogger.test.ts

@@ -1,81 +0,0 @@
-jest.mock('../logging/logger', () => ({
-  __esModule: true,
-  default: { info: jest.fn(), error: jest.fn(), warn: jest.fn(), debug: jest.fn(), http: jest.fn() }
-}));
-
-import logger from '../logging/logger';
-import { requestLogger, requestLoggerWithMetrics, simpleRequestLogger } from './requestLogger';
-
-function mockReqRes() {
-  const req: any = {
-    method: 'GET',
-    url: '/albums/123',
-    correlationId: 'corr-1',
-    ip: '127.0.0.1',
-    get: jest.fn().mockReturnValue('test-agent')
-  };
-  const res: any = { statusCode: 200, on: jest.fn() };
-  return { req, res };
-}
-
-describe('simpleRequestLogger', () => {
-  beforeEach(() => jest.clearAllMocks());
-
-  it('logs an inbound request line with correlation id, ip, and user agent', () => {
-    const { req, res } = mockReqRes();
-    const next = jest.fn();
-
-    simpleRequestLogger(req, res, next);
-
-    expect(logger.info).toHaveBeenCalledWith('→ GET /albums/123', {
-      correlationId: 'corr-1',
-      ip: '127.0.0.1',
-      userAgent: 'test-agent'
-    });
-    expect(next).toHaveBeenCalledTimes(1);
-  });
-
-  it('falls back to "unknown" correlation id when none was set on the request', () => {
-    const { req, res } = mockReqRes();
-    delete req.correlationId;
-    const next = jest.fn();
-
-    simpleRequestLogger(req, res, next);
-
-    expect(logger.info).toHaveBeenCalledWith(
-      expect.any(String),
-      expect.objectContaining({ correlationId: 'unknown' })
-    );
-  });
-
-  it('logs the outbound response line with status and duration once the response finishes', () => {
-    const { req, res } = mockReqRes();
-    const next = jest.fn();
-
-    simpleRequestLogger(req, res, next);
-
-    expect(res.on).toHaveBeenCalledWith('finish', expect.any(Function));
-    const finishHandler = res.on.mock.calls.find((c: any[]) => c[0] === 'finish')[1];
-    res.statusCode = 200;
-    finishHandler();
-
-    expect(logger.info).toHaveBeenCalledWith(
-      expect.stringMatching(/^← GET \/albums\/123 200 \d+ms$/),
-      expect.objectContaining({ correlationId: 'corr-1', statusCode: 200 })
-    );
-  });
-});
-
-describe('requestLogger', () => {
-  it('is a Morgan middleware function', () => {
-    expect(typeof requestLogger).toBe('function');
-  });
-});
-
-describe('requestLoggerWithMetrics', () => {
-  it('bundles requestLogger and metricsMiddleware as a two-item array', () => {
-    expect(requestLoggerWithMetrics).toHaveLength(2);
-    expect(requestLoggerWithMetrics[0]).toBe(requestLogger);
-    expect(typeof requestLoggerWithMetrics[1]).toBe('function');
-  });
-});

package/src/middleware/requestLogger.ts

@@ -1,48 +0,0 @@
-import morgan from 'morgan';
-import { Request, Response, NextFunction } from 'express';
-import logger from '../logging/logger';
-import { metricsMiddleware } from '../metrics';
-
-/**
- * Morgan middleware configured to use Winston logger
- * Logs HTTP requests in structured format
- */
-export const requestLogger = morgan('combined', {
-  stream: {
-    write: (message: string) => {
-      logger.http(message.trim());
-    }
-  }
-});
-
-/**
- * Combined middleware that includes both logging and metrics
- * Use this instead of separate requestLogger and metricsMiddleware
- */
-export const requestLoggerWithMetrics = [requestLogger, metricsMiddleware];
-
-/**
- * Simple request logger for development
- * Logs basic request info with correlation ID
- */
-export const simpleRequestLogger = (req: Request, res: Response, next: NextFunction) => {
-  const start = Date.now();
-  const correlationId = req.correlationId || 'unknown';
-
-  logger.info(`→ ${req.method} ${req.url}`, {
-    correlationId,
-    ip: req.ip,
-    userAgent: req.get('User-Agent')
-  });
-
-  res.on('finish', () => {
-    const duration = Date.now() - start;
-    logger.info(`← ${req.method} ${req.url} ${res.statusCode} ${duration}ms`, {
-      correlationId,
-      statusCode: res.statusCode,
-      duration
-    });
-  });
-
-  next();
-};

package/src/middleware/security.test.ts

@@ -1,45 +0,0 @@
-import express from 'express';
-import request from 'supertest';
-import { securityHeaders, createRateLimiter } from './security';
-
-describe('securityHeaders', () => {
-  const app = express();
-  app.use(securityHeaders);
-  app.get('/ping', (_req, res) => res.json({ ok: true }));
-
-  it('sets standard helmet protections', async () => {
-    const res = await request(app).get('/ping');
-
-    expect(res.headers['x-content-type-options']).toBe('nosniff');
-    expect(res.headers['x-frame-options']).toBe('SAMEORIGIN');
-  });
-
-  it('relaxes cross-origin-resource-policy so other-origin frontends can read the response', async () => {
-    const res = await request(app).get('/ping');
-
-    expect(res.headers['cross-origin-resource-policy']).toBe('cross-origin');
-  });
-
-  it('does not set a Content-Security-Policy header (JSON API, not HTML)', async () => {
-    const res = await request(app).get('/ping');
-
-    expect(res.headers['content-security-policy']).toBeUndefined();
-  });
-});
-
-describe('createRateLimiter', () => {
-  it('allows requests under the limit and blocks once the limit is exceeded', async () => {
-    const app = express();
-    app.use(createRateLimiter({ windowMs: 60_000, max: 2 }));
-    app.get('/ping', (_req, res) => res.json({ ok: true }));
-
-    const first = await request(app).get('/ping');
-    const second = await request(app).get('/ping');
-    const third = await request(app).get('/ping');
-
-    expect(first.status).toBe(200);
-    expect(second.status).toBe(200);
-    expect(third.status).toBe(429);
-    expect(third.body).toEqual({ success: false, message: 'Too many requests, please try again later' });
-  });
-});

package/src/middleware/security.ts

@@ -1,43 +0,0 @@
-import helmet from 'helmet';
-import rateLimit, { Options as RateLimitOptions } from 'express-rate-limit';
-
-/**
- * Standard security headers (helmet) for all services.
- *
- * - `contentSecurityPolicy` is off: these are JSON APIs, not HTML apps, and a
- *   couple of services serve a static Swagger docs page under `/api/docs`
- *   whose inline scripts a default CSP would break.
- * - `crossOriginResourcePolicy` is relaxed to `cross-origin`: helmet's default
- *   (`same-origin`) makes browsers refuse to read the response from a
- *   different origin — which every frontend is, since each front and backend
- *   service runs on its own port. CORS (see `createCorsMiddleware`) already
- *   does origin enforcement; this header must not fight it.
- */
-export const securityHeaders = helmet({
-  contentSecurityPolicy: false,
-  crossOriginResourcePolicy: { policy: 'cross-origin' },
-  crossOriginEmbedderPolicy: false
-});
-
-/**
- * Build a rate limiter with sane JSON error output. Counts per client IP.
- */
-export function createRateLimiter(options: Partial<RateLimitOptions> = {}) {
-  return rateLimit({
-    windowMs: 15 * 60 * 1000,
-    max: 300,
-    standardHeaders: true,
-    legacyHeaders: false,
-    message: { success: false, message: 'Too many requests, please try again later' },
-    ...options
-  });
-}
-
-/** Baseline limiter for authenticated/general routes. */
-export const standardRateLimiter = createRateLimiter();
-
-/**
- * Tighter limiter for brute-force-prone unauthenticated routes (token
- * issuance, public endpoints with no auth in front of them).
- */
-export const strictRateLimiter = createRateLimiter({ max: 20 });

package/src/middleware/validate.test.ts

@@ -1,72 +0,0 @@
-import express from 'express';
-import request from 'supertest';
-import { z } from 'zod';
-import { validate } from './validate';
-import { errorHandler } from './errorHandler';
-
-function buildApp(schema: z.ZodType) {
-  const app = express();
-  app.use(express.json());
-  app.post('/things', validate(schema), (req, res) => {
-    res.json({ success: true, data: req.body });
-  });
-  app.use(errorHandler);
-  return app;
-}
-
-describe('validate', () => {
-  const schema = z.object({
-    name: z.string().min(1),
-    age: z.number().int().positive().optional()
-  });
-
-  it('calls the handler with the parsed body when validation passes', async () => {
-    const app = buildApp(schema);
-
-    const res = await request(app).post('/things').send({ name: 'Alice', age: 30 });
-
-    expect(res.status).toBe(200);
-    expect(res.body).toEqual({ success: true, data: { name: 'Alice', age: 30 } });
-  });
-
-  it('responds 400 via the shared errorHandler when a required field is missing', async () => {
-    const app = buildApp(schema);
-
-    const res = await request(app).post('/things').send({});
-
-    expect(res.status).toBe(400);
-    expect(res.body.success).toBe(false);
-    expect(res.body.error).toBe('BadRequestError');
-    expect(res.body.message).toContain('name');
-  });
-
-  it('responds 400 when a field has the wrong type', async () => {
-    const app = buildApp(schema);
-
-    const res = await request(app).post('/things').send({ name: 'Bob', age: 'not-a-number' });
-
-    expect(res.status).toBe(400);
-    expect(res.body.error).toBe('BadRequestError');
-  });
-
-  it('strips unknown fields not declared in the schema (zod default behavior)', async () => {
-    const app = buildApp(schema);
-
-    const res = await request(app).post('/things').send({ name: 'Carol', extra: 'nope' });
-
-    expect(res.status).toBe(200);
-    expect(res.body.data).toEqual({ name: 'Carol' });
-  });
-
-  it('omits the field prefix when the zod issue has no path (whole-body validation)', async () => {
-    const arraySchema = z.array(z.string());
-    const app = buildApp(arraySchema);
-    const rawResult = arraySchema.safeParse({ not: 'an array' });
-
-    const res = await request(app).post('/things').send({ not: 'an array' });
-
-    expect(res.status).toBe(400);
-    expect(rawResult.success).toBe(false);
-    expect(res.body.message).toBe(!rawResult.success ? rawResult.error.issues[0].message : undefined);
-  });
-});

package/src/middleware/validate.ts

@@ -1,23 +0,0 @@
-import { Request, Response, NextFunction, RequestHandler } from 'express';
-import { ZodType } from 'zod';
-import { BadRequestError } from '../errors/HttpError';
-
-/**
- * Validates `req.body` against a zod schema before the route handler runs.
- * On failure, throws a `BadRequestError` (caught by the shared errorHandler)
- * instead of letting controllers hand-roll their own field checks. On
- * success, `req.body` is replaced with the parsed result so handlers get
- * zod's inferred, coerced types rather than raw untyped input.
- */
-export function validate(schema: ZodType): RequestHandler {
-  return (req: Request, _res: Response, next: NextFunction): void => {
-    const result = schema.safeParse(req.body);
-    if (!result.success) {
-      const issue = result.error.issues[0];
-      const field = issue.path.length ? `${issue.path.join('.')}: ` : '';
-      throw new BadRequestError(`${field}${issue.message}`);
-    }
-    req.body = result.data;
-    next();
-  };
-}

package/src/oauth/index.ts

@@ -1,29 +0,0 @@
-export { OAuthClient, AuthorizationCode, RefreshToken } from './models';
-export type { IOAuthClient, IAuthorizationCode, IRefreshToken } from './models';
-export {
-  registerClient,
-  findClient,
-  isRegisteredRedirect,
-  issueAuthorizationCode,
-  redeemAuthorizationCode,
-  issueRefreshToken,
-  redeemRefreshToken,
-  revokeRefreshTokensForUser,
-  listConnections
-} from './service';
-export type {
-  RegisterClientInput,
-  RegisteredClient,
-  IssueCodeInput,
-  CodeRedemption,
-  CodeRejection,
-  RefreshRedemption
-} from './service';
-export {
-  mintAccessToken,
-  verifyAccessToken,
-  parseScopes,
-  isAccessTokenClaims,
-  ACCESS_TOKEN_TYPE
-} from './tokens';
-export type { AccessTokenClaims, MintAccessTokenInput, MintedAccessToken, AccessTokenVerification } from './tokens';