@tumbaland/backend-core 1.44.0 → 1.46.0

package/src/logging/logger.test.ts

@@ -1,91 +0,0 @@
-import fs from 'fs';
-
-/**
- * logger.ts builds its transport list at module-load time based on
- * NODE_ENV/LOG_TO_FILE, so each scenario needs a fresh module load via
- * isolateModulesAsync rather than a single shared import.
- */
-async function loadLogger(env: Record<string, string | undefined>) {
-  const ORIGINAL_ENV = process.env;
-  process.env = { ...ORIGINAL_ENV, ...env };
-
-  let loggerModule!: typeof import('./logger').default;
-  await jest.isolateModulesAsync(async () => {
-    loggerModule = (await import('./logger')).default;
-  });
-
-  process.env = ORIGINAL_ENV;
-  return loggerModule;
-}
-
-// winston's `.transports` also holds the wrapped exception/rejection-handler
-// transports (always present), so assert on named regular transports only.
-function namedTransports(logger: import('winston').Logger, name: string) {
-  return logger.transports.filter((t) => (t as unknown as { name?: string }).name === name);
-}
-
-describe('logger', () => {
-  it('logs at debug level in development', async () => {
-    const logger = await loadLogger({ NODE_ENV: 'development', LOG_TO_FILE: undefined });
-    expect(logger.level).toBe('debug');
-  });
-
-  it('logs at info level in production', async () => {
-    const logger = await loadLogger({ NODE_ENV: 'production' });
-    expect(logger.level).toBe('info');
-  });
-
-  it('defaults to development (debug level) when NODE_ENV is unset', async () => {
-    const ORIGINAL_ENV = process.env;
-    const merged: Record<string, string | undefined> = { ...ORIGINAL_ENV };
-    delete merged.NODE_ENV;
-    process.env = merged as NodeJS.ProcessEnv;
-
-    let loggerModule!: typeof import('./logger').default;
-    await jest.isolateModulesAsync(async () => {
-      loggerModule = (await import('./logger')).default;
-    });
-
-    process.env = ORIGINAL_ENV;
-    expect(loggerModule.level).toBe('debug');
-  });
-
-  it('does not create a file transport when LOG_TO_FILE is unset', async () => {
-    const logger = await loadLogger({ NODE_ENV: 'development', LOG_TO_FILE: undefined });
-    expect(namedTransports(logger, 'file')).toHaveLength(0);
-    expect(namedTransports(logger, 'console')).toHaveLength(1);
-  });
-
-  it('does not create a file transport in production, even if LOG_TO_FILE is true', async () => {
-    const logger = await loadLogger({ NODE_ENV: 'production', LOG_TO_FILE: 'true' });
-    expect(namedTransports(logger, 'file')).toHaveLength(0);
-  });
-
-  describe('with LOG_TO_FILE=true in development', () => {
-    it('creates the logs directory when it does not exist and adds a file transport', async () => {
-      const existsSpy = jest.spyOn(fs, 'existsSync').mockReturnValue(false);
-      const mkdirSpy = jest.spyOn(fs, 'mkdirSync').mockImplementation(() => undefined as any);
-
-      const logger = await loadLogger({ NODE_ENV: 'development', LOG_TO_FILE: 'true' });
-
-      expect(mkdirSpy).toHaveBeenCalledWith(expect.stringContaining('logs'), { recursive: true });
-      expect(namedTransports(logger, 'file')).toHaveLength(1);
-
-      existsSpy.mockRestore();
-      mkdirSpy.mockRestore();
-    });
-
-    it('does not recreate the logs directory when it already exists', async () => {
-      const existsSpy = jest.spyOn(fs, 'existsSync').mockReturnValue(true);
-      const mkdirSpy = jest.spyOn(fs, 'mkdirSync').mockImplementation(() => undefined as any);
-
-      const logger = await loadLogger({ NODE_ENV: 'development', LOG_TO_FILE: 'true' });
-
-      expect(mkdirSpy).not.toHaveBeenCalled();
-      expect(namedTransports(logger, 'file')).toHaveLength(1);
-
-      existsSpy.mockRestore();
-      mkdirSpy.mockRestore();
-    });
-  });
-});

package/src/logging/logger.ts

@@ -1,103 +0,0 @@
-import winston from 'winston';
-import path from 'path';
-import fs from 'fs';
-
-// Define log levels
-const levels = {
-  error: 0,
-  warn: 1,
-  info: 2,
-  http: 3,
-  debug: 4,
-};
-
-const level = () => {
-  const env = process.env.NODE_ENV || 'development';
-  const isDevelopment = env === 'development';
-  return isDevelopment ? 'debug' : 'info';
-};
-
-// Define colors for each level
-const colors = {
-  error: 'red',
-  warn: 'yellow',
-  info: 'green',
-  http: 'magenta',
-  debug: 'white',
-};
-
-winston.addColors(colors);
-
-// Define format for console (human-readable)
-const consoleFormat = winston.format.combine(
-  winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss:ms' }),
-  winston.format.colorize({ all: true }),
-  winston.format.printf(
-    (info) => `${info.timestamp} ${info.level}: ${String(info.message)}`,
-  ),
-);
-
-// Define JSON format for production (structured logging)
-const jsonFormat = winston.format.combine(
-  winston.format.timestamp(),
-  winston.format.errors({ stack: true }),
-  winston.format.json()
-);
-
-// Choose format based on environment
-const isProduction = process.env.NODE_ENV === 'production';
-const logFormat = isProduction ? jsonFormat : consoleFormat;
-
-// Define which transports the logger must use
-const transports: winston.transport[] = [
-  // Console transport (goes to Docker stdout/stderr)
-  new winston.transports.Console({
-    format: logFormat,
-    level: level()
-  }),
-];
-
-// Add file transport only in development (optional)
-if (!isProduction && process.env.LOG_TO_FILE === 'true') {
-
-  // Create logs directory if it doesn't exist
-  const logsDir = path.join(process.cwd(), 'logs');
-  if (!fs.existsSync(logsDir)) {
-    fs.mkdirSync(logsDir, { recursive: true });
-  }
-
-  transports.push(
-    new winston.transports.File({
-      filename: path.join(logsDir, 'app.log'),
-      format: jsonFormat,
-      level: 'debug'
-    })
-  );
-}
-
-// Create the logger instance
-const logger = winston.createLogger({
-  level: level(),
-  levels,
-  format: logFormat,
-  transports,
-  // Handle exceptions and rejections
-  exceptionHandlers: [
-    new winston.transports.Console({
-      format: winston.format.combine(
-        winston.format.colorize(),
-        winston.format.simple()
-      )
-    })
-  ],
-  rejectionHandlers: [
-    new winston.transports.Console({
-      format: winston.format.combine(
-        winston.format.colorize(),
-        winston.format.simple()
-      )
-    })
-  ]
-});
-
-export default logger;

package/src/metrics/index.test.ts

@@ -1,116 +0,0 @@
-import { Request, Response } from 'express';
-import {
-  activeConnections,
-  businessMetrics,
-  httpRequestDuration,
-  httpRequestsTotal,
-  metricsHandler,
-  metricsMiddleware,
-  register
-} from './index';
-
-function mockRes(): Response {
-  const res: Partial<Response> & { _finishHandler?: () => void } = {};
-  res.set = jest.fn().mockReturnValue(res);
-  res.end = jest.fn().mockReturnValue(res);
-  res.status = jest.fn().mockReturnValue(res);
-  res.statusCode = 200;
-  res.on = jest.fn((event: string, handler: () => void) => {
-    if (event === 'finish') res._finishHandler = handler;
-    return res as Response;
-  });
-  return res as Response;
-}
-
-describe('metricsHandler', () => {
-  it('writes the registry content-type header and the serialized metrics body', async () => {
-    const res = mockRes();
-
-    await metricsHandler({} as Request, res);
-
-    expect(res.set).toHaveBeenCalledWith('Content-Type', register.contentType);
-    expect(res.end).toHaveBeenCalledWith(expect.any(String));
-  });
-
-  it('responds 500 when the registry fails to serialize metrics', async () => {
-    const res = mockRes();
-    jest.spyOn(register, 'metrics').mockRejectedValueOnce(new Error('boom'));
-
-    await metricsHandler({} as Request, res);
-
-    expect(res.status).toHaveBeenCalledWith(500);
-    expect(res.end).toHaveBeenCalledWith('Error generating metrics');
-  });
-});
-
-describe('metricsMiddleware', () => {
-  it('increments active connections immediately and decrements once the response finishes', async () => {
-    const req = { method: 'GET', url: '/albums' } as Request;
-    const res = mockRes() as Response & { _finishHandler?: () => void };
-    const next = jest.fn();
-    const before = (await activeConnections.get()).values[0]?.value ?? 0;
-
-    metricsMiddleware(req, res, next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(res.on).toHaveBeenCalledWith('finish', expect.any(Function));
-    expect((await activeConnections.get()).values[0]?.value).toBe(before + 1);
-
-    (res as any)._finishHandler();
-
-    expect((await activeConnections.get()).values[0]?.value).toBe(before);
-  });
-
-  it('records request duration and total-count metrics labeled by method/url/status on finish', () => {
-    const req = { method: 'POST', url: '/albums' } as Request;
-    const res = mockRes();
-    res.statusCode = 201;
-    const next = jest.fn();
-
-    const durationSpy = jest.spyOn(httpRequestDuration, 'labels');
-    const totalSpy = jest.spyOn(httpRequestsTotal, 'labels');
-
-    metricsMiddleware(req, res, next);
-    (res as any)._finishHandler();
-
-    expect(durationSpy).toHaveBeenCalledWith('POST', '/albums', '201');
-    expect(totalSpy).toHaveBeenCalledWith('POST', '/albums', '201');
-
-    durationSpy.mockRestore();
-    totalSpy.mockRestore();
-  });
-});
-
-describe('default labels', () => {
-  it('falls back to app "unknown-service" and version "1.0.0" when their env vars are unset', async () => {
-    const ORIGINAL_ENV = process.env;
-    const merged: Record<string, string | undefined> = { ...ORIGINAL_ENV };
-    delete merged.SERVICE_NAME;
-    delete merged.npm_package_version;
-    process.env = merged as NodeJS.ProcessEnv;
-
-    // isolateModulesAsync sandboxes the whole module registry, including
-    // prom-client itself — the spy must target the Registry class required
-    // *inside* the sandbox, not the one imported at the top of this file.
-    await jest.isolateModulesAsync(async () => {
-      const innerPromClient = (await import('prom-client')).default;
-      const setDefaultLabelsSpy = jest.spyOn(innerPromClient.Registry.prototype, 'setDefaultLabels');
-
-      await import('./index');
-
-      expect(setDefaultLabelsSpy).toHaveBeenCalledWith({ app: 'unknown-service', version: '1.0.0' });
-      setDefaultLabelsSpy.mockRestore();
-    });
-
-    process.env = ORIGINAL_ENV;
-  });
-});
-
-describe('businessMetrics', () => {
-  it('exposes counters that can be incremented without throwing', () => {
-    expect(() => businessMetrics.albumsCreated.inc()).not.toThrow();
-    expect(() => businessMetrics.filesUploaded.inc({ file_type: 'image' })).not.toThrow();
-    expect(() => businessMetrics.usersRegistered.inc()).not.toThrow();
-    expect(() => businessMetrics.paymentsProcessed.inc({ status: 'success', method: 'card' })).not.toThrow();
-  });
-});

package/src/metrics/index.ts

@@ -1,111 +0,0 @@
-import promClient from 'prom-client';
-import { Request, Response, NextFunction } from 'express';
-
-// Create a Registry which registers the metrics
-const register = new promClient.Registry();
-
-// Add a default label which is added to all metrics
-register.setDefaultLabels({
-  app: process.env.SERVICE_NAME || 'unknown-service',
-  version: process.env.npm_package_version || '1.0.0'
-});
-
-// Enable the collection of default metrics
-promClient.collectDefaultMetrics({ register });
-
-// Custom metrics
-export const httpRequestDuration = new promClient.Histogram({
-  name: 'http_request_duration_seconds',
-  help: 'Duration of HTTP requests in seconds',
-  labelNames: ['method', 'route', 'status_code'],
-  buckets: [0.1, 0.5, 1, 2, 5, 10]
-});
-
-export const httpRequestsTotal = new promClient.Counter({
-  name: 'http_requests_total',
-  help: 'Total number of HTTP requests',
-  labelNames: ['method', 'route', 'status_code']
-});
-
-export const activeConnections = new promClient.Gauge({
-  name: 'active_connections',
-  help: 'Number of active connections'
-});
-
-export const databaseQueryDuration = new promClient.Histogram({
-  name: 'database_query_duration_seconds',
-  help: 'Duration of database queries in seconds',
-  labelNames: ['operation', 'collection'],
-  buckets: [0.01, 0.05, 0.1, 0.5, 1, 2, 5]
-});
-
-export const databaseQueriesTotal = new promClient.Counter({
-  name: 'database_queries_total',
-  help: 'Total number of database queries',
-  labelNames: ['operation', 'collection', 'status']
-});
-
-export const businessMetrics = {
-  albumsCreated: new promClient.Counter({
-    name: 'albums_created_total',
-    help: 'Total number of albums created'
-  }),
-
-  filesUploaded: new promClient.Counter({
-    name: 'files_uploaded_total',
-    help: 'Total number of files uploaded',
-    labelNames: ['file_type']
-  }),
-
-  usersRegistered: new promClient.Counter({
-    name: 'users_registered_total',
-    help: 'Total number of users registered'
-  }),
-
-  paymentsProcessed: new promClient.Counter({
-    name: 'payments_processed_total',
-    help: 'Total number of payments processed',
-    labelNames: ['status', 'method']
-  })
-};
-
-// Metrics endpoint handler
-export const metricsHandler = async (_req: Request, res: Response) => {
-  try {
-    res.set('Content-Type', register.contentType);
-    const metrics = await register.metrics();
-    res.end(metrics);
-  } catch (error) {
-    res.status(500).end('Error generating metrics');
-  }
-};
-
-// Middleware to collect HTTP metrics
-export const metricsMiddleware = (req: Request, res: Response, next: NextFunction) => {
-  const start = Date.now();
-  const { method, url } = req;
-
-  // Increment active connections
-  activeConnections.inc();
-
-  res.on('finish', () => {
-    const duration = (Date.now() - start) / 1000; // Convert to seconds
-    const { statusCode } = res;
-
-    // Record metrics
-    httpRequestDuration
-      .labels(method, url, statusCode.toString())
-      .observe(duration);
-
-    httpRequestsTotal
-      .labels(method, url, statusCode.toString())
-      .inc();
-
-    // Decrement active connections
-    activeConnections.dec();
-  });
-
-  next();
-};
-
-export { register };

package/src/middleware/authMiddleware.test.ts

@@ -1,275 +0,0 @@
-import { Request, Response } from 'express';
-import jwt from 'jsonwebtoken';
-import { authenticateToken, optionalAuth } from './authMiddleware';
-import { PERSONAL_TENANT } from '../apiKeys/types';
-import { mintAccessToken } from '../oauth/tokens';
-import { UserPayload } from '../types/auth';
-import { overrideSessionCheckForTests } from '../auth/session';
-import { overrideMembershipLookupForTests } from '../groups/membership';
-
-// These tokens carry no session; the session check has its own tests below and in session.test.ts.
-beforeEach(() => overrideSessionCheckForTests(async () => true));
-afterAll(() => overrideSessionCheckForTests());
-
-function mockReq(overrides: Partial<Request> = {}): Request {
-  return { cookies: {}, headers: {}, ...overrides } as unknown as Request;
-}
-
-function mockRes(): Response {
-  const res: Partial<Response> = {};
-  res.status = jest.fn().mockReturnValue(res);
-  res.json = jest.fn().mockReturnValue(res);
-  return res as Response;
-}
-
-describe('authenticateToken', () => {
-  const ORIGINAL_ENV = process.env;
-  const next = jest.fn();
-
-  beforeEach(() => {
-    process.env = { ...ORIGINAL_ENV, JWT_SECRET: 'test-secret' };
-    next.mockClear();
-  });
-
-  afterAll(() => {
-    process.env = ORIGINAL_ENV;
-  });
-
-  const payload: UserPayload = { id: '1', email: 'user@example.com', name: 'Test User' };
-
-  it('attaches the decoded user and calls next for a valid cookie token', async () => {
-    const token = jwt.sign(payload, 'test-secret');
-    const req = mockReq({ cookies: { access_token: token } });
-    const res = mockRes();
-
-    await authenticateToken(req, res, next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(req.user).toMatchObject({ id: '1', email: 'user@example.com' });
-  });
-
-  it('attaches an empty userGroups array when the token has no groups claim', async () => {
-    const token = jwt.sign(payload, 'test-secret');
-    const req = mockReq({ cookies: { access_token: token } });
-    const res = mockRes();
-
-    await authenticateToken(req, res, next);
-
-    expect(req.userGroups).toEqual([]);
-  });
-
-  it("takes the person's groups from group-service, not from the token", async () => {
-    const lookup = jest.fn(async () => ['live-group']);
-    overrideMembershipLookupForTests(lookup);
-    const token = jwt.sign({ ...payload, groups: ['stale-group'] }, 'test-secret');
-    const req = mockReq({ cookies: { access_token: token } });
-    const res = mockRes();
-
-    await authenticateToken(req, res, next);
-
-    expect(lookup).toHaveBeenCalledWith(expect.objectContaining({ email: 'user@example.com' }));
-    expect(req.userGroups).toEqual(['live-group']);
-    expect(req.user?.groups).toEqual(['live-group']);
-    overrideMembershipLookupForTests();
-  });
-
-  it('accepts a Bearer token from the Authorization header', async () => {
-    const token = jwt.sign(payload, 'test-secret');
-    const req = mockReq({ headers: { authorization: `Bearer ${token}` } });
-    const res = mockRes();
-
-    await authenticateToken(req, res, next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-  });
-
-  it('returns 401 when no token is present', async () => {
-    const req = mockReq();
-    const res = mockRes();
-
-    await authenticateToken(req, res, next);
-
-    expect(next).not.toHaveBeenCalled();
-    expect(res.status).toHaveBeenCalledWith(401);
-    expect(res.json).toHaveBeenCalledWith({ success: false, message: 'Access token required' });
-  });
-
-  it('returns 401 for an invalid token', async () => {
-    const req = mockReq({ cookies: { access_token: 'not-a-real-token' } });
-    const res = mockRes();
-
-    await authenticateToken(req, res, next);
-
-    expect(next).not.toHaveBeenCalled();
-    expect(res.status).toHaveBeenCalledWith(401);
-    expect(res.json).toHaveBeenCalledWith({ success: false, message: 'Invalid or expired token' });
-  });
-
-  it('returns 401 for a token signed with a different secret', async () => {
-    const token = jwt.sign(payload, 'wrong-secret');
-    const req = mockReq({ cookies: { access_token: token } });
-    const res = mockRes();
-
-    await authenticateToken(req, res, next);
-
-    expect(res.status).toHaveBeenCalledWith(401);
-  });
-});
-
-describe('optionalAuth', () => {
-  const ORIGINAL_ENV = process.env;
-  const next = jest.fn();
-
-  beforeEach(() => {
-    process.env = { ...ORIGINAL_ENV, JWT_SECRET: 'test-secret' };
-    next.mockClear();
-  });
-
-  afterAll(() => {
-    process.env = ORIGINAL_ENV;
-  });
-
-  const payload: UserPayload = { id: '1', email: 'user@example.com', name: 'Test User' };
-
-  it('attaches the user when the token is valid', async () => {
-    const req = mockReq({ cookies: { access_token: jwt.sign(payload, 'test-secret') } });
-
-    await optionalAuth(req, mockRes(), next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(req.user).toMatchObject({ email: 'user@example.com' });
-  });
-
-  it('reads a bearer token too', async () => {
-    const req = mockReq({ headers: { authorization: `Bearer ${jwt.sign(payload, 'test-secret')}` } });
-
-    await optionalAuth(req, mockRes(), next);
-
-    expect(req.user).toMatchObject({ email: 'user@example.com' });
-  });
-
-  it('continues anonymously when there is no token', async () => {
-    const req = mockReq();
-    const res = mockRes();
-
-    await optionalAuth(req, res, next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(req.user).toBeUndefined();
-    expect(res.status).not.toHaveBeenCalled();
-  });
-
-  it('treats an expired or forged token as no token rather than as a 401', async () => {
-    // The caller asked for public data. Refusing it because a stale cookie is
-    // lying around would break the landing page for exactly the people most
-    // likely to have one.
-    const req = mockReq({ cookies: { access_token: jwt.sign(payload, 'wrong-secret') } });
-    const res = mockRes();
-
-    await optionalAuth(req, res, next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(req.user).toBeUndefined();
-    expect(res.status).not.toHaveBeenCalled();
-  });
-
-  it('continues anonymously when JWT_SECRET is not configured', async () => {
-    delete process.env.JWT_SECRET;
-    const req = mockReq({ cookies: { access_token: 'anything' } });
-    const res = mockRes();
-
-    await optionalAuth(req, res, next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(res.status).not.toHaveBeenCalled();
-  });
-});
-
-describe('OAuth access tokens are not sessions', () => {
-  const ORIGINAL_ENV = process.env;
-
-  beforeEach(() => {
-    process.env = { ...ORIGINAL_ENV, JWT_SECRET: 'test-secret' };
-  });
-
-  afterEach(() => {
-    process.env = ORIGINAL_ENV;
-  });
-
-  const accessToken = () =>
-    mintAccessToken({
-      userId: 'u1',
-      email: 'u1@example.com',
-      name: 'Tester',
-      resource: 'https://mcp.example.com',
-      issuer: 'https://auth.example.com',
-      scopes: ['relationship:read'],
-      tenants: [PERSONAL_TENANT],
-      defaultTenant: PERSONAL_TENANT,
-      tenantNames: {},
-      clientId: 'client-1',
-      clientName: 'Claude'
-    }).accessToken;
-
-  it('refuses one on a session-only route', async () => {
-    const res = mockRes();
-    const next = jest.fn();
-    const req = mockReq({ headers: { authorization: `Bearer ${accessToken()}` } });
-
-    // It verifies — same secret — so nothing but the type check stands between
-    // an assistant and every route that has no scopes to be held to.
-    await authenticateToken(req, res, next);
-
-    expect(res.status).toHaveBeenCalledWith(403);
-    expect(next).not.toHaveBeenCalled();
-    expect(req.user).toBeUndefined();
-  });
-
-  it('treats one as no session at all on an optional-auth route', async () => {
-    const next = jest.fn();
-    const req = mockReq({ headers: { authorization: `Bearer ${accessToken()}` } });
-
-    await optionalAuth(req, mockRes(), next);
-
-    // The route still answers, in its public form — the same as a stale cookie.
-    expect(next).toHaveBeenCalled();
-    expect(req.user).toBeUndefined();
-  });
-});
-
-describe('ended sessions', () => {
-  const ORIGINAL_ENV = process.env;
-  const payload: UserPayload = { id: '1', email: 'user@example.com', name: 'Test User', sid: 'a'.repeat(24) };
-
-  beforeEach(() => {
-    process.env = { ...ORIGINAL_ENV, JWT_SECRET: 'test-secret' };
-    overrideSessionCheckForTests(async () => false);
-  });
-
-  afterAll(() => {
-    process.env = ORIGINAL_ENV;
-  });
-
-  it('authenticateToken refuses a validly signed token whose session has ended', async () => {
-    const req = mockReq({ cookies: { access_token: jwt.sign(payload, 'test-secret') } });
-    const res = mockRes();
-    const next = jest.fn();
-
-    await authenticateToken(req, res, next);
-
-    expect(res.status).toHaveBeenCalledWith(401);
-    expect(res.json).toHaveBeenCalledWith({ success: false, message: 'Session has ended' });
-    expect(next).not.toHaveBeenCalled();
-    expect(req.user).toBeUndefined();
-  });
-
-  it('optionalAuth treats an ended session as no session', async () => {
-    const req = mockReq({ cookies: { access_token: jwt.sign(payload, 'test-secret') } });
-    const next = jest.fn();
-
-    await optionalAuth(req, mockRes(), next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(req.user).toBeUndefined();
-  });
-});