@twasik4/pocket-service 1.0.2 → 1.0.4

package/tests/auth-strategies.spec.ts

@@ -0,0 +1,150 @@
+/// <reference types="vitest/globals" />
+import type { Request } from "express";
+import { SignJWT } from "jose";
+import {
+  createJoseJwtVerifier,
+  createJwtAuthStrategy,
+  createMtlsAuthStrategy,
+} from "../src/workers/auth/strategies";
+import type { RouteDefinition } from "../src/workers/express-types";
+
+const route: RouteDefinition<any, any, boolean> = {
+  method: "GET",
+  fullPath: "/secure",
+  requireAuth: true,
+};
+
+describe("Auth strategies", () => {
+  it("maps JWT claims to authenticated user using Bearer token", async () => {
+    const strategy = createJwtAuthStrategy({
+      verifyToken: async () => ({
+        sub: "user-1",
+        team: "core",
+        flags: ["a", "b"],
+        ignoredObject: { x: 1 },
+      }),
+    });
+
+    const req = {
+      headers: { authorization: "Bearer signed-token" },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toEqual({
+      userId: "user-1",
+      team: "core",
+      flags: ["a", "b"],
+    });
+  });
+
+  it("returns null when token prefix does not match", async () => {
+    const verifyToken = vi.fn();
+    const strategy = createJwtAuthStrategy({
+      verifyToken,
+    });
+
+    const req = {
+      headers: { authorization: "Token signed-token" },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toBeNull();
+    expect(verifyToken).not.toHaveBeenCalled();
+  });
+
+  it("supports custom payload mapping", async () => {
+    const strategy = createJwtAuthStrategy({
+      verifyToken: async () => ({ sub: "user-2", role: "admin" }),
+      mapPayloadToUser: async (claims) => ({
+        userId: String(claims.sub),
+        role: String(claims.role),
+      }),
+    });
+
+    const req = {
+      headers: { authorization: "Bearer signed-token" },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toEqual({
+      userId: "user-2",
+      role: "admin",
+    });
+  });
+
+  it("verifies HS256 JWT using jose verifier", async () => {
+    const secret = "test-secret";
+    const token = await new SignJWT({ scope: "api:read" })
+      .setProtectedHeader({ alg: "HS256" })
+      .setSubject("subject-1")
+      .setIssuer("issuer-a")
+      .setAudience("audience-a")
+      .setIssuedAt()
+      .setExpirationTime("10m")
+      .sign(new TextEncoder().encode(secret));
+
+    const verify = createJoseJwtVerifier({
+      secret,
+      issuer: "issuer-a",
+      audience: "audience-a",
+      requiredClaims: ["sub", "scope"],
+    });
+
+    await expect(verify(token, {} as Request, route)).resolves.toMatchObject({
+      sub: "subject-1",
+      scope: "api:read",
+    });
+  });
+
+  it("returns null when required JWT claims are missing", async () => {
+    const secret = "test-secret";
+    const token = await new SignJWT({ role: "reader" })
+      .setProtectedHeader({ alg: "HS256" })
+      .setSubject("subject-2")
+      .setIssuedAt()
+      .setExpirationTime("10m")
+      .sign(new TextEncoder().encode(secret));
+
+    const verify = createJoseJwtVerifier({
+      secret,
+      requiredClaims: ["sub", "scope"],
+    });
+
+    await expect(verify(token, {} as Request, route)).resolves.toBeNull();
+  });
+
+  it("extracts mTLS identity from URI SAN", async () => {
+    const strategy = createMtlsAuthStrategy();
+    const req = {
+      socket: {
+        authorized: true,
+        getPeerCertificate: () => ({
+          subjectaltname:
+            "DNS:service.local, URI:spiffe://cluster/ns/default/sa/api",
+          subject: { CN: "subject-cn" },
+          issuer: { CN: "issuer-cn" },
+          fingerprint256: "fingerprint",
+          serialNumber: "serial",
+        }),
+      },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toMatchObject({
+      userId: "spiffe://cluster/ns/default/sa/api",
+      certSubjectCn: "subject-cn",
+      certIssuerCn: "issuer-cn",
+      certFingerprint256: "fingerprint",
+      certSerialNumber: "serial",
+      mtlsAuthorized: true,
+    });
+  });
+
+  it("rejects unauthorized mTLS request by default", async () => {
+    const strategy = createMtlsAuthStrategy();
+    const req = {
+      socket: {
+        authorized: false,
+        getPeerCertificate: () => ({ subject: { CN: "x" } }),
+      },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toBeNull();
+  });
+});

package/tests/clickhouse.spec.ts

@@ -0,0 +1,102 @@
+/// <reference types="vitest/globals" />
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const commandMock = vi.fn();
+const queryMock = vi.fn();
+const insertMock = vi.fn();
+const closeMock = vi.fn();
+
+vi.mock("@clickhouse/client", () => ({
+  createClient: vi.fn(() => ({
+    command: commandMock,
+    query: queryMock,
+    insert: insertMock,
+    close: closeMock,
+  })),
+}));
+
+import { createTypedClickhouse } from "../src/workers/db/clickhouse";
+
+describe("Clickhouse wrapper", () => {
+  beforeEach(() => {
+    commandMock.mockReset();
+    queryMock.mockReset();
+    insertMock.mockReset();
+    closeMock.mockReset();
+  });
+
+  it("executes createSQL for every configured table", async () => {
+    const clickhouse = createTypedClickhouse({
+      url: "http://localhost:8123",
+      tables: {
+        events: {
+          name: "events",
+          createSQL: "CREATE TABLE events (...)",
+          schema: () => ({ id: "", type: "" }),
+        },
+        metrics: {
+          name: "metrics",
+          createSQL: "CREATE TABLE metrics (...)",
+          schema: () => ({ id: "", value: 0 }),
+        },
+      },
+    });
+
+    await clickhouse.ensureTables();
+
+    expect(commandMock).toHaveBeenCalledTimes(2);
+    expect(commandMock).toHaveBeenNthCalledWith(1, {
+      query: "CREATE TABLE events (...)",
+    });
+    expect(commandMock).toHaveBeenNthCalledWith(2, {
+      query: "CREATE TABLE metrics (...)",
+    });
+  });
+
+  it("builds SELECT query with filters and returns parsed rows", async () => {
+    queryMock.mockResolvedValue({
+      json: async () => ({
+        data: [{ id: "1", type: "login", severity: 2 }],
+      }),
+    });
+
+    const clickhouse = createTypedClickhouse({
+      url: "http://localhost:8123",
+      tables: {
+        events: {
+          name: "events",
+          createSQL: "CREATE TABLE events (...)",
+          schema: () => ({ id: "", type: "", severity: 0 }),
+        },
+      },
+    });
+
+    const rows = await clickhouse.events.select({ type: "login", severity: 2 });
+
+    expect(queryMock).toHaveBeenCalledWith({
+      query: "SELECT * FROM events WHERE type = 'login' AND severity = 2",
+    });
+    expect(rows).toEqual([{ id: "1", type: "login", severity: 2 }]);
+  });
+
+  it("inserts rows using JSONEachRow format", async () => {
+    const clickhouse = createTypedClickhouse({
+      url: "http://localhost:8123",
+      tables: {
+        events: {
+          name: "events",
+          createSQL: "CREATE TABLE events (...)",
+          schema: () => ({ id: "", type: "" }),
+        },
+      },
+    });
+
+    await clickhouse.events.insert([{ id: "1", type: "login" }]);
+
+    expect(insertMock).toHaveBeenCalledWith({
+      table: "events",
+      values: [{ id: "1", type: "login" }],
+      format: "JSONEachRow",
+    });
+  });
+});

package/tests/express-types.spec.ts

@@ -0,0 +1,232 @@
+/// <reference types="vitest/globals" />
+import type { Request } from "express";
+import z from "zod";
+import {
+  createAuthResolver,
+  createMetaRouterWithAuth,
+  defaultHeaderAuthResolver,
+} from "../src/workers/express-types";
+
+function createMockResponse() {
+  return {
+    statusCode: 200,
+    body: undefined as unknown,
+    status(code: number) {
+      this.statusCode = code;
+      return this;
+    },
+    json(payload: unknown) {
+      this.body = payload;
+      return this;
+    },
+  };
+}
+
+describe("express-types", () => {
+  it("reads user from x-user-meta header when valid JSON is provided", () => {
+    const req = {
+      headers: {
+        "x-user-meta": JSON.stringify({ userId: "user-1", role: "admin" }),
+      },
+    } as unknown as Request;
+
+    expect(defaultHeaderAuthResolver(req)).toEqual({
+      userId: "user-1",
+      role: "admin",
+    });
+  });
+
+  it("returns null when x-user-meta is invalid JSON", () => {
+    const req = {
+      headers: {
+        "x-user-id": "user-1",
+        "x-user-meta": "{invalid-json",
+      },
+    } as unknown as Request;
+
+    expect(defaultHeaderAuthResolver(req)).toBeNull();
+  });
+
+  it("falls back to x-user-id header when x-user-meta is not set", () => {
+    const req = {
+      headers: { "x-user-id": "user-2" },
+    } as unknown as Request;
+
+    expect(defaultHeaderAuthResolver(req)).toEqual({ userId: "user-2" });
+  });
+
+  it("uses auth strategies in order and then fallback resolver", async () => {
+    const authResolver = createAuthResolver(
+      [
+        {
+          name: "first",
+          canHandle: async () => false,
+          authenticate: async () => ({ userId: "ignored" }),
+        },
+        {
+          name: "second",
+          authenticate: async () => null,
+        },
+      ],
+      {
+        fallbackResolver: async () => ({ userId: "fallback" }),
+      },
+    );
+
+    await expect(
+      authResolver({ headers: {} } as unknown as Request, {
+        method: "GET",
+        fullPath: "/",
+        requireAuth: true,
+      }),
+    ).resolves.toEqual({ userId: "fallback" });
+  });
+
+  it("returns route metadata from createMetaRouterWithAuth", () => {
+    const { routes, addRoute } = createMetaRouterWithAuth();
+
+    addRoute(
+      {
+        method: "POST",
+        fullPath: "/items/:id",
+        requireAuth: true,
+        bodyValidator: z.object({ name: z.string() }),
+        paramsValidator: z.object({ id: z.string() }),
+        meta: { description: "Create item" },
+      },
+      (_req, res) => {
+        res.status(200).json({ ok: true });
+      },
+    );
+
+    expect(routes).toHaveLength(1);
+    expect(routes[0]).toMatchObject({
+      method: "POST",
+      fullPath: "/items/:id",
+      requireAuth: true,
+      meta: { description: "Create item" },
+    });
+  });
+
+  it("returns 401 for protected route when auth resolver returns null", async () => {
+    const { router, addRoute } = createMetaRouterWithAuth({
+      authResolver: async () => null,
+    });
+
+    addRoute(
+      {
+        method: "POST",
+        fullPath: "/secure",
+        requireAuth: true,
+        bodyValidator: z.object({ name: z.string() }),
+      },
+      (_req, res) => {
+        res.status(200).json({ ok: true });
+      },
+    );
+
+    const layer = (router as any).stack.find(
+      (l: any) => l.route?.path === "/secure",
+    );
+    const authMiddleware = layer.route.stack[0].handle;
+
+    const req = { headers: {}, body: { name: "a" } } as unknown as Request;
+    const res = createMockResponse();
+    const next = vi.fn();
+
+    await authMiddleware(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(401);
+    expect(res.body).toEqual({ isSuccess: false, message: "Unauthorized" });
+  });
+
+  it("parses JSON body string when object schema is used", () => {
+    const { router, addRoute } = createMetaRouterWithAuth();
+
+    addRoute(
+      {
+        method: "POST",
+        fullPath: "/body",
+        bodyValidator: z.object({ count: z.number() }),
+      },
+      (_req, res) => {
+        res.status(200).json({ ok: true });
+      },
+    );
+
+    const layer = (router as any).stack.find(
+      (l: any) => l.route?.path === "/body",
+    );
+    const bodyMiddleware = layer.route.stack[0].handle;
+
+    const req = { body: '{"count":1}' } as Request;
+    const res = createMockResponse();
+    const next = vi.fn();
+
+    bodyMiddleware(req, res as any, next);
+
+    expect(next).toHaveBeenCalledOnce();
+    expect(req.body).toEqual({ count: 1 });
+  });
+
+  it("returns 400 for invalid JSON body string", () => {
+    const { router, addRoute } = createMetaRouterWithAuth();
+
+    addRoute(
+      {
+        method: "POST",
+        fullPath: "/invalid-body",
+        bodyValidator: z.object({ count: z.number() }),
+      },
+      (_req, res) => {
+        res.status(200).json({ ok: true });
+      },
+    );
+
+    const layer = (router as any).stack.find(
+      (l: any) => l.route?.path === "/invalid-body",
+    );
+    const bodyMiddleware = layer.route.stack[0].handle;
+
+    const req = { body: "{bad" } as Request;
+    const res = createMockResponse();
+    const next = vi.fn();
+
+    bodyMiddleware(req, res as any, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(400);
+    expect((res.body as any).message).toBe("Invalid JSON in request body");
+  });
+
+  it("returns 400 when params validation fails", () => {
+    const { router, addRoute } = createMetaRouterWithAuth();
+
+    addRoute(
+      {
+        method: "GET",
+        fullPath: "/items/:id",
+        paramsValidator: z.object({ id: z.uuid() }),
+      },
+      (_req, res) => {
+        res.status(200).json({ ok: true });
+      },
+    );
+
+    const layer = (router as any).stack.find(
+      (l: any) => l.route?.path === "/items/:id",
+    );
+    const paramsMiddleware = layer.route.stack[0].handle;
+
+    const req = { params: { id: "not-a-uuid" } } as unknown as Request;
+    const res = createMockResponse();
+    const next = vi.fn();
+
+    paramsMiddleware(req, res as any, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(400);
+    expect((res.body as any).message).toBe("Invalid URL parameters");
+  });
+});

package/tests/mongo-advanced.spec.ts

@@ -0,0 +1,172 @@
+/// <reference types="vitest/globals" />
+import { MongoMemoryServer } from "mongodb-memory-server";
+import { ObjectId } from "mongodb";
+import z from "zod";
+import {
+  createMongo,
+  defineMongoCollection,
+  type MongoCollectionsConfig,
+} from "../src/workers/db/mongo/mongo";
+
+describe("Mongo abstraction advanced behaviors", () => {
+  let mongoServer: MongoMemoryServer;
+
+  beforeAll(async () => {
+    mongoServer = await MongoMemoryServer.create();
+  });
+
+  afterAll(async () => {
+    await mongoServer.stop();
+  });
+
+  it("supports soft delete filtering and deletedBy attribution", async () => {
+    const mongo = createMongo(
+      "soft_delete_db",
+      {
+        users: defineMongoCollection({
+          schema: z.object({
+            name: z.string(),
+            deletedAt: z.date().optional(),
+            deletedBy: z.string().optional(),
+          }),
+        }),
+      },
+      { uri: mongoServer.getUri() },
+    );
+
+    await mongo.connect();
+
+    await mongo.users.insert({ name: "Ada" });
+    await mongo.users.delete({ name: "Ada" });
+
+    await mongo.users.insert({ name: "Grace" });
+    await mongo.users.delete({ name: "Grace" }, "admin-user");
+
+    const visible = await mongo.users.get({ name: "Ada" });
+    const rawAda = await mongo.db.collection("users").findOne({ name: "Ada" });
+    const rawGrace = await mongo.db.collection("users").findOne({
+      name: "Grace",
+    });
+
+    expect(visible).toEqual([]);
+    expect(rawAda?.deletedAt).toBeInstanceOf(Date);
+    expect(rawAda?.deletedBy).toBe("system");
+    expect(rawGrace?.deletedBy).toBe("admin-user");
+
+    await mongo.disconnect();
+  });
+
+  it("tracks revisions and updates updatedAt/revision on updateOne", async () => {
+    const config = {
+      records: {
+        ...defineMongoCollection({
+          schema: z.object({
+            key: z.string(),
+            value: z.string(),
+            revision: z.number().default(0),
+            updatedAt: z.date().optional(),
+          }),
+        }),
+        trackRevisions: true,
+      },
+    } satisfies MongoCollectionsConfig;
+
+    const mongo = createMongo("revisions_db", config, {
+      uri: mongoServer.getUri(),
+    });
+
+    await mongo.connect();
+
+    await mongo.records.insert({
+      key: "k1",
+      value: "v1",
+      revision: 0,
+      updatedAt: new Date("2020-01-01T00:00:00.000Z"),
+    });
+
+    await mongo.records.updateOne({ key: "k1" }, { value: "v2" });
+
+    const current = await mongo.records.getOne({ key: "k1" });
+    const revisions = await mongo.records.getRevisions({ key: "k1" });
+    const mostRecent = await mongo.records.getMostRecentRevision();
+
+    expect(current?.value).toBe("v2");
+    expect(current?.revision).toBe(1);
+    expect(current?.updatedAt).toBeInstanceOf(Date);
+    expect(revisions.length).toBeGreaterThanOrEqual(2);
+    expect(mostRecent?.value).toBe("v2");
+
+    await mongo.disconnect();
+  });
+
+  it("creates configured indexes during setup", async () => {
+    const mongo = createMongo(
+      "index_setup_db",
+      {
+        users: defineMongoCollection({
+          schema: z.object({
+            email: z.string(),
+            createdAt: z.date(),
+          }),
+          indexes: [
+            { key: { email: 1 }, unique: true, name: "users_email_unique" },
+            { key: { createdAt: 1 }, name: "users_created_at" },
+          ],
+        }),
+      },
+      { uri: mongoServer.getUri() },
+    );
+
+    await mongo.connect();
+
+    const indexes = await mongo.db.collection("users").indexes();
+
+    expect(indexes.some((idx) => idx.name === "users_email_unique")).toBe(true);
+    expect(indexes.some((idx) => idx.name === "users_created_at")).toBe(true);
+
+    await mongo.disconnect();
+  });
+
+  it("fails when enabling timeSeries on an existing non-time-series collection", async () => {
+    const dbName = `timeseries_mismatch_${new ObjectId().toHexString()}`;
+
+    const initial = createMongo(
+      dbName,
+      {
+        metrics: defineMongoCollection({
+          schema: z.object({
+            timestamp: z.date(),
+            value: z.number(),
+          }),
+        }),
+      },
+      { uri: mongoServer.getUri() },
+    );
+
+    await initial.connect();
+    await initial.db.createCollection("legacy_metrics");
+    await initial.disconnect();
+
+    const withTimeSeries = createMongo(
+      dbName,
+      {
+        legacy_metrics: defineMongoCollection({
+          schema: z.object({
+            timestamp: z.date(),
+            value: z.number(),
+          }),
+          timeSeries: {
+            timeField: "timestamp",
+          },
+        }),
+      },
+      { uri: mongoServer.getUri() },
+    );
+
+    await expect(withTimeSeries.connect()).rejects.toThrow(
+      "already exists and is not a time-series collection",
+    );
+
+    await withTimeSeries.disconnect();
+  });
+});

package/tests/mongo.spec.ts

@@ -89,4 +89,53 @@ describe("MongoDB Dependency", () => {
     expect(res[0].name).toEqual("updated");
     console.log("Updated document:", res[0]);
   });
+
+  it("Should support creating and using time-series collections", async () => {
+    const tsService = new Service()
+      .withName("admin-service")
+      .withPort(4121)
+      .withRedis("redis://localhost:6379")
+      .withMongo({
+        dbName: "test_timeseries",
+        uri: mongoServer.getUri(),
+        collections: {
+          metrics: defineMongoCollection({
+            schema: z.object({
+              timestamp: z.date(),
+              host: z.string(),
+              value: z.number(),
+            }),
+            timeSeries: {
+              timeField: "timestamp",
+              metaField: "host",
+              granularity: "seconds",
+            },
+          }),
+        },
+      })
+      .build();
+
+    await tsService.mongo.connect();
+
+    const collectionInfo = await tsService.mongo.db
+      .listCollections({ name: "metrics" }, { nameOnly: false })
+      .next();
+
+    expect(
+      collectionInfo?.type === "timeseries" ||
+        Boolean((collectionInfo?.options as any)?.timeseries),
+    ).toBe(true);
+
+    await tsService.db.metrics.insert({
+      timestamp: new Date(),
+      host: "app-1",
+      value: 42,
+    });
+    const values = await tsService.db.metrics.get({ host: "app-1" });
+
+    expect(values.length).toBe(1);
+    expect(values[0].value).toBe(42);
+
+    await tsService.mongo.disconnect();
+  });
 });