@twasik4/pocket-service 1.0.3 → 1.0.4

package/src/workers/db/clickhouse/index.ts

@@ -7,7 +7,7 @@ export interface ClickhouseTable<TSchema extends Record<string, any>> {
 }
 
 export interface ClickhouseConfig<
-  TTables extends Record<string, ClickhouseTable<any>>
+  TTables extends Record<string, ClickhouseTable<any>>,
 > {
   url: string;
   username?: string;
@@ -16,7 +16,7 @@ export interface ClickhouseConfig<
 }
 
 export function createTypedClickhouse<
-  TTables extends Record<string, ClickhouseTable<any>>
+  TTables extends Record<string, ClickhouseTable<any>>,
 >(config: ClickhouseConfig<TTables>) {
   const client = createClient({
     host: config.url,
@@ -38,7 +38,7 @@ export function createTypedClickhouse<
       const select = async (where?: Filter): Promise<Row[]> => {
         let query = `SELECT * FROM ${table.name}`;
         if (where && Object.keys(where).length > 0) {
-          const conditions = Object.keys(where)
+          const conditions = Object.entries(where)
             .map(([k, value]) => {
               if (typeof value === "string") return `${k} = '${value}'`;
               return `${k} = ${value}`;
@@ -62,11 +62,11 @@ export function createTypedClickhouse<
       };
 
       return [key, { select, insert }];
-    })
+    }),
   ) as {
     [K in keyof TTables]: {
       select(
-        where?: Partial<ReturnType<TTables[K]["schema"]>>
+        where?: Partial<ReturnType<TTables[K]["schema"]>>,
       ): Promise<ReturnType<TTables[K]["schema"]>[]>;
       insert(rows: ReturnType<TTables[K]["schema"]>[]): Promise<void>;
     };

package/src/workers/db/mongo/collection.ts

@@ -199,12 +199,9 @@ export class CollectionWrapper<T extends Document> {
             },
             {
               $merge: {
-                into: {
-                  db: this.collection.dbName,
-                  col: this.revision.collectionName,
-                  on: "_id",
-                  whenNotMatched: "insert",
-                },
+                into: this.revision.collectionName,
+                on: "_id",
+                whenNotMatched: "insert",
               },
             },
           ])
@@ -218,17 +215,24 @@ export class CollectionWrapper<T extends Document> {
 
   /**
    * Soft delete a document by setting the `deletedAt` field to the current date.
+   * If the schema has a `deletedBy` field, it is set to the provided actor or defaults to `system`.
    * If the schema does not have a `deletedAt` field, it will perform a hard delete.
    * @param filter - The filter to find documents to delete.
+   * @param deletedBy - Optional actor identifier for soft deletes.
    */
-  async delete(filter: Filter<T>): Promise<void> {
+  async delete(filter: Filter<T>, deletedBy?: string): Promise<void> {
     try {
       if (this.hasProperty("deletedAt")) {
         const deletedAt = new Date();
+        const deletedByValue = deletedBy ?? "system";
+        const setFields: Record<string, unknown> = {
+          deletedAt,
+          ...(this.hasProperty("deletedBy")
+            ? { deletedBy: deletedByValue }
+            : {}),
+        };
         const update = {
-          $set: {
-            deletedAt,
-          },
+          $set: setFields,
         } as unknown as UpdateFilter<T>;
         await this.collection.updateMany(filter, update);
         if (this.revision) {
@@ -238,16 +242,13 @@ export class CollectionWrapper<T extends Document> {
                 $match: filter,
               },
               {
-                $set: { _id: new ObjectId(), deletedAt },
+                $set: { _id: new ObjectId(), ...setFields },
               },
               {
                 $merge: {
-                  into: {
-                    db: this.collection.dbName,
-                    col: this.revision.collectionName,
-                    on: "_id",
-                    whenNotMatched: "insert",
-                  },
+                  into: this.revision.collectionName,
+                  on: "_id",
+                  whenNotMatched: "insert",
                 },
               },
             ])

package/src/workers/db/mongo/mongo.ts

@@ -32,6 +32,25 @@ export type MongoIndexSpec = {
   expireAfterSeconds?: number;
 };
 
+export type MongoTimeSeriesSpec = {
+  /**
+   * Name of the date field that MongoDB uses as the event time.
+   */
+  timeField: string;
+  /**
+   * Optional metadata field used to group measurements.
+   */
+  metaField?: string;
+  /**
+   * Optional bucket granularity hint used by MongoDB.
+   */
+  granularity?: "seconds" | "minutes" | "hours";
+  /**
+   * Optional retention in seconds for automatic expiry.
+   */
+  expireAfterSeconds?: number;
+};
+
 export type MongoCollectionMethodContext<TDocument extends Document> = {
   /**
    * The MongoDB client instance
@@ -71,6 +90,10 @@ export type MongoCollectionDefinition<
    * Optional array of index specifications to create on this collection. Indexes are created idempotently on service startup, so duplicate indexes are safely ignored.
    */
   indexes?: MongoIndexSpec[];
+  /**
+   * Optional MongoDB time-series settings. When provided, the collection is created as a time-series collection if it does not already exist.
+   */
+  timeSeries?: MongoTimeSeriesSpec;
 };
 
 export type MongoCollectionsConfig = Record<
@@ -147,6 +170,10 @@ export function defineMongoCollection<
    * Optional array of index specifications to create on this collection.
    */
   indexes?: MongoIndexSpec[];
+  /**
+   * Optional MongoDB time-series settings.
+   */
+  timeSeries?: MongoTimeSeriesSpec;
 }): MongoCollectionDefinition<SchemaOutput<TSchema>, {}>;
 
 /**
@@ -177,6 +204,10 @@ export function defineMongoCollection<
    * Optional array of index specifications to create on this collection.
    */
   indexes?: MongoIndexSpec[];
+  /**
+   * Optional MongoDB time-series settings.
+   */
+  timeSeries?: MongoTimeSeriesSpec;
 }): MongoCollectionDefinition<SchemaOutput<TSchema>, TMethods>;
 
 /**
@@ -207,6 +238,10 @@ export function defineMongoCollection<
    * Optional array of index specifications to create on this collection.
    */
   indexes?: MongoIndexSpec[];
+  /**
+   * Optional MongoDB time-series settings.
+   */
+  timeSeries?: MongoTimeSeriesSpec;
 }): MongoCollectionDefinition<SchemaOutput<TSchema>, TMethods> {
   return {
     name: config.name,
@@ -218,6 +253,7 @@ export function defineMongoCollection<
      */
     methods: config.methods,
     indexes: config.indexes,
+    timeSeries: config.timeSeries,
     /**
      * Whether to automatically track revisions of documents in this collection. If enabled, every update will insert a copy of the updated document into a separate revision collection, allowing you to keep a history of changes. The revision collection will have the same name as the main collection with `_revisions` appended to it (e.g. `users` -> `users_revisions`).
      */
@@ -236,6 +272,7 @@ export function createMongo<TCollections extends MongoCollectionsConfig>(
   const db = client.db(dbName);
 
   const wrapped = {} as InferMongoCollections<TCollections>;
+  const setupFns: Array<() => Promise<void>> = [];
 
   for (const key in config) {
     const def = config[key];
@@ -257,16 +294,78 @@ export function createMongo<TCollections extends MongoCollectionsConfig>(
         base,
       }) || {};
 
-    if (def.indexes && def.indexes.length > 0) {
-      for (const indexSpec of def.indexes) {
-        const { key, ...options } = indexSpec;
-        collection.createIndex(key, options).catch((err) => {
-          console.error(
-            `Failed to create index on ${collectionName}: ${err.message}`,
-          );
-        });
+    setupFns.push(async () => {
+      if (def.timeSeries) {
+        const existingCollection = await db
+          .listCollections({ name: collectionName }, { nameOnly: false })
+          .next();
+
+        if (!existingCollection) {
+          await db.createCollection(collectionName, {
+            timeseries: {
+              timeField: def.timeSeries.timeField,
+              ...(def.timeSeries.metaField
+                ? { metaField: def.timeSeries.metaField }
+                : {}),
+              ...(def.timeSeries.granularity
+                ? { granularity: def.timeSeries.granularity }
+                : {}),
+            },
+            ...(typeof def.timeSeries.expireAfterSeconds === "number"
+              ? { expireAfterSeconds: def.timeSeries.expireAfterSeconds }
+              : {}),
+          });
+        } else {
+          const hasTimeSeriesOptions =
+            existingCollection.type === "timeseries" ||
+            Boolean((existingCollection.options as any)?.timeseries);
+
+          if (!hasTimeSeriesOptions) {
+            throw new Error(
+              `Collection ${collectionName} already exists and is not a time-series collection. Migration is required before enabling timeSeries.`,
+            );
+          }
+
+          const existingTimeSeries = (existingCollection.options as any)
+            ?.timeseries as
+            | {
+                timeField?: string;
+                metaField?: string;
+              }
+            | undefined;
+
+          if (
+            existingTimeSeries?.timeField &&
+            existingTimeSeries.timeField !== def.timeSeries.timeField
+          ) {
+            throw new Error(
+              `Collection ${collectionName} has timeField '${existingTimeSeries.timeField}' but config expects '${def.timeSeries.timeField}'.`,
+            );
+          }
+
+          if (
+            def.timeSeries.metaField &&
+            existingTimeSeries?.metaField &&
+            existingTimeSeries.metaField !== def.timeSeries.metaField
+          ) {
+            throw new Error(
+              `Collection ${collectionName} has metaField '${existingTimeSeries.metaField}' but config expects '${def.timeSeries.metaField}'.`,
+            );
+          }
+        }
       }
-    }
+
+      if (def.indexes && def.indexes.length > 0) {
+        for (const indexSpec of def.indexes) {
+          const { key, ...indexOptions } = indexSpec;
+          await collection.createIndex(key, indexOptions).catch((err) => {
+            console.error(
+              `Failed to create index on ${collectionName}: ${err.message}`,
+            );
+          });
+        }
+      }
+    });
 
     wrapped[key] = Object.assign(
       base,
@@ -274,12 +373,29 @@ export function createMongo<TCollections extends MongoCollectionsConfig>(
     ) as InferMongoCollections<TCollections>[typeof key];
   }
 
+  let setupPromise: Promise<void> | null = null;
+
+  const ensureSetup = async () => {
+    if (!setupPromise) {
+      setupPromise = (async () => {
+        for (const setup of setupFns) {
+          await setup();
+        }
+      })();
+    }
+    return setupPromise;
+  };
+
   return {
     client,
     db,
     collections: wrapped,
     ...wrapped,
     disconnect: async () => client.close(),
-    connect: async () => client.connect(),
+    connect: async () => {
+      await client.connect();
+      await ensureSetup();
+      return client;
+    },
   } as MongoDatabase<TCollections>;
 }

package/tests/auth-strategies.spec.ts

@@ -0,0 +1,150 @@
+/// <reference types="vitest/globals" />
+import type { Request } from "express";
+import { SignJWT } from "jose";
+import {
+  createJoseJwtVerifier,
+  createJwtAuthStrategy,
+  createMtlsAuthStrategy,
+} from "../src/workers/auth/strategies";
+import type { RouteDefinition } from "../src/workers/express-types";
+
+const route: RouteDefinition<any, any, boolean> = {
+  method: "GET",
+  fullPath: "/secure",
+  requireAuth: true,
+};
+
+describe("Auth strategies", () => {
+  it("maps JWT claims to authenticated user using Bearer token", async () => {
+    const strategy = createJwtAuthStrategy({
+      verifyToken: async () => ({
+        sub: "user-1",
+        team: "core",
+        flags: ["a", "b"],
+        ignoredObject: { x: 1 },
+      }),
+    });
+
+    const req = {
+      headers: { authorization: "Bearer signed-token" },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toEqual({
+      userId: "user-1",
+      team: "core",
+      flags: ["a", "b"],
+    });
+  });
+
+  it("returns null when token prefix does not match", async () => {
+    const verifyToken = vi.fn();
+    const strategy = createJwtAuthStrategy({
+      verifyToken,
+    });
+
+    const req = {
+      headers: { authorization: "Token signed-token" },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toBeNull();
+    expect(verifyToken).not.toHaveBeenCalled();
+  });
+
+  it("supports custom payload mapping", async () => {
+    const strategy = createJwtAuthStrategy({
+      verifyToken: async () => ({ sub: "user-2", role: "admin" }),
+      mapPayloadToUser: async (claims) => ({
+        userId: String(claims.sub),
+        role: String(claims.role),
+      }),
+    });
+
+    const req = {
+      headers: { authorization: "Bearer signed-token" },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toEqual({
+      userId: "user-2",
+      role: "admin",
+    });
+  });
+
+  it("verifies HS256 JWT using jose verifier", async () => {
+    const secret = "test-secret";
+    const token = await new SignJWT({ scope: "api:read" })
+      .setProtectedHeader({ alg: "HS256" })
+      .setSubject("subject-1")
+      .setIssuer("issuer-a")
+      .setAudience("audience-a")
+      .setIssuedAt()
+      .setExpirationTime("10m")
+      .sign(new TextEncoder().encode(secret));
+
+    const verify = createJoseJwtVerifier({
+      secret,
+      issuer: "issuer-a",
+      audience: "audience-a",
+      requiredClaims: ["sub", "scope"],
+    });
+
+    await expect(verify(token, {} as Request, route)).resolves.toMatchObject({
+      sub: "subject-1",
+      scope: "api:read",
+    });
+  });
+
+  it("returns null when required JWT claims are missing", async () => {
+    const secret = "test-secret";
+    const token = await new SignJWT({ role: "reader" })
+      .setProtectedHeader({ alg: "HS256" })
+      .setSubject("subject-2")
+      .setIssuedAt()
+      .setExpirationTime("10m")
+      .sign(new TextEncoder().encode(secret));
+
+    const verify = createJoseJwtVerifier({
+      secret,
+      requiredClaims: ["sub", "scope"],
+    });
+
+    await expect(verify(token, {} as Request, route)).resolves.toBeNull();
+  });
+
+  it("extracts mTLS identity from URI SAN", async () => {
+    const strategy = createMtlsAuthStrategy();
+    const req = {
+      socket: {
+        authorized: true,
+        getPeerCertificate: () => ({
+          subjectaltname:
+            "DNS:service.local, URI:spiffe://cluster/ns/default/sa/api",
+          subject: { CN: "subject-cn" },
+          issuer: { CN: "issuer-cn" },
+          fingerprint256: "fingerprint",
+          serialNumber: "serial",
+        }),
+      },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toMatchObject({
+      userId: "spiffe://cluster/ns/default/sa/api",
+      certSubjectCn: "subject-cn",
+      certIssuerCn: "issuer-cn",
+      certFingerprint256: "fingerprint",
+      certSerialNumber: "serial",
+      mtlsAuthorized: true,
+    });
+  });
+
+  it("rejects unauthorized mTLS request by default", async () => {
+    const strategy = createMtlsAuthStrategy();
+    const req = {
+      socket: {
+        authorized: false,
+        getPeerCertificate: () => ({ subject: { CN: "x" } }),
+      },
+    } as unknown as Request;
+
+    await expect(strategy.authenticate(req, route)).resolves.toBeNull();
+  });
+});

package/tests/clickhouse.spec.ts

@@ -0,0 +1,102 @@
+/// <reference types="vitest/globals" />
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const commandMock = vi.fn();
+const queryMock = vi.fn();
+const insertMock = vi.fn();
+const closeMock = vi.fn();
+
+vi.mock("@clickhouse/client", () => ({
+  createClient: vi.fn(() => ({
+    command: commandMock,
+    query: queryMock,
+    insert: insertMock,
+    close: closeMock,
+  })),
+}));
+
+import { createTypedClickhouse } from "../src/workers/db/clickhouse";
+
+describe("Clickhouse wrapper", () => {
+  beforeEach(() => {
+    commandMock.mockReset();
+    queryMock.mockReset();
+    insertMock.mockReset();
+    closeMock.mockReset();
+  });
+
+  it("executes createSQL for every configured table", async () => {
+    const clickhouse = createTypedClickhouse({
+      url: "http://localhost:8123",
+      tables: {
+        events: {
+          name: "events",
+          createSQL: "CREATE TABLE events (...)",
+          schema: () => ({ id: "", type: "" }),
+        },
+        metrics: {
+          name: "metrics",
+          createSQL: "CREATE TABLE metrics (...)",
+          schema: () => ({ id: "", value: 0 }),
+        },
+      },
+    });
+
+    await clickhouse.ensureTables();
+
+    expect(commandMock).toHaveBeenCalledTimes(2);
+    expect(commandMock).toHaveBeenNthCalledWith(1, {
+      query: "CREATE TABLE events (...)",
+    });
+    expect(commandMock).toHaveBeenNthCalledWith(2, {
+      query: "CREATE TABLE metrics (...)",
+    });
+  });
+
+  it("builds SELECT query with filters and returns parsed rows", async () => {
+    queryMock.mockResolvedValue({
+      json: async () => ({
+        data: [{ id: "1", type: "login", severity: 2 }],
+      }),
+    });
+
+    const clickhouse = createTypedClickhouse({
+      url: "http://localhost:8123",
+      tables: {
+        events: {
+          name: "events",
+          createSQL: "CREATE TABLE events (...)",
+          schema: () => ({ id: "", type: "", severity: 0 }),
+        },
+      },
+    });
+
+    const rows = await clickhouse.events.select({ type: "login", severity: 2 });
+
+    expect(queryMock).toHaveBeenCalledWith({
+      query: "SELECT * FROM events WHERE type = 'login' AND severity = 2",
+    });
+    expect(rows).toEqual([{ id: "1", type: "login", severity: 2 }]);
+  });
+
+  it("inserts rows using JSONEachRow format", async () => {
+    const clickhouse = createTypedClickhouse({
+      url: "http://localhost:8123",
+      tables: {
+        events: {
+          name: "events",
+          createSQL: "CREATE TABLE events (...)",
+          schema: () => ({ id: "", type: "" }),
+        },
+      },
+    });
+
+    await clickhouse.events.insert([{ id: "1", type: "login" }]);
+
+    expect(insertMock).toHaveBeenCalledWith({
+      table: "events",
+      values: [{ id: "1", type: "login" }],
+      format: "JSONEachRow",
+    });
+  });
+});