@twasik4/pocket-service 1.0.4 → 1.1.0

package/src/workers/stream-handler.ts

@@ -1,25 +0,0 @@
-export type RedisStreamHandlerContext = {
-  service: string;
-  emit: (ev: {
-    type: string;
-    data: Record<string, string | number | boolean | null>;
-  }) => Promise<void>;
-  log: {
-    info: (msg: string) => void;
-    warn: (msg: string) => void;
-    error: (msg: string) => void;
-  };
-};
-export type RedisStreamEventHandler = {
-  type: string;
-  execute: (
-    ev: Record<string, any>,
-    ctx: RedisStreamHandlerContext,
-  ) => Promise<void>;
-};
-export function redisStreamHandler(
-  type: string,
-  fn: RedisStreamEventHandler["execute"],
-): RedisStreamEventHandler {
-  return { type, execute: fn };
-}

package/src/workers/types.ts

@@ -1,59 +0,0 @@
-import { NextFunction, Request, Response } from "express";
-import { Logger } from "winston";
-
-export type Message = {
-  type: string;
-  userId: string;
-  teamId: string;
-  timestamp: number;
-  payload: Record<string, string | number | boolean | null>;
-};
-export type ExpressMiddleware = (
-  req: Request,
-  res: Response,
-  next: NextFunction,
-) => void;
-export type BaseExpressOptions = {
-  /**
-   * Don't include the default health check and metrics routes.
-   */
-  omitDefaultRoutes?: boolean;
-  /**
-   * Whether to parse incoming request bodies as JSON.
-   */
-  asJson: boolean;
-  /**
-   * An array of custom Express middleware functions to apply to the Express app globally (before all routes).
-   */
-  customMiddleware?: ExpressMiddleware[];
-  /**
-   * Whether to allow CORS requests with credentials (cookies, authorization headers, etc.). This option is only relevant if CORS is enabled via either `corsFn` or `corsWhitelist`.
-   */
-  credentials?: boolean;
-};
-export type ExpressOptionsWithCorsFn = BaseExpressOptions & {
-  /**
-   * A function to determine whether to allow CORS requests from a given origin.
-   * @param origin The origin of the request.
-   * @param callback A callback function to indicate whether the origin is allowed.
-   */
-  corsFn: (
-    origin: string | undefined,
-    callback: (err: Error | null, allow?: boolean) => void,
-  ) => void;
-};
-export type ExpressOptionsWithCorsWhitelist = BaseExpressOptions & {
-  /**
-   * An array of allowed origins for CORS requests. If the origin of an incoming request is in this whitelist, the request will be allowed.
-   */
-  corsWhitelist: string[];
-};
-export type ExpressOptions =
-  | ExpressOptionsWithCorsFn
-  | ExpressOptionsWithCorsWhitelist;
-export type CustomModuleFactory = (log: Logger) => boolean | Promise<boolean>;
-export type CustomModules = {
-  init: CustomModuleFactory;
-  shutdown?: CustomModuleFactory;
-  name: string;
-}[];

package/src/workers/utils.ts

@@ -1,19 +0,0 @@
-import * as crypto from "crypto";
-
-export function generateRandomHexString(length: number): string {
-  if (length % 2 !== 0) {
-    throw new Error("Length must be an even number");
-  }
-
-  const numBytes = length / 2;
-  const randomBytes = crypto.randomBytes(numBytes);
-  return randomBytes.toString("hex");
-}
-
-export function getUseableDatesFromMs(ms: number) {
-  const seconds = Math.floor((ms / 1000) % 60);
-  const minutes = Math.floor((ms / (1000 * 60)) % 60);
-  const hours = Math.floor((ms / (1000 * 60 * 60)) % 24);
-  const days = Math.floor(ms / (1000 * 60 * 60 * 24));
-  return { days, hours, minutes, seconds };
-}

package/tests/auth-strategies.spec.ts

@@ -1,150 +0,0 @@
-/// <reference types="vitest/globals" />
-import type { Request } from "express";
-import { SignJWT } from "jose";
-import {
-  createJoseJwtVerifier,
-  createJwtAuthStrategy,
-  createMtlsAuthStrategy,
-} from "../src/workers/auth/strategies";
-import type { RouteDefinition } from "../src/workers/express-types";
-
-const route: RouteDefinition<any, any, boolean> = {
-  method: "GET",
-  fullPath: "/secure",
-  requireAuth: true,
-};
-
-describe("Auth strategies", () => {
-  it("maps JWT claims to authenticated user using Bearer token", async () => {
-    const strategy = createJwtAuthStrategy({
-      verifyToken: async () => ({
-        sub: "user-1",
-        team: "core",
-        flags: ["a", "b"],
-        ignoredObject: { x: 1 },
-      }),
-    });
-
-    const req = {
-      headers: { authorization: "Bearer signed-token" },
-    } as unknown as Request;
-
-    await expect(strategy.authenticate(req, route)).resolves.toEqual({
-      userId: "user-1",
-      team: "core",
-      flags: ["a", "b"],
-    });
-  });
-
-  it("returns null when token prefix does not match", async () => {
-    const verifyToken = vi.fn();
-    const strategy = createJwtAuthStrategy({
-      verifyToken,
-    });
-
-    const req = {
-      headers: { authorization: "Token signed-token" },
-    } as unknown as Request;
-
-    await expect(strategy.authenticate(req, route)).resolves.toBeNull();
-    expect(verifyToken).not.toHaveBeenCalled();
-  });
-
-  it("supports custom payload mapping", async () => {
-    const strategy = createJwtAuthStrategy({
-      verifyToken: async () => ({ sub: "user-2", role: "admin" }),
-      mapPayloadToUser: async (claims) => ({
-        userId: String(claims.sub),
-        role: String(claims.role),
-      }),
-    });
-
-    const req = {
-      headers: { authorization: "Bearer signed-token" },
-    } as unknown as Request;
-
-    await expect(strategy.authenticate(req, route)).resolves.toEqual({
-      userId: "user-2",
-      role: "admin",
-    });
-  });
-
-  it("verifies HS256 JWT using jose verifier", async () => {
-    const secret = "test-secret";
-    const token = await new SignJWT({ scope: "api:read" })
-      .setProtectedHeader({ alg: "HS256" })
-      .setSubject("subject-1")
-      .setIssuer("issuer-a")
-      .setAudience("audience-a")
-      .setIssuedAt()
-      .setExpirationTime("10m")
-      .sign(new TextEncoder().encode(secret));
-
-    const verify = createJoseJwtVerifier({
-      secret,
-      issuer: "issuer-a",
-      audience: "audience-a",
-      requiredClaims: ["sub", "scope"],
-    });
-
-    await expect(verify(token, {} as Request, route)).resolves.toMatchObject({
-      sub: "subject-1",
-      scope: "api:read",
-    });
-  });
-
-  it("returns null when required JWT claims are missing", async () => {
-    const secret = "test-secret";
-    const token = await new SignJWT({ role: "reader" })
-      .setProtectedHeader({ alg: "HS256" })
-      .setSubject("subject-2")
-      .setIssuedAt()
-      .setExpirationTime("10m")
-      .sign(new TextEncoder().encode(secret));
-
-    const verify = createJoseJwtVerifier({
-      secret,
-      requiredClaims: ["sub", "scope"],
-    });
-
-    await expect(verify(token, {} as Request, route)).resolves.toBeNull();
-  });
-
-  it("extracts mTLS identity from URI SAN", async () => {
-    const strategy = createMtlsAuthStrategy();
-    const req = {
-      socket: {
-        authorized: true,
-        getPeerCertificate: () => ({
-          subjectaltname:
-            "DNS:service.local, URI:spiffe://cluster/ns/default/sa/api",
-          subject: { CN: "subject-cn" },
-          issuer: { CN: "issuer-cn" },
-          fingerprint256: "fingerprint",
-          serialNumber: "serial",
-        }),
-      },
-    } as unknown as Request;
-
-    await expect(strategy.authenticate(req, route)).resolves.toMatchObject({
-      userId: "spiffe://cluster/ns/default/sa/api",
-      certSubjectCn: "subject-cn",
-      certIssuerCn: "issuer-cn",
-      certFingerprint256: "fingerprint",
-      certSerialNumber: "serial",
-      mtlsAuthorized: true,
-    });
-  });
-
-  it("rejects unauthorized mTLS request by default", async () => {
-    const strategy = createMtlsAuthStrategy();
-    const req = {
-      socket: {
-        authorized: false,
-        getPeerCertificate: () => ({ subject: { CN: "x" } }),
-      },
-    } as unknown as Request;
-
-    await expect(strategy.authenticate(req, route)).resolves.toBeNull();
-  });
-});

package/tests/clickhouse.spec.ts

@@ -1,102 +0,0 @@
-/// <reference types="vitest/globals" />
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const commandMock = vi.fn();
-const queryMock = vi.fn();
-const insertMock = vi.fn();
-const closeMock = vi.fn();
-
-vi.mock("@clickhouse/client", () => ({
-  createClient: vi.fn(() => ({
-    command: commandMock,
-    query: queryMock,
-    insert: insertMock,
-    close: closeMock,
-  })),
-}));
-
-import { createTypedClickhouse } from "../src/workers/db/clickhouse";
-
-describe("Clickhouse wrapper", () => {
-  beforeEach(() => {
-    commandMock.mockReset();
-    queryMock.mockReset();
-    insertMock.mockReset();
-    closeMock.mockReset();
-  });
-
-  it("executes createSQL for every configured table", async () => {
-    const clickhouse = createTypedClickhouse({
-      url: "http://localhost:8123",
-      tables: {
-        events: {
-          name: "events",
-          createSQL: "CREATE TABLE events (...)",
-          schema: () => ({ id: "", type: "" }),
-        },
-        metrics: {
-          name: "metrics",
-          createSQL: "CREATE TABLE metrics (...)",
-          schema: () => ({ id: "", value: 0 }),
-        },
-      },
-    });
-
-    await clickhouse.ensureTables();
-
-    expect(commandMock).toHaveBeenCalledTimes(2);
-    expect(commandMock).toHaveBeenNthCalledWith(1, {
-      query: "CREATE TABLE events (...)",
-    });
-    expect(commandMock).toHaveBeenNthCalledWith(2, {
-      query: "CREATE TABLE metrics (...)",
-    });
-  });
-
-  it("builds SELECT query with filters and returns parsed rows", async () => {
-    queryMock.mockResolvedValue({
-      json: async () => ({
-        data: [{ id: "1", type: "login", severity: 2 }],
-      }),
-    });
-
-    const clickhouse = createTypedClickhouse({
-      url: "http://localhost:8123",
-      tables: {
-        events: {
-          name: "events",
-          createSQL: "CREATE TABLE events (...)",
-          schema: () => ({ id: "", type: "", severity: 0 }),
-        },
-      },
-    });
-
-    const rows = await clickhouse.events.select({ type: "login", severity: 2 });
-
-    expect(queryMock).toHaveBeenCalledWith({
-      query: "SELECT * FROM events WHERE type = 'login' AND severity = 2",
-    });
-    expect(rows).toEqual([{ id: "1", type: "login", severity: 2 }]);
-  });
-
-  it("inserts rows using JSONEachRow format", async () => {
-    const clickhouse = createTypedClickhouse({
-      url: "http://localhost:8123",
-      tables: {
-        events: {
-          name: "events",
-          createSQL: "CREATE TABLE events (...)",
-          schema: () => ({ id: "", type: "" }),
-        },
-      },
-    });
-
-    await clickhouse.events.insert([{ id: "1", type: "login" }]);
-
-    expect(insertMock).toHaveBeenCalledWith({
-      table: "events",
-      values: [{ id: "1", type: "login" }],
-      format: "JSONEachRow",
-    });
-  });
-});

package/tests/express-types.spec.ts

@@ -1,232 +0,0 @@
-/// <reference types="vitest/globals" />
-import type { Request } from "express";
-import z from "zod";
-import {
-  createAuthResolver,
-  createMetaRouterWithAuth,
-  defaultHeaderAuthResolver,
-} from "../src/workers/express-types";
-
-function createMockResponse() {
-  return {
-    statusCode: 200,
-    body: undefined as unknown,
-    status(code: number) {
-      this.statusCode = code;
-      return this;
-    },
-    json(payload: unknown) {
-      this.body = payload;
-      return this;
-    },
-  };
-}
-
-describe("express-types", () => {
-  it("reads user from x-user-meta header when valid JSON is provided", () => {
-    const req = {
-      headers: {
-        "x-user-meta": JSON.stringify({ userId: "user-1", role: "admin" }),
-      },
-    } as unknown as Request;
-
-    expect(defaultHeaderAuthResolver(req)).toEqual({
-      userId: "user-1",
-      role: "admin",
-    });
-  });
-
-  it("returns null when x-user-meta is invalid JSON", () => {
-    const req = {
-      headers: {
-        "x-user-id": "user-1",
-        "x-user-meta": "{invalid-json",
-      },
-    } as unknown as Request;
-
-    expect(defaultHeaderAuthResolver(req)).toBeNull();
-  });
-
-  it("falls back to x-user-id header when x-user-meta is not set", () => {
-    const req = {
-      headers: { "x-user-id": "user-2" },
-    } as unknown as Request;
-
-    expect(defaultHeaderAuthResolver(req)).toEqual({ userId: "user-2" });
-  });
-
-  it("uses auth strategies in order and then fallback resolver", async () => {
-    const authResolver = createAuthResolver(
-      [
-        {
-          name: "first",
-          canHandle: async () => false,
-          authenticate: async () => ({ userId: "ignored" }),
-        },
-        {
-          name: "second",
-          authenticate: async () => null,
-        },
-      ],
-      {
-        fallbackResolver: async () => ({ userId: "fallback" }),
-      },
-    );
-
-    await expect(
-      authResolver({ headers: {} } as unknown as Request, {
-        method: "GET",
-        fullPath: "/",
-        requireAuth: true,
-      }),
-    ).resolves.toEqual({ userId: "fallback" });
-  });
-
-  it("returns route metadata from createMetaRouterWithAuth", () => {
-    const { routes, addRoute } = createMetaRouterWithAuth();
-
-    addRoute(
-      {
-        method: "POST",
-        fullPath: "/items/:id",
-        requireAuth: true,
-        bodyValidator: z.object({ name: z.string() }),
-        paramsValidator: z.object({ id: z.string() }),
-        meta: { description: "Create item" },
-      },
-      (_req, res) => {
-        res.status(200).json({ ok: true });
-      },
-    );
-
-    expect(routes).toHaveLength(1);
-    expect(routes[0]).toMatchObject({
-      method: "POST",
-      fullPath: "/items/:id",
-      requireAuth: true,
-      meta: { description: "Create item" },
-    });
-  });
-
-  it("returns 401 for protected route when auth resolver returns null", async () => {
-    const { router, addRoute } = createMetaRouterWithAuth({
-      authResolver: async () => null,
-    });
-
-    addRoute(
-      {
-        method: "POST",
-        fullPath: "/secure",
-        requireAuth: true,
-        bodyValidator: z.object({ name: z.string() }),
-      },
-      (_req, res) => {
-        res.status(200).json({ ok: true });
-      },
-    );
-
-    const layer = (router as any).stack.find(
-      (l: any) => l.route?.path === "/secure",
-    );
-    const authMiddleware = layer.route.stack[0].handle;
-
-    const req = { headers: {}, body: { name: "a" } } as unknown as Request;
-    const res = createMockResponse();
-    const next = vi.fn();
-
-    await authMiddleware(req, res, next);
-
-    expect(next).not.toHaveBeenCalled();
-    expect(res.statusCode).toBe(401);
-    expect(res.body).toEqual({ isSuccess: false, message: "Unauthorized" });
-  });
-
-  it("parses JSON body string when object schema is used", () => {
-    const { router, addRoute } = createMetaRouterWithAuth();
-
-    addRoute(
-      {
-        method: "POST",
-        fullPath: "/body",
-        bodyValidator: z.object({ count: z.number() }),
-      },
-      (_req, res) => {
-        res.status(200).json({ ok: true });
-      },
-    );
-
-    const layer = (router as any).stack.find(
-      (l: any) => l.route?.path === "/body",
-    );
-    const bodyMiddleware = layer.route.stack[0].handle;
-
-    const req = { body: '{"count":1}' } as Request;
-    const res = createMockResponse();
-    const next = vi.fn();
-
-    bodyMiddleware(req, res as any, next);
-
-    expect(next).toHaveBeenCalledOnce();
-    expect(req.body).toEqual({ count: 1 });
-  });
-
-  it("returns 400 for invalid JSON body string", () => {
-    const { router, addRoute } = createMetaRouterWithAuth();
-
-    addRoute(
-      {
-        method: "POST",
-        fullPath: "/invalid-body",
-        bodyValidator: z.object({ count: z.number() }),
-      },
-      (_req, res) => {
-        res.status(200).json({ ok: true });
-      },
-    );
-
-    const layer = (router as any).stack.find(
-      (l: any) => l.route?.path === "/invalid-body",
-    );
-    const bodyMiddleware = layer.route.stack[0].handle;
-
-    const req = { body: "{bad" } as Request;
-    const res = createMockResponse();
-    const next = vi.fn();
-
-    bodyMiddleware(req, res as any, next);
-
-    expect(next).not.toHaveBeenCalled();
-    expect(res.statusCode).toBe(400);
-    expect((res.body as any).message).toBe("Invalid JSON in request body");
-  });
-
-  it("returns 400 when params validation fails", () => {
-    const { router, addRoute } = createMetaRouterWithAuth();
-
-    addRoute(
-      {
-        method: "GET",
-        fullPath: "/items/:id",
-        paramsValidator: z.object({ id: z.uuid() }),
-      },
-      (_req, res) => {
-        res.status(200).json({ ok: true });
-      },
-    );
-
-    const layer = (router as any).stack.find(
-      (l: any) => l.route?.path === "/items/:id",
-    );
-    const paramsMiddleware = layer.route.stack[0].handle;
-
-    const req = { params: { id: "not-a-uuid" } } as unknown as Request;
-    const res = createMockResponse();
-    const next = vi.fn();
-
-    paramsMiddleware(req, res as any, next);
-
-    expect(next).not.toHaveBeenCalled();
-    expect(res.statusCode).toBe(400);
-    expect((res.body as any).message).toBe("Invalid URL parameters");
-  });
-});