@useatlas/create 0.0.1

package/templates/nextjs-standalone/src/api/__tests__/auth.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Unit tests for the Hono auth catch-all route.
+ *
+ * Tests that non-managed modes return 404, managed mode delegates
+ * to Better Auth's fetch handler, and errors return 503.
+ */
+
+import { describe, it, expect, beforeEach, mock } from "bun:test";
+
+// --- Mocks ---
+
+let mockAuthMode: string = "none";
+
+mock.module("@atlas/api/lib/auth/detect", () => ({
+  detectAuthMode: () => mockAuthMode,
+  resetAuthModeCache: () => {},
+}));
+
+/**
+ * Mock Better Auth instance with a fetch-compatible .handler method.
+ * Each test can override mockHandler.
+ */
+let mockHandler: (req: Request) => Response | Promise<Response> = () =>
+  new Response("ok", { status: 200 });
+
+mock.module("@atlas/api/lib/auth/server", () => ({
+  getAuthInstance: () => ({
+    handler: (req: Request) => mockHandler(req),
+  }),
+  resetAuthInstance: () => {},
+}));
+
+// Mock modules needed by chat and health routes (loaded when importing ../index).
+// We do NOT mock @/lib/logger — it works fine and mocking it globally would
+// break other test files in the same bun test run.
+mock.module("@atlas/api/lib/auth/middleware", () => ({
+  authenticateRequest: () =>
+    Promise.resolve({ authenticated: true, mode: "none", user: undefined }),
+  checkRateLimit: () => ({ allowed: true }),
+  getClientIP: () => null,
+}));
+
+mock.module("@atlas/api/lib/agent", () => ({
+  runAgent: () =>
+    Promise.resolve({
+      toUIMessageStreamResponse: () => new Response("stream", { status: 200 }),
+    }),
+}));
+
+mock.module("@atlas/api/lib/startup", () => ({
+  validateEnvironment: () => Promise.resolve([]),
+  getStartupWarnings: () => [],
+}));
+
+mock.module("@atlas/api/lib/semantic", () => ({
+  getWhitelistedTables: () => new Set(),
+  _resetWhitelists: () => {},
+}));
+
+mock.module("@atlas/api/lib/tools/explore", () => ({
+  getExploreBackendType: () => "just-bash",
+  getActiveSandboxPluginId: () => null,
+}));
+
+// Import after mocks
+const { app } = await import("../index");
+
+describe("Auth catch-all route (/api/auth/*)", () => {
+  beforeEach(() => {
+    mockAuthMode = "none";
+    mockHandler = () => new Response("ok", { status: 200 });
+  });
+
+  function makeRequest(
+    method: "GET" | "POST" = "GET",
+    path = "/api/auth/session",
+  ): Request {
+    return new Request(`http://localhost${path}`, { method });
+  }
+
+  // ----- Non-managed mode → 404 -----
+
+  describe("non-managed mode", () => {
+    for (const mode of ["none", "simple-key", "byot"] as const) {
+      it(`returns 404 when auth mode is '${mode}' (GET)`, async () => {
+        mockAuthMode = mode;
+        const res = await app.fetch(makeRequest("GET"));
+
+        expect(res.status).toBe(404);
+        const body = (await res.json()) as Record<string, unknown>;
+        expect(body.error).toBe("not_found");
+        expect(body.message).toContain("not enabled");
+      });
+
+      it(`returns 404 when auth mode is '${mode}' (POST)`, async () => {
+        mockAuthMode = mode;
+        const res = await app.fetch(makeRequest("POST"));
+
+        expect(res.status).toBe(404);
+        const body = (await res.json()) as Record<string, unknown>;
+        expect(body.error).toBe("not_found");
+      });
+    }
+  });
+
+  // ----- Managed mode → delegates to Better Auth -----
+
+  describe("managed mode", () => {
+    beforeEach(() => {
+      mockAuthMode = "managed";
+    });
+
+    it("delegates GET to Better Auth handler", async () => {
+      mockHandler = () =>
+        Response.json({ session: { id: "sess_1" } }, { status: 200 });
+
+      const res = await app.fetch(makeRequest("GET"));
+      expect(res.status).toBe(200);
+
+      const body = (await res.json()) as Record<string, unknown>;
+      expect(body.session).toBeDefined();
+    });
+
+    it("delegates POST to Better Auth handler", async () => {
+      mockHandler = () =>
+        Response.json({ user: { id: "usr_1" } }, { status: 200 });
+
+      const res = await app.fetch(makeRequest("POST"));
+      expect(res.status).toBe(200);
+
+      const body = (await res.json()) as Record<string, unknown>;
+      expect(body.user).toBeDefined();
+    });
+  });
+
+  // ----- Error handling → 503 -----
+
+  describe("error handling", () => {
+    beforeEach(() => {
+      mockAuthMode = "managed";
+    });
+
+    it("returns 503 when handler throws", async () => {
+      mockHandler = () => {
+        throw new Error("DB connection failed");
+      };
+
+      const res = await app.fetch(makeRequest("GET"));
+      expect(res.status).toBe(503);
+
+      const body = (await res.json()) as Record<string, unknown>;
+      expect(body.error).toBe("auth_service_error");
+      expect(body.message).toContain("unavailable");
+    });
+
+    it("returns 503 when handler throws non-Error", async () => {
+      mockHandler = () => {
+        throw "unexpected string error";
+      };
+
+      const res = await app.fetch(makeRequest("GET"));
+      expect(res.status).toBe(503);
+    });
+  });
+});

package/templates/nextjs-standalone/src/api/__tests__/chat.test.ts

@@ -0,0 +1,376 @@
+/**
+ * Unit tests for the Hono chat route.
+ *
+ * Mocks auth, rate-limiting, startup diagnostics, and the agent to
+ * isolate the route wiring logic. Tests the Hono app.fetch() directly.
+ */
+
+import {
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  mock,
+  type Mock,
+} from "bun:test";
+import type { AuthResult } from "@atlas/api/lib/auth/types";
+
+// --- Mocks ---
+
+const mockAuthenticateRequest: Mock<
+  (req: Request) => Promise<AuthResult>
+> = mock(() =>
+  Promise.resolve({
+    authenticated: true as const,
+    mode: "none" as const,
+    user: undefined,
+  }),
+);
+
+const mockCheckRateLimit: Mock<
+  (key: string) => { allowed: boolean; retryAfterMs?: number }
+> = mock(() => ({ allowed: true }));
+
+const mockGetClientIP: Mock<(req: Request) => string | null> = mock(
+  () => null,
+);
+
+mock.module("@atlas/api/lib/auth/middleware", () => ({
+  authenticateRequest: mockAuthenticateRequest,
+  checkRateLimit: mockCheckRateLimit,
+  getClientIP: mockGetClientIP,
+}));
+
+const mockValidateEnvironment: Mock<
+  () => Promise<{ message: string }[]>
+> = mock(() => Promise.resolve([]));
+
+const mockRunAgent = mock(() =>
+  Promise.resolve({
+    toUIMessageStreamResponse: () => new Response("stream", { status: 200 }),
+    text: Promise.resolve("answer"),
+  }),
+);
+
+mock.module("@atlas/api/lib/agent", () => ({
+  runAgent: mockRunAgent,
+}));
+
+// Mock modules needed by health and auth routes (loaded via ../index)
+mock.module("@atlas/api/lib/semantic", () => ({
+  getWhitelistedTables: () => new Set(),
+  _resetWhitelists: () => {},
+}));
+
+mock.module("@atlas/api/lib/tools/explore", () => ({
+  getExploreBackendType: () => "just-bash",
+  getActiveSandboxPluginId: () => null,
+  explore: { type: "function" },
+}));
+
+mock.module("@atlas/api/lib/auth/detect", () => ({
+  detectAuthMode: () => "none",
+  resetAuthModeCache: () => {},
+}));
+
+mock.module("@atlas/api/lib/startup", () => ({
+  validateEnvironment: mockValidateEnvironment,
+  getStartupWarnings: () => [],
+}));
+
+// Mock action tools so buildRegistry({ includeActions: true }) works
+// without needing JIRA/email credentials or external services.
+mock.module("@atlas/api/lib/tools/actions", () => ({
+  createJiraTicket: {
+    name: "createJiraTicket",
+    description: "### Create JIRA Ticket\nMock",
+    tool: { type: "function" },
+    actionType: "jira:create",
+    reversible: true,
+    defaultApproval: "manual",
+    requiredCredentials: ["JIRA_BASE_URL", "JIRA_EMAIL", "JIRA_API_TOKEN"],
+  },
+  sendEmailReport: {
+    name: "sendEmailReport",
+    description: "### Send Email Report\nMock",
+    tool: { type: "function" },
+    actionType: "email:send",
+    reversible: false,
+    defaultApproval: "admin-only",
+    requiredCredentials: ["RESEND_API_KEY"],
+  },
+}));
+
+const mockCreateConversation = mock((): Promise<{ id: string } | null> =>
+  Promise.resolve({ id: "conv-test-123" }),
+);
+const mockAddMessage = mock(() => {});
+const mockGetConversationChat = mock((): Promise<{ ok: boolean; reason?: string; data?: unknown }> => Promise.resolve({ ok: false, reason: "not_found" }));
+const mockGenerateTitle = mock((q: string) => q.slice(0, 80));
+
+mock.module("@atlas/api/lib/conversations", () => ({
+  createConversation: mockCreateConversation,
+  addMessage: mockAddMessage,
+  getConversation: mockGetConversationChat,
+  generateTitle: mockGenerateTitle,
+  listConversations: mock(() => Promise.resolve({ conversations: [], total: 0 })),
+  deleteConversation: mock(() => Promise.resolve({ ok: false, reason: "not_found" })),
+  starConversation: mock(() => Promise.resolve({ ok: false, reason: "not_found" })),
+}));
+
+// Import after mocks are registered
+const { app } = await import("../index");
+
+describe("POST /api/chat", () => {
+  const origDatasource = process.env.ATLAS_DATASOURCE_URL;
+  const origDatabaseUrl = process.env.DATABASE_URL;
+  const origActionsEnabled = process.env.ATLAS_ACTIONS_ENABLED;
+
+  beforeEach(() => {
+    process.env.ATLAS_DATASOURCE_URL =
+      "postgresql://test:test@localhost:5432/test";
+    process.env.DATABASE_URL = "postgresql://test:test@localhost:5432/test";
+    mockAuthenticateRequest.mockReset();
+    mockAuthenticateRequest.mockResolvedValue({
+      authenticated: true as const,
+      mode: "none" as const,
+      user: undefined,
+    });
+    mockCheckRateLimit.mockReset();
+    mockCheckRateLimit.mockReturnValue({ allowed: true });
+    mockGetClientIP.mockReset();
+    mockGetClientIP.mockReturnValue(null);
+    mockValidateEnvironment.mockReset();
+    mockValidateEnvironment.mockResolvedValue([]);
+    mockRunAgent.mockReset();
+    mockRunAgent.mockResolvedValue({
+      toUIMessageStreamResponse: () => new Response("stream", { status: 200 }),
+      text: Promise.resolve("answer"),
+    });
+    mockCreateConversation.mockReset();
+    mockCreateConversation.mockResolvedValue({ id: "conv-test-123" });
+    mockAddMessage.mockReset();
+    mockGetConversationChat.mockReset();
+    mockGetConversationChat.mockResolvedValue({ ok: false, reason: "not_found" });
+    delete process.env.ATLAS_ACTIONS_ENABLED;
+  });
+
+  afterEach(() => {
+    if (origDatasource !== undefined)
+      process.env.ATLAS_DATASOURCE_URL = origDatasource;
+    else delete process.env.ATLAS_DATASOURCE_URL;
+    if (origDatabaseUrl !== undefined)
+      process.env.DATABASE_URL = origDatabaseUrl;
+    else delete process.env.DATABASE_URL;
+    if (origActionsEnabled !== undefined)
+      process.env.ATLAS_ACTIONS_ENABLED = origActionsEnabled;
+    else delete process.env.ATLAS_ACTIONS_ENABLED;
+  });
+
+  function makeRequest(body?: unknown): Request {
+    return new Request("http://localhost/api/chat", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(
+        body ?? {
+          messages: [
+            {
+              id: "1",
+              role: "user",
+              parts: [{ type: "text", text: "hello" }],
+            },
+          ],
+        },
+      ),
+    });
+  }
+
+  it("returns 200 stream on success", async () => {
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(200);
+    const text = await response.text();
+    expect(text).toBe("stream");
+  });
+
+  it("returns 401 when authenticateRequest returns unauthenticated", async () => {
+    mockAuthenticateRequest.mockResolvedValueOnce({
+      authenticated: false as const,
+      mode: "simple-key" as const,
+      status: 401 as const,
+      error: "API key required",
+    });
+
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(401);
+
+    const body = (await response.json()) as Record<string, unknown>;
+    expect(body.error).toBe("auth_error");
+    expect(body.message).toBe("API key required");
+
+    expect(mockRunAgent).not.toHaveBeenCalled();
+  });
+
+  it("returns 500 when authenticateRequest throws", async () => {
+    mockAuthenticateRequest.mockRejectedValueOnce(new Error("DB crashed"));
+
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(500);
+
+    const body = (await response.json()) as Record<string, unknown>;
+    expect(body.error).toBe("auth_error");
+    expect(body.message).toBe("Authentication system error");
+
+    expect(mockRunAgent).not.toHaveBeenCalled();
+  });
+
+  it("returns 429 with Retry-After when rate limited", async () => {
+    mockCheckRateLimit.mockReturnValueOnce({
+      allowed: false,
+      retryAfterMs: 30000,
+    });
+
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(429);
+    expect(response.headers.get("Retry-After")).toBe("30");
+
+    const body = (await response.json()) as Record<string, unknown>;
+    expect(body.error).toBe("rate_limited");
+    expect(body.retryAfterSeconds).toBe(30);
+
+    expect(mockRunAgent).not.toHaveBeenCalled();
+  });
+
+  it("returns retryAfterSeconds=60 when retryAfterMs is undefined", async () => {
+    mockCheckRateLimit.mockReturnValueOnce({ allowed: false });
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(429);
+    expect(response.headers.get("Retry-After")).toBe("60");
+    const body = (await response.json()) as Record<string, unknown>;
+    expect(body.retryAfterSeconds).toBe(60);
+    expect(mockRunAgent).not.toHaveBeenCalled();
+  });
+
+  it("returns 400 when ATLAS_DATASOURCE_URL is not set", async () => {
+    delete process.env.ATLAS_DATASOURCE_URL;
+
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(400);
+
+    const body = (await response.json()) as Record<string, unknown>;
+    expect(body.error).toBe("no_datasource");
+    expect(body.message).toContain("ATLAS_DATASOURCE_URL");
+
+    expect(mockRunAgent).not.toHaveBeenCalled();
+  });
+
+  it("returns 400 when validateEnvironment reports errors", async () => {
+    mockValidateEnvironment.mockResolvedValueOnce([
+      { message: "Missing API key" },
+    ]);
+
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(400);
+
+    const body = (await response.json()) as Record<string, unknown>;
+    expect(body.error).toBe("configuration_error");
+
+    expect(mockRunAgent).not.toHaveBeenCalled();
+  });
+
+  it("returns x-conversation-id header when conversation is created", async () => {
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(200);
+    expect(response.headers.get("x-conversation-id")).toBe("conv-test-123");
+  });
+
+  it("returns 404 when conversationId does not belong to user", async () => {
+    mockGetConversationChat.mockResolvedValueOnce({ ok: false, reason: "not_found" });
+    const response = await app.fetch(
+      makeRequest({
+        messages: [{ id: "1", role: "user", parts: [{ type: "text", text: "follow up" }] }],
+        conversationId: "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+      }),
+    );
+    expect(response.status).toBe(404);
+    const body = (await response.json()) as Record<string, unknown>;
+    expect(body.error).toBe("not_found");
+  });
+
+  it("continues existing conversation and persists user message", async () => {
+    const convId = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+    mockGetConversationChat.mockResolvedValueOnce({
+      ok: true,
+      data: { id: convId, userId: null, title: "Test", messages: [] },
+    });
+
+    const response = await app.fetch(
+      makeRequest({
+        messages: [{ id: "1", role: "user", parts: [{ type: "text", text: "follow up" }] }],
+        conversationId: convId,
+      }),
+    );
+    expect(response.status).toBe(200);
+    expect(response.headers.get("x-conversation-id")).toBe(convId);
+    expect(mockCreateConversation).not.toHaveBeenCalled();
+    expect(mockAddMessage).toHaveBeenCalled();
+  });
+
+  it("returns 200 without x-conversation-id when createConversation fails", async () => {
+    mockCreateConversation.mockResolvedValueOnce(null);
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(200);
+    expect(response.headers.get("x-conversation-id")).toBeNull();
+  });
+
+  it("returns 200 when conversation creation throws", async () => {
+    mockCreateConversation.mockRejectedValueOnce(new Error("DB crashed"));
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(200);
+    expect(response.headers.get("x-conversation-id")).toBeNull();
+  });
+
+  it("returns 422 for invalid conversationId format", async () => {
+    const response = await app.fetch(
+      makeRequest({
+        messages: [
+          { id: "1", role: "user", parts: [{ type: "text", text: "hello" }] },
+        ],
+        conversationId: "not-a-uuid",
+      }),
+    );
+    expect(response.status).toBe(422);
+    const body = (await response.json()) as Record<string, unknown>;
+    expect(body.error).toBe("validation_error");
+  });
+
+  it("passes action tools to runAgent when ATLAS_ACTIONS_ENABLED=true", async () => {
+    process.env.ATLAS_ACTIONS_ENABLED = "true";
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(200);
+    expect(mockRunAgent).toHaveBeenCalledTimes(1);
+    const calls = mockRunAgent.mock.calls as unknown as unknown[][];
+    const call = calls[0]![0] as { tools?: unknown };
+    expect(call.tools).toBeDefined();
+  });
+
+  it("does not pass action tools when ATLAS_ACTIONS_ENABLED is unset", async () => {
+    delete process.env.ATLAS_ACTIONS_ENABLED;
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(200);
+    expect(mockRunAgent).toHaveBeenCalledTimes(1);
+    const calls = mockRunAgent.mock.calls as unknown as unknown[][];
+    const call = calls[0]![0] as { tools?: unknown };
+    expect(call.tools).toBeUndefined();
+  });
+
+  it("does not pass action tools when ATLAS_ACTIONS_ENABLED=false", async () => {
+    process.env.ATLAS_ACTIONS_ENABLED = "false";
+    const response = await app.fetch(makeRequest());
+    expect(response.status).toBe(200);
+    expect(mockRunAgent).toHaveBeenCalledTimes(1);
+    const calls = mockRunAgent.mock.calls as unknown as unknown[][];
+    const call = calls[0]![0] as { tools?: unknown };
+    expect(call.tools).toBeUndefined();
+  });
+});