@vltpkg/vsr 0.0.0-26

package/test/access.test.ts

@@ -0,0 +1,705 @@
+import { describe, it, expect } from 'vitest'
+import { env } from 'cloudflare:test'
+import { app } from '../src/index.ts'
+
+describe('Access Control Endpoints', () => {
+  describe('Package Access Status', () => {
+    describe('Unscoped Packages', () => {
+      it('should get access status for unscoped packages', async () => {
+        const res = await app.request(
+          '/-/package/lodash/access',
+          {},
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+        // Content-type depends on response status
+        if (res.status === 200) {
+          expect(res.headers.get('content-type')).toContain(
+            'application/json',
+          )
+        } else if (res.status === 500) {
+          expect(res.headers.get('content-type')).toContain(
+            'text/plain',
+          )
+        }
+      })
+
+      it('should set access status for unscoped packages', async () => {
+        const res = await app.request(
+          '/-/package/lodash/access',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              access: 'public',
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should handle private access setting', async () => {
+        const res = await app.request(
+          '/-/package/my-private-package/access',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              access: 'restricted',
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+
+    describe('Scoped Packages', () => {
+      it('should get access status for scoped packages', async () => {
+        const res = await app.request(
+          '/-/package/@types%2Fnode/access',
+          {},
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+        // Content-type depends on response status
+        if (res.status === 200) {
+          expect(res.headers.get('content-type')).toContain(
+            'application/json',
+          )
+        } else if (res.status === 500) {
+          expect(res.headers.get('content-type')).toContain(
+            'text/plain',
+          )
+        }
+      })
+
+      it('should set access status for scoped packages', async () => {
+        const res = await app.request(
+          '/-/package/@myorg%2Fmypackage/access',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              access: 'public',
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should handle URL-encoded scoped package names', async () => {
+        const res = await app.request(
+          '/-/package/@scope%2Fpackage/access',
+          {},
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+
+    describe('Access Status Response Structure', () => {
+      it('should return proper JSON structure for access status', async () => {
+        const res = await app.request(
+          '/-/package/lodash/access',
+          {},
+          env,
+        )
+        if (res.status === 200) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+          // Access status structure would be validated based on implementation
+        }
+      })
+
+      it('should include access level in response', async () => {
+        const res = await app.request(
+          '/-/package/lodash/access',
+          {},
+          env,
+        )
+        if (res.status === 200) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+          // Would validate access field based on implementation
+        }
+      })
+    })
+  })
+
+  describe('Package Collaborators', () => {
+    describe('Unscoped Package Collaborators', () => {
+      it('should grant access to unscoped package collaborators', async () => {
+        const res = await app.request(
+          '/-/package/lodash/collaborators/testuser',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read', 'write'],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should revoke access from unscoped package collaborators', async () => {
+        const res = await app.request(
+          '/-/package/lodash/collaborators/testuser',
+          {
+            method: 'DELETE',
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should handle different permission levels', async () => {
+        const res = await app.request(
+          '/-/package/lodash/collaborators/testuser',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read'],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+
+    describe('Scoped Package Collaborators', () => {
+      it('should grant access to scoped package collaborators', async () => {
+        const res = await app.request(
+          '/-/package/@myorg%2Fmypackage/collaborators/testuser',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read', 'write'],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should revoke access from scoped package collaborators', async () => {
+        const res = await app.request(
+          '/-/package/@myorg%2Fmypackage/collaborators/testuser',
+          {
+            method: 'DELETE',
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should handle multiple collaborators for scoped packages', async () => {
+        const res = await app.request(
+          '/-/package/@myorg%2Fmypackage/collaborators/user1',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read', 'write', 'admin'],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+
+    describe('Collaborator Management', () => {
+      it('should handle admin permissions for collaborators', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/collaborators/admin',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read', 'write', 'admin'],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should validate permission types', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/collaborators/testuser',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['invalid-permission'],
+            }),
+          },
+          env,
+        )
+        expect([400, 401, 404, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle empty permissions array', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/collaborators/testuser',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: [],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+  })
+
+  describe('Package List Access', () => {
+    describe('List All Packages', () => {
+      it('should list packages with access information', async () => {
+        const res = await app.request('/-/package/list', {}, env)
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+        // Content-type depends on response status
+        if (res.status === 200) {
+          expect(res.headers.get('content-type')).toContain(
+            'application/json',
+          )
+        } else if (res.status === 500) {
+          expect(res.headers.get('content-type')).toContain(
+            'text/plain',
+          )
+        }
+      })
+
+      it('should handle authenticated package listing', async () => {
+        const res = await app.request(
+          '/-/package/list',
+          {
+            headers: {
+              Authorization: 'Bearer test-admin-token-12345',
+            },
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should return proper structure for package list', async () => {
+        const res = await app.request('/-/package/list', {}, env)
+        if (res.status === 200) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+          // Package list structure would be validated based on implementation
+        }
+      })
+    })
+
+    describe('Filtered Package Lists', () => {
+      it('should handle package list filtering by access level', async () => {
+        const res = await app.request(
+          '/-/package/list?access=public',
+          {},
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should handle package list filtering by user', async () => {
+        const res = await app.request(
+          '/-/package/list?user=testuser',
+          {},
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should handle pagination for package lists', async () => {
+        const res = await app.request(
+          '/-/package/list?limit=10&offset=0',
+          {},
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+  })
+
+  describe('Authentication and Authorization', () => {
+    describe('Authentication Requirements', () => {
+      it('should require authentication for access modification', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/access',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              access: 'public',
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should require authentication for collaborator management', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/collaborators/testuser',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read'],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should handle valid authentication tokens', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/access',
+          {
+            method: 'POST',
+            headers: {
+              Authorization: 'Bearer test-admin-token-12345',
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              access: 'public',
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+
+    describe('Authorization Levels', () => {
+      it('should check package ownership for access changes', async () => {
+        const res = await app.request(
+          '/-/package/someone-elses-package/access',
+          {
+            method: 'POST',
+            headers: {
+              Authorization: 'Bearer test-admin-token-12345',
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              access: 'public',
+            }),
+          },
+          env,
+        )
+        expect(
+          [200, 400, 401, 403, 404, 500].includes(res.status),
+        ).toBe(true)
+      })
+
+      it('should check admin permissions for collaborator management', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/collaborators/testuser',
+          {
+            method: 'PUT',
+            headers: {
+              Authorization: 'Bearer test-admin-token-12345',
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read'],
+            }),
+          },
+          env,
+        )
+        expect(
+          [200, 400, 401, 403, 404, 500].includes(res.status),
+        ).toBe(true)
+      })
+    })
+  })
+
+  describe('Error Handling', () => {
+    describe('Invalid Package Names', () => {
+      it('should handle invalid package names in access requests', async () => {
+        const res = await app.request(
+          '/-/package/invalid..package/access',
+          env,
+        )
+        expect([400, 404, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle malformed scoped package names', async () => {
+        const res = await app.request(
+          '/-/package/@invalid/access',
+          {},
+          env,
+        )
+        expect([400, 404, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle packages starting with dots', async () => {
+        const res = await app.request(
+          '/-/package/.hidden-package/access',
+          env,
+        )
+        expect([400, 404, 500].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('Invalid Request Bodies', () => {
+      it('should handle malformed JSON in access requests', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/access',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: 'invalid-json',
+          },
+          env,
+        )
+        expect([400, 401, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle missing required fields', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/access',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({}),
+          },
+          env,
+        )
+        expect([400, 401, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle invalid access levels', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/access',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              access: 'invalid-access-level',
+            }),
+          },
+          env,
+        )
+        expect([400, 401, 500].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('Non-existent Resources', () => {
+      it('should handle non-existent packages', async () => {
+        const res = await app.request(
+          '/-/package/nonexistent-package-12345/access',
+          {},
+          env,
+        )
+        console.log(res.status)
+        expect([400, 404, 401, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle non-existent users in collaborator requests', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/collaborators/nonexistent-user',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read'],
+            }),
+          },
+          env,
+        )
+        expect([400, 401, 404, 500].includes(res.status)).toBe(true)
+      })
+    })
+  })
+
+  describe('Response Headers and Security', () => {
+    describe('Content-Type Headers', () => {
+      it('should set appropriate content-type headers', async () => {
+        const res = await app.request(
+          '/-/package/lodash/access',
+          {},
+          env,
+        )
+        if (res.status === 200) {
+          expect(res.headers.get('content-type')).toContain(
+            'application/json',
+          )
+        }
+      })
+    })
+
+    describe('Security Headers', () => {
+      it('should include security headers in access responses', async () => {
+        const res = await app.request(
+          '/-/package/lodash/access',
+          {},
+          env,
+        )
+        // Security headers would be validated based on implementation
+        expect(res.status).toBeDefined()
+      })
+    })
+
+    describe('CORS Headers', () => {
+      it('should handle CORS headers for access requests', async () => {
+        const res = await app.request(
+          '/-/package/lodash/access',
+          {
+            headers: {
+              Origin: 'https://example.com',
+            },
+          },
+          env,
+        )
+        // CORS headers would be validated based on implementation
+        expect(res.status).toBeDefined()
+      })
+    })
+  })
+
+  describe('Special Access Cases', () => {
+    describe('Organization Packages', () => {
+      it('should handle organization-scoped packages', async () => {
+        const res = await app.request(
+          '/-/package/@myorg%2Fpackage/access',
+          {},
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should handle organization member permissions', async () => {
+        const res = await app.request(
+          '/-/package/@myorg%2Fpackage/collaborators/orgmember',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read', 'write'],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+
+    describe('Team-based Access', () => {
+      it('should handle team-based access control', async () => {
+        const res = await app.request(
+          '/-/package/mypackage/collaborators/team:developers',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              permissions: ['read', 'write'],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+  })
+})