@vltpkg/vsr 0.0.0-26

package/test/tokens.test.ts

@@ -0,0 +1,389 @@
+import { describe, it, expect } from 'vitest'
+import { env } from 'cloudflare:test'
+import { app } from '../src/index.ts'
+
+describe('Token Management Endpoints', () => {
+  describe('Root Registry Token Management', () => {
+    describe('GET /-/tokens', () => {
+      it('should require authentication for token listing', async () => {
+        const res = await app.request('/-/tokens', {}, env)
+        expect([200, 400, 401].includes(res.status)).toBe(true)
+        expect(res.headers.get('content-type')).toContain(
+          'application/json',
+        )
+      })
+
+      it('should handle authenticated token listing', async () => {
+        const res = await app.request(
+          '/-/tokens',
+          {
+            headers: {
+              Authorization: 'Bearer test-admin-token-12345',
+            },
+          },
+          env,
+        )
+        expect([200, 400, 401].includes(res.status)).toBe(true)
+        expect(res.headers.get('content-type')).toContain(
+          'application/json',
+        )
+      })
+
+      it('should return proper JSON structure for token list', async () => {
+        const res = await app.request('/-/tokens', {}, env)
+        expect([200, 400, 401].includes(res.status)).toBe(true)
+        if (res.status === 200) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+        }
+      })
+    })
+
+    describe('POST /-/tokens', () => {
+      it('should handle token creation requests', async () => {
+        const res = await app.request(
+          '/-/tokens',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              password: 'test-password',
+              readonly: false,
+              cidr_whitelist: [],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 500].includes(res.status)).toBe(true)
+        expect(res.headers.get('content-type')).toContain(
+          'application/json',
+        )
+      })
+
+      it('should handle token creation with readonly flag', async () => {
+        const res = await app.request(
+          '/-/tokens',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              password: 'test-password',
+              readonly: true,
+              cidr_whitelist: [],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 500].includes(res.status)).toBe(true)
+        expect(res.headers.get('content-type')).toContain(
+          'application/json',
+        )
+      })
+
+      it('should validate required fields for token creation', async () => {
+        const res = await app.request(
+          '/-/tokens',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({}),
+          },
+          env,
+        )
+        expect([400, 401, 500].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('PUT /-/tokens', () => {
+      it('should handle token update requests', async () => {
+        const res = await app.request(
+          '/-/tokens',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              token: 'existing-token',
+              readonly: true,
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+        expect(res.headers.get('content-type')).toContain(
+          'application/json',
+        )
+      })
+
+      it('should handle token scope updates', async () => {
+        const res = await app.request(
+          '/-/tokens',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              token: 'existing-token',
+              cidr_whitelist: ['192.168.1.0/24'],
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+
+    describe('DELETE /-/tokens/{token}', () => {
+      it('should handle token deletion requests', async () => {
+        const res = await app.request(
+          '/-/tokens/test-token-to-delete',
+          {
+            method: 'DELETE',
+          },
+          env,
+        )
+        expect([200, 401, 404, 500].includes(res.status)).toBe(true)
+        if (res.status !== 404) {
+          expect(res.headers.get('content-type')).toContain(
+            'application/json',
+          )
+        }
+      })
+
+      it('should require valid token for deletion', async () => {
+        const res = await app.request(
+          '/-/tokens/invalid-token',
+          {
+            method: 'DELETE',
+          },
+          env,
+        )
+        expect([401, 404, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle authenticated token deletion', async () => {
+        const res = await app.request(
+          '/-/tokens/test-token-to-delete',
+          {
+            method: 'DELETE',
+            headers: {
+              Authorization: 'Bearer test-admin-token-12345',
+            },
+          },
+          env,
+        )
+        expect([200, 404, 500].includes(res.status)).toBe(true)
+      })
+    })
+  })
+
+  describe('Upstream Registry Token Management', () => {
+    describe('Upstream Token Endpoints', () => {
+      it('should handle upstream token listing', async () => {
+        const res = await app.request('/npm/-/tokens', {}, env)
+        expect([200, 400, 401].includes(res.status)).toBe(true)
+        expect(res.headers.get('content-type')).toContain(
+          'application/json',
+        )
+      })
+
+      it('should handle upstream token creation', async () => {
+        const res = await app.request(
+          '/npm/-/tokens',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              password: 'test-password',
+              readonly: false,
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle upstream token updates', async () => {
+        const res = await app.request(
+          '/npm/-/tokens',
+          {
+            method: 'PUT',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              token: 'existing-token',
+              readonly: true,
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 401, 404, 500].includes(res.status)).toBe(
+          true,
+        )
+      })
+
+      it('should handle upstream token deletion', async () => {
+        const res = await app.request(
+          '/npm/-/tokens/test-token',
+          {
+            method: 'DELETE',
+          },
+          env,
+        )
+        expect([200, 401, 404, 500].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('Different Upstream Registries', () => {
+      it('should handle JSR token management', async () => {
+        const res = await app.request('/jsr/-/tokens', {}, env)
+        expect([200, 400, 401].includes(res.status)).toBe(true)
+      })
+
+      it('should handle custom upstream token management', async () => {
+        const res = await app.request('/custom/-/tokens', {}, env)
+        expect([200, 400, 401].includes(res.status)).toBe(true)
+      })
+
+      it('should handle local upstream token management', async () => {
+        const res = await app.request('/local/-/tokens', {}, env)
+        expect([200, 400, 401].includes(res.status)).toBe(true)
+      })
+    })
+  })
+
+  describe('Token Response Structure', () => {
+    describe('Token List Response', () => {
+      it('should return proper structure for token listing', async () => {
+        const res = await app.request('/-/tokens', {}, env)
+        expect([200, 400, 401].includes(res.status)).toBe(true)
+        if (res.status === 200) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+          // Token list structure validation would depend on actual implementation
+        }
+      })
+    })
+
+    describe('Token Creation Response', () => {
+      it('should return token details on successful creation', async () => {
+        const res = await app.request(
+          '/-/tokens',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              password: 'test-password',
+              readonly: false,
+            }),
+          },
+          env,
+        )
+        if (res.status === 200) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+          // Would validate token structure based on implementation
+        }
+      })
+    })
+  })
+
+  describe('Error Handling', () => {
+    describe('Invalid Requests', () => {
+      it('should handle malformed JSON in token creation', async () => {
+        const res = await app.request(
+          '/-/tokens',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: 'invalid-json',
+          },
+          env,
+        )
+        expect([400, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle missing content-type header', async () => {
+        const res = await app.request(
+          '/-/tokens',
+          {
+            method: 'POST',
+            body: JSON.stringify({
+              password: 'test-password',
+            }),
+          },
+          env,
+        )
+        expect([400, 415, 500].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('Authentication Errors', () => {
+      it('should handle invalid authentication tokens', async () => {
+        const res = await app.request(
+          '/-/tokens/some-token',
+          {
+            method: 'DELETE',
+            headers: {
+              Authorization: 'Bearer invalid-token',
+            },
+          },
+          env,
+        )
+        expect([401, 404, 500].includes(res.status)).toBe(true)
+      })
+
+      it('should handle malformed authorization headers', async () => {
+        const res = await app.request(
+          '/-/tokens/some-token',
+          {
+            method: 'DELETE',
+            headers: {
+              Authorization: 'InvalidFormat',
+            },
+          },
+          env,
+        )
+        expect([401, 404, 500].includes(res.status)).toBe(true)
+      })
+    })
+  })
+
+  describe('Response Headers and Caching', () => {
+    describe('Content-Type Headers', () => {
+      it('should set appropriate content-type for token responses', async () => {
+        const res = await app.request('/-/tokens', {}, env)
+        expect(res.headers.get('content-type')).toContain(
+          'application/json',
+        )
+      })
+    })
+
+    describe('Security Headers', () => {
+      it('should include security headers in token responses', async () => {
+        const res = await app.request('/-/tokens', {}, env)
+        // Security headers would be validated based on implementation
+        expect(res.status).toBeDefined()
+      })
+    })
+  })
+})

package/test/utils/auth.test.ts

@@ -0,0 +1,214 @@
+import { describe, it, expect, vi } from 'vitest'
+import {
+  getTokenFromHeader,
+  parseTokenAccess,
+} from '../../src/utils/auth.ts'
+import type { HonoContext, TokenScope } from '../../types.ts'
+
+describe('Auth Utils', () => {
+  describe('getTokenFromHeader', () => {
+    it('should extract token from Bearer authorization header', () => {
+      const mockContext = {
+        req: {
+          header: vi.fn().mockReturnValue('Bearer test-token-12345'),
+        },
+      } as unknown as HonoContext
+
+      const token = getTokenFromHeader(mockContext)
+      expect(token).toBe('test-token-12345')
+      expect(mockContext.req.header).toHaveBeenCalledWith(
+        'Authorization',
+      )
+    })
+
+    it('should handle Bearer token with extra whitespace', () => {
+      const mockContext = {
+        req: {
+          header: vi
+            .fn()
+            .mockReturnValue('Bearer   test-token-with-spaces   '),
+        },
+      } as unknown as HonoContext
+
+      const token = getTokenFromHeader(mockContext)
+      expect(token).toBe('test-token-with-spaces')
+    })
+
+    it('should return null for missing authorization header', () => {
+      const mockContext = {
+        req: {
+          header: vi.fn().mockReturnValue(undefined),
+        },
+      } as unknown as HonoContext
+
+      const token = getTokenFromHeader(mockContext)
+      expect(token).toBeNull()
+    })
+
+    it('should return null for non-Bearer authorization header', () => {
+      const mockContext = {
+        req: {
+          header: vi.fn().mockReturnValue('Basic dXNlcjpwYXNz'),
+        },
+      } as unknown as HonoContext
+
+      const token = getTokenFromHeader(mockContext)
+      expect(token).toBeNull()
+    })
+
+    it('should return empty string for malformed Bearer header', () => {
+      const mockContext = {
+        req: {
+          header: vi.fn().mockReturnValue('Bearer '),
+        },
+      } as unknown as HonoContext
+
+      const token = getTokenFromHeader(mockContext)
+      expect(token).toBe('')
+    })
+  })
+
+  describe('parseTokenAccess', () => {
+    it('should parse read-only access for any package', () => {
+      const scope: TokenScope[] = [
+        {
+          types: { pkg: { read: true, write: false } },
+          values: ['*'],
+        },
+      ]
+
+      const access = parseTokenAccess({
+        scope,
+        uuid: 'test-user-uuid',
+      })
+
+      expect(access.anyPackage).toBe(true)
+      expect(access.specificPackage).toBe(false)
+      expect(access.readAccess).toBe(true)
+      expect(access.writeAccess).toBe(false)
+      expect(access.methods).toEqual(['get'])
+    })
+
+    it('should parse write access for specific package', () => {
+      const scope: TokenScope[] = [
+        {
+          types: { pkg: { read: false, write: true } },
+          values: ['my-package'],
+        },
+      ]
+
+      const access = parseTokenAccess({
+        scope,
+        pkg: 'my-package',
+        uuid: 'test-user-uuid',
+      })
+
+      expect(access.anyPackage).toBe(false)
+      expect(access.specificPackage).toBe(true)
+      expect(access.readAccess).toBe(false)
+      expect(access.writeAccess).toBe(true)
+      expect(access.methods).toEqual(['put', 'post', 'delete'])
+    })
+
+    it('should parse user-specific access', () => {
+      const scope: TokenScope[] = [
+        {
+          types: { user: { read: true, write: true } },
+          values: ['~test-user-uuid'],
+        },
+      ]
+
+      const access = parseTokenAccess({
+        scope,
+        uuid: 'test-user-uuid',
+      })
+
+      expect(access.anyUser).toBe(false)
+      expect(access.specificUser).toBe(true)
+      expect(access.readAccess).toBe(true)
+      expect(access.writeAccess).toBe(true)
+      expect(access.methods).toEqual(['get', 'put', 'post', 'delete'])
+    })
+
+    it('should parse wildcard user access', () => {
+      const scope: TokenScope[] = [
+        {
+          types: { user: { read: true, write: false } },
+          values: ['*'],
+        },
+      ]
+
+      const access = parseTokenAccess({
+        scope,
+        uuid: 'any-user-uuid',
+      })
+
+      expect(access.anyUser).toBe(true)
+      expect(access.specificUser).toBe(false)
+      expect(access.readAccess).toBe(true)
+      expect(access.writeAccess).toBe(false)
+    })
+
+    it('should handle multiple scopes with combined permissions', () => {
+      const scope: TokenScope[] = [
+        {
+          types: { pkg: { read: true, write: false } },
+          values: ['package-1'],
+        },
+        {
+          types: { pkg: { read: false, write: true } },
+          values: ['package-1'],
+        },
+      ]
+
+      const access = parseTokenAccess({
+        scope,
+        pkg: 'package-1',
+        uuid: 'test-user-uuid',
+      })
+
+      expect(access.specificPackage).toBe(true)
+      expect(access.readAccess).toBe(true)
+      expect(access.writeAccess).toBe(true)
+      expect(access.methods).toEqual(['get', 'put', 'post', 'delete'])
+    })
+
+    it('should handle empty scope array', () => {
+      const scope: TokenScope[] = []
+
+      const access = parseTokenAccess({
+        scope,
+        uuid: 'test-user-uuid',
+      })
+
+      expect(access.anyUser).toBe(false)
+      expect(access.specificUser).toBe(false)
+      expect(access.anyPackage).toBe(false)
+      expect(access.specificPackage).toBe(false)
+      expect(access.readAccess).toBe(false)
+      expect(access.writeAccess).toBe(false)
+      expect(access.methods).toEqual([])
+    })
+
+    it('should handle scope with no matching package', () => {
+      const scope: TokenScope[] = [
+        {
+          types: { pkg: true, user: false },
+          values: ['other-package'],
+          methods: ['get', 'put'],
+        },
+      ]
+
+      const access = parseTokenAccess({
+        scope,
+        pkg: 'my-package',
+        uuid: 'test-user-uuid',
+      })
+
+      expect(access.specificPackage).toBe(false)
+      expect(access.readAccess).toBe(false)
+      expect(access.writeAccess).toBe(false)
+      expect(access.methods).toEqual([])
+    })
+  })
+})