@wopr-network/platform-core 0.1.0

package/src/auth/middleware.test.ts

@@ -0,0 +1,264 @@
+import { createHash } from "node:crypto";
+import { Hono } from "hono";
+import { describe, expect, it, vi } from "vitest";
+import type { IApiKeyRepository } from "./api-key-repository.js";
+import type { Auth } from "./better-auth.js";
+import type { AuthUser } from "./index.js";
+import { dualAuth, type SessionAuthEnv, sessionAuth } from "./middleware.js";
+
+function sha256(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+function mockApiKeyRepo(entries: Map<string, AuthUser>): IApiKeyRepository {
+  const hashMap = new Map<string, AuthUser>();
+  for (const [token, user] of entries) {
+    hashMap.set(sha256(token), user);
+  }
+  return {
+    async findByHash(keyHash: string) {
+      return hashMap.get(keyHash) ?? null;
+    },
+  };
+}
+
+function mockAuth(sessionResult: { user: { id: string; role?: string } } | null = null): Auth {
+  return {
+    api: {
+      getSession: vi.fn().mockResolvedValue(sessionResult),
+    },
+  } as unknown as Auth;
+}
+
+describe("sessionAuth middleware", () => {
+  it("sets user and authMethod for valid session", async () => {
+    const auth = mockAuth({ user: { id: "user-1", role: "admin" } });
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", sessionAuth(auth));
+    app.get("/test", (c) => {
+      const user = c.get("user");
+      const method = c.get("authMethod");
+      return c.json({ userId: user.id, roles: user.roles, method });
+    });
+
+    const res = await app.request("/test");
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.userId).toBe("user-1");
+    expect(body.roles).toEqual(["admin", "user"]);
+    expect(body.method).toBe("session");
+  });
+
+  it("sets user roles as ['user'] for non-admin", async () => {
+    const auth = mockAuth({ user: { id: "user-2" } });
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", sessionAuth(auth));
+    app.get("/test", (c) => {
+      const user = c.get("user");
+      return c.json({ roles: user.roles });
+    });
+
+    const res = await app.request("/test");
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.roles).toEqual(["user"]);
+  });
+
+  it("returns 401 when no session found", async () => {
+    const auth = mockAuth(null);
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", sessionAuth(auth));
+    app.get("/test", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/test");
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toBe("Authentication required");
+  });
+
+  it("returns 401 when session has no user", async () => {
+    const auth = {
+      api: {
+        getSession: vi.fn().mockResolvedValue({ user: null }),
+      },
+    } as unknown as Auth;
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", sessionAuth(auth));
+    app.get("/test", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/test");
+    expect(res.status).toBe(401);
+  });
+
+  it("returns 503 when getSession throws a DB error", async () => {
+    const auth = {
+      api: {
+        getSession: vi.fn().mockRejectedValue(new Error("DB error")),
+      },
+    } as unknown as Auth;
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", sessionAuth(auth));
+    app.get("/test", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/test");
+    expect(res.status).toBe(503);
+    const body = await res.json();
+    expect(body.error).toBe("Service unavailable");
+  });
+});
+
+describe("dualAuth middleware", () => {
+  const apiKeyRepo = mockApiKeyRepo(
+    new Map<string, AuthUser>([
+      ["api-key-admin", { id: "admin-1", roles: ["admin"] }],
+      ["api-key-reader", { id: "reader-1", roles: ["user"] }],
+    ]),
+  );
+
+  it("authenticates with session cookie first", async () => {
+    const auth = mockAuth({ user: { id: "session-user", role: "admin" } });
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", dualAuth(auth, apiKeyRepo));
+    app.get("/test", (c) => {
+      const user = c.get("user");
+      const method = c.get("authMethod");
+      return c.json({ userId: user.id, method });
+    });
+
+    const res = await app.request("/test");
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.userId).toBe("session-user");
+    expect(body.method).toBe("session");
+  });
+
+  it("falls back to bearer token when session fails", async () => {
+    const auth = mockAuth(null);
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", dualAuth(auth, apiKeyRepo));
+    app.get("/test", (c) => {
+      const user = c.get("user");
+      const method = c.get("authMethod");
+      return c.json({ userId: user.id, method });
+    });
+
+    const res = await app.request("/test", {
+      headers: { Authorization: "Bearer api-key-admin" },
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.userId).toBe("admin-1");
+    expect(body.method).toBe("api_key");
+  });
+
+  it("returns 401 when neither session nor token is valid", async () => {
+    const auth = mockAuth(null);
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", dualAuth(auth, apiKeyRepo));
+    app.get("/test", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/test");
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error).toBe("Authentication required");
+  });
+
+  it("returns 401 when bearer token is unknown", async () => {
+    const auth = mockAuth(null);
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", dualAuth(auth, apiKeyRepo));
+    app.get("/test", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/test", {
+      headers: { Authorization: "Bearer bad-token" },
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it("returns 401 when Authorization header is not Bearer scheme", async () => {
+    const auth = mockAuth(null);
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", dualAuth(auth, apiKeyRepo));
+    app.get("/test", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/test", {
+      headers: { Authorization: "Basic dXNlcjpwYXNz" },
+    });
+    expect(res.status).toBe(401);
+  });
+
+  it("works without apiKeyRepo (session-only mode)", async () => {
+    const auth = mockAuth(null);
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", dualAuth(auth));
+    app.get("/test", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/test");
+    expect(res.status).toBe(401);
+  });
+
+  it("returns 503 when session DB lookup throws", async () => {
+    const auth = {
+      api: {
+        getSession: vi.fn().mockRejectedValue(new Error("Session DB error")),
+      },
+    } as unknown as Auth;
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", dualAuth(auth, apiKeyRepo));
+    app.get("/test", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/test", {
+      headers: { Authorization: "Bearer api-key-admin" },
+    });
+    expect(res.status).toBe(503);
+    const body = await res.json();
+    expect(body.error).toBe("Service unavailable");
+  });
+
+  it("returns 503 when API key DB lookup throws", async () => {
+    const auth = mockAuth(null);
+    const failingRepo: IApiKeyRepository = {
+      findByHash: vi.fn().mockRejectedValue(new Error("DB connection lost")),
+    };
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", dualAuth(auth, failingRepo));
+    app.get("/test", (c) => c.json({ ok: true }));
+
+    const res = await app.request("/test", {
+      headers: { Authorization: "Bearer some-token" },
+    });
+    expect(res.status).toBe(503);
+    const body = await res.json();
+    expect(body.error).toBe("Service unavailable");
+  });
+
+  it("copies API user roles to prevent mutation", async () => {
+    const auth = mockAuth(null);
+
+    const app = new Hono<SessionAuthEnv>();
+    app.use("/*", dualAuth(auth, apiKeyRepo));
+    app.get("/test", (c) => {
+      const user = c.get("user");
+      return c.json({ roles: user.roles });
+    });
+
+    const res = await app.request("/test", {
+      headers: { Authorization: "Bearer api-key-reader" },
+    });
+    const body = await res.json();
+    expect(body.roles).toEqual(["user"]);
+  });
+});

package/src/auth/middleware.ts

@@ -0,0 +1,117 @@
+/**
+ * Session Auth Middleware — Resolves better-auth sessions for Hono routes.
+ *
+ * Reads the better-auth session cookie from the request, resolves the user,
+ * and sets `c.set("user", ...)` and `c.set("authMethod", "session")` for
+ * downstream route handlers.
+ *
+ * This middleware supports a dual-auth model:
+ * - **Session auth** (cookie-based): For browser/UI clients via better-auth
+ * - **Bearer token auth** (header-based): For machine-to-machine / API key access
+ *
+ * If neither is present, the request is rejected with 401.
+ */
+
+import { createHash } from "node:crypto";
+import type { Context, Next } from "hono";
+import type { IApiKeyRepository } from "./api-key-repository.js";
+import type { Auth } from "./better-auth.js";
+import type { AuthUser } from "./index.js";
+
+export interface SessionAuthEnv {
+  Variables: {
+    user: AuthUser;
+    authMethod: "session" | "api_key";
+  };
+}
+
+/**
+ * Create middleware that authenticates requests via better-auth session cookies.
+ *
+ * On success, sets:
+ * - `c.set("user", { id, roles })` — user context for downstream routes
+ * - `c.set("authMethod", "session")` — indicates session-based auth
+ *
+ * If no valid session cookie is found, returns 401.
+ *
+ * @param auth - The better-auth instance (use `getAuth()`)
+ */
+export function sessionAuth(auth: Auth) {
+  return async (c: Context<SessionAuthEnv>, next: Next) => {
+    try {
+      const session = await auth.api.getSession({ headers: c.req.raw.headers });
+
+      if (!session?.user) {
+        return c.json({ error: "Authentication required" }, 401);
+      }
+
+      const sessionUser = session.user as { id: string; role?: string };
+      const user: AuthUser = {
+        id: sessionUser.id,
+        roles: sessionUser.role === "admin" ? ["admin", "user"] : ["user"],
+      };
+
+      c.set("user", user);
+      c.set("authMethod", "session");
+      return next();
+    } catch {
+      return c.json({ error: "Service unavailable" }, 503);
+    }
+  };
+}
+
+/**
+ * Create dual-auth middleware that accepts EITHER a better-auth session cookie
+ * OR a bearer token. Session cookies are checked first; if absent, falls back
+ * to bearer token validation via DB-backed API key lookup.
+ *
+ * Bearer tokens are hashed with SHA-256 before lookup — raw tokens are never
+ * stored or compared in plaintext.
+ *
+ * @param auth - The better-auth instance
+ * @param apiKeyRepo - Optional repository for DB-backed API key lookup
+ */
+export function dualAuth(auth: Auth, apiKeyRepo?: IApiKeyRepository) {
+  return async (c: Context<SessionAuthEnv>, next: Next) => {
+    // 1. Try session cookie first
+    try {
+      const session = await auth.api.getSession({ headers: c.req.raw.headers });
+      if (session?.user) {
+        const sessionUser = session.user as { id: string; role?: string };
+        const user: AuthUser = {
+          id: sessionUser.id,
+          roles: sessionUser.role === "admin" ? ["admin", "user"] : ["user"],
+        };
+        c.set("user", user);
+        c.set("authMethod", "session");
+        return next();
+      }
+    } catch {
+      return c.json({ error: "Service unavailable" }, 503);
+    }
+
+    // 2. Fall back to bearer token (DB-backed lookup)
+    const authHeader = c.req.header("Authorization");
+    if (authHeader && apiKeyRepo) {
+      const trimmed = authHeader.trim();
+      if (trimmed.toLowerCase().startsWith("bearer ")) {
+        const token = trimmed.slice(7).trim();
+        if (token) {
+          const keyHash = createHash("sha256").update(token).digest("hex");
+          try {
+            const apiUser = await apiKeyRepo.findByHash(keyHash);
+            if (apiUser) {
+              c.set("user", { ...apiUser, roles: [...apiUser.roles] });
+              c.set("authMethod", "api_key");
+              return next();
+            }
+          } catch {
+            return c.json({ error: "Service unavailable" }, 503);
+          }
+        }
+      }
+    }
+
+    return c.json({ error: "Authentication required" }, 401);
+  };
+}