@xdelivered/emberflow 0.2.0

package/server/auth/verifiers.ts

@@ -0,0 +1,9 @@
+// Re-exports the shared, browser-safe implementation from src/engine/authVerify.ts
+// so server-side auth enforcement and the requireAuth node (bundled into the
+// studio browser build) share one implementation instead of two diverging copies.
+export {
+  bearerVerifier,
+  apiKeyVerifier,
+  VerifierRegistry,
+  createDefaultVerifierRegistry,
+} from '../../src/engine';

package/server/authAttach.test.ts

@@ -0,0 +1,175 @@
+import { describe, expect, it } from 'vitest';
+import { attachCredential, captureCredential } from './authAttach';
+import type { EnvAuth } from './environments';
+
+describe('attachCredential', () => {
+  it('sets a cookie on empty headers', () => {
+    const attach: EnvAuth['attach'] = { as: 'cookie', name: 'session', secretRef: 'S' };
+    const result = attachCredential({}, attach, 'abc');
+    expect(result).toEqual({ cookie: 'session=abc' });
+  });
+
+  it('appends a cookie to an existing Cookie header', () => {
+    const attach: EnvAuth['attach'] = { as: 'cookie', name: 'session', secretRef: 'S' };
+    const result = attachCredential({ cookie: 'x=1' }, attach, 'abc');
+    expect(result).toEqual({ cookie: 'x=1; session=abc' });
+  });
+
+  it('sets a header', () => {
+    const attach: EnvAuth['attach'] = { as: 'header', name: 'Authorization', secretRef: 'S' };
+    const result = attachCredential({}, attach, 'Bearer abc');
+    expect(result).toEqual({ authorization: 'Bearer abc' });
+  });
+
+  it('returns headers unchanged when the target header is already present', () => {
+    const attach: EnvAuth['attach'] = { as: 'header', name: 'Authorization', secretRef: 'S' };
+    const headers = { authorization: 'Bearer explicit' };
+    const result = attachCredential(headers, attach, 'Bearer abc');
+    expect(result).toBe(headers);
+    expect(result).toEqual({ authorization: 'Bearer explicit' });
+  });
+
+  it('returns headers unchanged when the target header is already present under different casing', () => {
+    const attach: EnvAuth['attach'] = { as: 'header', name: 'Authorization', secretRef: 'x' };
+    const headers = { Authorization: 'Bearer caller' };
+    const result = attachCredential(headers, attach, 'injected');
+    expect(result).toBe(headers);
+    expect(result).toEqual({ Authorization: 'Bearer caller' });
+    expect(Object.prototype.hasOwnProperty.call(result, 'authorization')).toBe(false);
+  });
+
+  it('returns headers unchanged when the target cookie name is already present', () => {
+    const attach: EnvAuth['attach'] = { as: 'cookie', name: 'session', secretRef: 'S' };
+    const headers = { cookie: 'session=explicit' };
+    const result = attachCredential(headers, attach, 'abc');
+    expect(result).toBe(headers);
+    expect(result).toEqual({ cookie: 'session=explicit' });
+  });
+
+  it('returns a new headers object (does not mutate input) when attaching', () => {
+    const attach: EnvAuth['attach'] = { as: 'header', name: 'Authorization', secretRef: 'S' };
+    const headers = {};
+    const result = attachCredential(headers, attach, 'Bearer abc');
+    expect(result).not.toBe(headers);
+    expect(headers).toEqual({});
+  });
+
+  it('prepends the prefix to a header value', () => {
+    const attach: EnvAuth['attach'] = { as: 'header', name: 'Authorization', secretRef: 'S', prefix: 'Bearer ' };
+    const result = attachCredential({}, attach, 'tok123');
+    expect(result).toEqual({ authorization: 'Bearer tok123' });
+  });
+
+  it('prepends the prefix to a cookie value', () => {
+    const attach: EnvAuth['attach'] = { as: 'cookie', name: 'session', secretRef: 'S', prefix: 'Basic ' };
+    const result = attachCredential({}, attach, 'tok123');
+    expect(result).toEqual({ cookie: 'session=Basic tok123' });
+  });
+
+  it('returns headers unchanged when the target header is already present, even with a prefix configured', () => {
+    const attach: EnvAuth['attach'] = { as: 'header', name: 'Authorization', secretRef: 'S', prefix: 'Bearer ' };
+    const headers = { authorization: 'Bearer explicit' };
+    const result = attachCredential(headers, attach, 'tok123');
+    expect(result).toBe(headers);
+    expect(result).toEqual({ authorization: 'Bearer explicit' });
+  });
+
+  it('behaves identically to no-prefix behavior when prefix is absent', () => {
+    const attach: EnvAuth['attach'] = { as: 'header', name: 'Authorization', secretRef: 'S' };
+    const result = attachCredential({}, attach, 'tok123');
+    expect(result).toEqual({ authorization: 'tok123' });
+  });
+});
+
+describe('captureCredential', () => {
+  function makeRes(headersInit: Record<string, string>, body: unknown): { headers: Headers; json: () => Promise<any> } {
+    return {
+      headers: new Headers(headersInit),
+      json: async () => body,
+    };
+  }
+
+  it('captures a named cookie value from set-cookie', async () => {
+    const res = makeRes({ 'set-cookie': 'session=abc; Path=/; HttpOnly' }, {});
+    const capture: NonNullable<EnvAuth['login']>['capture'] = { from: 'set-cookie', cookieName: 'session' };
+    const value = await captureCredential(res, capture);
+    expect(value).toBe('abc');
+  });
+
+  it('captures the whole cookie pair when cookieName is omitted', async () => {
+    const res = makeRes({ 'set-cookie': 'session=abc; Path=/; HttpOnly' }, {});
+    const capture: NonNullable<EnvAuth['login']>['capture'] = { from: 'set-cookie' };
+    const value = await captureCredential(res, capture);
+    expect(value).toBe('session=abc');
+  });
+
+  it('captures a value from a json dot-path', async () => {
+    const res = makeRes({}, { token: 'tok-123' });
+    const capture: NonNullable<EnvAuth['login']>['capture'] = { from: 'json', path: 'token' };
+    const value = await captureCredential(res, capture);
+    expect(value).toBe('tok-123');
+  });
+
+  it('captures a value from a nested json dot-path', async () => {
+    const res = makeRes({}, { data: { token: 'tok-nested' } });
+    const capture: NonNullable<EnvAuth['login']>['capture'] = { from: 'json', path: 'data.token' };
+    const value = await captureCredential(res, capture);
+    expect(value).toBe('tok-nested');
+  });
+
+  it('captures a header value', async () => {
+    const res = makeRes({ 'x-auth-token': 'tok-header' }, {});
+    const capture: NonNullable<EnvAuth['login']>['capture'] = { from: 'header', name: 'x-auth-token' };
+    const value = await captureCredential(res, capture);
+    expect(value).toBe('tok-header');
+  });
+
+  it('returns null when the set-cookie header is missing', async () => {
+    const res = makeRes({}, {});
+    const capture: NonNullable<EnvAuth['login']>['capture'] = { from: 'set-cookie', cookieName: 'session' };
+    const value = await captureCredential(res, capture);
+    expect(value).toBeNull();
+  });
+
+  it('selects the named cookie line from multiple getSetCookie() lines', async () => {
+    const res = {
+      headers: {
+        getSetCookie: () => ['other=1; Path=/', 'better-auth.session_token=zzz; HttpOnly', 'trailing=x'],
+        get: () => null,
+      } as unknown as Headers,
+      json: async () => ({}),
+    };
+    const capture: NonNullable<EnvAuth['login']>['capture'] = {
+      from: 'set-cookie',
+      cookieName: 'better-auth.session_token',
+    };
+    const value = await captureCredential(res, capture);
+    expect(value).toBe('zzz');
+  });
+
+  it('falls back to the single comma-joined get(set-cookie) when getSetCookie is unavailable', async () => {
+    const res = {
+      headers: {
+        get: (name: string) => (name === 'set-cookie' ? 'session=abc; Path=/; HttpOnly' : null),
+      } as unknown as Headers,
+      json: async () => ({}),
+    };
+    const capture: NonNullable<EnvAuth['login']>['capture'] = { from: 'set-cookie', cookieName: 'session' };
+    const value = await captureCredential(res, capture);
+    expect(value).toBe('abc');
+  });
+
+  it('returns null when the json path is not found', async () => {
+    const res = makeRes({}, { other: 'x' });
+    const capture: NonNullable<EnvAuth['login']>['capture'] = { from: 'json', path: 'token' };
+    const value = await captureCredential(res, capture);
+    expect(value).toBeNull();
+  });
+
+  it('returns null when the header is missing', async () => {
+    const res = makeRes({}, {});
+    const capture: NonNullable<EnvAuth['login']>['capture'] = { from: 'header', name: 'x-auth-token' };
+    const value = await captureCredential(res, capture);
+    expect(value).toBeNull();
+  });
+});

package/server/authAttach.ts

@@ -0,0 +1,99 @@
+import type { EnvAuth } from './environments';
+
+type LoginCapture = NonNullable<EnvAuth['login']>['capture'];
+
+/**
+ * Attaches a captured credential value onto a headers object for a run.
+ * Pure and non-mutating: returns a NEW headers object.
+ * Additive + non-destructive — if the target header/cookie-name is already
+ * present, the input is returned unchanged (caller-explicit wins).
+ */
+export function attachCredential(
+  headers: Record<string, unknown>,
+  attach: EnvAuth['attach'],
+  value: string,
+): Record<string, unknown> {
+  const attachedValue = attach.prefix ? `${attach.prefix}${value}` : value;
+
+  if (attach.as === 'cookie') {
+    const existingCookie = typeof headers['cookie'] === 'string' ? (headers['cookie'] as string) : undefined;
+    if (existingCookie !== undefined && hasCookieName(existingCookie, attach.name)) {
+      return headers;
+    }
+    const nextCookie = existingCookie
+      ? `${existingCookie}; ${attach.name}=${attachedValue}`
+      : `${attach.name}=${attachedValue}`;
+    return { ...headers, cookie: nextCookie };
+  }
+
+  const headerKey = attach.name.toLowerCase();
+  const existing = Object.keys(headers).find((k) => k.toLowerCase() === headerKey);
+  if (existing !== undefined) {
+    return headers;
+  }
+  return { ...headers, [headerKey]: attachedValue };
+}
+
+function hasCookieName(cookieHeader: string, name: string): boolean {
+  return cookieHeader
+    .split(';')
+    .map((pair) => pair.trim().split('=')[0])
+    .some((cookieName) => cookieName === name);
+}
+
+/**
+ * Extracts a captured credential value from a login response.
+ * Pure with respect to its inputs (no I/O of its own) — the caller performs
+ * the actual fetch and passes in the response-like object.
+ */
+export async function captureCredential(
+  res: { headers: Headers; json: () => Promise<any> },
+  capture: LoginCapture,
+): Promise<string | null> {
+  if (capture.from === 'set-cookie') {
+    const single = res.headers.get('set-cookie');
+    const lines = res.headers.getSetCookie?.() ?? (single ? [single] : []);
+    if (lines.length === 0) {
+      return null;
+    }
+
+    if (!capture.cookieName) {
+      const firstPair = lines[0]?.split(';')[0]?.trim();
+      return firstPair || null;
+    }
+
+    for (const line of lines) {
+      const firstPair = line.split(';')[0]?.trim();
+      if (!firstPair) {
+        continue;
+      }
+      const [cookieName, ...rest] = firstPair.split('=');
+      if (cookieName === capture.cookieName) {
+        return rest.join('=');
+      }
+    }
+    return null;
+  }
+
+  if (capture.from === 'json') {
+    const body = await res.json();
+    return readDotPath(body, capture.path);
+  }
+
+  return res.headers.get(capture.name);
+}
+
+function readDotPath(body: unknown, path: string): string | null {
+  const segments = path.split('.');
+  let current: unknown = body;
+  for (const segment of segments) {
+    if (current === null || typeof current !== 'object') {
+      return null;
+    }
+    current = (current as Record<string, unknown>)[segment];
+  }
+  if (current === undefined || current === null) {
+    return null;
+  }
+  return String(current);
+}