alepha 0.14.2 → 0.14.3

package/src/server/compress/providers/ServerCompressProvider.spec.ts

@@ -0,0 +1,31 @@
+import { Alepha } from "alepha";
+import { $action, ServerProvider } from "alepha/server";
+import { describe, it } from "vitest";
+import { AlephaServerCompress } from "../index.ts";
+
+class App {
+  hello = $action({
+    handler: () => "Hello, world!",
+  });
+}
+
+const a1 = Alepha.create().with(App).with(AlephaServerCompress);
+const a2 = Alepha.create().with(App);
+
+describe("ServerCompressProvider", () => {
+  it("should compress responses when enabled", async ({ expect }) => {
+    const serv1 = a1.inject(ServerProvider);
+    const serv2 = a2.inject(ServerProvider);
+
+    const resp1 = await fetch(`${serv1.hostname}/api/hello`, {
+      headers: { "Accept-Encoding": "gzip" },
+    });
+
+    const resp2 = await fetch(`${serv2.hostname}/api/hello`, {
+      headers: { "Accept-Encoding": "gzip" },
+    });
+
+    expect(resp1.headers.get("content-encoding")).toBe("gzip");
+    expect(resp2.headers.get("content-encoding")).toBeNull();
+  });
+});

package/src/server/compress/providers/ServerCompressProvider.ts

@@ -125,11 +125,13 @@ export class ServerCompressProvider {
       this.setHeaders(response, encoding);
       response.headers["content-length"] = compressed.length.toString();
       response.body = compressed;
+      return;
     }
 
     if (typeof body === "object" && body instanceof Readable) {
       this.setHeaders(response, encoding);
       response.body = body.pipe(compressor.stream({ params }));
+      return;
     }
 
     if (typeof body === "object" && body instanceof ReadableStream) {

package/src/server/cookies/providers/ServerCookiesProvider.spec.ts

@@ -0,0 +1,253 @@
+import { Alepha, t } from "alepha";
+import { $action, AlephaServer } from "alepha/server";
+import { describe, expect, test } from "vitest";
+import { $cookie, AlephaServerCookies } from "../index.ts";
+
+// A strong, 32-character secret for testing purposes
+const TEST_COOKIE_SECRET = "DCf6DvpLAfwy8XdPRucMO4tPS6dVCHob";
+
+// --- Test Application Setup ---
+
+class CookieTestApp {
+  // 1. Basic Cookie
+  session = $cookie({
+    name: "session",
+    schema: t.object({ userId: t.number(), role: t.text() }),
+  });
+
+  // 2. Signed Cookie
+  signed = $cookie({
+    name: "signed_session",
+    schema: t.text(),
+    sign: true,
+  });
+
+  // 3. Encrypted Cookie
+  encrypted = $cookie({
+    name: "encrypted_secret",
+    schema: t.object({ apiKey: t.text() }),
+    encrypt: true,
+  });
+
+  // 4. Compressed, Signed, and Encrypted Cookie with TTL
+  secure_all = $cookie({
+    name: "ultra_secure",
+    schema: t.object({ data: t.text() }),
+    compress: true,
+    sign: true,
+    encrypt: true,
+    ttl: [1, "hour"],
+  });
+
+  // An action to test the cookie functionality in a request cycle
+  cookie_test = $action({
+    schema: {
+      response: t.object({
+        incomingSession: t.optional(this.session.options.schema),
+        reqCookies: t.object({
+          req: t.record(t.text(), t.text()),
+          res: t.record(t.text(), t.any()),
+        }),
+      }),
+    },
+    handler: ({ cookies }) => {
+      // Set some cookies
+      this.session.set({ userId: 123, role: "admin" });
+      this.signed.set("i-am-signed");
+      this.encrypted.set({ apiKey: "secret-key" });
+      this.secure_all.set({ data: "super sensitive data" });
+
+      // Read a cookie from the request
+      const incomingSession = this.session.get({ cookies });
+
+      // Delete a cookie
+      if (incomingSession?.role === "guest") {
+        this.signed.del();
+      }
+
+      return { incomingSession, reqCookies: cookies };
+    },
+  });
+}
+
+const alepha = Alepha.create({
+  env: {
+    COOKIE_SECRET: TEST_COOKIE_SECRET,
+  },
+})
+  .with(AlephaServer)
+  .with(AlephaServerCookies);
+
+const app = alepha.inject(CookieTestApp);
+
+// Helper to simulate a request and capture the response headers
+const makeRequest = async (incomingCookieHeader = "") => {
+  const response = await app.cookie_test.fetch(
+    {},
+    {
+      request: { headers: { cookie: incomingCookieHeader } },
+    },
+  );
+  return {
+    data: response.data,
+    // The fetch client in tests might not handle multiple headers the same way a browser does.
+    // We get the raw header to properly check it.
+    setCookieHeader: response.raw?.headers.get("set-cookie"),
+  };
+};
+
+describe("ServerCookiesProvider", () => {
+  test("should set and get a basic cookie", async () => {
+    const { data, setCookieHeader } = await makeRequest();
+
+    // The handler receives no initial cookie
+    expect(data.incomingSession).toBeUndefined();
+
+    // Check if the response sets the cookie correctly
+    expect(setCookieHeader).toBeDefined();
+    const decodedValue = JSON.parse(
+      decodeURIComponent(setCookieHeader!.match(/session=([^;]*)/)![1]),
+    );
+    expect(decodedValue).toEqual({ userId: 123, role: "admin" });
+  });
+
+  test("should correctly read an incoming cookie", async () => {
+    const sessionData = { userId: 456, role: "user" };
+    const cookieHeader = `session=${encodeURIComponent(JSON.stringify(sessionData))}`;
+
+    const { data } = await makeRequest(cookieHeader);
+
+    // The handler should have received and parsed the cookie
+    expect(data.incomingSession).toEqual(sessionData);
+  });
+
+  test("should set and get a signed cookie", async () => {
+    const { setCookieHeader } = await makeRequest();
+    const signedCookie = setCookieHeader!.match(/signed_session=([^;]*)/)![1];
+
+    // Make a new request with the signed cookie
+    const { data } = await makeRequest(`signed_session=${signedCookie}`);
+
+    // The `get` method should successfully validate the signature and return the value
+    expect(app.signed.get({ cookies: data.reqCookies })).toBe("i-am-signed");
+  });
+
+  test("should reject a tampered signed cookie", async () => {
+    const { setCookieHeader } = await makeRequest();
+    let tamperedCookie = setCookieHeader!.match(/signed_session=([^;]*)/)![1];
+    tamperedCookie += "tampered"; // alter the cookie value
+
+    const { data } = await makeRequest(`signed_session=${tamperedCookie}`);
+
+    // The get should fail and return undefined
+    expect(app.signed.get({ cookies: data.reqCookies })).toBeUndefined();
+  });
+
+  test("should set and get an encrypted cookie", async () => {
+    const { setCookieHeader } = await makeRequest();
+    const encryptedCookie = setCookieHeader!.match(
+      /encrypted_secret=([^;]*)/,
+    )![1];
+
+    // The value should not be plain text
+    expect(decodeURIComponent(encryptedCookie)).not.toContain("secret-key");
+
+    const { data } = await makeRequest(`encrypted_secret=${encryptedCookie}`);
+
+    expect(app.encrypted.get({ cookies: data.reqCookies })).toEqual({
+      apiKey: "secret-key",
+    });
+  });
+
+  test("should reject a tampered encrypted cookie", async () => {
+    const { setCookieHeader } = await makeRequest();
+    const tamperedCookie = setCookieHeader!.match(
+      /encrypted_secret=([^;]*)/,
+    )![1];
+
+    const { data } = await makeRequest(
+      `encrypted_secret=aa${tamperedCookie}aa`,
+    );
+
+    // The get should fail (throw internally) and return undefined
+    expect(app.encrypted.get({ cookies: data.reqCookies })).toBeUndefined();
+  });
+
+  test("should handle a combination of compress, sign, and encrypt", async () => {
+    const { setCookieHeader } = await makeRequest();
+    const secureCookie = setCookieHeader!.match(/ultra_secure=([^;]*)/)![1];
+
+    const { data } = await makeRequest(`ultra_secure=${secureCookie}`);
+
+    expect(app.secure_all.get({ cookies: data.reqCookies })).toEqual({
+      data: "super sensitive data",
+    });
+  });
+
+  test("should delete a cookie", async () => {
+    const sessionData = { userId: 789, role: "guest" };
+    const cookieHeader = `session=${encodeURIComponent(JSON.stringify(sessionData))}`;
+
+    const { setCookieHeader } = await makeRequest(cookieHeader);
+
+    // The handler should detect role === 'guest' and delete the signed cookie
+    expect(setCookieHeader).toContain("signed_session=; Path=/; Max-Age=0");
+  });
+
+  test("should serialize all cookie attributes correctly", async () => {
+    class AttrApp {
+      advanced = $cookie({
+        name: "advanced",
+        schema: t.text(),
+        path: "/admin",
+        ttl: [30, "minutes"],
+        httpOnly: true,
+        secure: true,
+        sameSite: "strict",
+        domain: "example.com",
+      });
+      test = $action({
+        handler: () => {
+          this.advanced.set("value");
+        },
+      });
+    }
+
+    const attrAlepha = Alepha.create({
+      env: { COOKIE_SECRET: TEST_COOKIE_SECRET },
+    })
+      .with(AlephaServer)
+      .with(AlephaServerCookies)
+      .with(AttrApp);
+
+    await attrAlepha.start();
+
+    const response = await attrAlepha.inject(AttrApp).test.fetch();
+    const setCookieHeader = response.headers.get("set-cookie");
+    expect(setCookieHeader).toContain("Max-Age=1800");
+    expect(setCookieHeader).toContain("Path=/admin");
+    expect(setCookieHeader).toContain("HttpOnly");
+    expect(setCookieHeader).toContain("SameSite=strict");
+    expect(setCookieHeader).toContain("Domain=example.com");
+    // Secure flag is not added in tests unless protocol is https, which is handled by the provider
+  });
+
+  // test("should throw if secret is missing for secure cookies", async () => {
+  // 	class AppWithMissingSecret {
+  // 		badCookie = $cookie({
+  // 			name: "bad",
+  // 			schema: t.text(),
+  // 			sign: true,
+  // 		});
+  // 	}
+  //
+  // 	const alephaWithoutSecret = Alepha.create()
+  // 		.with(AlephaServer)
+  // 		.with(AlephaServerCookies)
+  // 		.with(AppWithMissingSecret);
+  //
+  // 	await expect(() => alephaWithoutSecret.start()).rejects.toThrow(
+  // 		/COOKIE_SECRET environment variable is not set/,
+  // 	);
+  // });
+});

package/src/server/core/__tests__/ServerRouterProvider-getRoutes.spec.ts

@@ -0,0 +1,334 @@
+import { Alepha, t } from "alepha";
+import { describe, it } from "vitest";
+import { $action, $route, ServerRouterProvider } from "../index.ts";
+
+describe("ServerRouterProvider - getRoutes", () => {
+  it("should return all routes when no pattern is provided", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      action1 = $action({
+        path: "/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      action2 = $action({
+        path: "/posts",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      route1 = $route({
+        path: "/health",
+        handler: () => "OK",
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+    const routes = routerProvider.getRoutes();
+
+    expect(routes.length).toBeGreaterThanOrEqual(3);
+  });
+
+  it("should return routes matching wildcard pattern", async ({ expect }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      users = $action({
+        path: "/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      userDetail = $action({
+        path: "/users/:id",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      posts = $action({
+        path: "/posts",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      health = $route({
+        path: "/health",
+        handler: () => "OK",
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+    const routes = routerProvider.getRoutes("/api/*");
+
+    // Should include the actions under /api/*
+    const paths = routes.map((r) => r.path);
+    expect(paths.length).toBeGreaterThanOrEqual(3);
+    expect(paths.some((p) => p.includes("/users"))).toBe(true);
+    expect(paths.some((p) => p.includes("/posts"))).toBe(true);
+    // health route should not match /api/*
+    expect(paths.some((p) => p === "/GET/health")).toBe(false);
+  });
+
+  it("should return empty array when pattern doesn't match any routes", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      users = $action({
+        path: "/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      posts = $action({
+        path: "/posts",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+    const routes = routerProvider.getRoutes("/v2/*");
+
+    expect(routes).toHaveLength(0);
+  });
+
+  it("should return empty array when exact pattern doesn't match", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      users = $action({
+        path: "/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+    const routes = routerProvider.getRoutes("/admin");
+
+    expect(routes).toHaveLength(0);
+  });
+
+  it("should differentiate between exact match and wildcard match patterns", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      apiInfo = $action({
+        path: "/api-info",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      apiUsers = $action({
+        path: "/api-users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      settings = $route({
+        path: "/settings",
+        handler: () => "OK",
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+
+    // Wildcard pattern matches multiple routes
+    const wildcardRoutes = routerProvider.getRoutes("/api/*");
+    expect(wildcardRoutes.length).toBeGreaterThan(0);
+  });
+
+  it("should return multiple routes for deep nested paths", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      level1 = $action({
+        path: "/v1/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      level2 = $action({
+        path: "/v1/users/:id/posts",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      level3 = $action({
+        path: "/v1/users/:id/posts/:postId/comments",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      v2 = $action({
+        path: "/v2/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+    const routes = routerProvider.getRoutes("/api/*");
+
+    // Should find nested routes under /api/*
+    expect(routes.length).toBeGreaterThanOrEqual(2);
+    const paths = routes.map((r) => r.path);
+    expect(paths.some((p) => p.includes("v1"))).toBe(true);
+    expect(paths.some((p) => p.includes("v2"))).toBe(true);
+  });
+
+  it("should match all routes with root wildcard pattern", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      health = $route({
+        path: "/health",
+        schema: { response: t.object({ status: t.string() }) },
+        handler: () => ({ status: "ok" }),
+      });
+
+      about = $route({
+        path: "/about",
+        schema: { response: t.object({ name: t.string() }) },
+        handler: () => ({ name: "app" }),
+      });
+
+      users = $action({
+        path: "/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+    const routes = routerProvider.getRoutes("/*");
+
+    expect(routes.length).toBeGreaterThanOrEqual(3);
+  });
+
+  it("should correctly filter by path prefix", async ({ expect }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      publicApi = $action({
+        path: "/public/info",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      adminApi = $action({
+        path: "/admin/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      privateRoute = $route({
+        path: "/private",
+        handler: () => "private",
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+
+    // Get routes matching /api/* pattern
+    const apiRoutes = routerProvider.getRoutes("/api/*");
+    expect(apiRoutes.length).toBeGreaterThan(0);
+
+    // Get routes matching a specific non-api pattern
+    const privateRoutes = routerProvider.getRoutes("/private");
+    expect(privateRoutes.length).toBeGreaterThanOrEqual(0);
+  });
+
+  it("should handle routes with method-specific paths", async ({ expect }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      getUsers = $action({
+        method: "GET",
+        path: "/users",
+        schema: { response: t.array(t.object({ id: t.integer() })) },
+        handler: () => [],
+      });
+
+      createUser = $action({
+        method: "POST",
+        path: "/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      updateUser = $action({
+        method: "PATCH",
+        path: "/users/:id",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+    const routes = routerProvider.getRoutes("/api/*");
+
+    // Should return routes with different HTTP methods for /users path
+    expect(routes.length).toBeGreaterThanOrEqual(2);
+    const paths = routes.map((r) => r.path);
+    expect(paths.some((p) => p.includes("/users"))).toBe(true);
+  });
+
+  it("should be case-sensitive for path matching", async ({ expect }) => {
+    const alepha = Alepha.create();
+
+    class TestApp {
+      users = $action({
+        path: "/users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+
+      users2 = $action({
+        path: "/Users",
+        schema: { response: t.object({ id: t.integer() }) },
+        handler: () => ({ id: 1 }),
+      });
+    }
+
+    await alepha.with(TestApp).start();
+
+    const routerProvider = alepha.inject(ServerRouterProvider);
+    const allRoutes = routerProvider.getRoutes();
+
+    // Both routes should exist
+    expect(allRoutes.length).toBeGreaterThanOrEqual(2);
+  });
+});