alepha 0.14.2 → 0.14.4

package/src/server/security/__tests__/ServerSecurityProvider-realm.spec.ts

@@ -0,0 +1,388 @@
+import { randomUUID } from "node:crypto";
+import { Alepha } from "alepha";
+import { $realm } from "alepha/security";
+import { $action, $route, ForbiddenError, ServerProvider } from "alepha/server";
+import { describe, expect, it } from "vitest";
+import { AlephaServerSecurity } from "../index.ts";
+
+describe("ServerSecurityProvider - Realm Protection", () => {
+  it("should allow access when user belongs to the required realm", async () => {
+    class TestApp {
+      realmA = $realm({
+        secret: "test-realm-a",
+        roles: [
+          {
+            name: "user",
+            permissions: [{ name: "*" }],
+          },
+        ],
+      });
+
+      realmB = $realm({
+        secret: "test-realm-b",
+        roles: [
+          {
+            name: "user",
+            permissions: [{ name: "*" }],
+          },
+        ],
+      });
+
+      // Action that requires realmA
+      actionA = $action({
+        secure: { realm: "realmA" },
+        handler: () => "REALM_A",
+      });
+
+      // Route that requires realmB
+      routeB = $route({
+        method: "GET",
+        path: "/realm-b",
+        secure: { realm: "realmB" },
+        handler: () => "REALM_B",
+      });
+    }
+
+    const alepha = Alepha.create().with(AlephaServerSecurity);
+    const app = alepha.inject(TestApp);
+    await alepha.start();
+
+    const userA = {
+      id: randomUUID(),
+      roles: ["user"],
+      realm: "realmA",
+      name: "Test User A",
+    };
+
+    const userB = {
+      id: randomUUID(),
+      roles: ["user"],
+      realm: "realmB",
+      name: "Test User B",
+    };
+
+    // User from realmA should access actionA via .run()
+    expect(await app.actionA.run({}, { user: userA })).toBe("REALM_A");
+
+    // User from realmA should access actionA via .fetch()
+    expect(
+      await app.actionA.fetch({}, { user: userA }).then((it) => it.data),
+    ).toBe("REALM_A");
+
+    // User from realmB should access routeB via .run()
+    const tokenB = await app.realmB.createToken(userB);
+    const responseB = await fetch(
+      `${alepha.inject(ServerProvider).hostname}/realm-b`,
+      {
+        headers: {
+          authorization: `Bearer ${tokenB.access_token}`,
+        },
+      },
+    );
+
+    expect(await responseB.text()).toBe("REALM_B");
+  });
+
+  it("should deny access when user does not belong to the required realm", async () => {
+    class TestApp {
+      realmA = $realm({
+        secret: "test-realm-a",
+        roles: [
+          {
+            name: "user",
+            permissions: [{ name: "*" }],
+          },
+        ],
+      });
+
+      realmB = $realm({
+        secret: "test-realm-b",
+        roles: [
+          {
+            name: "user",
+            permissions: [{ name: "*" }],
+          },
+        ],
+      });
+
+      // Action that requires realmA
+      actionA = $action({
+        secure: { realm: "realmA" },
+        handler: () => "REALM_A",
+      });
+
+      // Route that requires realmB
+      routeB = $route({
+        method: "GET",
+        path: "/realm-b",
+        secure: { realm: "realmB" },
+        handler: () => "REALM_B",
+      });
+    }
+
+    const alepha = Alepha.create().with(AlephaServerSecurity);
+    const app = alepha.inject(TestApp);
+    await alepha.start();
+
+    const userA = {
+      id: randomUUID(),
+      roles: ["user"],
+      realm: "realmA",
+      name: "Test User A",
+    };
+
+    const userB = {
+      id: randomUUID(),
+      roles: ["user"],
+      realm: "realmB",
+      name: "Test User B",
+    };
+
+    // User from realmB should NOT access actionA via .run()
+    await expect(app.actionA.run({}, { user: userB })).rejects.toThrowError(
+      ForbiddenError,
+    );
+
+    // User from realmB should NOT access actionA via .fetch()
+    await expect(app.actionA.fetch({}, { user: userB })).rejects.toThrowError(
+      "User must belong to realm 'realmA' to access this route",
+    );
+
+    // User from realmA should NOT access routeB via HTTP (requires realmB)
+    const tokenA = await app.realmA.createToken(userA);
+
+    const responseB = await fetch(
+      `${alepha.inject(ServerProvider).hostname}/realm-b`,
+      {
+        headers: {
+          authorization: `Bearer ${tokenA.access_token}`,
+        },
+      },
+    );
+
+    expect(responseB.status).toBe(403);
+    const errorData = await responseB.json();
+    expect(errorData).toEqual({
+      error: "ForbiddenError",
+      message: "User must belong to realm 'realmB' to access this route",
+      status: 403,
+      requestId: expect.any(String),
+    });
+  });
+
+  it("should work with actions when user has no realm attribute", async () => {
+    class TestApp {
+      realmA = $realm({
+        secret: "test-realm-a",
+        roles: [
+          {
+            name: "user",
+            permissions: [{ name: "*" }],
+          },
+        ],
+      });
+
+      actionA = $action({
+        secure: { realm: "realmA" },
+        handler: () => "REALM_A",
+      });
+    }
+
+    const alepha = Alepha.create().with(AlephaServerSecurity);
+    const app = alepha.inject(TestApp);
+    await alepha.start();
+
+    const userWithoutRealm = {
+      id: randomUUID(),
+      roles: ["user"],
+      // no realm attribute
+    };
+
+    // User without realm attribute should be denied via .run()
+    await expect(
+      app.actionA.run({}, { user: userWithoutRealm }),
+    ).rejects.toThrowError(ForbiddenError);
+
+    // Note: .fetch() in test mode auto-assigns the first realm during token creation,
+    // so a user without a realm will succeed if the first realm matches the required realm.
+    // This is expected test helper behavior for convenience.
+    expect(
+      await app.actionA
+        .fetch({}, { user: userWithoutRealm })
+        .then((it) => it.data),
+    ).toBe("REALM_A");
+  });
+
+  it("should combine realm and permission checks", async () => {
+    class TestApp {
+      realmA = $realm({
+        secret: "test-realm-a",
+        roles: [
+          {
+            name: "admin",
+            permissions: [{ name: "*" }],
+          },
+          {
+            name: "user",
+            permissions: [{ name: "read:*" }],
+          },
+        ],
+      });
+
+      realmB = $realm({
+        secret: "test-realm-b",
+      });
+
+      // Requires both realmA and admin permission
+      adminAction = $action({
+        group: "admin",
+        secure: { realm: "realmA" },
+        handler: () => "ADMIN",
+      });
+
+      // Requires both realmA and read permission
+      readAction = $action({
+        group: "read",
+        secure: { realm: "realmA" },
+        handler: () => "READ",
+      });
+    }
+
+    const alepha = Alepha.create().with(AlephaServerSecurity);
+    const app = alepha.inject(TestApp);
+    await alepha.start();
+
+    const adminUserRealmA = {
+      id: randomUUID(),
+      roles: ["admin"],
+      realm: "realmA",
+      name: "Admin User",
+    };
+
+    const regularUserRealmA = {
+      id: randomUUID(),
+      roles: ["user"],
+      realm: "realmA",
+      name: "Regular User",
+    };
+
+    const adminUserRealmB = {
+      id: randomUUID(),
+      roles: ["admin"],
+      realm: "realmB",
+      name: "Admin User B",
+    };
+
+    // Admin from realmA should access both actions via .run()
+    expect(await app.adminAction.run({}, { user: adminUserRealmA })).toBe(
+      "ADMIN",
+    );
+    expect(await app.readAction.run({}, { user: adminUserRealmA })).toBe(
+      "READ",
+    );
+
+    // Admin from realmA should access both actions via .fetch()
+    expect(
+      await app.adminAction
+        .fetch({}, { user: adminUserRealmA })
+        .then((it) => it.data),
+    ).toBe("ADMIN");
+    expect(
+      await app.readAction
+        .fetch({}, { user: adminUserRealmA })
+        .then((it) => it.data),
+    ).toBe("READ");
+
+    // Regular user from realmA can access both actions via .run() (realm check only, no permission check)
+    // When secure: { realm: "..." } is used, permissions are not enforced
+    expect(await app.adminAction.run({}, { user: regularUserRealmA })).toBe(
+      "ADMIN",
+    );
+    expect(await app.readAction.run({}, { user: regularUserRealmA })).toBe(
+      "READ",
+    );
+
+    // Regular user from realmA can access both actions via .fetch()
+    expect(
+      await app.adminAction
+        .fetch({}, { user: regularUserRealmA })
+        .then((it) => it.data),
+    ).toBe("ADMIN");
+    expect(
+      await app.readAction
+        .fetch({}, { user: regularUserRealmA })
+        .then((it) => it.data),
+    ).toBe("READ");
+
+    // Admin from realmB should NOT access any action via .run() (wrong realm)
+    await expect(
+      app.adminAction.run({}, { user: adminUserRealmB }),
+    ).rejects.toThrowError(ForbiddenError);
+    await expect(
+      app.readAction.run({}, { user: adminUserRealmB }),
+    ).rejects.toThrowError(ForbiddenError);
+
+    await expect(
+      app.adminAction.fetch({}, { user: adminUserRealmB }),
+    ).rejects.toThrowError(
+      "User must belong to realm 'realmA' to access this route",
+    );
+    await expect(
+      app.readAction.fetch({}, { user: adminUserRealmB }),
+    ).rejects.toThrowError(
+      "User must belong to realm 'realmA' to access this route",
+    );
+  });
+
+  it("should work with fetch requests when realm is valid", async () => {
+    class TestApp {
+      realmA = $realm({
+        secret: "test-realm-a",
+        roles: [
+          {
+            name: "user",
+            permissions: [{ name: "*" }],
+          },
+        ],
+      });
+
+      actionA = $action({
+        secure: { realm: "realmA" },
+        handler: () => "SUCCESS",
+      });
+    }
+
+    const alepha = Alepha.create().with(AlephaServerSecurity);
+    const app = alepha.inject(TestApp);
+    await alepha.start();
+
+    const user = {
+      id: randomUUID(),
+      roles: ["user"],
+      realm: "realmA",
+      name: "Test User",
+    };
+
+    // Should work via .run()
+    expect(await app.actionA.run({}, { user })).toBe("SUCCESS");
+
+    // Should work via .fetch()
+    expect(await app.actionA.fetch({}, { user }).then((it) => it.data)).toBe(
+      "SUCCESS",
+    );
+
+    // Should work via HTTP with token
+    const token = await app.realmA.createToken(user);
+    const response = await fetch(
+      `${alepha.inject(ServerProvider).hostname}${app.actionA.route.path}`,
+      {
+        headers: {
+          authorization: `Bearer ${token.access_token}`,
+        },
+      },
+    );
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe("SUCCESS");
+  });
+});

package/src/server/security/providers/ServerSecurityProvider.spec.ts

@@ -0,0 +1,123 @@
+import { randomUUID } from "node:crypto";
+import { Alepha } from "alepha";
+import { $realm } from "alepha/security";
+import {
+  $action,
+  ForbiddenError,
+  HttpError,
+  ServerProvider,
+  UnauthorizedError,
+} from "alepha/server";
+import { describe, expect, it } from "vitest";
+import { AlephaServerSecurity } from "../index.ts";
+
+describe("ServerSecurityProvider", () => {
+  it("should protect action from unauthorized users", async () => {
+    class TestApp {
+      ok = $action({
+        handler: () => "OK",
+      });
+    }
+
+    const alepha = Alepha.create().with(AlephaServerSecurity);
+    const app = alepha.inject(TestApp);
+    await alepha.start();
+
+    // in testing environment, .run() a dummy user is created
+    expect(await app.ok.run({})).toBe("OK");
+
+    // but you can force empty user
+    await expect(app.ok.run({}, { user: undefined })).rejects.toThrowError(
+      UnauthorizedError,
+    );
+
+    // .fetch() will also generates a dummy user in testing environment
+    expect(await app.ok.fetch({}).then((it) => it.data)).toBe("OK");
+
+    // but you can also force empty user
+    await expect(app.ok.fetch({}, { user: undefined })).rejects.toThrowError(
+      HttpError,
+    );
+
+    // regular fetch does not trigger helpers
+    expect(
+      await fetch(
+        `${alepha.inject(ServerProvider).hostname}${app.ok.route.path}`,
+      ).then((it) => it.json()),
+    ).toEqual({
+      error: "UnauthorizedError",
+      message: "Invalid authorization header, maybe token is missing ?",
+      status: 401,
+      requestId: expect.any(String),
+    });
+  });
+
+  it("should guard by permission", async () => {
+    class TestApp {
+      admin = $action({
+        group: "read",
+        handler: () => "ADMIN",
+      });
+      user = $action({
+        group: "read",
+        handler: () => "USER",
+      });
+      realm = $realm({
+        secret: "test",
+        roles: [
+          {
+            name: "admin",
+            permissions: [{ name: "*" }],
+          },
+          {
+            name: "user",
+            permissions: [{ name: "read:user" }],
+          },
+        ],
+      });
+    }
+
+    const alepha = Alepha.create().with(AlephaServerSecurity);
+    const app = alepha.inject(TestApp);
+    await alepha.start();
+
+    const user = {
+      id: randomUUID(),
+      roles: ["user"],
+    };
+    const admin = {
+      id: randomUUID(),
+      roles: ["admin"],
+    };
+
+    // as user, you can access user action
+    expect(await app.user.run({}, { user })).toBe("USER");
+    expect(await app.user.fetch({}, { user }).then((it) => it.data)).toBe(
+      "USER",
+    );
+
+    // as admin, you can access user action too
+    expect(await app.user.run({}, { user: admin })).toBe("USER");
+    expect(
+      await app.user.fetch({}, { user: admin }).then((it) => it.data),
+    ).toBe("USER");
+
+    // as user, you cannot access admin action
+    await expect(app.admin.run({}, { user })).rejects.toThrowError(
+      ForbiddenError,
+    );
+    await expect(app.admin.fetch({}, { user })).rejects.toThrowError(
+      new HttpError({
+        status: 403,
+        message: "User is not allowed to access 'read:admin'",
+        requestId: expect.any(String),
+      }),
+    );
+
+    // as admin, you can access admin action
+    expect(await app.admin.run({}, { user: admin })).toBe("ADMIN");
+    expect(
+      await app.admin.fetch({}, { user: admin }).then((it) => it.data),
+    ).toBe("ADMIN");
+  });
+});

package/src/server/static/primitives/$serve.spec.ts

@@ -0,0 +1,193 @@
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { brotliCompressSync, gzipSync } from "node:zlib";
+import { Alepha } from "alepha";
+import { AlephaServer, ServerProvider } from "alepha/server";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import {
+  $serve,
+  AlephaServerStatic,
+  type ServePrimitiveOptions,
+} from "../index.ts";
+
+// --- Test Setup: Create a temporary directory for static files ---
+
+const tempTestDir = join(tmpdir(), `alepha-static-test-${Date.now()}`);
+const tempWeirdFileName = "weird file 02020&&&&&éééé";
+
+beforeAll(async () => {
+  await mkdir(tempTestDir, { recursive: true });
+
+  // Create some test files
+  await writeFile(join(tempTestDir, "index.html"), "<h1>Hello World</h1>");
+  await writeFile(join(tempTestDir, "style.css"), "body { color: red; }");
+  await writeFile(join(tempTestDir, "script.js"), "console.log('test');");
+  await writeFile(join(tempTestDir, ".secret"), "should-not-be-served");
+  await writeFile(join(tempTestDir, tempWeirdFileName), "ok");
+
+  // Create pre-compressed versions
+  const cssContent = "body { color: blue; }";
+  await writeFile(join(tempTestDir, "compressed.css"), cssContent);
+  await writeFile(join(tempTestDir, "compressed.css.gz"), gzipSync(cssContent));
+  await writeFile(
+    join(tempTestDir, "compressed.css.br"),
+    brotliCompressSync(cssContent),
+  );
+});
+
+afterAll(async () => {
+  // Clean up the temporary directory
+  await rm(tempTestDir, { recursive: true, force: true });
+});
+
+// --- Test Suite ---
+
+describe("alepha/server/static", () => {
+  const setupServer = async (serveOptions: ServePrimitiveOptions) => {
+    class TestApp {
+      staticContent = $serve({ root: tempTestDir, ...serveOptions });
+    }
+
+    const alepha = Alepha.create({ env: { LOG_LEVEL: "error" } })
+      .with(AlephaServer)
+      .with(AlephaServerStatic)
+      .with(TestApp);
+
+    await alepha.start();
+    const server = alepha.inject(ServerProvider);
+
+    return {
+      hostname: server.hostname,
+    };
+  };
+
+  test("should serve a basic static file with correct content-type", async () => {
+    const { hostname } = await setupServer({});
+
+    const response = await fetch(`${hostname}/style.css`);
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toBe("text/css");
+    expect(await response.text()).toBe("body { color: red; }");
+  });
+
+  test("should serve a file with invalid character", async () => {
+    const { hostname } = await setupServer({});
+    const r1 = await fetch(`${hostname}/${tempWeirdFileName}`);
+    expect(r1.status).toBe(200);
+    expect(await r1.text()).toBe("ok");
+
+    const r2 = await fetch(`${hostname}/${encodeURI(tempWeirdFileName)}`);
+    expect(r2.status).toBe(200);
+    expect(await r2.text()).toBe("ok");
+  });
+
+  test("should serve index.html for root path", async () => {
+    const { hostname } = await setupServer({});
+
+    const response = await fetch(`${hostname}/`);
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toBe("text/html");
+    expect(await response.text()).toBe("<h1>Hello World</h1>");
+  });
+
+  test("should handle ETag and Last-Modified headers for caching", async () => {
+    const { hostname } = await setupServer({});
+
+    const initialResponse = await fetch(`${hostname}/script.js`);
+    const etag = initialResponse.headers.get("etag");
+    const lastModified = initialResponse.headers.get("last-modified");
+
+    expect(etag).toBeDefined();
+    expect(lastModified).toBeDefined();
+
+    // Second request with caching headers
+    const cachedResponse = await fetch(`${hostname}/script.js`, {
+      headers: {
+        "if-none-match": etag!,
+        "if-modified-since": lastModified!,
+      },
+    });
+
+    expect(cachedResponse.status).toBe(304); // Not Modified
+    expect(await cachedResponse.text()).toBe(""); // Body should be empty
+  });
+
+  test("should serve pre-compressed .gz file if accepted", async () => {
+    const { hostname } = await setupServer({});
+
+    const response = await fetch(`${hostname}/compressed.css`, {
+      headers: { "Accept-Encoding": "gzip, deflate, br" },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-encoding")).toBe("br");
+    expect(response.headers.get("content-type")).toBe("text/css");
+    // The fetched content will be automatically decompressed by fetch
+    expect(await response.text()).toBe("body { color: blue; }");
+  });
+
+  test("should serve pre-compressed .br file if accepted and preferred", async () => {
+    const { hostname } = await setupServer({});
+
+    // Brotli is generally preferred by servers if available
+    const response = await fetch(`${hostname}/compressed.css`, {
+      headers: { "Accept-Encoding": "br, gzip" },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-encoding")).toBe("br");
+    expect(await response.text()).toBe("body { color: blue; }");
+  });
+
+  test("should not serve dotfiles by default", async () => {
+    const { hostname } = await setupServer({});
+
+    const response = await fetch(`${hostname}/.secret`);
+    expect(response.status).toBe(404);
+  });
+
+  test("should serve dotfiles if ignoreDotEnvFiles is false", async () => {
+    const { hostname } = await setupServer({ ignoreDotEnvFiles: false });
+
+    const response = await fetch(`${hostname}/.secret`);
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe("should-not-be-served");
+  });
+
+  test("should use historyApiFallback for SPA routing", async () => {
+    const { hostname } = await setupServer({ historyApiFallback: true });
+
+    // A path that doesn't correspond to a real file
+    const response = await fetch(`${hostname}/some/deep/spa/route`);
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toBe("text/html");
+    expect(await response.text()).toBe("<h1>Hello World</h1>");
+
+    // Should still not fallback for paths that look like files
+    const fileResponse = await fetch(`${hostname}/non-existent/style.css`);
+    expect(fileResponse.status).toBe(404);
+  });
+
+  test("should apply Cache-Control headers for configured file types", async () => {
+    const { hostname } = await setupServer({
+      cacheControl: {
+        fileTypes: [".css"],
+        maxAge: [1, "day"],
+        immutable: true,
+      },
+    });
+
+    const cssResponse = await fetch(`${hostname}/style.css`);
+    expect(cssResponse.headers.get("cache-control")).toBe(
+      "public, max-age=86400, immutable",
+    );
+
+    // JS file should not have the header
+    const jsResponse = await fetch(`${hostname}/script.js`);
+    expect(jsResponse.headers.get("cache-control")).toBeNull();
+  });
+});