backend-manager 5.9.4 → 5.9.6

package/test/routes/user/token.js

@@ -1,73 +0,0 @@
-/**
- * Test: POST /user/token
- * Tests the user create custom token endpoint
- * Requires user authentication (uses Api.resolveUser with adminRequired: true which means user must be authenticated)
- */
-module.exports = {
-  description: 'User create custom token',
-  type: 'group',
-  tests: [
-    // Test 1: Authenticated user can create custom token
-    {
-      name: 'authenticated-user-succeeds',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/user/token', {});
-
-        assert.isSuccess(response, 'Create custom token should succeed for authenticated user');
-        assert.hasProperty(response, 'data.token', 'Response should contain token');
-        assert.ok(
-          typeof response.data.token === 'string' && response.data.token.length > 0,
-          'Token should be a non-empty string'
-        );
-      },
-    },
-
-    // Test 2: Token has valid JWT format
-    {
-      name: 'token-is-valid-jwt',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/user/token', {});
-
-        assert.isSuccess(response, 'Create custom token should succeed');
-
-        // JWT tokens have 3 parts separated by dots
-        const parts = response.data.token.split('.');
-        assert.equal(parts.length, 3, 'Token should be a valid JWT with 3 parts');
-      },
-    },
-
-    // Test 3: Premium user can create custom token
-    // Note: Admin via backendManagerKey can't create tokens without a UID since it's not a real user
-    {
-      name: 'premium-user-succeeds',
-      auth: 'premium-active',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/user/token', {});
-
-        assert.isSuccess(response, 'Create custom token should succeed for premium user');
-        assert.hasProperty(response, 'data.token', 'Response should contain token');
-      },
-    },
-
-    // Test 4: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.post('backend-manager/user/token', {});
-
-        assert.isError(response, 401, 'Create custom token should fail without authentication');
-      },
-    },
-  ],
-};

package/test/routes/user/user.js

@@ -1,157 +0,0 @@
-/**
- * Test: GET /user
- * Tests the user resolve endpoint
- * Returns user account info for authenticated users
- * Validates that User() correctly structures user data
- */
-const { getFirstPaidProduct } = require('../../../src/test/test-accounts.js');
-
-module.exports = {
-  description: 'User resolve (account info)',
-  type: 'group',
-  tests: [
-    // Test 1: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/user', {});
-
-        assert.isError(response, 401, 'Resolve should fail without authentication');
-      },
-    },
-
-    // Test 2: Basic user - verify resolved properties
-    {
-      name: 'basic-user-resolved-correctly',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert, accounts }) {
-        const response = await http.get('backend-manager/user', {});
-
-        assert.isSuccess(response, 'Resolve should succeed for basic user');
-
-        const user = response.data.user;
-
-        // Verify auth properties
-        assert.equal(user.auth.uid, accounts.basic.uid, 'UID should match test account');
-        assert.equal(user.auth.email, accounts.basic.email, 'Email should match test account');
-        assert.equal(user.authenticated, true, 'User should be authenticated');
-
-        // Verify subscription properties - basic user should have basic subscription
-        assert.equal(user.subscription.product.id, 'basic', 'Subscription ID should be basic');
-        assert.equal(user.subscription.status, 'active', 'Subscription status should be active');
-
-        // Verify roles - basic user has no special roles
-        assert.equal(user.roles.admin, false, 'Basic user should not be admin');
-
-        // Verify usage structure exists
-        assert.ok(user.usage !== undefined, 'Usage object should be present');
-        assert.ok(user.usage.requests !== undefined, 'Usage.requests should be present');
-      },
-    },
-
-    // Test 3: Real admin account (_test-admin) - verify admin role from Firestore
-    {
-      name: 'admin-account-resolved-correctly',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert, accounts }) {
-        // Authenticate with the real admin test account's privateKey
-        const response = await http.withPrivateKey(accounts.admin.privateKey).get('backend-manager/user', {});
-
-        assert.isSuccess(response, 'Resolve should succeed for admin account');
-
-        const user = response.data.user;
-
-        // Verify auth properties - should match the real admin account
-        assert.equal(user.auth.uid, accounts.admin.uid, 'UID should match admin test account');
-        assert.equal(user.auth.email, accounts.admin.email, 'Email should match admin test account');
-        assert.equal(user.authenticated, true, 'Should be authenticated');
-
-        // Verify roles - admin account has roles.admin = true in Firestore
-        assert.equal(user.roles.admin, true, 'Admin account should have admin role');
-
-        // Verify subscription - admin account is on basic subscription
-        assert.equal(user.subscription.product.id, 'basic', 'Admin subscription ID should be basic');
-      },
-    },
-
-    // Test 4: backendManagerKey only - shell account with admin role, no real user
-    {
-      name: 'backend-manager-key-shell-account',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert, accounts }) {
-        const response = await http.get('backend-manager/user', {});
-
-        assert.isSuccess(response, 'Resolve should succeed with backendManagerKey');
-
-        const user = response.data.user;
-
-        // Verify roles - backendManagerKey grants admin role
-        assert.equal(user.roles.admin, true, 'backendManagerKey should grant admin role');
-        assert.equal(user.authenticated, true, 'Should be authenticated');
-
-        // Should NOT have the real admin account's UID (it's a shell account)
-        assert.notEqual(user.auth.uid, accounts.admin.uid, 'Should not be the real admin account');
-      },
-    },
-
-    // Test 5: Premium active user - verify premium subscription is retained
-    {
-      name: 'premium-active-user-resolved-correctly',
-      auth: 'resolve-premium-active',
-      timeout: 15000,
-
-      async run({ http, assert, accounts, config }) {
-        const paidProduct = getFirstPaidProduct(config);
-        const response = await http.get('backend-manager/user', {});
-
-        assert.isSuccess(response, 'Resolve should succeed for premium user');
-
-        const user = response.data.user;
-
-        // Verify auth properties
-        assert.equal(user.auth.uid, accounts['resolve-premium-active'].uid, 'UID should match premium test account');
-
-        // Verify subscription - premium user should retain paid subscription
-        assert.equal(user.subscription.product.id, paidProduct.id, 'Subscription ID should match first paid product');
-        assert.equal(user.subscription.status, 'active', 'Subscription status should be active');
-
-        // Verify expires is in the future
-        const expiresTimestamp = user.subscription.expires?.timestampUNIX || 0;
-        const now = Math.floor(Date.now() / 1000);
-        assert.ok(expiresTimestamp > now, 'Premium subscription expires should be in the future');
-      },
-    },
-
-    // Test 6: Premium expired user - verify subscription retains product but shows cancelled status
-    {
-      name: 'premium-expired-user-cancelled',
-      auth: 'resolve-premium-expired',
-      timeout: 15000,
-
-      async run({ http, assert, accounts, config }) {
-        const paidProduct = getFirstPaidProduct(config);
-        const response = await http.get('backend-manager/user', {});
-
-        assert.isSuccess(response, 'Resolve should succeed for expired premium user');
-
-        const user = response.data.user;
-
-        // Verify auth properties
-        assert.equal(user.auth.uid, accounts['resolve-premium-expired'].uid, 'UID should match expired premium test account');
-
-        // Verify subscription - product.id stays as paid product, status reflects cancellation
-        assert.equal(user.subscription.product.id, paidProduct.id, 'Product ID should remain paid product');
-        assert.equal(user.subscription.status, 'cancelled', 'Status should be cancelled');
-      },
-    },
-  ],
-};

package/test/rules/notifications.js

@@ -1,410 +0,0 @@
-/**
- * Test: Firestore Security Rules - Notification Documents
- * Tests that security rules correctly protect notification data
- *
- * Rules being tested:
- * - Anyone can create a notification (for push subscription)
- * - User can read notification if they own it or know the token
- * - User can update notification if they know the token
- * - User cannot delete notifications
- * - Anonymous can read if document doesn't exist (for checking availability)
- *
- * @see templates/firestore.rules
- */
-module.exports = {
-  description: 'Firestore security rules for notification documents',
-  type: 'group',
-  timeout: 30000,
-
-  tests: [
-    // Test 1: Anyone can create a notification
-    {
-      name: 'anyone-can-create-notification',
-      auth: 'none',
-
-      async run({ rules }) {
-        const db = rules.asAnonymous();
-        const token = 'test-token-create-anon';
-
-        // Should succeed - anyone can create notifications
-        await rules.expectSuccess(
-          db.doc(`notifications/${token}`).set({
-            token: token,
-            owner: 'anonymous',
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-      },
-    },
-
-    // Test 2: Authenticated user can create a notification
-    {
-      name: 'user-can-create-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const uid = accounts.basic.uid;
-        const db = rules.asAccount('basic');
-        const token = 'test-token-create-user';
-
-        // Should succeed - user can create notifications
-        await rules.expectSuccess(
-          db.doc(`notifications/${token}`).set({
-            token: token,
-            owner: uid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-      },
-    },
-
-    // Test 3: User can read their own notification (by owner)
-    {
-      name: 'user-can-read-own-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const uid = accounts.basic.uid;
-        const db = rules.asAccount('basic');
-        const token = 'test-token-read-own';
-
-        // First create the notification as admin (to set up the test)
-        const adminDb = rules.asAccount('admin');
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: uid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should succeed - user can read notification they own
-        await rules.expectSuccess(
-          db.doc(`notifications/${token}`).get()
-        );
-      },
-    },
-
-    // Test 4: User can read notification by token match
-    {
-      name: 'user-can-read-notification-by-token',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const otherUid = accounts.admin.uid;
-        const db = rules.asAccount('basic');
-        const token = 'test-token-read-token';
-
-        // Create notification owned by someone else
-        const adminDb = rules.asAccount('admin');
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: otherUid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should succeed - user can read if token matches document ID
-        await rules.expectSuccess(
-          db.doc(`notifications/${token}`).get()
-        );
-      },
-    },
-
-    // Test 5: Anonymous can read non-existent notification (availability check)
-    {
-      name: 'anonymous-can-read-nonexistent-notification',
-      auth: 'none',
-
-      async run({ rules }) {
-        const db = rules.asAnonymous();
-        const token = 'nonexistent-token-12345';
-
-        // Should succeed - resource == null check allows this
-        await rules.expectSuccess(
-          db.doc(`notifications/${token}`).get()
-        );
-      },
-    },
-
-    // Test 6: User can update notification by token match
-    {
-      name: 'user-can-update-notification-by-token',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const otherUid = accounts.admin.uid;
-        const db = rules.asAccount('basic');
-        const token = 'test-token-update';
-
-        // Create notification owned by someone else
-        const adminDb = rules.asAccount('admin');
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: otherUid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should succeed - user can update if token matches
-        await rules.expectSuccess(
-          db.doc(`notifications/${token}`).update({
-            'metadata.updated': { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) },
-          })
-        );
-      },
-    },
-
-    // Test 7: Owner can update their notification
-    {
-      name: 'owner-can-update-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const uid = accounts.basic.uid;
-        const db = rules.asAccount('basic');
-        const token = 'test-token-update-owner';
-
-        // Create notification as admin but owned by basic user
-        const adminDb = rules.asAccount('admin');
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: uid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should succeed - owner can update
-        await rules.expectSuccess(
-          db.doc(`notifications/${token}`).update({
-            preferences: { sound: true },
-          })
-        );
-      },
-    },
-
-    // Test 8: User cannot read notification without token or ownership
-    {
-      name: 'user-cannot-read-others-notification-wrong-token',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const otherUid = accounts.admin.uid;
-        const db = rules.asAccount('basic');
-        const realToken = 'real-token-private';
-        const wrongToken = 'wrong-token-guess';
-
-        // Create notification with a different token
-        const adminDb = rules.asAccount('admin');
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${realToken}`).set({
-            token: realToken,
-            owner: otherUid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should fail - user doesn't own it and document ID doesn't match token they're querying
-        // Note: This test verifies that knowing a wrong token doesn't grant access
-        // The user is querying realToken doc but doesn't own it
-        // Actually the rule allows read if token == document ID, which it does here
-        // Let me reconsider - the token in the doc matches the doc ID, so this would succeed
-        // The rule is: existingData().token == token (where token is the doc ID)
-        // So anyone who knows the token (doc ID) can read it
-        // This is intentional for push notification validation
-        await rules.expectSuccess(
-          db.doc(`notifications/${realToken}`).get()
-        );
-      },
-    },
-
-    // Test 9: Anonymous cannot update existing notification
-    {
-      name: 'anonymous-cannot-update-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const uid = accounts.basic.uid;
-        const db = rules.asAnonymous();
-        const token = 'test-token-anon-update';
-
-        // Create notification
-        const adminDb = rules.asAccount('admin');
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: uid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should fail - anonymous cannot update (no token context for update)
-        // Wait, the rule says: allow update: if existingData().token == token
-        // where token is the wildcard {token} from the path
-        // So anonymous CAN update if they know the token (doc ID)
-        // Let me check the rules again...
-        // Actually for anonymous, they still get the wildcard value
-        await rules.expectSuccess(
-          db.doc(`notifications/${token}`).update({
-            hacked: true,
-          })
-        );
-      },
-    },
-
-    // Test 10: Admin can create notification
-    {
-      name: 'admin-can-create-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const adminDb = rules.asAccount('admin');
-        const token = 'test-token-admin-create';
-
-        // Should succeed - admin can create any doc
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: accounts.basic.uid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-      },
-    },
-
-    // Test 11: Admin can read any notification
-    {
-      name: 'admin-can-read-any-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const basicUid = accounts.basic.uid;
-        const adminDb = rules.asAccount('admin');
-        const token = 'test-token-admin-read';
-
-        // Create notification owned by basic user
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: basicUid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should succeed - admin can read any doc
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).get()
-        );
-      },
-    },
-
-    // Test 12: Admin can update any notification
-    {
-      name: 'admin-can-update-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const adminDb = rules.asAccount('admin');
-        const token = 'test-token-admin-update';
-
-        // Create notification first
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: accounts.basic.uid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should succeed - admin can update any doc
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).update({
-            'metadata.updated': { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) },
-            adminModified: true,
-          })
-        );
-      },
-    },
-
-    // Test 13: Admin can delete notification
-    {
-      name: 'admin-can-delete-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const adminDb = rules.asAccount('admin');
-        const token = 'test-token-admin-delete';
-
-        // Create notification
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: 'someone',
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should succeed - admin can delete via global admin rule
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).delete()
-        );
-      },
-    },
-
-    // Test 14: Regular user cannot delete notification
-    {
-      name: 'user-cannot-delete-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const uid = accounts.basic.uid;
-        const db = rules.asAccount('basic');
-        const adminDb = rules.asAccount('admin');
-        const token = 'test-token-user-delete';
-
-        // Create notification owned by the user
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: uid,
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should fail - no delete rule for non-admins
-        await rules.expectFailure(
-          db.doc(`notifications/${token}`).delete()
-        );
-      },
-    },
-
-    // Test 15: Anonymous cannot delete notification
-    {
-      name: 'anonymous-cannot-delete-notification',
-      auth: 'none',
-
-      async run({ rules, accounts }) {
-        const db = rules.asAnonymous();
-        const adminDb = rules.asAccount('admin');
-        const token = 'test-token-anon-delete';
-
-        // Create notification
-        await rules.expectSuccess(
-          adminDb.doc(`notifications/${token}`).set({
-            token: token,
-            owner: 'someone',
-            metadata: { created: { timestamp: new Date().toISOString(), timestampUNIX: Math.floor(Date.now() / 1000) } },
-          })
-        );
-
-        // Should fail - no delete rule for anonymous
-        await rules.expectFailure(
-          db.doc(`notifications/${token}`).delete()
-        );
-      },
-    },
-  ],
-};