create-ailk 0.1.0

package/templates/apps/api/src/routes/auth/__tests__/auth-tokens.functional.test.ts

@@ -0,0 +1,193 @@
+/**
+ * @file auth-tokens.functional.test.ts
+ *
+ * End-to-end coverage for the three /api/auth/tokens routes once the dual-mode
+ * preHandler (#587) is wired in front. Confirms that:
+ *
+ *   - Cookie-mode happy path: cookie present + valid Session row + same-origin
+ *     POST → handler runs, prisma.apiToken.create is called.
+ *   - Bearer-mode happy path: Authorization: Bearer header → ApiToken lookup
+ *     succeeds → handler runs.
+ *   - Unauthenticated → 401 from the preHandler (handler not reached).
+ *
+ * Together with `tokens.test.ts` (route-body coverage with userId stub) this
+ * locks the spec §5 AC #4 bullet ("All eight existing routes ship functional
+ * via cookie AND via bearer; no public paths renamed").
+ */
+
+import { createHash } from "node:crypto";
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      findMany: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+      updateMany: jest.fn(),
+    },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { tokenRoutes } from "../tokens.js";
+
+const FRONTEND = "https://app.example.com";
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(tokenRoutes);
+  await app.ready();
+  return app;
+}
+
+describe("tokens routes — functional via dual-mode preHandler", () => {
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  describe("cookie mode", () => {
+    it("POST /api/auth/tokens succeeds when authenticated via cookie + same-origin", async () => {
+      (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+        userId: "user_cookie",
+        expiresAt: new Date(Date.now() + 60_000),
+      });
+      (prisma.apiToken.create as jest.Mock).mockResolvedValue({
+        id: "tok_1",
+        name: "desktop",
+        tokenPrefix: "tok_abcdef",
+        clientType: "api",
+        scopes: [],
+        expiresAt: null,
+        createdAt: new Date(),
+      });
+
+      app = await buildApp();
+      const res = await app.inject({
+        method: "POST",
+        url: "/v1/auth/tokens",
+        headers: {
+          cookie: "better-auth.session_token=sess_abc",
+          origin: FRONTEND,
+        },
+        payload: { name: "desktop" },
+      });
+
+      expect(res.statusCode).toBe(201);
+      expect(prisma.apiToken.create).toHaveBeenCalled();
+      expect(
+        (prisma.apiToken.create as jest.Mock).mock.calls[0][0].data.userId,
+      ).toBe("user_cookie");
+    });
+
+    it("GET /api/auth/tokens succeeds when authenticated via cookie (no Origin needed)", async () => {
+      (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+        userId: "user_cookie",
+        expiresAt: new Date(Date.now() + 60_000),
+      });
+      (prisma.apiToken.findMany as jest.Mock).mockResolvedValue([]);
+
+      app = await buildApp();
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/auth/tokens",
+        headers: { cookie: "better-auth.session_token=sess_abc" },
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(prisma.apiToken.findMany).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: { userId: "user_cookie", revokedAt: null },
+        }),
+      );
+    });
+  });
+
+  describe("bearer mode", () => {
+    it("GET /api/auth/tokens succeeds when authenticated via Authorization: Bearer", async () => {
+      const bearer = "tok_live_zzz";
+      const hash = createHash("sha256").update(bearer).digest("hex");
+      (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+        id: "tok_id",
+        userId: "user_bear",
+        expiresAt: null,
+        revokedAt: null,
+      });
+      (prisma.apiToken.findMany as jest.Mock).mockResolvedValue([]);
+
+      app = await buildApp();
+      const res = await app.inject({
+        method: "GET",
+        url: "/v1/auth/tokens",
+        headers: { authorization: `Bearer ${bearer}` },
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(prisma.apiToken.findUnique).toHaveBeenCalledWith({
+        where: { token: hash },
+        select: { id: true, userId: true, expiresAt: true, revokedAt: true },
+      });
+      expect(prisma.apiToken.findMany).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: { userId: "user_bear", revokedAt: null },
+        }),
+      );
+    });
+
+    it("DELETE /api/auth/tokens/:id succeeds via bearer; revokes the row", async () => {
+      const bearer = "tok_live_zzz";
+      (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+        id: "tok_id",
+        userId: "user_bear",
+        expiresAt: null,
+        revokedAt: null,
+      });
+      (prisma.apiToken.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
+
+      app = await buildApp();
+      const res = await app.inject({
+        method: "DELETE",
+        url: "/v1/auth/tokens/tok_other",
+        headers: { authorization: `Bearer ${bearer}` },
+      });
+
+      expect(res.statusCode).toBe(200);
+      expect(prisma.apiToken.updateMany).toHaveBeenCalledWith({
+        where: { id: "tok_other", userId: "user_bear", revokedAt: null },
+        data: { revokedAt: expect.any(Date) },
+      });
+    });
+  });
+
+  describe("unauthenticated", () => {
+    it.each([
+      ["POST", "/v1/auth/tokens"],
+      ["GET", "/v1/auth/tokens"],
+      ["DELETE", "/v1/auth/tokens/tok_x"],
+    ])("%s %s → 401 (handler never runs)", async (method, url) => {
+      app = await buildApp();
+      const res = await app.inject({
+        method: method as "POST" | "GET" | "DELETE",
+        url,
+        payload: method === "POST" ? { name: "x" } : undefined,
+      });
+      expect(res.statusCode).toBe(401);
+      expect(prisma.apiToken.create).not.toHaveBeenCalled();
+      expect(prisma.apiToken.findMany).not.toHaveBeenCalled();
+      expect(prisma.apiToken.updateMany).not.toHaveBeenCalled();
+    });
+  });
+});

package/templates/apps/api/src/routes/auth/__tests__/auth-user.functional.test.ts

@@ -0,0 +1,201 @@
+/**
+ * @file auth-user.functional.test.ts
+ *
+ * End-to-end coverage for the five /api/user/* routes once the dual-mode
+ * preHandler (#587) is wired in front. Covers cookie + bearer happy paths and
+ * unauthenticated 401s for all five.
+ */
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+    user: {
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
+    userData: {
+      findUnique: jest.fn(),
+      upsert: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { userRoutes } from "../user.js";
+
+const FRONTEND = "https://app.example.com";
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(userRoutes);
+  await app.ready();
+  return app;
+}
+
+function withCookie(userId: string): void {
+  (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+    userId,
+    expiresAt: new Date(Date.now() + 60_000),
+  });
+}
+
+function withBearer(userId: string): void {
+  (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
+    id: "tok_id",
+    userId,
+    expiresAt: null,
+    revokedAt: null,
+  });
+}
+
+describe("user routes — functional via dual-mode preHandler", () => {
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("GET /api/user/profile — cookie mode", async () => {
+    withCookie("user_cookie");
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      id: "user_cookie",
+      email: "a@b.com",
+      name: "A",
+      image: null,
+      role: "user",
+      createdAt: new Date(),
+    });
+
+    app = await buildApp();
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/user/profile",
+      headers: { cookie: "better-auth.session_token=sess_abc" },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.user.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: "user_cookie" } }),
+    );
+  });
+
+  it("PATCH /api/user/profile — cookie mode (same-origin)", async () => {
+    withCookie("user_cookie");
+    (prisma.user.update as jest.Mock).mockResolvedValue({
+      id: "user_cookie",
+      email: "a@b.com",
+      name: "New",
+      image: null,
+      role: "user",
+      updatedAt: new Date(),
+    });
+
+    app = await buildApp();
+    const res = await app.inject({
+      method: "PATCH",
+      url: "/v1/user/profile",
+      headers: {
+        cookie: "better-auth.session_token=sess_abc",
+        origin: FRONTEND,
+      },
+      payload: { name: "New" },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect((prisma.user.update as jest.Mock).mock.calls[0][0].where.id).toBe(
+      "user_cookie",
+    );
+  });
+
+  it("GET /api/user/data/:key — bearer mode", async () => {
+    withBearer("user_bear");
+    (prisma.userData.findUnique as jest.Mock).mockResolvedValue({
+      value: { theme: "dark" },
+    });
+
+    app = await buildApp();
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/user/data/prefs",
+      headers: { authorization: "Bearer tok_live_xx" },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.userData.findUnique).toHaveBeenCalledWith({
+      where: { userId_key: { userId: "user_bear", key: "prefs" } },
+    });
+  });
+
+  it("PUT /api/user/data/:key — bearer mode (CSRF skipped)", async () => {
+    withBearer("user_bear");
+    (prisma.userData.upsert as jest.Mock).mockResolvedValue({
+      value: { theme: "dark" },
+    });
+
+    app = await buildApp();
+    const res = await app.inject({
+      method: "PUT",
+      url: "/v1/user/data/prefs",
+      headers: { authorization: "Bearer tok_live_xx" },
+      payload: { theme: "dark" },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.userData.upsert).toHaveBeenCalled();
+  });
+
+  it("DELETE /api/user/data/:key — bearer mode", async () => {
+    withBearer("user_bear");
+    (prisma.userData.deleteMany as jest.Mock).mockResolvedValue({ count: 1 });
+
+    app = await buildApp();
+    const res = await app.inject({
+      method: "DELETE",
+      url: "/v1/user/data/prefs",
+      headers: { authorization: "Bearer tok_live_xx" },
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.userData.deleteMany).toHaveBeenCalledWith({
+      where: { userId: "user_bear", key: "prefs" },
+    });
+  });
+
+  describe("unauthenticated", () => {
+    it.each([
+      ["GET", "/v1/user/profile", undefined],
+      ["PATCH", "/v1/user/profile", { name: "x" }],
+      ["GET", "/v1/user/data/prefs", undefined],
+      ["PUT", "/v1/user/data/prefs", { v: 1 }],
+      ["DELETE", "/v1/user/data/prefs", undefined],
+    ])("%s %s → 401 (handler never runs)", async (method, url, payload) => {
+      app = await buildApp();
+      const res = await app.inject({
+        method: method as "GET" | "PATCH" | "PUT" | "DELETE",
+        url,
+        payload,
+      });
+      expect(res.statusCode).toBe(401);
+      expect(prisma.user.findUnique).not.toHaveBeenCalled();
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      expect(prisma.userData.findUnique).not.toHaveBeenCalled();
+      expect(prisma.userData.upsert).not.toHaveBeenCalled();
+      expect(prisma.userData.deleteMany).not.toHaveBeenCalled();
+    });
+  });
+});

package/templates/apps/api/src/routes/auth/__tests__/tokens.test.ts

@@ -0,0 +1,294 @@
+import { FastifyInstance } from 'fastify';
+import { tokenRoutes } from '../tokens';
+
+// Mock Prisma — lib/prisma.ts wraps the external DB boundary (PrismaClient
+// requires a live connection). This call auto-resolves to the manual mock at
+// src/lib/__mocks__/prisma.ts which covers apiToken/user/userData models.
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock('../../../lib/prisma.js');
+
+import { prisma } from '../../../lib/prisma.js';
+
+describe('Token Routes', () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    const fastify = require('fastify')();
+    fastify.decorateRequest('userId', null);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+    fastify.addHook('preHandler', async (request: any) => {
+      // Default to authenticated - set userId if not explicitly set to null
+      if (request.userId === null) {
+        request.userId = 'user_123';
+      }
+    });
+    await fastify.register(tokenRoutes);
+    app = fastify;
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  describe('POST /v1/auth/tokens', () => {
+    it('should return 401 when user is not authenticated', async () => {
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // Add hook that explicitly keeps userId as null
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = null; // Explicitly set to null to test unauthenticated
+      });
+      await fastify2.register(tokenRoutes);
+
+      const response = await fastify2.inject({
+        method: 'POST',
+        url: '/v1/auth/tokens',
+        payload: { name: 'Test Token' },
+      });
+
+      expect(response.statusCode).toBe(401);
+      await fastify2.close();
+    });
+
+    it('should create a new API token', async () => {
+      // ARRANGE
+      const mockToken = {
+        id: 'token_123',
+        name: 'Test Token',
+        tokenPrefix: 'tok_abc123',
+        clientType: 'api',
+        scopes: [],
+        expiresAt: null,
+        createdAt: new Date(),
+      };
+
+      (prisma.apiToken.create as jest.Mock).mockResolvedValue(mockToken);
+
+      // ACT
+      const response = await app.inject({
+        method: 'POST',
+        url: '/v1/auth/tokens',
+        payload: {
+          name: 'Test Token',
+          clientType: 'api',
+        },
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(201);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(true);
+      expect(body.token).toBeDefined();
+      expect(body.token).toMatch(/^tok_/);
+      expect(body.data.name).toBe('Test Token');
+      expect(prisma.apiToken.create).toHaveBeenCalled();
+    });
+
+    it('should create token with expiration', async () => {
+      // ARRANGE
+      const mockToken = {
+        id: 'token_123',
+        name: 'Test Token',
+        tokenPrefix: 'tok_abc123',
+        clientType: 'api',
+        scopes: [],
+        expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
+        createdAt: new Date(),
+      };
+
+      (prisma.apiToken.create as jest.Mock).mockResolvedValue(mockToken);
+
+      // ACT
+      const response = await app.inject({
+        method: 'POST',
+        url: '/v1/auth/tokens',
+        payload: {
+          name: 'Test Token',
+          expiresInDays: 30,
+        },
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(201);
+      expect(prisma.apiToken.create).toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({
+            expiresAt: expect.any(Date),
+          }),
+        })
+      );
+    });
+
+    it('should return 400 on validation error', async () => {
+      // ACT
+      const response = await app.inject({
+        method: 'POST',
+        url: '/v1/auth/tokens',
+        payload: {
+          name: '', // Invalid: empty name
+        },
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(400);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('Validation failed');
+    });
+
+    it('should return 500 on database error', async () => {
+      // ARRANGE
+      (prisma.apiToken.create as jest.Mock).mockRejectedValue(
+        new Error('Database error')
+      );
+
+      // ACT
+      const response = await app.inject({
+        method: 'POST',
+        url: '/v1/auth/tokens',
+        payload: {
+          name: 'Test Token',
+        },
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(500);
+    });
+  });
+
+  describe('GET /v1/auth/tokens', () => {
+    it('should return 401 when user is not authenticated', async () => {
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = null; // Explicitly set to null
+      });
+      await fastify2.register(tokenRoutes);
+
+      const response = await fastify2.inject({
+        method: 'GET',
+        url: '/v1/auth/tokens',
+      });
+
+      expect(response.statusCode).toBe(401);
+      await fastify2.close();
+    });
+
+    it('should list user tokens', async () => {
+      // ARRANGE
+      const mockTokens = [
+        {
+          id: 'token_1',
+          name: 'Token 1',
+          tokenPrefix: 'tok_abc',
+          clientType: 'api',
+          deviceInfo: null,
+          scopes: [],
+          expiresAt: null,
+          lastUsedAt: null,
+          createdAt: new Date(),
+        },
+        {
+          id: 'token_2',
+          name: 'Token 2',
+          tokenPrefix: 'tok_def',
+          clientType: 'mobile',
+          deviceInfo: 'iPhone',
+          scopes: ['read'],
+          expiresAt: new Date(),
+          lastUsedAt: new Date(),
+          createdAt: new Date(),
+        },
+      ];
+
+      (prisma.apiToken.findMany as jest.Mock).mockResolvedValue(mockTokens);
+
+      // ACT
+      const response = await app.inject({
+        method: 'GET',
+        url: '/v1/auth/tokens',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(true);
+      expect(body.data).toHaveLength(2);
+      expect(prisma.apiToken.findMany).toHaveBeenCalledWith({
+        where: {
+          userId: 'user_123',
+          revokedAt: null,
+        },
+        select: expect.any(Object),
+        orderBy: { createdAt: 'desc' },
+      });
+    });
+  });
+
+  describe('DELETE /v1/auth/tokens/:id', () => {
+    it('should return 401 when user is not authenticated', async () => {
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = null; // Explicitly set to null
+      });
+      await fastify2.register(tokenRoutes);
+
+      const response = await fastify2.inject({
+        method: 'DELETE',
+        url: '/v1/auth/tokens/token_123',
+      });
+
+      expect(response.statusCode).toBe(401);
+      await fastify2.close();
+    });
+
+    it('should revoke a token', async () => {
+      // ARRANGE
+      (prisma.apiToken.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
+
+      // ACT
+      const response = await app.inject({
+        method: 'DELETE',
+        url: '/v1/auth/tokens/token_123',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(true);
+      expect(body.message).toBe('Token revoked');
+      expect(prisma.apiToken.updateMany).toHaveBeenCalledWith({
+        where: {
+          id: 'token_123',
+          userId: 'user_123',
+          revokedAt: null,
+        },
+        data: {
+          revokedAt: expect.any(Date),
+        },
+      });
+    });
+
+    it('should return 404 when token is not found', async () => {
+      // ARRANGE
+      (prisma.apiToken.updateMany as jest.Mock).mockResolvedValue({ count: 0 });
+
+      // ACT
+      const response = await app.inject({
+        method: 'DELETE',
+        url: '/v1/auth/tokens/nonexistent',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(404);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('Token not found');
+    });
+  });
+});