create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/middleware/__tests__/auth.bearer-path.test.ts

@@ -1,562 +0,0 @@
-/**
- * @file auth.bearer-path.test.ts
- *
- * Bearer-path coverage for the dual-mode auth preHandler (#587).
- *
- * Asserts:
- *   - Valid Authorization: Bearer header → request.userId populated; 200.
- *   - CSRF is NOT checked on bearer-authenticated POST (cross-origin OK).
- *   - Malformed Authorization header → 401 (does not fall through silently).
- *   - Revoked token → 401.
- *   - Expired token → 401.
- *   - Unknown token → 401.
- */
-
-import { createHash } from "node:crypto";
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-    // #3591 — the agent branch's lookup and its best-effort lastActiveAt bump.
-    agent: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-  },
-}));
-
-import { hashAgentKey, mintAgentKey } from "../../lib/agent-store.js";
-import { prisma } from "../../lib/prisma.js";
-import { leadListRoute } from "../../routes/leads/list.js";
-import { tokenRoutes } from "../../routes/auth/tokens.js";
-import { __resetAgentRateBuckets, authPreHandlerPlugin } from "../auth.js";
-
-const FRONTEND = "https://app.example.com";
-const BEARER = "tok_live_abc";
-const BEARER_HASH = createHash("sha256").update(BEARER).digest("hex");
-
-function buildApp(): FastifyInstance {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
-  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
-  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
-  return app;
-}
-
-describe("auth preHandler — bearer path", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("decorates request.userId for a valid bearer token (GET)", async () => {
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bear",
-      expiresAt: null,
-      revokedAt: null,
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { authorization: `Bearer ${BEARER}` },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body)).toEqual({ userId: "user_bear" });
-    expect(prisma.apiToken.findUnique).toHaveBeenCalledWith({
-      where: { token: BEARER_HASH },
-      select: { id: true, userId: true, expiresAt: true, revokedAt: true },
-    });
-  });
-
-  it("skips CSRF on bearer POST (cross-origin allowed for non-browser callers)", async () => {
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bear",
-      expiresAt: null,
-      revokedAt: null,
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/echo",
-      headers: {
-        authorization: `Bearer ${BEARER}`,
-        origin: "https://anywhere.example.com", // explicitly cross-origin
-      },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body).userId).toBe("user_bear");
-  });
-
-  it("rejects a malformed Authorization header (no silent fallback to cookie)", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { authorization: "NotBearer x" },
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
-    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("returns 401 for a revoked token", async () => {
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bear",
-      expiresAt: null,
-      revokedAt: new Date(),
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { authorization: `Bearer ${BEARER}` },
-    });
-
-    expect(res.statusCode).toBe(401);
-  });
-
-  it("returns 401 for an expired token", async () => {
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bear",
-      expiresAt: new Date(Date.now() - 1000),
-      revokedAt: null,
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { authorization: `Bearer ${BEARER}` },
-    });
-
-    expect(res.statusCode).toBe(401);
-  });
-
-  it("returns 401 for an unknown token", async () => {
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue(null);
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { authorization: "Bearer some-random-token" },
-    });
-
-    expect(res.statusCode).toBe(401);
-  });
-});
-
-// ── #3591 — the agent branch (spec docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D4, D6, D9) ──
-
-const AGENT_A = "agent_00000000-0000-7000-8000-0000000000c1";
-const AGENT_B = "agent_00000000-0000-7000-8000-0000000000c2";
-const PERSON = "user_00000000-0000-7000-8000-0000000000f2";
-const PERSON_MEMBERSHIP = "member_00000000-0000-7000-8000-0000000000f2";
-const ADMIN_MEMBERSHIP = "member_00000000-0000-7000-8000-0000000000f1";
-const ORG_A = "org_00000000-0000-7000-8000-000000000aaa";
-const WS_A1 = "wksp_00000000-0000-7000-8000-0000000000a1";
-
-type AgentFixture = {
-  id: string;
-  /** Absent → the row carries none (the double omits the column). */
-  grants?: string[];
-  enabled?: boolean;
-  keyIssuedToMembershipId?: string | null;
-  lastActiveAt?: Date | null;
-};
-
-/**
- * Keys are minted at run time — a key-shaped literal in a fixture trips the
- * repo-wide secret scan. Each key maps, by its digest, to one agent row.
- */
-function installAgents(agents: Array<AgentFixture & { key: string }>): void {
-  const byHash = new Map(agents.map((a) => [hashAgentKey(a.key), a]));
-  (prisma.agent.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { credentialHash: string } }) => {
-      const a = byHash.get(where.credentialHash);
-      return Promise.resolve(
-        a
-          ? {
-              id: a.id,
-              workspaceId: WS_A1,
-              organizationId: ORG_A,
-              permissionLevel: "member",
-              ...(a.grants === undefined ? {} : { grants: a.grants }),
-              enabled: a.enabled ?? true,
-              keyIssuedToMembershipId:
-                a.keyIssuedToMembershipId === undefined ? ADMIN_MEMBERSHIP : a.keyIssuedToMembershipId,
-              lastActiveAt: a.lastActiveAt ?? null,
-              responsible: { id: PERSON_MEMBERSHIP, userId: PERSON },
-            }
-          : null,
-      );
-    },
-  );
-}
-
-/** Collects every JSON log line the app writes. */
-function captureLogs(): { lines: Array<Record<string, unknown>>; raw: string[]; stream: { write(line: string): void } } {
-  const lines: Array<Record<string, unknown>> = [];
-  const raw: string[] = [];
-  return {
-    lines,
-    raw,
-    stream: {
-      write(line: string) {
-        raw.push(line);
-        lines.push(JSON.parse(line) as Record<string, unknown>);
-      },
-    },
-  };
-}
-
-/** Echo routes: one the tenant guard would tag, one it would not (D6). */
-function buildAgentApp(stream?: { write(line: string): void }): FastifyInstance {
-  const app = Fastify(stream ? { logger: { level: "info", stream } } : {});
-  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
-  const echo = async (req: import("fastify").FastifyRequest) => ({
-    userId: req.userId ?? null,
-    agent: req.agent ?? null,
-    actor: req.actor ?? null,
-    sessionTenant: req.sessionTenant ?? null,
-  });
-  for (const method of ["GET", "POST", "PATCH"] as const) {
-    app.route({ method, url: "/guarded", config: { tenantGuarded: true }, handler: echo });
-    app.route({ method, url: "/unguarded", handler: echo });
-  }
-  return app;
-}
-
-describe("auth preHandler — agent branch (#3591)", () => {
-  let app: FastifyInstance;
-  let keyA: string;
-  let keyB: string;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    __resetAgentRateBuckets();
-    keyA = mintAgentKey();
-    keyB = mintAgentKey();
-    installAgents([
-      { id: AGENT_A, key: keyA },
-      { id: AGENT_B, key: keyB },
-    ]);
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  const agentGet = (url: string, key: string) =>
-    app.inject({ method: "GET", url, headers: { authorization: `Bearer ${key}` } });
-
-  it("an ailk_agt_ bearer takes the agent branch: request.userId is the person, request.agent the binding, request.actor the agent — never sessionTenant", async () => {
-    app = buildAgentApp();
-    await app.ready();
-
-    const res = await agentGet("/guarded", keyA);
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({
-      userId: PERSON,
-      agent: {
-        agentId: AGENT_A,
-        workspaceId: WS_A1,
-        organizationId: ORG_A,
-        responsibleMembershipId: PERSON_MEMBERSHIP,
-        permissionLevel: "member",
-        grants: [],
-      },
-      actor: { type: "agent", agentId: AGENT_A, onBehalfOfUserId: PERSON },
-      sessionTenant: null,
-    });
-    expect(prisma.agent.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { credentialHash: hashAgentKey(keyA) } }),
-    );
-    // The ApiToken table is never consulted for an agent key.
-    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("bumps lastActiveAt best-effort — a failed bump never 401s", async () => {
-    (prisma.agent.update as jest.Mock).mockRejectedValueOnce(new Error("db down"));
-    app = buildAgentApp();
-    await app.ready();
-
-    const res = await agentGet("/guarded", keyA);
-
-    expect(res.statusCode).toBe(200);
-    expect(prisma.agent.update).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { id: AGENT_A } }),
-    );
-  });
-
-  it("writes lastActiveAt at most once a minute: a stamp under 60s old is left alone, an older one is refreshed", async () => {
-    const fresh = mintAgentKey();
-    const stale = mintAgentKey();
-    installAgents([
-      { id: AGENT_A, key: fresh, lastActiveAt: new Date(Date.now() - 10_000) },
-      { id: AGENT_B, key: stale, lastActiveAt: new Date(Date.now() - 120_000) },
-    ]);
-    app = buildAgentApp();
-    await app.ready();
-
-    expect((await agentGet("/guarded", fresh)).statusCode).toBe(200);
-    expect(prisma.agent.update).not.toHaveBeenCalled();
-
-    expect((await agentGet("/guarded", stale)).statusCode).toBe(200);
-    expect(prisma.agent.update).toHaveBeenCalledTimes(1);
-    expect(prisma.agent.update).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { id: AGENT_B } }),
-    );
-  });
-
-  it("a refused request writes no lastActiveAt", async () => {
-    app = buildAgentApp();
-    await app.ready();
-
-    expect((await agentGet("/unguarded", keyA)).statusCode).toBe(403);
-    expect(prisma.agent.update).not.toHaveBeenCalled();
-  });
-
-  it.each([
-    ["an unknown key", () => mintAgentKey()],
-    ["a switched-off agent", () => "off"],
-    ["an agent whose key-holder has left (keyIssuedToMembershipId null)", () => "orphaned"],
-  ])("answers 401 with one body for %s", async (_label, pick) => {
-    const off = mintAgentKey();
-    const orphaned = mintAgentKey();
-    installAgents([
-      { id: AGENT_A, key: off, enabled: false },
-      { id: AGENT_B, key: orphaned, keyIssuedToMembershipId: null },
-    ]);
-    const chosen = pick();
-    const key = chosen === "off" ? off : chosen === "orphaned" ? orphaned : chosen;
-    app = buildAgentApp();
-    await app.ready();
-
-    const res = await agentGet("/guarded", key);
-
-    expect(res.statusCode).toBe(401);
-    expect(res.json()).toEqual({ error: "unauthorized" });
-    expect(prisma.agent.update).not.toHaveBeenCalled();
-  });
-
-  it("a lookup failure is 401, not a 500", async () => {
-    (prisma.agent.findUnique as jest.Mock).mockRejectedValueOnce(new Error("db down"));
-    app = buildAgentApp();
-    await app.ready();
-
-    const res = await agentGet("/guarded", keyA);
-
-    expect(res.statusCode).toBe(401);
-  });
-
-  it("the cookie still wins over an agent bearer (precedence unchanged)", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      id: "sess_1",
-      userId: "user_cookie",
-      expiresAt: new Date(Date.now() + 60_000),
-      activeOrganizationId: null,
-      activeWorkspaceId: null,
-    });
-    app = buildAgentApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/unguarded",
-      headers: { cookie: "better-auth.session_token=tok", authorization: `Bearer ${keyA}` },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json().actor).toEqual({ type: "user", userId: "user_cookie" });
-    expect(prisma.agent.findUnique).not.toHaveBeenCalled();
-  });
-
-  describe("D6 — an agent reaches only routes the tenant guard runs on", () => {
-    it("is 403 on a route the guard did not tag", async () => {
-      app = buildAgentApp();
-      await app.ready();
-
-      const res = await agentGet("/unguarded", keyA);
-
-      expect(res.statusCode).toBe(403);
-      expect(res.json()).toEqual({ ok: false, error: { code: "forbidden", message: "Forbidden" } });
-    });
-
-    it("a personal ApiToken still reaches an untagged route (tok_ behaviour unchanged)", async () => {
-      (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-        id: "tok_id",
-        userId: "user_bear",
-        expiresAt: null,
-        revokedAt: null,
-      });
-      app = buildAgentApp();
-      await app.ready();
-
-      const res = await app.inject({
-        method: "GET",
-        url: "/unguarded",
-        headers: { authorization: `Bearer ${BEARER}` },
-      });
-
-      expect(res.statusCode).toBe(200);
-      expect(res.json().actor).toEqual({ type: "user", userId: "user_bear" });
-      expect(res.json().agent).toBeNull();
-    });
-
-    it("is 403 on GET /v1/leads and POST /v1/auth/tokens, before either handler reads anything", async () => {
-      app = Fastify();
-      app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
-      app.register(tokenRoutes);
-      app.register(leadListRoute);
-      await app.ready();
-
-      const leads = await agentGet("/v1/leads", keyA);
-      const tokens = await app.inject({
-        method: "POST",
-        url: "/v1/auth/tokens",
-        headers: { authorization: `Bearer ${keyA}` },
-        payload: { name: "escalation" },
-      });
-
-      expect(leads.statusCode).toBe(403);
-      expect(tokens.statusCode).toBe(403);
-      expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-    });
-  });
-
-  describe("the per-agent limit (D4 step 5, SEC-3591-04)", () => {
-    const write = (key: string) =>
-      app.inject({ method: "PATCH", url: "/guarded", headers: { authorization: `Bearer ${key}` } });
-
-    it("the eleventh non-GET request in a minute is 429 with Retry-After, while a second agent is unaffected", async () => {
-      app = buildAgentApp();
-      await app.ready();
-
-      for (let i = 0; i < 10; i += 1) {
-        expect((await write(keyA)).statusCode).toBe(200);
-      }
-      const eleventh = await write(keyA);
-      expect(eleventh.statusCode).toBe(429);
-      expect(Number(eleventh.headers["retry-after"])).toBeGreaterThan(0);
-      expect(eleventh.json()).toEqual({
-        ok: false,
-        error: { code: "rate_limited", message: "Too many requests" },
-      });
-
-      expect((await write(keyB)).statusCode).toBe(200);
-    });
-
-    it("reads count toward 60 a minute, and the sixty-first is 429", async () => {
-      app = buildAgentApp();
-      await app.ready();
-
-      for (let i = 0; i < 60; i += 1) {
-        expect((await agentGet("/guarded", keyA)).statusCode).toBe(200);
-      }
-      expect((await agentGet("/guarded", keyA)).statusCode).toBe(429);
-      expect((await agentGet("/guarded", keyB)).statusCode).toBe(200);
-    });
-
-    it("an invented key never gets a bucket: it is 401 every time, never 429", async () => {
-      app = buildAgentApp();
-      await app.ready();
-
-      const invented = mintAgentKey();
-      for (let i = 0; i < 15; i += 1) {
-        expect((await write(invented)).statusCode).toBe(401);
-      }
-    });
-  });
-
-  describe("D9 — the completion log line names the actor", () => {
-    it("carries actorType agent, the agent id and its person; the key appears in no line", async () => {
-      const logs = captureLogs();
-      app = buildAgentApp(logs.stream);
-      await app.ready();
-
-      const res = await agentGet("/guarded", keyA);
-      expect(res.statusCode).toBe(200);
-
-      const completed = logs.lines.find((l) => l.msg === "request completed");
-      expect(completed).toMatchObject({
-        actorType: "agent",
-        agentId: AGENT_A,
-        onBehalfOfUserId: PERSON,
-      });
-      expect(logs.raw.join("\n")).not.toContain(keyA);
-    });
-
-    it("a refused agent's lines carry no key either", async () => {
-      const logs = captureLogs();
-      app = buildAgentApp(logs.stream);
-      await app.ready();
-
-      await agentGet("/unguarded", keyA);
-      await agentGet("/guarded", mintAgentKey());
-
-      expect(logs.raw.length).toBeGreaterThan(0);
-      expect(logs.raw.join("\n")).not.toContain(keyA);
-      expect(logs.raw.join("\n")).not.toContain("ailk_agt_");
-    });
-
-    it("an ApiToken request's completion line carries actorType user", async () => {
-      (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-        id: "tok_id",
-        userId: "user_bear",
-        expiresAt: null,
-        revokedAt: null,
-      });
-      const logs = captureLogs();
-      app = buildAgentApp(logs.stream);
-      await app.ready();
-
-      await app.inject({
-        method: "GET",
-        url: "/unguarded",
-        headers: { authorization: `Bearer ${BEARER}` },
-      });
-
-      const completed = logs.lines.find((l) => l.msg === "request completed");
-      expect(completed).toMatchObject({ actorType: "user" });
-      expect(completed).not.toHaveProperty("agentId");
-    });
-  });
-});

package/templates/apps/api/src/middleware/__tests__/auth.both-present-precedence.test.ts

@@ -1,76 +0,0 @@
-/**
- * @file auth.both-present-precedence.test.ts
- *
- * "Both cookie and bearer present" tie-break (#587).
- *
- * Spec §3 #3: cookie precedence wins. The bearer token is ignored when the
- * cookie session is valid. Brief decision OQ-D Layer 1 #2 locks this.
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-  },
-}));
-
-import { prisma } from "../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../auth.js";
-
-function buildApp(): FastifyInstance {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, {
-    trustedOrigins: ["https://app.example.com"],
-  });
-  app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
-  return app;
-}
-
-describe("auth preHandler — both cookie and bearer present", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("cookie wins when both are valid; bearer lookup is skipped entirely", async () => {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      userId: "user_cookie",
-      expiresAt: new Date(Date.now() + 60_000),
-    });
-    (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_id",
-      userId: "user_bearer",
-      expiresAt: null,
-      revokedAt: null,
-    });
-
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: {
-        cookie: "better-auth.session_token=sess_tok_abc",
-        authorization: "Bearer tok_live_xyz",
-      },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body)).toEqual({ userId: "user_cookie" });
-    // Bearer table MUST NOT be queried when the cookie path resolves.
-    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-  });
-});