create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/routes/auth/__tests__/hub-sign-in.test.ts

@@ -1,532 +0,0 @@
-/**
- * @file hub-sign-in.test.ts
- *
- * The four hub-sign-in routes through a real Fastify instance, wired as
- * `server.ts` wires them (#7894, spec
- * docs/specs/7894-the-hub-signs-in-its-spec.md D5, D6; AC-4, AC-5):
- * `codes` and `me` behind the auth preHandler, `token` and `revoke` in their
- * own scope without one.
- *
- * The REAL preHandler, routes, service and store run over an in-memory stand-in
- * for the Prisma delegates (`__tests__/support/hub-sign-in-fake-db.ts`).
- *
- * External dependency boundary mocked:
- *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../../lib/prisma.js");
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-import {
-  installHubSignInFakeDb,
-  pkcePair,
-  seedSpoke,
-  seedUser,
-  type FakeHubDb,
-  type FakeUser,
-  type SeededSpoke,
-} from "../../../__tests__/support/hub-sign-in-fake-db.js";
-import { hashAgentKey, mintAgentKey } from "../../../lib/agent-store.js";
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../../middleware/auth.js";
-import { __resetHubSignInBuckets } from "../../../services/hub-sign-in.js";
-import {
-  hubSignInClientRoutes,
-  hubSignInPublicRoutes,
-  hubSignInSessionRoutes,
-} from "../hub-sign-in.js";
-
-const db = jest.mocked(prisma);
-
-const HUB = "https://hub.example.com";
-const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
-const COOKIE_TOKEN = "cookie_pat";
-
-let state: FakeHubDb;
-let app: FastifyInstance;
-let user: FakeUser;
-let spoke: SeededSpoke;
-
-function buildApp(): FastifyInstance {
-  const server = Fastify();
-  server.register(async (authScope) => {
-    await authScope.register(authPreHandlerPlugin, { trustedOrigins: [HUB] });
-    await authScope.register(hubSignInSessionRoutes);
-  });
-  server.register(hubSignInClientRoutes);
-  server.register(hubSignInPublicRoutes);
-  return server;
-}
-
-beforeEach(async () => {
-  jest.resetAllMocks();
-  state = installHubSignInFakeDb(db);
-  __resetHubSignInBuckets();
-
-  user = seedUser(state);
-  spoke = seedSpoke(state);
-
-  // The Better Auth session the cookie path resolves.
-  (db.session.findUnique as jest.Mock).mockImplementation(
-    async ({ where }: { where: { token: string } }) =>
-      where.token === COOKIE_TOKEN
-        ? {
-            id: "sess_1",
-            userId: user.id,
-            expiresAt: FUTURE,
-            activeOrganizationId: null,
-            activeWorkspaceId: null,
-          }
-        : null,
-  );
-
-  app = buildApp();
-  await app.ready();
-});
-
-afterEach(async () => {
-  await app.close();
-});
-
-const cookieHeaders = () => ({
-  cookie: `better-auth.session_token=${COOKIE_TOKEN}`,
-  origin: HUB,
-});
-
-async function postCode(
-  headers: Record<string, string>,
-  overrides: Record<string, unknown> = {},
-  challenge = pkcePair().challenge,
-) {
-  return app.inject({
-    method: "POST",
-    url: "/v1/hub-sign-in/codes",
-    headers,
-    payload: {
-      clientId: spoke.client.clientId,
-      redirectUri: spoke.redirectUri,
-      codeChallenge: challenge,
-      ...overrides,
-    },
-  });
-}
-
-async function postToken(
-  s: SeededSpoke,
-  body: Record<string, unknown>,
-  headers: Record<string, string> = {},
-) {
-  return app.inject({
-    method: "POST",
-    url: "/v1/hub-sign-in/token",
-    headers: { authorization: s.basic, "x-ailk-spoke-key": s.key, ...headers },
-    payload: { redirectUri: s.redirectUri, ...body },
-  });
-}
-
-/** The whole sign-in, over HTTP: cookie → code → token. */
-async function signIn(s: SeededSpoke = spoke): Promise<string> {
-  const { verifier, challenge } = pkcePair();
-  const minted = await app.inject({
-    method: "POST",
-    url: "/v1/hub-sign-in/codes",
-    headers: cookieHeaders(),
-    payload: {
-      clientId: s.client.clientId,
-      redirectUri: s.redirectUri,
-      codeChallenge: challenge,
-    },
-  });
-  expect(minted.statusCode).toBe(201);
-  const { code } = minted.json().data as { code: string };
-  const exchanged = await postToken(s, { code, codeVerifier: verifier });
-  expect(exchanged.statusCode).toBe(200);
-  return (exchanged.json().data as { accessToken: string }).accessToken;
-}
-
-describe("POST /v1/hub-sign-in/codes", () => {
-  it("a cookie session mints a code: 201, the envelope, no-store, no cookie", async () => {
-    const res = await postCode(cookieHeaders());
-
-    expect(res.statusCode).toBe(201);
-    expect(res.headers["cache-control"]).toBe("no-store");
-    expect(res.headers["set-cookie"]).toBeUndefined();
-    expect(res.json()).toEqual({
-      ok: true,
-      data: {
-        code: expect.stringMatching(/^[A-Za-z0-9_-]{43}$/),
-        redirectUri: spoke.redirectUri,
-      },
-    });
-    expect(state.verifications).toHaveLength(1);
-  });
-
-  it("is 401 with no credential at all, and 401 for a cookie write with no Origin", async () => {
-    expect((await postCode({})).statusCode).toBe(401);
-    expect(
-      (await postCode({ cookie: cookieHeaders().cookie })).statusCode,
-    ).toBe(401);
-    expect(state.verifications).toHaveLength(0);
-  });
-
-  it("AC-5: refuses a personal ApiToken (403), an agent key (403) and a hub credential (404) — and writes no code", async () => {
-    // A personal API token: authenticated, but no cookie session.
-    (db.apiToken.findUnique as jest.Mock).mockResolvedValue({
-      id: "tok_1",
-      userId: user.id,
-      expiresAt: null,
-      revokedAt: null,
-    });
-    (db.apiToken.update as jest.Mock).mockResolvedValue({});
-    const apiToken = await postCode({ authorization: "Bearer tok_live_abc" });
-    expect(apiToken.statusCode).toBe(403);
-    expect(apiToken.json()).toEqual({
-      ok: false,
-      error: { code: "forbidden", message: "Forbidden" },
-    });
-
-    // An agent key: refused at the preHandler on any route outside a tenant guard.
-    const agentKey = mintAgentKey();
-    (db.agent.findUnique as jest.Mock).mockImplementation(
-      async ({ where }: { where: { credentialHash: string } }) =>
-        where.credentialHash === hashAgentKey(agentKey)
-          ? {
-              id: "agent_00000000-0000-7000-8000-0000000000c1",
-              workspaceId: "wksp_00000000-0000-7000-8000-0000000000a1",
-              organizationId: "org_00000000-0000-7000-8000-000000000aaa",
-              permissionLevel: "member",
-              enabled: true,
-              keyIssuedToMembershipId:
-                "member_00000000-0000-7000-8000-0000000000f1",
-              lastActiveAt: null,
-              responsible: {
-                id: "member_00000000-0000-7000-8000-0000000000f2",
-                userId: user.id,
-              },
-            }
-          : null,
-    );
-    (db.agent.update as jest.Mock).mockResolvedValue({});
-    const agent = await postCode({ authorization: `Bearer ${agentKey}` });
-    expect(agent.statusCode).toBe(403);
-
-    // A hub credential: this route is not on its list.
-    const credential = await signIn();
-    state.verifications.length = 0;
-    const hub = await postCode({
-      authorization: `Bearer ${credential}`,
-      "x-ailk-spoke-key": spoke.key,
-    });
-    expect(hub.statusCode).toBe(404);
-
-    expect(state.verifications).toHaveLength(0);
-  });
-
-  it("maps the service's refusals: unregistered callback 400, unverified email 403, bad body 400", async () => {
-    const callback = await postCode(cookieHeaders(), {
-      redirectUri: "https://attacker.example.com/api/hub-session/callback",
-    });
-    expect(callback.statusCode).toBe(400);
-    expect(callback.json().error.code).toBe("invalid_redirect_uri");
-
-    const body = await postCode(cookieHeaders(), { codeChallenge: "short" });
-    expect(body.statusCode).toBe(400);
-    expect(body.json().error.code).toBe("invalid_request");
-
-    user.emailVerified = false;
-    const unverified = await postCode(cookieHeaders());
-    expect(unverified.statusCode).toBe(403);
-    expect(unverified.json().error.code).toBe("email_unverified");
-    expect(state.verifications).toHaveLength(0);
-  });
-
-  it("answers 429 with Retry-After past the per-user budget", async () => {
-    let last = await postCode(cookieHeaders());
-    for (let i = 0; i < 30; i += 1) last = await postCode(cookieHeaders());
-    expect(last.statusCode).toBe(429);
-    expect(Number(last.headers["retry-after"])).toBeGreaterThan(0);
-    expect(last.json().error.code).toBe("rate_limited");
-  });
-});
-
-describe("AC-4: one cookie session, two spokes", () => {
-  it("signs the same person in to both: two grants, one userId, different clients — and each credential works only with its own spoke's key", async () => {
-    const other = seedSpoke(state, "other.example.com");
-
-    const credentialA = await signIn(spoke);
-    const credentialB = await signIn(other);
-
-    expect(state.authorizations).toHaveLength(2);
-    expect(new Set(state.authorizations.map((g) => g.userId))).toEqual(
-      new Set([user.id]),
-    );
-    expect(new Set(state.authorizations.map((g) => g.clientId)).size).toBe(2);
-
-    const me = (credential: string, s: SeededSpoke) =>
-      app.inject({
-        method: "GET",
-        url: "/v1/hub-sign-in/me",
-        headers: { authorization: `Bearer ${credential}`, "x-ailk-spoke-key": s.key },
-      });
-    expect((await me(credentialA, spoke)).statusCode).toBe(200);
-    expect((await me(credentialB, other)).statusCode).toBe(200);
-    // A's credential with B's key (and the reverse) is refused at the preHandler.
-    expect((await me(credentialA, other)).statusCode).toBe(401);
-    expect((await me(credentialB, spoke)).statusCode).toBe(401);
-  });
-});
-
-describe("POST /v1/hub-sign-in/token", () => {
-  it("exchanges a code: 200, the envelope, no-store, and NEVER a Set-Cookie or a Session", async () => {
-    const { verifier, challenge } = pkcePair();
-    const minted = await postCode(cookieHeaders(), {}, challenge);
-    const { code } = minted.json().data as { code: string };
-
-    const res = await postToken(spoke, { code, codeVerifier: verifier });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.headers["set-cookie"]).toBeUndefined();
-    expect(res.headers["cache-control"]).toBe("no-store");
-    expect(res.json().data).toMatchObject({
-      accessToken: expect.stringMatching(/^ailk_hst_/),
-      tokenType: "Bearer",
-      expiresIn: 86400,
-      user: { id: user.id, email: user.email, emailVerified: true },
-    });
-    expect(db.session.create).not.toHaveBeenCalled();
-    expect(state.sessionCalls).not.toContain("create");
-  });
-
-  it("every refusal is the envelope with the right status and no Set-Cookie", async () => {
-    const { verifier, challenge } = pkcePair();
-    const minted = await postCode(cookieHeaders(), {}, challenge);
-    const { code } = minted.json().data as { code: string };
-
-    const noKey = await app.inject({
-      method: "POST",
-      url: "/v1/hub-sign-in/token",
-      headers: { authorization: spoke.basic },
-      payload: { code, redirectUri: spoke.redirectUri, codeVerifier: verifier },
-    });
-    expect(noKey.statusCode).toBe(401);
-    expect(noKey.json()).toEqual({
-      ok: false,
-      error: {
-        code: "invalid_client",
-        message: "Client authentication failed",
-      },
-    });
-
-    const wrongVerifier = await postToken(spoke, {
-      code,
-      codeVerifier: pkcePair().verifier,
-    });
-    expect(wrongVerifier.statusCode).toBe(400);
-    expect(wrongVerifier.json().error.code).toBe("invalid_grant");
-
-    const malformed = await postToken(spoke, {
-      code: "short",
-      codeVerifier: "v",
-    });
-    expect(malformed.statusCode).toBe(400);
-    expect(malformed.json().error.code).toBe("invalid_request");
-
-    for (const res of [noKey, wrongVerifier, malformed]) {
-      expect(res.headers["set-cookie"]).toBeUndefined();
-    }
-    expect(state.authorizations).toHaveLength(0);
-  });
-
-  it("is reachable without any person's session (it sits outside the auth scope)", async () => {
-    const res = await postToken(spoke, {
-      code: "x".repeat(43),
-      codeVerifier: pkcePair().verifier,
-    });
-    // 400 invalid_grant — not the preHandler's 401.
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error.code).toBe("invalid_grant");
-  });
-});
-
-describe("POST /v1/hub-sign-in/revoke", () => {
-  it("revokes a credential, which the preHandler then refuses", async () => {
-    const credential = await signIn();
-    const me = () =>
-      app.inject({
-        method: "GET",
-        url: "/v1/hub-sign-in/me",
-        headers: {
-          authorization: `Bearer ${credential}`,
-          "x-ailk-spoke-key": spoke.key,
-        },
-      });
-    expect((await me()).statusCode).toBe(200);
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/hub-sign-in/revoke",
-      headers: { authorization: spoke.basic, "x-ailk-spoke-key": spoke.key },
-      payload: { accessToken: credential },
-    });
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, data: { revoked: true } });
-    expect((await me()).statusCode).toBe(401);
-  });
-
-  it("is 401 invalid_client without the spoke key", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/hub-sign-in/revoke",
-      headers: { authorization: spoke.basic },
-      payload: { code: "x".repeat(43) },
-    });
-    expect(res.statusCode).toBe(401);
-  });
-});
-
-describe("GET /v1/hub-sign-in/me", () => {
-  it("answers the credential's person, with a null customer id when no Person of the spoke's workspace is theirs", async () => {
-    const credential = await signIn();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/hub-sign-in/me",
-      headers: {
-        authorization: `Bearer ${credential}`,
-        "x-ailk-spoke-key": spoke.key,
-      },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.headers["cache-control"]).toBe("no-store");
-    expect(res.json()).toEqual({
-      ok: true,
-      data: {
-        user: {
-          id: user.id,
-          name: user.name,
-          email: user.email,
-          emailVerified: true,
-          createdAt: user.createdAt.toISOString(),
-        },
-        billingCustomerId: null,
-      },
-    });
-  });
-
-  it("vouches for the customer id of the Person in the credential's OWN spoke workspace (#7961, D13)", async () => {
-    const other = seedSpoke(state, "other.example.com");
-    const people = [
-      { id: "person_a", workspaceId: spoke.spoke.workspaceId, email: user.email, userId: user.id, billingCustomerId: "cus_a" },
-      { id: "person_b", workspaceId: other.spoke.workspaceId, email: user.email, userId: user.id, billingCustomerId: "cus_b" },
-    ];
-    db.person.findFirst.mockImplementation((async ({
-      where,
-    }: {
-      where: Record<string, unknown>;
-    }) =>
-      people.find((row) =>
-        Object.entries(where).every(
-          ([key, value]) => row[key as keyof (typeof people)[number]] === value,
-        ),
-      ) ?? null) as never);
-
-    for (const [s, expected] of [
-      [spoke, "cus_a"],
-      [other, "cus_b"],
-    ] as const) {
-      const credential = await signIn(s);
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/hub-sign-in/me",
-        headers: {
-          authorization: `Bearer ${credential}`,
-          "x-ailk-spoke-key": s.key,
-        },
-      });
-      expect(res.statusCode).toBe(200);
-      expect(res.json().data.billingCustomerId).toBe(expected);
-    }
-  });
-
-  it("is 404 for a cookie session — only the hub credential reaches it", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/hub-sign-in/me",
-      headers: cookieHeaders(),
-    });
-    expect(res.statusCode).toBe(404);
-  });
-
-  it("is 401 with the credential but no spoke key, or with another spoke's key", async () => {
-    const credential = await signIn();
-    const other = seedSpoke(state, "other.example.com");
-
-    const noKey = await app.inject({
-      method: "GET",
-      url: "/v1/hub-sign-in/me",
-      headers: { authorization: `Bearer ${credential}` },
-    });
-    expect(noKey.statusCode).toBe(401);
-
-    const wrongKey = await app.inject({
-      method: "GET",
-      url: "/v1/hub-sign-in/me",
-      headers: {
-        authorization: `Bearer ${credential}`,
-        "x-ailk-spoke-key": other.key,
-      },
-    });
-    expect(wrongKey.statusCode).toBe(401);
-  });
-});
-
-describe("GET /v1/hub-sign-in/clients/:clientId (#8790 D2)", () => {
-  const read = (clientId: string) =>
-    app.inject({
-      method: "GET",
-      url: `/v1/hub-sign-in/clients/${encodeURIComponent(clientId)}`,
-    });
-
-  it("answers a live client's name and origin, and nothing else", async () => {
-    const res = await read(spoke.spoke.id);
-    expect(res.statusCode).toBe(200);
-    expect(res.headers["cache-control"]).toBe("no-store");
-    expect(res.json()).toEqual({
-      ok: true,
-      data: {
-        clientId: spoke.spoke.id,
-        name: spoke.spoke.name,
-        origin: new URL(spoke.client.redirectUris[0]!).origin,
-      },
-    });
-  });
-
-  it("is a 404 for an unknown client id", async () => {
-    const res = await read("spoke_nope");
-    expect(res.statusCode).toBe(404);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "not_found", message: "Not found" },
-    });
-  });
-
-  it("is the same 404 for a disabled client", async () => {
-    spoke.client.enabled = false;
-    const res = await read(spoke.spoke.id);
-    expect(res.statusCode).toBe(404);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "not_found", message: "Not found" },
-    });
-  });
-
-  it("is the same 404 for a revoked spoke", async () => {
-    spoke.spoke.revokedAt = new Date();
-    const res = await read(spoke.spoke.id);
-    expect(res.statusCode).toBe(404);
-  });
-});