doover-js 0.1.2 → 0.2.0

package/dist/test/auth.test.js

@@ -0,0 +1,502 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const chai_as_promised_1 = __importDefault(require("chai-as-promised"));
+const mocha_1 = require("mocha");
+const sinon_1 = __importDefault(require("sinon"));
+const auth_profile_1 = require("../auth/auth-profile");
+const build_auth_1 = require("../auth/build-auth");
+const cookie_auth_1 = require("../auth/cookie-auth");
+const doover_token_auth_1 = require("../auth/doover-token-auth");
+const errors_1 = require("../auth/errors");
+const jwt_1 = require("../auth/jwt");
+const doover_client_1 = require("../client/doover-client");
+const gateway_client_1 = require("../gateway/gateway-client");
+const rest_client_1 = require("../http/rest-client");
+const helpers_1 = require("./helpers");
+(0, chai_1.use)(chai_as_promised_1.default);
+// ---------------------------------------------------------------------------
+// Helper: create a minimal JWT with a given `exp` claim
+// ---------------------------------------------------------------------------
+function makeJwt(exp) {
+    const header = Buffer.from(JSON.stringify({ alg: "HS256" })).toString("base64url");
+    const payload = Buffer.from(JSON.stringify({ exp })).toString("base64url");
+    return `${header}.${payload}.fakesig`;
+}
+// ---------------------------------------------------------------------------
+// Helper: in-memory AuthProfileStore
+// ---------------------------------------------------------------------------
+class MemoryProfileStore {
+    constructor() {
+        this.currentProfile = null;
+        this.current = null;
+        this.profiles = new Map();
+        this.writeCalled = 0;
+    }
+    get(name) {
+        return this.profiles.get(name);
+    }
+    create(entry) {
+        this.profiles.set(entry.profile, entry);
+    }
+    delete(name) {
+        this.profiles.delete(name);
+    }
+    write() {
+        this.writeCalled++;
+    }
+}
+// ---------------------------------------------------------------------------
+// CookieAuth
+// ---------------------------------------------------------------------------
+(0, mocha_1.describe)("CookieAuth", () => {
+    (0, mocha_1.it)("sends no auth header and uses credentials: include", async () => {
+        const auth = new cookie_auth_1.CookieAuth();
+        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({});
+        (0, chai_1.expect)(auth.getFetchCredentials()).to.equal("include");
+    });
+    (0, mocha_1.it)("prepareWebSocket returns the URL unchanged", async () => {
+        const auth = new cookie_auth_1.CookieAuth();
+        const result = await auth.prepareWebSocket("wss://example.com/ws", true);
+        (0, chai_1.expect)(result).to.deep.equal({ url: "wss://example.com/ws" });
+    });
+    (0, mocha_1.it)("ensureReady resolves immediately", async () => {
+        const auth = new cookie_auth_1.CookieAuth();
+        await auth.ensureReady(); // should not throw
+    });
+});
+// ---------------------------------------------------------------------------
+// DooverTokenAuth
+// ---------------------------------------------------------------------------
+(0, mocha_1.describe)("DooverTokenAuth", () => {
+    (0, mocha_1.afterEach)(() => sinon_1.default.restore());
+    (0, mocha_1.it)("sends bearer header and uses credentials: omit", async () => {
+        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "tok123" });
+        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
+            Authorization: "Bearer tok123",
+        });
+        (0, chai_1.expect)(auth.getFetchCredentials()).to.equal("omit");
+    });
+    (0, mocha_1.it)("returns empty headers when no token is set", async () => {
+        const auth = new doover_token_auth_1.DooverTokenAuth({});
+        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({});
+    });
+    (0, mocha_1.it)("setToken updates the token", async () => {
+        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "old" });
+        auth.setToken("new-token");
+        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
+            Authorization: "Bearer new-token",
+        });
+    });
+    // -- Refresh behaviour ----------------------------------------------------
+    (0, mocha_1.it)("does not refresh when token is clearly valid", async () => {
+        const farFuture = Date.now() + 3600000;
+        const fetchMock = (0, helpers_1.createFetchMock)();
+        const auth = new doover_token_auth_1.DooverTokenAuth({
+            token: "valid",
+            tokenExpires: new Date(farFuture),
+            refreshToken: "rt",
+            authServerUrl: "https://auth.example.com",
+            authServerClientId: "client-1",
+            fetchImpl: fetchMock,
+        });
+        await auth.ensureReady();
+        (0, chai_1.expect)(fetchMock.callCount).to.equal(0);
+    });
+    (0, mocha_1.it)("triggers refresh when token is missing", async () => {
+        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({
+            access_token: "new-tok",
+            expires_in: 3600,
+        }));
+        const auth = new doover_token_auth_1.DooverTokenAuth({
+            token: null,
+            refreshToken: "rt",
+            authServerUrl: "https://auth.example.com",
+            authServerClientId: "client-1",
+            fetchImpl: fetchMock,
+        });
+        await auth.ensureReady();
+        (0, chai_1.expect)(fetchMock.callCount).to.equal(1);
+        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
+            Authorization: "Bearer new-tok",
+        });
+    });
+    (0, mocha_1.it)("triggers refresh within the 30-second expiry buffer", async () => {
+        const almostExpired = Date.now() + 15000; // 15 s left
+        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({
+            access_token: "refreshed-tok",
+            expires_in: 3600,
+        }));
+        const auth = new doover_token_auth_1.DooverTokenAuth({
+            token: "old-tok",
+            tokenExpires: new Date(almostExpired),
+            refreshToken: "rt",
+            authServerUrl: "https://auth.example.com",
+            authServerClientId: "client-1",
+            fetchImpl: fetchMock,
+        });
+        await auth.ensureReady();
+        (0, chai_1.expect)(fetchMock.callCount).to.equal(1);
+        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
+            Authorization: "Bearer refreshed-tok",
+        });
+    });
+    (0, mocha_1.it)("throws DooverAuthError when refresh metadata is incomplete", async () => {
+        const auth = new doover_token_auth_1.DooverTokenAuth({
+            token: null,
+            // No refreshToken, authServerUrl, or authServerClientId
+        });
+        await (0, chai_1.expect)(auth.ensureReady()).to.be.rejectedWith(errors_1.DooverAuthError, /missing authServerUrl/);
+    });
+    (0, mocha_1.it)("throws DooverAuthError when refresh HTTP request fails", async () => {
+        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({ error: "invalid_grant" }, { status: 400 }));
+        const auth = new doover_token_auth_1.DooverTokenAuth({
+            token: null,
+            refreshToken: "rt",
+            authServerUrl: "https://auth.example.com",
+            authServerClientId: "client-1",
+            fetchImpl: fetchMock,
+        });
+        await (0, chai_1.expect)(auth.ensureReady()).to.be.rejectedWith(errors_1.DooverAuthError, /status 400/);
+    });
+    (0, mocha_1.it)("writes refreshed token back to the attached ConfigManager", async () => {
+        const store = new MemoryProfileStore();
+        const profile = new auth_profile_1.AuthProfile({
+            profile: "test",
+            refreshToken: "rt",
+            authServerUrl: "https://auth.example.com",
+            authServerClientId: "client-1",
+        });
+        store.create(profile);
+        const fetchMock = (0, helpers_1.createFetchMock)(() => (0, helpers_1.createJsonResponse)({
+            access_token: "refreshed",
+            expires_in: 3600,
+            refresh_token: "new-rt",
+        }));
+        // Construct with no token so refresh is triggered
+        const auth = new doover_token_auth_1.DooverTokenAuth({
+            refreshToken: "rt",
+            authServerUrl: "https://auth.example.com",
+            authServerClientId: "client-1",
+            fetchImpl: fetchMock,
+        });
+        auth.attachProfile(profile, store);
+        await auth.ensureReady();
+        (0, chai_1.expect)(profile.token).to.equal("refreshed");
+        (0, chai_1.expect)(profile.refreshToken).to.equal("new-rt");
+        (0, chai_1.expect)(store.writeCalled).to.equal(1);
+    });
+    // -- WebSocket auth -------------------------------------------------------
+    (0, mocha_1.it)("prepareWebSocket uses Authorization header when canUseHeaders is true", async () => {
+        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "ws-tok" });
+        const result = await auth.prepareWebSocket("wss://ws.example.com", true);
+        (0, chai_1.expect)(result.url).to.equal("wss://ws.example.com");
+        (0, chai_1.expect)(result.headers).to.deep.equal({
+            Authorization: "Bearer ws-tok",
+        });
+    });
+    (0, mocha_1.it)("prepareWebSocket appends ?token= when canUseHeaders is false", async () => {
+        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "ws-tok" });
+        const result = await auth.prepareWebSocket("wss://ws.example.com/path", false);
+        (0, chai_1.expect)(result.url).to.equal("wss://ws.example.com/path?token=ws-tok");
+        (0, chai_1.expect)(result.headers).to.be.undefined;
+    });
+});
+// ---------------------------------------------------------------------------
+// JWT expiry decoding
+// ---------------------------------------------------------------------------
+(0, mocha_1.describe)("JWT decodeTokenExpiry", () => {
+    (0, mocha_1.it)("decodes token exp claim", () => {
+        const exp = Math.floor(Date.now() / 1000) + 3600;
+        const token = makeJwt(exp);
+        const result = (0, jwt_1.decodeTokenExpiry)(token);
+        (0, chai_1.expect)(result).to.be.instanceOf(Date);
+        (0, chai_1.expect)(result.getTime()).to.equal(exp * 1000);
+    });
+    (0, mocha_1.it)("returns null for tokens without exp", () => {
+        const header = Buffer.from(JSON.stringify({ alg: "HS256" })).toString("base64url");
+        const payload = Buffer.from(JSON.stringify({ sub: "user" })).toString("base64url");
+        (0, chai_1.expect)((0, jwt_1.decodeTokenExpiry)(`${header}.${payload}.sig`)).to.equal(null);
+    });
+    (0, mocha_1.it)("returns null for malformed tokens", () => {
+        (0, chai_1.expect)((0, jwt_1.decodeTokenExpiry)("not-a-jwt")).to.equal(null);
+        (0, chai_1.expect)((0, jwt_1.decodeTokenExpiry)("")).to.equal(null);
+    });
+});
+// ---------------------------------------------------------------------------
+// AuthProfile parse / dump
+// ---------------------------------------------------------------------------
+(0, mocha_1.describe)("AuthProfile", () => {
+    (0, mocha_1.it)("parses reduced-format config lines", () => {
+        const lines = [
+            "TOKEN=abc123",
+            "TOKEN_EXPIRES=2026-01-01T00:00:00.000Z",
+            "AGENT_ID=agent-1",
+            "BASE_URL=https://control.example.com",
+            "BASE_DATA_URL=https://data.example.com",
+            "REFRESH_TOKEN=rt-xyz",
+            "REFRESH_TOKEN_ID=rti-1",
+            "AUTH_SERVER_URL=https://auth.example.com",
+            "AUTH_SERVER_CLIENT_ID=client-1",
+        ];
+        const profile = auth_profile_1.AuthProfile.parse("prod", lines);
+        (0, chai_1.expect)(profile.profile).to.equal("prod");
+        (0, chai_1.expect)(profile.token).to.equal("abc123");
+        (0, chai_1.expect)(profile.tokenExpires).to.equal("2026-01-01T00:00:00.000Z");
+        (0, chai_1.expect)(profile.agentId).to.equal("agent-1");
+        (0, chai_1.expect)(profile.controlBaseUrl).to.equal("https://control.example.com");
+        (0, chai_1.expect)(profile.dataBaseUrl).to.equal("https://data.example.com");
+        (0, chai_1.expect)(profile.refreshToken).to.equal("rt-xyz");
+        (0, chai_1.expect)(profile.refreshTokenId).to.equal("rti-1");
+        (0, chai_1.expect)(profile.authServerUrl).to.equal("https://auth.example.com");
+        (0, chai_1.expect)(profile.authServerClientId).to.equal("client-1");
+    });
+    (0, mocha_1.it)("dumps back to the same reduced format", () => {
+        const profile = new auth_profile_1.AuthProfile({
+            profile: "test",
+            token: "tok",
+            agentId: "a1",
+            refreshToken: "rt",
+        });
+        const dumped = profile.dump();
+        (0, chai_1.expect)(dumped).to.include("TOKEN=tok");
+        (0, chai_1.expect)(dumped).to.include("AGENT_ID=a1");
+        (0, chai_1.expect)(dumped).to.include("REFRESH_TOKEN=rt");
+        // Null fields should be absent
+        (0, chai_1.expect)(dumped).not.to.include("TOKEN_EXPIRES");
+        (0, chai_1.expect)(dumped).not.to.include("BASE_URL");
+    });
+    (0, mocha_1.it)("dumpBlock includes the [profile=...] header", () => {
+        const profile = new auth_profile_1.AuthProfile({ profile: "dev", token: "t1" });
+        const block = profile.dumpBlock();
+        (0, chai_1.expect)(block).to.match(/^\[profile=dev\]/);
+        (0, chai_1.expect)(block).to.include("TOKEN=t1");
+    });
+});
+// ---------------------------------------------------------------------------
+// buildAuth
+// ---------------------------------------------------------------------------
+(0, mocha_1.describe)("buildAuth", () => {
+    (0, mocha_1.it)("returns provided auth as-is", () => {
+        const auth = new cookie_auth_1.CookieAuth();
+        (0, chai_1.expect)((0, build_auth_1.buildAuth)({ auth })).to.equal(auth);
+    });
+    (0, mocha_1.it)("throws when auth is combined with raw auth config", () => {
+        const auth = new cookie_auth_1.CookieAuth();
+        (0, chai_1.expect)(() => (0, build_auth_1.buildAuth)({ auth, token: "tok" })).to.throw(errors_1.DooverAuthError, /Cannot combine/);
+    });
+    (0, mocha_1.it)("builds CookieAuth when no token-related input is present", () => {
+        (0, chai_1.expect)((0, build_auth_1.buildAuth)({})).to.be.instanceOf(cookie_auth_1.CookieAuth);
+    });
+    (0, mocha_1.it)("builds DooverTokenAuth when token is provided", () => {
+        const auth = (0, build_auth_1.buildAuth)({ token: "tok" });
+        (0, chai_1.expect)(auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
+    });
+    (0, mocha_1.it)("builds DooverTokenAuth from an AuthProfile with token", () => {
+        const profile = new auth_profile_1.AuthProfile({ profile: "test", token: "t1" });
+        const auth = (0, build_auth_1.buildAuth)({ profile });
+        (0, chai_1.expect)(auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
+    });
+    (0, mocha_1.it)("explicit raw fields override profile-loaded values", async () => {
+        const profile = new auth_profile_1.AuthProfile({ profile: "test", token: "profile-tok" });
+        const auth = (0, build_auth_1.buildAuth)({ profile, token: "override-tok" });
+        (0, chai_1.expect)(auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
+        (0, chai_1.expect)(await auth.getHttpHeaders()).to.deep.equal({
+            Authorization: "Bearer override-tok",
+        });
+    });
+    (0, mocha_1.it)("resolves a string profile via configManager", () => {
+        const store = new MemoryProfileStore();
+        store.create(new auth_profile_1.AuthProfile({ profile: "staging", token: "st" }));
+        const auth = (0, build_auth_1.buildAuth)({ profile: "staging", configManager: store });
+        (0, chai_1.expect)(auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
+    });
+    (0, mocha_1.it)("throws when profile is a string without configManager", () => {
+        (0, chai_1.expect)(() => (0, build_auth_1.buildAuth)({ profile: "staging" })).to.throw(errors_1.DooverAuthError, /configManager/);
+    });
+    (0, mocha_1.it)("throws when string profile is not found in configManager", () => {
+        const store = new MemoryProfileStore();
+        (0, chai_1.expect)(() => (0, build_auth_1.buildAuth)({ profile: "nope", configManager: store })).to.throw(errors_1.DooverAuthError, /not found/);
+    });
+});
+// ---------------------------------------------------------------------------
+// DooverClient shared auth instance
+// ---------------------------------------------------------------------------
+(0, mocha_1.describe)("DooverClient auth sharing", () => {
+    (0, mocha_1.beforeEach)(() => {
+        (0, helpers_1.installSessionStorageMock)();
+        helpers_1.MockWebSocket.reset();
+        Object.defineProperty(globalThis, "WebSocket", {
+            value: helpers_1.MockWebSocket,
+            configurable: true,
+            writable: true,
+        });
+    });
+    (0, mocha_1.it)("shares one auth instance across REST and gateway", () => {
+        const client = new doover_client_1.DooverClient({
+            dataRestUrl: "https://api.example.com",
+            controlApiUrl: "https://control.example.com",
+            dataWssUrl: "wss://ws.example.com",
+            token: "shared-tok",
+            fetchImpl: (0, helpers_1.createFetchMock)(),
+            webSocketImpl: helpers_1.MockWebSocket,
+        });
+        (0, chai_1.expect)(client.auth).to.be.instanceOf(doover_token_auth_1.DooverTokenAuth);
+        (0, chai_1.expect)(client.rest.auth).to.equal(client.auth);
+        // viewer's internal rest and gateway should also share the same auth
+        (0, chai_1.expect)(client.viewer.rest.auth).to.equal(client.auth);
+    });
+    (0, mocha_1.it)("defaults to CookieAuth when no auth inputs are provided", () => {
+        const client = new doover_client_1.DooverClient({
+            dataRestUrl: "https://api.example.com",
+            controlApiUrl: "https://control.example.com",
+            dataWssUrl: "wss://ws.example.com",
+            fetchImpl: (0, helpers_1.createFetchMock)(),
+            webSocketImpl: helpers_1.MockWebSocket,
+        });
+        (0, chai_1.expect)(client.auth).to.be.instanceOf(cookie_auth_1.CookieAuth);
+    });
+});
+// ---------------------------------------------------------------------------
+// GatewayClient auth integration
+// ---------------------------------------------------------------------------
+(0, mocha_1.describe)("GatewayClient auth integration", () => {
+    (0, mocha_1.beforeEach)(() => {
+        helpers_1.MockWebSocket.reset();
+        Object.defineProperty(globalThis, "WebSocket", {
+            value: helpers_1.MockWebSocket,
+            configurable: true,
+            writable: true,
+        });
+    });
+    (0, mocha_1.afterEach)(() => sinon_1.default.restore());
+    (0, mocha_1.it)("appends ?token= when using token auth without webSocketFactory", async () => {
+        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "gw-tok" });
+        const gw = new gateway_client_1.GatewayClient({
+            dataRestUrl: "https://api.example.com",
+            controlApiUrl: "https://control.example.com",
+            dataWssUrl: "wss://ws.example.com",
+            webSocketImpl: helpers_1.MockWebSocket,
+        }, auth);
+        await gw.connect();
+        const ws = helpers_1.MockWebSocket.instances[0];
+        (0, chai_1.expect)(ws.url).to.equal("wss://ws.example.com/?token=gw-tok");
+    });
+    (0, mocha_1.it)("uses webSocketFactory with Authorization header for token auth", async () => {
+        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "factory-tok" });
+        let capturedHeaders;
+        const factory = (opts) => {
+            capturedHeaders = opts.headers;
+            return new helpers_1.MockWebSocket(opts.url);
+        };
+        const gw = new gateway_client_1.GatewayClient({
+            dataRestUrl: "https://api.example.com",
+            controlApiUrl: "https://control.example.com",
+            dataWssUrl: "wss://ws.example.com",
+            webSocketFactory: factory,
+        }, auth);
+        await gw.connect();
+        (0, chai_1.expect)(capturedHeaders).to.deep.equal({
+            Authorization: "Bearer factory-tok",
+        });
+        // URL should NOT have the token query param
+        const ws = helpers_1.MockWebSocket.instances[0];
+        (0, chai_1.expect)(ws.url).to.equal("wss://ws.example.com");
+    });
+    (0, mocha_1.it)("cookie auth leaves websocket URL unchanged", async () => {
+        const auth = new cookie_auth_1.CookieAuth();
+        const gw = new gateway_client_1.GatewayClient({
+            dataRestUrl: "https://api.example.com",
+            controlApiUrl: "https://control.example.com",
+            dataWssUrl: "wss://ws.example.com",
+            webSocketImpl: helpers_1.MockWebSocket,
+        }, auth);
+        await gw.connect();
+        const ws = helpers_1.MockWebSocket.instances[0];
+        (0, chai_1.expect)(ws.url).to.equal("wss://ws.example.com");
+    });
+    (0, mocha_1.it)("reconnect uses newly refreshed token", async () => {
+        let callCount = 0;
+        const fetchMock = (0, helpers_1.createFetchMock)(() => {
+            callCount++;
+            return (0, helpers_1.createJsonResponse)({
+                access_token: `refreshed-${callCount}`,
+                expires_in: 3600,
+            });
+        });
+        const auth = new doover_token_auth_1.DooverTokenAuth({
+            token: null,
+            refreshToken: "rt",
+            authServerUrl: "https://auth.example.com",
+            authServerClientId: "c1",
+            fetchImpl: fetchMock,
+        });
+        const gw = new gateway_client_1.GatewayClient({
+            dataRestUrl: "https://api.example.com",
+            controlApiUrl: "https://control.example.com",
+            dataWssUrl: "wss://ws.example.com",
+            webSocketImpl: helpers_1.MockWebSocket,
+        }, auth);
+        await gw.connect();
+        const ws1 = helpers_1.MockWebSocket.instances[0];
+        (0, chai_1.expect)(ws1.url).to.include("token=refreshed-1");
+        // Simulate disconnect + reconnect
+        gw.disconnect();
+        // Clear the token to force a re-refresh
+        auth.setToken(null);
+        await gw.connect();
+        const ws2 = helpers_1.MockWebSocket.instances[1];
+        (0, chai_1.expect)(ws2.url).to.include("token=refreshed-2");
+    });
+});
+// ---------------------------------------------------------------------------
+// RestClient auth integration
+// ---------------------------------------------------------------------------
+(0, mocha_1.describe)("RestClient auth integration", () => {
+    (0, mocha_1.beforeEach)(() => (0, helpers_1.installSessionStorageMock)());
+    (0, mocha_1.it)("sends Authorization header with token auth", async () => {
+        const auth = new doover_token_auth_1.DooverTokenAuth({ token: "rest-tok" });
+        const fetchMock = (0, helpers_1.createFetchMock)();
+        const client = new rest_client_1.RestClient({
+            dataRestUrl: "https://api.example.com",
+            controlApiUrl: "https://control.example.com",
+            dataWssUrl: "wss://ws.example.com",
+            fetchImpl: fetchMock,
+        }, auth);
+        await client.get("/items");
+        const [, init] = fetchMock.getCall(0).args;
+        const headers = init?.headers;
+        (0, chai_1.expect)(headers.get("Authorization")).to.equal("Bearer rest-tok");
+        (0, chai_1.expect)(init?.credentials).to.equal("omit");
+    });
+    (0, mocha_1.it)("uses credentials: include with cookie auth", async () => {
+        const auth = new cookie_auth_1.CookieAuth();
+        const fetchMock = (0, helpers_1.createFetchMock)();
+        const client = new rest_client_1.RestClient({
+            dataRestUrl: "https://api.example.com",
+            controlApiUrl: "https://control.example.com",
+            dataWssUrl: "wss://ws.example.com",
+            fetchImpl: fetchMock,
+        }, auth);
+        await client.get("/items");
+        const [, init] = fetchMock.getCall(0).args;
+        const headers = init?.headers;
+        (0, chai_1.expect)(headers.get("Authorization")).to.equal(null);
+        (0, chai_1.expect)(init?.credentials).to.equal("include");
+    });
+    (0, mocha_1.it)("uses credentials: include when no auth is provided (backward compat)", async () => {
+        const fetchMock = (0, helpers_1.createFetchMock)();
+        const client = new rest_client_1.RestClient({
+            dataRestUrl: "https://api.example.com",
+            controlApiUrl: "https://control.example.com",
+            dataWssUrl: "wss://ws.example.com",
+            fetchImpl: fetchMock,
+        });
+        await client.get("/items");
+        const [, init] = fetchMock.getCall(0).args;
+        (0, chai_1.expect)(init?.credentials).to.equal("include");
+    });
+});

package/dist/test/config-manager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/config-manager.test.js

@@ -0,0 +1,160 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const mocha_1 = require("mocha");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const config_manager_1 = require("../node/config-manager");
+const auth_profile_1 = require("../auth/auth-profile");
+function tmpConfigPath() {
+    return path.join(os.tmpdir(), `doover-test-${Date.now()}-${Math.random().toString(36).slice(2)}`, "config");
+}
+function cleanup(configPath) {
+    try {
+        fs.unlinkSync(configPath);
+    }
+    catch { /* ignore */ }
+    try {
+        fs.rmdirSync(path.dirname(configPath));
+    }
+    catch { /* ignore */ }
+}
+(0, mocha_1.describe)("ConfigManager", () => {
+    const paths = [];
+    (0, mocha_1.afterEach)(() => {
+        for (const p of paths) {
+            cleanup(p);
+        }
+        paths.length = 0;
+    });
+    (0, mocha_1.it)("starts empty when config file does not exist", () => {
+        const p = tmpConfigPath();
+        paths.push(p);
+        const mgr = new config_manager_1.ConfigManager(p);
+        (0, chai_1.expect)(mgr.currentProfile).to.equal(null);
+        (0, chai_1.expect)(mgr.current).to.equal(null);
+        (0, chai_1.expect)(mgr.get("any")).to.be.undefined;
+    });
+    (0, mocha_1.it)("parses a reduced-format Doover2 config file", () => {
+        const p = tmpConfigPath();
+        paths.push(p);
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, [
+            "[profile=prod]",
+            "TOKEN=abc123",
+            "AGENT_ID=agent-1",
+            "REFRESH_TOKEN=rt-xyz",
+            "AUTH_SERVER_URL=https://auth.example.com",
+            "AUTH_SERVER_CLIENT_ID=client-1",
+            "",
+            "[profile=staging]",
+            "TOKEN=stg-tok",
+        ].join("\n"), "utf-8");
+        const mgr = new config_manager_1.ConfigManager(p);
+        (0, chai_1.expect)(mgr.currentProfile).to.equal("prod");
+        const prod = mgr.get("prod");
+        (0, chai_1.expect)(prod).to.not.be.undefined;
+        (0, chai_1.expect)(prod.token).to.equal("abc123");
+        (0, chai_1.expect)(prod.agentId).to.equal("agent-1");
+        (0, chai_1.expect)(prod.refreshToken).to.equal("rt-xyz");
+        const staging = mgr.get("staging");
+        (0, chai_1.expect)(staging).to.not.be.undefined;
+        (0, chai_1.expect)(staging.token).to.equal("stg-tok");
+    });
+    (0, mocha_1.it)("preserves legacy Doover1 blocks verbatim", () => {
+        const p = tmpConfigPath();
+        paths.push(p);
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        const legacyBlock = "[legacy-section]\nSOME_KEY=some_value\nOTHER=123";
+        fs.writeFileSync(p, `${legacyBlock}\n\n[profile=prod]\nTOKEN=t1\n`, "utf-8");
+        const mgr = new config_manager_1.ConfigManager(p);
+        mgr.write();
+        const written = fs.readFileSync(p, "utf-8");
+        // The legacy block should appear verbatim before the managed profile
+        (0, chai_1.expect)(written).to.include("[legacy-section]\nSOME_KEY=some_value\nOTHER=123");
+        (0, chai_1.expect)(written).to.include("[profile=prod]\nTOKEN=t1");
+    });
+    (0, mocha_1.it)("rewrites legacy Doover2 blocks back in reduced format", () => {
+        const p = tmpConfigPath();
+        paths.push(p);
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, "[profile=test]\nTOKEN=old\nAGENT_ID=a1\n", "utf-8");
+        const mgr = new config_manager_1.ConfigManager(p);
+        // Modify the profile
+        const profile = mgr.get("test");
+        profile.token = "new-token";
+        mgr.create(profile);
+        mgr.write();
+        const written = fs.readFileSync(p, "utf-8");
+        (0, chai_1.expect)(written).to.include("TOKEN=new-token");
+        (0, chai_1.expect)(written).to.include("AGENT_ID=a1");
+    });
+    (0, mocha_1.it)("write() creates the .doover directory if missing", () => {
+        const p = tmpConfigPath();
+        paths.push(p);
+        const mgr = new config_manager_1.ConfigManager(p);
+        const profile = new auth_profile_1.AuthProfile({ profile: "test", token: "t" });
+        mgr.create(profile);
+        mgr.write();
+        (0, chai_1.expect)(fs.existsSync(p)).to.equal(true);
+        const content = fs.readFileSync(p, "utf-8");
+        (0, chai_1.expect)(content).to.include("[profile=test]");
+        (0, chai_1.expect)(content).to.include("TOKEN=t");
+    });
+    (0, mocha_1.it)("delete removes a managed profile", () => {
+        const p = tmpConfigPath();
+        paths.push(p);
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, "[profile=a]\nTOKEN=1\n\n[profile=b]\nTOKEN=2\n", "utf-8");
+        const mgr = new config_manager_1.ConfigManager(p);
+        (0, chai_1.expect)(mgr.get("a")).to.not.be.undefined;
+        mgr.delete("a");
+        (0, chai_1.expect)(mgr.get("a")).to.be.undefined;
+        mgr.write();
+        const written = fs.readFileSync(p, "utf-8");
+        (0, chai_1.expect)(written).not.to.include("[profile=a]");
+        (0, chai_1.expect)(written).to.include("[profile=b]");
+    });
+});
+(0, mocha_1.describe)("doover-js/node exports", () => {
+    (0, mocha_1.it)("exports ConfigManager from the node subpath", () => {
+        // Verify the node subpath module re-exports ConfigManager
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const nodeExports = require("../node/index");
+        (0, chai_1.expect)(nodeExports.ConfigManager).to.equal(config_manager_1.ConfigManager);
+    });
+});