minutework 0.1.0

package/assets/templates/next-tenant-app/src/lib/platform/auth.server.test.ts

@@ -0,0 +1,75 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const redirect = vi.fn((href: string) => {
+  throw new Error(`redirect:${href}`);
+});
+const resolveCurrentSession = vi.fn();
+const readPlatformAuthState = vi.fn();
+
+vi.mock("next/navigation", () => ({
+  redirect,
+}));
+
+vi.mock("@/lib/platform/client.server", () => ({
+  resolveCurrentSession,
+}));
+
+vi.mock("@/lib/platform/session.server", () => ({
+  readPlatformAuthState,
+}));
+
+describe("resolveAuthenticatedSession", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.resetModules();
+  });
+
+  it("redirects anonymous sessions to /login", async () => {
+    readPlatformAuthState.mockResolvedValue(null);
+    resolveCurrentSession.mockResolvedValue({ authenticated: false });
+
+    const auth = await import("./auth.server");
+
+    await expect(auth.resolveAuthenticatedSession()).rejects.toThrow(
+      "redirect:/login",
+    );
+    expect(redirect).toHaveBeenCalledWith("/login");
+  });
+
+  it("returns the authenticated platform session", async () => {
+    const session = {
+      authenticated: true as const,
+      user: {
+        id: "user-1",
+        username: "demo-user",
+        email: "demo@example.com",
+      },
+      active_tenant_id: "tenant-1",
+      active_tenant: {
+        tenant_id: "tenant-1",
+        tenant_slug: "alpha",
+        tenant_name: "Alpha",
+        role: "admin",
+      },
+      memberships: [
+        {
+          tenant_id: "tenant-1",
+          tenant_slug: "alpha",
+          tenant_name: "Alpha",
+          role: "admin",
+        },
+      ],
+    };
+
+    readPlatformAuthState.mockResolvedValue({
+      sessionId: "session-1",
+      csrfToken: "csrf-1",
+    });
+    resolveCurrentSession.mockResolvedValue(session);
+
+    const auth = await import("./auth.server");
+
+    await expect(auth.resolveAuthenticatedSession()).resolves.toEqual(session);
+    expect(redirect).not.toHaveBeenCalled();
+  });
+});

package/assets/templates/next-tenant-app/src/lib/platform/auth.server.ts

@@ -0,0 +1,25 @@
+import "server-only";
+
+import { cache } from "react";
+import { redirect } from "next/navigation";
+
+import { appRoutes } from "@/lib/app-routes";
+import { resolveCurrentSession } from "@/lib/platform/client.server";
+import type { AuthenticatedPlatformSession } from "@/lib/platform/contracts";
+import { readPlatformAuthState } from "@/lib/platform/session.server";
+
+const loadResolvedPlatformSession = cache(async () =>
+  resolveCurrentSession(await readPlatformAuthState()),
+);
+
+export const resolvePlatformSession = loadResolvedPlatformSession;
+
+export async function resolveAuthenticatedSession(): Promise<AuthenticatedPlatformSession> {
+  const session = await loadResolvedPlatformSession();
+
+  if (!session.authenticated) {
+    redirect(appRoutes.login);
+  }
+
+  return session;
+}

package/assets/templates/next-tenant-app/src/lib/platform/client.server.test.ts

@@ -0,0 +1,170 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  dispatchTenantCommand,
+  loadCurrentSession,
+  loginWithPassword,
+} from "@/lib/platform/client.server";
+
+const sessionPayload = {
+  user: {
+    id: "user-1",
+    username: "demo-user",
+    email: "demo@example.com",
+  },
+  active_tenant_id: "tenant-1",
+  active_tenant: {
+    tenant_id: "tenant-1",
+    tenant_slug: "alpha",
+    tenant_name: "Alpha",
+    role: "admin",
+  },
+  memberships: [
+    {
+      tenant_id: "tenant-1",
+      tenant_slug: "alpha",
+      tenant_name: "Alpha",
+      role: "admin",
+    },
+  ],
+};
+
+const commandRunPayload = {
+  run_id: "run-1",
+  tenant_id: "tenant-1",
+  runtime_id: "runtime-1",
+  template_key: "echo_hello",
+  status: "queued",
+  safe_summary: "Queued for dispatch.",
+  exit_code: null,
+  stdout_tail: "",
+  stderr_tail: "",
+  source_ref: "runtime:command:1",
+  dispatch_error: "",
+};
+
+function jsonResponse(
+  body: unknown,
+  init?: {
+    status?: number;
+    headers?: Record<string, string>;
+  },
+) {
+  return new Response(body === null ? null : JSON.stringify(body), {
+    status: init?.status ?? 200,
+    headers: {
+      "content-type": "application/json",
+      ...init?.headers,
+    },
+  });
+}
+
+describe("platform client", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("bootstraps an anonymous csrf token while resolving the session", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      jsonResponse(
+        { detail: "Authentication required." },
+        {
+          status: 401,
+          headers: {
+            "set-cookie": "csrftoken=bootstrap-token; Path=/; SameSite=Lax",
+          },
+        },
+      ),
+    );
+
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loadCurrentSession(null);
+
+    expect(result.data).toEqual({ authenticated: false });
+    expect(result.authState).toEqual({
+      sessionId: null,
+      csrfToken: "bootstrap-token",
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("bootstraps csrf before login and persists the returned session cookies", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        jsonResponse(
+          { detail: "Authentication required." },
+          {
+            status: 401,
+            headers: {
+              "set-cookie": "csrftoken=bootstrap-token; Path=/; SameSite=Lax",
+            },
+          },
+        ),
+      )
+      .mockResolvedValueOnce(
+        jsonResponse(sessionPayload, {
+          status: 200,
+          headers: {
+            "set-cookie":
+              "sessionid=session-1; Path=/; HttpOnly, csrftoken=rotated-token; Path=/; SameSite=Lax",
+          },
+        }),
+      );
+
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await loginWithPassword(null, {
+      username: "demo-user",
+      password: "demo-password",
+    });
+
+    const loginHeaders = new Headers(fetchMock.mock.calls[1]?.[1]?.headers);
+
+    expect(loginHeaders.get("x-csrftoken")).toBe("bootstrap-token");
+    expect(loginHeaders.get("cookie")).toBe("csrftoken=bootstrap-token");
+    expect(result.authState).toEqual({
+      sessionId: "session-1",
+      csrfToken: "rotated-token",
+    });
+    expect(result.data.authenticated).toBe(true);
+    expect(result.data.active_tenant_id).toBe("tenant-1");
+  });
+
+  it("forwards the stored session and csrf token on unsafe tenant mutations", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        jsonResponse(sessionPayload, {
+          status: 200,
+          headers: {
+            "set-cookie": "csrftoken=csrf-1; Path=/; SameSite=Lax",
+          },
+        }),
+      )
+      .mockResolvedValueOnce(jsonResponse(commandRunPayload));
+
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await dispatchTenantCommand(
+      { sessionId: "session-1", csrfToken: null },
+      {
+        tenant_id: "tenant-1",
+        template_key: "echo_hello",
+      },
+    );
+
+    const commandHeaders = new Headers(fetchMock.mock.calls[1]?.[1]?.headers);
+
+    expect(commandHeaders.get("cookie")).toBe(
+      "sessionid=session-1; csrftoken=csrf-1",
+    );
+    expect(commandHeaders.get("x-csrftoken")).toBe("csrf-1");
+    expect(result.authState).toEqual({
+      sessionId: "session-1",
+      csrfToken: "csrf-1",
+    });
+    expect(result.data.run_id).toBe("run-1");
+  });
+});