miravo 0.4.0 → 0.6.0

package/src/lib/admin-server.test.ts

@@ -2,8 +2,35 @@ import { afterEach, describe, expect, test } from "bun:test";
 import type { EventEmitter } from "node:events";
 import { createServer } from "node:net";
 import type { EngineCoreMetrics, EngineStateSnapshot } from "@miravo/core";
-import type { CommandResult, EngineCommand } from "@miravo/shared";
+import {
+  type CommandResult,
+  ConsoleBootstrapResponseSchema,
+  type EngineCommand,
+} from "@miravo/shared";
 import { startAdminServer } from "./admin-server.ts";
+import { createSessionStore } from "./session-store.ts";
+
+/** Default test auth config: password "admin", not default. */
+function testAuth() {
+  return {
+    verifyPassword: async (pw: string) => pw === "testpass",
+    isDefaultPassword: false,
+    sessionStore: createSessionStore(),
+    changePassword: async (_old: string, _new: string) => {},
+  };
+}
+
+/** Login to the test server and return the session cookie string for use in headers. */
+async function loginAndGetCookie(baseUrl: string, password = "testpass"): Promise<string> {
+  const res = await fetch(`${baseUrl}/auth/login`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ username: "admin", password }),
+  });
+  if (!res.ok) throw new Error(`Login failed: ${res.status}`);
+  const setCookie = res.headers.get("set-cookie") ?? "";
+  return setCookie.split(";")[0] ?? "";
+}
 
 async function canBindLocalTcp(): Promise<boolean> {
   const probe = createServer();
@@ -140,6 +167,12 @@ function createMockAdminEngine(
       getModelSchema: (_name: string) => undefined,
       getEventLog: () => ({ events: [], nextCursor: null, hasMore: false }),
       getRunningTemplates: () => [],
+      getManifest: () => ({
+        generatedAt: new Date().toISOString(),
+        protocols: {},
+        tags: [],
+        summary: { totalTags: 0, totalInstances: 0, enabledProtocols: [] },
+      }),
       execute: async (command: EngineCommand): Promise<CommandResult> => {
         runtime.executedCommands.push(command);
         return {
@@ -187,6 +220,12 @@ interface StartServerOptions {
   readonly connectedAdapters?: string[];
   /** Adapter names that should report as enabled in the runtime state. */
   readonly enabledAdapters?: string[];
+  readonly getLeExport?:
+    | ((
+        id: string,
+        opts: { host: string; protocol: import("@miravo/shared").ProtocolName | undefined },
+      ) => Promise<{ templateJson: string; tagsCSV: string } | null>)
+    | undefined;
 }
 
 async function startTestServer(options: StartServerOptions, handles: Array<{ stop: () => void }>) {
@@ -207,6 +246,8 @@ async function startTestServer(options: StartServerOptions, handles: Array<{ sto
     protocols: {
       getLastTickProgressAt: () => mock.getLastTickProgressAt(),
     },
+    auth: testAuth(),
+    ...(options.getLeExport ? { getLeExport: options.getLeExport } : {}),
   });
   handles.push(handle);
   const baseUrl = serverBaseUrl(handle.endpoint);
@@ -224,6 +265,7 @@ async function startShutdownTestServer(handles: Array<{ stop: () => void }>): Pr
     engine: mock.engine,
     network: { host: "127.0.0.1", port, tickIntervalMs: 1000 },
     protocols: { getLastTickProgressAt: () => mock.getLastTickProgressAt() },
+    auth: testAuth(),
     requestShutdown: (reason) => {
       shutdownReason = reason;
     },
@@ -242,6 +284,8 @@ describeIfTcp("admin server", () => {
     handles.length = 0;
   });
 
+  // --- Health endpoints (unauthenticated) ---
+
   test.each([
     {
       label: "200 when running and mqtt connected",
@@ -326,11 +370,16 @@ describeIfTcp("admin server", () => {
     expect(recovered.status).toBe(200);
   });
 
+  // --- Protected endpoints (require session cookie) ---
+
   test("GET /metrics returns the engine metrics snapshot", async () => {
     const { mock, baseUrl } = await startTestServer({ state: "running" }, handles);
     mock.setTickCount(12);
+    const cookie = await loginAndGetCookie(baseUrl);
 
-    const response = await fetch(`${baseUrl}/metrics`);
+    const response = await fetch(`${baseUrl}/metrics`, {
+      headers: { cookie },
+    });
     const body = (await response.json()) as {
       core: { tickCount: number; state: EngineCoreMetrics["state"] };
       simulationName: string;
@@ -344,8 +393,11 @@ describeIfTcp("admin server", () => {
 
   test("GET /state returns the engine state snapshot", async () => {
     const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const cookie = await loginAndGetCookie(baseUrl);
 
-    const response = await fetch(`${baseUrl}/state`);
+    const response = await fetch(`${baseUrl}/state`, {
+      headers: { cookie },
+    });
     const body = (await response.json()) as EngineStateSnapshot;
 
     expect(response.status).toBe(200);
@@ -355,10 +407,11 @@ describeIfTcp("admin server", () => {
 
   test("POST /commands validates and dispatches engine commands", async () => {
     const { mock, baseUrl } = await startTestServer({ state: "running" }, handles);
+    const cookie = await loginAndGetCookie(baseUrl);
 
     const response = await fetch(`${baseUrl}/commands`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", cookie },
       body: JSON.stringify({
         type: "pause",
         correlationId: "req-1",
@@ -372,30 +425,24 @@ describeIfTcp("admin server", () => {
     expect(mock.getExecutedCommands()).toEqual([{ type: "pause", correlationId: "req-1" }]);
   });
 
-  test("POST /commands requires auth on non-loopback binds", async () => {
-    const { baseUrl } = await startTestServer({ state: "running", host: "0.0.0.0" }, handles);
-
+  test("POST /commands requires session auth", async () => {
+    const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    // Without session cookie
     const response = await fetch(`${baseUrl}/commands`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({
-        type: "pause",
-        correlationId: "req-1",
-      }),
+      body: JSON.stringify({ type: "pause", correlationId: "req-1" }),
     });
-    const body = (await response.json()) as { message: string; error: string };
-
-    expect(response.status).toBe(403);
-    expect(body.message).toBe("Mutation endpoints require authentication.");
-    expect(body.error).toBe("Set MIRAVO_ADMIN_TOKEN when binding to a non-loopback address.");
+    expect(response.status).toBe(401);
   });
 
   test("POST /commands returns 400 for invalid JSON", async () => {
     const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const cookie = await loginAndGetCookie(baseUrl);
 
     const response = await fetch(`${baseUrl}/commands`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", cookie },
       body: "{bad json",
     });
     const body = (await response.json()) as { message: string };
@@ -406,10 +453,11 @@ describeIfTcp("admin server", () => {
 
   test("POST /commands returns 400 for invalid command shape", async () => {
     const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const cookie = await loginAndGetCookie(baseUrl);
 
     const response = await fetch(`${baseUrl}/commands`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", cookie },
       body: JSON.stringify({ type: "setSpeed" }),
     });
     const body = (await response.json()) as CommandResult;
@@ -419,6 +467,60 @@ describeIfTcp("admin server", () => {
     expect(body.command).toBe("setSpeed");
   });
 
+  test.each([
+    { label: "missing host", suffix: "" },
+    { label: "blank host", suffix: "?host=%20%20%20" },
+  ])("GET /catalog/templates/:id/le-template.json returns 400 for $label", async ({ suffix }) => {
+    const { baseUrl } = await startTestServer(
+      {
+        state: "running",
+        getLeExport: async () => ({
+          templateJson: JSON.stringify({ ok: true }),
+          tagsCSV: "name,value\n",
+        }),
+      },
+      handles,
+    );
+    const cookie = await loginAndGetCookie(baseUrl);
+
+    const response = await fetch(
+      `${baseUrl}/catalog/templates/smart-factory/le-template.json${suffix}`,
+      {
+        headers: { cookie },
+      },
+    );
+    const body = (await response.json()) as { message: string; error: string };
+
+    expect(response.status).toBe(400);
+    expect(body.message).toBe("Missing host query parameter.");
+    expect(body.error).toContain("?host=<hostname-or-ip>");
+  });
+
+  test("GET /catalog/templates/:id/le-template.json accepts a non-empty host", async () => {
+    const { baseUrl } = await startTestServer(
+      {
+        state: "running",
+        getLeExport: async (_id, { host }) => ({
+          templateJson: JSON.stringify({ host }),
+          tagsCSV: "name,value\n",
+        }),
+      },
+      handles,
+    );
+    const cookie = await loginAndGetCookie(baseUrl);
+
+    const response = await fetch(
+      `${baseUrl}/catalog/templates/smart-factory/le-template.json?host=172.17.0.1`,
+      {
+        headers: { cookie },
+      },
+    );
+    const body = (await response.json()) as { host: string };
+
+    expect(response.status).toBe(200);
+    expect(body.host).toBe("172.17.0.1");
+  });
+
   // --- Daemon mode endpoints ---
 
   test("/readyz includes simulationName and runId when provided", async () => {
@@ -428,6 +530,7 @@ describeIfTcp("admin server", () => {
       engine: mock.engine,
       network: { host: "127.0.0.1", port, tickIntervalMs: 1000 },
       protocols: { getLastTickProgressAt: () => mock.getLastTickProgressAt() },
+      auth: testAuth(),
       simulationName: "test-daemon",
       runId: "run-abc-123",
     });
@@ -455,10 +558,11 @@ describeIfTcp("admin server", () => {
 
   test("POST /shutdown calls requestShutdown callback and returns 200", async () => {
     const { baseUrl, getShutdownReason } = await startShutdownTestServer(handles);
+    const cookie = await loginAndGetCookie(baseUrl);
 
     const response = await fetch(`${baseUrl}/shutdown`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", cookie },
       body: JSON.stringify({ reason: "miravo stop" }),
     });
     const body = (await response.json()) as Record<string, unknown>;
@@ -470,10 +574,11 @@ describeIfTcp("admin server", () => {
 
   test("POST /shutdown uses default reason when body is empty", async () => {
     const { baseUrl, getShutdownReason } = await startShutdownTestServer(handles);
+    const cookie = await loginAndGetCookie(baseUrl);
 
     const response = await fetch(`${baseUrl}/shutdown`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", cookie },
     });
     expect(response.status).toBe(200);
     expect(getShutdownReason()).toBe("remote shutdown request");
@@ -486,6 +591,7 @@ describeIfTcp("admin server", () => {
       engine: mock.engine,
       network: { host: "127.0.0.1", port, tickIntervalMs: 1000 },
       protocols: { getLastTickProgressAt: () => mock.getLastTickProgressAt() },
+      auth: testAuth(),
       requestShutdown: () => {},
     });
     handles.push(handle);
@@ -497,66 +603,179 @@ describeIfTcp("admin server", () => {
 
   test("POST /shutdown returns 501 when requestShutdown not provided", async () => {
     const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const cookie = await loginAndGetCookie(baseUrl);
 
-    const response = await fetch(`${baseUrl}/shutdown`, { method: "POST" });
+    const response = await fetch(`${baseUrl}/shutdown`, {
+      method: "POST",
+      headers: { cookie },
+    });
     expect(response.status).toBe(501);
   });
 
-  test("POST /shutdown requires auth when adminToken is set", async () => {
-    const port = await reservePort();
-    const mock = createMockAdminEngine("running", 1000);
-    const handle = startAdminServer({
-      engine: mock.engine,
-      network: { host: "127.0.0.1", port, tickIntervalMs: 1000 },
-      protocols: { getLastTickProgressAt: () => mock.getLastTickProgressAt() },
-      requestShutdown: () => {},
-      adminToken: "secret-token",
-    });
-    handles.push(handle);
-    const baseUrl = serverBaseUrl(handle.endpoint);
-
-    // Without token
+  test("POST /shutdown requires session auth", async () => {
+    const { baseUrl } = await startShutdownTestServer(handles);
+    // Without session cookie
     const noAuth = await fetch(`${baseUrl}/shutdown`, {
       method: "POST",
       headers: { "content-type": "application/json" },
     });
     expect(noAuth.status).toBe(401);
-
-    // With token
+    // With session cookie
+    const cookie = await loginAndGetCookie(baseUrl);
     const withAuth = await fetch(`${baseUrl}/shutdown`, {
       method: "POST",
-      headers: { "content-type": "application/json", authorization: "Bearer secret-token" },
+      headers: { "content-type": "application/json", cookie },
     });
     expect(withAuth.status).toBe(200);
   });
 
-  test("POST /commands accepts bearer auth on non-loopback binds", async () => {
+  test("POST /commands accepts session auth", async () => {
+    const { mock, baseUrl } = await startTestServer({ state: "running" }, handles);
+    const cookie = await loginAndGetCookie(baseUrl);
+    const response = await fetch(`${baseUrl}/commands`, {
+      method: "POST",
+      headers: { "content-type": "application/json", cookie },
+      body: JSON.stringify({ type: "pause", correlationId: "req-2" }),
+    });
+    const body = (await response.json()) as CommandResult;
+    expect(response.status).toBe(200);
+    expect(body.success).toBe(true);
+    expect(mock.getExecutedCommands()).toEqual([{ type: "pause", correlationId: "req-2" }]);
+  });
+
+  // --- Auth endpoint tests ---
+
+  test("POST /auth/login returns 200 with valid credentials", async () => {
+    const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const res = await fetch(`${baseUrl}/auth/login`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ username: "admin", password: "testpass" }),
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; changePassword: boolean };
+    expect(body.ok).toBe(true);
+    expect(body.changePassword).toBe(false);
+    expect(res.headers.get("set-cookie")).toContain("miravo_session=");
+  });
+
+  test("POST /auth/login returns 401 with invalid credentials", async () => {
+    const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const res = await fetch(`${baseUrl}/auth/login`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ username: "admin", password: "wrong" }),
+    });
+    expect(res.status).toBe(401);
+  });
+
+  test("GET /auth/status returns authenticated with valid session", async () => {
+    const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const cookie = await loginAndGetCookie(baseUrl);
+    const res = await fetch(`${baseUrl}/auth/status`, { headers: { cookie } });
+    const body = (await res.json()) as { authenticated: boolean; username?: string };
+    expect(body.authenticated).toBe(true);
+    expect(body.username).toBe("admin");
+  });
+
+  test("GET /auth/status returns unauthenticated without session", async () => {
+    const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const res = await fetch(`${baseUrl}/auth/status`);
+    const body = (await res.json()) as { authenticated: boolean };
+    expect(body.authenticated).toBe(false);
+  });
+
+  test("GET /bootstrap returns unauthenticated without session", async () => {
+    const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const res = await fetch(`${baseUrl}/bootstrap`);
+    expect(res.status).toBe(200);
+    const parsed = ConsoleBootstrapResponseSchema.safeParse(await res.json());
+    expect(parsed.success).toBe(true);
+    expect(parsed.data).toEqual({ authenticated: false });
+  });
+
+  test("GET /bootstrap returns auth plus canonical runtime snapshot with valid session", async () => {
+    const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const cookie = await loginAndGetCookie(baseUrl);
+    const res = await fetch(`${baseUrl}/bootstrap`, { headers: { cookie } });
+    expect(res.status).toBe(200);
+    const parsed = ConsoleBootstrapResponseSchema.safeParse(await res.json());
+    expect(parsed.success).toBe(true);
+    if (!parsed.success || !parsed.data.authenticated) {
+      throw new Error("Expected authenticated bootstrap payload.");
+    }
+    expect(parsed.data.username).toBe("admin");
+    expect(parsed.data.runtime.state.instances.length).toBeGreaterThanOrEqual(0);
+    expect(parsed.data.runtime.metrics.core.state).toBe("running");
+    expect(Array.isArray(parsed.data.runtime.runningTemplates)).toBe(true);
+    expect(typeof parsed.data.runtime.revision).toBe("number");
+  });
+
+  test("GET /state requires session auth", async () => {
+    const { baseUrl } = await startTestServer({ state: "running" }, handles);
+    const res = await fetch(`${baseUrl}/state`);
+    expect(res.status).toBe(401);
+  });
+});
+
+describeIfTcp("anonymous mode (--no-auth)", () => {
+  const handles: Array<{ stop: () => void }> = [];
+  afterEach(() => {
+    for (const h of handles) h.stop();
+    handles.length = 0;
+  });
+
+  async function startAnonServer() {
     const port = await reservePort();
     const mock = createMockAdminEngine("running", 1000);
     const handle = startAdminServer({
       engine: mock.engine,
-      network: { host: "0.0.0.0", port, tickIntervalMs: 1000 },
+      network: { host: "127.0.0.1", port, tickIntervalMs: 1000 },
       protocols: { getLastTickProgressAt: () => mock.getLastTickProgressAt() },
-      adminToken: "secret-token",
+      auth: { ...testAuth(), anonymousMode: true },
     });
     handles.push(handle);
-    const baseUrl = serverBaseUrl(handle.endpoint);
+    return { baseUrl: serverBaseUrl(handle.endpoint) };
+  }
+
+  test("GET /bootstrap returns authenticated:true without a session cookie", async () => {
+    const { baseUrl } = await startAnonServer();
+    const res = await fetch(`${baseUrl}/bootstrap`);
+    expect(res.status).toBe(200);
+    const parsed = ConsoleBootstrapResponseSchema.safeParse(await res.json());
+    expect(parsed.success).toBe(true);
+    if (!parsed.success || !parsed.data.authenticated) {
+      throw new Error("Expected authenticated bootstrap payload.");
+    }
+    expect(parsed.data.username).toBe("anonymous");
+    expect(parsed.data.runtime.metrics.core.state).toBe("running");
+  });
 
-    const response = await fetch(`${baseUrl}/commands`, {
+  test("GET /state succeeds without a session cookie", async () => {
+    const { baseUrl } = await startAnonServer();
+    const res = await fetch(`${baseUrl}/state`);
+    expect(res.status).toBe(200);
+  });
+
+  test("POST /auth/login succeeds with any credentials", async () => {
+    const { baseUrl } = await startAnonServer();
+    const res = await fetch(`${baseUrl}/auth/login`, {
       method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: "Bearer secret-token",
-      },
-      body: JSON.stringify({
-        type: "pause",
-        correlationId: "req-2",
-      }),
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ username: "whoever", password: "anything" }),
     });
-    const body = (await response.json()) as CommandResult;
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; changePassword: boolean };
+    expect(body.ok).toBe(true);
+    expect(body.changePassword).toBe(false);
+  });
 
-    expect(response.status).toBe(200);
-    expect(body.success).toBe(true);
-    expect(mock.getExecutedCommands()).toEqual([{ type: "pause", correlationId: "req-2" }]);
+  test("GET /auth/status returns authenticated:true without a session cookie", async () => {
+    const { baseUrl } = await startAnonServer();
+    const res = await fetch(`${baseUrl}/auth/status`);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { authenticated: boolean; username?: string };
+    expect(body.authenticated).toBe(true);
+    expect(body.username).toBe("anonymous");
   });
 });