musix-box 0.1.0

package/tests/providers/spotify/spotify_session.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, test, vi } from "vitest";
+
+import {
+  getAccessToken,
+  NoSpotifySessionError,
+  storeSession,
+} from "../../../src/providers/spotify/spotify_session";
+import type { SpotifyTokens } from "../../../src/providers/spotify/spotify_oauth";
+
+/** A minimal in-memory stand-in for the one KV method pair this module calls. */
+function fakeKv(): KVNamespace {
+  const store = new Map<string, string>();
+  return {
+    get: vi.fn(async (key: string) => store.get(key) ?? null),
+    put: vi.fn(async (key: string, value: string) => {
+      store.set(key, value);
+    }),
+  } as unknown as KVNamespace;
+}
+
+const TOKENS: SpotifyTokens = {
+  accessToken: "access-1",
+  refreshToken: "refresh-1",
+  expiresAt: 1_000_000,
+};
+
+describe("getAccessToken", () => {
+  test("throws NoSpotifySessionError when nothing is stored", async () => {
+    const kv = fakeKv();
+    await expect(
+      getAccessToken(kv, "user-1", { clientId: "client", now: () => 0 }),
+    ).rejects.toThrow(NoSpotifySessionError);
+  });
+
+  test("returns the stored access token when it is still valid", async () => {
+    const kv = fakeKv();
+    await storeSession(kv, "user-1", TOKENS);
+
+    const token = await getAccessToken(kv, "user-1", {
+      clientId: "client",
+      now: () => 0,
+    });
+
+    expect(token).toBe("access-1");
+  });
+
+  test("refreshes and re-stores when the token is within the refresh margin", async () => {
+    const kv = fakeKv();
+    await storeSession(kv, "user-1", TOKENS);
+
+    globalThis.fetch = vi.fn(async () =>
+      new Response(
+        JSON.stringify({
+          access_token: "access-2",
+          refresh_token: "refresh-2",
+          expires_in: 3600,
+        }),
+        { status: 200 },
+      ),
+    ) as unknown as typeof fetch;
+
+    // 999_500 is inside the 60_000ms margin before TOKENS.expiresAt (1_000_000).
+    const token = await getAccessToken(kv, "user-1", {
+      clientId: "client",
+      now: () => 999_500,
+    });
+
+    expect(token).toBe("access-2");
+
+    // The refreshed token must have been written back, or the next call
+    // would refresh again unnecessarily on every request.
+    const second = await getAccessToken(kv, "user-1", {
+      clientId: "client",
+      now: () => 999_500,
+    });
+    expect(second).toBe("access-2");
+  });
+});

package/tests/secret_hygiene.test.ts

@@ -0,0 +1,93 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { describe, expect, test } from "vitest";
+
+/**
+ * These tests check the repository rather than the code.
+ *
+ * A secret scanner looks for things that resemble credentials. It would not
+ * have caught the failure that prompted these tests, which was a repository
+ * with no `.gitignore` at all — there was no secret to find yet, only a
+ * missing floor for one to fall through. That is a structural property, and
+ * structure is what is asserted here.
+ */
+
+const repositoryRoot = join(import.meta.dirname, "..");
+
+/**
+ * Files that must never be committed, whatever they happen to contain today.
+ *
+ * These are the conventional homes for credentials in this project: `.env`
+ * for shared keys, `.dev.vars` for the Workers runtime, `wrangler.jsonc` for
+ * a deployment's own configuration.
+ */
+const MUST_BE_IGNORED = [".env", ".dev.vars"];
+
+/**
+ * Run a git command in this repository.
+ *
+ * @param args - Arguments passed to git.
+ * @returns The command's standard output, trimmed.
+ */
+function git(args: string[]): string {
+  return execFileSync("git", args, {
+    cwd: repositoryRoot,
+    encoding: "utf8",
+  }).trim();
+}
+
+describe("secret hygiene", () => {
+  test("a .gitignore exists", () => {
+    // The floor. Without it every other guarantee here is accidental.
+    expect(existsSync(join(repositoryRoot, ".gitignore"))).toBe(true);
+  });
+
+  test.each(MUST_BE_IGNORED)("%s is ignored", (path) => {
+    // `check-ignore` exits non-zero when the path is not ignored, which
+    // execFileSync turns into a throw.
+    expect(() => git(["check-ignore", "--quiet", path])).not.toThrow();
+  });
+
+  test("nothing that should be ignored is already tracked", () => {
+    // A .gitignore does nothing for a file that was committed before it was
+    // written, and that is the case most likely to go unnoticed.
+    const tracked = git(["ls-files"]).split("\n").filter(Boolean);
+    const shouldNotBeTracked = tracked.filter((path) => {
+      const name = path.split("/").pop() ?? "";
+      return (
+        name === ".env" ||
+        name.startsWith(".env.") ||
+        name === ".dev.vars" ||
+        name.endsWith(".pem") ||
+        name.endsWith(".key")
+      );
+    });
+    expect(shouldNotBeTracked).toEqual([]);
+  });
+
+  test("no tracked file contains a credential", () => {
+    // A blunt pattern check over the working tree. gitleaks in the pre-commit
+    // hook is the thorough version and reads the whole history; this catches
+    // the same thing from inside the test suite, so a repository set up
+    // without the hook is not left with nothing.
+    const credentialPattern =
+      /(ghp_[A-Za-z0-9]{20}|github_pat_[A-Za-z0-9_]{20}|sk-[A-Za-z0-9]{32}|-----BEGIN [A-Z ]*PRIVATE KEY-----)/;
+
+    const tracked = git(["ls-files"]).split("\n").filter(Boolean);
+    const offenders = tracked.filter((path) => {
+      const fullPath = join(repositoryRoot, path);
+      if (!existsSync(fullPath)) {
+        return false;
+      }
+      // This test file necessarily contains the patterns it searches for.
+      if (path.endsWith("secret_hygiene.test.ts")) {
+        return false;
+      }
+      return credentialPattern.test(readFileSync(fullPath, "utf8"));
+    });
+
+    expect(offenders).toEqual([]);
+  });
+});

package/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "es2021",
+    "lib": ["es2021"],
+    "module": "es2022",
+    "moduleResolution": "bundler",
+    "types": ["@cloudflare/workers-types", "node"],
+    "resolveJsonModule": true,
+    "allowJs": true,
+    "checkJs": false,
+    "noEmit": true,
+    "isolatedModules": true,
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts", "tests/**/*.ts"]
+}

package/vitest.config.ts

@@ -0,0 +1,39 @@
+import { cloudflareTest } from "@cloudflare/vitest-pool-workers";
+import { defineConfig } from "vitest/config";
+
+/**
+ * Two kinds of test, matching `other-memory`'s split minus its third
+ * project: `worker` holds the logic tests, running inside workerd so
+ * `crypto.subtle` (needed for PKCE) behaves exactly as it does in
+ * production. `repository` holds tests that inspect the repo itself.
+ *
+ * No `integration` project yet — those would need a real Spotify account
+ * and OAuth app to run against, which this package does not have configured.
+ * Add it the same way `other-memory`'s exists once that credential is set up.
+ */
+export default defineConfig({
+  test: {
+    projects: [
+      {
+        extends: true,
+        plugins: [
+          cloudflareTest({
+            wrangler: { configPath: "./wrangler.jsonc" },
+          }),
+        ],
+        test: {
+          name: "worker",
+          include: ["tests/**/*.test.ts"],
+          exclude: ["tests/**/*.source.test.ts", "tests/secret_hygiene.test.ts"],
+        },
+      },
+      {
+        test: {
+          name: "repository",
+          environment: "node",
+          include: ["tests/secret_hygiene.test.ts", "tests/**/*.source.test.ts"],
+        },
+      },
+    ],
+  },
+});

package/wrangler.example.jsonc

@@ -0,0 +1,51 @@
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+
+  // Copy this to wrangler.jsonc and fill in the marked values.
+  // wrangler.jsonc is gitignored, so your account details stay yours.
+
+  "name": "musix-box",
+  "main": "src/worker.ts",
+  "compatibility_date": "2025-03-10",
+  "compatibility_flags": ["nodejs_compat"],
+
+  "migrations": [
+    {
+      "tag": "v1",
+      "new_sqlite_classes": ["MusixBoxMCP"]
+    }
+  ],
+  "durable_objects": {
+    "bindings": [
+      {
+        "name": "MCP_OBJECT",
+        "class_name": "MusixBoxMCP"
+      }
+    ]
+  },
+
+  "kv_namespaces": [
+    {
+      "binding": "OAUTH_KV",
+      // From `npx wrangler kv namespace create OAUTH_KV`.
+      "id": "0000000000000000000000000000test"
+    },
+    {
+      "binding": "SPOTIFY_TOKENS",
+      // From `npx wrangler kv namespace create SPOTIFY_TOKENS`.
+      "id": "0000000000000000000000000000test"
+    }
+  ],
+
+  // Not secret. Secrets are set with `wrangler secret put` — see the README.
+  "vars": {
+    // Only this Spotify account may use the server. An authenticated
+    // stranger is still a stranger. Find it via the /me endpoint or the
+    // Spotify account overview page.
+    "ALLOWED_SPOTIFY_USER_ID": "example"
+  },
+
+  "observability": {
+    "enabled": true
+  }
+}