queen-mq 0.12.3 → 0.13.0

package/test-v2/auth.js

@@ -0,0 +1,340 @@
+// Tests for server-stamped producer identity (issue #23, feature A).
+//
+// The goal of feature A is: when JWT auth is enabled, the server attaches the
+// authenticated client's `sub` claim to every pushed message, and a client
+// cannot spoof another producer's identity by supplying `producerSub` in the
+// request body.
+//
+// Three environments are exercised here:
+//
+//   1. No auth (default dev setup): `producer_sub` must be NULL; clients that
+//      send `producerSub` in the body must still get NULL (the field is not
+//      client-settable).
+//   2. JWT auth enabled (set JWT_SECRET env to match the server's
+//      JWT_SECRET): `producer_sub` must equal the `sub` claim.
+//   3. JWT auth enabled + spoofing attempt: body-supplied `producerSub` must
+//      be ignored; stored value is the JWT `sub`.
+//
+// Tests gate themselves on the `JWT_SECRET` env var so the suite can run
+// unattended in either server configuration.
+
+import crypto from 'crypto'
+import { dbPool } from './run.js'
+
+const SERVER_URL = process.env.QUEEN_URL || 'http://localhost:6632'
+const JWT_SECRET = process.env.JWT_SECRET || ''
+const JWT_ENABLED = JWT_SECRET.length > 0
+
+// ---------------------------------------------------------------------------
+// Minimal HS256 JWT signer (avoids pulling a dependency just for tests)
+// ---------------------------------------------------------------------------
+function b64url(buf) {
+    return Buffer.from(buf).toString('base64')
+        .replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
+}
+
+function signHs256Jwt(payload, secret) {
+    const header = { alg: 'HS256', typ: 'JWT' }
+    const encHeader = b64url(JSON.stringify(header))
+    const encPayload = b64url(JSON.stringify(payload))
+    const signingInput = `${encHeader}.${encPayload}`
+    const sig = crypto.createHmac('sha256', secret).update(signingInput).digest()
+    return `${signingInput}.${b64url(sig)}`
+}
+
+function makeToken(sub, role = 'read-write') {
+    const now = Math.floor(Date.now() / 1000)
+    return signHs256Jwt(
+        { sub, username: sub, role, iat: now, exp: now + 3600 },
+        JWT_SECRET
+    )
+}
+
+// ---------------------------------------------------------------------------
+// Ground-truth helper: read producer_sub directly from Postgres, bypassing
+// the API so we can tell the difference between a server that actually stores
+// the value and one that just echoes the client's input.
+// ---------------------------------------------------------------------------
+async function getStoredProducerSub(queueName, transactionId) {
+    const res = await dbPool.query(
+        `SELECT m.producer_sub
+         FROM queen.messages m
+         JOIN queen.partitions p ON p.id = m.partition_id
+         JOIN queen.queues q ON q.id = p.queue_id
+         WHERE q.name = $1 AND m.transaction_id = $2`,
+        [queueName, transactionId]
+    )
+    return res.rows.length > 0 ? res.rows[0].producer_sub : null
+}
+
+// Raw HTTP push so we can control the Authorization header and inject
+// arbitrary extra fields (like a forged `producerSub`) per-test.
+async function httpPush({ queue, partition = 'Default', transactionId, data, bearerToken, extraItemFields = {} }) {
+    const headers = { 'Content-Type': 'application/json' }
+    if (bearerToken) headers['Authorization'] = `Bearer ${bearerToken}`
+
+    const body = {
+        items: [{
+            queue,
+            partition,
+            transactionId,
+            payload: data,
+            ...extraItemFields
+        }]
+    }
+
+    const res = await fetch(`${SERVER_URL}/api/v1/push`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(body)
+    })
+    const text = await res.text()
+    if (!res.ok) {
+        throw new Error(`push failed ${res.status}: ${text}`)
+    }
+    return text ? JSON.parse(text) : null
+}
+
+// Raw HTTP configure (queue creation) with optional bearer.
+async function httpConfigure(queue, bearerToken) {
+    const headers = { 'Content-Type': 'application/json' }
+    if (bearerToken) headers['Authorization'] = `Bearer ${bearerToken}`
+    const res = await fetch(`${SERVER_URL}/api/v1/configure`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ queue, options: {} })
+    })
+    if (!res.ok) {
+        const text = await res.text()
+        throw new Error(`configure failed ${res.status}: ${text}`)
+    }
+}
+
+// Direct SP call via dbPool — bypasses HTTP and JWT entirely. Used by the
+// SP-level tests below so they work regardless of whether the server has
+// auth enabled or not.
+async function callPushMessagesV3(items) {
+    await dbPool.query(
+        'SELECT queen.push_messages_v3($1::jsonb)',
+        [JSON.stringify(items)]
+    )
+}
+
+// Direct SP pop. Returns the `messages` array for the first (only) partition.
+async function callPopSpecificBatch(queueName) {
+    const reqs = [{
+        idx: 0,
+        queue_name: queueName,
+        partition_name: 'Default',
+        consumer_group: '__QUEUE_MODE__',
+        lease_seconds: 60,
+        worker_id: `test-worker-${Date.now()}`,
+        batch_size: 10,
+        sub_mode: 'all',
+        sub_from: ''
+    }]
+    const res = await dbPool.query(
+        'SELECT queen.pop_specific_batch($1::jsonb) as out',
+        [JSON.stringify(reqs)]
+    )
+    const out = res.rows[0].out
+    return out[0]?.result?.messages || []
+}
+
+// ===========================================================================
+// TEST 1: Stored procedure round-trip (SQL-only, no HTTP, no JWT)
+// ---------------------------------------------------------------------------
+// Exercises the schema + SP contract end-to-end purely via SQL. If this fails,
+// the migration or 001_push.sql / 002_pop_unified.sql is wrong. Runs in any
+// server configuration because it talks to Postgres directly.
+// ===========================================================================
+export async function producerSubRoundTripViaStoredProcedure(client) {
+    const q = 'test-auth-sp-roundtrip'
+    const tx = `tx-sp-${Date.now()}`
+
+    await callPushMessagesV3([{
+        queue: q,
+        partition: 'Default',
+        transactionId: tx,
+        payload: { x: 1 },
+        producerSub: 'sp-test-sub'
+    }])
+
+    const stored = await getStoredProducerSub(q, tx)
+    if (stored !== 'sp-test-sub') {
+        return { success: false, message: `Expected producer_sub='sp-test-sub' in DB, got ${JSON.stringify(stored)}` }
+    }
+
+    const popped = await callPopSpecificBatch(q)
+    const target = popped.find(m => m.transactionId === tx)
+    if (!target) {
+        return { success: false, message: `Expected to find tx ${tx} in pop result` }
+    }
+    if (target.producerSub !== 'sp-test-sub') {
+        return { success: false, message: `Pop returned producerSub=${JSON.stringify(target.producerSub)}, expected 'sp-test-sub'` }
+    }
+
+    return { success: true, message: 'producer_sub round-trips through push_messages_v3 and pop exposes it' }
+}
+
+// ===========================================================================
+// TEST 2: SP with no producerSub => producer_sub is NULL
+// ---------------------------------------------------------------------------
+// Guards against an accidental "default to empty string" regression in the SP.
+// ===========================================================================
+export async function producerSubNullWhenNotProvided(client) {
+    const q = 'test-auth-sp-null'
+    const tx = `tx-sp-null-${Date.now()}`
+
+    await callPushMessagesV3([{
+        queue: q,
+        partition: 'Default',
+        transactionId: tx,
+        payload: { x: 1 }
+        // no producerSub
+    }])
+
+    const stored = await getStoredProducerSub(q, tx)
+    if (stored !== null) {
+        return { success: false, message: `Expected NULL producer_sub, got ${JSON.stringify(stored)}` }
+    }
+
+    const popped = await callPopSpecificBatch(q)
+    const target = popped.find(m => m.transactionId === tx)
+    if (!target) {
+        return { success: false, message: `Expected to find tx ${tx} in pop result` }
+    }
+    if (target.producerSub != null) {
+        return { success: false, message: `Pop returned producerSub=${JSON.stringify(target.producerSub)}, expected null` }
+    }
+
+    return { success: true, message: 'Omitting producerSub yields NULL in DB and null in pop response' }
+}
+
+// ===========================================================================
+// TEST 3: SP treats empty string producerSub as NULL
+// ---------------------------------------------------------------------------
+// The SP uses NULLIF(..., '') to avoid storing a literal empty string when a
+// client accidentally sends "". Verifies that invariant.
+// ===========================================================================
+export async function producerSubEmptyStringStoredAsNull(client) {
+    const q = 'test-auth-sp-empty'
+    const tx = `tx-sp-empty-${Date.now()}`
+
+    await callPushMessagesV3([{
+        queue: q,
+        partition: 'Default',
+        transactionId: tx,
+        payload: { x: 1 },
+        producerSub: ''
+    }])
+
+    const stored = await getStoredProducerSub(q, tx)
+    if (stored !== null) {
+        return { success: false, message: `Expected NULL for empty-string producerSub, got ${JSON.stringify(stored)}` }
+    }
+
+    return { success: true, message: 'Empty-string producerSub is stored as NULL' }
+}
+
+// ===========================================================================
+// TEST 4: HTTP push without JWT => producer_sub is NULL
+// ---------------------------------------------------------------------------
+// Runs only when the server is NOT configured with JWT (typical dev setup).
+// Also checks that a client sending `producerSub` in the push body does NOT
+// end up with it persisted (the field is not client-settable under any mode).
+// ===========================================================================
+export async function producerSubIgnoredFromBodyWithoutAuth(client) {
+    if (JWT_ENABLED) {
+        return { success: true, message: 'Skipped (JWT_SECRET is set - run producerSubStampedFromJwt instead)' }
+    }
+
+    const q = 'test-auth-http-no-jwt'
+    const tx = `tx-noauth-${Date.now()}`
+
+    const queue = await client.queue(q).create()
+    if (!queue.configured) {
+        return { success: false, message: 'Queue not created' }
+    }
+
+    // Spoofing attempt against an unauthenticated server.
+    await httpPush({
+        queue: q,
+        transactionId: tx,
+        data: { hello: 'world' },
+        extraItemFields: { producerSub: 'attacker-no-jwt' }
+    })
+
+    const stored = await getStoredProducerSub(q, tx)
+    if (stored !== null) {
+        return { success: false, message: `Expected NULL producer_sub (auth disabled), got ${JSON.stringify(stored)} - client was able to set it!` }
+    }
+
+    return { success: true, message: 'Body-supplied producerSub ignored when auth disabled; stored as NULL' }
+}
+
+// ===========================================================================
+// TEST 5: HTTP push WITH JWT => producer_sub = sub claim
+// ---------------------------------------------------------------------------
+// Requires:
+//   - Server started with JWT_ENABLED=true JWT_ALGORITHM=HS256 JWT_SECRET=<x>
+//   - Test run with JWT_SECRET=<x>
+// ===========================================================================
+export async function producerSubStampedFromJwt(client) {
+    if (!JWT_ENABLED) {
+        return { success: true, message: 'Skipped (set JWT_SECRET env var matching server to run)' }
+    }
+
+    const q = 'test-auth-http-jwt-stamp'
+    const tx = `tx-jwt-${Date.now()}`
+    const token = makeToken('alice-producer')
+
+    await httpConfigure(q, token)
+    await httpPush({
+        queue: q,
+        transactionId: tx,
+        data: { hello: 'world' },
+        bearerToken: token
+    })
+
+    const stored = await getStoredProducerSub(q, tx)
+    if (stored !== 'alice-producer') {
+        return { success: false, message: `Expected producer_sub='alice-producer', got ${JSON.stringify(stored)}` }
+    }
+
+    return { success: true, message: 'producer_sub stamped from authenticated JWT sub claim' }
+}
+
+// ===========================================================================
+// TEST 6: Spoofing producerSub in body is ignored even with valid JWT
+// ---------------------------------------------------------------------------
+// This is the core anti-impersonation invariant of issue #23.
+// ===========================================================================
+export async function producerSubSpoofingIgnoredWithJwt(client) {
+    if (!JWT_ENABLED) {
+        return { success: true, message: 'Skipped (set JWT_SECRET env var matching server to run)' }
+    }
+
+    const q = 'test-auth-http-jwt-spoof'
+    const tx = `tx-spoof-${Date.now()}`
+    const token = makeToken('legit-producer')
+
+    await httpConfigure(q, token)
+    await httpPush({
+        queue: q,
+        transactionId: tx,
+        data: { hello: 'world' },
+        bearerToken: token,
+        extraItemFields: { producerSub: 'attacker' }
+    })
+
+    const stored = await getStoredProducerSub(q, tx)
+    if (stored !== 'legit-producer') {
+        return {
+            success: false,
+            message: `Impersonation not prevented: stored producer_sub=${JSON.stringify(stored)}, expected 'legit-producer'`
+        }
+    }
+
+    return { success: true, message: 'Body-supplied producerSub ignored; stored sub is from validated JWT' }
+}

package/test-v2/logger.js

@@ -0,0 +1,312 @@
+/**
+ * Logger Unit Tests
+ *
+ * Tests the pluggable logger system in utils/logger.js:
+ * - Default console-based logging (gated by QUEEN_CLIENT_LOG)
+ * - Custom logger injection via configure()
+ * - Level mapping (log->info, warn->warn, error->error, debug->debug)
+ * - debug() fallback to info() when custom logger has no debug()
+ * - configure(null) resets to default
+ * - configure() validation
+ * - isEnabled() behavior
+ *
+ * These are pure unit tests — no Queen server required.
+ */
+
+import * as logger from '../client-v2/utils/logger.js'
+
+function createMockLogger() {
+  const calls = { info: [], warn: [], error: [], debug: [] }
+  return {
+    calls,
+    info: (msg) => calls.info.push(msg),
+    warn: (msg) => calls.warn.push(msg),
+    error: (msg) => calls.error.push(msg),
+    debug: (msg) => calls.debug.push(msg)
+  }
+}
+
+function createMockLoggerWithoutDebug() {
+  const calls = { info: [], warn: [], error: [] }
+  return {
+    calls,
+    info: (msg) => calls.info.push(msg),
+    warn: (msg) => calls.warn.push(msg),
+    error: (msg) => calls.error.push(msg)
+  }
+}
+
+/**
+ * Test that configure() accepts a valid logger and routes log() to info()
+ */
+export async function testLoggerCustomLogRouting(_client) {
+  const mock = createMockLogger()
+  logger.configure(mock)
+
+  try {
+    logger.log('TestOp', 'hello')
+    logger.log('TestOp', { key: 'value' })
+
+    if (mock.calls.info.length !== 2) {
+      return { success: false, message: `Expected 2 info calls, got ${mock.calls.info.length}` }
+    }
+    if (!mock.calls.info[0].includes('[TestOp]') || !mock.calls.info[0].includes('hello')) {
+      return { success: false, message: `Unexpected info message: ${mock.calls.info[0]}` }
+    }
+    if (!mock.calls.info[1].includes('"key":"value"')) {
+      return { success: false, message: `Object details not serialized: ${mock.calls.info[1]}` }
+    }
+
+    return { success: true, message: 'log() routes to custom logger info()' }
+  } finally {
+    logger.configure(null)
+  }
+}
+
+/**
+ * Test that warn() routes to custom logger warn()
+ */
+export async function testLoggerCustomWarnRouting(_client) {
+  const mock = createMockLogger()
+  logger.configure(mock)
+
+  try {
+    logger.warn('WarnOp', 'something bad')
+    logger.warn('WarnOp', { code: 42 })
+
+    if (mock.calls.warn.length !== 2) {
+      return { success: false, message: `Expected 2 warn calls, got ${mock.calls.warn.length}` }
+    }
+    if (!mock.calls.warn[0].includes('[WarnOp]')) {
+      return { success: false, message: `Missing operation in warn: ${mock.calls.warn[0]}` }
+    }
+
+    return { success: true, message: 'warn() routes to custom logger warn()' }
+  } finally {
+    logger.configure(null)
+  }
+}
+
+/**
+ * Test that error() routes to custom logger error()
+ */
+export async function testLoggerCustomErrorRouting(_client) {
+  const mock = createMockLogger()
+  logger.configure(mock)
+
+  try {
+    logger.error('ErrOp', { error: 'boom' })
+
+    if (mock.calls.error.length !== 1) {
+      return { success: false, message: `Expected 1 error call, got ${mock.calls.error.length}` }
+    }
+    if (!mock.calls.error[0].includes('[ErrOp]') || !mock.calls.error[0].includes('boom')) {
+      return { success: false, message: `Unexpected error message: ${mock.calls.error[0]}` }
+    }
+
+    return { success: true, message: 'error() routes to custom logger error()' }
+  } finally {
+    logger.configure(null)
+  }
+}
+
+/**
+ * Test that debug() routes to custom logger debug() when available
+ */
+export async function testLoggerCustomDebugRouting(_client) {
+  const mock = createMockLogger()
+  logger.configure(mock)
+
+  try {
+    logger.debug('DebugOp', 'verbose detail')
+
+    if (mock.calls.debug.length !== 1) {
+      return { success: false, message: `Expected 1 debug call, got ${mock.calls.debug.length}` }
+    }
+    if (!mock.calls.debug[0].includes('[DebugOp]')) {
+      return { success: false, message: `Missing operation in debug: ${mock.calls.debug[0]}` }
+    }
+    // info() should NOT have been called
+    if (mock.calls.info.length !== 0) {
+      return { success: false, message: `debug() should not fall back to info() when debug() exists` }
+    }
+
+    return { success: true, message: 'debug() routes to custom logger debug()' }
+  } finally {
+    logger.configure(null)
+  }
+}
+
+/**
+ * Test that debug() falls back to info() when custom logger has no debug()
+ */
+export async function testLoggerDebugFallbackToInfo(_client) {
+  const mock = createMockLoggerWithoutDebug()
+  logger.configure(mock)
+
+  try {
+    logger.debug('FallbackOp', 'should go to info')
+
+    if (mock.calls.info.length !== 1) {
+      return { success: false, message: `Expected 1 info call (fallback), got ${mock.calls.info.length}` }
+    }
+    if (!mock.calls.info[0].includes('[FallbackOp]')) {
+      return { success: false, message: `Missing operation in fallback: ${mock.calls.info[0]}` }
+    }
+
+    return { success: true, message: 'debug() falls back to info() when no debug() on logger' }
+  } finally {
+    logger.configure(null)
+  }
+}
+
+/**
+ * Test that configure(null) resets to default console behavior
+ */
+export async function testLoggerConfigureNull(_client) {
+  const mock = createMockLogger()
+  logger.configure(mock)
+
+  // Verify custom logger is active
+  logger.log('Before', 'test')
+  if (mock.calls.info.length !== 1) {
+    return { success: false, message: 'Custom logger not active before reset' }
+  }
+
+  // Reset
+  logger.configure(null)
+
+  // Now log should NOT go to mock anymore
+  logger.log('After', 'test')
+  if (mock.calls.info.length !== 1) {
+    return { success: false, message: `Expected still 1 info call after reset, got ${mock.calls.info.length}` }
+  }
+
+  return { success: true, message: 'configure(null) resets to default' }
+}
+
+/**
+ * Test that configure() throws on invalid logger (missing info method)
+ */
+export async function testLoggerConfigureValidation(_client) {
+  try {
+    logger.configure({ warn: () => {}, error: () => {} })
+    return { success: false, message: 'Should have thrown for logger missing info()' }
+  } catch (e) {
+    if (!e.message.includes('info()')) {
+      return { success: false, message: `Wrong error message: ${e.message}` }
+    }
+  } finally {
+    logger.configure(null)
+  }
+
+  // Empty object should also fail
+  try {
+    logger.configure({})
+    return { success: false, message: 'Should have thrown for empty object' }
+  } catch (e) {
+    // expected
+  } finally {
+    logger.configure(null)
+  }
+
+  return { success: true, message: 'configure() validates logger interface' }
+}
+
+/**
+ * Test isEnabled() returns true when custom logger is set
+ */
+export async function testLoggerIsEnabledWithCustom(_client) {
+  // Without custom logger and without QUEEN_CLIENT_LOG, isEnabled depends on env
+  const beforeCustom = logger.isEnabled()
+
+  const mock = createMockLogger()
+  logger.configure(mock)
+
+  try {
+    if (!logger.isEnabled()) {
+      return { success: false, message: 'isEnabled() should return true with custom logger' }
+    }
+    return { success: true, message: `isEnabled() returns true with custom logger (was ${beforeCustom} before)` }
+  } finally {
+    logger.configure(null)
+  }
+}
+
+/**
+ * Test that levels are isolated — log() only hits info(), not warn() or error()
+ */
+export async function testLoggerLevelIsolation(_client) {
+  const mock = createMockLogger()
+  logger.configure(mock)
+
+  try {
+    logger.log('Op', 'info msg')
+    logger.warn('Op', 'warn msg')
+    logger.error('Op', 'error msg')
+    logger.debug('Op', 'debug msg')
+
+    if (mock.calls.info.length !== 1) {
+      return { success: false, message: `info: expected 1, got ${mock.calls.info.length}` }
+    }
+    if (mock.calls.warn.length !== 1) {
+      return { success: false, message: `warn: expected 1, got ${mock.calls.warn.length}` }
+    }
+    if (mock.calls.error.length !== 1) {
+      return { success: false, message: `error: expected 1, got ${mock.calls.error.length}` }
+    }
+    if (mock.calls.debug.length !== 1) {
+      return { success: false, message: `debug: expected 1, got ${mock.calls.debug.length}` }
+    }
+
+    return { success: true, message: 'Each level routes to exactly its corresponding method' }
+  } finally {
+    logger.configure(null)
+  }
+}
+
+/**
+ * Test that string details are passed through without JSON.stringify
+ */
+export async function testLoggerStringDetails(_client) {
+  const mock = createMockLogger()
+  logger.configure(mock)
+
+  try {
+    logger.log('Op', 'plain string')
+
+    const msg = mock.calls.info[0]
+    if (!msg.includes('plain string')) {
+      return { success: false, message: `String details not passed through: ${msg}` }
+    }
+    // Should NOT be double-quoted as JSON
+    if (msg.includes('"plain string"')) {
+      return { success: false, message: `String was JSON-serialized: ${msg}` }
+    }
+
+    return { success: true, message: 'String details passed as-is' }
+  } finally {
+    logger.configure(null)
+  }
+}
+
+/**
+ * Test that object details are JSON-serialized
+ */
+export async function testLoggerObjectDetails(_client) {
+  const mock = createMockLogger()
+  logger.configure(mock)
+
+  try {
+    logger.log('Op', { foo: 'bar', count: 3 })
+
+    const msg = mock.calls.info[0]
+    if (!msg.includes('"foo":"bar"') || !msg.includes('"count":3')) {
+      return { success: false, message: `Object not serialized correctly: ${msg}` }
+    }
+
+    return { success: true, message: 'Object details JSON-serialized' }
+  } finally {
+    logger.configure(null)
+  }
+}