rastack 0.0.57 → 0.0.59

package/test/auth.spec.ts

@@ -1,207 +0,0 @@
-/**
- * Tests for the `rastack/auth` core — the client-side mirror of the access
- * rules `rastack-api-core` enforces (see `rust/rastack-api-core/tests/access.rs`
- * for the server side of the same matrix). The semantics here must track the
- * Rust `check_permission` / `enforced_owner` exactly: `can()` answers "would
- * the server accept this request?", so the components can limit the paths they
- * expose instead of surfacing 401s.
- */
-
-import {
-  anonymousAuth,
-  authFromClaims,
-  bypassesRls,
-  can,
-  canActOnRow,
-  isAdmin,
-  ownsRow,
-  policyFromManifest,
-  policyFromOpenApi,
-  trustedAuth,
-  userAuth,
-  type ResourcePolicy,
-} from "../auth/core";
-
-const rls: ResourcePolicy = {
-  permission: "authenticated",
-  access: { ownerField: "owner", scope: "owner", adminGroups: ["staff"] },
-};
-
-describe("rastack/auth — the permission gate (can)", () => {
-  it("defaults to authenticated — secure by default, like the server", () => {
-    expect(can(anonymousAuth(), {}, "list")).toBe(false);
-    expect(can(anonymousAuth(), undefined, "create")).toBe(false);
-    expect(can(userAuth("u1"), {}, "list")).toBe(true);
-    expect(can(userAuth("u1"), undefined, "delete")).toBe(true);
-  });
-
-  it("public admits everyone, for every action", () => {
-    const policy: ResourcePolicy = { permission: "public" };
-    for (const action of [
-      "list",
-      "retrieve",
-      "create",
-      "update",
-      "delete",
-    ] as const) {
-      expect(can(anonymousAuth(), policy, action)).toBe(true);
-    }
-  });
-
-  it("authenticatedOrReadOnly admits anonymous reads but not writes", () => {
-    const policy: ResourcePolicy = { permission: "authenticatedOrReadOnly" };
-    expect(can(anonymousAuth(), policy, "list")).toBe(true);
-    expect(can(anonymousAuth(), policy, "retrieve")).toBe(true);
-    expect(can(anonymousAuth(), policy, "create")).toBe(false);
-    expect(can(anonymousAuth(), policy, "update")).toBe(false);
-    expect(can(anonymousAuth(), policy, "delete")).toBe(false);
-    expect(can(userAuth("u1"), policy, "delete")).toBe(true);
-  });
-
-  it("row-secured resources need a subject (the server answers 401 without one)", () => {
-    // Authenticated but subject-less — e.g. a machine token without `sub`.
-    const noSub = { authenticated: true, groups: [] };
-    expect(can(noSub, rls, "list")).toBe(false);
-    expect(can(userAuth("u1"), rls, "list")).toBe(true);
-    // A configured admin group bypasses row-level security.
-    expect(can({ ...noSub, groups: ["staff"] }, rls, "list")).toBe(true);
-  });
-
-  it("trusted contexts (dev without auth) pass everything", () => {
-    expect(can(trustedAuth(), rls, "delete")).toBe(true);
-  });
-
-  it("a missing identity gates nothing — the server stays the enforcer", () => {
-    expect(can(undefined, rls, "delete")).toBe(true);
-    expect(can(null, { permission: "authenticated" }, "create")).toBe(true);
-  });
-});
-
-describe("rastack/auth — row-level security helpers", () => {
-  const mine = { id: 1, owner: "u1" };
-  const theirs = { id: 2, owner: "u2" };
-
-  it("owners own their rows; others don't", () => {
-    expect(ownsRow(userAuth("u1"), rls, mine)).toBe(true);
-    expect(ownsRow(userAuth("u1"), rls, theirs)).toBe(false);
-  });
-
-  it("admin groups and trusted contexts bypass the owner filter", () => {
-    expect(bypassesRls(userAuth("u1", ["staff"]), rls)).toBe(true);
-    expect(ownsRow(userAuth("u1", ["staff"]), rls, theirs)).toBe(true);
-    expect(ownsRow(trustedAuth(), rls, theirs)).toBe(true);
-    expect(bypassesRls(userAuth("u1", ["other"]), rls)).toBe(false);
-  });
-
-  it("unsecured resources are owned by everyone", () => {
-    expect(ownsRow(userAuth("u1"), {}, theirs)).toBe(true);
-  });
-
-  it("canActOnRow combines the gate and ownership", () => {
-    expect(canActOnRow(userAuth("u1"), rls, "update", mine)).toBe(true);
-    expect(canActOnRow(userAuth("u1"), rls, "update", theirs)).toBe(false);
-    expect(canActOnRow(anonymousAuth(), rls, "update", mine)).toBe(false);
-  });
-});
-
-describe("rastack/auth — group-owned datasets", () => {
-  // A group dataset: rows belong to a team, physically partitioned per group.
-  const grouped: ResourcePolicy = {
-    permission: "authenticated",
-    access: { groupField: "team", scope: "group", adminGroups: ["staff"] },
-  };
-  const blueRow = { id: 1, team: "blue" };
-
-  it("members read; identities in no group can read (empty) but never write", () => {
-    const dana = userAuth("dana", ["blue"]);
-    const loner = userAuth("lonnie", []);
-    expect(can(dana, grouped, "list")).toBe(true);
-    expect(can(dana, grouped, "create")).toBe(true);
-    // Reads outside any group just come back empty — but a write can never
-    // succeed, so the UI shouldn't offer it.
-    expect(can(loner, grouped, "list")).toBe(true);
-    expect(can(loner, grouped, "create")).toBe(false);
-    expect(can(loner, grouped, "delete")).toBe(false);
-  });
-
-  it("row membership mirrors the server's group guard", () => {
-    expect(ownsRow(userAuth("dana", ["blue"]), grouped, blueRow)).toBe(true);
-    expect(ownsRow(userAuth("erin", ["green"]), grouped, blueRow)).toBe(false);
-    expect(
-      canActOnRow(userAuth("erin", ["green"]), grouped, "update", blueRow),
-    ).toBe(false);
-    // adminGroups members act across groups.
-    expect(ownsRow(userAuth("sam", ["staff"]), grouped, blueRow)).toBe(true);
-  });
-
-  it("owner + group guards both apply when a policy carries both", () => {
-    const both: ResourcePolicy = {
-      access: { ownerField: "owner", groupField: "team" },
-    };
-    const row = { id: 1, owner: "dana", team: "blue" };
-    expect(ownsRow(userAuth("dana", ["blue"]), both, row)).toBe(true);
-    expect(ownsRow(userAuth("dana", ["green"]), both, row)).toBe(false);
-    expect(ownsRow(userAuth("erin", ["blue"]), both, row)).toBe(false);
-  });
-
-  it("isAdmin is the scope-driven admin role", () => {
-    expect(isAdmin(userAuth("sam", ["staff"]), grouped)).toBe(true);
-    expect(isAdmin(userAuth("dana", ["blue"]), grouped)).toBe(false);
-    expect(isAdmin(trustedAuth(), grouped)).toBe(true);
-  });
-});
-
-describe("rastack/auth — building an identity", () => {
-  it("authFromClaims reads sub and cognito:groups from a decoded token", () => {
-    const auth = authFromClaims({
-      sub: "u1",
-      "cognito:groups": ["staff", 42],
-      email: "x@y.z",
-    });
-    expect(auth).toEqual({ authenticated: true, sub: "u1", groups: ["staff"] });
-    expect(authFromClaims({}).authenticated).toBe(false);
-  });
-});
-
-describe("rastack/auth — policy lookup", () => {
-  const manifest = {
-    resources: [
-      { app: "airports", model: "airport", fields: [] },
-      {
-        app: "airports",
-        model: "itinerary",
-        fields: [],
-        permission: "authenticated",
-        access: { ownerField: "owner", scope: "owner", adminGroups: ["staff"] },
-      },
-    ],
-  };
-
-  it("policyFromManifest extracts permission + access", () => {
-    expect(policyFromManifest(manifest, "airports.itinerary")).toEqual(rls);
-    expect(
-      policyFromManifest(manifest, { app: "airports", model: "airport" }),
-    ).toEqual({});
-    expect(policyFromManifest(manifest, "airports.missing")).toBeUndefined();
-    // Accepts the JSON string form the provider may hold.
-    expect(
-      policyFromManifest(JSON.stringify(manifest), "airports.itinerary"),
-    ).toEqual(rls);
-  });
-
-  it("policyFromOpenApi reads the x-rastack-permission / x-rastack-access stamps", () => {
-    const doc = {
-      paths: {
-        "/api/airports/v1/itinerary/": {
-          get: {
-            operationId: "listItinerary",
-            "x-rastack-permission": "authenticated",
-            "x-rastack-access": rls.access,
-          },
-        },
-      },
-    };
-    expect(policyFromOpenApi(doc, "airports.itinerary")).toEqual(rls);
-    expect(policyFromOpenApi(doc, "airports.airport")).toBeUndefined();
-  });
-});

package/test/cache.spec.ts

@@ -1,263 +0,0 @@
-import {
-  AccessRevokedError,
-  CacheExpiredError,
-  createEncryptedCacheStorage,
-  generateEncryptionKey,
-  IcebergFileCache,
-  MemoryCacheStorage,
-  purgeLocalData,
-  WarehouseFileSource,
-} from "../cache";
-
-/**
- * The cache is exercised against an in-memory "object store" that counts
- * fetches — the observable contract is Iceberg's: the version hint is the only
- * file re-fetched once cached copies exist, immutable snapshot/data files are
- * fetched exactly once, and revoked access deletes the identity's cache.
- */
-
-const encoder = new TextEncoder();
-
-class FakeWarehouse implements WarehouseFileSource {
-  files = new Map<string, Uint8Array>();
-  fetches: string[] = [];
-  revoked = false;
-  offline = false;
-
-  async fetchFile(key: string): Promise<Uint8Array | null> {
-    if (this.revoked) throw new AccessRevokedError("revoked", 403);
-    if (this.offline) throw new Error("network unreachable");
-    this.fetches.push(key);
-    return this.files.get(key) ?? null;
-  }
-
-  /** Commit snapshot `version` for the table with the given data files. */
-  commit(prefix: string, version: number, dataFiles: Record<string, object[]>) {
-    this.files.set(
-      `${prefix}/metadata/version-hint.text`,
-      encoder.encode(String(version)),
-    );
-    this.files.set(
-      `${prefix}/metadata/v${version}.metadata.json`,
-      encoder.encode(
-        JSON.stringify({
-          format: "rastack-iceberg-v1",
-          data_files: Object.keys(dataFiles),
-          next_int_id: 99,
-        }),
-      ),
-    );
-    for (const [rel, rows] of Object.entries(dataFiles)) {
-      this.files.set(`${prefix}/${rel}`, encoder.encode(JSON.stringify(rows)));
-    }
-  }
-}
-
-class FakeEngine {
-  seeded: string[] = [];
-  async seedFile(key: string): Promise<void> {
-    this.seeded.push(key);
-  }
-}
-
-const RESOURCES = [{ app: "airports", model: "airport" }];
-const PREFIX = "airports.db/airport";
-
-function makeCache(source: FakeWarehouse, identity = "alice-sub") {
-  const storage = new MemoryCacheStorage();
-  return {
-    storage,
-    cache: new IcebergFileCache({ storage, source, identity }),
-  };
-}
-
-describe("IcebergFileCache", () => {
-  it("cold seed fetches the Iceberg tree and feeds it to the engine", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1, code: "JFK" }] });
-    const { cache } = makeCache(source);
-    const engine = new FakeEngine();
-
-    const stats = await cache.seed(engine, RESOURCES);
-
-    expect(stats).toEqual({ tables: 1, fromCache: 0, fetched: 3 });
-    expect(engine.seeded).toEqual([
-      `${PREFIX}/metadata/version-hint.text`,
-      `${PREFIX}/metadata/v1.metadata.json`,
-      `${PREFIX}/data/v1.json`,
-    ]);
-  });
-
-  it("warm seed with no new commit refetches only the version hint", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const { cache } = makeCache(source);
-
-    await cache.seed(new FakeEngine(), RESOURCES);
-    source.fetches = [];
-
-    const stats = await cache.seed(new FakeEngine(), RESOURCES);
-    // One small network read (the pointer); the immutable files came from cache.
-    expect(source.fetches).toEqual([`${PREFIX}/metadata/version-hint.text`]);
-    expect(stats).toEqual({ tables: 1, fromCache: 2, fetched: 1 });
-  });
-
-  it("a new snapshot fetches only unseen files and prunes superseded ones", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const { cache, storage } = makeCache(source);
-    await cache.seed(new FakeEngine(), RESOURCES);
-
-    // Update/delete rewrite a compacted snapshot: v2 supersedes v1's file.
-    source.commit(PREFIX, 2, { "data/v2.json": [{ id: 1, name: "x" }] });
-    source.fetches = [];
-
-    const engine = new FakeEngine();
-    await cache.seed(engine, RESOURCES);
-
-    expect(source.fetches).toEqual([
-      `${PREFIX}/metadata/version-hint.text`,
-      `${PREFIX}/metadata/v2.metadata.json`,
-      `${PREFIX}/data/v2.json`,
-    ]);
-    expect(engine.seeded).toContain(`${PREFIX}/data/v2.json`);
-    // The superseded snapshot's files no longer occupy the device.
-    const keys = await storage.keys("");
-    expect(keys.some((k) => k.includes("v1.metadata.json"))).toBe(false);
-    expect(keys.some((k) => k.includes("data/v1.json"))).toBe(false);
-  });
-
-  it("falls back to the cached pointer when offline", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const { cache } = makeCache(source);
-    await cache.seed(new FakeEngine(), RESOURCES);
-
-    source.offline = true;
-    const engine = new FakeEngine();
-    const stats = await cache.seed(engine, RESOURCES);
-    expect(stats.tables).toBe(1);
-    expect(stats.fetched).toBe(0);
-    expect(engine.seeded).toHaveLength(3);
-  });
-
-  it("revoked access deletes the identity's cached data and surfaces the error", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const { cache, storage } = makeCache(source);
-    await cache.seed(new FakeEngine(), RESOURCES);
-    expect(await storage.keys("alice-sub::")).not.toHaveLength(0);
-
-    source.revoked = true;
-    await expect(cache.seed(new FakeEngine(), RESOURCES)).rejects.toThrow(
-      AccessRevokedError,
-    );
-    // Nothing of alice's survives on the device.
-    expect(await storage.keys("alice-sub::")).toHaveLength(0);
-  });
-
-  it("enforces the offline-retention bound: stale cache is deleted, not served", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const storage = new MemoryCacheStorage();
-    let clock = 1_000_000;
-    const cache = new IcebergFileCache({
-      storage,
-      source,
-      identity: "alice",
-      maxOfflineMs: 60_000,
-      now: () => clock,
-    });
-    await cache.seed(new FakeEngine(), RESOURCES);
-
-    // Offline but within the bound: cached data still serves.
-    source.offline = true;
-    clock += 30_000;
-    expect((await cache.seed(new FakeEngine(), RESOURCES)).tables).toBe(1);
-
-    // Past the bound: the cache refuses AND deletes the identity's data.
-    clock += 60_001;
-    await expect(cache.seed(new FakeEngine(), RESOURCES)).rejects.toThrow(
-      CacheExpiredError,
-    );
-    expect(await storage.keys("alice::")).toHaveLength(0);
-
-    // Back online: re-verification restores service from the source.
-    source.offline = false;
-    expect((await cache.seed(new FakeEngine(), RESOURCES)).tables).toBe(1);
-  });
-
-  it("namespaces isolate identities sharing one device", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const storage = new MemoryCacheStorage();
-    const alice = new IcebergFileCache({ storage, source, identity: "alice" });
-    const bob = new IcebergFileCache({ storage, source, identity: "bob" });
-
-    await alice.seed(new FakeEngine(), RESOURCES);
-    await bob.seed(new FakeEngine(), RESOURCES);
-
-    await purgeLocalData({ identity: "alice", cacheStorage: storage });
-    expect(await storage.keys("alice::")).toHaveLength(0);
-    expect(await storage.keys("bob::")).not.toHaveLength(0);
-  });
-});
-
-describe("createEncryptedCacheStorage", () => {
-  it("round-trips values while storing only ciphertext", async () => {
-    const inner = new MemoryCacheStorage();
-    const key = await generateEncryptionKey();
-    const storage = createEncryptedCacheStorage(inner, key);
-    const plaintext = encoder.encode("sensitive row data");
-
-    await storage.put("k", plaintext);
-    expect(new Uint8Array((await storage.get("k"))!)).toEqual(plaintext);
-
-    // What actually hits the device is sealed: different bytes, and a fresh
-    // random IV means two writes of the same value differ too.
-    const sealed1 = (await inner.get("k"))!;
-    expect(Buffer.from(sealed1).includes(Buffer.from(plaintext))).toBe(false);
-    await storage.put("k", plaintext);
-    expect((await inner.get("k"))!).not.toEqual(sealed1);
-  });
-
-  it("treats undecryptable bytes as a cache miss, never as data", async () => {
-    const inner = new MemoryCacheStorage();
-    const storage = createEncryptedCacheStorage(inner, await generateEncryptionKey());
-    await storage.put("k", encoder.encode("secret"));
-
-    // Read back under a different key → miss.
-    const other = createEncryptedCacheStorage(inner, await generateEncryptionKey());
-    expect(await other.get("k")).toBeNull();
-
-    // Tampered ciphertext → authenticated decryption fails → miss.
-    const sealed = (await inner.get("k"))!;
-    sealed[sealed.length - 1] ^= 0xff;
-    await inner.put("k", sealed);
-    expect(await storage.get("k")).toBeNull();
-  });
-
-  it("works end-to-end as the IcebergFileCache storage", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1, code: "JFK" }] });
-    const inner = new MemoryCacheStorage();
-    const cache = new IcebergFileCache({
-      storage: createEncryptedCacheStorage(inner, await generateEncryptionKey()),
-      source,
-      identity: "alice",
-    });
-
-    await cache.seed(new FakeEngine(), RESOURCES);
-    source.fetches = [];
-    const stats = await cache.seed(new FakeEngine(), RESOURCES);
-    // Warm-cache behaviour is unchanged by encryption.
-    expect(stats).toEqual({ tables: 1, fromCache: 2, fetched: 1 });
-    // And nothing readable sits on the device.
-    const stored = await Promise.all(
-      (await inner.keys("alice::")).map((k) => inner.get(k)),
-    );
-    for (const bytes of stored) {
-      expect(Buffer.from(bytes!).includes(Buffer.from("JFK"))).toBe(false);
-    }
-  });
-});