rastack 0.0.57 → 0.0.59

package/test/cognito.spec.ts

@@ -1,281 +0,0 @@
-/**
- * The Cognito auth core (`rastack/auth`): PKCE (S256, against the RFC 7636 test
- * vector), Hosted UI URL builders, the `/oauth2/token` request body, JWT
- * decoding, session shaping + expiry, redirect parsing, and the server-less
- * local session.
- */
-
-import {
-  authorizeUrl,
-  base64UrlDecode,
-  base64UrlDecodeToBytes,
-  base64UrlEncode,
-  codeChallengeFromVerifier,
-  createPkcePair,
-  decodeJwt,
-  hostedUiOrigin,
-  isSessionValid,
-  issuerUrl,
-  localSession,
-  logoutUrl,
-  parseRedirect,
-  randomCodeVerifier,
-  sessionFromTokens,
-  tokenEndpoint,
-  tokenRequestBody,
-  userFromClaims,
-  type CognitoAuthConfig,
-  type CognitoTokenResponse,
-} from "../src/auth/cognito";
-import { cognitoToRastackAuth } from "../auth/provider";
-
-const CONFIG: CognitoAuthConfig = {
-  domain: "myapp.auth.us-east-1.amazoncognito.com",
-  clientId: "abc123clientid",
-  redirectUri: "https://app.example.com/callback",
-  region: "us-east-1",
-  userPoolId: "us-east-1_Pool",
-};
-
-/** Build a signed-shaped JWT (unsigned) carrying the given payload. */
-function makeJwt(payload: Record<string, unknown>): string {
-  const seg = (v: unknown) =>
-    base64UrlEncode(new TextEncoder().encode(JSON.stringify(v)));
-  return `${seg({ alg: "RS256", typ: "JWT" })}.${seg(payload)}.sig`;
-}
-
-describe("base64url", () => {
-  it("round-trips bytes and strips padding", () => {
-    const bytes = new Uint8Array([0, 1, 2, 250, 251, 252, 253]);
-    const encoded = base64UrlEncode(bytes);
-    expect(encoded).not.toMatch(/[+/=]/);
-    expect([...base64UrlDecodeToBytes(encoded)]).toEqual([...bytes]);
-  });
-
-  it("decodes a UTF-8 payload", () => {
-    const encoded = base64UrlEncode(new TextEncoder().encode('{"é":"✓"}'));
-    expect(base64UrlDecode(encoded)).toBe('{"é":"✓"}');
-  });
-});
-
-describe("PKCE", () => {
-  it("derives the S256 challenge from the RFC 7636 test vector", async () => {
-    const verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
-    const challenge = await codeChallengeFromVerifier(verifier);
-    expect(challenge).toBe("E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM");
-  });
-
-  it("generates a url-safe verifier of the expected length", () => {
-    const verifier = randomCodeVerifier(new Uint8Array(32).fill(7));
-    expect(verifier).not.toMatch(/[+/=]/);
-    expect(verifier.length).toBeGreaterThanOrEqual(43);
-  });
-
-  it("creates a matching verifier/challenge pair", async () => {
-    const bytes = new Uint8Array(32).map((_, i) => i);
-    const { verifier, challenge } = await createPkcePair(bytes);
-    expect(verifier).toBe(randomCodeVerifier(bytes));
-    expect(challenge).toBe(await codeChallengeFromVerifier(verifier));
-  });
-});
-
-describe("Hosted UI URLs", () => {
-  it("builds the authorize URL with PKCE + default scopes", () => {
-    const url = new URL(
-      authorizeUrl(CONFIG, { state: "st8", codeChallenge: "chal" }),
-    );
-    expect(url.origin + url.pathname).toBe(
-      "https://myapp.auth.us-east-1.amazoncognito.com/oauth2/authorize",
-    );
-    expect(url.searchParams.get("response_type")).toBe("code");
-    expect(url.searchParams.get("client_id")).toBe("abc123clientid");
-    expect(url.searchParams.get("redirect_uri")).toBe(
-      "https://app.example.com/callback",
-    );
-    expect(url.searchParams.get("scope")).toBe("openid email profile");
-    expect(url.searchParams.get("code_challenge")).toBe("chal");
-    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
-    expect(url.searchParams.get("state")).toBe("st8");
-  });
-
-  it("honours custom scopes and strips a scheme from the domain", () => {
-    const url = new URL(
-      authorizeUrl(
-        { ...CONFIG, domain: "https://auth.example.com/", scopes: ["openid"] },
-        { state: "s", codeChallenge: "c" },
-      ),
-    );
-    expect(url.origin).toBe("https://auth.example.com");
-    expect(url.searchParams.get("scope")).toBe("openid");
-  });
-
-  it("builds the logout URL, defaulting logout_uri to redirect_uri", () => {
-    const url = new URL(logoutUrl(CONFIG));
-    expect(url.pathname).toBe("/logout");
-    expect(url.searchParams.get("logout_uri")).toBe(
-      "https://app.example.com/callback",
-    );
-  });
-
-  it("derives the origin, token endpoint and issuer", () => {
-    expect(hostedUiOrigin(CONFIG)).toBe(
-      "https://myapp.auth.us-east-1.amazoncognito.com",
-    );
-    expect(tokenEndpoint(CONFIG)).toBe(
-      "https://myapp.auth.us-east-1.amazoncognito.com/oauth2/token",
-    );
-    expect(issuerUrl(CONFIG)).toBe(
-      "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_Pool",
-    );
-  });
-});
-
-describe("token request body", () => {
-  it("encodes an authorization_code grant with the verifier", () => {
-    const body = new URLSearchParams(
-      tokenRequestBody(CONFIG, {
-        grantType: "authorization_code",
-        code: "the-code",
-        codeVerifier: "the-verifier",
-      }),
-    );
-    expect(body.get("grant_type")).toBe("authorization_code");
-    expect(body.get("client_id")).toBe("abc123clientid");
-    expect(body.get("code")).toBe("the-code");
-    expect(body.get("redirect_uri")).toBe("https://app.example.com/callback");
-    expect(body.get("code_verifier")).toBe("the-verifier");
-  });
-
-  it("encodes a refresh_token grant", () => {
-    const body = new URLSearchParams(
-      tokenRequestBody(CONFIG, {
-        grantType: "refresh_token",
-        refreshToken: "rt",
-      }),
-    );
-    expect(body.get("grant_type")).toBe("refresh_token");
-    expect(body.get("refresh_token")).toBe("rt");
-    expect(body.has("code")).toBe(false);
-  });
-});
-
-describe("JWT + claims", () => {
-  it("decodes a JWT payload without verifying", () => {
-    const token = makeJwt({ sub: "user-1", email: "a@b.co" });
-    expect(decodeJwt(token)).toMatchObject({ sub: "user-1", email: "a@b.co" });
-  });
-
-  it("throws on a malformed token", () => {
-    expect(() => decodeJwt("not-a-jwt")).toThrow(/Malformed JWT/);
-  });
-
-  it("projects cognito:groups into the user (empty when absent)", () => {
-    expect(
-      userFromClaims({ sub: "s", "cognito:groups": ["admin", "ops"] }),
-    ).toEqual({ sub: "s", email: undefined, username: "s", groups: ["admin", "ops"] });
-    expect(userFromClaims({ sub: "s", email: "e@x.co" }).groups).toEqual([]);
-  });
-});
-
-describe("sessions", () => {
-  const now = 1_000_000_000_000;
-
-  it("builds a session from tokens, using the token's own exp", () => {
-    const idToken = makeJwt({
-      sub: "u9",
-      exp: Math.floor(now / 1000) + 3600,
-      "cognito:groups": ["pilots"],
-      email: "pilot@sky.co",
-    });
-    const tokens: CognitoTokenResponse = {
-      id_token: idToken,
-      access_token: makeJwt({ sub: "u9" }),
-      refresh_token: "rt",
-      expires_in: 3600,
-    };
-    const session = sessionFromTokens(tokens, now);
-    expect(session.user).toMatchObject({ sub: "u9", groups: ["pilots"] });
-    expect(session.expiresAt).toBe((Math.floor(now / 1000) + 3600) * 1000);
-    expect(session.refreshToken).toBe("rt");
-  });
-
-  it("validates against expiry with skew", () => {
-    const session = sessionFromTokens(
-      {
-        id_token: makeJwt({ sub: "u", exp: Math.floor(now / 1000) + 3600 }),
-        access_token: "a",
-      },
-      now,
-    );
-    expect(isSessionValid(session, now)).toBe(true);
-    expect(isSessionValid(session, session.expiresAt - 10_000, 30_000)).toBe(false);
-    expect(isSessionValid(null, now)).toBe(false);
-  });
-});
-
-describe("redirect parsing", () => {
-  it("parses code + state from a search string or full URL", () => {
-    expect(parseRedirect("?code=abc&state=xyz")).toMatchObject({
-      code: "abc",
-      state: "xyz",
-    });
-    expect(
-      parseRedirect("https://app.example.com/callback?code=c1&state=s1"),
-    ).toMatchObject({ code: "c1", state: "s1" });
-  });
-
-  it("surfaces an OAuth error", () => {
-    const r = parseRedirect("?error=access_denied&error_description=nope");
-    expect(r.error).toBe("access_denied");
-    expect(r.errorDescription).toBe("nope");
-    expect(r.code).toBeUndefined();
-  });
-});
-
-describe("local (server-less) session", () => {
-  const now = 2_000_000_000_000;
-
-  it("mints a decodable, valid session with groups", () => {
-    const session = localSession(
-      { sub: "ops-lead", email: "lead@sky.co", groups: ["admins"] },
-      now,
-    );
-    expect(session.user).toMatchObject({
-      sub: "ops-lead",
-      email: "lead@sky.co",
-      groups: ["admins"],
-    });
-    expect(isSessionValid(session, now)).toBe(true);
-    // The minted token is a real-shaped JWT the same decoder reads back.
-    expect(decodeJwt(session.idToken)).toMatchObject({ sub: "ops-lead" });
-  });
-
-  it("defaults the subject and carries no groups", () => {
-    const session = localSession({}, now);
-    expect(session.user.sub).toBe("local-dev");
-    expect(session.user.groups).toEqual([]);
-  });
-});
-
-describe("bridge to the authorization half (RastackAuth)", () => {
-  const now = 2_000_000_000_000;
-
-  it("maps a signed-in session's claims into a RastackAuth", () => {
-    const session = localSession({ sub: "u1", groups: ["admins"] }, now);
-    const auth = cognitoToRastackAuth({
-      isAuthenticated: true,
-      claims: session.claims,
-    });
-    expect(auth).toEqual({
-      authenticated: true,
-      sub: "u1",
-      groups: ["admins"],
-    });
-  });
-
-  it("maps a signed-out state to an anonymous identity", () => {
-    expect(cognitoToRastackAuth({ isAuthenticated: false, claims: null })).toEqual(
-      { authenticated: false, groups: [] },
-    );
-  });
-});

package/test/compile.spec.ts

@@ -1,240 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
-import { join } from "path";
-import {
-  analyzeResources,
-  buildOpenApi,
-  collisions,
-  compile,
-  ResourceModel,
-} from "../src/compile";
-import { generateFiles, generateFolders } from "../src/schema-entities";
-import { removeNonModelPaths } from "../src/schema/remove-non-model-paths";
-
-/**
- * The compiler's fixtures are real `.ts` files that import the DSL by its
- * package name (`rastack/define`); `createProgram` maps that to the in-tree
- * source, so the type checker resolves the `Ref`/`Resource` brands exactly as it
- * would in a consumer project.
- */
-const workRoot = join(__dirname, "compile-fixtures");
-const resourcesDir = join(workRoot, "resources");
-const outDir = join(workRoot, "out");
-
-const AIRPORTS_TS = `
-import { resource, s } from "rastack/define";
-
-export const Airport = resource("airports", "airport", {
-  code: s.string({ maxLength: 3, unique: true }),
-  name: s.string({ maxLength: 120 }),
-}, { search: ["code", "name"], admin: { listDisplay: ["code", "name"] } });
-
-export const Terminal = resource("airports", "terminal", {
-  airport: s.ref(() => Airport),
-  label: s.string({ maxLength: 20 }),
-});
-
-export const Flight = resource("airports", "flight", {
-  number: s.string({ maxLength: 8 }),
-  status: s.string({ maxLength: 20, default: "scheduled" }),
-}, { sync: { mode: "local", scope: "owner_id={user.id}", confirmed: ["update"] } });
-
-export const Gate = resource("airports", "gate", {
-  number: s.string({ maxLength: 5 }),
-}, { sync: { mode: "local", load: "lazy" } });
-
-export const Booking = resource("airports", "booking", {
-  reference: s.string({ maxLength: 12 }),
-}, { sync: { mode: "local", clientIds: true } });
-
-export const Itinerary = resource("airports", "itinerary", {
-  owner: s.string({ maxLength: 64 }),
-  notes: s.string({ maxLength: 500 }),
-}, {
-  permission: "authenticated",
-  access: { ownerField: "owner", scope: "owner", adminGroups: ["staff"] },
-});
-`;
-
-function findResource(
-  resources: ResourceModel[],
-  app: string,
-  model: string,
-): ResourceModel {
-  const found = resources.find((r) => r.app === app && r.model === model);
-  if (!found) throw new Error(`missing ${app}.${model}`);
-  return found;
-}
-
-describe("rastack compile — resource analysis & FK inference", () => {
-  beforeAll(() => {
-    mkdirSync(resourcesDir, { recursive: true });
-    writeFileSync(join(resourcesDir, "airports.ts"), AIRPORTS_TS);
-  });
-
-  afterAll(() => {
-    rmSync(workRoot, { recursive: true, force: true });
-  });
-
-  it("infers a foreign key from the field type", () => {
-    const resources = analyzeResources(resourcesDir);
-    const terminal = findResource(resources, "airports", "terminal");
-
-    const airportField = terminal.fields.find((f) => f.name === "airport");
-    expect(airportField?.type).toBe("fk");
-    expect(airportField?.relation).toEqual({
-      app: "airports",
-      model: "airport",
-    });
-
-    expect(terminal.relations).toEqual([
-      { field: "airport", target: "airports.airport", kind: "fk" },
-    ]);
-  });
-
-  it("maps scalar fields and their constraints", () => {
-    const resources = analyzeResources(resourcesDir);
-    const airport = findResource(resources, "airports", "airport");
-
-    const code = airport.fields.find((f) => f.name === "code");
-    expect(code).toMatchObject({ type: "string", maxLength: 3, unique: true });
-
-    const name = airport.fields.find((f) => f.name === "name");
-    expect(name).toMatchObject({ type: "string", maxLength: 120 });
-
-    expect(airport.search).toEqual(["code", "name"]);
-    expect(airport.admin).toEqual({ listDisplay: ["code", "name"] });
-  });
-
-  it("captures sync config (local / lazy / client-ids / confirmed)", () => {
-    const resources = analyzeResources(resourcesDir);
-
-    expect(findResource(resources, "airports", "flight").sync).toMatchObject({
-      mode: "local",
-      scope: "owner_id={user.id}",
-      confirmed: ["update"],
-    });
-    expect(findResource(resources, "airports", "gate").sync).toMatchObject({
-      mode: "local",
-      load: "lazy",
-    });
-    expect(findResource(resources, "airports", "booking").sync).toMatchObject({
-      mode: "local",
-      clientIds: true,
-    });
-  });
-
-  it("captures row-level access config (ownerField / scope / adminGroups)", () => {
-    const resources = analyzeResources(resourcesDir);
-    const itinerary = findResource(resources, "airports", "itinerary");
-
-    expect(itinerary.permission).toBe("authenticated");
-    expect(itinerary.access).toEqual({
-      ownerField: "owner",
-      scope: "owner",
-      adminGroups: ["staff"],
-    });
-
-    // Resources without an access block stay unstamped.
-    expect(
-      findResource(resources, "airports", "airport").access,
-    ).toBeUndefined();
-  });
-
-  it("reports no collisions for a valid graph", () => {
-    const resources = analyzeResources(resourcesDir);
-    expect(collisions(resources)).toEqual([]);
-  });
-});
-
-describe("rastack compile — OpenAPI emission", () => {
-  beforeAll(() => {
-    mkdirSync(resourcesDir, { recursive: true });
-    writeFileSync(join(resourcesDir, "airports.ts"), AIRPORTS_TS);
-  });
-
-  afterAll(() => {
-    rmSync(workRoot, { recursive: true, force: true });
-  });
-
-  it("writes schema.rastack.json and openapi.json", () => {
-    const result = compile(resourcesDir, outDir);
-    expect(existsSync(join(outDir, "schema.rastack.json"))).toBe(true);
-    expect(existsSync(join(outDir, "openapi.json"))).toBe(true);
-    expect(result.manifest.resources.length).toBe(6);
-  });
-
-  it("emits the /api/{app}/v1/{model}/ contract with FK + sync extensions", () => {
-    const resources = analyzeResources(resourcesDir);
-    const doc = buildOpenApi(resources);
-
-    // URL-segment contract the codegen keys off.
-    expect(doc.paths["/api/airports/v1/terminal/"]).toBeDefined();
-    expect(doc.paths["/api/airports/v1/terminal/{id}/"]).toBeDefined();
-
-    // FK field carries the new relation extension.
-    const terminalSchema = doc.components.schemas.Terminal;
-    expect(terminalSchema.properties.airport["x-rastack-relation"]).toEqual({
-      app: "airports",
-      model: "airport",
-    });
-
-    // Local-mode sync extensions, confirmed on update.
-    const flightList = doc.paths["/api/airports/v1/flight/"];
-    expect(flightList.get["x-rastack-sync"]).toBe("local");
-    expect(
-      doc.paths["/api/airports/v1/flight/{id}/"].put["x-rastack-sync"],
-    ).toBe("confirmed");
-    expect(doc.paths["/api/airports/v1/gate/"].get["x-rastack-sync-load"]).toBe(
-      "lazy",
-    );
-    expect(
-      doc.paths["/api/airports/v1/booking/"].post["x-rastack-sync-client-ids"],
-    ).toBe(true);
-
-    // Access-controlled resource carries the full policy on every op — the
-    // permission gate plus the access block `rastack/auth` mirrors in the UI.
-    const itineraryList = doc.paths["/api/airports/v1/itinerary/"];
-    expect(itineraryList.get["x-rastack-permission"]).toBe("authenticated");
-    expect(itineraryList.get["x-rastack-access"]).toEqual({
-      ownerField: "owner",
-      scope: "owner",
-      adminGroups: ["staff"],
-    });
-    expect(
-      doc.paths["/api/airports/v1/itinerary/{id}/"].delete["x-rastack-access"],
-    ).toEqual({ ownerField: "owner", scope: "owner", adminGroups: ["staff"] });
-    // Unscoped resources stay unstamped.
-    expect(
-      doc.paths["/api/airports/v1/airport/"].get["x-rastack-access"],
-    ).toBeUndefined();
-    expect(
-      doc.paths["/api/airports/v1/airport/"].get["x-rastack-permission"],
-    ).toBeUndefined();
-  });
-
-  it("round-trips through the existing hooks codegen", async () => {
-    const resources = analyzeResources(resourcesDir);
-    const doc = buildOpenApi(resources);
-    const paths = removeNonModelPaths(doc.paths);
-
-    const entitiesPath = join(workRoot, "entities");
-    mkdirSync(entitiesPath, { recursive: true });
-    await generateFolders(entitiesPath, paths);
-    await generateFiles(entitiesPath, paths);
-
-    // Non-sync entity → plain async hook.
-    const airportApi = readFileSync(
-      join(entitiesPath, "airports", "airport", "api.ts"),
-      "utf-8",
-    );
-    expect(airportApi).toContain("export function useListAirport(");
-
-    // Sync entity → store-backed hooks + a defineEntity descriptor.
-    const flightApi = readFileSync(
-      join(entitiesPath, "airports", "flight", "api.ts"),
-      "utf-8",
-    );
-    expect(flightApi).toContain("defineEntity<IFlight>({");
-    expect(flightApi).toContain("from 'rastack/sync'");
-  });
-});