rastack 0.0.58 → 0.0.60

package/test/cache.spec.ts

@@ -1,263 +0,0 @@
-import {
-  AccessRevokedError,
-  CacheExpiredError,
-  createEncryptedCacheStorage,
-  generateEncryptionKey,
-  IcebergFileCache,
-  MemoryCacheStorage,
-  purgeLocalData,
-  WarehouseFileSource,
-} from "../cache";
-
-/**
- * The cache is exercised against an in-memory "object store" that counts
- * fetches — the observable contract is Iceberg's: the version hint is the only
- * file re-fetched once cached copies exist, immutable snapshot/data files are
- * fetched exactly once, and revoked access deletes the identity's cache.
- */
-
-const encoder = new TextEncoder();
-
-class FakeWarehouse implements WarehouseFileSource {
-  files = new Map<string, Uint8Array>();
-  fetches: string[] = [];
-  revoked = false;
-  offline = false;
-
-  async fetchFile(key: string): Promise<Uint8Array | null> {
-    if (this.revoked) throw new AccessRevokedError("revoked", 403);
-    if (this.offline) throw new Error("network unreachable");
-    this.fetches.push(key);
-    return this.files.get(key) ?? null;
-  }
-
-  /** Commit snapshot `version` for the table with the given data files. */
-  commit(prefix: string, version: number, dataFiles: Record<string, object[]>) {
-    this.files.set(
-      `${prefix}/metadata/version-hint.text`,
-      encoder.encode(String(version)),
-    );
-    this.files.set(
-      `${prefix}/metadata/v${version}.metadata.json`,
-      encoder.encode(
-        JSON.stringify({
-          format: "rastack-iceberg-v1",
-          data_files: Object.keys(dataFiles),
-          next_int_id: 99,
-        }),
-      ),
-    );
-    for (const [rel, rows] of Object.entries(dataFiles)) {
-      this.files.set(`${prefix}/${rel}`, encoder.encode(JSON.stringify(rows)));
-    }
-  }
-}
-
-class FakeEngine {
-  seeded: string[] = [];
-  async seedFile(key: string): Promise<void> {
-    this.seeded.push(key);
-  }
-}
-
-const RESOURCES = [{ app: "airports", model: "airport" }];
-const PREFIX = "airports.db/airport";
-
-function makeCache(source: FakeWarehouse, identity = "alice-sub") {
-  const storage = new MemoryCacheStorage();
-  return {
-    storage,
-    cache: new IcebergFileCache({ storage, source, identity }),
-  };
-}
-
-describe("IcebergFileCache", () => {
-  it("cold seed fetches the Iceberg tree and feeds it to the engine", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1, code: "JFK" }] });
-    const { cache } = makeCache(source);
-    const engine = new FakeEngine();
-
-    const stats = await cache.seed(engine, RESOURCES);
-
-    expect(stats).toEqual({ tables: 1, fromCache: 0, fetched: 3 });
-    expect(engine.seeded).toEqual([
-      `${PREFIX}/metadata/version-hint.text`,
-      `${PREFIX}/metadata/v1.metadata.json`,
-      `${PREFIX}/data/v1.json`,
-    ]);
-  });
-
-  it("warm seed with no new commit refetches only the version hint", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const { cache } = makeCache(source);
-
-    await cache.seed(new FakeEngine(), RESOURCES);
-    source.fetches = [];
-
-    const stats = await cache.seed(new FakeEngine(), RESOURCES);
-    // One small network read (the pointer); the immutable files came from cache.
-    expect(source.fetches).toEqual([`${PREFIX}/metadata/version-hint.text`]);
-    expect(stats).toEqual({ tables: 1, fromCache: 2, fetched: 1 });
-  });
-
-  it("a new snapshot fetches only unseen files and prunes superseded ones", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const { cache, storage } = makeCache(source);
-    await cache.seed(new FakeEngine(), RESOURCES);
-
-    // Update/delete rewrite a compacted snapshot: v2 supersedes v1's file.
-    source.commit(PREFIX, 2, { "data/v2.json": [{ id: 1, name: "x" }] });
-    source.fetches = [];
-
-    const engine = new FakeEngine();
-    await cache.seed(engine, RESOURCES);
-
-    expect(source.fetches).toEqual([
-      `${PREFIX}/metadata/version-hint.text`,
-      `${PREFIX}/metadata/v2.metadata.json`,
-      `${PREFIX}/data/v2.json`,
-    ]);
-    expect(engine.seeded).toContain(`${PREFIX}/data/v2.json`);
-    // The superseded snapshot's files no longer occupy the device.
-    const keys = await storage.keys("");
-    expect(keys.some((k) => k.includes("v1.metadata.json"))).toBe(false);
-    expect(keys.some((k) => k.includes("data/v1.json"))).toBe(false);
-  });
-
-  it("falls back to the cached pointer when offline", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const { cache } = makeCache(source);
-    await cache.seed(new FakeEngine(), RESOURCES);
-
-    source.offline = true;
-    const engine = new FakeEngine();
-    const stats = await cache.seed(engine, RESOURCES);
-    expect(stats.tables).toBe(1);
-    expect(stats.fetched).toBe(0);
-    expect(engine.seeded).toHaveLength(3);
-  });
-
-  it("revoked access deletes the identity's cached data and surfaces the error", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const { cache, storage } = makeCache(source);
-    await cache.seed(new FakeEngine(), RESOURCES);
-    expect(await storage.keys("alice-sub::")).not.toHaveLength(0);
-
-    source.revoked = true;
-    await expect(cache.seed(new FakeEngine(), RESOURCES)).rejects.toThrow(
-      AccessRevokedError,
-    );
-    // Nothing of alice's survives on the device.
-    expect(await storage.keys("alice-sub::")).toHaveLength(0);
-  });
-
-  it("enforces the offline-retention bound: stale cache is deleted, not served", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const storage = new MemoryCacheStorage();
-    let clock = 1_000_000;
-    const cache = new IcebergFileCache({
-      storage,
-      source,
-      identity: "alice",
-      maxOfflineMs: 60_000,
-      now: () => clock,
-    });
-    await cache.seed(new FakeEngine(), RESOURCES);
-
-    // Offline but within the bound: cached data still serves.
-    source.offline = true;
-    clock += 30_000;
-    expect((await cache.seed(new FakeEngine(), RESOURCES)).tables).toBe(1);
-
-    // Past the bound: the cache refuses AND deletes the identity's data.
-    clock += 60_001;
-    await expect(cache.seed(new FakeEngine(), RESOURCES)).rejects.toThrow(
-      CacheExpiredError,
-    );
-    expect(await storage.keys("alice::")).toHaveLength(0);
-
-    // Back online: re-verification restores service from the source.
-    source.offline = false;
-    expect((await cache.seed(new FakeEngine(), RESOURCES)).tables).toBe(1);
-  });
-
-  it("namespaces isolate identities sharing one device", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1 }] });
-    const storage = new MemoryCacheStorage();
-    const alice = new IcebergFileCache({ storage, source, identity: "alice" });
-    const bob = new IcebergFileCache({ storage, source, identity: "bob" });
-
-    await alice.seed(new FakeEngine(), RESOURCES);
-    await bob.seed(new FakeEngine(), RESOURCES);
-
-    await purgeLocalData({ identity: "alice", cacheStorage: storage });
-    expect(await storage.keys("alice::")).toHaveLength(0);
-    expect(await storage.keys("bob::")).not.toHaveLength(0);
-  });
-});
-
-describe("createEncryptedCacheStorage", () => {
-  it("round-trips values while storing only ciphertext", async () => {
-    const inner = new MemoryCacheStorage();
-    const key = await generateEncryptionKey();
-    const storage = createEncryptedCacheStorage(inner, key);
-    const plaintext = encoder.encode("sensitive row data");
-
-    await storage.put("k", plaintext);
-    expect(new Uint8Array((await storage.get("k"))!)).toEqual(plaintext);
-
-    // What actually hits the device is sealed: different bytes, and a fresh
-    // random IV means two writes of the same value differ too.
-    const sealed1 = (await inner.get("k"))!;
-    expect(Buffer.from(sealed1).includes(Buffer.from(plaintext))).toBe(false);
-    await storage.put("k", plaintext);
-    expect((await inner.get("k"))!).not.toEqual(sealed1);
-  });
-
-  it("treats undecryptable bytes as a cache miss, never as data", async () => {
-    const inner = new MemoryCacheStorage();
-    const storage = createEncryptedCacheStorage(inner, await generateEncryptionKey());
-    await storage.put("k", encoder.encode("secret"));
-
-    // Read back under a different key → miss.
-    const other = createEncryptedCacheStorage(inner, await generateEncryptionKey());
-    expect(await other.get("k")).toBeNull();
-
-    // Tampered ciphertext → authenticated decryption fails → miss.
-    const sealed = (await inner.get("k"))!;
-    sealed[sealed.length - 1] ^= 0xff;
-    await inner.put("k", sealed);
-    expect(await storage.get("k")).toBeNull();
-  });
-
-  it("works end-to-end as the IcebergFileCache storage", async () => {
-    const source = new FakeWarehouse();
-    source.commit(PREFIX, 1, { "data/v1.json": [{ id: 1, code: "JFK" }] });
-    const inner = new MemoryCacheStorage();
-    const cache = new IcebergFileCache({
-      storage: createEncryptedCacheStorage(inner, await generateEncryptionKey()),
-      source,
-      identity: "alice",
-    });
-
-    await cache.seed(new FakeEngine(), RESOURCES);
-    source.fetches = [];
-    const stats = await cache.seed(new FakeEngine(), RESOURCES);
-    // Warm-cache behaviour is unchanged by encryption.
-    expect(stats).toEqual({ tables: 1, fromCache: 2, fetched: 1 });
-    // And nothing readable sits on the device.
-    const stored = await Promise.all(
-      (await inner.keys("alice::")).map((k) => inner.get(k)),
-    );
-    for (const bytes of stored) {
-      expect(Buffer.from(bytes!).includes(Buffer.from("JFK"))).toBe(false);
-    }
-  });
-});

package/test/cognito.spec.ts

@@ -1,281 +0,0 @@
-/**
- * The Cognito auth core (`rastack/auth`): PKCE (S256, against the RFC 7636 test
- * vector), Hosted UI URL builders, the `/oauth2/token` request body, JWT
- * decoding, session shaping + expiry, redirect parsing, and the server-less
- * local session.
- */
-
-import {
-  authorizeUrl,
-  base64UrlDecode,
-  base64UrlDecodeToBytes,
-  base64UrlEncode,
-  codeChallengeFromVerifier,
-  createPkcePair,
-  decodeJwt,
-  hostedUiOrigin,
-  isSessionValid,
-  issuerUrl,
-  localSession,
-  logoutUrl,
-  parseRedirect,
-  randomCodeVerifier,
-  sessionFromTokens,
-  tokenEndpoint,
-  tokenRequestBody,
-  userFromClaims,
-  type CognitoAuthConfig,
-  type CognitoTokenResponse,
-} from "../src/auth/cognito";
-import { cognitoToRastackAuth } from "../auth/provider";
-
-const CONFIG: CognitoAuthConfig = {
-  domain: "myapp.auth.us-east-1.amazoncognito.com",
-  clientId: "abc123clientid",
-  redirectUri: "https://app.example.com/callback",
-  region: "us-east-1",
-  userPoolId: "us-east-1_Pool",
-};
-
-/** Build a signed-shaped JWT (unsigned) carrying the given payload. */
-function makeJwt(payload: Record<string, unknown>): string {
-  const seg = (v: unknown) =>
-    base64UrlEncode(new TextEncoder().encode(JSON.stringify(v)));
-  return `${seg({ alg: "RS256", typ: "JWT" })}.${seg(payload)}.sig`;
-}
-
-describe("base64url", () => {
-  it("round-trips bytes and strips padding", () => {
-    const bytes = new Uint8Array([0, 1, 2, 250, 251, 252, 253]);
-    const encoded = base64UrlEncode(bytes);
-    expect(encoded).not.toMatch(/[+/=]/);
-    expect([...base64UrlDecodeToBytes(encoded)]).toEqual([...bytes]);
-  });
-
-  it("decodes a UTF-8 payload", () => {
-    const encoded = base64UrlEncode(new TextEncoder().encode('{"é":"✓"}'));
-    expect(base64UrlDecode(encoded)).toBe('{"é":"✓"}');
-  });
-});
-
-describe("PKCE", () => {
-  it("derives the S256 challenge from the RFC 7636 test vector", async () => {
-    const verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
-    const challenge = await codeChallengeFromVerifier(verifier);
-    expect(challenge).toBe("E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM");
-  });
-
-  it("generates a url-safe verifier of the expected length", () => {
-    const verifier = randomCodeVerifier(new Uint8Array(32).fill(7));
-    expect(verifier).not.toMatch(/[+/=]/);
-    expect(verifier.length).toBeGreaterThanOrEqual(43);
-  });
-
-  it("creates a matching verifier/challenge pair", async () => {
-    const bytes = new Uint8Array(32).map((_, i) => i);
-    const { verifier, challenge } = await createPkcePair(bytes);
-    expect(verifier).toBe(randomCodeVerifier(bytes));
-    expect(challenge).toBe(await codeChallengeFromVerifier(verifier));
-  });
-});
-
-describe("Hosted UI URLs", () => {
-  it("builds the authorize URL with PKCE + default scopes", () => {
-    const url = new URL(
-      authorizeUrl(CONFIG, { state: "st8", codeChallenge: "chal" }),
-    );
-    expect(url.origin + url.pathname).toBe(
-      "https://myapp.auth.us-east-1.amazoncognito.com/oauth2/authorize",
-    );
-    expect(url.searchParams.get("response_type")).toBe("code");
-    expect(url.searchParams.get("client_id")).toBe("abc123clientid");
-    expect(url.searchParams.get("redirect_uri")).toBe(
-      "https://app.example.com/callback",
-    );
-    expect(url.searchParams.get("scope")).toBe("openid email profile");
-    expect(url.searchParams.get("code_challenge")).toBe("chal");
-    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
-    expect(url.searchParams.get("state")).toBe("st8");
-  });
-
-  it("honours custom scopes and strips a scheme from the domain", () => {
-    const url = new URL(
-      authorizeUrl(
-        { ...CONFIG, domain: "https://auth.example.com/", scopes: ["openid"] },
-        { state: "s", codeChallenge: "c" },
-      ),
-    );
-    expect(url.origin).toBe("https://auth.example.com");
-    expect(url.searchParams.get("scope")).toBe("openid");
-  });
-
-  it("builds the logout URL, defaulting logout_uri to redirect_uri", () => {
-    const url = new URL(logoutUrl(CONFIG));
-    expect(url.pathname).toBe("/logout");
-    expect(url.searchParams.get("logout_uri")).toBe(
-      "https://app.example.com/callback",
-    );
-  });
-
-  it("derives the origin, token endpoint and issuer", () => {
-    expect(hostedUiOrigin(CONFIG)).toBe(
-      "https://myapp.auth.us-east-1.amazoncognito.com",
-    );
-    expect(tokenEndpoint(CONFIG)).toBe(
-      "https://myapp.auth.us-east-1.amazoncognito.com/oauth2/token",
-    );
-    expect(issuerUrl(CONFIG)).toBe(
-      "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_Pool",
-    );
-  });
-});
-
-describe("token request body", () => {
-  it("encodes an authorization_code grant with the verifier", () => {
-    const body = new URLSearchParams(
-      tokenRequestBody(CONFIG, {
-        grantType: "authorization_code",
-        code: "the-code",
-        codeVerifier: "the-verifier",
-      }),
-    );
-    expect(body.get("grant_type")).toBe("authorization_code");
-    expect(body.get("client_id")).toBe("abc123clientid");
-    expect(body.get("code")).toBe("the-code");
-    expect(body.get("redirect_uri")).toBe("https://app.example.com/callback");
-    expect(body.get("code_verifier")).toBe("the-verifier");
-  });
-
-  it("encodes a refresh_token grant", () => {
-    const body = new URLSearchParams(
-      tokenRequestBody(CONFIG, {
-        grantType: "refresh_token",
-        refreshToken: "rt",
-      }),
-    );
-    expect(body.get("grant_type")).toBe("refresh_token");
-    expect(body.get("refresh_token")).toBe("rt");
-    expect(body.has("code")).toBe(false);
-  });
-});
-
-describe("JWT + claims", () => {
-  it("decodes a JWT payload without verifying", () => {
-    const token = makeJwt({ sub: "user-1", email: "a@b.co" });
-    expect(decodeJwt(token)).toMatchObject({ sub: "user-1", email: "a@b.co" });
-  });
-
-  it("throws on a malformed token", () => {
-    expect(() => decodeJwt("not-a-jwt")).toThrow(/Malformed JWT/);
-  });
-
-  it("projects cognito:groups into the user (empty when absent)", () => {
-    expect(
-      userFromClaims({ sub: "s", "cognito:groups": ["admin", "ops"] }),
-    ).toEqual({ sub: "s", email: undefined, username: "s", groups: ["admin", "ops"] });
-    expect(userFromClaims({ sub: "s", email: "e@x.co" }).groups).toEqual([]);
-  });
-});
-
-describe("sessions", () => {
-  const now = 1_000_000_000_000;
-
-  it("builds a session from tokens, using the token's own exp", () => {
-    const idToken = makeJwt({
-      sub: "u9",
-      exp: Math.floor(now / 1000) + 3600,
-      "cognito:groups": ["pilots"],
-      email: "pilot@sky.co",
-    });
-    const tokens: CognitoTokenResponse = {
-      id_token: idToken,
-      access_token: makeJwt({ sub: "u9" }),
-      refresh_token: "rt",
-      expires_in: 3600,
-    };
-    const session = sessionFromTokens(tokens, now);
-    expect(session.user).toMatchObject({ sub: "u9", groups: ["pilots"] });
-    expect(session.expiresAt).toBe((Math.floor(now / 1000) + 3600) * 1000);
-    expect(session.refreshToken).toBe("rt");
-  });
-
-  it("validates against expiry with skew", () => {
-    const session = sessionFromTokens(
-      {
-        id_token: makeJwt({ sub: "u", exp: Math.floor(now / 1000) + 3600 }),
-        access_token: "a",
-      },
-      now,
-    );
-    expect(isSessionValid(session, now)).toBe(true);
-    expect(isSessionValid(session, session.expiresAt - 10_000, 30_000)).toBe(false);
-    expect(isSessionValid(null, now)).toBe(false);
-  });
-});
-
-describe("redirect parsing", () => {
-  it("parses code + state from a search string or full URL", () => {
-    expect(parseRedirect("?code=abc&state=xyz")).toMatchObject({
-      code: "abc",
-      state: "xyz",
-    });
-    expect(
-      parseRedirect("https://app.example.com/callback?code=c1&state=s1"),
-    ).toMatchObject({ code: "c1", state: "s1" });
-  });
-
-  it("surfaces an OAuth error", () => {
-    const r = parseRedirect("?error=access_denied&error_description=nope");
-    expect(r.error).toBe("access_denied");
-    expect(r.errorDescription).toBe("nope");
-    expect(r.code).toBeUndefined();
-  });
-});
-
-describe("local (server-less) session", () => {
-  const now = 2_000_000_000_000;
-
-  it("mints a decodable, valid session with groups", () => {
-    const session = localSession(
-      { sub: "ops-lead", email: "lead@sky.co", groups: ["admins"] },
-      now,
-    );
-    expect(session.user).toMatchObject({
-      sub: "ops-lead",
-      email: "lead@sky.co",
-      groups: ["admins"],
-    });
-    expect(isSessionValid(session, now)).toBe(true);
-    // The minted token is a real-shaped JWT the same decoder reads back.
-    expect(decodeJwt(session.idToken)).toMatchObject({ sub: "ops-lead" });
-  });
-
-  it("defaults the subject and carries no groups", () => {
-    const session = localSession({}, now);
-    expect(session.user.sub).toBe("local-dev");
-    expect(session.user.groups).toEqual([]);
-  });
-});
-
-describe("bridge to the authorization half (RastackAuth)", () => {
-  const now = 2_000_000_000_000;
-
-  it("maps a signed-in session's claims into a RastackAuth", () => {
-    const session = localSession({ sub: "u1", groups: ["admins"] }, now);
-    const auth = cognitoToRastackAuth({
-      isAuthenticated: true,
-      claims: session.claims,
-    });
-    expect(auth).toEqual({
-      authenticated: true,
-      sub: "u1",
-      groups: ["admins"],
-    });
-  });
-
-  it("maps a signed-out state to an anonymous identity", () => {
-    expect(cognitoToRastackAuth({ isAuthenticated: false, claims: null })).toEqual(
-      { authenticated: false, groups: [] },
-    );
-  });
-});