tapimo 0.0.2 → 0.2.0

package/src/index.ts

@@ -1,10 +1,12 @@
 export * as ApiKey from './ApiKey.js'
-export * as ApiKeySource from './ApiKeySource.js'
+export * as ApiKeys from './ApiKeys.js'
 export * as App from './App.js'
 export * as Assets from './Assets.js'
 export * as Auth from './Auth.js'
-export * as Cli from './Cli.js'
+export * as Cli from './cli/Cli.js'
 export * as Client from './Client.js'
+export * as Db from './db/Db.js'
+export * as Handler from './Handler.js'
 export * as Log from './internal/Log.js'
 export * as Metrics from './Metrics.js'
 export * as RateLimit from './internal/RateLimit.js'

package/src/internal/Auth.test.ts

@@ -1,7 +1,7 @@
 import { Hono } from 'hono'
 import { requestId } from 'hono/request-id'
 import { Mppx, tempo } from 'mppx/hono'
-import { RateLimit } from 'cadent'
+import { RateLimit } from 'tapimo'
 import * as ApiKey from '../ApiKey.js'
 import * as Auth from './Auth.js'
 import * as Log from './Log.js'
@@ -96,7 +96,7 @@ describe('require', () => {
       // the downstream validator rejects it as `query_invalid` and the legacy
       // `?key=...` lane breaks on every strict-query endpoint.
       const auth = {
-        apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
         rateLimit: RateLimit.memory(),
       }
       const app = new Hono<Auth.Environment>()
@@ -241,7 +241,7 @@ describe('require', () => {
       const app = createApp({
         auth: {
           apiKey: {
-            source: TestApp.source({
+            resolve: TestApp.resolver({
               keys: [{ ...key, scopes: [Scope.wildcard], token }],
             }),
           },
@@ -267,13 +267,242 @@ describe('require', () => {
     })
   })
 
+  describe('session', () => {
+    const sessionPrincipal = {
+      id: 'usr_test',
+      identity: { provider: 'wallet', subject: '0x0000000000000000000000000000000000000001' },
+      type: 'session',
+    } as const satisfies Auth.SessionPrincipal
+
+    /** Harness with the session capability installed on the auth context. */
+    function createSessionApp(
+      options: {
+        policy?: Auth.require.Policy | undefined
+        resolve?: Auth.Session['resolve'] | undefined
+      } = {},
+    ) {
+      const auth = {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        rateLimit: RateLimit.memory(),
+        ...(options.resolve ? { session: { resolve: options.resolve } } : {}),
+      }
+      const app = new Hono<Auth.Environment>()
+      app.use('*', async (c, next) => {
+        c.set('auth', auth)
+        await next()
+      })
+      app.use('/protected', Auth.require(options.policy ?? { session: true }))
+      app.get('/protected', (c) => c.json(serializePrincipal(Auth.getPrincipal(c))))
+      return app
+    }
+
+    test('resolves cookie sessions for session-lane routes', async () => {
+      const app = createSessionApp({ resolve: async () => sessionPrincipal })
+      const response = await app.request('/protected')
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "id": "usr_test",
+          "type": "session",
+        }
+      `)
+    })
+
+    test('falls through to the session lane on invalid bearer tokens', async () => {
+      const app = createSessionApp({ resolve: async () => sessionPrincipal })
+      const response = await app.request('/protected', {
+        headers: { authorization: 'Bearer not-an-api-key' },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+    })
+
+    test('rejects anonymous requests without a session', async () => {
+      const app = createSessionApp({ resolve: async () => null })
+      const response = await app.request('/protected')
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+    })
+
+    test('stays closed without the app session capability', async () => {
+      const app = createSessionApp()
+      const response = await app.request('/protected')
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+    })
+
+    test('valid API keys win over sessions', async () => {
+      const app = createSessionApp({
+        policy: { apiKey: { scopes: ['data:read'] }, session: true },
+        resolve: async () => sessionPrincipal,
+      })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "id": "key_test",
+          "orgId": "org_test",
+          "type": "api_key",
+        }
+      `)
+    })
+
+    test('is not consulted on lane-less routes', async () => {
+      const app = createSessionApp({
+        policy: {},
+        resolve: async () => sessionPrincipal,
+      })
+      const response = await app.request('/protected')
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+    })
+  })
+
+  describe('superAdmin', () => {
+    const secret = 'tempo:sk:a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0'
+
+    /** Auth context with the super admin secret configured alongside the test key. */
+    function withSuperAdmin(): Auth.Context {
+      return {
+        apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+        rateLimit: RateLimit.memory(),
+        superAdmin: { tokenHash: ApiKey.hash(secret) },
+      }
+    }
+
+    test('resolves the super admin secret before key lookup', async () => {
+      const app = createApp({ auth: withSuperAdmin() })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "actor": "super_admin",
+          "id": "super_admin",
+          "type": "super_admin",
+        }
+      `)
+    })
+
+    test('accepts the super admin secret as a bearer token', async () => {
+      const app = createApp({ auth: withSuperAdmin() })
+      const response = await app.request('/protected', {
+        headers: { authorization: `Bearer ${secret}` },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+    })
+
+    test('bypasses scope checks', async () => {
+      const app = createApp({
+        auth: withSuperAdmin(),
+        policy: { apiKey: { scopes: [Scope.wildcard] } },
+      })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+    })
+
+    test('non-matching tokens fall through to key lookup', async () => {
+      const app = createApp({ auth: withSuperAdmin() })
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`200`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "id": "key_test",
+          "orgId": "org_test",
+          "type": "api_key",
+        }
+      `)
+    })
+
+    test('is disabled when unconfigured', async () => {
+      const app = createApp()
+      const response = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+      const body = await response.json()
+
+      expect(response.status).toMatchInlineSnapshot(`401`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": "api_key_invalid",
+            "message": "Invalid API key",
+          },
+        }
+      `)
+    })
+
+    test('is the only principal for lane-less routes', async () => {
+      const app = createApp({ auth: withSuperAdmin(), policy: {} })
+
+      const superAdmin = await app.request('/protected', {
+        headers: { 'tempo-api-key': secret },
+      })
+      expect(superAdmin.status).toMatchInlineSnapshot(`200`)
+
+      const keyed = await app.request('/protected', {
+        headers: { 'tempo-api-key': token },
+      })
+      const body = await keyed.json()
+      expect(keyed.status).toMatchInlineSnapshot(`403`)
+      expect(body).toMatchInlineSnapshot(`
+        {
+          "error": {
+            "code": "forbidden",
+            "message": "API key not permitted for this route",
+          },
+        }
+      `)
+
+      const anonymous = await app.request('/protected')
+      expect(anonymous.status).toMatchInlineSnapshot(`401`)
+    })
+
+    test('logs the principal actor, never the secret', async () => {
+      const entries: Log.Entry[] = []
+      const app = createApp({
+        auth: withSuperAdmin(),
+        logger: (entry) => {
+          entries.push(entry)
+        },
+      })
+      await app.request('/protected', { headers: { 'tempo-api-key': secret } })
+
+      expect(entries[0]?.principal).toMatchInlineSnapshot(`
+        {
+          "actor": "super_admin",
+          "id": "super_admin",
+          "type": "super_admin",
+        }
+      `)
+      expect(JSON.stringify(entries)).not.toContain(secret)
+    })
+  })
+
   describe('environment', () => {
     const sandboxToken = 'secret_sandbox'
 
     function createChainApp(options: { public?: boolean } = {}) {
       const auth: Auth.Context = {
         apiKey: {
-          source: TestApp.source({
+          resolve: TestApp.resolver({
             keys: [
               { ...key, scopes: [Scope.wildcard], token },
               {
@@ -399,7 +628,7 @@ describe('require', () => {
       const mpp = createMppServer()
       const app = createApp({
         auth: {
-          apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
           mpp,
           rateLimit: overQuota(),
         },
@@ -420,7 +649,7 @@ describe('require', () => {
       const mpp = createMppServer()
       const app = createApp({
         auth: {
-          apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
           mpp,
           rateLimit: overQuotaOnce(),
         },
@@ -451,7 +680,7 @@ describe('require', () => {
       const mpp = createMppServer()
       const app = createApp({
         auth: {
-          apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
           mpp,
           rateLimit: overQuota(),
         },
@@ -477,7 +706,7 @@ describe('require', () => {
       const mpp = createMppServer()
       const app = createApp({
         auth: {
-          apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
           mpp,
           rateLimit: overQuotaOnce(),
         },
@@ -537,7 +766,7 @@ describe('require', () => {
     test('returns rate-limit error without payment context', async () => {
       const app = createApp({
         auth: {
-          apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
           rateLimit: overQuota(),
         },
         policy: { public: { rateLimit: { perMinute: 1 } } },
@@ -561,7 +790,7 @@ describe('require', () => {
       try {
         const app = createApp({
           auth: {
-            apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
             rateLimit: {
               async consume() {
                 throw new Error('Network connection lost.')
@@ -594,7 +823,7 @@ describe('require', () => {
       try {
         const app = createApp({
           auth: {
-            apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
             rateLimit: {
               async consume() {
                 throw new Error('Network connection lost.')
@@ -613,6 +842,85 @@ describe('require', () => {
         error.mockRestore()
       }
     })
+
+    test('fails open (at warn) when the rate-limit store stalls past the timeout', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      vi.useFakeTimers()
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            // A hot Durable Object under a storage-latency blip never returns;
+            // the consume must not block the request indefinitely.
+            rateLimit: { consume: () => new Promise<never>(() => {}) },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const pending = app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+        // Advance past the 300ms consume timeout so it fails open.
+        await vi.advanceTimersByTimeAsync(300)
+        const response = await pending
+        const body = await response.json()
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(body).toMatchInlineSnapshot(`
+          {
+            "id": "203.0.113.10",
+            "type": "public",
+          }
+        `)
+        // A timeout is an expected degradation: warn, never error.
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        vi.useRealTimers()
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
+
+    test('fails open (at warn) when the rate-limit Durable Object is overloaded', async () => {
+      const error = vi.spyOn(console, 'error').mockImplementation(() => {})
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+      try {
+        const app = createApp({
+          auth: {
+            apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
+            rateLimit: {
+              async consume() {
+                throw Object.assign(
+                  new Error('Durable Object is overloaded. Requests queued for too long.'),
+                  { overloaded: true },
+                )
+              },
+            },
+          },
+          policy: { public: { rateLimit: { perMinute: 1 } } },
+        })
+        const response = await app.request('/protected', {
+          headers: { 'x-forwarded-for': '203.0.113.10' },
+        })
+        const body = await response.json()
+
+        expect(response.status).toMatchInlineSnapshot(`200`)
+        expect(response.headers.has('ratelimit-limit')).toMatchInlineSnapshot(`false`)
+        expect(body).toMatchInlineSnapshot(`
+          {
+            "id": "203.0.113.10",
+            "type": "public",
+          }
+        `)
+        expect(warn.mock.calls.length).toMatchInlineSnapshot(`1`)
+        expect(error.mock.calls.length).toMatchInlineSnapshot(`0`)
+      } finally {
+        warn.mockRestore()
+        error.mockRestore()
+      }
+    })
   })
 
   describe('rateLimit per-scope', () => {
@@ -632,7 +940,7 @@ describe('require', () => {
       const auth = {
         apiKey: {
           rateLimits: { 'data:read': { perMinute: 1 }, 'webhooks:write': { perMinute: 1 } },
-          source: TestApp.source({
+          resolve: TestApp.resolver({
             keys: [{ ...key, scopes: [Scope.wildcard], token }],
           }),
         },
@@ -686,7 +994,7 @@ describe('require', () => {
       const auth = {
         apiKey: {
           rateLimits: { 'data:read': { perMinute: 1_000 } },
-          source: TestApp.source({
+          resolve: TestApp.resolver({
             keys: [{ ...key, scopes: [Scope.wildcard], token }],
           }),
         },
@@ -710,7 +1018,7 @@ describe('require', () => {
     })
 
     test('per-key default overrides config default but not a route cap', async () => {
-      const source = TestApp.source({
+      const resolve = TestApp.resolver({
         keys: [
           {
             ...key,
@@ -723,7 +1031,7 @@ describe('require', () => {
 
       const open = createScopedApp({
         auth: {
-          apiKey: { rateLimits: { '*': { perMinute: 1_000 } }, source },
+          apiKey: { rateLimits: { '*': { perMinute: 1_000 } }, resolve },
           rateLimit: RateLimit.memory(),
         },
         routes: [{ path: '/protected', policy: { apiKey: { scopes: ['data:read'] } } }],
@@ -734,7 +1042,7 @@ describe('require', () => {
 
       const capped = createScopedApp({
         auth: {
-          apiKey: { rateLimits: { '*': { perMinute: 1_000 } }, source },
+          apiKey: { rateLimits: { '*': { perMinute: 1_000 } }, resolve },
           rateLimit: RateLimit.memory(),
         },
         routes: [
@@ -757,7 +1065,7 @@ describe('require', () => {
     test('per-key per-scope overrides everything including a route cap', async () => {
       const auth = {
         apiKey: {
-          source: TestApp.source({
+          resolve: TestApp.resolver({
             keys: [
               {
                 ...key,
@@ -790,7 +1098,7 @@ describe('require', () => {
       const entries: Log.Entry[] = []
       const app = createApp({
         auth: {
-          apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
           rateLimit: overQuota(),
         },
         logger: (entry) => void entries.push(entry),
@@ -817,7 +1125,7 @@ describe('require', () => {
       const mpp = createMppServer()
       const app = createApp({
         auth: {
-          apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+          apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
           mpp,
           rateLimit: overQuota(),
         },
@@ -846,7 +1154,7 @@ function createScopedApp(options: {
 }) {
   const auth = options.auth ?? {
     apiKey: {
-      source: TestApp.source({ keys: [{ ...key, scopes: [Scope.wildcard], token }] }),
+      resolve: TestApp.resolver({ keys: [{ ...key, scopes: [Scope.wildcard], token }] }),
     },
     rateLimit: RateLimit.memory(),
   }
@@ -872,7 +1180,7 @@ type Options = {
 
 function createApp(options: Options = {}) {
   const auth = options.auth ?? {
-    apiKey: { source: TestApp.source({ keys: [{ ...key, token }] }) },
+    apiKey: { resolve: TestApp.resolver({ keys: [{ ...key, token }] }) },
     rateLimit: RateLimit.memory(),
   }
   const app = new Hono<Auth.Environment>()
@@ -948,6 +1256,14 @@ function serializePrincipal(principal: Auth.Principal | null) {
       type: principal.type,
     }
 
+  if (principal.type === 'super_admin')
+    return {
+      actor: principal.actor,
+      id: principal.id,
+      ...payment,
+      type: principal.type,
+    }
+
   return {
     id: principal.id,
     ...payment,