tapimo 0.15.1 → 0.18.1

package/src/internal/BetterAuth.test.ts

@@ -2,10 +2,51 @@ import { getSchema } from 'better-auth/db'
 import { sql } from 'kysely'
 
 import * as TestApp from '../../test/App.js'
+import * as Db from '../db/Db.js'
 import * as BetterAuth from './BetterAuth.js'
 import * as RateLimit from './RateLimit.js'
 
 describe('create', () => {
+  test('reads the session and user in one query', async () => {
+    const db = TestApp.database()
+    let queries = 0
+    try {
+      const auth = BetterAuth.create(Db.observe(db, { onQuery: () => queries++ }), {
+        basePath: '/v1/auth',
+        baseUrl: 'https://api.example.com',
+        rateLimit: RateLimit.memory(),
+        secret: 'test-better-auth-secret-at-least-32-characters',
+        secureCookies: true,
+      })
+      const context = await auth.$context
+      const user = await context.internalAdapter.createUser(
+        { email: 'developer@example.com', name: 'Tempo Developer' },
+        { method: 'email-otp' },
+      )
+      const session = await context.internalAdapter.createSession(user.id)
+      queries = 0
+
+      expect(await context.internalAdapter.findSession(session.token)).toMatchObject({
+        session: {
+          createdAt: expect.any(Date),
+          expiresAt: expect.any(Date),
+          id: session.id,
+          updatedAt: expect.any(Date),
+          userId: user.id,
+        },
+        user: {
+          createdAt: expect.any(Date),
+          email: user.email,
+          id: user.id,
+          updatedAt: expect.any(Date),
+        },
+      })
+      expect(queries).toMatchInlineSnapshot('1')
+    } finally {
+      await db.close()
+    }
+  })
+
   test('uses the pinned schema through Tempo Kysely', async () => {
     const db = TestApp.database()
     try {
@@ -34,6 +75,9 @@ describe('create', () => {
         providerId: 'email-otp',
         userId: user.id,
       })
+      expect(await db.kysely.selectFrom('users').selectAll().executeTakeFirst()).toMatchObject({
+        termsSharedAt: null,
+      })
       const session = await context.internalAdapter.createSession(user.id)
       const verification = await context.internalAdapter.createVerificationValue({
         expiresAt: new Date(Date.now() + 300_000),
@@ -60,7 +104,8 @@ describe('create', () => {
         createdAt: user.createdAt.toISOString(),
         email: 'developer@example.com',
         id: user.id,
-        updatedAt: user.updatedAt.toISOString(),
+        termsSharedAt: expect.any(String),
+        updatedAt: expect.any(String),
       })
       await expect(
         db.kysely.selectFrom('auth_accounts').selectAll().executeTakeFirst(),
@@ -109,27 +154,18 @@ describe('create', () => {
           ]
         })
         .sort((a, b) => `${a.table}.${a.column}`.localeCompare(`${b.table}.${b.column}`))
-      const currentSchema = (
-        await sql<{ schema: string }>`SELECT current_schema() AS schema`.execute(db.kysely)
-      ).rows[0]!.schema
-      const tables = await db.kysely.introspection.getTables()
-      const actualColumns = tables
-        .filter(
-          (table) =>
-            table.schema === currentSchema && [...tableNames.values()].includes(table.name),
-        )
-        .flatMap((table) =>
-          table.columns
-            .filter((column) =>
-              expectedColumns.some(
-                (expected) => expected.table === table.name && expected.column === column.name,
-              ),
-            )
-            .map((column) => ({
-              column: column.name,
-              nullable: column.isNullable,
-              table: table.name,
-            })),
+      // Scope the query to auth tables because other tests migrate and drop their schemas concurrently.
+      const columns = await sql<{ column: string; nullable: boolean; table: string }>`
+        SELECT column_name AS "column", is_nullable = 'YES' AS nullable, table_name AS "table"
+        FROM information_schema.columns
+        WHERE table_schema = current_schema()
+          AND table_name IN (${sql.join([...tableNames.values()])})
+      `.execute(db.kysely)
+      const actualColumns = columns.rows
+        .filter((column) =>
+          expectedColumns.some(
+            (expected) => expected.table === column.table && expected.column === column.column,
+          ),
         )
         .sort((a, b) => `${a.table}.${a.column}`.localeCompare(`${b.table}.${b.column}`))
       expect(actualColumns).toStrictEqual(expectedColumns)

package/src/internal/BetterAuth.ts

@@ -17,6 +17,8 @@ import {
 } from 'kysely'
 
 import * as Db from '../db/Db.js'
+import * as Users from '../db/tables/users.js'
+import * as ExecutionContext from './ExecutionContext.js'
 import * as Id from './Id.js'
 import type * as RateLimit from './RateLimit.js'
 
@@ -76,6 +78,7 @@ export function create(source: Db.Source, options: create.Options) {
       cookiePrefix: 'tempo_auth',
       database: {
         generateId: ({ model }) => Id.generate(idPrefix[model] ?? 'auth'),
+        joins: true,
       },
       defaultCookieAttributes: {
         httpOnly: true,
@@ -98,14 +101,23 @@ export function create(source: Db.Source, options: create.Options) {
         async transformResult(options) {
           return {
             ...options.result,
-            rows: options.result.rows.map((row) => ({
-              ...row,
-              ...Object.fromEntries(
-                dateFields.flatMap((field) =>
-                  typeof row[field] === 'string' ? [[field, new Date(row[field])]] : [],
-                ),
+            // Joined columns carry model-prefixed names but retain Better Auth's Date contract.
+            rows: options.result.rows.map((row) =>
+              Object.fromEntries(
+                Object.entries(row).map(([field, value]) => [
+                  field,
+                  typeof value === 'string' &&
+                  dateFields.some(
+                    (name) =>
+                      field === name ||
+                      (field.startsWith('_Joined') &&
+                        field.endsWith(`${name.charAt(0).toUpperCase()}${name.slice(1)}`)),
+                  )
+                    ? new Date(value)
+                    : value,
+                ]),
               ),
-            })),
+            ),
           }
         },
       } satisfies KyselyPlugin),
@@ -132,6 +144,9 @@ export function create(source: Db.Source, options: create.Options) {
             if (!provider) return
             return { data: { ...session, provider } }
           },
+          async after(session) {
+            await Users.recordTermsShared(db, session.userId)
+          },
         },
       },
     },
@@ -281,7 +296,7 @@ export function fromContext(c: hono_Context, options: fromContext.Options) {
     forwardedOrigin && options.trustedOrigins?.includes(forwardedOrigin)
       ? forwardedOrigin
       : url.origin
-  const waitUntil = getWaitUntil(c)
+  const waitUntil = ExecutionContext.waitUntil(c)
   return create(options.db, {
     basePath: options.basePath,
     baseUrl,
@@ -326,15 +341,6 @@ export declare namespace fromContext {
   }
 }
 
-function getWaitUntil(c: hono_Context) {
-  try {
-    const context = c.executionCtx
-    return context ? context.waitUntil.bind(context) : undefined
-  } catch {
-    return undefined
-  }
-}
-
 /** Raised if a mounted Better Auth route requests an unsupported rate-limit window. */
 export class UnsupportedRateLimitWindowError extends Error {
   override name = 'BetterAuth.UnsupportedRateLimitWindowError'

package/src/internal/Cache.ts

@@ -225,7 +225,9 @@ export function urlKey<
   return url.toString()
 }
 
-namespace Etag {
+/** Entity-tag helpers for conditional requests. */
+export namespace Etag {
+  /** Whether an `If-None-Match` header names the entity tag, ignoring weak markers. */
   export function matches(etag: string | null, ifNoneMatch: string | undefined) {
     if (!etag || !ifNoneMatch) return false
     return ifNoneMatch.split(/,\s*/).some((tag) => stripWeak(tag) === stripWeak(etag))

package/src/internal/CliAuth.test.ts

@@ -0,0 +1,279 @@
+import * as CliAuth from './CliAuth.js'
+import * as Store from './Store.js'
+
+// RFC 7636 appendix B test vector.
+const codeVerifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'
+const codeChallenge = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM'
+const client = { device: 'build-box', name: 'tempo api 0.1.0' }
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('generateCode', () => {
+  test('produces 8 consonants from the code alphabet', () => {
+    for (let i = 0; i < 200; i++)
+      expect(CliAuth.generateCode()).toMatch(/^[BCDFGHJKLMNPQRSTVWXZ]{8}$/)
+  })
+})
+
+describe('normalizeCode', () => {
+  test('accepts lowercase, dashes, and spaces', () => {
+    expect(CliAuth.normalizeCode('bcdf-ghjk')).toMatchInlineSnapshot(`"BCDFGHJK"`)
+    expect(CliAuth.normalizeCode(' BCDF GHJK ')).toMatchInlineSnapshot(`"BCDFGHJK"`)
+  })
+
+  test('rejects vowels, digits, and wrong lengths', () => {
+    expect(CliAuth.normalizeCode('ABCD-EFGH')).toBeUndefined()
+    expect(CliAuth.normalizeCode('BCDF-GHJ1')).toBeUndefined()
+    expect(CliAuth.normalizeCode('BCDF-GHJ')).toBeUndefined()
+    expect(CliAuth.normalizeCode('BCDF-GHJKL')).toBeUndefined()
+  })
+})
+
+describe('formatCode', () => {
+  test('inserts a separator for display', () => {
+    expect(CliAuth.formatCode('BCDFGHJK')).toMatchInlineSnapshot(`"BCDF-GHJK"`)
+  })
+})
+
+describe('challengeFrom', () => {
+  test('matches the RFC 7636 S256 test vector', () => {
+    expect(CliAuth.challengeFrom(codeVerifier)).toBe(codeChallenge)
+  })
+})
+
+describe('generateToken', () => {
+  test('produces a prefixed 64-hex token recognized by isToken', () => {
+    const token = CliAuth.generateToken()
+    expect(token).toMatch(/^tempo:cli:[a-f0-9]{64}$/)
+    expect(CliAuth.isToken(token)).toBe(true)
+  })
+})
+
+describe('isToken', () => {
+  test('rejects API keys', () => {
+    expect(CliAuth.isToken(`tempo:sk:${'ab'.repeat(24)}`)).toBe(false)
+    expect(CliAuth.isToken(`tempo_sandbox:sk:${'ab'.repeat(24)}`)).toBe(false)
+  })
+})
+
+describe('redact', () => {
+  test('masks embedded CLI tokens', () => {
+    expect(
+      CliAuth.redact(`Authorization: Bearer tempo:cli:${'ab'.repeat(32)} failed`),
+    ).toMatchInlineSnapshot(`"Authorization: Bearer tempo:cli:… failed"`)
+  })
+})
+
+describe('authorize', () => {
+  test('stores a pending authorization readable by its code', async () => {
+    const store = Store.memory()
+    const authorization = await CliAuth.authorize(store, {
+      client,
+      codeChallenge,
+      ip: '203.0.113.7',
+    })
+    const { code, createdAt, expiresAt, ...rest } = authorization
+    expect(code).toMatch(/^[BCDFGHJKLMNPQRSTVWXZ]{8}$/)
+    expect(Date.parse(expiresAt) - Date.parse(createdAt)).toBe(CliAuth.authorizationTtl)
+    expect(rest).toMatchInlineSnapshot(`
+      {
+        "client": {
+          "device": "build-box",
+          "name": "tempo api 0.1.0",
+        },
+        "codeChallenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+        "ip": "203.0.113.7",
+        "status": "pending",
+      }
+    `)
+    expect(await CliAuth.getAuthorization(store, code)).toEqual(authorization)
+  })
+})
+
+describe('getAuthorization', () => {
+  test('returns undefined once the stored deadline passes', async () => {
+    vi.useFakeTimers()
+    const store = Store.memory()
+    const { code } = await CliAuth.authorize(store, { client: {}, codeChallenge })
+    vi.advanceTimersByTime(CliAuth.authorizationTtl)
+    expect(await CliAuth.getAuthorization(store, code)).toBeUndefined()
+  })
+})
+
+describe('approve', () => {
+  test('retains the original scope consent on repeated approval', async () => {
+    const store = Store.memory()
+    const { code } = await CliAuth.authorize(store, { client, codeChallenge })
+    await CliAuth.approve(store, { code, scopes: ['data:read'], userId: 'usr_a' })
+    await CliAuth.approve(store, { code, scopes: [], userId: 'usr_a' })
+    const result = await CliAuth.redeem(store, { code, codeVerifier })
+    expect(result?.status === 'approved' && result.session.scopes).toMatchInlineSnapshot(`
+      [
+        "data:read",
+      ]
+    `)
+  })
+  test('approves a pending authorization and is idempotent for the same user', async () => {
+    const store = Store.memory()
+    const { code } = await CliAuth.authorize(store, { client: {}, codeChallenge })
+    const first = await CliAuth.approve(store, { code, userId: 'usr_a' })
+    expect(first.status).toBe('approved')
+    expect(first.authorization?.userId).toBe('usr_a')
+    expect((await CliAuth.approve(store, { code, userId: 'usr_a' })).status).toBe('approved')
+  })
+
+  test('conflicts when another user already approved or the request was denied', async () => {
+    const store = Store.memory()
+    const approved = await CliAuth.authorize(store, { client: {}, codeChallenge })
+    await CliAuth.approve(store, { code: approved.code, userId: 'usr_a' })
+    expect(await CliAuth.approve(store, { code: approved.code, userId: 'usr_b' })).toEqual({
+      status: 'conflict',
+    })
+
+    const denied = await CliAuth.authorize(store, { client: {}, codeChallenge })
+    await CliAuth.deny(store, denied.code)
+    expect(await CliAuth.approve(store, { code: denied.code, userId: 'usr_a' })).toEqual({
+      status: 'conflict',
+    })
+  })
+
+  test('reports unknown codes', async () => {
+    expect(await CliAuth.approve(Store.memory(), { code: 'BCDFGHJK', userId: 'usr_a' })).toEqual({
+      status: 'not_found',
+    })
+  })
+
+  test('keeps the original deadline', async () => {
+    vi.useFakeTimers()
+    const store = Store.memory()
+    const { code, expiresAt } = await CliAuth.authorize(store, { client: {}, codeChallenge })
+    vi.advanceTimersByTime(CliAuth.authorizationTtl - 1_000)
+    const { authorization } = await CliAuth.approve(store, { code, userId: 'usr_a' })
+    expect(authorization?.expiresAt).toBe(expiresAt)
+    vi.advanceTimersByTime(1_000)
+    expect(await CliAuth.getAuthorization(store, code)).toBeUndefined()
+  })
+})
+
+describe('deny', () => {
+  test('denies a pending authorization', async () => {
+    const store = Store.memory()
+    const { code } = await CliAuth.authorize(store, { client: {}, codeChallenge })
+    expect(await CliAuth.deny(store, code)).toEqual({ status: 'denied' })
+    expect((await CliAuth.getAuthorization(store, code))?.status).toBe('denied')
+  })
+
+  test('conflicts once approved', async () => {
+    const store = Store.memory()
+    const { code } = await CliAuth.authorize(store, { client: {}, codeChallenge })
+    await CliAuth.approve(store, { code, userId: 'usr_a' })
+    expect(await CliAuth.deny(store, code)).toEqual({ status: 'conflict' })
+  })
+})
+
+describe('redeem', () => {
+  test('does not grant API scopes to a legacy authorization without consent', async () => {
+    const store = Store.memory()
+    const authorization = await CliAuth.authorize(store, { client, codeChallenge })
+    await store.put(
+      `cli:authorization:${authorization.code}`,
+      JSON.stringify({
+        ...authorization,
+        approvedAt: new Date().toISOString(),
+        status: 'approved',
+        userId: 'usr_a',
+      }),
+    )
+    const result = await CliAuth.redeem(store, { code: authorization.code, codeVerifier })
+    expect(result?.status).toBe('approved')
+    if (result?.status !== 'approved') throw new Error('expected an approved redemption')
+    expect(result.session.scopes).toEqual([])
+    expect((await CliAuth.resolve(store, result.token))?.scopes).toEqual([])
+  })
+
+  test('stays pending when the authorization cannot be consumed yet', async () => {
+    const store = Store.memory()
+    const { code } = await CliAuth.authorize(store, { client, codeChallenge })
+    await CliAuth.approve(store, { code, userId: 'usr_a' })
+    // Workers KV rejects this delete when it lands within a second of the approval write.
+    const limited: Store.State = {
+      ...store,
+      delete: () => Promise.reject(new Error('KV DELETE failed: 429 Too Many Requests')),
+    }
+    expect(await CliAuth.redeem(limited, { code, codeVerifier })).toEqual({ status: 'pending' })
+    expect((await CliAuth.redeem(store, { code, codeVerifier }))?.status).toBe('approved')
+  })
+
+  test('reports pending until approved, then mints a single-use session', async () => {
+    const store = Store.memory()
+    const { code } = await CliAuth.authorize(store, { client, codeChallenge })
+    expect(await CliAuth.redeem(store, { code, codeVerifier })).toEqual({ status: 'pending' })
+
+    await CliAuth.approve(store, { code, userId: 'usr_a' })
+    const result = await CliAuth.redeem(store, { code, codeVerifier })
+    if (result?.status !== 'approved') throw new Error('expected an approved redemption')
+    const { createdAt, expiresAt, id, ...session } = result.session
+    expect(id).toMatch(/^cli_[0-9A-Za-z]{24}$/)
+    expect(Date.parse(expiresAt) - Date.parse(createdAt)).toBe(CliAuth.sessionTtl)
+    expect(session).toMatchInlineSnapshot(`
+      {
+        "client": {
+          "device": "build-box",
+          "name": "tempo api 0.1.0",
+        },
+        "scopes": [
+          "data:read",
+          "routes:read",
+          "routes:write",
+          "rpc-relay:read",
+        ],
+        "userId": "usr_a",
+      }
+    `)
+    expect(await CliAuth.resolve(store, result.token)).toEqual(result.session)
+    expect(await CliAuth.redeem(store, { code, codeVerifier })).toBeUndefined()
+  })
+
+  test('rejects a mismatched verifier without revealing the code', async () => {
+    const store = Store.memory()
+    const { code } = await CliAuth.authorize(store, { client: {}, codeChallenge })
+    await CliAuth.approve(store, { code, userId: 'usr_a' })
+    expect(await CliAuth.redeem(store, { code, codeVerifier: 'x'.repeat(43) })).toBeUndefined()
+    // The rightful CLI can still redeem afterwards.
+    expect((await CliAuth.redeem(store, { code, codeVerifier }))?.status).toBe('approved')
+  })
+
+  test('reports denial once and forgets the code', async () => {
+    const store = Store.memory()
+    const { code } = await CliAuth.authorize(store, { client: {}, codeChallenge })
+    await CliAuth.deny(store, code)
+    expect(await CliAuth.redeem(store, { code, codeVerifier })).toEqual({ status: 'denied' })
+    expect(await CliAuth.redeem(store, { code, codeVerifier })).toBeUndefined()
+  })
+})
+
+describe('resolve', () => {
+  test('expires sessions at their deadline', async () => {
+    vi.useFakeTimers()
+    const store = Store.memory()
+    const { token } = await CliAuth.mint(store, { client: {}, ttl: 60_000, userId: 'usr_a' })
+    expect((await CliAuth.resolve(store, token))?.userId).toBe('usr_a')
+    vi.advanceTimersByTime(60_000)
+    expect(await CliAuth.resolve(store, token)).toBeUndefined()
+  })
+
+  test('ignores tokens without the CLI prefix', async () => {
+    expect(await CliAuth.resolve(Store.memory(), `tempo:sk:${'ab'.repeat(24)}`)).toBeUndefined()
+  })
+})
+
+describe('revoke', () => {
+  test('removes the session', async () => {
+    const store = Store.memory()
+    const { token } = await CliAuth.mint(store, { client: {}, userId: 'usr_a' })
+    await CliAuth.revoke(store, token)
+    expect(await CliAuth.resolve(store, token)).toBeUndefined()
+  })
+})