tapimo 0.2.0 → 0.4.0

package/src/apps/platform/routes/me.test.ts

@@ -1,121 +0,0 @@
-import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
-
-import * as TestApp from '../../../../test/App.js'
-import * as Me from './me.js'
-
-/** Origin pinned for SIWE domain binding; Hono test requests use this host. */
-const origin = 'http://localhost'
-
-const superAdminSecret = 'tempo:sk:c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2c2'
-
-function createApp() {
-  return TestApp.create({
-    auth: { keys: [TestApp.key], superAdmin: { secret: superAdminSecret } },
-    session: { wallet: { origin } },
-  })
-}
-
-describe('GET /me', () => {
-  test('returns the signed-in user', async () => {
-    const app = createApp()
-    const account = privateKeyToAccount(generatePrivateKey())
-    const { cookie, verifyResponse } = await TestApp.signIn(app, account)
-
-    expect(verifyResponse.status).toBe(200)
-    expect(cookie).toBeDefined()
-
-    const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
-    expect(response.status).toBe(200)
-    const body = await TestApp.json(response, Me.schema.User)
-    expect(body.address).toBe(account.address.toLowerCase())
-    expect(body.id.startsWith('usr_')).toBe(true)
-    expect(body.email).toBeUndefined()
-  })
-
-  test('sign-in is idempotent per address', async () => {
-    const app = createApp()
-    const account = privateKeyToAccount(generatePrivateKey())
-
-    const first = await TestApp.signIn(app, account)
-    const firstMe = await app.request('/v1/me', { headers: { cookie: first.cookie! } })
-    const firstBody = await TestApp.json(firstMe, Me.schema.User)
-
-    const second = await TestApp.signIn(app, account)
-    const secondMe = await app.request('/v1/me', { headers: { cookie: second.cookie! } })
-    const secondBody = await TestApp.json(secondMe, Me.schema.User)
-
-    expect(secondBody.id).toBe(firstBody.id)
-  })
-
-  test('supports bearer-token sessions', async () => {
-    const app = createApp()
-    const account = privateKeyToAccount(generatePrivateKey())
-    const { verifyResponse } = await TestApp.signIn(app, account, { returnToken: true })
-    const { token } = (await verifyResponse.json()) as { token: string }
-
-    expect(typeof token).toBe('string')
-    // The bearer session token takes the API-key header path first; the failed
-    // key lookup must fall through to the session lane.
-    const response = await app.request('/v1/me', {
-      headers: { authorization: `Bearer ${token}` },
-    })
-    expect(response.status).toBe(200)
-  })
-
-  test('logout revokes the session', async () => {
-    const app = createApp()
-    const account = privateKeyToAccount(generatePrivateKey())
-    const { cookie } = await TestApp.signIn(app, account)
-
-    const logout = await app.request('/v1/auth/siwe/logout', {
-      headers: { cookie: cookie! },
-      method: 'POST',
-    })
-    expect(logout.status).toBe(204)
-
-    const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
-    expect(response.status).toBe(401)
-  })
-
-  test('rejects anonymous requests', async () => {
-    const app = createApp()
-    const response = await app.request('/v1/me')
-    expect(response.status).toBe(401)
-  })
-
-  test('rejects API keys', async () => {
-    const app = createApp()
-    const response = await app.request('/v1/me', {
-      headers: { 'tempo-api-key': TestApp.key.token },
-    })
-    expect(response.status).toBe(403)
-    const { requestId, ...body } = (await response.json()) as { requestId?: string }
-    expect(requestId).toBeDefined()
-    expect(body).toMatchInlineSnapshot(`
-      {
-        "error": {
-          "code": "forbidden",
-          "message": "API key not permitted for this route",
-        },
-      }
-    `)
-  })
-
-  test('rejects the super admin (no user row)', async () => {
-    const app = createApp()
-    const response = await app.request('/v1/me', {
-      headers: { 'tempo-api-key': superAdminSecret },
-    })
-    expect(response.status).toBe(403)
-    const { requestId, ...body } = (await response.json()) as { requestId?: string }
-    expect(requestId).toBeDefined()
-    expect(body).toMatchInlineSnapshot(`
-      {
-        "error": {
-          "code": "forbidden",
-          "message": "Session required",
-        },
-      }
-    `)
-  })
-})