whale-code 6.5.10 → 6.6.0

package/dist/server/handlers/__tests__/conversation-lock.test.js

@@ -1,117 +0,0 @@
-/**
- * Tests for conversation serialization (lane queue) in channel message handler
- */
-
-import { describe, it, expect } from "vitest";
-
-// We test the withConversationLock function directly by extracting the logic
-// Since it's module-scoped, we test the behavior through handleChannelMessages indirectly
-// For unit testing, let's recreate the lock logic
-
-describe("conversation serialization", () => {
-  // Recreate the lock logic for isolated testing
-  function createLockSystem() {
-    const locks = new Map();
-    function withConversationLock(conversationId, fn) {
-      const prev = locks.get(conversationId) || Promise.resolve();
-      const next = prev.then(fn, fn);
-      const voidNext = next.then(() => {}, () => {});
-      locks.set(conversationId, voidNext);
-      voidNext.then(() => {
-        if (locks.get(conversationId) === voidNext) {
-          locks.delete(conversationId);
-        }
-      });
-      return next;
-    }
-    return {
-      withConversationLock,
-      locks
-    };
-  }
-  it("serializes concurrent operations for the same conversation", async () => {
-    const {
-      withConversationLock
-    } = createLockSystem();
-    const order = [];
-    const p1 = withConversationLock("conv-1", async () => {
-      await new Promise(r => setTimeout(r, 50));
-      order.push(1);
-      return "first";
-    });
-    const p2 = withConversationLock("conv-1", async () => {
-      order.push(2);
-      return "second";
-    });
-    const [r1, r2] = await Promise.all([p1, p2]);
-    expect(r1).toBe("first");
-    expect(r2).toBe("second");
-    // p1 should complete before p2 starts
-    expect(order).toEqual([1, 2]);
-  });
-  it("allows parallel operations for different conversations", async () => {
-    const {
-      withConversationLock
-    } = createLockSystem();
-    const order = [];
-    const p1 = withConversationLock("conv-A", async () => {
-      await new Promise(r => setTimeout(r, 50));
-      order.push("A");
-      return "A-done";
-    });
-    const p2 = withConversationLock("conv-B", async () => {
-      order.push("B");
-      return "B-done";
-    });
-    const [r1, r2] = await Promise.all([p1, p2]);
-    expect(r1).toBe("A-done");
-    expect(r2).toBe("B-done");
-    // B should complete before A since they're independent
-    expect(order).toEqual(["B", "A"]);
-  });
-  it("cleans up locks after completion", async () => {
-    const {
-      withConversationLock,
-      locks
-    } = createLockSystem();
-    await withConversationLock("conv-cleanup", async () => "done");
-
-    // Give microtask a chance to clean up
-    await new Promise(r => setTimeout(r, 10));
-    expect(locks.size).toBe(0);
-  });
-  it("continues executing even if previous operation fails", async () => {
-    const {
-      withConversationLock
-    } = createLockSystem();
-    const p1 = withConversationLock("conv-err", async () => {
-      throw new Error("boom");
-    }).catch(() => "caught");
-    const p2 = withConversationLock("conv-err", async () => {
-      return "recovered";
-    });
-    const [r1, r2] = await Promise.all([p1, p2]);
-    expect(r1).toBe("caught");
-    expect(r2).toBe("recovered");
-  });
-  it("handles triple-chaining correctly", async () => {
-    const {
-      withConversationLock
-    } = createLockSystem();
-    const order = [];
-    const p1 = withConversationLock("conv-3", async () => {
-      await new Promise(r => setTimeout(r, 30));
-      order.push(1);
-    });
-    const p2 = withConversationLock("conv-3", async () => {
-      await new Promise(r => setTimeout(r, 20));
-      order.push(2);
-    });
-    const p3 = withConversationLock("conv-3", async () => {
-      await new Promise(r => setTimeout(r, 10));
-      order.push(3);
-    });
-    await Promise.all([p1, p2, p3]);
-    expect(order).toEqual([1, 2, 3]);
-  });
-});

package/dist/server/handlers/__tests__/e2e/auth-cross-platform-login.e2e.test.js

@@ -1,268 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { randomUUID } from "node:crypto";
-import { HAS_TEST_DB, getTestClient, seedTracked, cleanup, RUN_PREFIX } from "../../__test-utils__/test-db.js";
-
-// ============================================================================
-// Real Supabase client
-// ============================================================================
-
-const sb = getTestClient();
-
-// ============================================================================
-// In-memory stores
-// ============================================================================
-
-let inMemorySessions = [];
-let inMemoryApiCalls = [];
-let inMemoryStoreMemberships = [];
-
-// ============================================================================
-// Auth Helpers
-// ============================================================================
-
-let jwtCounter = 0;
-function generateJwt(userId, storeId, expiresInMs = 3600000) {
-  const header = {
-    alg: "HS256",
-    typ: "JWT"
-  };
-  const payload = {
-    sub: userId,
-    store_id: storeId,
-    iat: Date.now(),
-    exp: Date.now() + expiresInMs,
-    jti: `${Date.now()}_${++jwtCounter}`
-  };
-  const b64 = obj => Buffer.from(JSON.stringify(obj)).toString("base64url");
-  return `${b64(header)}.${b64(payload)}.mock_signature`;
-}
-function parseJwt(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
-    return payload;
-  } catch {
-    return null;
-  }
-}
-async function login(email, password) {
-  const {
-    data: userLookup
-  } = await sb.from("platform_users").select().eq("email", email);
-  if (!userLookup || userLookup.length === 0) {
-    return {
-      token: null,
-      error: "Invalid credentials"
-    };
-  }
-  const user = userLookup[0];
-  const prefs = user.preferences ?? {};
-  if (prefs._test_password_hash !== `hashed_${password}`) {
-    return {
-      token: null,
-      error: "Invalid credentials"
-    };
-  }
-  const membership = inMemoryStoreMemberships.find(m => m.user_id === user.id);
-  if (!membership) {
-    return {
-      token: null,
-      error: "No store assigned"
-    };
-  }
-  const storeId = membership.store_id;
-  const token = generateJwt(user.id, storeId);
-  inMemorySessions.push({
-    id: randomUUID(),
-    user_id: user.id,
-    store_id: storeId,
-    token_hash: `hash_${token.slice(-10)}`,
-    expires_at: new Date(Date.now() + 3600000).toISOString(),
-    active: true
-  });
-  return {
-    token,
-    error: null
-  };
-}
-async function authenticateRequest(token) {
-  const payload = parseJwt(token);
-  if (!payload) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Invalid token"
-    };
-  }
-  if (payload.exp < Date.now()) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Token expired"
-    };
-  }
-  const {
-    data: user
-  } = await sb.from("platform_users").select().eq("id", payload.sub);
-  if (!user || user.length === 0) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "User not found"
-    };
-  }
-  return {
-    userId: payload.sub,
-    storeId: payload.store_id,
-    error: null
-  };
-}
-async function makeAuthenticatedApiCall(token, endpoint, targetStoreId) {
-  const auth = await authenticateRequest(token);
-  if (auth.error) {
-    return {
-      data: null,
-      error: auth.error,
-      statusCode: 401
-    };
-  }
-  if (auth.storeId !== targetStoreId) {
-    inMemoryApiCalls.push({
-      id: randomUUID(),
-      user_id: auth.userId,
-      endpoint,
-      target_store_id: targetStoreId,
-      authorized: false,
-      reason: "store_mismatch"
-    });
-    return {
-      data: null,
-      error: "Forbidden: store access denied",
-      statusCode: 403
-    };
-  }
-  inMemoryApiCalls.push({
-    id: randomUUID(),
-    user_id: auth.userId,
-    endpoint,
-    target_store_id: targetStoreId,
-    authorized: true
-  });
-  return {
-    data: {
-      store_id: targetStoreId,
-      endpoint,
-      result: "ok"
-    },
-    error: null,
-    statusCode: 200
-  };
-}
-
-// ============================================================================
-// E2E Tests: Auth Cross-Platform — login & API calls
-// ============================================================================
-
-describe.skipIf(!HAS_TEST_DB)("Auth Cross-Platform E2E — login & API calls", () => {
-  let storeAId;
-  let storeBId;
-  let user1Id;
-  let user2Id;
-  beforeEach(async () => {
-    storeAId = randomUUID();
-    storeBId = randomUUID();
-    user1Id = randomUUID();
-    user2Id = randomUUID();
-    inMemorySessions = [];
-    inMemoryApiCalls = [];
-    inMemoryStoreMemberships = [];
-    await seedTracked("stores", [{
-      id: storeAId,
-      store_name: `${RUN_PREFIX}_Store Alpha`,
-      slug: `${RUN_PREFIX}-store-alpha`,
-      email: `${RUN_PREFIX}_alpha@example.com`
-    }, {
-      id: storeBId,
-      store_name: `${RUN_PREFIX}_Store Beta`,
-      slug: `${RUN_PREFIX}-store-beta`,
-      email: `${RUN_PREFIX}_beta@example.com`
-    }]);
-    await seedTracked("platform_users", [{
-      id: user1Id,
-      email: `${RUN_PREFIX}_alice@example.com`,
-      first_name: "Alice",
-      last_name: "Test",
-      preferences: {
-        _test_password_hash: "hashed_secret123"
-      }
-    }, {
-      id: user2Id,
-      email: `${RUN_PREFIX}_bob@example.com`,
-      first_name: "Bob",
-      last_name: "Test",
-      preferences: {
-        _test_password_hash: "hashed_password456"
-      }
-    }]);
-    inMemoryStoreMemberships = [{
-      id: randomUUID(),
-      user_id: user1Id,
-      store_id: storeAId,
-      role: "owner"
-    }, {
-      id: randomUUID(),
-      user_id: user2Id,
-      store_id: storeBId,
-      role: "member"
-    }];
-  });
-  afterEach(async () => {
-    await cleanup();
-  });
-  it("logs in with valid credentials and returns a JWT", async () => {
-    const {
-      token,
-      error
-    } = await login(`${RUN_PREFIX}_alice@example.com`, "secret123");
-    expect(error).toBeNull();
-    expect(token).toBeDefined();
-    expect(token.split(".")).toHaveLength(3);
-    const payload = parseJwt(token);
-    expect(payload).not.toBeNull();
-    expect(payload.sub).toBe(user1Id);
-    expect(payload.store_id).toBe(storeAId);
-    const sessions = inMemorySessions.filter(s => s.user_id === user1Id);
-    expect(sessions.length).toBeGreaterThanOrEqual(1);
-    const activeSession = sessions.find(s => s.active === true);
-    expect(activeSession).toBeDefined();
-  });
-  it("makes an authenticated API call with a valid token", async () => {
-    const {
-      token
-    } = await login(`${RUN_PREFIX}_alice@example.com`, "secret123");
-    const result = await makeAuthenticatedApiCall(token, "/api/products", storeAId);
-    expect(result.statusCode).toBe(200);
-    expect(result.error).toBeNull();
-    expect(result.data).toEqual({
-      store_id: storeAId,
-      endpoint: "/api/products",
-      result: "ok"
-    });
-    const calls = inMemoryApiCalls.filter(c => c.user_id === user1Id);
-    const authorizedCall = calls.find(c => c.authorized === true);
-    expect(authorizedCall).toBeDefined();
-  });
-  it("enforces store isolation - user A cannot access store B data", async () => {
-    const {
-      token: aliceToken
-    } = await login(`${RUN_PREFIX}_alice@example.com`, "secret123");
-    const result = await makeAuthenticatedApiCall(aliceToken, "/api/orders", storeBId);
-    expect(result.statusCode).toBe(403);
-    expect(result.error).toBe("Forbidden: store access denied");
-    const calls = inMemoryApiCalls.filter(c => c.user_id === user1Id && c.target_store_id === storeBId);
-    expect(calls.length).toBeGreaterThanOrEqual(1);
-    expect(calls[0].authorized).toBe(false);
-    expect(calls[0].reason).toBe("store_mismatch");
-  });
-});

package/dist/server/handlers/__tests__/e2e/auth-cross-platform-tokens.e2e.test.js

@@ -1,264 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { randomUUID } from "node:crypto";
-import { HAS_TEST_DB, getTestClient, seedTracked, cleanup, RUN_PREFIX } from "../../__test-utils__/test-db.js";
-const sb = getTestClient();
-
-// In-memory stores
-
-let inMemorySessions = [];
-let inMemoryApiCalls = [];
-let inMemoryStoreMemberships = [];
-let jwtCounter = 0;
-function generateJwt(userId, storeId, expiresInMs = 3600000) {
-  const header = {
-    alg: "HS256",
-    typ: "JWT"
-  };
-  const payload = {
-    sub: userId,
-    store_id: storeId,
-    iat: Date.now(),
-    exp: Date.now() + expiresInMs,
-    jti: `${Date.now()}_${++jwtCounter}`
-  };
-  const b64 = obj => Buffer.from(JSON.stringify(obj)).toString("base64url");
-  return `${b64(header)}.${b64(payload)}.mock_signature`;
-}
-function parseJwt(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
-    return payload;
-  } catch {
-    return null;
-  }
-}
-async function login(email, password) {
-  const {
-    data: userLookup
-  } = await sb.from("platform_users").select().eq("email", email);
-  if (!userLookup || userLookup.length === 0) {
-    return {
-      token: null,
-      error: "Invalid credentials"
-    };
-  }
-  const user = userLookup[0];
-  const prefs = user.preferences ?? {};
-  if (prefs._test_password_hash !== `hashed_${password}`) {
-    return {
-      token: null,
-      error: "Invalid credentials"
-    };
-  }
-  const membership = inMemoryStoreMemberships.find(m => m.user_id === user.id);
-  if (!membership) {
-    return {
-      token: null,
-      error: "No store assigned"
-    };
-  }
-  const storeId = membership.store_id;
-  const token = generateJwt(user.id, storeId);
-  inMemorySessions.push({
-    id: randomUUID(),
-    user_id: user.id,
-    store_id: storeId,
-    token_hash: `hash_${token.slice(-10)}`,
-    expires_at: new Date(Date.now() + 3600000).toISOString(),
-    active: true
-  });
-  return {
-    token,
-    error: null
-  };
-}
-async function authenticateRequest(token) {
-  const payload = parseJwt(token);
-  if (!payload) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Invalid token"
-    };
-  }
-  if (payload.exp < Date.now()) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Token expired"
-    };
-  }
-  const {
-    data: user
-  } = await sb.from("platform_users").select().eq("id", payload.sub);
-  if (!user || user.length === 0) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "User not found"
-    };
-  }
-  return {
-    userId: payload.sub,
-    storeId: payload.store_id,
-    error: null
-  };
-}
-async function makeAuthenticatedApiCall(token, endpoint, targetStoreId) {
-  const auth = await authenticateRequest(token);
-  if (auth.error) {
-    return {
-      data: null,
-      error: auth.error,
-      statusCode: 401
-    };
-  }
-  if (auth.storeId !== targetStoreId) {
-    inMemoryApiCalls.push({
-      id: randomUUID(),
-      user_id: auth.userId,
-      endpoint,
-      target_store_id: targetStoreId,
-      authorized: false,
-      reason: "store_mismatch"
-    });
-    return {
-      data: null,
-      error: "Forbidden: store access denied",
-      statusCode: 403
-    };
-  }
-  inMemoryApiCalls.push({
-    id: randomUUID(),
-    user_id: auth.userId,
-    endpoint,
-    target_store_id: targetStoreId,
-    authorized: true
-  });
-  return {
-    data: {
-      store_id: targetStoreId,
-      endpoint,
-      result: "ok"
-    },
-    error: null,
-    statusCode: 200
-  };
-}
-async function refreshSession(userId, storeId) {
-  for (const session of inMemorySessions) {
-    if (session.user_id === userId) {
-      session.active = false;
-    }
-  }
-  const newToken = generateJwt(userId, storeId);
-  inMemorySessions.push({
-    id: randomUUID(),
-    user_id: userId,
-    store_id: storeId,
-    token_hash: `hash_${newToken.slice(-10)}`,
-    expires_at: new Date(Date.now() + 3600000).toISOString(),
-    active: true
-  });
-  return {
-    token: newToken,
-    error: null
-  };
-}
-describe.skipIf(!HAS_TEST_DB)("Auth Cross-Platform E2E — tokens & refresh", () => {
-  let storeAId;
-  let storeBId;
-  let user1Id;
-  let user2Id;
-  beforeEach(async () => {
-    storeAId = randomUUID();
-    storeBId = randomUUID();
-    user1Id = randomUUID();
-    user2Id = randomUUID();
-    inMemorySessions = [];
-    inMemoryApiCalls = [];
-    inMemoryStoreMemberships = [];
-    await seedTracked("stores", [{
-      id: storeAId,
-      store_name: `${RUN_PREFIX}_Store Alpha`,
-      slug: `${RUN_PREFIX}-store-alpha`,
-      email: `${RUN_PREFIX}_alpha@example.com`
-    }, {
-      id: storeBId,
-      store_name: `${RUN_PREFIX}_Store Beta`,
-      slug: `${RUN_PREFIX}-store-beta`,
-      email: `${RUN_PREFIX}_beta@example.com`
-    }]);
-    await seedTracked("platform_users", [{
-      id: user1Id,
-      email: `${RUN_PREFIX}_alice@example.com`,
-      first_name: "Alice",
-      last_name: "Test",
-      preferences: {
-        _test_password_hash: "hashed_secret123"
-      }
-    }, {
-      id: user2Id,
-      email: `${RUN_PREFIX}_bob@example.com`,
-      first_name: "Bob",
-      last_name: "Test",
-      preferences: {
-        _test_password_hash: "hashed_password456"
-      }
-    }]);
-    inMemoryStoreMemberships = [{
-      id: randomUUID(),
-      user_id: user1Id,
-      store_id: storeAId,
-      role: "owner"
-    }, {
-      id: randomUUID(),
-      user_id: user2Id,
-      store_id: storeBId,
-      role: "member"
-    }];
-  });
-  afterEach(async () => {
-    await cleanup();
-  });
-  it("rejects requests with invalid or expired tokens", async () => {
-    const expiredToken = generateJwt(user1Id, storeAId, -1000);
-    const expiredResult = await makeAuthenticatedApiCall(expiredToken, "/api/data", storeAId);
-    expect(expiredResult.statusCode).toBe(401);
-    expect(expiredResult.error).toBe("Token expired");
-    const malformedResult = await makeAuthenticatedApiCall("not.a.valid.token", "/api/data", storeAId);
-    expect(malformedResult.statusCode).toBe(401);
-    expect(malformedResult.error).toBe("Invalid token");
-    const {
-      token,
-      error
-    } = await login(`${RUN_PREFIX}_alice@example.com`, "wrongpassword");
-    expect(token).toBeNull();
-    expect(error).toBe("Invalid credentials");
-  });
-  it("refreshes session and invalidates old tokens", async () => {
-    const {
-      token: originalToken
-    } = await login(`${RUN_PREFIX}_bob@example.com`, "password456");
-    expect(originalToken).not.toBeNull();
-    const originalSessions = inMemorySessions.filter(s => s.user_id === user2Id);
-    const activeOrig = originalSessions.find(s => s.active === true);
-    expect(activeOrig).toBeDefined();
-    const {
-      token: newToken,
-      error
-    } = await refreshSession(user2Id, storeBId);
-    expect(error).toBeNull();
-    expect(newToken).toBeDefined();
-    expect(newToken).not.toBe(originalToken);
-    const allSessions = inMemorySessions.filter(s => s.user_id === user2Id);
-    const activeSessions = allSessions.filter(s => s.active === true);
-    const inactiveSessions = allSessions.filter(s => s.active === false);
-    expect(activeSessions).toHaveLength(1);
-    expect(inactiveSessions.length).toBeGreaterThanOrEqual(1);
-    const result = await makeAuthenticatedApiCall(newToken, "/api/inventory", storeBId);
-    expect(result.statusCode).toBe(200);
-  });
-});