wind-agent-cli 1.37.2 → 1.38.0

package/server/modules/auth/auth.service.ts

@@ -1,155 +1,155 @@
-import { AppError } from '@/shared/utils.js';
-
-type AuthUser = {
-  id: number | bigint;
-  username: string;
-};
-
-type AuthLoginUser = AuthUser & { password_hash: string };
-
-type AuthDependencies = {
-  users: {
-    hasUsers(): boolean;
-    createUser(username: string, passwordHash: string): AuthUser;
-    getUserByUsername(username: string): AuthLoginUser | undefined;
-    updateLastLogin(userId: number): void;
-  };
-  transaction: {
-    begin(): void;
-    commit(): void;
-    rollback(): void;
-  };
-  hashPassword(password: string): Promise<string>;
-  comparePassword(password: string, passwordHash: string): Promise<boolean>;
-  generateToken(user: AuthUser): string;
-};
-
-function numericUserId(userId: number | bigint): number {
-  return Number(userId);
-}
-
-function isUniqueConstraintError(error: unknown): boolean {
-  return typeof error === 'object'
-    && error !== null
-    && 'code' in error
-    && error.code === 'SQLITE_CONSTRAINT_UNIQUE';
-}
-
-/**
- * Creates the Auth application service around explicit persistence, crypto,
- * transaction, and token dependencies.
- */
-export function createAuthService(dependencies: AuthDependencies) {
-  return {
-    getStatus() {
-      return {
-        needsSetup: !dependencies.users.hasUsers(),
-        isAuthenticated: false,
-      };
-    },
-
-    async register(usernameInput: unknown, passwordInput: unknown) {
-      const username = typeof usernameInput === 'string' ? usernameInput : '';
-      const password = typeof passwordInput === 'string' ? passwordInput : '';
-
-      if (!username || !password) {
-        throw new AppError('Username and password are required', {
-          code: 'AUTH_CREDENTIALS_REQUIRED',
-          statusCode: 400,
-        });
-      }
-      if (username.length < 3 || password.length < 6) {
-        throw new AppError(
-          'Username must be at least 3 characters, password at least 6 characters',
-          { code: 'AUTH_CREDENTIALS_TOO_SHORT', statusCode: 400 },
-        );
-      }
-
-      dependencies.transaction.begin();
-      try {
-        if (dependencies.users.hasUsers()) {
-          throw new AppError('User already exists. This is a single-user system.', {
-            code: 'AUTH_USER_ALREADY_CONFIGURED',
-            statusCode: 403,
-          });
-        }
-
-        const passwordHash = await dependencies.hashPassword(password);
-        const user = dependencies.users.createUser(username, passwordHash);
-        const token = dependencies.generateToken(user);
-        dependencies.transaction.commit();
-        dependencies.users.updateLastLogin(numericUserId(user.id));
-
-        return {
-          success: true,
-          user: { id: user.id, username: user.username },
-          token,
-        };
-      } catch (error) {
-        dependencies.transaction.rollback();
-        if (isUniqueConstraintError(error)) {
-          throw new AppError('Username already exists', {
-            code: 'AUTH_USERNAME_CONFLICT',
-            statusCode: 409,
-          });
-        }
-        throw error;
-      }
-    },
-
-    async login(usernameInput: unknown, passwordInput: unknown) {
-      const username = typeof usernameInput === 'string' ? usernameInput : '';
-      const password = typeof passwordInput === 'string' ? passwordInput : '';
-      if (!username || !password) {
-        throw new AppError('Username and password are required', {
-          code: 'AUTH_CREDENTIALS_REQUIRED',
-          statusCode: 400,
-        });
-      }
-
-      const user = dependencies.users.getUserByUsername(username);
-      const validPassword = user
-        ? await dependencies.comparePassword(password, user.password_hash)
-        : false;
-      if (!user || !validPassword) {
-        throw new AppError('Invalid username or password', {
-          code: 'AUTH_INVALID_CREDENTIALS',
-          statusCode: 401,
-        });
-      }
-
-      dependencies.users.updateLastLogin(numericUserId(user.id));
-      return {
-        success: true,
-        user: { id: user.id, username: user.username },
-        token: dependencies.generateToken(user),
-      };
-    },
-
-    getCurrentUser(user: unknown) {
-      return { user };
-    },
-
-    refreshSession(user: unknown) {
-      if (
-        typeof user !== 'object'
-        || user === null
-        || !('id' in user)
-        || !('username' in user)
-        || (typeof user.id !== 'number' && typeof user.id !== 'bigint')
-        || typeof user.username !== 'string'
-      ) {
-        throw new AppError('Authenticated user is required', {
-          code: 'AUTH_USER_REQUIRED',
-          statusCode: 401,
-        });
-      }
-
-      return { token: dependencies.generateToken(user as AuthUser) };
-    },
-
-    logout() {
-      return { success: true, message: 'Logged out successfully' };
-    },
-  };
-}
+import { AppError } from '@/shared/utils.js';
+
+type AuthUser = {
+  id: number | bigint;
+  username: string;
+};
+
+type AuthLoginUser = AuthUser & { password_hash: string };
+
+type AuthDependencies = {
+  users: {
+    hasUsers(): boolean;
+    createUser(username: string, passwordHash: string): AuthUser;
+    getUserByUsername(username: string): AuthLoginUser | undefined;
+    updateLastLogin(userId: number): void;
+  };
+  transaction: {
+    begin(): void;
+    commit(): void;
+    rollback(): void;
+  };
+  hashPassword(password: string): Promise<string>;
+  comparePassword(password: string, passwordHash: string): Promise<boolean>;
+  generateToken(user: AuthUser): string;
+};
+
+function numericUserId(userId: number | bigint): number {
+  return Number(userId);
+}
+
+function isUniqueConstraintError(error: unknown): boolean {
+  return typeof error === 'object'
+    && error !== null
+    && 'code' in error
+    && error.code === 'SQLITE_CONSTRAINT_UNIQUE';
+}
+
+/**
+ * Creates the Auth application service around explicit persistence, crypto,
+ * transaction, and token dependencies.
+ */
+export function createAuthService(dependencies: AuthDependencies) {
+  return {
+    getStatus() {
+      return {
+        needsSetup: !dependencies.users.hasUsers(),
+        isAuthenticated: false,
+      };
+    },
+
+    async register(usernameInput: unknown, passwordInput: unknown) {
+      const username = typeof usernameInput === 'string' ? usernameInput : '';
+      const password = typeof passwordInput === 'string' ? passwordInput : '';
+
+      if (!username || !password) {
+        throw new AppError('Username and password are required', {
+          code: 'AUTH_CREDENTIALS_REQUIRED',
+          statusCode: 400,
+        });
+      }
+      if (username.length < 3 || password.length < 6) {
+        throw new AppError(
+          'Username must be at least 3 characters, password at least 6 characters',
+          { code: 'AUTH_CREDENTIALS_TOO_SHORT', statusCode: 400 },
+        );
+      }
+
+      dependencies.transaction.begin();
+      try {
+        if (dependencies.users.hasUsers()) {
+          throw new AppError('User already exists. This is a single-user system.', {
+            code: 'AUTH_USER_ALREADY_CONFIGURED',
+            statusCode: 403,
+          });
+        }
+
+        const passwordHash = await dependencies.hashPassword(password);
+        const user = dependencies.users.createUser(username, passwordHash);
+        const token = dependencies.generateToken(user);
+        dependencies.transaction.commit();
+        dependencies.users.updateLastLogin(numericUserId(user.id));
+
+        return {
+          success: true,
+          user: { id: user.id, username: user.username },
+          token,
+        };
+      } catch (error) {
+        dependencies.transaction.rollback();
+        if (isUniqueConstraintError(error)) {
+          throw new AppError('Username already exists', {
+            code: 'AUTH_USERNAME_CONFLICT',
+            statusCode: 409,
+          });
+        }
+        throw error;
+      }
+    },
+
+    async login(usernameInput: unknown, passwordInput: unknown) {
+      const username = typeof usernameInput === 'string' ? usernameInput : '';
+      const password = typeof passwordInput === 'string' ? passwordInput : '';
+      if (!username || !password) {
+        throw new AppError('Username and password are required', {
+          code: 'AUTH_CREDENTIALS_REQUIRED',
+          statusCode: 400,
+        });
+      }
+
+      const user = dependencies.users.getUserByUsername(username);
+      const validPassword = user
+        ? await dependencies.comparePassword(password, user.password_hash)
+        : false;
+      if (!user || !validPassword) {
+        throw new AppError('Invalid username or password', {
+          code: 'AUTH_INVALID_CREDENTIALS',
+          statusCode: 401,
+        });
+      }
+
+      dependencies.users.updateLastLogin(numericUserId(user.id));
+      return {
+        success: true,
+        user: { id: user.id, username: user.username },
+        token: dependencies.generateToken(user),
+      };
+    },
+
+    getCurrentUser(user: unknown) {
+      return { user };
+    },
+
+    refreshSession(user: unknown) {
+      if (
+        typeof user !== 'object'
+        || user === null
+        || !('id' in user)
+        || !('username' in user)
+        || (typeof user.id !== 'number' && typeof user.id !== 'bigint')
+        || typeof user.username !== 'string'
+      ) {
+        throw new AppError('Authenticated user is required', {
+          code: 'AUTH_USER_REQUIRED',
+          statusCode: 401,
+        });
+      }
+
+      return { token: dependencies.generateToken(user as AuthUser) };
+    },
+
+    logout() {
+      return { success: true, message: 'Logged out successfully' };
+    },
+  };
+}

package/server/modules/auth/index.ts

@@ -1,9 +1,9 @@
-// authRoutes: used by the server entrypoint to mount public authentication endpoints.
-export { authRoutes } from './auth.module.js';
-
-// authenticateToken: used by the server entrypoint to protect authenticated API modules.
-export { authenticateToken } from './auth.middleware.js';
-// authenticateWebSocket: used by WebSocket setup to verify connection tokens.
-export { authenticateWebSocket } from './auth.middleware.js';
-// validateApiKey: used by the server entrypoint for optional API-wide key validation.
-export { validateApiKey } from './auth.middleware.js';
+// authRoutes: used by the server entrypoint to mount public authentication endpoints.
+export { authRoutes } from './auth.module.js';
+
+// authenticateToken: used by the server entrypoint to protect authenticated API modules.
+export { authenticateToken } from './auth.middleware.js';
+// authenticateWebSocket: used by WebSocket setup to verify connection tokens.
+export { authenticateWebSocket } from './auth.middleware.js';
+// validateApiKey: used by the server entrypoint for optional API-wide key validation.
+export { validateApiKey } from './auth.middleware.js';

package/server/modules/auth/tests/auth.service.test.ts

@@ -1,95 +1,95 @@
-import assert from 'node:assert/strict';
-import test from 'node:test';
-
-import { AppError } from '@/shared/utils.js';
-
-import { createAuthService } from '../auth.service.js';
-
-type AuthDependencies = Parameters<typeof createAuthService>[0];
-
-function createDependencies(overrides: Partial<AuthDependencies> = {}): AuthDependencies {
-  return {
-    users: {
-      hasUsers: () => false,
-      createUser: (username, passwordHash) => ({ id: 1, username, password_hash: passwordHash }),
-      getUserByUsername: () => undefined,
-      updateLastLogin: () => undefined,
-    },
-    transaction: {
-      begin: () => undefined,
-      commit: () => undefined,
-      rollback: () => undefined,
-    },
-    hashPassword: async () => 'hashed-password',
-    comparePassword: async () => false,
-    generateToken: () => 'signed-token',
-    ...overrides,
-  };
-}
-
-test('register hashes credentials and commits through injected dependencies', async () => {
-  const operations: string[] = [];
-  const service = createAuthService(createDependencies({
-    transaction: {
-      begin: () => operations.push('begin'),
-      commit: () => operations.push('commit'),
-      rollback: () => operations.push('rollback'),
-    },
-    hashPassword: async (password) => {
-      operations.push(`hash:${password}`);
-      return 'hash';
-    },
-    users: {
-      hasUsers: () => false,
-      createUser: (username, passwordHash) => {
-        operations.push(`create:${username}:${passwordHash}`);
-        return { id: 1, username, password_hash: passwordHash };
-      },
-      getUserByUsername: () => undefined,
-      updateLastLogin: (userId) => operations.push(`login:${userId}`),
-    },
-  }));
-
-  const result = await service.register('alice', 'secret12');
-
-  assert.equal(result.token, 'signed-token');
-  assert.deepEqual(operations, ['begin', 'hash:secret12', 'create:alice:hash', 'commit', 'login:1']);
-});
-
-test('login rejects an invalid password without issuing a token', async () => {
-  let tokenIssued = false;
-  const service = createAuthService(createDependencies({
-    users: {
-      hasUsers: () => true,
-      createUser: () => { throw new Error('unused'); },
-      getUserByUsername: () => ({ id: 1, username: 'alice', password_hash: 'hash' }),
-      updateLastLogin: () => undefined,
-    },
-    comparePassword: async () => false,
-    generateToken: () => {
-      tokenIssued = true;
-      return 'token';
-    },
-  }));
-
-  await assert.rejects(
-    service.login('alice', 'wrong-password'),
-    (error: unknown) => error instanceof AppError && error.code === 'AUTH_INVALID_CREDENTIALS',
-  );
-  assert.equal(tokenIssued, false);
-});
-
-test('refreshSession issues a replacement token for the authenticated user', () => {
-  let tokenUser: { id: number | bigint; username: string } | undefined;
-  const service = createAuthService(createDependencies({
-    generateToken: (user) => {
-      tokenUser = user;
-      return 'replacement-token';
-    },
-  }));
-
-  const result = service.refreshSession({ id: 7, username: 'alice' });
-
-  assert.deepEqual(result, { token: 'replacement-token' });
-  assert.deepEqual(tokenUser, { id: 7, username: 'alice' });
-});
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { AppError } from '@/shared/utils.js';
+
+import { createAuthService } from '../auth.service.js';
+
+type AuthDependencies = Parameters<typeof createAuthService>[0];
+
+function createDependencies(overrides: Partial<AuthDependencies> = {}): AuthDependencies {
+  return {
+    users: {
+      hasUsers: () => false,
+      createUser: (username, passwordHash) => ({ id: 1, username, password_hash: passwordHash }),
+      getUserByUsername: () => undefined,
+      updateLastLogin: () => undefined,
+    },
+    transaction: {
+      begin: () => undefined,
+      commit: () => undefined,
+      rollback: () => undefined,
+    },
+    hashPassword: async () => 'hashed-password',
+    comparePassword: async () => false,
+    generateToken: () => 'signed-token',
+    ...overrides,
+  };
+}
+
+test('register hashes credentials and commits through injected dependencies', async () => {
+  const operations: string[] = [];
+  const service = createAuthService(createDependencies({
+    transaction: {
+      begin: () => operations.push('begin'),
+      commit: () => operations.push('commit'),
+      rollback: () => operations.push('rollback'),
+    },
+    hashPassword: async (password) => {
+      operations.push(`hash:${password}`);
+      return 'hash';
+    },
+    users: {
+      hasUsers: () => false,
+      createUser: (username, passwordHash) => {
+        operations.push(`create:${username}:${passwordHash}`);
+        return { id: 1, username, password_hash: passwordHash };
+      },
+      getUserByUsername: () => undefined,
+      updateLastLogin: (userId) => operations.push(`login:${userId}`),
+    },
+  }));
+
+  const result = await service.register('alice', 'secret12');
+
+  assert.equal(result.token, 'signed-token');
+  assert.deepEqual(operations, ['begin', 'hash:secret12', 'create:alice:hash', 'commit', 'login:1']);
+});
+
+test('login rejects an invalid password without issuing a token', async () => {
+  let tokenIssued = false;
+  const service = createAuthService(createDependencies({
+    users: {
+      hasUsers: () => true,
+      createUser: () => { throw new Error('unused'); },
+      getUserByUsername: () => ({ id: 1, username: 'alice', password_hash: 'hash' }),
+      updateLastLogin: () => undefined,
+    },
+    comparePassword: async () => false,
+    generateToken: () => {
+      tokenIssued = true;
+      return 'token';
+    },
+  }));
+
+  await assert.rejects(
+    service.login('alice', 'wrong-password'),
+    (error: unknown) => error instanceof AppError && error.code === 'AUTH_INVALID_CREDENTIALS',
+  );
+  assert.equal(tokenIssued, false);
+});
+
+test('refreshSession issues a replacement token for the authenticated user', () => {
+  let tokenUser: { id: number | bigint; username: string } | undefined;
+  const service = createAuthService(createDependencies({
+    generateToken: (user) => {
+      tokenUser = user;
+      return 'replacement-token';
+    },
+  }));
+
+  const result = service.refreshSession({ id: 7, username: 'alice' });
+
+  assert.deepEqual(result, { token: 'replacement-token' });
+  assert.deepEqual(tokenUser, { id: 7, username: 'alice' });
+});