feat(tests): add unit and integration test suite (node:test)

Adds 215 tests across three tiers using node:test + node:assert/strict (no new test framework dependencies): - test/tools/ — middleware and utility tests (token, hash, authenticate, jsonBody, convertError, validators) - test/shared/ — DbInterface/BackendDbInterface contract suites reusable across backends (users, abodes, residents, apikeys, sessions, auth) - test/backends/sqlite/ — SQLite-private tests (sql builder, WrappedDb, migrator) + shared suites via SqliteInterface - test/backends/api/ — ApiInterface unit tests + shared suites via a live Koa server backed by SQLite Also fixes four bugs uncovered by the tests: - ApiInterface: path params leaked into query string (slice(1) fix) - ApiInterface: calling res.json() on 204 No Content responses - SqliteInterface.updateResident: missing comma in SET clause - WrappedBetterSqlite3Db: readonly:undefined rejected by better-sqlite3 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-30 11:33:32 +00:00
parent 3b9a6bc85c
commit da4e597f73
24 changed files with 2212 additions and 3 deletions
@@ -0,0 +1,273 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { authenticate } from "../../src/webapi/middleware/authenticate.js";
+import type { BackendDbInterface } from "../../src/db/types/DbInterface.js";
+import type { ClientUser } from "../../src/db/types/User.js";
+import type { ClientApikey } from "../../src/db/types/Apikey.js";
+import {
+  ConflictAbodeError,
+  NotAuthorizedAbodeError,
+  NotFoundAbodeError,
+} from "../../src/db/types/errors.js";
+
+const MOCK_USER: ClientUser = {
+  uid: "11111111-1111-1111-1111-111111111111",
+  email: "test@example.com",
+  name: "Test User",
+  flags: {},
+  created_at: "2024-01-01T00:00:00Z",
+  updated_at: "2024-01-01T00:00:00Z",
+};
+
+const MOCK_APIKEY: ClientApikey = {
+  kid: "22222222-2222-2222-2222-222222222222",
+  uid: MOCK_USER.uid,
+  name: "Test Key",
+  permissions: {},
+  created_at: "2024-01-01T00:00:00Z",
+  expires_at: null,
+};
+
+function makeMockDb(
+  overrides: Partial<BackendDbInterface> = {}
+): BackendDbInterface {
+  return {
+    readonly: false,
+    backend: true,
+    name: "mock",
+    close: async () => {},
+    listUsers: async () => [],
+    getUserById: async () => { throw new NotFoundAbodeError(); },
+    deleteUserById: async () => {},
+    createUser: async () => MOCK_USER,
+    updateUser: async () => MOCK_USER,
+    getUserByEmail: async () => { throw new NotFoundAbodeError(); },
+    listAbodes: async () => [],
+    getAbodeById: async () => { throw new NotFoundAbodeError(); },
+    deleteAbodeById: async () => {},
+    createAbode: async () => ({ aid: "a", name: "A", created_at: "", created_by: null, updated_at: "", updated_by: null }),
+    updateAbode: async () => ({ aid: "a", name: "A", created_at: "", created_by: null, updated_at: "", updated_by: null }),
+    listResidents: async () => [],
+    getResidentById: async () => { throw new NotFoundAbodeError(); },
+    deleteResidentById: async () => {},
+    createResident: async () => ({ uid: "", aid: "", flags: {}, created_at: "", created_by: null, updated_at: "", updated_by: null }),
+    updateResident: async () => ({ uid: "", aid: "", flags: {}, created_at: "", created_by: null, updated_at: "", updated_by: null }),
+    listResidentsByUserId: async () => [],
+    listResidentsByAbodeId: async () => [],
+    listUsersByAbodeId: async () => [],
+    listAbodesByUserId: async () => [],
+    listNotes: async () => [],
+    getNoteById: async () => { throw new NotFoundAbodeError(); },
+    deleteNoteById: async () => {},
+    createNote: async () => { throw new Error("unimplemented"); },
+    updateNote: async () => { throw new Error("unimplemented"); },
+    listNotesByAbodeId: async () => [],
+    listNotesByUserId: async () => [],
+    deleteSessionsByUser: async () => {},
+    listApikeysByUser: async () => [],
+    getApikeyById: async () => { throw new NotFoundAbodeError(); },
+    createApikey: async () => [MOCK_APIKEY, "at_" + "0".repeat(32) as `at_${string}`],
+    deleteApikeyById: async () => {},
+    getUserByLogin: async () => { throw new NotFoundAbodeError(); },
+    getUserBySession: async () => { throw new NotFoundAbodeError(); },
+    createSession: async () => `as_${"0".repeat(32)}`,
+    getUserByApikey: async () => { throw new NotFoundAbodeError(); },
+    ...overrides,
+  };
+}
+
+type MockCtx = {
+  headers: Record<string, string>;
+  cookieJar: Record<string, string>;
+  clearedCookies: Set<string>;
+  status: number;
+  body: unknown;
+  user?: ClientUser;
+  session?: unknown;
+  get(header: string): string;
+  cookies: {
+    get(name: string): string | undefined;
+    set(name: string, value: string, opts?: unknown): void;
+  };
+};
+
+function makeMockCtx(headerOverrides: Record<string, string> = {}, cookieOverrides: Record<string, string> = {}): MockCtx {
+  const clearedCookies = new Set<string>();
+  const ctx: MockCtx = {
+    headers: headerOverrides,
+    cookieJar: cookieOverrides,
+    clearedCookies,
+    status: 200,
+    body: null,
+    user: undefined,
+    session: undefined,
+    get(header: string) {
+      return this.headers[header] ?? this.headers[header.toLowerCase()] ?? "";
+    },
+    cookies: {
+      get(name: string) {
+        return cookieOverrides[name];
+      },
+      set(name: string, value: string, opts?: unknown) {
+        if (value === "" || (opts && (opts as { expires?: Date }).expires?.getFullYear()! < 2000)) {
+          clearedCookies.add(name);
+        }
+      },
+    },
+  };
+  return ctx;
+}
+
+async function runMiddleware(
+  db: BackendDbInterface,
+  ctx: MockCtx
+): Promise<boolean> {
+  let nextCalled = false;
+  const mw = authenticate(db);
+  await mw(ctx as any, async () => { nextCalled = true; });
+  return nextCalled;
+}
+
+describe("authenticate middleware", () => {
+  describe("Basic auth", () => {
+    it("valid credentials → sets user and session, calls next", async () => {
+      const db = makeMockDb({ getUserByLogin: async () => MOCK_USER });
+      const encoded = btoa("test@example.com:password");
+      const ctx = makeMockCtx({ Authorization: `Basic ${encoded}` });
+      const next = await runMiddleware(db, ctx);
+      assert.equal(next, true);
+      assert.deepEqual(ctx.user, MOCK_USER);
+      assert.deepEqual(ctx.session, { source: "basic" });
+    });
+
+    it("malformed base64 → 400", async () => {
+      const db = makeMockDb();
+      const ctx = makeMockCtx({ Authorization: "Basic !!not-base64!!" });
+      await runMiddleware(db, ctx);
+      assert.equal(ctx.status, 400);
+    });
+
+    it("missing colon in decoded value → 400", async () => {
+      const db = makeMockDb();
+      const ctx = makeMockCtx({ Authorization: "Basic " + btoa("nocolon") });
+      await runMiddleware(db, ctx);
+      assert.equal(ctx.status, 400);
+    });
+
+    it("wrong password (NotAuthorizedAbodeError) → 401 invalid_password", async () => {
+      const db = makeMockDb({
+        getUserByLogin: async () => { throw new NotAuthorizedAbodeError(); },
+      });
+      const ctx = makeMockCtx({ Authorization: "Basic " + btoa("user:wrong") });
+      await runMiddleware(db, ctx);
+      assert.equal(ctx.status, 401);
+      assert.deepEqual((ctx.body as any)?.error, "invalid_password");
+    });
+
+    it("unknown user (NotFoundAbodeError) → 401 unknown_user", async () => {
+      const db = makeMockDb({
+        getUserByLogin: async () => { throw new NotFoundAbodeError(); },
+      });
+      const ctx = makeMockCtx({ Authorization: "Basic " + btoa("nobody:pass") });
+      await runMiddleware(db, ctx);
+      assert.equal(ctx.status, 401);
+      assert.deepEqual((ctx.body as any)?.error, "unknown_user");
+    });
+
+    it("ConflictAbodeError (#unset password) → 401 user_not_loggable", async () => {
+      const db = makeMockDb({
+        getUserByLogin: async () => { throw new ConflictAbodeError(); },
+      });
+      const ctx = makeMockCtx({ Authorization: "Basic " + btoa("user:pass") });
+      await runMiddleware(db, ctx);
+      assert.equal(ctx.status, 401);
+      assert.deepEqual((ctx.body as any)?.error, "user_not_loggable");
+    });
+
+    it("uses X-Abode-Authorization header when Authorization is absent", async () => {
+      const db = makeMockDb({ getUserByLogin: async () => MOCK_USER });
+      const encoded = btoa("test@example.com:password");
+      const ctx = makeMockCtx({ "X-Abode-Authorization": `Basic ${encoded}` });
+      const next = await runMiddleware(db, ctx);
+      assert.equal(next, true);
+      assert.ok(ctx.user);
+    });
+  });
+
+  describe("Bearer (API key)", () => {
+    const validToken = `at_${"a".repeat(32)}` as `at_${string}`;
+
+    it("valid at_ token → sets user and apikey session, calls next", async () => {
+      const db = makeMockDb({
+        getUserByApikey: async () => [MOCK_USER, MOCK_APIKEY],
+      });
+      const ctx = makeMockCtx({ Authorization: `Bearer ${validToken}` });
+      const next = await runMiddleware(db, ctx);
+      assert.equal(next, true);
+      assert.deepEqual(ctx.user, MOCK_USER);
+      assert.deepEqual(ctx.session, { source: "apikey", key: MOCK_APIKEY });
+    });
+
+    it("invalid/expired at_ token → 401 invalid_apikey", async () => {
+      const db = makeMockDb({
+        getUserByApikey: async () => { throw new NotFoundAbodeError(); },
+      });
+      const ctx = makeMockCtx({ Authorization: `Bearer ${validToken}` });
+      await runMiddleware(db, ctx);
+      assert.equal(ctx.status, 401);
+      assert.deepEqual((ctx.body as any)?.error, "invalid_apikey");
+    });
+
+    it("bearer token without at_ prefix → 401 unrecognized_bearer", async () => {
+      const db = makeMockDb();
+      const ctx = makeMockCtx({ Authorization: "Bearer not-an-apikey-token" });
+      await runMiddleware(db, ctx);
+      assert.equal(ctx.status, 401);
+      assert.deepEqual((ctx.body as any)?.error, "unrecognized_bearer");
+    });
+  });
+
+  describe("session cookie", () => {
+    const validToken = `as_${"b".repeat(32)}`;
+
+    it("valid session cookie → sets user and session, calls next", async () => {
+      const db = makeMockDb({
+        getUserBySession: async () => MOCK_USER,
+      });
+      const ctx = makeMockCtx({}, { abode_session: validToken });
+      const next = await runMiddleware(db, ctx);
+      assert.equal(next, true);
+      assert.deepEqual(ctx.user, MOCK_USER);
+      assert.deepEqual(ctx.session, { source: "session" });
+    });
+
+    it("invalid session token format clears cookie and falls through to 401", async () => {
+      const db = makeMockDb();
+      const ctx = makeMockCtx({}, { abode_session: "not-a-session-token" });
+      await runMiddleware(db, ctx);
+      assert.ok(ctx.clearedCookies.has("abode_session"), "cookie should be cleared");
+      assert.equal(ctx.status, 401);
+    });
+
+    it("expired/unknown session token clears cookie and returns 401", async () => {
+      const db = makeMockDb({
+        getUserBySession: async () => { throw new NotFoundAbodeError(); },
+      });
+      const ctx = makeMockCtx({}, { abode_session: validToken });
+      await runMiddleware(db, ctx);
+      assert.ok(ctx.clearedCookies.has("abode_session"), "cookie should be cleared");
+      assert.equal(ctx.status, 401);
+    });
+  });
+
+  describe("no auth", () => {
+    it("no credentials → 401 not_authenticated", async () => {
+      const db = makeMockDb();
+      const ctx = makeMockCtx();
+      const next = await runMiddleware(db, ctx);
+      assert.equal(next, false);
+      assert.equal(ctx.status, 401);
+      assert.deepEqual((ctx.body as any)?.error, "not_authenticated");
+    });
+  });
+});