From ac32bd405f6cda6176fa8bcc1bd6bde8840d6090 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Wed, 17 Jun 2026 16:48:07 -0400 Subject: [PATCH] test(19-03): add failing tests for localAuthMiddleware and GET /api/auth/mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - RED: 8 tests failing (modules not yet created) - localAuthMiddleware: 4 tests for cookie→user shape, no-cookie passthrough, missing user row, devAuthBypass coexistence - authMode: 3 tests for mode response with no oidc, env oidc, app_config oidc --- .../tests/auth/localAuthMiddleware.test.ts | 246 ++++++++++++++++++ apps/api/tests/routes/authMode.test.ts | 123 +++++++++ 2 files changed, 369 insertions(+) create mode 100644 apps/api/tests/auth/localAuthMiddleware.test.ts create mode 100644 apps/api/tests/routes/authMode.test.ts diff --git a/apps/api/tests/auth/localAuthMiddleware.test.ts b/apps/api/tests/auth/localAuthMiddleware.test.ts new file mode 100644 index 0000000..4dc9590 --- /dev/null +++ b/apps/api/tests/auth/localAuthMiddleware.test.ts @@ -0,0 +1,246 @@ +/** + * localAuthMiddleware() — unit tests (Plan 19-03, TDD RED → GREEN). + * + * Covers: + * Test 1: valid local-session cookie for an existing user → c.get('user') set; next() called + * Test 2: no cookie → pure passthrough; c.get('user') NOT set (OIDC guard fall-through intact) + * Test 3: cookie with valid JWT but userId has no users row → passthrough (no crash) + * Test 4: c.get('user') already set (devAuthBypass ran first) → not overwritten; next() called + * + * Security: + * - Test 2 is the Pitfall-1 guard: middleware must NEVER call c.set('user', undefined). + * The OIDC guard only fires when c.get('user') is falsy; setting it to undefined + * would suppress the OIDC guard for unauthenticated requests. + */ + +import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'; +import { Hono } from 'hono'; + +// --------------------------------------------------------------------------- +// Mock DB — avoids real DB connections in this middleware unit-test +// --------------------------------------------------------------------------- + +const mockDbSelectResult: Array<{ + id: number; + oidcIss: string | null; + oidcSub: string | null; + displayName: string | null; + color: string; +}> = []; + +vi.mock('../../src/db/client.js', () => ({ + db: { + select: vi.fn().mockReturnValue({ + from: vi.fn().mockReturnValue({ + where: vi.fn().mockReturnValue({ + limit: vi.fn().mockImplementation(() => Promise.resolve(mockDbSelectResult)), + }), + }), + }), + }, +})); + +// --------------------------------------------------------------------------- +// Mock verifyLocalSessionCookie — controls what userId the cookie yields +// --------------------------------------------------------------------------- + +let mockVerifyResult: number | null = null; + +vi.mock('../../src/auth/localSession.js', () => ({ + verifyLocalSessionCookie: vi.fn().mockImplementation(() => Promise.resolve(mockVerifyResult)), + issueLocalSessionCookie: vi.fn(), + clearLocalSessionCookie: vi.fn(), +})); + +// --------------------------------------------------------------------------- +// Helpers +// --------------------------------------------------------------------------- + +async function getMiddleware() { + const { localAuthMiddleware } = await import('../../src/auth/localAuthMiddleware.js'); + return localAuthMiddleware; +} + +function makeApp(middleware: ReturnType, presetUser?: unknown) { + const app = new Hono(); + + if (presetUser !== undefined) { + // Simulate devAuthBypass having already set c.get('user') + app.use('/api/*', async (c, next) => { + // eslint-disable-next-line @typescript-eslint/no-explicit-any + c.set('user', presetUser as any); + await next(); + }); + } + + // eslint-disable-next-line @typescript-eslint/no-unsafe-call + app.use('/api/*', middleware()); + + let capturedUser: unknown = 'NOT_SET_SENTINEL'; + let nextCalled = false; + + app.get('/api/test', (c) => { + capturedUser = c.get('user'); + nextCalled = true; + return c.json({ ok: true }); + }); + + return { app, getCapturedUser: () => capturedUser, wasNextCalled: () => nextCalled }; +} + +// --------------------------------------------------------------------------- + +describe('localAuthMiddleware', () => { + beforeEach(() => { + mockVerifyResult = null; + mockDbSelectResult.splice(0); + vi.resetModules(); + }); + + afterEach(() => { + vi.resetModules(); + }); + + it('Test 1: valid local-session cookie for existing user → sets c.get("user") and calls next', async () => { + mockVerifyResult = 42; + mockDbSelectResult.push({ + id: 42, + oidcIss: 'local', + oidcSub: '42', + displayName: 'Test User', + color: '#4A90D9', + }); + + const localAuthMiddleware = await getMiddleware(); + const { app } = makeApp(localAuthMiddleware); + + const res = await app.request('/api/test'); + expect(res.status).toBe(200); + + // Re-import to inspect captured value via the route handler's closure + // We verify by checking response — route returns 200 only if next() was called + // The actual user value is verified via the app route handler + const body = (await res.json()) as { ok: boolean }; + expect(body.ok).toBe(true); + }); + + it('Test 1b: user shape from DB row is correct (id, oidcIss, oidcSub, displayName, color)', async () => { + mockVerifyResult = 7; + mockDbSelectResult.push({ + id: 7, + oidcIss: 'https://auth.example.com', + oidcSub: 'sub-abc', + displayName: 'Alice', + color: '#FF5733', + }); + + const localAuthMiddleware = await getMiddleware(); + const app = new Hono(); + let capturedUser: unknown; + + app.use('/api/*', localAuthMiddleware()); + app.get('/api/test', (c) => { + capturedUser = c.get('user'); + return c.json({ ok: true }); + }); + + const res = await app.request('/api/test'); + expect(res.status).toBe(200); + expect(capturedUser).toBeDefined(); + const u = capturedUser as { id: number; oidcIss: string; oidcSub: string; displayName: string | null; color: string }; + expect(u.id).toBe(7); + expect(u.oidcIss).toBe('https://auth.example.com'); + expect(u.oidcSub).toBe('sub-abc'); + expect(u.displayName).toBe('Alice'); + expect(u.color).toBe('#FF5733'); + }); + + it('Test 2: no cookie → pure passthrough; c.get("user") remains unset (Pitfall-1 guard)', async () => { + mockVerifyResult = null; // No cookie / invalid + + const localAuthMiddleware = await getMiddleware(); + const app = new Hono(); + let capturedUser: unknown = 'NOT_SET_SENTINEL'; + let nextCalled = false; + + app.use('/api/*', localAuthMiddleware()); + app.get('/api/test', (c) => { + capturedUser = c.get('user'); + nextCalled = true; + return c.json({ ok: true }); + }); + + const res = await app.request('/api/test'); + expect(res.status).toBe(200); + expect(nextCalled).toBe(true); + // CRITICAL: user must remain UNSET (undefined), NOT set to undefined explicitly. + // The OIDC guard checks c.get('user') — if it's undefined (not set), the guard fires. + // The middleware must call next() without c.set('user') on the no-cookie path. + expect(capturedUser).toBeUndefined(); + }); + + it('Test 3: valid cookie but userId has no users row → passthrough (no crash)', async () => { + mockVerifyResult = 999; // Valid JWT payload, userId=999 + mockDbSelectResult.splice(0); // No DB row for userId 999 + + const localAuthMiddleware = await getMiddleware(); + const app = new Hono(); + let capturedUser: unknown = 'NOT_SET_SENTINEL'; + let nextCalled = false; + + app.use('/api/*', localAuthMiddleware()); + app.get('/api/test', (c) => { + capturedUser = c.get('user'); + nextCalled = true; + return c.json({ ok: true }); + }); + + const res = await app.request('/api/test'); + expect(res.status).toBe(200); + expect(nextCalled).toBe(true); + // No row found — should passthrough without setting user + expect(capturedUser).toBeUndefined(); + }); + + it('Test 4: c.get("user") already set (devAuthBypass ran first) → not overwritten; next() called', async () => { + const preExistingUser = { + id: 1, + oidcIss: 'dev', + oidcSub: 'dev-user', + displayName: 'Dev User', + color: '#4A90D9', + }; + + // Even if verifyLocalSessionCookie would succeed, the existing user must not be overwritten + mockVerifyResult = 99; // A DIFFERENT userId + mockDbSelectResult.push({ + id: 99, + oidcIss: 'local', + oidcSub: '99', + displayName: 'Another User', + color: '#FF0000', + }); + + const localAuthMiddleware = await getMiddleware(); + const app = new Hono(); + let capturedUser: unknown; + + // Simulate devAuthBypass having set the user first + app.use('/api/*', async (c, next) => { + // eslint-disable-next-line @typescript-eslint/no-explicit-any + c.set('user', preExistingUser as any); + await next(); + }); + app.use('/api/*', localAuthMiddleware()); + app.get('/api/test', (c) => { + capturedUser = c.get('user'); + return c.json({ ok: true }); + }); + + const res = await app.request('/api/test'); + expect(res.status).toBe(200); + // User must remain the dev-bypass user, not overwritten + expect(capturedUser).toEqual(preExistingUser); + expect((capturedUser as typeof preExistingUser).id).toBe(1); + }); +}); diff --git a/apps/api/tests/routes/authMode.test.ts b/apps/api/tests/routes/authMode.test.ts new file mode 100644 index 0000000..19fe7fe --- /dev/null +++ b/apps/api/tests/routes/authMode.test.ts @@ -0,0 +1,123 @@ +/** + * GET /api/auth/mode — unit tests (Plan 19-03, TDD RED → GREEN). + * + * Covers: + * Test 5: returns { localEnabled:true, oidcEnabled:false } when no oidc_issuer in env or app_config + * Test 6: returns { oidcEnabled:true } when OIDC_ISSUER env var is set + * Test 6b: returns { oidcEnabled:true } when oidc_issuer is in app_config (no env var) + * + * Pre-auth surface: reachable without OIDC session (same as /api/setup/status). + */ + +import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'; + +// --------------------------------------------------------------------------- +// DB mock — controls app_config rows returned for oidc_issuer +// --------------------------------------------------------------------------- + +let mockAppConfigOidcIssuer: string | null = null; + +vi.mock('../../src/db/client.js', () => ({ + db: { + execute: vi.fn().mockResolvedValue([[{ '1': 1 }]]), + select: vi.fn().mockImplementation(() => ({ + from: vi.fn().mockReturnValue({ + where: vi.fn().mockReturnValue({ + limit: vi.fn().mockImplementation(() => { + if (mockAppConfigOidcIssuer) { + return Promise.resolve([{ value: mockAppConfigOidcIssuer }]); + } + return Promise.resolve([]); + }), + }), + }), + })), + insert: vi.fn().mockReturnValue({ + values: vi.fn().mockReturnValue({ + onDuplicateKeyUpdate: vi.fn().mockResolvedValue(undefined), + }), + }), + }, +})); + +vi.mock('@hono/oidc-auth', () => ({ + oidcAuthMiddleware: () => async (_c: unknown, next: () => Promise) => next(), + processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) => c.json({ ok: true }), + getAuth: vi.fn().mockResolvedValue(null), +})); + +vi.mock('../../src/auth/devBypass.js', () => ({ + devAuthBypass: + () => async (_c: unknown, next: () => Promise) => next(), +})); + +vi.mock('../../src/auth/localAuthMiddleware.js', () => ({ + localAuthMiddleware: + () => async (_c: unknown, next: () => Promise) => next(), +})); + +// --------------------------------------------------------------------------- +// Env snapshot +// --------------------------------------------------------------------------- + +const originalOidcIssuer = process.env.OIDC_ISSUER; + +beforeEach(() => { + mockAppConfigOidcIssuer = null; + delete process.env.OIDC_ISSUER; + vi.resetModules(); +}); + +afterEach(() => { + if (originalOidcIssuer === undefined) { + delete process.env.OIDC_ISSUER; + } else { + process.env.OIDC_ISSUER = originalOidcIssuer; + } + vi.resetModules(); +}); + +// --------------------------------------------------------------------------- +// Tests +// --------------------------------------------------------------------------- + +describe('GET /api/auth/mode', () => { + it('Test 5: returns { localEnabled:true, oidcEnabled:false } when no oidc_issuer in env or app_config', async () => { + delete process.env.OIDC_ISSUER; + mockAppConfigOidcIssuer = null; + + const { app } = await import('../../src/index.js'); + const res = await app.request('/api/auth/mode'); + + expect(res.status).toBe(200); + const body = (await res.json()) as { localEnabled: boolean; oidcEnabled: boolean }; + expect(body.localEnabled).toBe(true); + expect(body.oidcEnabled).toBe(false); + }); + + it('Test 6: returns { oidcEnabled:true } when OIDC_ISSUER env var is set', async () => { + process.env.OIDC_ISSUER = 'https://auth.example.com'; + mockAppConfigOidcIssuer = null; + + const { app } = await import('../../src/index.js'); + const res = await app.request('/api/auth/mode'); + + expect(res.status).toBe(200); + const body = (await res.json()) as { localEnabled: boolean; oidcEnabled: boolean }; + expect(body.localEnabled).toBe(true); + expect(body.oidcEnabled).toBe(true); + }); + + it('Test 6b: returns { oidcEnabled:true } when oidc_issuer is in app_config (no env var)', async () => { + delete process.env.OIDC_ISSUER; + mockAppConfigOidcIssuer = 'https://auth-from-config.example.com'; + + const { app } = await import('../../src/index.js'); + const res = await app.request('/api/auth/mode'); + + expect(res.status).toBe(200); + const body = (await res.json()) as { localEnabled: boolean; oidcEnabled: boolean }; + expect(body.localEnabled).toBe(true); + expect(body.oidcEnabled).toBe(true); + }); +});