familysync/apps/api/tests/auth/localAuthMiddleware.test.ts

/**
 * localAuthMiddleware() — unit tests (Plan 19-03, TDD RED → GREEN).
 *
 * Covers:
 *   Test 1: valid local-session cookie for an existing user → c.get('user') set; next() called
 *   Test 2: no cookie → pure passthrough; c.get('user') NOT set (OIDC guard fall-through intact)
 *   Test 3: cookie with valid JWT but userId has no users row → passthrough (no crash)
 *   Test 4: c.get('user') already set (devAuthBypass ran first) → not overwritten; next() called
 *
 * Security:
 *   - Test 2 is the Pitfall-1 guard: middleware must NEVER call c.set('user', undefined).
 *     The OIDC guard only fires when c.get('user') is falsy; setting it to undefined
 *     would suppress the OIDC guard for unauthenticated requests.
 */

import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
import { Hono } from 'hono';

// ---------------------------------------------------------------------------
// Mock DB — avoids real DB connections in this middleware unit-test
// ---------------------------------------------------------------------------

const mockDbSelectResult: Array<{
  id: number;
  oidcIss: string | null;
  oidcSub: string | null;
  displayName: string | null;
  color: string;
}> = [];

vi.mock('../../src/db/client.js', () => ({
  db: {
    select: vi.fn().mockReturnValue({
      from: vi.fn().mockReturnValue({
        where: vi.fn().mockReturnValue({
          limit: vi.fn().mockImplementation(() => Promise.resolve(mockDbSelectResult)),
        }),
      }),
    }),
  },
}));

// ---------------------------------------------------------------------------
// Mock verifyLocalSessionCookie — controls what userId the cookie yields
// ---------------------------------------------------------------------------

let mockVerifyResult: number | null = null;

vi.mock('../../src/auth/localSession.js', () => ({
  verifyLocalSessionCookie: vi.fn().mockImplementation(() => Promise.resolve(mockVerifyResult)),
  issueLocalSessionCookie: vi.fn(),
  clearLocalSessionCookie: vi.fn(),
}));

// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------

async function getMiddleware() {
  const { localAuthMiddleware } = await import('../../src/auth/localAuthMiddleware.js');
  return localAuthMiddleware;
}

function makeApp(middleware: ReturnType<typeof vi.fn>, presetUser?: unknown) {
  const app = new Hono();

  if (presetUser !== undefined) {
    // Simulate devAuthBypass having already set c.get('user')
    app.use('/api/*', async (c, next) => {
      // eslint-disable-next-line @typescript-eslint/no-explicit-any
      c.set('user', presetUser as any);
      await next();
    });
  }

  app.use('/api/*', middleware());

  let capturedUser: unknown = 'NOT_SET_SENTINEL';
  let nextCalled = false;

  app.get('/api/test', (c) => {
    capturedUser = c.get('user');
    nextCalled = true;
    return c.json({ ok: true });
  });

  return { app, getCapturedUser: () => capturedUser, wasNextCalled: () => nextCalled };
}

// ---------------------------------------------------------------------------

describe('localAuthMiddleware', () => {
  beforeEach(() => {
    mockVerifyResult = null;
    mockDbSelectResult.splice(0);
    vi.resetModules();
  });

  afterEach(() => {
    vi.resetModules();
  });

  it('Test 1: valid local-session cookie for existing user → sets c.get("user") and calls next', async () => {
    mockVerifyResult = 42;
    mockDbSelectResult.push({
      id: 42,
      oidcIss: 'local',
      oidcSub: '42',
      displayName: 'Test User',
      color: '#4A90D9',
    });

    const localAuthMiddleware = await getMiddleware();
    const { app } = makeApp(localAuthMiddleware);

    const res = await app.request('/api/test');
    expect(res.status).toBe(200);

    // Re-import to inspect captured value via the route handler's closure
    // We verify by checking response — route returns 200 only if next() was called
    // The actual user value is verified via the app route handler
    const body = (await res.json()) as { ok: boolean };
    expect(body.ok).toBe(true);
  });

  it('Test 1b: user shape from DB row is correct (id, oidcIss, oidcSub, displayName, color)', async () => {
    mockVerifyResult = 7;
    mockDbSelectResult.push({
      id: 7,
      oidcIss: 'https://auth.example.com',
      oidcSub: 'sub-abc',
      displayName: 'Alice',
      color: '#FF5733',
    });

    const localAuthMiddleware = await getMiddleware();
    const app = new Hono();
    let capturedUser: unknown;

    app.use('/api/*', localAuthMiddleware());
    app.get('/api/test', (c) => {
      capturedUser = c.get('user');
      return c.json({ ok: true });
    });

    const res = await app.request('/api/test');
    expect(res.status).toBe(200);
    expect(capturedUser).toBeDefined();
    const u = capturedUser as {
      id: number;
      oidcIss: string;
      oidcSub: string;
      displayName: string | null;
      color: string;
    };
    expect(u.id).toBe(7);
    expect(u.oidcIss).toBe('https://auth.example.com');
    expect(u.oidcSub).toBe('sub-abc');
    expect(u.displayName).toBe('Alice');
    expect(u.color).toBe('#FF5733');
  });

  it('Test 1c (BL-04): local user with null DB oidc fields → context oidcIss/oidcSub are NULL (no fabricated sentinels)', async () => {
    mockVerifyResult = 9;
    mockDbSelectResult.push({
      id: 9,
      oidcIss: null, // local user — no OIDC identity bound
      oidcSub: null,
      displayName: 'Local Member',
      color: '#22AA88',
    });

    const localAuthMiddleware = await getMiddleware();
    const app = new Hono();
    let capturedUser: unknown;

    app.use('/api/*', localAuthMiddleware());
    app.get('/api/test', (c) => {
      capturedUser = c.get('user');
      return c.json({ ok: true });
    });

    const res = await app.request('/api/test');
    expect(res.status).toBe(200);
    const u = capturedUser as { id: number; oidcIss: string | null; oidcSub: string | null };
    expect(u.id).toBe(9);
    // BL-04: must be null — NOT 'local' / String(id) sentinels that share the
    // uniq_oidc_identity domain with real OIDC identities.
    expect(u.oidcIss).toBeNull();
    expect(u.oidcSub).toBeNull();
  });

  it('Test 2: no cookie → pure passthrough; c.get("user") remains unset (Pitfall-1 guard)', async () => {
    mockVerifyResult = null; // No cookie / invalid

    const localAuthMiddleware = await getMiddleware();
    const app = new Hono();
    let capturedUser: unknown = 'NOT_SET_SENTINEL';
    let nextCalled = false;

    app.use('/api/*', localAuthMiddleware());
    app.get('/api/test', (c) => {
      capturedUser = c.get('user');
      nextCalled = true;
      return c.json({ ok: true });
    });

    const res = await app.request('/api/test');
    expect(res.status).toBe(200);
    expect(nextCalled).toBe(true);
    // CRITICAL: user must remain UNSET (undefined), NOT set to undefined explicitly.
    // The OIDC guard checks c.get('user') — if it's undefined (not set), the guard fires.
    // The middleware must call next() without c.set('user') on the no-cookie path.
    expect(capturedUser).toBeUndefined();
  });

  it('Test 3: valid cookie but userId has no users row → passthrough (no crash)', async () => {
    mockVerifyResult = 999; // Valid JWT payload, userId=999
    mockDbSelectResult.splice(0); // No DB row for userId 999

    const localAuthMiddleware = await getMiddleware();
    const app = new Hono();
    let capturedUser: unknown = 'NOT_SET_SENTINEL';
    let nextCalled = false;

    app.use('/api/*', localAuthMiddleware());
    app.get('/api/test', (c) => {
      capturedUser = c.get('user');
      nextCalled = true;
      return c.json({ ok: true });
    });

    const res = await app.request('/api/test');
    expect(res.status).toBe(200);
    expect(nextCalled).toBe(true);
    // No row found — should passthrough without setting user
    expect(capturedUser).toBeUndefined();
  });

  it('Test 4: c.get("user") already set (devAuthBypass ran first) → not overwritten; next() called', async () => {
    const preExistingUser = {
      id: 1,
      oidcIss: 'dev',
      oidcSub: 'dev-user',
      displayName: 'Dev User',
      color: '#4A90D9',
    };

    // Even if verifyLocalSessionCookie would succeed, the existing user must not be overwritten
    mockVerifyResult = 99; // A DIFFERENT userId
    mockDbSelectResult.push({
      id: 99,
      oidcIss: 'local',
      oidcSub: '99',
      displayName: 'Another User',
      color: '#FF0000',
    });

    const localAuthMiddleware = await getMiddleware();
    const app = new Hono();
    let capturedUser: unknown;

    // Simulate devAuthBypass having set the user first
    app.use('/api/*', async (c, next) => {
      // eslint-disable-next-line @typescript-eslint/no-explicit-any
      c.set('user', preExistingUser as any);
      await next();
    });
    app.use('/api/*', localAuthMiddleware());
    app.get('/api/test', (c) => {
      capturedUser = c.get('user');
      return c.json({ ok: true });
    });

    const res = await app.request('/api/test');
    expect(res.status).toBe(200);
    // User must remain the dev-bypass user, not overwritten
    expect(capturedUser).toEqual(preExistingUser);
    expect((capturedUser as typeof preExistingUser).id).toBe(1);
  });
});