familysync/apps/api/tests/routes/push.test.ts

/**
 * RED scaffold — push routes (Plan 05-04 turns this GREEN).
 *
 * Asserts:
 *   - POST /api/push/subscription persists a row scoped to the authed user
 *   - POST /api/push/subscription returns 401 when unauthenticated
 *   - DELETE /api/push/subscription removes all rows for the caller's userId
 *   - GET /api/push/vapid-public-key returns { publicKey } (unauthenticated)
 *
 * These tests fail now because apps/api/src/routes/push.ts does not yet exist.
 * Run: pnpm --filter @familysync/api exec vitest run tests/routes/push.test.ts
 *
 * Uses the same mock boilerplate as lists.test.ts.
 */

import { describe, it, expect, beforeEach, vi } from 'vitest';
import { randomUUID } from 'node:crypto';
import { db } from '../../src/db/client.js';
import { users, pushSubscriptions } from '../../src/db/schema.js';

// ---------------------------------------------------------------------------
// Dev-bypass mock: inject a specific user ID as the "logged-in" user.
// ---------------------------------------------------------------------------

let currentDevUserId = 1;

vi.mock('../../src/auth/devBypass.js', () => ({
  devAuthBypass:
    () => async (c: { set: (k: string, v: unknown) => void }, next: () => Promise<void>) => {
      c.set('user', { id: currentDevUserId });
      await next();
    },
}));

vi.mock('@hono/oidc-auth', () => ({
  oidcAuthMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
  processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) => c.json({ ok: true }),
  getAuth: () => null,
}));

// ---------------------------------------------------------------------------
// Seed helpers
// ---------------------------------------------------------------------------

async function seedUser(label: string): Promise<number> {
  const [result] = await db
    .insert(users)
    .values({
      oidcIss: 'https://auth.test',
      oidcSub: `sub-${label}-${randomUUID()}`,
      displayName: `User ${label}`,
      color: '#4A90D9',
    })
    .$returningId();
  return result.id;
}

// ---------------------------------------------------------------------------
// Import `app` lazily (after mocks are registered)
// ---------------------------------------------------------------------------

async function getApp() {
  const { app } = await import('../../src/index.js');
  return app;
}

// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------

function jsonRequest(method: string, path: string, body?: unknown): Request {
  return new Request(`http://localhost${path}`, {
    method,
    headers: { 'Content-Type': 'application/json' },
    body: body !== undefined ? JSON.stringify(body) : undefined,
  });
}

function makeSubscriptionBody() {
  return {
    endpoint: `https://push.example.com/sub/${randomUUID()}`,
    keys: {
      p256dh: 'BNbxV8eFzxF7rPv3fakekey==',
      auth: 'fakeauthtoken==',
    },
  };
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

beforeEach(async () => {
  // Users are seeded fresh per test; setup.ts truncates pushSubscriptions in afterEach
});

describe('GET /api/push/vapid-public-key', () => {
  it('returns { publicKey } without authentication', async () => {
    process.env.VAPID_PUBLIC_KEY = 'test_public_key_value';
    const app = await getApp();
    const res = await app.fetch(new Request('http://localhost/api/push/vapid-public-key'));
    expect(res.status).toBe(200);
    const body = (await res.json()) as { publicKey: string };
    expect(typeof body.publicKey).toBe('string');
  });
});

describe('POST /api/push/subscription', () => {
  it('returns 401 when unauthenticated', async () => {
    // Simulate unauthenticated state: devBypass injects no user (passthrough only),
    // and OIDC getAuth returns null — so resolveUserId returns null → 401.
    vi.doMock('../../src/auth/devBypass.js', () => ({
      devAuthBypass: () => async (_c: unknown, next: () => Promise<void>) => next(),
    }));
    vi.doMock('../../src/auth/middleware.js', () => ({
      getAuth: () => null,
      oidcAuthMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
      processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) =>
        c.json({ ok: true }),
    }));

    const { app: freshApp } = await import('../../src/index.js?v=unauth');
    const res = await freshApp.fetch(
      jsonRequest('POST', '/api/push/subscription', makeSubscriptionBody()),
    );
    expect(res.status).toBe(401);
  });

  it('persists a push_subscriptions row scoped to the authed user', async () => {
    const userId = await seedUser('alice');
    currentDevUserId = userId;
    const app = await getApp();

    const body = makeSubscriptionBody();
    const res = await app.fetch(jsonRequest('POST', '/api/push/subscription', body));
    expect(res.status).toBe(201);

    const rows = await db
      .select()
      .from(pushSubscriptions)
      .where((await import('drizzle-orm')).eq(pushSubscriptions.userId, userId));
    expect(rows).toHaveLength(1);
    expect(rows[0].endpoint).toBe(body.endpoint);
  });
});

describe('DELETE /api/push/subscription', () => {
  it("removes the caller's subscription rows", async () => {
    const userId = await seedUser('bob');
    currentDevUserId = userId;
    const app = await getApp();

    // First subscribe
    await app.fetch(jsonRequest('POST', '/api/push/subscription', makeSubscriptionBody()));

    // Then unsubscribe
    const res = await app.fetch(jsonRequest('DELETE', '/api/push/subscription'));
    expect(res.status).toBe(200);

    const { eq } = await import('drizzle-orm');
    const rows = await db
      .select()
      .from(pushSubscriptions)
      .where(eq(pushSubscriptions.userId, userId));
    expect(rows).toHaveLength(0);
  });
});