mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 13:36:48 +00:00
Maurice
724c88c201
A mechanical prettier --write over server/src, server/tests, server/scripts and shared/src with the workspaces' .prettierrc; nothing but layout and import order changes, and every file keeps the same set of imports. shared is formatted throughout and its format baseline is empty. The server baseline keeps the 35 files that Prettier would grow past their lint:size limit (they need a split first, which is not a formatting change), and the generated entity files stay as their generator writes them.
418 lines
19 KiB
TypeScript
418 lines
19 KiB
TypeScript
// ---------------------------------------------------------------------------
|
|
// Imports (after mocks)
|
|
// ---------------------------------------------------------------------------
|
|
import { db as testDb } from '../../../src/db/database';
|
|
import { McpTokens } from '../../../src/db/entities/McpTokens.entity';
|
|
import { Users } from '../../../src/db/entities/Users.entity';
|
|
import { revokeUserSessions } from '../../../src/mcp/sessionManager';
|
|
import { EphemeralTokenService } from '../../../src/nest/auth-core/ephemeral-token.service';
|
|
import { createEphemeralToken } from '../../../src/nest/auth-core/ephemeral-tokens';
|
|
import { TokenService } from '../../../src/nest/tokens/token.service';
|
|
import { TokensModule } from '../../../src/nest/tokens/tokens.module';
|
|
import { asLegacyResult } from '../../helpers/domain-error';
|
|
import { createUser } from '../../helpers/factories';
|
|
import { countRows, findRow, insertRow, updateRows } from '../../helpers/factories/rows';
|
|
import { expectRegisteredProvider } from '../../helpers/module-providers';
|
|
import { resetTestDb } from '../../helpers/test-db';
|
|
import { createTestMcpTokensRepo, createTestUsersRepo } from '../../helpers/test-uow';
|
|
import { sharedTestOrm } from '../../helpers/test-uow';
|
|
|
|
import { describe, it, expect, beforeAll, beforeEach, afterAll, vi } from 'vitest';
|
|
|
|
/**
|
|
* token.service.test.ts
|
|
*
|
|
* DB-centric unit tests for TokenService against a real in-memory SQLite
|
|
* database. The cases moved here with the methods, out of auth.service.test.ts;
|
|
* the AUTH-DB-* / AUTH-BR-* case IDs are preserved so the history stays
|
|
* greppable. Constructed directly (no TestingModule, repo convention).
|
|
*/
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// vi.hoisted: build the real in-memory DB and the module mock before any import
|
|
// ---------------------------------------------------------------------------
|
|
|
|
vi.mock('../../../src/db/database', async () => {
|
|
const { createSnapshotTestDb } = await import('../../helpers/db-mock');
|
|
const db = createSnapshotTestDb();
|
|
const mock = {
|
|
db,
|
|
closeDb: () => {},
|
|
reinitialize: () => {},
|
|
canAccessTrip: () => undefined,
|
|
isOwner: () => false,
|
|
};
|
|
return mock;
|
|
});
|
|
|
|
vi.mock('../../../src/nest/auth-core/ephemeral-tokens', () => ({ createEphemeralToken: vi.fn() }));
|
|
vi.mock('../../../src/mcp/sessionManager', () => ({ revokeUserSessions: vi.fn() }));
|
|
|
|
/** The token row, or null once it is gone. */
|
|
async function tokenRow(id: number | string) {
|
|
return findRow(await sharedTestOrm(testDb), McpTokens, { id: Number(id) });
|
|
}
|
|
|
|
// Schema first, then the ORM-backed repositories `TokenService` now takes
|
|
// (Plan 3b Task 2) — `sharedTestOrm` (behind `createTestMcpTokensRepo`/
|
|
// `createTestUsersRepo`) shares this suite's own better-sqlite3 handle, so
|
|
// the tables must already exist before it initialises.
|
|
let svc: TokenService;
|
|
|
|
beforeAll(async () => {
|
|
svc = new TokenService(
|
|
await createTestMcpTokensRepo(testDb),
|
|
await createTestUsersRepo(testDb),
|
|
new EphemeralTokenService(),
|
|
);
|
|
});
|
|
|
|
beforeEach(() => {
|
|
resetTestDb(testDb);
|
|
vi.clearAllMocks();
|
|
});
|
|
|
|
afterAll(() => {
|
|
testDb.close();
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// MCP tokens — the user-facing half
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('MCP token service', () => {
|
|
it('AUTH-DB-041: createMcpToken returns 400 when name is missing', async () => {
|
|
const { user } = createUser(testDb);
|
|
const result = await asLegacyResult(svc.createMcpToken(user.id, undefined));
|
|
expect(result.status).toBe(400);
|
|
});
|
|
|
|
it('AUTH-DB-042: createMcpToken returns 400 when name exceeds 100 chars', async () => {
|
|
const { user } = createUser(testDb);
|
|
const result = await asLegacyResult(svc.createMcpToken(user.id, 'a'.repeat(101)));
|
|
expect(result.status).toBe(400);
|
|
});
|
|
|
|
it('AUTH-DB-043: createMcpToken creates token and returns raw_token', async () => {
|
|
const { user } = createUser(testDb);
|
|
const result = await asLegacyResult(svc.createMcpToken(user.id, 'My Token'));
|
|
expect(result.token).toBeDefined();
|
|
expect((result.token as any).raw_token).toMatch(/^trek_/);
|
|
});
|
|
|
|
it('AUTH-DB-044: createMcpToken returns 400 when user has 10 tokens already', async () => {
|
|
const { user } = createUser(testDb);
|
|
for (let i = 0; i < 10; i++) {
|
|
await insertRow(await sharedTestOrm(testDb), McpTokens, {
|
|
user: user.id,
|
|
name: `Token ${i}`,
|
|
token_hash: `hash${i}`,
|
|
token_prefix: `trek_prefix${i}`,
|
|
});
|
|
}
|
|
const result = await asLegacyResult(svc.createMcpToken(user.id, 'One More'));
|
|
expect(result.status).toBe(400);
|
|
});
|
|
|
|
it('AUTH-DB-045: deleteMcpToken returns 404 for non-existent token', async () => {
|
|
const { user } = createUser(testDb);
|
|
const result = await asLegacyResult(svc.deleteMcpToken(user.id, '99999'));
|
|
expect(result.status).toBe(404);
|
|
});
|
|
|
|
it('AUTH-DB-046: deleteMcpToken deletes the token and returns success', async () => {
|
|
const { user } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createMcpToken(user.id, 'Deletable Token'));
|
|
const tokenId = String((created.token as any).id);
|
|
|
|
const result = await asLegacyResult(svc.deleteMcpToken(user.id, tokenId));
|
|
expect(result).toEqual({ success: true });
|
|
|
|
const row = await tokenRow(tokenId);
|
|
expect(row).toBeNull();
|
|
});
|
|
|
|
it('AUTH-DB-092: deleteMcpToken succeeds even when the session sweep throws (best-effort)', async () => {
|
|
const { user } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createMcpToken(user.id, 'sweep-down'));
|
|
const tokenId = String((created.token as { id: number }).id);
|
|
vi.mocked(revokeUserSessions).mockImplementationOnce(() => {
|
|
throw new Error('sweep down');
|
|
});
|
|
|
|
expect(await asLegacyResult(svc.deleteMcpToken(user.id, tokenId))).toEqual({ success: true });
|
|
expect(await tokenRow(tokenId)).toBeNull();
|
|
});
|
|
|
|
it('TOKEN-001: listMcpTokens is scoped to the caller and never exposes the hash', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
await asLegacyResult(svc.createMcpToken(user.id, 'mine'));
|
|
await asLegacyResult(svc.createMcpToken(other.id, 'theirs'));
|
|
|
|
const mine = (await svc.listMcpTokens(user.id)) as Record<string, unknown>[];
|
|
expect(mine).toHaveLength(1);
|
|
expect(mine[0].name).toBe('mine');
|
|
expect(mine[0]).not.toHaveProperty('token_hash');
|
|
});
|
|
|
|
it('TOKEN-002: deleteMcpToken refuses a token that belongs to someone else', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createMcpToken(other.id, 'not-yours'));
|
|
const tokenId = String((created.token as { id: number }).id);
|
|
|
|
expect(await asLegacyResult(svc.deleteMcpToken(user.id, tokenId))).toEqual({
|
|
error: 'Token not found',
|
|
status: 404,
|
|
});
|
|
expect(await tokenRow(tokenId)).not.toBeNull();
|
|
});
|
|
|
|
it('TOKEN-017: deleteMcpToken 404s (not 500) on a non-numeric id — Plan 3b Task 2 review, F1', async () => {
|
|
const { user } = createUser(testDb);
|
|
expect(await asLegacyResult(svc.deleteMcpToken(user.id, 'abc'))).toEqual({ error: 'Token not found', status: 404 });
|
|
});
|
|
|
|
it('TOKEN-018: deleteMcpToken 404s on a hex-shaped id — Number("0x10") is 16, a safe integer a bare Number() conversion would accept, but SQLite affinity never would (Plan 3b Task 2 review, F1)', async () => {
|
|
const { user } = createUser(testDb);
|
|
expect(await asLegacyResult(svc.deleteMcpToken(user.id, '0x10'))).toEqual({
|
|
error: 'Token not found',
|
|
status: 404,
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// API keys — the same table, a different door
|
|
//
|
|
// An MCP token drives every assistant tool; an API key reads trips over HTTP.
|
|
// The kind is in the WHERE clause of every lookup, so these tests are the ones
|
|
// that would catch a credential quietly opening the wrong surface.
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('API key service', () => {
|
|
it('TOKEN-010: an API key does not verify as an MCP token', async () => {
|
|
const { user } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createApiToken(user.id, 'dawarich'));
|
|
const raw = (created.token as { raw_token: string }).raw_token;
|
|
|
|
expect((await svc.verifyApiToken(raw))?.id).toBe(user.id);
|
|
expect(await svc.verifyMcpToken(raw)).toBeNull();
|
|
});
|
|
|
|
it('TOKEN-011: an MCP token does not verify as an API key', async () => {
|
|
const { user } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createMcpToken(user.id, 'claude'));
|
|
const raw = (created.token as { raw_token: string }).raw_token;
|
|
|
|
expect((await svc.verifyMcpToken(raw))?.id).toBe(user.id);
|
|
expect(await svc.verifyApiToken(raw)).toBeNull();
|
|
});
|
|
|
|
it('TOKEN-012: each list shows only its own kind', async () => {
|
|
const { user } = createUser(testDb);
|
|
await asLegacyResult(svc.createMcpToken(user.id, 'claude'));
|
|
await asLegacyResult(svc.createApiToken(user.id, 'dawarich'));
|
|
|
|
const mcp = (await svc.listMcpTokens(user.id)) as Record<string, unknown>[];
|
|
const api = (await svc.listApiTokens(user.id)) as Record<string, unknown>[];
|
|
expect(mcp.map((t) => t.name)).toEqual(['claude']);
|
|
expect(api.map((t) => t.name)).toEqual(['dawarich']);
|
|
});
|
|
|
|
it('TOKEN-013: deleting across kinds 404s, identically to an unknown id', async () => {
|
|
const { user } = createUser(testDb);
|
|
const mcpId = String((await asLegacyResult(svc.createMcpToken(user.id, 'claude'))).token!.id as number);
|
|
const apiId = String((await asLegacyResult(svc.createApiToken(user.id, 'dawarich'))).token!.id as number);
|
|
|
|
expect(await asLegacyResult(svc.deleteApiToken(user.id, mcpId))).toEqual({ error: 'Token not found', status: 404 });
|
|
expect(await asLegacyResult(svc.deleteMcpToken(user.id, apiId))).toEqual({ error: 'Token not found', status: 404 });
|
|
// Neither row was touched: a wrong-kind delete must not be a way to revoke
|
|
// someone's assistant access from the API-key screen.
|
|
expect(await tokenRow(mcpId)).not.toBeNull();
|
|
expect(await tokenRow(apiId)).not.toBeNull();
|
|
});
|
|
|
|
it('TOKEN-014: the ten-token ceiling counts each kind on its own', async () => {
|
|
const { user } = createUser(testDb);
|
|
for (let i = 0; i < 10; i += 1) await asLegacyResult(svc.createMcpToken(user.id, `mcp-${i}`));
|
|
|
|
expect((await asLegacyResult(svc.createMcpToken(user.id, 'one-too-many'))).status).toBe(400);
|
|
// A full MCP shelf must not lock the user out of minting an API key.
|
|
expect((await asLegacyResult(svc.createApiToken(user.id, 'dawarich'))).status).toBeUndefined();
|
|
});
|
|
|
|
it('TOKEN-015: an API key is stored hashed, with only a prefix in the clear', async () => {
|
|
const { user } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createApiToken(user.id, 'dawarich'));
|
|
const raw = (created.token as { raw_token: string }).raw_token;
|
|
|
|
const row = (await findRow(await sharedTestOrm(testDb), McpTokens, { user: user.id }))!;
|
|
expect(row.kind).toBe('api');
|
|
expect(row.token_hash).not.toBe(raw);
|
|
expect(raw.startsWith(row.token_prefix)).toBe(true);
|
|
});
|
|
|
|
it('TOKEN-016: verifying an API key records last_used_at, so a stale key is visible', async () => {
|
|
const { user } = createUser(testDb);
|
|
const raw = (await asLegacyResult(svc.createApiToken(user.id, 'dawarich'))).token!.raw_token as string;
|
|
|
|
const before = (await svc.listApiTokens(user.id)) as Record<string, unknown>[];
|
|
expect(before[0].last_used_at).toBeNull();
|
|
|
|
await svc.verifyApiToken(raw);
|
|
const after = (await svc.listApiTokens(user.id)) as Record<string, unknown>[];
|
|
expect(after[0].last_used_at).not.toBeNull();
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// MCP tokens — the admin half
|
|
//
|
|
// Same table, no user scope. These came from AdminService, which only owned
|
|
// them because the admin route lived there.
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('MCP token service (admin view)', () => {
|
|
it('ADMIN-SVC-068 — listAllMcpTokens returns empty array initially', async () => {
|
|
const result = (await svc.listAllMcpTokens()) as any[];
|
|
expect(Array.isArray(result)).toBe(true);
|
|
expect(result).toHaveLength(0);
|
|
});
|
|
|
|
it('ADMIN-SVC-069 — adminDeleteMcpToken returns 404 for non-existent token', async () => {
|
|
const result = (await asLegacyResult(svc.adminDeleteMcpToken('99999'))) as any;
|
|
expect(result.status).toBe(404);
|
|
expect(result.error).toBeDefined();
|
|
});
|
|
|
|
it('TOKEN-003: listAllMcpTokens spans users and carries the owner username', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
await asLegacyResult(svc.createMcpToken(user.id, 'a'));
|
|
await asLegacyResult(svc.createMcpToken(other.id, 'b'));
|
|
|
|
// `listAllMcpTokens` returns the repository's own typed
|
|
// `McpTokenWithUsernameRow[]` now (Plan 3b Task 2) — no cast needed
|
|
// (Task 2 review, F7: the earlier `as unknown as Record<string,
|
|
// unknown>[]` was a double cast kept only to compile against the old
|
|
// `unknown` return type).
|
|
const all = await svc.listAllMcpTokens();
|
|
expect(all).toHaveLength(2);
|
|
expect(all.every((t) => typeof t.username === 'string')).toBe(true);
|
|
expect(all.every((t) => !('token_hash' in t))).toBe(true);
|
|
});
|
|
|
|
it('TOKEN-004: adminDeleteMcpToken removes any user token and revokes that user', async () => {
|
|
const { user } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createMcpToken(user.id, 'admin-killed'));
|
|
const tokenId = String((created.token as { id: number }).id);
|
|
|
|
expect(await asLegacyResult(svc.adminDeleteMcpToken(tokenId))).toEqual({});
|
|
expect(await tokenRow(tokenId)).toBeNull();
|
|
expect(revokeUserSessions).toHaveBeenCalledWith(user.id);
|
|
});
|
|
|
|
it('TOKEN-005: adminDeleteMcpToken 404s on an unknown id without revoking anyone', async () => {
|
|
expect(await asLegacyResult(svc.adminDeleteMcpToken('99999'))).toEqual({ error: 'Token not found', status: 404 });
|
|
expect(revokeUserSessions).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('TOKEN-019: adminDeleteMcpToken 404s (not 500) on a non-numeric id, without revoking anyone — Plan 3b Task 2 review, F1', async () => {
|
|
expect(await asLegacyResult(svc.adminDeleteMcpToken('abc'))).toEqual({ error: 'Token not found', status: 404 });
|
|
expect(revokeUserSessions).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('TOKEN-020: adminDeleteMcpToken 404s on a hex-shaped id (Plan 3b Task 2 review, F1)', async () => {
|
|
expect(await asLegacyResult(svc.adminDeleteMcpToken('0x10'))).toEqual({ error: 'Token not found', status: 404 });
|
|
expect(revokeUserSessions).not.toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Ephemeral tokens
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('ephemeral tokens', () => {
|
|
it('AUTH-DB-086: createResourceToken rejects a non-download purpose and 503s when the store is down', () => {
|
|
const { user } = createUser(testDb);
|
|
expect(svc.createResourceToken(user.id, 'exfiltrate')).toEqual({ error: 'Invalid purpose', status: 400 });
|
|
expect(svc.createResourceToken(user.id, 'download')).toEqual({ error: 'Service unavailable', status: 503 });
|
|
vi.mocked(createEphemeralToken).mockReturnValueOnce('tok-1');
|
|
expect(svc.createResourceToken(user.id, 'download')).toEqual({ token: 'tok-1' });
|
|
});
|
|
|
|
it('AUTH-DB-087: createWsToken returns the ephemeral token when the store answers', async () => {
|
|
const { user } = createUser(testDb);
|
|
vi.mocked(createEphemeralToken).mockReturnValueOnce('ws-tok');
|
|
expect(await asLegacyResult(svc.createWsToken(user.id))).toEqual({ token: 'ws-tok' });
|
|
});
|
|
|
|
it('TOKEN-006: createWsToken binds the caller password_version, so a pre-reset token is rejected on connect', async () => {
|
|
const { user } = createUser(testDb);
|
|
await updateRows(await sharedTestOrm(testDb), Users, { id: user.id }, { password_version: 7 });
|
|
vi.mocked(createEphemeralToken).mockReturnValueOnce('ws-tok');
|
|
|
|
await asLegacyResult(svc.createWsToken(user.id));
|
|
expect(createEphemeralToken).toHaveBeenCalledWith(user.id, 'ws', { pv: 7 });
|
|
});
|
|
|
|
it('TOKEN-007: createWsToken falls back to pv 0 for a user row without one', async () => {
|
|
vi.mocked(createEphemeralToken).mockReturnValueOnce('ws-tok');
|
|
await asLegacyResult(svc.createWsToken(99999));
|
|
expect(createEphemeralToken).toHaveBeenCalledWith(99999, 'ws', { pv: 0 });
|
|
});
|
|
|
|
it('TOKEN-008: createWsToken reports 503 when the store refuses', async () => {
|
|
const { user } = createUser(testDb);
|
|
vi.mocked(createEphemeralToken).mockReturnValueOnce(null as unknown as string);
|
|
expect(await asLegacyResult(svc.createWsToken(user.id))).toEqual({ error: 'Service unavailable', status: 503 });
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Verification
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('verifyMcpToken', () => {
|
|
it('AUTH-BR-002: verifyMcpToken resolves a freshly created token to its user', async () => {
|
|
const { user } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createMcpToken(user.id, 'bridge-case'));
|
|
const raw = (created.token as { raw_token: string }).raw_token;
|
|
|
|
const resolved = await svc.verifyMcpToken(raw);
|
|
expect(resolved?.id).toBe(user.id);
|
|
expect(await svc.verifyMcpToken('trek_no_such_token')).toBeNull();
|
|
});
|
|
|
|
it('TOKEN-009: a successful verify stamps last_used_at, a failed one changes nothing', async () => {
|
|
const { user } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createMcpToken(user.id, 'stamped'));
|
|
const raw = (created.token as { raw_token: string }).raw_token;
|
|
const id = (created.token as { id: number }).id;
|
|
expect((await tokenRow(id))!.last_used_at).toBeNull();
|
|
|
|
await svc.verifyMcpToken(raw);
|
|
expect((await tokenRow(id))!.last_used_at).not.toBeNull();
|
|
|
|
await svc.verifyMcpToken('trek_wrong');
|
|
expect(await countRows(await sharedTestOrm(testDb), McpTokens)).toBe(1);
|
|
});
|
|
|
|
it('TOKEN-010: verifyMcpToken returns identity columns only, never the password hash', async () => {
|
|
const { user } = createUser(testDb);
|
|
const created = await asLegacyResult(svc.createMcpToken(user.id, 'lean'));
|
|
const raw = (created.token as { raw_token: string }).raw_token;
|
|
|
|
const resolved = (await svc.verifyMcpToken(raw)) as unknown as Record<string, unknown>;
|
|
expect(Object.keys(resolved).sort()).toEqual(['email', 'id', 'role', 'username']);
|
|
});
|
|
});
|
|
|
|
describe('TokensModule', () => {
|
|
it('TOKEN-011: registers TokenService, without which every consumer fails to resolve', () => {
|
|
expectRegisteredProvider(TokensModule, TokenService);
|
|
});
|
|
});
|