105 lines
3.7 KiB
TypeScript
105 lines
3.7 KiB
TypeScript
import { describe, expect, test } from "bun:test";
|
|
import worker from "../apps/api/src/index";
|
|
|
|
const executionContext = {
|
|
passThroughOnException() {},
|
|
waitUntil() {},
|
|
props: {},
|
|
} as unknown as ExecutionContext;
|
|
|
|
const createDatabase = (
|
|
statements: string[],
|
|
{ lastSeenAt = new Date().toISOString() }: { lastSeenAt?: string } = {},
|
|
) => ({
|
|
prepare(sql: string) {
|
|
statements.push(sql);
|
|
return {
|
|
bind() {
|
|
return this;
|
|
},
|
|
async first() {
|
|
if (sql.includes("SELECT id FROM users")) return { id: "usr_owner" };
|
|
if (sql.includes("FROM sessions s")) {
|
|
return {
|
|
id: "sess_owner",
|
|
user_id: "usr_owner",
|
|
username: "owner",
|
|
display_name: "Owner",
|
|
expires_at: "2027-08-14T00:00:00.000Z",
|
|
last_seen_at: lastSeenAt,
|
|
workspace_id: "ws_default",
|
|
role: "owner",
|
|
};
|
|
}
|
|
if (sql.includes("FROM memo_shares")) return null;
|
|
return null;
|
|
},
|
|
async all() {
|
|
return { results: [] };
|
|
},
|
|
async run() {
|
|
return { success: true };
|
|
},
|
|
};
|
|
},
|
|
}) as unknown as D1Database;
|
|
|
|
describe("authentication hot path", () => {
|
|
test("reads an authenticated session without provisioning or seeding its workspace", async () => {
|
|
const statements: string[] = [];
|
|
const response = await worker.fetch(
|
|
new Request("https://edgeever.test/api/v1/auth/session", {
|
|
headers: { Authorization: "Bearer desktop-session-token" },
|
|
}),
|
|
{ DB: createDatabase(statements), EDGE_EVER_AUTH_PASSWORD: "configured-secret" } as never,
|
|
executionContext,
|
|
);
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(await response.json()).toMatchObject({
|
|
authenticated: true,
|
|
user: { id: "usr_owner", role: "owner" },
|
|
});
|
|
const sessionQueries = statements.filter((sql) => sql.includes("FROM sessions s"));
|
|
expect(sessionQueries).toHaveLength(1);
|
|
expect(sessionQueries[0]).toContain("LEFT JOIN workspace_members");
|
|
expect(statements.some((sql) => sql.includes("SELECT id FROM users"))).toBe(false);
|
|
expect(statements.some((sql) => sql.includes("memo_templates"))).toBe(false);
|
|
expect(statements.some((sql) => sql.includes("ai_prompt_templates"))).toBe(false);
|
|
});
|
|
|
|
test("does not rewrite a recently touched session on a protected request", async () => {
|
|
const statements: string[] = [];
|
|
const response = await worker.fetch(
|
|
new Request("https://edgeever.test/api/v1/memos/memo_1/share", {
|
|
headers: { Authorization: "Bearer desktop-session-token" },
|
|
}),
|
|
{ DB: createDatabase(statements), EDGE_EVER_AUTH_PASSWORD: "configured-secret" } as never,
|
|
executionContext,
|
|
);
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(statements.some((sql) => /UPDATE sessions\s+SET last_seen_at/.test(sql))).toBe(false);
|
|
expect(statements.some((sql) => sql.includes("SELECT id FROM users"))).toBe(false);
|
|
expect(statements.some((sql) => sql.includes("memo_templates"))).toBe(false);
|
|
expect(statements.some((sql) => sql.includes("ai_prompt_templates"))).toBe(false);
|
|
});
|
|
|
|
test("touches a stale session once on a protected request", async () => {
|
|
const statements: string[] = [];
|
|
const response = await worker.fetch(
|
|
new Request("https://edgeever.test/api/v1/memos/memo_1/share", {
|
|
headers: { Authorization: "Bearer desktop-session-token" },
|
|
}),
|
|
{
|
|
DB: createDatabase(statements, { lastSeenAt: "2026-08-14T00:00:00.000Z" }),
|
|
EDGE_EVER_AUTH_PASSWORD: "configured-secret",
|
|
} as never,
|
|
executionContext,
|
|
);
|
|
|
|
expect(response.status).toBe(200);
|
|
expect(statements.filter((sql) => /UPDATE sessions\s+SET last_seen_at/.test(sql))).toHaveLength(1);
|
|
});
|
|
});
|