Claude
a8c9539ad9
- RequestAuth: clients sign `${timestamp}:${path}:${body}` (as in
sync-server-example); headers carry public key, timestamp, signature and
algorithm. Pluggable signers/verifiers; Ed25519 via WebCrypto built in.
Timestamp window and replay protection.
- KVStorageHttpServer requires auth ('none' must be explicit). With auth, every
key, scan range and subscription path must be under the caller's public key.
- POST /events with { paths }: subscribers only receive (and on resume only
replay) changes under their authorized paths.
- KVStorageHttp: signer option; subscribe(path)/unsubscribe(path)/close()
replace watch(); 401/403 reject instead of retrying.
- KVStorageComposite: prefix option scopes sync, cache and subscription.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Qxbkp4tA7G5SCWjzWuxmE
96 lines
4.9 KiB
TypeScript
96 lines
4.9 KiB
TypeScript
import { afterEach, beforeEach, describe, expect, it } from 'vitest'
|
|
import type { KVChangeEvent } from '../../src/kv-storage/base-kv-storage.js'
|
|
import { KVStorageComposite } from '../../src/kv-storage/kv-storage-composite.js'
|
|
import { KVStorageInMemory } from '../../src/kv-storage/kv-storage-in-memory.js'
|
|
import { AuthError } from '../../src/utils/errors.js'
|
|
import { Ed25519Signer, Ed25519Verifier } from '../../src/utils/request-auth.js'
|
|
import { collect } from '../helpers.js'
|
|
import { TestNetwork } from './sync-helpers.js'
|
|
|
|
let network: TestNetwork
|
|
let alice: Ed25519Signer
|
|
let bob: Ed25519Signer
|
|
|
|
beforeEach(async () => {
|
|
network = new TestNetwork({ auth: { verifiers: [new Ed25519Verifier()] } })
|
|
alice = await Ed25519Signer.generate()
|
|
bob = await Ed25519Signer.generate()
|
|
await network.store.writeMany([
|
|
[`${alice.publicKey}/profile`, { name: 'Alice' }],
|
|
[`${bob.publicKey}/profile`, { name: 'Bob' }],
|
|
[`${bob.publicKey}/posts/1`, { title: 'secret' }],
|
|
])
|
|
})
|
|
afterEach(() => network.close())
|
|
|
|
describe('authenticated KVStorageHttpServer', () => {
|
|
it('lets a user read, write and list their own keys', async () => {
|
|
const mine = network.client(alice).child(alice.publicKey)
|
|
expect(await mine.get('profile')).toEqual({ name: 'Alice' })
|
|
await mine.child('posts').set('1', { title: 'hello' })
|
|
expect(await collect(mine.keys())).toEqual(['posts', 'profile'])
|
|
expect(await collect(mine.child('posts').entries())).toEqual([['1', { title: 'hello' }]])
|
|
})
|
|
|
|
it("forbids reading, writing or scanning another user's keys", async () => {
|
|
const client = network.client(alice)
|
|
const theirs = client.child(bob.publicKey)
|
|
await expect(theirs.get('profile')).rejects.toMatchObject({ status: 403 })
|
|
await expect(theirs.set('profile', { name: 'hacked' })).rejects.toBeInstanceOf(AuthError)
|
|
await expect(theirs.delete('profile')).rejects.toMatchObject({ status: 403 })
|
|
await expect(collect(theirs.keys())).rejects.toMatchObject({ status: 403 })
|
|
await expect(collect(client.keys())).rejects.toMatchObject({ status: 403 }) // root listing
|
|
await expect(client.readMany([alice.publicKey + 'x/a'])).rejects.toMatchObject({ status: 403 }) // lookalike prefix
|
|
expect(await network.store.readMany([`${bob.publicKey}/profile`])).toEqual([{ name: 'Bob' }])
|
|
})
|
|
|
|
it('rejects unsigned requests', async () => {
|
|
await expect(network.client().child(alice.publicKey).get('profile')).rejects.toMatchObject({ status: 401 })
|
|
})
|
|
|
|
it('delivers only subscribed, authorized changes', async () => {
|
|
const watcher = network.client(alice)
|
|
const received: KVChangeEvent[] = []
|
|
watcher.on('change', (e) => e.origin === 'remote' && received.push(e))
|
|
await watcher.child(alice.publicKey).child('posts').subscribe()
|
|
const writer = network.client(alice).child(alice.publicKey)
|
|
await network.client(bob).child(bob.publicKey).child('posts').set('2', { title: 'bob only' })
|
|
await writer.set('profile', { name: 'Alice 2' }) // not subscribed
|
|
const arrived = watcher.waitFor('change', () => true)
|
|
await writer.child('posts').set('1', { title: 'mine' })
|
|
await arrived
|
|
expect(received.flatMap((e) => e.changes)).toEqual([{ key: `${alice.publicKey}/posts/1`, value: { title: 'mine' } }])
|
|
})
|
|
|
|
it("refuses subscriptions to another user's keys without retrying forever", async () => {
|
|
await expect(network.client(alice).child(bob.publicKey).subscribe()).rejects.toMatchObject({ status: 403 })
|
|
await expect(network.client(alice).subscribe('')).rejects.toMatchObject({ status: 403 })
|
|
})
|
|
|
|
it('replays only matching changes when resuming', async () => {
|
|
const watcher = network.client(alice)
|
|
const mine = watcher.child(alice.publicKey)
|
|
await mine.subscribe()
|
|
await mine.unsubscribe()
|
|
await network.client(bob).child(bob.publicKey).set('x', 1)
|
|
await network.client(alice).child(alice.publicKey).set('y', 2)
|
|
const replayed: KVChangeEvent[] = []
|
|
watcher.on('change', (e) => replayed.push(e))
|
|
await mine.subscribe()
|
|
expect(replayed.flatMap((e) => e.changes)).toEqual([{ key: `${alice.publicKey}/y`, value: 2 }])
|
|
})
|
|
|
|
it('a composite scoped to the user syncs only their data', async () => {
|
|
const db = new KVStorageComposite({ source: network.client(alice), prefix: alice.publicKey, replicas: [new KVStorageInMemory()] })
|
|
await db.synced()
|
|
expect(await collect(db.scan({ values: true }))).toEqual([[`${alice.publicKey}/profile`, { name: 'Alice' }]])
|
|
expect(await collect(db.keys())).toEqual([alice.publicKey])
|
|
await expect(db.child(bob.publicKey).get('profile')).rejects.toBeInstanceOf(RangeError)
|
|
const pushed = db.waitFor('change', (e) => e.origin === 'remote')
|
|
await network.client(bob).child(bob.publicKey).set('ignored', 1)
|
|
await network.client(alice).child(alice.publicKey).set('fromElsewhere', 1)
|
|
expect((await pushed).changes).toEqual([{ key: `${alice.publicKey}/fromElsewhere`, value: 1 }])
|
|
await db.close()
|
|
})
|
|
})
|