PotentialStorage/test/kv-storage/kv-storage-http-auth.test.ts

import { afterEach, beforeEach, describe, expect, it } from 'vitest'
import type { KVChangeEvent } from '../../src/kv-storage/base-kv-storage.js'
import { KVStorageComposite } from '../../src/kv-storage/kv-storage-composite.js'
import { KVStorageHttpServer } from '../../src/kv-storage/kv-storage-http-server.js'
import { KVStorageInMemory } from '../../src/kv-storage/kv-storage-in-memory.js'
import { AuthError } from '../../src/utils/errors.js'
import { Ed25519Signer, Ed25519Verifier } from '../../src/utils/request-auth.js'
import { collect, KVStorageCounting } from '../helpers.js'
import { TestNetwork } from './sync-helpers.js'

let network: TestNetwork
let alice: Ed25519Signer
let bob: Ed25519Signer

beforeEach(async () => {
  network = new TestNetwork({ auth: { verifiers: [new Ed25519Verifier()] } })
  alice = await Ed25519Signer.generate()
  bob = await Ed25519Signer.generate()
  await network.store.writeMany([
    { key: `${alice.publicKey}/profile`, value: { name: 'Alice' } },
    { key: `${bob.publicKey}/profile`, value: { name: 'Bob' } },
    { key: `${bob.publicKey}/posts/1`, value: { title: 'secret' } },
  ])
})
afterEach(() => network.close())

/** Swaps in a server that rejects every signature (as if the user's access was revoked). */
function refuseEverySignature() {
  network.server = new KVStorageHttpServer(network.store, { auth: { verifiers: [{ algorithm: 'ed25519', verify: async () => false }] } })
}

describe('authenticated KVStorageHttpServer', () => {
  it('lets a user read, write and list their own keys', async () => {
    const mine = network.client(alice).child(alice.publicKey)
    expect(await mine.get('profile')).toEqual({ name: 'Alice' })
    await mine.child('posts').set('1', { title: 'hello' })
    expect(await collect(mine.keys())).toEqual(['posts', 'profile'])
    expect(await collect(mine.child('posts').entries())).toEqual([['1', { title: 'hello' }]])
  })

  it("forbids reading, writing or scanning another user's keys", async () => {
    const client = network.client(alice)
    const theirs = client.child(bob.publicKey)
    await expect(theirs.get('profile')).rejects.toMatchObject({ status: 403 })
    await expect(theirs.set('profile', { name: 'hacked' })).rejects.toBeInstanceOf(AuthError)
    await expect(theirs.delete('profile')).rejects.toMatchObject({ status: 403 })
    await expect(collect(theirs.keys())).rejects.toMatchObject({ status: 403 })
    await expect(collect(client.keys())).rejects.toMatchObject({ status: 403 }) // root listing
    await expect(client.readMany([alice.publicKey + 'x/a'])).rejects.toMatchObject({ status: 403 }) // lookalike prefix
    expect(await network.store.readMany([`${bob.publicKey}/profile`])).toEqual([{ name: 'Bob' }])
  })

  it('rejects unsigned requests', async () => {
    await expect(network.client().child(alice.publicKey).get('profile')).rejects.toMatchObject({ status: 401 })
  })

  it('delivers only subscribed, authorized changes', async () => {
    const watcher = network.client(alice)
    const received: KVChangeEvent[] = []
    watcher.on('change', (e) => e.origin === 'remote' && received.push(e))
    await watcher.child(alice.publicKey).child('posts').subscribe()
    const writer = network.client(alice).child(alice.publicKey)
    await network.client(bob).child(bob.publicKey).child('posts').set('2', { title: 'bob only' })
    await writer.set('profile', { name: 'Alice 2' }) // not subscribed
    const arrived = watcher.waitFor('change', () => true)
    await writer.child('posts').set('1', { title: 'mine' })
    await arrived
    expect(received.flatMap((e) => e.changes)).toEqual([{ key: `${alice.publicKey}/posts/1`, value: { title: 'mine' } }])
  })

  it("refuses subscriptions to another user's keys without retrying forever", async () => {
    await expect(network.client(alice).child(bob.publicKey).subscribe()).rejects.toMatchObject({ status: 403 })
    await expect(network.client(alice).subscribe('')).rejects.toMatchObject({ status: 403 })
  })

  it('a composite scoped to the user syncs only their data', async () => {
    const db = new KVStorageComposite({ source: network.client(alice), prefix: alice.publicKey, replicas: [new KVStorageInMemory()] })
    await db.sync()
    expect(await collect(db.scan({ values: true }))).toEqual([[`${alice.publicKey}/profile`, { name: 'Alice' }]])
    expect(await collect(db.keys())).toEqual([alice.publicKey])
    await expect(db.child(bob.publicKey).get('profile')).rejects.toBeInstanceOf(RangeError)
    const pushed = db.waitFor('change', (e) => e.origin === 'remote')
    await network.client(bob).child(bob.publicKey).set('ignored', 1)
    await network.client(alice).child(alice.publicKey).set('fromElsewhere', 1)
    expect((await pushed).changes).toEqual([{ key: `${alice.publicKey}/fromElsewhere`, value: 1 }])
    await db.close()
  })

  it('a composite undoes a local write the server refuses', async () => {
    // A source without subscriptions, so no follow-up sync is running when the write is made.
    const db = new KVStorageComposite({ source: new KVStorageCounting(network.client(alice)), prefix: alice.publicKey, replicas: [new KVStorageInMemory()] })
    await db.child(alice.publicKey).set('x', 'before')
    await db.sync()
    refuseEverySignature()
    await expect(db.child(alice.publicKey).set('x', 'after')).rejects.toMatchObject({ status: 401 })
    expect(await db.child(alice.publicKey).get('x')).toBe('before')
    await db.close()
  })

  it('a composite drops a queued write the server refuses, restores the server value, and reports it', async () => {
    const errors: Error[] = []
    const db = new KVStorageComposite({
      source: network.client(alice),
      prefix: alice.publicKey,
      replicas: [new KVStorageInMemory()],
      onError: (e) => errors.push(e),
    })
    const mine = db.child(alice.publicKey)
    await mine.set('x', 'before')
    await db.sync()
    network.online = false
    await mine.set('x', 'queued')
    await mine.set('y', 'queued after')
    expect(db.queued).toBe(2)
    const server = network.server
    refuseEverySignature()
    network.online = true
    await db.sync()
    network.server = server
    expect(db.queued).toBe(0) // dropped, not retried forever
    expect(errors.filter((e) => e.message === 'A queued write was refused by the source and dropped')).toHaveLength(2) // the sync's own scan is reported too
    await db.sync()
    expect(await mine.getMany(['x', 'y'])).toEqual(['before', undefined])
    await db.close()
  })
})