Many fixes

test/helpers/controlled-request.ts

@@ -0,0 +1,68 @@
+import { ApplicationRouter } from "../../source/services/router";
+import { BaseStream } from "../../source/services/stream/base-stream";
+
+export type ControlledRequestDeps = {
+  router: ApplicationRouter;
+  connection: BaseStream;
+}
+
+export type ControlledRequestOptions = {
+  path: string;
+  requestId: string;
+  body?: unknown;
+  headers?: Record<string, string>;
+  includeAuthHeaders?: boolean;
+  timeout?: number;
+}
+
+export type ControlledRequestParams = ControlledRequestOptions & ControlledRequestDeps;
+
+export type ControlledRequest = {
+  request: Promise<void>;
+  started: Promise<void>;
+  release: () => void;
+}
+
+export const createControlledRequest = ({ router, connection, ...requestOptions }: ControlledRequestParams): ControlledRequest => {
+  // Create promises with resolvers to signal the request has started and released
+  const { promise: started, resolve: signalStarted } = Promise.withResolvers<void>();
+  const { promise: released, resolve: release } = Promise.withResolvers<void>();
+
+  // The request options (sets the includeAuthHeaders to true by default)
+  const options = {
+    includeAuthHeaders: true,
+    ...requestOptions
+  }
+
+  // The test auth headers
+  const authHeaders = {
+    'x-public-key':  'public-key',
+    'x-signature': 'signature',
+    'x-timestamp': '1000',
+  }
+
+  // If the request should include the test auth headers (default is true)
+  if (options.includeAuthHeaders) {
+    options.headers = {
+      ...options.headers,
+      ...authHeaders,
+    };
+  }
+
+  // Add the signalStarted and released promises to the request body
+  options.body = {
+    ...(options.body ?? {}),
+    signalStarted,
+    released,
+  }
+
+  // Dispatch the request
+  const request = router.dispatch(options, connection);
+  
+  // Return the request, started, and release promises
+  return {
+    request,
+    started,
+    release,
+  };
+};

test/helpers/misc.ts

@@ -0,0 +1,29 @@
+import { vi } from "vitest";
+import type { AuthSecp256k1 } from "../../source/auth/auth";
+import type { RouteDefinition, RouteModule } from "../../source/routes/types";
+
+/**
+ * Convert an array of route definitions to a route module by returning an object with a getRoutes method that returns the routes.
+ * @param routes - The route definitions to convert.
+ * @returns A route module.
+ */
+export const toRoutes = (routes: RouteDefinition[]): RouteModule => {
+  return {
+    getRoutes: async () => routes,
+  };
+};
+
+
+export const mockAuth = {
+  verifySignature: vi.fn().mockResolvedValue(true),
+  verifyUniqueRequest: vi.fn().mockResolvedValue(true),
+  assertTimestampFreshness: vi.fn().mockResolvedValue(true),
+} as unknown as AuthSecp256k1;
+
+/**
+ * Create a mock of the AuthSecp256k1 service
+ * @returns A mock of the AuthSecp256k1 service
+ */
+export const createMockAuth = (): AuthSecp256k1 => {
+  return mockAuth;
+};

test/routes/resources.test.ts

@@ -7,6 +7,8 @@ import { ApplicationRouteStream } from '../../source/services/route-stream.ts';
 import type { Database } from '../../source/services/storage/database.ts';
 import { TestConnection } from '../helpers/test-connection.ts';
 import { HTTP_STATUS_CODE_NOT_ACCEPTED } from '../../source/constants.ts';
+import { createMockAuth } from '../helpers/misc.ts';
+import { AuthSecp256k1 } from '../../source/auth/auth.ts';
 
 const createBroadcasterStub = (): BaseBroadcaster => {
     return {
@@ -33,8 +35,14 @@ describe('DataRoute subscriptions', (): void => {
         const connection = new TestConnection(true, false);
         const stream = new ApplicationRouteStream(connection, {
             resourceId: [ 'a', 'b' ],
+        }, 'subscribe-1');
+        const route = new DataRoute({
+            auth: await AuthSecp256k1.create({ database: storage }, { timestampWindowMs: 0 }),
+            database: storage,
+            broadcaster: broadcaster,
+        }, {
+            timestampWindowMs: 0,
         });
-        const route = new DataRoute(storage, broadcaster, 0);
 
         const execution = route.subscribeData(stream);
 
@@ -55,8 +63,14 @@ describe('DataRoute subscriptions', (): void => {
         } as unknown as Database;
         const broadcaster = createBroadcasterStub();
         const connection = new TestConnection(true, true);
-        const stream = new ApplicationRouteStream(connection, { resourceId: [ 'a' ] }, 'unsubscribe-1');
-        const route = new DataRoute(storage, broadcaster, 0);
+        const stream = new ApplicationRouteStream(connection, { resourceId: [ 'a' ] }, '/unsubscribe', 'unsubscribe-1');
+        const route = new DataRoute({
+            auth: await AuthSecp256k1.create({ database: storage }, { timestampWindowMs: 0 }),
+            database: storage,
+            broadcaster: broadcaster,
+        }, {
+            timestampWindowMs: 0,
+        });
 
         await route.unsubscribeData(stream);
 
@@ -78,10 +92,17 @@ describe('DataRoute subscriptions', (): void => {
             },
         } as unknown as Database;
         const broadcaster = createBroadcasterStub();
-        const stream = new ApplicationRouteStream(new TestConnection(true, false), {
+        const connection = new TestConnection(true, false);
+        const stream = new ApplicationRouteStream(connection, {
             resourceId: [ 'a' ],
+        }, '/unsubscribe', 'unsubscribe-1');
+        const route = new DataRoute({
+            auth: await AuthSecp256k1.create({ database: storage }, { timestampWindowMs: 0 }),
+            database: storage,
+            broadcaster: broadcaster,
+        }, {
+            timestampWindowMs: 0,
         });
-        const route = new DataRoute(storage, broadcaster, 0);
 
         await expect(route.unsubscribeData(stream)).rejects.toMatchObject({ statusCode: HTTP_STATUS_CODE_NOT_ACCEPTED });
         expect(broadcaster.unsubscribe).not.toHaveBeenCalled();
@@ -97,7 +118,13 @@ describe('DataRoute resource write auth', (): void => {
         } as unknown as Database;
 
         const broadcaster = createBroadcasterStub();
-        const route = new DataRoute(storage, broadcaster, 0);
+        const route = new DataRoute({
+            auth: await AuthSecp256k1.create({ database: storage }, { timestampWindowMs: 0 }),
+            database: storage,
+            broadcaster: broadcaster,
+        }, {
+            timestampWindowMs: 0,
+        });
 
         await expect(route.writeData({
                 connection: new TestConnection(true, true),

test/services/broadcaster.test.ts

@@ -10,7 +10,7 @@ const createBroadcaster = (): Broadcaster => {
 };
 
 const routeStream = (connection: TestConnection): ApplicationRouteStream => {
-    return new ApplicationRouteStream(connection, undefined);
+    return new ApplicationRouteStream(connection, undefined, '/items', 'items-1');
 };
 
 const expectPending = async (promise: Promise<void>): Promise<void> => {

test/services/router.test.ts

@@ -1,52 +1,27 @@
-import { describe, expect, it, vi } from 'vitest';
+import { describe, expect, it } from 'vitest';
 
-import type { RouteDefinition, RouteModule } from '../../source/routes/types.ts';
+// Source
 import { ApplicationRouter } from '../../source/services/router.ts';
+
+// Helpers
+import { createMockAuth, toRoutes } from '../helpers/misc.ts';
 import { TestConnection } from '../helpers/test-connection.ts';
-
-import type { AuthSecp256k1 } from '../../source/auth/auth.ts';
-
-/**
- * A controlled request is a request that is controlled by the test.
- * It is used to control the request flow and ensure that the request is completed in the correct order.
- */
-type ControlledRequest = {
-    request: Promise<void>;
-    started: Promise<void>;
-    release: () => void;
-};
+import { createControlledRequest } from '../helpers/controlled-request.ts';
 
 /**
  * A mock of the AuthSecp256k1 service
  */
-const auth = {
-    verifySignature: vi.fn().mockResolvedValue(true),
-    verifyUniqueRequest: vi.fn().mockResolvedValue(true),
-    assertTimestampFreshness: vi.fn().mockResolvedValue(true),
-} as unknown as AuthSecp256k1;
-
-/**
- * A helper function to create a route module with the given routes
- * @param routes - The routes to create the module with
- * @returns The created route module
- */
-const moduleWith = (routes: RouteDefinition[]): RouteModule => {
-    return {
-        async getRoutes(): Promise<RouteDefinition[]> {
-            return routes;
-        },
-    };
-};
+const auth = createMockAuth();
 
 describe('ApplicationRouter initialization', (): void => {
     it('rejects duplicate exact paths during startup', async (): Promise<void> => {
         const route = { url: '/echo', handler: (): void => undefined };
 
-        await expect(ApplicationRouter.create({ auth }, [ moduleWith([ route ]), moduleWith([ route ]) ])).rejects.toThrow('Duplicate application route: /echo');
+        await expect(ApplicationRouter.create({ auth }, [ toRoutes([ route ]), toRoutes([ route ]) ])).rejects.toThrow('Duplicate application route: /echo');
     });
 
     it.each([ 'echo', '/', '/items/:id', '/items?active=true', '/items#active' ])('rejects the invalid route path %s', async (url): Promise<void> => {
-        await expect(ApplicationRouter.create({ auth }, [ moduleWith([{ url, handler: (): void => undefined }]) ])).rejects.toThrow('Invalid application route');
+        await expect(ApplicationRouter.create({ auth }, [ toRoutes([{ url, handler: (): void => undefined }]) ])).rejects.toThrow('Invalid application route');
     });
 });
 
@@ -54,7 +29,7 @@ describe('ApplicationRouter dispatch', (): void => {
     it('binds the connection, body, and request ID to one route stream', async (): Promise<void> => {
         const connection = new TestConnection(false, false);
         const router = await ApplicationRouter.create({ auth }, [
-            moduleWith([
+            toRoutes([
                 {
                     url: '/echo',
                     handler: async (stream): Promise<void> => {
@@ -94,7 +69,7 @@ describe('ApplicationRouter dispatch', (): void => {
 
     it('preserves correlation when concurrent requests finish out of order', async (): Promise<void> => {
         const router = await ApplicationRouter.create({ auth }, [
-            moduleWith([
+            toRoutes([
                 {
                     url: '/delayed',
                     handler: async (stream): Promise<void> => {
@@ -115,38 +90,8 @@ describe('ApplicationRouter dispatch', (): void => {
 
         const connection = new TestConnection(false, false);
 
-        const createControlledRequest = (key: string): ControlledRequest => {
-            const { promise: started, resolve: signalStarted } = Promise.withResolvers<void>();
-
-            const { promise: released, resolve: release } = Promise.withResolvers<void>();
-
-            const request = router.dispatch(
-                {
-                    path: '/delayed',
-                    body: {
-                        key,
-                        signalStarted,
-                        released,
-                    },
-                    requestId: key,
-                    headers: {
-                        'x-public-key': 'public-key',
-                        'x-signature': 'signature',
-                        'x-timestamp': '1000',
-                    },
-                },
-                connection,
-            );
-
-            return {
-                request,
-                started,
-                release,
-            };
-        };
-
-        const first = createControlledRequest('A');
-        const second = createControlledRequest('B');
+        const first = createControlledRequest({ router, connection, path: '/delayed', requestId: 'A', body: { key: 'A' } });
+        const second = createControlledRequest({ router, connection, path: '/delayed', requestId: 'B', body: { key: 'B' } });
 
         expect(connection.messages).toEqual([]);
 
@@ -181,12 +126,12 @@ describe('ApplicationRouter dispatch', (): void => {
                 body: { key: 'A' },
             },
         ]);
-    });
+    }, 1000);
 
     it('propagates route failures without infrastructure-specific cleanup', async (): Promise<void> => {
         const error = new Error('route failed');
         const router = await ApplicationRouter.create({ auth }, [
-            moduleWith([
+            toRoutes([
                 {
                     url: '/failure',
                     handler: (): void => {

test/services/transports/http-transport.test.ts

@@ -10,6 +10,22 @@ import type { AppEnv } from '../../../source/services/transport/transport-router
 import { fromExtendedJson, toExtendedJson } from '@xo-cash/utils';
 import { Logger } from '../../../source/utils/logger.ts';
 import { ServerHost } from '../../../source/services/server-host.ts';
+import { AuthSecp256k1 } from '../../../source/auth/auth.ts';
+
+/**
+ * A mock of the AuthSecp256k1 service
+ */
+const auth = {
+    verifySignature: vi.fn().mockResolvedValue(true),
+    verifyUniqueRequest: vi.fn().mockResolvedValue(true),
+    assertTimestampFreshness: vi.fn().mockResolvedValue(true),
+} as unknown as AuthSecp256k1;
+
+const mockAuthHeaders = {
+    'x-public-key': 'public-key',
+    'x-signature': 'signature',
+    'x-timestamp': '1000',
+};
 
 const createApp = async (
     routes: RouteDefinition[] | ((broadcaster: Broadcaster) => RouteDefinition[]),
@@ -18,7 +34,9 @@ const createApp = async (
     const debug = new Logger('http-transport-test');
     const broadcaster = new Broadcaster(debug);
     const resolvedRoutes = typeof routes === 'function' ? routes(broadcaster) : routes;
-    const router = await ApplicationRouter.create([
+    const router = await ApplicationRouter.create({
+        auth,
+    }, [
         {
             async getRoutes(): Promise<RouteDefinition[]> {
                 return resolvedRoutes;
@@ -40,18 +58,20 @@ describe('HttpTransportRouter', (): void => {
     it('runs normal HTTP through a non-streaming route stream', async (): Promise<void> => {
         const app = await createApp([
             {
-                url: '/echo',
+                url: '/echowtf',
                 handler: async (stream): Promise<void> => stream.send(stream.body),
             },
         ]);
         const value = new Uint8Array([ 1, 2, 3 ]);
 
-        const response = await app.request('/echo', {
+        const request = new Request('http://localhost/echowtf', {
             method: 'POST',
-            headers: { 'content-type': 'application/json' },
+            headers: { 'content-type': 'application/json', ...mockAuthHeaders },
             body: toExtendedJson({ value }),
         });
 
+        const response = await app.request(request);
+
         expect(response.status).toBe(200);
         expect(fromExtendedJson(await response.text())).toEqual({ value });
     });
@@ -64,7 +84,7 @@ describe('HttpTransportRouter', (): void => {
             },
         ]);
 
-        const response = await app.request('/nothing', { method: 'POST' });
+        const response = await app.request('/nothing', { method: 'POST', headers: { ...mockAuthHeaders } });
 
         expect(response.status).toBe(204);
         expect(await response.text()).toBe('');
@@ -73,7 +93,7 @@ describe('HttpTransportRouter', (): void => {
     it('returns normalized errors for non-streaming requests', async (): Promise<void> => {
         const app = await createApp([]);
 
-        const missing = await app.request('/missing', { method: 'POST' });
+        const missing = await app.request('/missing', { method: 'POST', headers: { ...mockAuthHeaders } });
         expect(missing.status).toBe(404);
         expect(await missing.json()).toEqual({
             statusCode: 404,
@@ -82,7 +102,7 @@ describe('HttpTransportRouter', (): void => {
 
         const invalid = await app.request('/missing', {
             method: 'POST',
-            headers: { 'content-type': 'application/json' },
+            headers: { 'content-type': 'application/json', ...mockAuthHeaders },
             body: '{',
         });
         expect(invalid.status).toBe(400);
@@ -102,7 +122,7 @@ describe('HttpTransportRouter', (): void => {
             },
         ]);
 
-        const response = await app.request('/items/subscribe', { method: 'POST' });
+        const response = await app.request('/items/subscribe', { method: 'POST', headers: { ...mockAuthHeaders } });
 
         expect(response.status).toBe(406);
         expect(await response.json()).toMatchObject({ statusCode: 406 });
@@ -120,7 +140,7 @@ describe('HttpTransportRouter', (): void => {
 
         const response = await app.request('/items/subscribe', {
             method: 'POST',
-            headers: { accept: 'text/event-stream' },
+            headers: { accept: 'text/event-stream', ...mockAuthHeaders },
         });
         const events = await response.text();
 
@@ -140,7 +160,7 @@ describe('HttpTransportRouter', (): void => {
 
         const response = await app.request('/echo', {
             method: 'POST',
-            headers: { accept: 'text/event-stream' },
+            headers: { accept: 'text/event-stream', ...mockAuthHeaders },
         });
         const events = await response.text();
 
@@ -171,7 +191,7 @@ describe('HttpTransportRouter', (): void => {
 
         const response = await app.request('/items/subscribe', {
             method: 'POST',
-            headers: { accept: 'text/event-stream' },
+            headers: { accept: 'text/event-stream', ...mockAuthHeaders },
         });
         const body = response.text();
         const completed = vi.fn();
@@ -203,7 +223,7 @@ describe('HttpTransportRouter', (): void => {
 
         const response = await app.request('/items/unsubscribe', {
             method: 'POST',
-            headers: { accept: 'text/event-stream' },
+            headers: { accept: 'text/event-stream', ...mockAuthHeaders },
         });
         const events = await response.text();
 
@@ -224,7 +244,7 @@ describe('HttpTransportRouter', (): void => {
 
         const response = await app.request('/echo', {
             method: 'POST',
-            headers: { 'content-type': 'application/json' },
+            headers: { 'content-type': 'application/json', ...mockAuthHeaders },
             body: JSON.stringify({ value: 'x'.repeat(64) }),
         });
 

test/services/transports/ws-transport.test.ts

@@ -1,11 +1,21 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import { z } from 'zod';
-import type { WebSocketServer } from 'ws';
 
 import { ApplicationRouter } from '../../../source/services/router.ts';
 import { WsTransportRouter } from '../../../source/services/transport/ws-transport.ts';
 import { Logger } from '../../../source/utils/logger.ts';
 import { toExtendedJson } from '@xo-cash/utils';
+import { AuthSecp256k1 } from '../../../source/auth/auth.ts';
+import { toRoutes } from '../../helpers/misc.ts';
+
+/**
+ * A mock of the AuthSecp256k1 service
+ */
+const auth = {
+    verifySignature: vi.fn().mockResolvedValue(true),
+    verifyUniqueRequest: vi.fn().mockResolvedValue(true),
+    assertTimestampFreshness: vi.fn().mockResolvedValue(true),
+} as unknown as AuthSecp256k1;
 
 describe('WebSocket request decoding', (): void => {
     it('decodes the minimal route-agnostic envelope and Extended JSON body', async (): Promise<void> => {
@@ -38,11 +48,21 @@ describe('WebSocket request decoding', (): void => {
 describe('WsTransportRouter payload limits', (): void => {
     it("configures Hono's ws server with the requested maxPayload", async () => {
         const debug = new Logger('ws-transport-test');
-        const router = await ApplicationRouter.create([]);
+        const router = await ApplicationRouter.create({
+            auth,
+        }, [
+            toRoutes([
+                {
+                    url: '/data/write',
+                    handler: async (stream): Promise<void> => {
+                        await stream.send({});
+                    },
+                },
+            ]),
+        ]);
         const transport = new WsTransportRouter(router, debug, 1024);
-        const wsServer = transport.websocketServer as unknown as WebSocketServer;
 
-        expect(wsServer.options.maxPayload).toBe(1024);
+        expect(transport['wsServer'].options.maxPayload).toBe(1024);
         await transport.stop();
     });
 });

test/subscription-flow.test.ts

@@ -1,35 +1,38 @@
 import { describe, expect, it, vi } from 'vitest';
 
-import type { RouteDefinition, RouteModule } from '../source/routes/types.ts';
 import { ApplicationRouter } from '../source/services/router.ts';
 import { Broadcaster } from '../source/services/broadcaster.ts';
 import { Logger } from '../source/utils/logger.ts';
 import { TestConnection } from './helpers/test-connection.ts';
 
-const moduleWith = (routes: RouteDefinition[]): RouteModule => {
-    return {
-        async getRoutes(): Promise<RouteDefinition[]> {
-            return routes;
-        },
-    };
-};
+import { createControlledRequest } from './helpers/controlled-request.ts';
+import { createMockAuth, toRoutes } from './helpers/misc.ts';
 
-const expectPending = async (promise: Promise<void>): Promise<void> => {
-    const settled = vi.fn();
-    void promise.then(settled);
-    await Promise.resolve();
-    expect(settled).not.toHaveBeenCalled();
-};
+/**
+ * A mock of the AuthSecp256k1 service
+ */
+const auth = createMockAuth();
 
 describe('long-lived subscription dispatch', (): void => {
     it('allows duplicate subscribe and unsubscribe requests while the original request waits', async (): Promise<void> => {
         const broadcaster = new Broadcaster(new Logger('subscription-flow-test'));
-        const router = await ApplicationRouter.create([
-            moduleWith([
+        const router = await ApplicationRouter.create({
+                auth,
+            },
+            [
+            toRoutes([
                 {
                     url: '/items/subscribe',
                     handler: async (stream): Promise<void> => {
+                        const { signalStarted, released } = stream.body as {
+                            signalStarted: () => void;
+                            released: Promise<void>;
+                        };
+                        
+                        signalStarted();
+                        
                         await broadcaster.subscribe(stream, [ 'items' ]);
+                        await released;
                     },
                 },
                 {
@@ -43,17 +46,24 @@ describe('long-lived subscription dispatch', (): void => {
         ]);
         const connection = new TestConnection(true, true);
 
-        const original = router.dispatch({ path: '/items/subscribe', requestId: 'subscribe-1' }, connection);
+        const original = createControlledRequest({ router, connection, path: '/items/subscribe', requestId: 'subscribe-1' });
         await vi.waitFor(() => expect(connection.closeCallbacks).toHaveLength(1));
-        await expectPending(original);
+        await original.started;
 
         // This request uses a different ApplicationRouteStream over the same
         // connection. Since the topic already exists, its dispatch completes.
-        await router.dispatch({ path: '/items/subscribe', requestId: 'subscribe-2' }, connection);
-        await expectPending(original);
+        const second = createControlledRequest({ router, connection, path: '/items/subscribe', requestId: 'subscribe-2' });
+        second.release();
+        await second.request;
 
-        await router.dispatch({ path: '/items/unsubscribe', requestId: 'unsubscribe-1' }, connection);
-        await original;
+        // Unsubscribe the original request stream
+        const third = createControlledRequest({ router, connection, path: '/items/unsubscribe', requestId: 'unsubscribe-1' });
+        third.release();
+        await third.request;
+
+        // Release the original request stream
+        original.release();
+        await original.request;
 
         expect(connection.messages).toEqual([
             {