makiolaj/GearBox
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases 10 Wiki Activity

Merge branch 'worktree-agent-ad8081f0' into Develop

Browse Source 
# Conflicts:
#	.planning/REQUIREMENTS.md
#	.planning/STATE.md
#	tests/mcp/tools.test.ts
#	tests/routes/auth.test.ts
#	tests/routes/categories.test.ts
#	tests/routes/items.test.ts
#	tests/routes/oauth.test.ts
#	tests/routes/params.test.ts
#	tests/routes/setups.test.ts
#	tests/routes/threads.test.ts
This commit is contained in:
Jean-Luc Makiola
2026-04-05 11:33:13 +02:00
parent fc74bbceba f3ac9d1327
commit 98aed09d11
12 changed files with 473 additions and 294 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
.planning/REQUIREMENTS.md
View File

@@ -25,12 +25,12 @@ Requirements for this milestone. Each maps to roadmap phases.
### Multi-User Data Model ### Multi-User Data Model
- [x] **MULTI-01**: Every item, category, thread, and setup is owned by a specific user - [ ] **MULTI-01**: Every item, category, thread, and setup is owned by a specific user
- [x] **MULTI-02**: User can only see and modify their own data (cross-user isolation) - [x] **MULTI-02**: User can only see and modify their own data (cross-user isolation)
- [x] **MULTI-03**: Categories use composite unique constraint (userId + name) - [ ] **MULTI-03**: Categories use composite unique constraint (userId + name)
- [x] **MULTI-04**: Existing data is assigned to the original user during migration - [x] **MULTI-04**: Existing data is assigned to the original user during migration
- [x] **MULTI-05**: MCP tools operate within the authenticated user's scope - [x] **MULTI-05**: MCP tools operate within the authenticated user's scope
- [x] **MULTI-06**: Settings are per-user rather than global - [ ] **MULTI-06**: Settings are per-user rather than global
### Image Storage ### Image Storage
@@ -126,12 +126,12 @@ Which phases cover which requirements. Updated during roadmap creation.
| AUTH-03 | Phase 15 | Pending | | AUTH-03 | Phase 15 | Pending |
| AUTH-04 | Phase 15 | Pending | | AUTH-04 | Phase 15 | Pending |
| AUTH-05 | Phase 15 | Pending | | AUTH-05 | Phase 15 | Pending |
| MULTI-01 | Phase 16 | Complete | | MULTI-01 | Phase 16 | Pending |
| MULTI-02 | Phase 16 | Complete | | MULTI-02 | Phase 16 | Complete |
| MULTI-03 | Phase 16 | Complete | | MULTI-03 | Phase 16 | Pending |
| MULTI-04 | Phase 16 | Complete | | MULTI-04 | Phase 16 | Complete |
| MULTI-05 | Phase 16 | Complete | | MULTI-05 | Phase 16 | Complete |
| MULTI-06 | Phase 16 | Complete | | MULTI-06 | Phase 16 | Pending |
| IMG-01 | Phase 17 | Pending | | IMG-01 | Phase 17 | Pending |
| IMG-02 | Phase 17 | Pending | | IMG-02 | Phase 17 | Pending |
| IMG-03 | Phase 17 | Pending | | IMG-03 | Phase 17 | Pending |

52
.planning/STATE.md
View File

@@ -2,16 +2,16 @@
gsd_state_version: 1.0 gsd_state_version: 1.0
milestone: v1.3 milestone: v1.3
milestone_name: Research & Decision Tools milestone_name: Research & Decision Tools
status: executing status: planning
stopped_at: Completed 16-02-PLAN.md stopped_at: Completed 16-04-PLAN.md
last_updated: "2026-04-05T08:45:22.411Z" last_updated: "2026-04-05T09:32:35.219Z"
last_activity: 2026-04-05 last_activity: 2026-04-03 — v2.0 roadmap created (Phases 14-18)
progress: progress:
total_phases: 10 total_phases: 8
completed_phases: 8 completed_phases: 6
total_plans: 25 total_plans: 12
completed_plans: 21 completed_plans: 11
percent: 5 percent: 0
--- ---
# Project State # Project State
@@ -21,24 +21,24 @@ progress:
See: .planning/PROJECT.md (updated 2026-04-03) See: .planning/PROJECT.md (updated 2026-04-03)
**Core value:** Help people make better gear decisions — discover what others use, compare real-world data, and see how a potential buy affects your setup before committing. **Core value:** Help people make better gear decisions — discover what others use, compare real-world data, and see how a potential buy affects your setup before committing.
**Current focus:** v2.0 Platform Foundation — Phase 16 (Multi-User Data Model) **Current focus:** v2.0 Platform Foundation — Phase 14 (PostgreSQL Migration)
## Current Position ## Current Position
Phase: 16 of 18 (Multi-User Data Model) Phase: 14 of 18 (PostgreSQL Migration)
Plan: 3 of 4 in current phase Plan: 0 of ? in current phase
Status: Ready to execute Status: Ready to plan
Last activity: 2026-04-05 Last activity: 2026-04-03 — v2.0 roadmap created (Phases 14-18)
Progress: [#---------] 5% (v2.0 milestone) Progress: [----------] 0% (v2.0 milestone)
## Performance Metrics ## Performance Metrics
**Velocity:** **Velocity:**
- Total plans completed: 2 (v2.0 milestone) - Total plans completed: 0 (v2.0 milestone)
- Average duration: 7min - Average duration: --
- Total execution time: 14min - Total execution time: --
*Updated after each plan completion* *Updated after each plan completion*
@@ -46,7 +46,7 @@ Progress: [#---------] 5% (v2.0 milestone)
### Decisions ### Decisions
Key decisions made during v2.0 execution: Key decisions made during v2.0 planning:
- Platform pivot: single-user to multi-user with discovery-first approach - Platform pivot: single-user to multi-user with discovery-first approach
- External auth provider (self-hosted, open-source) — Logto vs Authentik OPEN decision - External auth provider (self-hosted, open-source) — Logto vs Authentik OPEN decision
@@ -54,15 +54,7 @@ Key decisions made during v2.0 execution:
- Structured UGC only — ratings and predefined fields, no freeform text until moderation - Structured UGC only — ratings and predefined fields, no freeform text until moderation
- Separate globalItems table — not a flag on user items table - Separate globalItems table — not a flag on user items table
- Single-user SQLite mode diverges at v2.0 boundary - Single-user SQLite mode diverges at v2.0 boundary
- All API routes require auth (no GET bypass) for per-user data scoping (16-01) - [Phase 16]: Cross-user isolation tests placed in MCP suite for direct tool validation without HTTP layer
- OAuth service converted from sync to async for pg compatibility (16-01)
- getOrCreateUncategorized placed in category.service.ts (16-01)
- [Phase 16]: Category deletion uses dynamic getOrCreateUncategorized per user instead of hardcoded ID
- [Phase 16]: Candidate operations verify parent thread ownership for cross-user isolation
- [Phase 16]: syncSetupItems validates both setup and item ownership via inArray
- [Phase 16-03]: Non-null assertion on c.get("userId") since requireAuth guarantees it
- [Phase 16-03]: MCP session map stores userId alongside transport for session reuse
- [Phase 16-03]: Images route unchanged -- no user-scoped DB operations
### Pending Todos ### Pending Todos
@@ -75,6 +67,6 @@ None active.
## Session Continuity ## Session Continuity
Last session: 2026-04-05T08:45:22.408Z Last session: 2026-04-05T09:32:35.217Z
Stopped at: Completed 16-03-PLAN.md Stopped at: Completed 16-04-PLAN.md
Resume file: None Resume file: None

112
.planning/phases/16-multi-user-data-model/16-04-SUMMARY.md Normal file
View File

@@ -0,0 +1,112 @@
---
phase: 16-multi-user-data-model
plan: 04
subsystem: testing
tags: [bun-test, multi-user, isolation, userId, mcp]
requires:
- phase: 16-01
provides: "Schema with userId columns, createTestDb returning { db, userId }, createSecondTestUser helper"
- phase: 16-02
provides: "Service functions accepting userId parameter"
- phase: 16-03
provides: "Routes extracting userId from context, MCP tools accepting userId"
provides:
- "All 17 test files updated for multi-user userId pattern"
- "Cross-user isolation tests for MCP tools"
- "Route test middleware setting userId on context"
affects: [16-multi-user-data-model]
tech-stack:
added: []
patterns:
- "Route test middleware sets both db and userId on Hono context"
- "MCP tool registration takes (db, userId) for user-scoped operations"
- "Cross-user isolation tests use createSecondTestUser(db)"
key-files:
modified:
- tests/routes/items.test.ts
- tests/routes/categories.test.ts
- tests/routes/threads.test.ts
- tests/routes/setups.test.ts
- tests/routes/auth.test.ts
- tests/routes/images.test.ts
- tests/routes/oauth.test.ts
- tests/routes/params.test.ts
- tests/mcp/tools.test.ts
key-decisions:
- "Added userId to images test even though current image routes are stateless, for forward compatibility"
- "Created 4 cross-user isolation tests in MCP suite covering items list, item by ID, threads, and collection summary"
patterns-established:
- "Route test pattern: const { db, userId } = createTestDb(); middleware sets c.set('userId', userId)"
- "MCP test pattern: registerXTools(db, userId) for user-scoped tool registration"
- "Isolation test pattern: createSecondTestUser(db) returns userId2, verify data separation"
requirements-completed: [MULTI-02, MULTI-04, MULTI-05]
duration: 3min
completed: 2026-04-05
---
# Phase 16 Plan 04: Test Suite Multi-User Update Summary
**Route tests, MCP tests, and cross-user isolation tests updated with userId context for multi-user data model**
## Performance
- **Duration:** 3 min
- **Started:** 2026-04-05T09:28:40Z
- **Completed:** 2026-04-05T09:31:31Z
- **Tasks:** 2 (Task 1 completed in prior session)
- **Files modified:** 9
## Accomplishments
- All 8 route test files updated to destructure `{ db, userId }` from `createTestDb()` and set userId on Hono context middleware
- MCP tools.test.ts updated to pass userId to all `registerXTools(db, userId)` and `getCollectionSummary(db, userId)` calls
- Added 4 cross-user isolation tests in MCP suite validating that user 2 cannot access user 1's items, threads, or collection summary
- OAuth test type annotations updated for new `createTestDb` return shape
## Task Commits
Each task was committed atomically:
1. **Task 1: Update all service test files to pass userId** - completed in prior session (service test files already had userId)
2. **Task 2: Update route tests, MCP tests, and run full suite** - `5085d8e` (feat)
## Files Created/Modified
- `tests/routes/items.test.ts` - Destructure { db, userId }, set userId in middleware
- `tests/routes/categories.test.ts` - Destructure { db, userId }, set userId in middleware
- `tests/routes/threads.test.ts` - Destructure { db, userId }, set userId in middleware
- `tests/routes/setups.test.ts` - Destructure { db, userId }, set userId in middleware
- `tests/routes/auth.test.ts` - Destructure { db, userId }, set userId in middleware, updated Variables type
- `tests/routes/images.test.ts` - Added createTestDb import, db/userId context, middleware setup
- `tests/routes/oauth.test.ts` - Updated both createTestApp and createFullTestApp, fixed db type annotation
- `tests/routes/params.test.ts` - Destructure { db, userId }, set userId in middleware
- `tests/mcp/tools.test.ts` - All registerXTools calls take userId, added 4 cross-user isolation tests
## Decisions Made
- Added userId context to images.test.ts even though current image routes don't use it, for forward compatibility when image routes may need user scoping
- Placed all cross-user isolation tests in MCP suite rather than route suite, since MCP tests directly call tool registrations and can validate isolation without HTTP layer
## Deviations from Plan
None - plan executed exactly as written.
## Issues Encountered
- Prerequisite plans (16-01, 16-02, 16-03) have not been merged to this branch yet, so tests cannot be run to verify. Tests are syntactically correct for the expected new signatures and will pass once all parallel plan branches are merged.
## User Setup Required
None - no external service configuration required.
## Next Phase Readiness
- All 17 test files are updated for multi-user userId pattern
- Tests will pass once schema changes (16-01), service changes (16-02), and route/MCP changes (16-03) are merged
- Cross-user isolation coverage exists for items, threads, and collection summary via MCP tools
---
*Phase: 16-multi-user-data-model*
*Completed: 2026-04-05*

163
tests/mcp/tools.test.ts
View File

@@ -4,7 +4,7 @@ import { registerCategoryTools } from "../../src/server/mcp/tools/categories.ts"
import { registerItemTools } from "../../src/server/mcp/tools/items.ts"; import { registerItemTools } from "../../src/server/mcp/tools/items.ts";
import { registerSetupTools } from "../../src/server/mcp/tools/setups.ts"; import { registerSetupTools } from "../../src/server/mcp/tools/setups.ts";
import { registerThreadTools } from "../../src/server/mcp/tools/threads.ts"; import { registerThreadTools } from "../../src/server/mcp/tools/threads.ts";
import { createTestDb } from "../helpers/db.ts"; import { createSecondTestUser, createTestDb } from "../helpers/db.ts";
function parseResult(result: { function parseResult(result: {
content: Array<{ type: string; text: string }>; content: Array<{ type: string; text: string }>;
@@ -14,16 +14,16 @@ function parseResult(result: {
describe("MCP Item Tools", () => { describe("MCP Item Tools", () => {
test("list_items returns array", async () => { test("list_items returns array", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerItemTools(db); const tools = registerItemTools(db, userId);
const result = await tools.list_items({}); const result = await tools.list_items({});
const data = parseResult(result); const data = parseResult(result);
expect(Array.isArray(data)).toBe(true); expect(Array.isArray(data)).toBe(true);
}); });
test("create_item creates and returns item", async () => { test("create_item creates and returns item", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerItemTools(db); const tools = registerItemTools(db, userId);
const result = await tools.create_item({ const result = await tools.create_item({
name: "Test Tent", name: "Test Tent",
categoryId: 1, categoryId: 1,
@@ -38,8 +38,8 @@ describe("MCP Item Tools", () => {
}); });
test("get_item retrieves by ID", async () => { test("get_item retrieves by ID", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerItemTools(db); const tools = registerItemTools(db, userId);
const created = parseResult( const created = parseResult(
await tools.create_item({ name: "Sleeping Bag", categoryId: 1 }), await tools.create_item({ name: "Sleeping Bag", categoryId: 1 }),
); );
@@ -50,16 +50,16 @@ describe("MCP Item Tools", () => {
}); });
test("get_item returns error for missing item", async () => { test("get_item returns error for missing item", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerItemTools(db); const tools = registerItemTools(db, userId);
const result = await tools.get_item({ id: 999 }); const result = await tools.get_item({ id: 999 });
const data = parseResult(result); const data = parseResult(result);
expect(data.error).toContain("not found"); expect(data.error).toContain("not found");
}); });
test("delete_item removes item", async () => { test("delete_item removes item", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerItemTools(db); const tools = registerItemTools(db, userId);
const created = parseResult( const created = parseResult(
await tools.create_item({ name: "To Delete", categoryId: 1 }), await tools.create_item({ name: "To Delete", categoryId: 1 }),
); );
@@ -76,8 +76,8 @@ describe("MCP Item Tools", () => {
describe("MCP Category Tools", () => { describe("MCP Category Tools", () => {
test("list_categories returns array with Uncategorized", async () => { test("list_categories returns array with Uncategorized", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerCategoryTools(db); const tools = registerCategoryTools(db, userId);
const result = await tools.list_categories(); const result = await tools.list_categories();
const data = parseResult(result); const data = parseResult(result);
expect(Array.isArray(data)).toBe(true); expect(Array.isArray(data)).toBe(true);
@@ -86,8 +86,8 @@ describe("MCP Category Tools", () => {
}); });
test("create_category creates a new category", async () => { test("create_category creates a new category", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerCategoryTools(db); const tools = registerCategoryTools(db, userId);
const result = await tools.create_category({ const result = await tools.create_category({
name: "Shelter", name: "Shelter",
icon: "tent", icon: "tent",
@@ -100,8 +100,8 @@ describe("MCP Category Tools", () => {
describe("MCP Thread Tools", () => { describe("MCP Thread Tools", () => {
test("create_thread starts a thread with status active", async () => { test("create_thread starts a thread with status active", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerThreadTools(db); const tools = registerThreadTools(db, userId);
const result = await tools.create_thread({ const result = await tools.create_thread({
name: "Handlebar Bag", name: "Handlebar Bag",
categoryId: 1, categoryId: 1,
@@ -112,8 +112,8 @@ describe("MCP Thread Tools", () => {
}); });
test("add_candidate adds to thread", async () => { test("add_candidate adds to thread", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerThreadTools(db); const tools = registerThreadTools(db, userId);
const thread = parseResult( const thread = parseResult(
await tools.create_thread({ name: "Saddle Bag", categoryId: 1 }), await tools.create_thread({ name: "Saddle Bag", categoryId: 1 }),
); );
@@ -132,9 +132,9 @@ describe("MCP Thread Tools", () => {
}); });
test("resolve_thread picks winner and creates item", async () => { test("resolve_thread picks winner and creates item", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const threadTools = registerThreadTools(db); const threadTools = registerThreadTools(db, userId);
const itemTools = registerItemTools(db); const itemTools = registerItemTools(db, userId);
// Create thread with two candidates // Create thread with two candidates
const thread = parseResult( const thread = parseResult(
@@ -179,8 +179,8 @@ describe("MCP Thread Tools", () => {
describe("MCP Setup Tools", () => { describe("MCP Setup Tools", () => {
test("create_setup and list_setups", async () => { test("create_setup and list_setups", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const tools = registerSetupTools(db); const tools = registerSetupTools(db, userId);
await tools.create_setup({ name: "Weekend Trip" }); await tools.create_setup({ name: "Weekend Trip" });
const result = await tools.list_setups(); const result = await tools.list_setups();
const data = parseResult(result); const data = parseResult(result);
@@ -189,9 +189,9 @@ describe("MCP Setup Tools", () => {
}); });
test("get_setup returns setup with items", async () => { test("get_setup returns setup with items", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const setupTools = registerSetupTools(db); const setupTools = registerSetupTools(db, userId);
const itemTools = registerItemTools(db); const itemTools = registerItemTools(db, userId);
const setup = parseResult( const setup = parseResult(
await setupTools.create_setup({ name: "Overnighter" }), await setupTools.create_setup({ name: "Overnighter" }),
@@ -210,10 +210,10 @@ describe("MCP Setup Tools", () => {
}); });
describe("MCP Collection Summary Resource", () => { describe("MCP Collection Summary Resource", () => {
test("returns overview with correct counts", async () => { test("returns overview with correct counts", () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const summary = await getCollectionSummary(db); const summary = getCollectionSummary(db, userId);
expect(summary.overview).toBeDefined(); expect(summary.overview).toBeDefined();
expect(summary.overview.totalItems).toBe(0); expect(summary.overview.totalItems).toBe(0);
expect(summary.overview.categoryCount).toBe(1); // Uncategorized expect(summary.overview.categoryCount).toBe(1); // Uncategorized
@@ -223,9 +223,9 @@ describe("MCP Collection Summary Resource", () => {
}); });
test("reflects items and threads after creation", async () => { test("reflects items and threads after creation", async () => {
const db = await createTestDb(); const { db, userId } = createTestDb();
const itemTools = registerItemTools(db); const itemTools = registerItemTools(db, userId);
const threadTools = registerThreadTools(db); const threadTools = registerThreadTools(db, userId);
await itemTools.create_item({ await itemTools.create_item({
name: "Tent", name: "Tent",
@@ -242,7 +242,7 @@ describe("MCP Collection Summary Resource", () => {
categoryId: 1, categoryId: 1,
}); });
const summary = await getCollectionSummary(db); const summary = getCollectionSummary(db, userId);
expect(summary.overview.totalItems).toBe(2); expect(summary.overview.totalItems).toBe(2);
expect(summary.overview.totalWeightGrams).toBe(2000); expect(summary.overview.totalWeightGrams).toBe(2000);
expect(summary.overview.activeThreadCount).toBe(1); expect(summary.overview.activeThreadCount).toBe(1);
@@ -251,3 +251,98 @@ describe("MCP Collection Summary Resource", () => {
expect(summary.activeThreads[0].name).toBe("Cook System"); expect(summary.activeThreads[0].name).toBe("Cook System");
}); });
}); });
describe("MCP Cross-User Isolation", () => {
test("user 2 cannot see user 1's items via MCP tools", async () => {
const { db, userId } = createTestDb();
const userId2 = createSecondTestUser(db);
const user1Tools = registerItemTools(db, userId);
const user2Tools = registerItemTools(db, userId2);
// User 1 creates an item
await user1Tools.create_item({
name: "User 1 Tent",
categoryId: 1,
weightGrams: 1200,
});
// User 2 creates an item
await user2Tools.create_item({
name: "User 2 Sleeping Bag",
categoryId: 1,
weightGrams: 800,
});
// Each user only sees their own items
const user1Items = parseResult(await user1Tools.list_items({}));
const user2Items = parseResult(await user2Tools.list_items({}));
expect(user1Items).toHaveLength(1);
expect(user1Items[0].name).toBe("User 1 Tent");
expect(user2Items).toHaveLength(1);
expect(user2Items[0].name).toBe("User 2 Sleeping Bag");
});
test("user 2 cannot access user 1's item by ID", async () => {
const { db, userId } = createTestDb();
const userId2 = createSecondTestUser(db);
const user1Tools = registerItemTools(db, userId);
const user2Tools = registerItemTools(db, userId2);
const created = parseResult(
await user1Tools.create_item({
name: "Private Item",
categoryId: 1,
}),
);
// User 2 tries to get user 1's item
const result = await user2Tools.get_item({ id: created.id });
const data = parseResult(result);
expect(data.error).toContain("not found");
});
test("user 2 cannot see user 1's threads via MCP tools", async () => {
const { db, userId } = createTestDb();
const userId2 = createSecondTestUser(db);
const user1Tools = registerThreadTools(db, userId);
const user2Tools = registerThreadTools(db, userId2);
await user1Tools.create_thread({
name: "User 1 Thread",
categoryId: 1,
});
const user1Threads = parseResult(
await user1Tools.list_threads({ includeResolved: false }),
);
const user2Threads = parseResult(
await user2Tools.list_threads({ includeResolved: false }),
);
expect(user1Threads).toHaveLength(1);
expect(user1Threads[0].name).toBe("User 1 Thread");
expect(user2Threads).toHaveLength(0);
});
test("collection summary is scoped to user", async () => {
const { db, userId } = createTestDb();
const userId2 = createSecondTestUser(db);
const user1Tools = registerItemTools(db, userId);
await user1Tools.create_item({
name: "User 1 Item",
categoryId: 1,
weightGrams: 500,
});
const user1Summary = getCollectionSummary(db, userId);
const user2Summary = getCollectionSummary(db, userId2);
expect(user1Summary.overview.totalItems).toBe(1);
expect(user2Summary.overview.totalItems).toBe(0);
});
});

192
tests/routes/auth.test.ts
View File

@@ -1,139 +1,129 @@
import { beforeEach, describe, expect, it, mock } from "bun:test"; import { beforeEach, describe, expect, it } from "bun:test";
import { Hono } from "hono"; import { Hono } from "hono";
import { createApiKey } from "../../src/server/services/auth.service.ts"; import { authRoutes } from "../../src/server/routes/auth.ts";
import { createTestDb } from "../helpers/db.ts"; import { createTestDb } from "../helpers/db.ts";
// Mock @hono/oidc-auth function createTestApp() {
const mockGetAuth = mock(() => null as any); const { db, userId } = createTestDb();
mock.module("@hono/oidc-auth", () => ({ const app = new Hono<{ Variables: { db?: any; userId?: number } }>();
getAuth: mockGetAuth,
oidcAuthMiddleware: () => async (_c: any, next: any) => next(),
processOAuthCallback: async (c: any) => c.json({ ok: true }),
revokeSession: async () => {},
}));
// Mock verifyAccessToken from oauth.service
mock.module("../../src/server/services/oauth.service", () => ({
verifyAccessToken: mock(() => Promise.resolve(false)),
}));
// Import routes AFTER mocks
const { authRoutes } = await import("../../src/server/routes/auth.ts");
async function createTestApp() {
const db = await createTestDb();
const app = new Hono<{ Variables: { db?: any } }>();
app.use("*", async (c, next) => { app.use("*", async (c, next) => {
c.set("db", db); c.set("db", db);
c.set("userId", userId);
await next(); await next();
}); });
app.route("/api/auth", authRoutes); app.route("/api/auth", authRoutes);
return { app, db }; return { app, db, userId };
} }
describe("Auth Routes", () => { describe("Auth Routes", () => {
let app: Hono; let app: Hono;
let db: Awaited<ReturnType<typeof createTestDb>>;
beforeEach(async () => { beforeEach(() => {
const testApp = await createTestApp(); const testApp = createTestApp();
app = testApp.app; app = testApp.app;
db = testApp.db;
mockGetAuth.mockReset();
mockGetAuth.mockReturnValue(null);
}); });
describe("GET /api/auth/me", () => { describe("GET /api/auth/me", () => {
it("returns authenticated false when no OIDC session", async () => { it("returns null user and setupRequired true when no users exist", async () => {
const res = await app.request("/api/auth/me"); const res = await app.request("/api/auth/me");
expect(res.status).toBe(200); expect(res.status).toBe(200);
const body = await res.json(); const body = await res.json();
expect(body.user).toBeNull(); expect(body.user).toBeNull();
expect(body.authenticated).toBe(false); expect(body.setupRequired).toBe(true);
});
it("returns user info when OIDC session exists", async () => {
mockGetAuth.mockReturnValue({
sub: "logto-user-abc123",
email: "user@example.com",
});
const res = await app.request("/api/auth/me");
expect(res.status).toBe(200);
const body = await res.json();
expect(body.authenticated).toBe(true);
expect(body.user.id).toBe("logto-user-abc123");
expect(body.user.email).toBe("user@example.com");
}); });
}); });
describe("GET /api/auth/keys", () => { describe("POST /api/auth/setup", () => {
it("returns 401 without authentication", async () => { it("creates first user and returns 201", async () => {
const res = await app.request("/api/auth/keys"); const res = await app.request("/api/auth/setup", {
expect(res.status).toBe(401);
});
it("returns empty key list with API key auth", async () => {
const key = await createApiKey(db, "test-key");
const res = await app.request("/api/auth/keys", {
headers: { "X-API-Key": key.rawKey },
});
expect(res.status).toBe(200);
const body = await res.json();
// Contains at least the key we created for auth
expect(Array.isArray(body)).toBe(true);
expect(body.length).toBeGreaterThanOrEqual(1);
});
});
describe("POST /api/auth/keys", () => {
it("creates a new API key when authenticated", async () => {
const authKey = await createApiKey(db, "auth-key");
const res = await app.request("/api/auth/keys", {
method: "POST",
headers: {
"Content-Type": "application/json",
"X-API-Key": authKey.rawKey,
},
body: JSON.stringify({ name: "my-new-key" }),
});
expect(res.status).toBe(201);
const body = await res.json();
expect(body.name).toBe("my-new-key");
expect(body.key).toBeDefined();
expect(body.prefix).toBeDefined();
});
it("rejects without auth", async () => {
const res = await app.request("/api/auth/keys", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/json" }, headers: { "Content-Type": "application/json" },
body: JSON.stringify({ name: "my-key" }), body: JSON.stringify({ username: "admin", password: "secret123" }),
}); });
expect(res.status).toBe(201);
const body = await res.json();
expect(body.username).toBe("admin");
// Should set a session cookie
const setCookie = res.headers.get("set-cookie");
expect(setCookie).toContain("gearbox_session");
});
it("rejects second setup attempt with 403", async () => {
// First setup
await app.request("/api/auth/setup", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ username: "admin", password: "secret123" }),
});
// Second attempt
const res = await app.request("/api/auth/setup", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ username: "other", password: "secret456" }),
});
expect(res.status).toBe(403);
});
it("rejects password shorter than 6 characters", async () => {
const res = await app.request("/api/auth/setup", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ username: "admin", password: "short" }),
});
expect(res.status).toBe(400);
});
});
describe("POST /api/auth/login", () => {
beforeEach(async () => {
// Create a user first
await app.request("/api/auth/setup", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ username: "admin", password: "secret123" }),
});
});
it("returns session cookie on valid login", async () => {
const res = await app.request("/api/auth/login", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ username: "admin", password: "secret123" }),
});
expect(res.status).toBe(200);
const body = await res.json();
expect(body.username).toBe("admin");
const setCookie = res.headers.get("set-cookie");
expect(setCookie).toContain("gearbox_session");
});
it("rejects invalid credentials with 401", async () => {
const res = await app.request("/api/auth/login", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ username: "admin", password: "wrongpassword" }),
});
expect(res.status).toBe(401); expect(res.status).toBe(401);
}); });
}); });
describe("DELETE /api/auth/keys/:id", () => { describe("POST /api/auth/logout", () => {
it("deletes an API key when authenticated", async () => { it("clears session cookie", async () => {
const authKey = await createApiKey(db, "auth-key"); const res = await app.request("/api/auth/logout", {
const targetKey = await createApiKey(db, "to-delete"); method: "POST",
const res = await app.request(`/api/auth/keys/${targetKey.id}`, {
method: "DELETE",
headers: { "X-API-Key": authKey.rawKey },
}); });
expect(res.status).toBe(200); expect(res.status).toBe(200);
const body = await res.json();
expect(body.ok).toBe(true);
});
it("rejects without auth", async () => {
const res = await app.request("/api/auth/keys/1", {
method: "DELETE",
});
expect(res.status).toBe(401);
}); });
}); });
}); });

13
tests/routes/categories.test.ts
View File

@@ -4,26 +4,27 @@ import { categoryRoutes } from "../../src/server/routes/categories.ts";
import { itemRoutes } from "../../src/server/routes/items.ts"; import { itemRoutes } from "../../src/server/routes/items.ts";
import { createTestDb } from "../helpers/db.ts"; import { createTestDb } from "../helpers/db.ts";
async function createTestApp() { function createTestApp() {
const db = await createTestDb(); const { db, userId } = createTestDb();
const app = new Hono(); const app = new Hono();
// Inject test DB into context for all routes // Inject test DB and userId into context for all routes
app.use("*", async (c, next) => { app.use("*", async (c, next) => {
c.set("db", db); c.set("db", db);
c.set("userId", userId);
await next(); await next();
}); });
app.route("/api/categories", categoryRoutes); app.route("/api/categories", categoryRoutes);
app.route("/api/items", itemRoutes); app.route("/api/items", itemRoutes);
return { app, db }; return { app, db, userId };
} }
describe("Category Routes", () => { describe("Category Routes", () => {
let app: Hono; let app: Hono;
beforeEach(async () => { beforeEach(() => {
const testApp = await createTestApp(); const testApp = createTestApp();
app = testApp.app; app = testApp.app;
}); });

7
tests/routes/images.test.ts
View File

@@ -1,8 +1,15 @@
import { describe, expect, test } from "bun:test"; import { describe, expect, test } from "bun:test";
import { Hono } from "hono"; import { Hono } from "hono";
import { imageRoutes } from "../../src/server/routes/images"; import { imageRoutes } from "../../src/server/routes/images";
import { createTestDb } from "../helpers/db.ts";
const { db, userId } = createTestDb();
const app = new Hono(); const app = new Hono();
app.use("*", async (c, next) => {
c.set("db", db);
c.set("userId", userId);
await next();
});
app.route("/api/images", imageRoutes); app.route("/api/images", imageRoutes);
describe("POST /api/images/from-url", () => { describe("POST /api/images/from-url", () => {

13
tests/routes/items.test.ts
View File

@@ -4,26 +4,27 @@ import { categoryRoutes } from "../../src/server/routes/categories.ts";
import { itemRoutes } from "../../src/server/routes/items.ts"; import { itemRoutes } from "../../src/server/routes/items.ts";
import { createTestDb } from "../helpers/db.ts"; import { createTestDb } from "../helpers/db.ts";
async function createTestApp() { function createTestApp() {
const db = await createTestDb(); const { db, userId } = createTestDb();
const app = new Hono(); const app = new Hono();
// Inject test DB into context for all routes // Inject test DB and userId into context for all routes
app.use("*", async (c, next) => { app.use("*", async (c, next) => {
c.set("db", db); c.set("db", db);
c.set("userId", userId);
await next(); await next();
}); });
app.route("/api/items", itemRoutes); app.route("/api/items", itemRoutes);
app.route("/api/categories", categoryRoutes); app.route("/api/categories", categoryRoutes);
return { app, db }; return { app, db, userId };
} }
describe("Item Routes", () => { describe("Item Routes", () => {
let app: Hono; let app: Hono;
beforeEach(async () => { beforeEach(() => {
const testApp = await createTestApp(); const testApp = createTestApp();
app = testApp.app; app = testApp.app;
}); });

170
tests/routes/oauth.test.ts
View File

@@ -1,43 +1,36 @@
import { beforeEach, describe, expect, it, mock } from "bun:test"; import { beforeEach, describe, expect, it } from "bun:test";
import { createHash, randomBytes } from "node:crypto"; import { createHash, randomBytes } from "node:crypto";
import { Hono } from "hono"; import { Hono } from "hono";
import { mcpRoutes } from "../../src/server/mcp/index.ts"; import { mcpRoutes } from "../../src/server/mcp/index.ts";
import { oauthRoutes, wellKnownRoute } from "../../src/server/routes/oauth.ts"; import { oauthRoutes, wellKnownRoute } from "../../src/server/routes/oauth.ts";
import { createApiKey } from "../../src/server/services/auth.service.ts"; import { createUser } from "../../src/server/services/auth.service.ts";
import { createTestDb } from "../helpers/db.ts"; import { createTestDb } from "../helpers/db.ts";
// Mock @hono/oidc-auth — must be before importing routes function createTestApp() {
const mockGetAuth = mock(() => null as any); const { db, userId } = createTestDb();
mock.module("@hono/oidc-auth", () => ({ const app = new Hono<{ Variables: { db?: any; userId?: number } }>();
getAuth: mockGetAuth,
oidcAuthMiddleware: () => async (_c: any, next: any) => next(),
processOAuthCallback: async (c: any) => c.json({ ok: true }),
revokeSession: async () => {},
}));
async function createTestApp() {
const db = await createTestDb();
const app = new Hono<{ Variables: { db?: any } }>();
app.use("*", async (c, next) => { app.use("*", async (c, next) => {
c.set("db", db); c.set("db", db);
c.set("userId", userId);
await next(); await next();
}); });
app.route("/.well-known", wellKnownRoute); app.route("/.well-known", wellKnownRoute);
app.route("/oauth", oauthRoutes); app.route("/oauth", oauthRoutes);
return { app, db }; return { app, db, userId };
} }
async function createFullTestApp() { function createFullTestApp() {
const db = await createTestDb(); const { db, userId } = createTestDb();
const app = new Hono<{ Variables: { db?: any } }>(); const app = new Hono<{ Variables: { db?: any; userId?: number } }>();
app.use("*", async (c, next) => { app.use("*", async (c, next) => {
c.set("db", db); c.set("db", db);
c.set("userId", userId);
await next(); await next();
}); });
app.route("/.well-known", wellKnownRoute); app.route("/.well-known", wellKnownRoute);
app.route("/oauth", oauthRoutes); app.route("/oauth", oauthRoutes);
app.route("/mcp", mcpRoutes); app.route("/mcp", mcpRoutes);
return { app, db }; return { app, db, userId };
} }
function generatePkce() { function generatePkce() {
@@ -48,15 +41,13 @@ function generatePkce() {
describe("OAuth Routes", () => { describe("OAuth Routes", () => {
let app: Hono; let app: Hono;
let db: any; let db: ReturnType<typeof createTestDb>["db"];
beforeEach(async () => { beforeEach(async () => {
const testApp = await createTestApp(); const testApp = createTestApp();
app = testApp.app; app = testApp.app;
db = testApp.db; db = testApp.db;
mockGetAuth.mockReset(); await createUser(db, "admin", "secret123");
// Default: user is authenticated via OIDC
mockGetAuth.mockReturnValue({ sub: "user-123", email: "admin@example.com" });
}); });
describe("GET /.well-known/oauth-authorization-server", () => { describe("GET /.well-known/oauth-authorization-server", () => {
@@ -109,7 +100,7 @@ describe("OAuth Routes", () => {
}); });
describe("GET /oauth/authorize", () => { describe("GET /oauth/authorize", () => {
it("returns 200 HTML with consent form when OIDC session exists", async () => { it("returns 200 HTML with form when params are valid", async () => {
// Register a client first // Register a client first
const regRes = await app.request("/oauth/register", { const regRes = await app.request("/oauth/register", {
method: "POST", method: "POST",
@@ -136,41 +127,10 @@ describe("OAuth Routes", () => {
const html = await res.text(); const html = await res.text();
expect(html).toContain("GearBox"); expect(html).toContain("GearBox");
expect(html).toContain("Authorize"); expect(html).toContain("password");
expect(html).toContain("Test Client"); expect(html).toContain("Test Client");
}); });
it("redirects to /login when no OIDC session", async () => {
mockGetAuth.mockReturnValue(null);
const regRes = await app.request("/oauth/register", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
client_name: "Test Client",
redirect_uris: ["http://localhost:3000/callback"],
}),
});
const { client_id } = await regRes.json();
const { challenge } = generatePkce();
const params = new URLSearchParams({
response_type: "code",
client_id,
redirect_uri: "http://localhost:3000/callback",
code_challenge: challenge,
code_challenge_method: "S256",
state: "abc123",
});
const res = await app.request(`/oauth/authorize?${params}`, {
redirect: "manual",
});
expect(res.status).toBe(302);
const location = res.headers.get("location");
expect(location).toContain("/login");
});
it("returns 400 with invalid client_id", async () => { it("returns 400 with invalid client_id", async () => {
const { challenge } = generatePkce(); const { challenge } = generatePkce();
const params = new URLSearchParams({ const params = new URLSearchParams({
@@ -188,30 +148,43 @@ describe("OAuth Routes", () => {
}); });
describe("POST /oauth/authorize", () => { describe("POST /oauth/authorize", () => {
it("redirects to /login when no OIDC session", async () => { it("returns 200 HTML with error on wrong password", async () => {
mockGetAuth.mockReturnValue(null); // Register a client
const regRes = await app.request("/oauth/register", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
client_name: "Test Client",
redirect_uris: ["http://localhost:3000/callback"],
}),
});
const { client_id } = await regRes.json();
const { challenge } = generatePkce();
const formBody = new URLSearchParams({
username: "admin",
password: "wrongpassword",
client_id,
redirect_uri: "http://localhost:3000/callback",
code_challenge: challenge,
code_challenge_method: "S256",
state: "abc123",
});
const res = await app.request("/oauth/authorize", { const res = await app.request("/oauth/authorize", {
method: "POST", method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded" }, headers: { "Content-Type": "application/x-www-form-urlencoded" },
body: new URLSearchParams({ body: formBody.toString(),
client_id: "some-client",
redirect_uri: "http://localhost:3000/callback",
code_challenge: "challenge",
code_challenge_method: "S256",
state: "abc123",
}).toString(),
redirect: "manual",
}); });
expect(res.status).toBe(302); expect(res.status).toBe(200);
const location = res.headers.get("location"); const html = await res.text();
expect(location).toContain("/login"); expect(html).toContain("Invalid");
}); });
}); });
describe("Full OAuth flow", () => { describe("Full OAuth flow", () => {
it("register -> authorize (consent) -> token exchange", async () => { it("register → authorize → token exchange", async () => {
// 1. Register client // 1. Register client
const regRes = await app.request("/oauth/register", { const regRes = await app.request("/oauth/register", {
method: "POST", method: "POST",
@@ -224,8 +197,10 @@ describe("OAuth Routes", () => {
const { client_id } = await regRes.json(); const { client_id } = await regRes.json();
const { verifier, challenge } = generatePkce(); const { verifier, challenge } = generatePkce();
// 2. POST /oauth/authorize with OIDC session (consent form submission) // 2. POST /oauth/authorize with correct credentials
const formBody = new URLSearchParams({ const formBody = new URLSearchParams({
username: "admin",
password: "secret123",
client_id, client_id,
redirect_uri: "http://localhost:3000/callback", redirect_uri: "http://localhost:3000/callback",
code_challenge: challenge, code_challenge: challenge,
@@ -272,12 +247,10 @@ describe("OAuth Routes", () => {
}); });
}); });
describe("Full OAuth -> MCP Flow", () => { describe("Full OAuth → MCP Flow", () => {
it("complete flow: register -> authorize -> token -> MCP call", async () => { it("complete flow: register → authorize → token → MCP call", async () => {
const { app } = await createFullTestApp(); const { app, db } = createFullTestApp();
// Mock authenticated OIDC session await createUser(db, "admin", "secret123");
mockGetAuth.mockReturnValue({ sub: "user-123", email: "admin@example.com" });
const { verifier, challenge } = generatePkce(); const { verifier, challenge } = generatePkce();
// 1. Register client // 1. Register client
@@ -291,19 +264,23 @@ describe("OAuth Routes", () => {
}); });
const { client_id } = await regRes.json(); const { client_id } = await regRes.json();
// 2. Authorize (consent form POST with OIDC session) // 2. Authorize (simulate form POST)
const authRes = await app.request("/oauth/authorize", { const authRes = await app.request(
method: "POST", `/oauth/authorize?response_type=code&client_id=${client_id}&redirect_uri=${encodeURIComponent("http://localhost/cb")}&code_challenge=${challenge}&code_challenge_method=S256&state=test`,
headers: { "Content-Type": "application/x-www-form-urlencoded" }, {
body: new URLSearchParams({ method: "POST",
client_id, headers: { "Content-Type": "application/x-www-form-urlencoded" },
redirect_uri: "http://localhost/cb", body: new URLSearchParams({
code_challenge: challenge, username: "admin",
code_challenge_method: "S256", password: "secret123",
state: "test", client_id,
}).toString(), redirect_uri: "http://localhost/cb",
redirect: "manual", code_challenge: challenge,
}); code_challenge_method: "S256",
state: "test",
}).toString(),
},
);
const code = new URL(authRes.headers.get("location")!).searchParams.get( const code = new URL(authRes.headers.get("location")!).searchParams.get(
"code", "code",
)!; )!;
@@ -345,11 +322,9 @@ describe("OAuth Routes", () => {
expect(mcpRes.status).toBe(200); expect(mcpRes.status).toBe(200);
}); });
it("rejects MCP call without auth", async () => { it("rejects MCP call without auth when user exists", async () => {
const { app } = await createFullTestApp(); const { app, db } = createFullTestApp();
// Create an API key so auth middleware doesn't return setup_required await createUser(db, "admin", "secret123");
const { db } = await createTestApp();
await createApiKey(db, "setup-key");
const mcpRes = await app.request("/mcp", { const mcpRes = await app.request("/mcp", {
method: "POST", method: "POST",
@@ -367,6 +342,7 @@ describe("OAuth Routes", () => {
}); });
expect(mcpRes.status).toBe(401); expect(mcpRes.status).toBe(401);
expect(mcpRes.headers.get("www-authenticate")).toContain("Bearer");
}); });
}); });
@@ -385,6 +361,8 @@ describe("OAuth Routes", () => {
const { verifier, challenge } = generatePkce(); const { verifier, challenge } = generatePkce();
const formBody = new URLSearchParams({ const formBody = new URLSearchParams({
username: "admin",
password: "secret123",
client_id, client_id,
redirect_uri: "http://localhost:3000/callback", redirect_uri: "http://localhost:3000/callback",
code_challenge: challenge, code_challenge: challenge,

9
tests/routes/params.test.ts
View File

@@ -6,11 +6,12 @@ import { setupRoutes } from "../../src/server/routes/setups";
import { threadRoutes } from "../../src/server/routes/threads"; import { threadRoutes } from "../../src/server/routes/threads";
import { createTestDb } from "../helpers/db"; import { createTestDb } from "../helpers/db";
async function createTestApp() { function createTestApp() {
const db = await createTestDb(); const { db, userId } = createTestDb();
const app = new Hono(); const app = new Hono();
app.use("*", async (c, next) => { app.use("*", async (c, next) => {
c.set("db", db); c.set("db", db);
c.set("userId", userId);
await next(); await next();
}); });
app.route("/api/items", itemRoutes); app.route("/api/items", itemRoutes);
@@ -23,8 +24,8 @@ async function createTestApp() {
describe("Invalid ID parameter handling", () => { describe("Invalid ID parameter handling", () => {
let app: Hono; let app: Hono;
beforeEach(async () => { beforeEach(() => {
app = await createTestApp(); app = createTestApp();
}); });
describe("items", () => { describe("items", () => {

11
tests/routes/setups.test.ts
View File

@@ -4,18 +4,19 @@ import { itemRoutes } from "../../src/server/routes/items.ts";
import { setupRoutes } from "../../src/server/routes/setups.ts"; import { setupRoutes } from "../../src/server/routes/setups.ts";
import { createTestDb } from "../helpers/db.ts"; import { createTestDb } from "../helpers/db.ts";
async function createTestApp() { function createTestApp() {
const db = await createTestDb(); const { db, userId } = createTestDb();
const app = new Hono(); const app = new Hono();
app.use("*", async (c, next) => { app.use("*", async (c, next) => {
c.set("db", db); c.set("db", db);
c.set("userId", userId);
await next(); await next();
}); });
app.route("/api/setups", setupRoutes); app.route("/api/setups", setupRoutes);
app.route("/api/items", itemRoutes); app.route("/api/items", itemRoutes);
return { app, db }; return { app, db, userId };
} }
async function createSetupViaAPI(app: Hono, name: string) { async function createSetupViaAPI(app: Hono, name: string) {
@@ -39,8 +40,8 @@ async function createItemViaAPI(app: Hono, data: any) {
describe("Setup Routes", () => { describe("Setup Routes", () => {
let app: Hono; let app: Hono;
beforeEach(async () => { beforeEach(() => {
const testApp = await createTestApp(); const testApp = createTestApp();
app = testApp.app; app = testApp.app;
}); });

13
tests/routes/threads.test.ts
View File

@@ -3,18 +3,19 @@ import { Hono } from "hono";
import { threadRoutes } from "../../src/server/routes/threads.ts"; import { threadRoutes } from "../../src/server/routes/threads.ts";
import { createTestDb } from "../helpers/db.ts"; import { createTestDb } from "../helpers/db.ts";
async function createTestApp() { function createTestApp() {
const db = await createTestDb(); const { db, userId } = createTestDb();
const app = new Hono(); const app = new Hono();
// Inject test DB into context for all routes // Inject test DB and userId into context for all routes
app.use("*", async (c, next) => { app.use("*", async (c, next) => {
c.set("db", db); c.set("db", db);
c.set("userId", userId);
await next(); await next();
}); });
app.route("/api/threads", threadRoutes); app.route("/api/threads", threadRoutes);
return { app, db }; return { app, db, userId };
} }
async function createThreadViaAPI(app: Hono, name: string, categoryId = 1) { async function createThreadViaAPI(app: Hono, name: string, categoryId = 1) {
@@ -38,8 +39,8 @@ async function createCandidateViaAPI(app: Hono, threadId: number, data: any) {
describe("Thread Routes", () => { describe("Thread Routes", () => {
let app: Hono; let app: Hono;
beforeEach(async () => { beforeEach(() => {
const testApp = await createTestApp(); const testApp = createTestApp();
app = testApp.app; app = testApp.app;
}); });