feat: add auth routes for login, setup, and API key management

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/routes/auth.ts

@@ -0,0 +1,187 @@
+import { zValidator } from "@hono/zod-validator";
+import { eq } from "drizzle-orm";
+import { Hono } from "hono";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { z } from "zod";
+import { users } from "../../db/schema.ts";
+import { requireAuth } from "../middleware/auth.ts";
+import {
+	changePassword,
+	createApiKey,
+	createSession,
+	createUser,
+	deleteApiKey,
+	deleteSession,
+	getSession,
+	getUserCount,
+	listApiKeys,
+	verifyPassword,
+} from "../services/auth.service.ts";
+
+type Env = { Variables: { db?: any } };
+
+const loginSchema = z.object({
+	username: z.string().min(1),
+	password: z.string().min(1),
+});
+const setupSchema = z.object({
+	username: z.string().min(1),
+	password: z.string().min(6),
+});
+const changePasswordSchema = z.object({
+	currentPassword: z.string().min(1),
+	newPassword: z.string().min(6),
+});
+const createKeySchema = z.object({ name: z.string().min(1) });
+
+const COOKIE_NAME = "gearbox_session";
+const COOKIE_MAX_AGE = 30 * 24 * 60 * 60; // 30 days in seconds
+
+const app = new Hono<Env>();
+
+// ── Public routes ───────────────────────────────────────────────────
+
+app.get("/me", (c) => {
+	const db = c.get("db");
+	const sessionId = getCookie(c, COOKIE_NAME);
+
+	if (sessionId) {
+		const session = getSession(db, sessionId);
+		if (session) {
+			return c.json({
+				user: { id: session.userId },
+				setupRequired: false,
+			});
+		}
+	}
+
+	const setupRequired = getUserCount(db) === 0;
+	return c.json({ user: null, setupRequired });
+});
+
+app.post("/setup", zValidator("json", setupSchema), async (c) => {
+	const db = c.get("db");
+
+	if (getUserCount(db) > 0) {
+		return c.json({ error: "Setup already completed" }, 403);
+	}
+
+	const { username, password } = c.req.valid("json");
+	const user = await createUser(db, username, password);
+	const session = createSession(db, user.id);
+
+	setCookie(c, COOKIE_NAME, session.id, {
+		httpOnly: true,
+		sameSite: "Lax",
+		path: "/",
+		maxAge: COOKIE_MAX_AGE,
+	});
+
+	return c.json({ username: user.username }, 201);
+});
+
+app.post("/login", zValidator("json", loginSchema), async (c) => {
+	const db = c.get("db");
+	const { username, password } = c.req.valid("json");
+
+	const user = await verifyPassword(db, username, password);
+	if (!user) {
+		return c.json({ error: "Invalid credentials" }, 401);
+	}
+
+	const session = createSession(db, user.id);
+
+	setCookie(c, COOKIE_NAME, session.id, {
+		httpOnly: true,
+		sameSite: "Lax",
+		path: "/",
+		maxAge: COOKIE_MAX_AGE,
+	});
+
+	return c.json({ username: user.username });
+});
+
+app.post("/logout", (c) => {
+	const db = c.get("db");
+	const sessionId = getCookie(c, COOKIE_NAME);
+
+	if (sessionId) {
+		deleteSession(db, sessionId);
+	}
+
+	deleteCookie(c, COOKIE_NAME, { path: "/" });
+	return c.json({ ok: true });
+});
+
+// ── Protected routes ────────────────────────────────────────────────
+
+app.put(
+	"/password",
+	requireAuth,
+	zValidator("json", changePasswordSchema),
+	async (c) => {
+		const db = c.get("db");
+		const sessionId = getCookie(c, COOKIE_NAME)!;
+		const session = getSession(db, sessionId)!;
+
+		const userRecord = db
+			.select()
+			.from(users)
+			.where(eq(users.id, session.userId))
+			.get();
+
+		if (!userRecord) {
+			return c.json({ error: "User not found" }, 404);
+		}
+
+		const { currentPassword, newPassword } = c.req.valid("json");
+		const changed = await changePassword(
+			db,
+			userRecord.username,
+			currentPassword,
+			newPassword,
+		);
+
+		if (!changed) {
+			return c.json({ error: "Invalid current password" }, 401);
+		}
+
+		return c.json({ ok: true });
+	},
+);
+
+app.get("/keys", requireAuth, (c) => {
+	const db = c.get("db");
+	const keys = listApiKeys(db);
+	return c.json(keys);
+});
+
+app.post(
+	"/keys",
+	requireAuth,
+	zValidator("json", createKeySchema),
+	async (c) => {
+		const db = c.get("db");
+		const { name } = c.req.valid("json");
+		const result = await createApiKey(db, name);
+
+		return c.json(
+			{
+				id: result.id,
+				name: result.name,
+				key: result.rawKey,
+				prefix: result.keyPrefix,
+			},
+			201,
+		);
+	},
+);
+
+app.delete("/keys/:id", requireAuth, (c) => {
+	const db = c.get("db");
+	const id = Number(c.req.param("id"));
+	deleteApiKey(db, id);
+	return c.json({ ok: true });
+});
+
+export const authRoutes = app;

tests/routes/auth.test.ts

@@ -0,0 +1,128 @@
+import { beforeEach, describe, expect, it } from "bun:test";
+import { Hono } from "hono";
+import { authRoutes } from "../../src/server/routes/auth.ts";
+import { createTestDb } from "../helpers/db.ts";
+
+function createTestApp() {
+	const db = createTestDb();
+	const app = new Hono<{ Variables: { db?: any } }>();
+
+	app.use("*", async (c, next) => {
+		c.set("db", db);
+		await next();
+	});
+
+	app.route("/api/auth", authRoutes);
+	return { app, db };
+}
+
+describe("Auth Routes", () => {
+	let app: Hono;
+
+	beforeEach(() => {
+		const testApp = createTestApp();
+		app = testApp.app;
+	});
+
+	describe("GET /api/auth/me", () => {
+		it("returns null user and setupRequired true when no users exist", async () => {
+			const res = await app.request("/api/auth/me");
+			expect(res.status).toBe(200);
+			const body = await res.json();
+			expect(body.user).toBeNull();
+			expect(body.setupRequired).toBe(true);
+		});
+	});
+
+	describe("POST /api/auth/setup", () => {
+		it("creates first user and returns 201", async () => {
+			const res = await app.request("/api/auth/setup", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ username: "admin", password: "secret123" }),
+			});
+
+			expect(res.status).toBe(201);
+			const body = await res.json();
+			expect(body.username).toBe("admin");
+
+			// Should set a session cookie
+			const setCookie = res.headers.get("set-cookie");
+			expect(setCookie).toContain("gearbox_session");
+		});
+
+		it("rejects second setup attempt with 403", async () => {
+			// First setup
+			await app.request("/api/auth/setup", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ username: "admin", password: "secret123" }),
+			});
+
+			// Second attempt
+			const res = await app.request("/api/auth/setup", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ username: "other", password: "secret456" }),
+			});
+
+			expect(res.status).toBe(403);
+		});
+
+		it("rejects password shorter than 6 characters", async () => {
+			const res = await app.request("/api/auth/setup", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ username: "admin", password: "short" }),
+			});
+
+			expect(res.status).toBe(400);
+		});
+	});
+
+	describe("POST /api/auth/login", () => {
+		beforeEach(async () => {
+			// Create a user first
+			await app.request("/api/auth/setup", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ username: "admin", password: "secret123" }),
+			});
+		});
+
+		it("returns session cookie on valid login", async () => {
+			const res = await app.request("/api/auth/login", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ username: "admin", password: "secret123" }),
+			});
+
+			expect(res.status).toBe(200);
+			const body = await res.json();
+			expect(body.username).toBe("admin");
+
+			const setCookie = res.headers.get("set-cookie");
+			expect(setCookie).toContain("gearbox_session");
+		});
+
+		it("rejects invalid credentials with 401", async () => {
+			const res = await app.request("/api/auth/login", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ username: "admin", password: "wrongpassword" }),
+			});
+
+			expect(res.status).toBe(401);
+		});
+	});
+
+	describe("POST /api/auth/logout", () => {
+		it("clears session cookie", async () => {
+			const res = await app.request("/api/auth/logout", {
+				method: "POST",
+			});
+
+			expect(res.status).toBe(200);
+		});
+	});
+});