konnosDashboard
step1-password-proof.mjs174 lines · main
1/**
2 * Phase 2 local proof: password sign-up + sign-in + session on Doltgres.
3 *
4 * cd apps/api
5 * BRIVEN_ENGINE_DATABASE_URL=postgres://postgres:devpass@127.0.0.1:5434/briven_engine?sslmode=disable \
6 * BRIVEN_DATA_PLANE_URL=postgres://postgres:devpass@127.0.0.1:5434/postgres?sslmode=disable \
7 * BRIVEN_AUTH_CORE_ENABLED=true \
8 * bun scripts/step1-password-proof.mjs
9 */
10
11import pg from 'pg';
12
13// Set env BEFORE importing engine modules that read env at load.
14process.env.BRIVEN_AUTH_CORE_ENABLED = process.env.BRIVEN_AUTH_CORE_ENABLED ?? 'true';
15process.env.BRIVEN_ENGINE_DATABASE_URL =
16 process.env.BRIVEN_ENGINE_DATABASE_URL ??
17 'postgres://postgres:devpass@127.0.0.1:5434/briven_engine?sslmode=disable';
18process.env.BRIVEN_DATA_PLANE_URL =
19 process.env.BRIVEN_DATA_PLANE_URL ??
20 'postgres://postgres:devpass@127.0.0.1:5434/postgres?sslmode=disable';
21process.env.BRIVEN_ENV = process.env.BRIVEN_ENV ?? 'development';
22
23const { ensureBrivenEngineDatabase } = await import(
24 '../src/services/auth-core/ensure-db.ts'
25);
26const { initAuthCoreSdk, probeBrivenEngine } = await import(
27 '../src/services/auth-core/engine.ts'
28);
29const { signUpEmailPassword, signInEmailPassword } = await import(
30 '../src/services/auth-core/emailpassword.ts'
31);
32const { createEngineSession, getSessionByHandle } = await import(
33 '../src/services/auth-core/native-session.ts'
34);
35const { getEnginePool } = await import('../src/services/auth-core/db.ts');
36
37const email = `step1_${Date.now()}@example.com`;
38const password = 'Step1Test!Pass99';
39const projectId = 'p_step1_local';
40
41console.log('=== Step 1: password login on Doltgres ===');
42console.log('engine DB', process.env.BRIVEN_ENGINE_DATABASE_URL);
43console.log('email', email);
44console.log('project', projectId);
45
46// 1) Ensure database exists on Doltgres
47const ensured = await ensureBrivenEngineDatabase();
48console.log('ensure DB', ensured);
49if (!ensured.ok) {
50 console.error('FAIL ensure DB');
51 process.exit(1);
52}
53if (ensured.host !== 'doltgres' && !String(process.env.BRIVEN_ENGINE_DATABASE_URL).includes('5434')) {
54 console.warn('warn: host check', ensured.host);
55}
56
57// 2) Init schema + pool
58const ok = await initAuthCoreSdk();
59console.log('init engine', ok);
60if (!ok) {
61 console.error('FAIL init');
62 process.exit(1);
63}
64
65const probe = await probeBrivenEngine();
66console.log('probe', {
67 ok: probe.ok,
68 storage: probe.storage,
69 message: probe.message,
70 schemaReady: probe.schemaReady,
71});
72if (!probe.ok) {
73 console.error('FAIL probe');
74 process.exit(1);
75}
76
77// 3) Sign up
78const signup = await signUpEmailPassword({
79 email,
80 password,
81 projectId,
82});
83console.log('signup', signup);
84if (signup.status !== 'OK') {
85 console.error('FAIL signup');
86 process.exit(1);
87}
88
89// 4) Sign in
90const signin = await signInEmailPassword({
91 email,
92 password,
93 projectId,
94});
95console.log('signin', signin);
96if (signin.status !== 'OK') {
97 console.error('FAIL signin');
98 process.exit(1);
99}
100
101// 5) Wrong password must fail
102const bad = await signInEmailPassword({
103 email,
104 password: 'wrong-password',
105 projectId,
106});
107console.log('wrong password', bad.status);
108if (bad.status === 'OK') {
109 console.error('FAIL: wrong password accepted');
110 process.exit(1);
111}
112
113// 6) Session row on Doltgres
114const session = await createEngineSession({
115 userId: signin.user.id,
116 tenantId: signin.user.tenantId,
117});
118console.log('session handle', session.sessionHandle);
119// Phase 2: cookie value (accessToken) must equal handle for /session/me
120if (session.accessToken !== session.sessionHandle) {
121 console.error('FAIL: accessToken must equal sessionHandle for cookie lookup');
122 process.exit(1);
123}
124
125const loaded = await getSessionByHandle(session.sessionHandle);
126console.log('session loaded', loaded);
127if (!loaded || loaded.userId !== signin.user.id) {
128 console.error('FAIL session not in Doltgres');
129 process.exit(1);
130}
131
132// Cookie-style extract + verify (no HTTP server)
133const { extractSessionHandle } = await import(
134 '../src/services/auth-core/session.ts'
135);
136const fromCookie = extractSessionHandle({
137 cookieHeader: `sAccessToken=${encodeURIComponent(session.sessionHandle)}`,
138});
139if (fromCookie !== session.sessionHandle) {
140 console.error('FAIL cookie extract', fromCookie);
141 process.exit(1);
142}
143
144// 7) Direct SQL proof
145const pool = getEnginePool();
146const users = await pool.query(
147 `SELECT id, email, tenant_id FROM be_users WHERE email = $1`,
148 [email],
149);
150const sessions = await pool.query(
151 `SELECT session_handle, user_id FROM be_sessions WHERE user_id = $1`,
152 [signin.user.id],
153);
154console.log('SQL users', users.rows);
155console.log('SQL sessions count', sessions.rowCount, sessions.rows);
156
157// Refuse if somehow not on expected local doltgres port (localhost proof)
158const host = new URL(process.env.BRIVEN_ENGINE_DATABASE_URL).hostname;
159if (host === 'postgres') {
160 console.error('FAIL: stock postgres host forbidden');
161 process.exit(1);
162}
163
164console.log('');
165console.log('✔ PHASE 2 LOCAL PROOF OK');
166console.log(' storage: Doltgres (briven_engine)');
167console.log(' sign-up: OK');
168console.log(' sign-in: OK');
169console.log(' wrong password rejected: OK');
170console.log(' session row: OK');
171console.log(' cookie handle = session handle: OK');
172console.log(' userId:', signin.user.id);
173console.log(' tenantId:', signin.user.tenantId);
174process.exit(0);