konnosDashboard
step4-proxy-proof.mjs154 lines · main
1/**
2 * Step 4 proof: first-party proxy keeps cookies on the **app** host.
3 *
4 * Spins up:
5 * - "API" Hono with real Doltgres briven-engine FDI
6 * - "App" Hono with /api/auth/* proxy → API FDI
7 * Client hits App only; expects Set-Cookie + successful signup.
8 *
9 * cd apps/api
10 * BRIVEN_ENGINE_DATABASE_URL=postgres://postgres:devpass@127.0.0.1:5434/briven_engine?sslmode=disable \
11 * BRIVEN_DATA_PLANE_URL=postgres://postgres:devpass@127.0.0.1:5434/postgres?sslmode=disable \
12 * bun scripts/step4-proxy-proof.mjs
13 */
14
15process.env.BRIVEN_AUTH_CORE_ENABLED = 'true';
16process.env.BRIVEN_ENV = 'development';
17process.env.BRIVEN_ENGINE_DATABASE_URL =
18 process.env.BRIVEN_ENGINE_DATABASE_URL ??
19 'postgres://postgres:devpass@127.0.0.1:5434/briven_engine?sslmode=disable';
20process.env.BRIVEN_DATA_PLANE_URL =
21 process.env.BRIVEN_DATA_PLANE_URL ??
22 'postgres://postgres:devpass@127.0.0.1:5434/postgres?sslmode=disable';
23process.env.BRIVEN_API_ORIGIN = 'http://127.0.0.1:3011';
24process.env.BRIVEN_WEB_ORIGIN = 'http://127.0.0.1:3010';
25
26import { Hono } from 'hono';
27
28const { ensureBrivenEngineDatabase } = await import(
29 '../src/services/auth-core/ensure-db.ts'
30);
31const { initAuthCoreSdk } = await import('../src/services/auth-core/engine.ts');
32const { authCoreFdiRouter } = await import('../src/routes/auth-core-fdi.ts');
33const { proxyBrivenEngineAuth, appAuthPathToFdiSuffix } = await import(
34 '../../../packages/auth/src/engine/proxy.ts'
35);
36
37console.log('=== Step 4: first-party proxy (cookies on app host) ===');
38
39if (!(await ensureBrivenEngineDatabase()).ok) {
40 console.error('FAIL ensure DB');
41 process.exit(1);
42}
43if (!(await initAuthCoreSdk())) {
44 console.error('FAIL init');
45 process.exit(1);
46}
47
48// Unit-ish path mapping
49const mapped = appAuthPathToFdiSuffix('/api/auth/signup');
50console.log('path map /api/auth/signup →', mapped);
51if (mapped !== '/signup') {
52 console.error('FAIL path map');
53 process.exit(1);
54}
55
56// API server (briven-engine FDI)
57const api = new Hono();
58api.route('/', authCoreFdiRouter);
59const apiServer = Bun.serve({
60 port: 3011,
61 fetch: api.fetch,
62});
63console.log('API on', apiServer.url.href);
64
65// App server (first-party proxy)
66const app = new Hono();
67app.all('/api/auth/*', async (c) => {
68 const res = await proxyBrivenEngineAuth(c.req.raw, {
69 apiOrigin: 'http://127.0.0.1:3011',
70 projectId: 'p_step4_local',
71 proxyMount: '/api/auth',
72 });
73 return res;
74});
75app.get('/health', (c) => c.json({ app: true }));
76const appServer = Bun.serve({
77 port: 3010,
78 fetch: app.fetch,
79});
80console.log('APP on', appServer.url.href);
81
82const email = `step4_${Date.now()}@example.com`;
83const password = 'Step4Test!Pass99';
84
85// Client talks ONLY to app host
86const res = await fetch('http://127.0.0.1:3010/api/auth/signup', {
87 method: 'POST',
88 headers: {
89 'content-type': 'application/json',
90 'x-briven-project-id': 'p_step4_local',
91 },
92 body: JSON.stringify({
93 formFields: [
94 { id: 'email', value: email },
95 { id: 'password', value: password },
96 ],
97 }),
98});
99
100const body = await res.json().catch(() => ({}));
101const setCookies =
102 typeof res.headers.getSetCookie === 'function'
103 ? res.headers.getSetCookie()
104 : [res.headers.get('set-cookie')].filter(Boolean);
105
106console.log('proxy signup status', res.status);
107console.log('proxy body status', body.status);
108console.log('x-briven-proxy', res.headers.get('x-briven-proxy'));
109console.log('set-cookie count', setCookies.length);
110console.log(
111 'set-cookie sample',
112 setCookies.map((c) => String(c).slice(0, 40) + '…'),
113);
114
115const ok =
116 res.status === 200 &&
117 body.status === 'OK' &&
118 res.headers.get('x-briven-proxy') === 'first-party' &&
119 setCookies.length >= 1 &&
120 setCookies.some((c) => String(c).includes('sAccessToken'));
121
122// Sign-in through proxy too
123const res2 = await fetch('http://127.0.0.1:3010/api/auth/signin', {
124 method: 'POST',
125 headers: {
126 'content-type': 'application/json',
127 'x-briven-project-id': 'p_step4_local',
128 },
129 body: JSON.stringify({
130 formFields: [
131 { id: 'email', value: email },
132 { id: 'password', value: password },
133 ],
134 }),
135});
136const body2 = await res2.json().catch(() => ({}));
137console.log('proxy signin status', res2.status, body2.status);
138
139apiServer.stop();
140appServer.stop();
141
142if (!ok || body2.status !== 'OK') {
143 console.error('FAIL step 4', { ok, body, body2 });
144 process.exit(1);
145}
146
147console.log('');
148console.log('✔ STEP 4 PROOF OK');
149console.log(' client hit: http://127.0.0.1:3010/api/auth/* (app host)');
150console.log(' upstream: http://127.0.0.1:3011/v1/auth-core/fdi/* (API)');
151console.log(' Set-Cookie returned on app response: yes');
152console.log(' signup + signin via proxy: OK');
153console.log(' storage still Doltgres (via API)');
154process.exit(0);