konnosDashboard
platform-auth.test.ts60 lines · main
1// apps/api/src/routes/platform-auth.test.ts
2//
3// Zone-2 regression test for the /platform/* Supabase-compat surface.
4//
5// Bug: requireProjectAuth was mounted on the `/platform/*` wildcard and read
6// `c.req.param('id')`, but the routes use `:ref`. Hono resolves params against
7// the *current* matched route only, so a wildcard `.use()` never sees a named
8// param — `param('id')` was undefined → requireProjectAuth threw
9// ForbiddenError('missing project id') (403) on EVERY /platform/* request, so
10// the whole surface was dead.
11//
12// Fix: requireProjectAuth now takes a param name and is mounted PER-ROUTE as
13// requireProjectAuth('ref'). With the ref param resolved, an UN-authenticated
14// request gets past the "missing project id" check and falls through to the
15// no-credential branch → UnauthorizedError (401).
16//
17// KEY assertion: status is 401 (param resolved), NOT 403 (the old
18// missing-project-id failure). No DB is required — the 401 is thrown before
19// any access lookup.
20
21const ORIGINAL_SECRET = process.env.BRIVEN_BETTER_AUTH_SECRET;
22const ORIGINAL_DB_URL = process.env.BRIVEN_DATABASE_URL;
23process.env.BRIVEN_BETTER_AUTH_SECRET = ORIGINAL_SECRET ?? 'a'.repeat(32);
24process.env.BRIVEN_DATABASE_URL = ORIGINAL_DB_URL ?? 'postgres://test:test@127.0.0.1:5/test';
25
26import { afterAll, describe, expect, it } from 'bun:test';
27
28import type { AppEnv } from '../types/app-env.js';
29
30describe('GET /platform/pg-meta/:ref/tables auth wiring', () => {
31 it('resolves the :ref param (401 unauthenticated, not 403 missing-project-id)', async () => {
32 const { Hono } = await import('hono');
33 const { errorHandler } = await import('../middleware/error.js');
34 const { platformRouter } = await import('./platform.js');
35
36 const app = new Hono<AppEnv>();
37 // attachSession would normally set user; here we send no session/token so
38 // requireProjectAuth must fall through to its no-credential branch.
39 app.use('*', async (c, next) => {
40 c.set('user', null);
41 await next();
42 });
43 app.route('/', platformRouter);
44 app.onError(errorHandler);
45
46 const res = await app.request('/platform/pg-meta/proj_ref_test/tables');
47
48 // 401 proves the :ref param resolved (auth ran). A 403 would mean the
49 // guard never saw the project id — the original bug.
50 expect(res.status).toBe(401);
51 expect(res.status).not.toBe(403);
52 });
53});
54
55afterAll(() => {
56 if (ORIGINAL_SECRET === undefined) delete process.env.BRIVEN_BETTER_AUTH_SECRET;
57 else process.env.BRIVEN_BETTER_AUTH_SECRET = ORIGINAL_SECRET;
58 if (ORIGINAL_DB_URL === undefined) delete process.env.BRIVEN_DATABASE_URL;
59 else process.env.BRIVEN_DATABASE_URL = ORIGINAL_DB_URL;
60});