auth-yes/server/main.test.ts

import { assert, assertEquals, assertExists } from "jsr:@std/assert";
import { stub } from "jsr:@std/testing/mock";
import { app } from "./main.ts";
import { sqlWrapper } from "./db.ts";
import { valkey } from "./valkey.ts";
import { spireWrapper } from "./spire_ffi.ts";
import { auditWrapper } from "./audit.ts";
import { rateLimitWrapper } from "./ratelimit.ts";

const originalSql = sqlWrapper.sql;

function setMockSql(mockImpl: () => Promise<any>) {
  sqlWrapper.sql = mockImpl as any;
}

function restoreMockSql() {
  sqlWrapper.sql = originalSql;
}

// Bypass rate limit in tests to prevent Valkey Multi errors

rateLimitWrapper.checkRateLimit = () => Promise.resolve(true);

Deno.test("Tier 1 & 2: GET /api/forward-auth - Valid session", async () => {
  const mockUser = {
    id: "user-id-1",
    username: "alice",
    account_status: "active",
  };

  setMockSql(() => Promise.resolve([mockUser]));

  let queryCount = 0;

  setMockSql(() => {
    queryCount++;
    if (queryCount === 1) return Promise.resolve([mockUser]); // User lookup
    return Promise.resolve([]); // isGlobalAdmin lookup
  });

  const valkeyStub = stub(valkey, "get", (key: any) => {
    const k = String(key);
    if (k.startsWith("auth:app_by_host:")) {
      return Promise.resolve(
        JSON.stringify({ id: "app-id-1", name: "test-app" }),
      );
    }
    if (k.startsWith("auth:grants:")) {
      return Promise.resolve("viewer");
    }
    return Promise.resolve(
      JSON.stringify({ uuid: "user-id-1", username: "alice" }),
    );
  });

  const req = new Request("http://localhost/api/forward-auth", {
    headers: {
      Cookie: "session_id=mock-session-id",
      "X-Forwarded-Host": "test.app.local",
    },
  });

  const res = await app.request(req);
  assertEquals(res.status, 200);
  assertEquals(res.headers.get("X-Forwarded-User"), "alice");
  assertEquals(res.headers.get("X-Forwarded-User-Id"), "user-id-1");
  assertEquals(res.headers.get("X-Forwarded-Scopes"), "viewer");
  assertEquals(res.headers.get("X-Forwarded-App-Id"), "app-id-1");

  restoreMockSql();
  valkeyStub.restore();
});

Deno.test("Tier 1 & 2: GET /api/forward-auth - Missing session (API request)", async () => {
  const req = new Request("http://localhost/api/forward-auth", {
    headers: { "X-Forwarded-Host": "test.app.local" },
  });

  const valkeyStub = stub(valkey, "get", (key: any) => {
    const k = String(key);
    if (k.startsWith("auth:app_by_host:")) {
      return Promise.resolve(
        JSON.stringify({ id: "app-id-1", name: "test-app" }),
      );
    }
    return Promise.resolve(null);
  });

  const res = await app.request(req);
  assertEquals(res.status, 401);
  valkeyStub.restore();
});

Deno.test("Tier 1 & 2: GET /api/forward-auth - Missing session (Browser request with text/html)", async () => {
  const req = new Request("http://localhost/api/forward-auth", {
    headers: {
      "X-Forwarded-Host": "ed-droid.atyg.org",
      "X-Forwarded-Uri": "/control-panel",
      "X-Forwarded-Proto": "https",
      Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    },
  });

  const valkeyStub = stub(valkey, "get", (key: any) => {
    const k = String(key);
    if (k.startsWith("auth:app_by_host:")) {
      return Promise.resolve(
        JSON.stringify({ id: "app-id-1", name: "ed-droid" }),
      );
    }
    return Promise.resolve(null);
  });

  const res = await app.request(req);
  assertEquals(res.status, 302);
  const location = res.headers.get("Location");
  assertExists(location);
  assertEquals(
    location?.includes(
      "login?redirect=https%3A%2F%2Fed-droid.atyg.org%2Fcontrol-panel",
    ),
    true,
  );
  valkeyStub.restore();
});

Deno.test("Tier 1 & 2: GET /api/forward-auth - Expired session", async () => {
  const valkeyStub = stub(valkey, "get", (key: any) => {
    const k = String(key);
    if (k.startsWith("auth:app_by_host:")) {
      return Promise.resolve(
        JSON.stringify({ id: "app-id-1", name: "test-app" }),
      );
    }
    return Promise.resolve(null);
  });

  const req = new Request("http://localhost/api/forward-auth", {
    headers: {
      Cookie: "session_id=expired-session-id",
      "X-Forwarded-Host": "test.app.local",
    },
  });
  const res = await app.request(req);
  assertEquals(res.status, 401);
  valkeyStub.restore();
});

Deno.test("Tier 1 & 2: GET /api/forward-auth - Suspended account", async () => {
  const mockUser = {
    id: "user-id-1",
    username: "alice",
    account_status: "suspended",
  };

  setMockSql(() => Promise.resolve([mockUser]));

  const valkeyStub = stub(valkey, "get", (key: any) => {
    const k = String(key);
    if (k.startsWith("auth:app_by_host:")) {
      return Promise.resolve(
        JSON.stringify({ id: "app-id-1", name: "test-app" }),
      );
    }
    return Promise.resolve(
      JSON.stringify({ uuid: "user-id-1", username: "alice" }),
    );
  });

  const req = new Request("http://localhost/api/forward-auth", {
    headers: {
      Cookie: "session_id=mock-session-id",
      "X-Forwarded-Host": "test.app.local",
    },
  });
  const res = await app.request(req);
  assertEquals(res.status, 403);
  assertEquals(await res.text(), "Forbidden: Account inactive");

  restoreMockSql();
  valkeyStub.restore();
});

Deno.test("Tier 3: ValidateSession ConnectRPC - Default-Deny", async () => {
  const originalExtract = spireWrapper.extractSpiffeIdFromCert;
  spireWrapper.extractSpiffeIdFromCert = () => "spiffe://system.local/ed-droid";

  let queryCount = 0;
  setMockSql(() => {
    queryCount++;
    if (queryCount === 1) {
      return Promise.resolve([{ id: "app-1" }]);
    } else {
      return Promise.resolve([]);
    }
  });

  // Re-define valkey stub
  const valkeyStub = stub(valkey, "get", () => {
    return Promise.resolve(
      JSON.stringify({ uuid: "user-1", username: "alice" }),
    );
  });

  let auditCalled = false;
  const originalAudit = auditWrapper.auditLog;
  auditWrapper.auditLog = (..._args: any[]) => {
    auditCalled = true;
  };

  const req = new Request(
    "http://localhost/auth.v1.AuthService/ValidateSession",
    {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "x-peer-cert": "cert-data",
      },
      // The Connect protocol expects token under a specific format or we can just send it,
      // actually our handler looks at `req.token` via connect protocol, which translates to the json body for unary requests in Connect HTTP POST.
      // However, the `ValidateSession` requires an argument structured as `{ "token": "..." }`.
      body: JSON.stringify({ token: "some-session-token" }),
    },
  );

  const res = await app.request(req);
  const data = await res.json();

  // The data structure from universal handler might wrap the response.
  // Connect responses might look like just the json object.
  // We'll check if valid is false.

  if (data.valid !== undefined) {
    assertEquals(data.valid, false);
  } else {
    // If not direct format, just ensure valid is falsy or check for error
    assertEquals(!!data.valid, false);
  }

  assertEquals(auditCalled, true);

  spireWrapper.extractSpiffeIdFromCert = originalExtract;
  restoreMockSql();
  valkeyStub.restore();
  auditWrapper.auditLog = originalAudit;
});

Deno.test("Tier 3: ValidateSession ConnectRPC - Valid RBAC Grant", async () => {
  const originalExtract = spireWrapper.extractSpiffeIdFromCert;
  spireWrapper.extractSpiffeIdFromCert = () => "spiffe://system.local/ed-droid";

  let queryCount = 0;
  setMockSql(() => {
    queryCount++;
    if (queryCount === 1) {
      return Promise.resolve([{ id: "app-1" }]);
    } else {
      return Promise.resolve([{ role: "viewer" }]);
    }
  });

  const valkeyStub = stub(valkey, "get", () => {
    return Promise.resolve(
      JSON.stringify({ uuid: "user-1", username: "alice" }),
    );
  });

  const req = new Request(
    "http://localhost/auth.v1.AuthService/ValidateSession",
    {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "x-peer-cert": "cert-data",
      },
      body: JSON.stringify({ token: "some-session-token" }),
    },
  );

  const res = await app.request(req);
  const data = await res.json();

  if (data.valid !== undefined) {
    assertEquals(data.valid, true);
    assertEquals(data.uuid, "user-1");
    assertEquals(data.scopes[0], "viewer");
  }

  spireWrapper.extractSpiffeIdFromCert = originalExtract;
  restoreMockSql();
  valkeyStub.restore();
});

Deno.test("Tier 3: ValidateSession ConnectRPC - SPIFFE Attestation Failure", async () => {
  const originalExtract = spireWrapper.extractSpiffeIdFromCert;
  spireWrapper.extractSpiffeIdFromCert = () => null;

  const req = new Request(
    "http://localhost/auth.v1.AuthService/ValidateSession",
    {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "x-peer-cert": "invalid-cert",
      },
      body: JSON.stringify({ token: "some-session-token" }),
    },
  );

  const res = await app.request(req);
  const data = await res.json();

  if (data.valid !== undefined) {
    assertEquals(data.valid, false);
  } else {
    assertEquals(!!data.valid, false);
  }

  spireWrapper.extractSpiffeIdFromCert = originalExtract;
});

Deno.test("Phase 4: Audit Ledger Verification - Login failed", async () => {
  const mockUser = {
    id: "user-2",
    username: "bob",
    account_status: "suspended",
  };

  let queryCount = 0;
  setMockSql(() => {
    queryCount++;
    if (queryCount === 1) {
      return Promise.resolve([{ user_id: "user-2" }]);
    } else {
      return Promise.resolve([mockUser]);
    }
  });

  let auditArgs: any[] = [];
  const originalAudit = auditWrapper.auditLog;
  auditWrapper.auditLog = (...args: any[]) => {
    auditArgs = args;
  };

  const req = new Request("http://localhost/api/login/verify", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Cookie": "expected_authentication_challenge=challenge",
    },
    body: JSON.stringify({ response: { id: "passkey-id" } }),
  });

  const res = await app.request(req);
  assertEquals(res.status, 403);

  assertEquals(auditArgs.length > 0, true);
  assertEquals(auditArgs[1], "login_failed");

  restoreMockSql();
  auditWrapper.auditLog = originalAudit;
});

Deno.test("WebAuthn - /api/register/verify extracts PRF", async () => {
  const { app } = await import("./main.ts");

  const req = new Request("http://localhost/api/register/verify", {
    method: "POST",
    body: JSON.stringify({}),
  });
  const res = await app.fetch(req);
  assertEquals(res.status, 400);
  const json = await res.json();
  assertEquals(json.error, "inviteCode or upgrade_session required");
});

Deno.test("WebAuthn - /api/login/challenge handles username for PRF", async () => {
  const { app } = await import("./main.ts");
  const { sqlWrapper } = await import("./db.ts");

  const originalSql = sqlWrapper.sql;
  try {
    const mockSql = (strings: any, ..._values: any[]) => {
      const query = strings.join("?");
      if (query.includes("SELECT id FROM users WHERE username =")) {
        return Promise.resolve([{ id: "mock-user-id" }]);
      }
      if (query.includes("FROM passkeys WHERE user_id =")) {
        return Promise.resolve([{
          credential_id: "mock-cred",
          prf_enabled: true,
          prf_salt: "bW9jay1zYWx0", // "mock-salt"
        }]);
      }
      return Promise.resolve([]);
    };
    sqlWrapper.sql = mockSql as any;

    const req = new Request("http://localhost/api/login/challenge", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ username: "testuser" }),
    });
    const res = await app.fetch(req);
    assertEquals(res.status, 200);

    const json = await res.json();
    assertExists(json.options);
    assertExists(json.options.extensions);
    assertExists(json.options.extensions.prf);
    assertExists(json.options.extensions.prf.evalByCredential);
    assertExists(json.options.extensions.prf.evalByCredential["mock-cred"]);
  } finally {
    sqlWrapper.sql = originalSql;
  }
});

Deno.test("Cookie Domain Scoping - getCookieDomain derives wildcard parent domain", async () => {
  const { getCookieDomain } = await import("./auth-session.ts");

  assertEquals(getCookieDomain("auth.atyg.org"), ".atyg.org");
  assertEquals(getCookieDomain("ed-droid.atyg.org"), ".atyg.org");
  assertEquals(getCookieDomain("atyg.org"), ".atyg.org");
  assertEquals(getCookieDomain("localhost"), undefined);
});

Deno.test("Tier 1 & 2: GET /api/forward-auth - Unregistered domain (API)", async () => {
  // Override sql to return no app
  sqlWrapper.sql = (async () => []) as any;
  const req = new Request("http://localhost/api/forward-auth", {
    headers: {
      "X-Forwarded-Host": "unknown.atyg.org",
    },
  });
  const res = await app.fetch(req);
  assertEquals(res.status, 403);
  const data = await res.json();
  assertEquals(data.error, "Application not registered");
});

Deno.test("Tier 1 & 2: GET /api/forward-auth - Unregistered domain (Browser)", async () => {
  // Override sql to return no app
  sqlWrapper.sql = (async () => []) as any;
  const req = new Request("http://localhost/api/forward-auth", {
    headers: {
      "X-Forwarded-Host": "unknown.atyg.org",
      "Accept": "text/html",
    },
  });
  const res = await app.fetch(req);
  assertEquals(res.status, 302);
  const location = res.headers.get("Location") || "";
  assertEquals(
    true,
    location.includes("/errors/unregistered?host=unknown.atyg.org"),
  );
});

Deno.test("Tier 1 & 2: GET /api/forward-auth - Dynamic Bypass (is_public)", async () => {
  // Override sql to return public app
  sqlWrapper.sql = (async (strings: any) => {
    if (strings[0].includes("FROM apps")) {
      return [{
        id: "public-app-id",
        name: "Public App",
        is_public: true,
      }];
    }
    return [];
  }) as any;

  const req = new Request("http://localhost/api/forward-auth", {
    headers: {
      "X-Forwarded-Host": "public.atyg.org",
    },
  });
  const res = await app.fetch(req);
  assertEquals(res.status, 200);
  assertEquals(res.headers.get("X-Forwarded-App-Id"), "public-app-id");
});

Deno.test("Tier 1 & 2: GET /api/forward-auth - Dynamic Bypass (bypass_paths)", async () => {
  // Override sql to return app with bypass path
  sqlWrapper.sql = (async (strings: any) => {
    if (strings[0].includes("FROM apps")) {
      return [{
        id: "bypass-app-id",
        name: "Bypass App",
        bypass_paths: ["/api/public/*"],
      }];
    }
    return [];
  }) as any;

  const req = new Request("http://localhost/api/forward-auth", {
    headers: {
      "X-Forwarded-Host": "bypass.atyg.org",
      "X-Forwarded-Uri": "/api/public/status",
    },
  });
  const res = await app.fetch(req);
  assertEquals(res.status, 200);
});

Deno.test("Tier 1 & 2: POST /api/guests/sandbox - Creates guest session", async () => {
  const { valkey } = await import("./valkey.ts");
  // Mock valkey.setex to prevent connection errors during tests
  valkey.setex = async () => "OK" as any;

  const req = new Request("http://localhost/api/guests/sandbox", {
    method: "POST",
  });
  const res = await app.fetch(req);
  assertEquals(res.status, 200);
  const data = await res.json();
  assertEquals(data.success, true);
  assertEquals(true, !!data.sessionId);
  assertEquals(true, !!data.guestUuid);
});

Deno.test("Logout Return-Path Validation", async (t) => {
  await t.step("GET /logout preserves valid redirect", async () => {
    const req = new Request(
      "http://localhost/logout?redirect=https://ed-droid.atyg.org/",
    );
    const res = await app.fetch(req);
    assertEquals(res.status, 302);
    assertEquals(
      res.headers.get("Location"),
      "https://ed-droid.atyg.org/",
    );
  });

  await t.step("GET /logout intercepts malicious redirect", async () => {
    const res = await app.request("/logout?redirect=https://evil.com", {
      method: "GET",
    });
    assertEquals(res.status, 302);
    const location = res.headers.get("location");
    assertExists(location);
    // Malicious redirect should be discarded, so it just redirects to /login
    assertEquals(location, "/login");
  });
});

Deno.test("App Launchpad Zero-Knowledge Query Logic", async (t) => {
  await t.step(
    "GET /dashboard redirects to /login if unauthenticated",
    async () => {
      const res = await app.request("/dashboard", { method: "GET" });
      assertEquals(res.status, 302);
      assertEquals(res.headers.get("location"), "/login");
    },
  );

  await t.step("GET /dashboard renders for admin", async () => {
    const mockGet = (key: string) => {
      if (key === "valid_session") {
        return Promise.resolve(
          JSON.stringify({ uuid: "admin-uuid", username: "admin" }),
        );
      }
      return Promise.resolve(null);
    };
    valkey.get = mockGet as any;

    const originalSql = sqlWrapper.sql;
    sqlWrapper.sql = (strings: any, ..._values: any[]) => {
      const query = strings.join("?");
      if (query.includes("g.role = 'admin'")) {
        return Promise.resolve([{ id: "grant-id" }]);
      }
      if (
        query.includes("SELECT id, name, description, domain, 'Admin' as role")
      ) {
        return Promise.resolve([
          {
            id: "app1",
            name: "App 1",
            description: "Desc",
            domain: "app1.com",
            role: "Admin",
          },
          {
            id: "app2",
            name: "App 2",
            description: "Desc",
            domain: "app2.com",
            role: "Admin",
          },
        ]);
      }
      return Promise.resolve([]);
    };

    try {
      const res = await app.request("/dashboard", {
        method: "GET",
        headers: { Cookie: "session_id=valid_session" },
      });
      assertEquals(res.status, 200);
      const text = await res.text();
      assert(text.includes("App 1"));
      assert(text.includes("App 2"));
      assert(text.includes("Admin Console")); // Layout link
    } finally {
      sqlWrapper.sql = originalSql;
    }
  });

  await t.step("GET /dashboard renders for regular user", async () => {
    const mockGet = (key: string) => {
      if (key === "valid_session") {
        return Promise.resolve(
          JSON.stringify({ uuid: "user-uuid", username: "user" }),
        );
      }
      return Promise.resolve(null);
    };
    valkey.get = mockGet as any;

    const originalSql = sqlWrapper.sql;
    sqlWrapper.sql = (strings: any, ..._values: any[]) => {
      const query = strings.join("?");
      if (query.includes("g.role = 'admin'")) {
        return Promise.resolve([]); // Not admin
      }
      if (query.includes("ORDER BY created_at ASC LIMIT 1")) {
        return Promise.resolve([{ id: "different-user" }]);
      }
      if (
        query.includes("SELECT a.id, a.name, a.description, a.domain, g.role")
      ) {
        return Promise.resolve([
          {
            id: "app1",
            name: "App 1",
            description: "Desc",
            domain: "app1.com",
            role: "Viewer",
          },
        ]);
      }
      return Promise.resolve([]);
    };

    try {
      const res = await app.request("/dashboard", {
        method: "GET",
        headers: { Cookie: "session_id=valid_session" },
      });
      assertEquals(res.status, 200);
      const text = await res.text();
      assert(text.includes("App 1"));
      assert(!text.includes("App 2"));
      assert(!text.includes("Admin Console")); // Layout link should be missing
    } finally {
      sqlWrapper.sql = originalSql;
    }
  });
});