wren/glyph Public Public: anyone can read this; nobody can change it.

/**

 * The door turns away, before a byte of the body is read, exactly who the

 * table says could never pass — and nobody it would let through.

 */

import { afterAll, expect, test } from "bun:test";

import { mkdtempSync } from "node:fs";

import { tmpdir } from "node:os";

import { join } from "node:path";

import { readContract } from "./can.ts";

import { openDb } from "./db.ts";

import {

  allow,

  door,

  doorOf,

  mayKnock,

  openToStrangers,

  STRANGERS,

} from "./security.ts";

import { serve } from "./server.ts";

import { sign } from "./who.ts";

const KEY = "a-key-only-the-forge-holds";

const server = serve({

  port: 0,

  dataDir: mkdtempSync(join(tmpdir(), "app-door-")),

  identityKey: KEY,

});

const base = `http://${server.hostname}:${server.port}`;

afterAll(() => server.stop(true));

const as = (id: string, role: "user" | "admin"): Record<string, string> => {

  const identity = `${id}|${id}|${role}|${Date.now() + 60_000}`;

  return {

    "x-forge-identity": identity,

    "x-forge-signature": sign(identity, KEY),

  };

};

test("a path is a resource's door by the contract's api, and nothing else is", () => {

  expect(doorOf("GET", "/api/notes")).toEqual({

    resource: "note",

    verb: "list",

  });

  expect(doorOf("POST", "/api/notes")).toEqual({

    resource: "note",

    verb: "create",

  });

  expect(doorOf("GET", "/api/notes/7")).toEqual({

    resource: "note",

    verb: "read",

  });

  expect(doorOf("PATCH", "/api/notes/7")).toEqual({

    resource: "note",

    verb: "update",

  });

  expect(doorOf("DELETE", "/api/notes/7")).toEqual({

    resource: "note",

    verb: "delete",

  });

  expect(doorOf("GET", "/api/audit")).toEqual({

    resource: "audit",

    verb: "list",

  });

  for (const [method, path] of [

    ["PUT", "/api/notes"],

    ["GET", "/api/notes/7/x"],

    ["GET", "/api/notesy"],

    ["GET", "/api/notes/"],

    ["POST", "/notes"],

  ] as const)

    expect(doorOf(method, path)).toBeUndefined();

});

test("the door refuses only what no row would open", () => {

  const anon = { role: "anon" } as const;

  const alice = { role: "user", id: "u1", name: "alice" } as const;

  const root = { role: "admin", id: "u0", name: "root" } as const;

  expect(mayKnock(anon, "note", "list")).toBe(true);

  expect(mayKnock(anon, "note", "create")).toBe(false);

  expect(mayKnock(anon, "note", "delete")).toBe(false);

  // alice may delete a note of her own, so the door lets her ask; the action decides which.

  expect(mayKnock(alice, "note", "delete")).toBe(true);

  expect(mayKnock(alice, "audit", "list")).toBe(false);

  expect(mayKnock(root, "audit", "list")).toBe(true);

  expect(mayKnock(root, "audit", "create")).toBe(false);

});

test("a stranger is refused /api before the body is read, when the contract closes it", async () => {

  // A body past the cap: read, it would be 413. The door answers first.

  const huge = "x".repeat(128 * 1024);

  const refused = await fetch(`${base}/api/notes`, {

    method: "POST",

    headers: { "content-type": "application/json" },

    body: huge,

  });

  expect(refused.status).toBe(401);

  const signedIn = await fetch(`${base}/api/notes`, {

    method: "POST",

    headers: { "content-type": "application/json", ...as("u1", "user") },

    body: huge,

  });

  expect(signedIn.status).toBe(413);

  expect(await refused.json()).toEqual({

    error: "signin_required",

    message: "Sign in first.",

  });

  expect((await fetch(`${base}/api/audit`)).status).toBe(401);

  expect((await fetch(`${base}/api/audit/1`)).status).toBe(401);

  expect(

    (await fetch(`${base}/api/audit`, { headers: as("u1", "user") })).status,

  ).toBe(403);

  // What the table opens stays open.

  expect((await fetch(`${base}/api/notes`)).status).toBe(200);

  expect((await fetch(`${base}/api/notes/0`)).status).toBe(404);

  expect((await fetch(`${base}/openapi.json`)).status).toBe(200);

});

test("the API's description is shut to strangers when the table opens them no door", () => {

  const closed = readContract(

    JSON.stringify({

      roles: {

        anon: { above: [], held: { by: "everyone" } },

        user: { above: ["anon"], held: { by: "identity", role: "user" } },

      },

      resources: {

        note: {

          api: "/api/notes",

          can: {

            create: "user",

            read: "user",

            update: "user",

            delete: "user",

            list: "user",

          },

        },

      },

    }),

  );

  if (!closed.ok) throw new Error(closed.problems.join("; "));

  expect(openToStrangers(closed.contract)).toBe(false);

  expect(openToStrangers()).toBe(true);

});

test("strangers are rationed at the API, reads too", () => {

  const db = openDb(mkdtempSync(join(tmpdir(), "app-door-rate-")));

  const knock = () =>

    door(

      db,

      new Request("http://app/api/notes"),

      new URL("http://app/api/notes"),

      { role: "anon" },

      "203.0.113.7",

    );

  const answers = Array.from({ length: STRANGERS.burst + 5 }, knock);

  expect(answers.slice(0, STRANGERS.burst).every((a) => a === undefined)).toBe(

    true,

  );

  expect(answers.at(-1)?.status).toBe(429);

  // The page itself is not the API: a stranger reading it is never rationed here.

  expect(

    door(

      db,

      new Request("http://app/"),

      new URL("http://app/"),

      { role: "anon" },

      "203.0.113.7",

    ),

  ).toBeUndefined();

  // A bucket refills.

  const t = Date.now();

  for (let i = 0; i < 25; i++) allow("k", { burst: 20, perSecond: 2 }, t);

  expect(allow("k", { burst: 20, perSecond: 2 }, t)).toBe(false);

  expect(allow("k", { burst: 20, perSecond: 2 }, t + 1000)).toBe(true);

});