feat(core): users, sessions, invites, app tokens

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

packages/core/test/auth.test.ts

@@ -0,0 +1,109 @@
+import { expect, test } from "bun:test";
+import { forEachDialect } from "@sttracker/db/testing";
+import {
+  createAppToken,
+  createInvite,
+  getSessionUser,
+  login,
+  logout,
+  registerUser,
+  revokeAppToken,
+  verifyAppToken,
+} from "../src/auth.ts";
+import { AuthError } from "../src/errors.ts";
+
+async function code(p: Promise<unknown>): Promise<string | undefined> {
+  try {
+    await p;
+  } catch (e) {
+    return e instanceof AuthError ? e.code : "other";
+  }
+  return undefined;
+}
+
+forEachDialect("auth", (getDb) => {
+  test("first user is admin and username is lowercased", async () => {
+    const u = await registerUser(getDb(), { username: "Alice", password: "pw-one" });
+    expect(u.role).toBe("admin");
+    expect(u.username).toBe("alice");
+    expect(u.displayName).toBe("alice");
+  });
+
+  test("invalid and duplicate usernames are rejected", async () => {
+    const db = getDb();
+    expect(await code(registerUser(db, { username: "a b", password: "x" }))).toBe("invalid_username");
+    await registerUser(db, { username: "alice", password: "x" });
+    const inv = await createInvite(db, (await login(db, "alice", "x")).user.id);
+    expect(await code(registerUser(db, { username: "ALICE", password: "x", inviteCode: inv }))).toBe(
+      "username_taken",
+    );
+  });
+
+  test("second user needs a single-use invite", async () => {
+    const db = getDb();
+    const admin = await registerUser(db, { username: "alice", password: "x" });
+    expect(await code(registerUser(db, { username: "bob", password: "x" }))).toBe("invite_required");
+    expect(await code(registerUser(db, { username: "bob", password: "x", inviteCode: "nope" }))).toBe(
+      "invite_required",
+    );
+    const inv = await createInvite(db, admin.id);
+    const bob = await registerUser(db, { username: "bob", password: "x", inviteCode: inv });
+    expect(bob.role).toBe("member");
+    expect(await code(registerUser(db, { username: "carol", password: "x", inviteCode: inv }))).toBe(
+      "invite_required",
+    );
+  });
+
+  test("expired invite is rejected; members cannot create invites", async () => {
+    const db = getDb();
+    const admin = await registerUser(db, { username: "alice", password: "x" });
+    const inv = await createInvite(db, admin.id, -1);
+    expect(await code(registerUser(db, { username: "bob", password: "x", inviteCode: inv }))).toBe(
+      "invite_required",
+    );
+    const ok = await createInvite(db, admin.id);
+    const bob = await registerUser(db, { username: "bob", password: "x", inviteCode: ok });
+    expect(await code(createInvite(db, bob.id))).toBe("forbidden");
+  });
+
+  test("wrong password or unknown user -> invalid_credentials", async () => {
+    const db = getDb();
+    await registerUser(db, { username: "alice", password: "right" });
+    expect(await code(login(db, "alice", "wrong"))).toBe("invalid_credentials");
+    expect(await code(login(db, "nobody", "x"))).toBe("invalid_credentials");
+  });
+
+  test("session round-trip and logout", async () => {
+    const db = getDb();
+    await registerUser(db, { username: "alice", password: "pw" });
+    const { user, sessionToken } = await login(db, "Alice", "pw");
+    expect(await getSessionUser(db, sessionToken)).toEqual(user);
+    const stored = await db.k.selectFrom("sessions").selectAll().execute();
+    expect(stored[0]!.token_hash).not.toBe(sessionToken);
+    await logout(db, sessionToken);
+    expect(await getSessionUser(db, sessionToken)).toBeNull();
+    expect(await getSessionUser(db, "garbage")).toBeNull();
+  });
+
+  test("expired session returns null", async () => {
+    const db = getDb();
+    await registerUser(db, { username: "alice", password: "pw" });
+    const { sessionToken } = await login(db, "alice", "pw");
+    await db.k.updateTable("sessions").set({ expires_at: new Date(Date.now() - 1000).toISOString() }).execute();
+    expect(await getSessionUser(db, sessionToken)).toBeNull();
+  });
+
+  test("app tokens: scope check, last_used_at, revoke", async () => {
+    const db = getDb();
+    const u = await registerUser(db, { username: "alice", password: "pw" });
+    const { id, token } = await createAppToken(db, u.id, "cli", ["read"]);
+    expect(token.startsWith("stt_")).toBe(true);
+    expect(await verifyAppToken(db, token, "write")).toBeNull();
+    expect(await verifyAppToken(db, token, "read")).toEqual(u);
+    const row = await db.k.selectFrom("app_tokens").selectAll().executeTakeFirstOrThrow();
+    expect(row.last_used_at).not.toBeNull();
+    expect(await verifyAppToken(db, "stt_bogus", "read")).toBeNull();
+    await revokeAppToken(db, u.id, id);
+    expect(await verifyAppToken(db, token, "read")).toBeNull();
+  });
+});