import { mkdtempSync } from "node:fs";import { tmpdir } from "node:os";import { join } from "node:path"; import { afterAll, expect, test } from "@effect/vitest"; import { mintInviteCode } from "../testing/mint-invite"; // Real Better Auth path: set a secret + bootstrap admin before importing.// Better Auth skips origin checks in test mode by default; this suite exercises// the production check so the trusted-origin cases below cover the real path.process.env.NODE_ENV = "production";process.env.TEST = "false";process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-auth-"));process.env.BETTER_AUTH_SECRET = "test-secret-0123456789-abcdefghijklmnop-qrstuv";process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@test.local";process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-password-123";process.env.EXECUTOR_WEB_BASE_URL = "https://executor.example.com";process.env.EXECUTOR_TRUSTED_ORIGINS = "http://executor.home.arpa:4788"; const { makeSelfHostApiHandler } = await import("../app"); const { handler, dispose } = await makeSelfHostApiHandler();afterAll(() => dispose()); const BASE = "http://localhost:4788"; test("an HTTP trusted alias receives a usable session cookie with an HTTPS canonical URL", async () => { const alias = "http://executor.home.arpa:4788"; const signIn = await handler( new Request(`${alias}/api/auth/sign-in/email`, { method: "POST", headers: { "content-type": "application/json", origin: alias, "sec-fetch-dest": "empty", "sec-fetch-mode": "cors", "sec-fetch-site": "same-origin", }, body: JSON.stringify({ email: "admin@test.local", password: "admin-password-123", }), }), ); expect(signIn.status).toBe(200); const sessionCookie = signIn.headers.get("set-cookie"); expect(sessionCookie).toContain("better-auth.session_token="); expect(sessionCookie).not.toMatch(/(?:^|;\s*)Secure(?:;|$)/i); expect(sessionCookie).not.toContain("__Secure-");}); test("an explicitly trusted browser alias can sign up without changing the canonical base URL", async () => { const alias = "http://executor.home.arpa:4788"; const inviteCode = await mintInviteCode(handler); const signUp = await handler( new Request(`${alias}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json", origin: alias, "sec-fetch-dest": "empty", "sec-fetch-mode": "cors", "sec-fetch-site": "same-origin", }, body: JSON.stringify({ email: "trusted-alias@test.local", password: "member-password-123", name: "Trusted Alias", inviteCode, }), }), ); expect(signUp.status).toBe(200);}); test("an unlisted browser alias remains blocked", async () => { const alias = "http://untrusted.home.arpa:4788"; const inviteCode = await mintInviteCode(handler); const signUp = await handler( new Request(`${alias}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json", origin: alias, "sec-fetch-dest": "empty", "sec-fetch-mode": "cors", "sec-fetch-site": "same-origin", }, body: JSON.stringify({ email: "untrusted-alias@test.local", password: "member-password-123", name: "Untrusted Alias", inviteCode, }), }), ); expect(signUp.status).toBe(403);}); test("migrations create both the Better Auth and FumaDB executor schema regions", async () => { // Open a SEPARATE libSQL connection to the same file Better Auth (via its own // LibsqlDialect connection) and the FumaDB drizzle client wrote to. That this // connection can read Better Auth's tables AND rows proves the cross-connection // invariant: there is no shared in-process handle anymore, yet a row Better // Auth wrote is immediately visible here on the same file: URL. const { createClient } = await import("@libsql/client"); const db = createClient({ url: `file:${join(process.env.EXECUTOR_DATA_DIR!, "data.db")}`, }); const names = (await db.execute("SELECT name FROM sqlite_master WHERE type='table'")).rows.map( // oxlint-disable-next-line executor/no-redundant-primitive-cast -- boundary: sqlite_master.name is TEXT; narrow libSQL's SQLValue to string for the table-name list (r) => r.name as string, ); // Better Auth tables for (const t of ["user", "session", "account", "organization", "member"]) { expect(names).toContain(t); } // FumaDB executor tables coexist in the same file (v2: a connection IS the // credential, so the `connection` table replaces the v1 `secret` table). expect(names).toContain("connection"); // CROSS-CONNECTION PROOF: the bootstrap admin Better Auth wrote through its // LibsqlDialect connection is readable through this independent connection. // oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT column is the schema contract for the Better Auth `user` row read off this independent libSQL connection const admin = ( await db.execute({ sql: "SELECT email FROM user WHERE email = ?", args: ["admin@test.local"], }) ).rows[0] as unknown as { email: string } | undefined; expect(admin?.email).toBe("admin@test.local"); db.close();}); test("sign-up issues a bearer token and resolves to a per-user org-pinned identity", async () => { const inviteCode = await mintInviteCode(handler); const signUp = await handler( new Request(`${BASE}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email: "member@test.local", password: "member-password-123", name: "Member", inviteCode, }), }), ); expect(signUp.status).toBe(200); const token = signUp.headers.get("set-auth-token"); expect(token).toBeTruthy(); // The bearer token resolves to the user pinned to their own org (the v2 binding // is `{ tenant: org, subject: user }`; `/api/account/me` reflects both). const me = await handler( new Request("http://localhost/api/account/me", { headers: { authorization: `Bearer ${token}` }, }), ); expect(me.status).toBe(200); const body = (await me.json()) as { user: { id: string; email: string }; organization: { id: string; name: string } | null; }; expect(body.user.email).toBe("member@test.local"); expect(body.organization).not.toBeNull(); expect(body.organization!.id).toBeTruthy();}); test("self-host API keys are not capped by Better Auth's default request limit", async () => { const inviteCode = await mintInviteCode(handler); const signUp = await handler( new Request(`${BASE}/api/auth/sign-up/email`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email: "key-user@test.local", password: "member-password-123", name: "Key User", inviteCode, }), }), ); expect(signUp.status).toBe(200); const token = signUp.headers.get("set-auth-token"); expect(token).toBeTruthy(); const createKey = await handler( new Request(`${BASE}/api/account/api-keys`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json", }, body: JSON.stringify({ name: "MCP bootstrap" }), }), ); expect(createKey.status).toBe(200); const keyBody = (await createKey.json()) as { value: string }; for (let i = 0; i < 12; i++) { const me = await handler( new Request(`${BASE}/api/account/me`, { headers: { "x-api-key": keyBody.value }, }), ); expect(me.status).toBe(200); }}); test("an unauthenticated request is rejected with 401", async () => { const res = await handler(new Request("http://localhost/api/account/me")); expect(res.status).toBe(401);});
import { mkdtempSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterAll, expect, test } from "@effect/vitest";
import { mintInviteCode } from "../testing/mint-invite";
// Real Better Auth path: set a secret + bootstrap admin before importing.
// Better Auth skips origin checks in test mode by default; this suite exercises
// the production check so the trusted-origin cases below cover the real path.
process.env.NODE_ENV = "production";
process.env.TEST = "false";
process.env.EXECUTOR_DATA_DIR = mkdtempSync(join(tmpdir(), "eh-auth-"));
process.env.BETTER_AUTH_SECRET = "test-secret-0123456789-abcdefghijklmnop-qrstuv";
process.env.EXECUTOR_BOOTSTRAP_ADMIN_EMAIL = "admin@test.local";
process.env.EXECUTOR_BOOTSTRAP_ADMIN_PASSWORD = "admin-password-123";
process.env.EXECUTOR_WEB_BASE_URL = "https://executor.example.com";
process.env.EXECUTOR_TRUSTED_ORIGINS = "http://executor.home.arpa:4788";
const { makeSelfHostApiHandler } = await import("../app");
const { handler, dispose } = await makeSelfHostApiHandler();
afterAll(() => dispose());
const BASE = "http://localhost:4788";
test("an HTTP trusted alias receives a usable session cookie with an HTTPS canonical URL", async () => {
const alias = "http://executor.home.arpa:4788";
const signIn = await handler(
new Request(`${alias}/api/auth/sign-in/email`, {
method: "POST",
headers: {
"content-type": "application/json",
origin: alias,
"sec-fetch-dest": "empty",
"sec-fetch-mode": "cors",
"sec-fetch-site": "same-origin",
},
body: JSON.stringify({
email: "admin@test.local",
password: "admin-password-123",
}),
}),
);
expect(signIn.status).toBe(200);
const sessionCookie = signIn.headers.get("set-cookie");
expect(sessionCookie).toContain("better-auth.session_token=");
expect(sessionCookie).not.toMatch(/(?:^|;\s*)Secure(?:;|$)/i);
expect(sessionCookie).not.toContain("__Secure-");
});
test("an explicitly trusted browser alias can sign up without changing the canonical base URL", async () => {
const alias = "http://executor.home.arpa:4788";
const inviteCode = await mintInviteCode(handler);
const signUp = await handler(
new Request(`${alias}/api/auth/sign-up/email`, {
method: "POST",
headers: {
"content-type": "application/json",
origin: alias,
"sec-fetch-dest": "empty",
"sec-fetch-mode": "cors",
"sec-fetch-site": "same-origin",
},
body: JSON.stringify({
email: "trusted-alias@test.local",
password: "member-password-123",
name: "Trusted Alias",
inviteCode,
}),
}),
);
expect(signUp.status).toBe(200);
});
test("an unlisted browser alias remains blocked", async () => {
const alias = "http://untrusted.home.arpa:4788";
const inviteCode = await mintInviteCode(handler);
const signUp = await handler(
new Request(`${alias}/api/auth/sign-up/email`, {
method: "POST",
headers: {
"content-type": "application/json",
origin: alias,
"sec-fetch-dest": "empty",
"sec-fetch-mode": "cors",
"sec-fetch-site": "same-origin",
},
body: JSON.stringify({
email: "untrusted-alias@test.local",
password: "member-password-123",
name: "Untrusted Alias",
inviteCode,
}),
}),
);
expect(signUp.status).toBe(403);
});
test("migrations create both the Better Auth and FumaDB executor schema regions", async () => {
// Open a SEPARATE libSQL connection to the same file Better Auth (via its own
// LibsqlDialect connection) and the FumaDB drizzle client wrote to. That this
// connection can read Better Auth's tables AND rows proves the cross-connection
// invariant: there is no shared in-process handle anymore, yet a row Better
// Auth wrote is immediately visible here on the same file: URL.
const { createClient } = await import("@libsql/client");
const db = createClient({
url: `file:${join(process.env.EXECUTOR_DATA_DIR!, "data.db")}`,
});
const names = (await db.execute("SELECT name FROM sqlite_master WHERE type='table'")).rows.map(
// oxlint-disable-next-line executor/no-redundant-primitive-cast -- boundary: sqlite_master.name is TEXT; narrow libSQL's SQLValue to string for the table-name list
(r) => r.name as string,
);
// Better Auth tables
for (const t of ["user", "session", "account", "organization", "member"]) {
expect(names).toContain(t);
}
// FumaDB executor tables coexist in the same file (v2: a connection IS the
// credential, so the `connection` table replaces the v1 `secret` table).
expect(names).toContain("connection");
// CROSS-CONNECTION PROOF: the bootstrap admin Better Auth wrote through its
// LibsqlDialect connection is readable through this independent connection.
// oxlint-disable-next-line executor/no-double-cast -- boundary: the SELECT column is the schema contract for the Better Auth `user` row read off this independent libSQL connection
const admin = (
await db.execute({
sql: "SELECT email FROM user WHERE email = ?",
args: ["admin@test.local"],
})
).rows[0] as unknown as { email: string } | undefined;
expect(admin?.email).toBe("admin@test.local");
db.close();
});
test("sign-up issues a bearer token and resolves to a per-user org-pinned identity", async () => {
const inviteCode = await mintInviteCode(handler);
const signUp = await handler(
new Request(`${BASE}/api/auth/sign-up/email`, {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({
email: "member@test.local",
password: "member-password-123",
name: "Member",
inviteCode,
}),
}),
);
expect(signUp.status).toBe(200);
const token = signUp.headers.get("set-auth-token");
expect(token).toBeTruthy();
// The bearer token resolves to the user pinned to their own org (the v2 binding
// is `{ tenant: org, subject: user }`; `/api/account/me` reflects both).
const me = await handler(
new Request("http://localhost/api/account/me", {
headers: { authorization: `Bearer ${token}` },
}),
);
expect(me.status).toBe(200);
const body = (await me.json()) as {
user: { id: string; email: string };
organization: { id: string; name: string } | null;
};
expect(body.user.email).toBe("member@test.local");
expect(body.organization).not.toBeNull();
expect(body.organization!.id).toBeTruthy();
});
test("self-host API keys are not capped by Better Auth's default request limit", async () => {
const inviteCode = await mintInviteCode(handler);
const signUp = await handler(
new Request(`${BASE}/api/auth/sign-up/email`, {
method: "POST",
headers: { "content-type": "application/json" },
body: JSON.stringify({
email: "key-user@test.local",
password: "member-password-123",
name: "Key User",
inviteCode,
}),
}),
);
expect(signUp.status).toBe(200);
const token = signUp.headers.get("set-auth-token");
expect(token).toBeTruthy();
const createKey = await handler(
new Request(`${BASE}/api/account/api-keys`, {
method: "POST",
headers: {
authorization: `Bearer ${token}`,
"content-type": "application/json",
},
body: JSON.stringify({ name: "MCP bootstrap" }),
}),
);
expect(createKey.status).toBe(200);
const keyBody = (await createKey.json()) as { value: string };
for (let i = 0; i < 12; i++) {
const me = await handler(
new Request(`${BASE}/api/account/me`, {
headers: { "x-api-key": keyBody.value },
}),
);
expect(me.status).toBe(200);
}
});
test("an unauthenticated request is rejected with 401", async () => {
const res = await handler(new Request("http://localhost/api/account/me"));
expect(res.status).toBe(401);
});