findr-api/test/api-tokens.service.test.ts

import { describe, expect, it, vi } from "vitest";
import { ForbiddenError, NotFoundError, ValidationError } from "../src/lib/errors.js";
import { SCOPES } from "../src/lib/scopes.js";
import type { ApiToken, ApiTokensRepository } from "../src/repositories/api-tokens.repository.js";
import { createApiTokensService } from "../src/services/api-tokens.service.js";

function fakeToken(over: Partial<ApiToken> = {}): ApiToken {
  return {
    id: "00000000-0000-0000-0000-000000000001",
    subject: "user-1",
    name: "KiCad plugin",
    tokenHash: "hash",
    tokenPrefix: "9c4a2b91",
    scopes: [SCOPES.PARTS_READ],
    expiresAt: null,
    lastUsedAt: null,
    revokedAt: null,
    createdAt: new Date(),
    ...over,
  };
}

function repoStub(over: Partial<ApiTokensRepository> = {}): ApiTokensRepository {
  return {
    create: vi.fn(),
    listBySubject: vi.fn(),
    findByHash: vi.fn(),
    findByIdForSubject: vi.fn(),
    revoke: vi.fn(),
    touchLastUsed: vi.fn(),
    ...over,
  } as unknown as ApiTokensRepository;
}

describe("apiTokensService.create", () => {
  it("rejects a scope the caller doesn't hold", async () => {
    const service = createApiTokensService(repoStub());
    await expect(
      service.create(
        "user-1",
        { name: "x", scopes: [SCOPES.STOCK_WRITE] },
        new Set([SCOPES.PARTS_READ]),
      ),
    ).rejects.toBeInstanceOf(ForbiddenError);
  });

  it("rejects an unknown scope", async () => {
    const service = createApiTokensService(repoStub());
    await expect(
      service.create(
        "user-1",
        { name: "x", scopes: ["not-a-real-scope"] },
        new Set(["not-a-real-scope"]),
      ),
    ).rejects.toBeInstanceOf(ValidationError);
  });

  it("rejects an empty name", async () => {
    const service = createApiTokensService(repoStub());
    await expect(
      service.create(
        "user-1",
        { name: "  ", scopes: [SCOPES.PARTS_READ] },
        new Set([SCOPES.PARTS_READ]),
      ),
    ).rejects.toBeInstanceOf(ValidationError);
  });

  it("rejects an empty scope list", async () => {
    const service = createApiTokensService(repoStub());
    await expect(
      service.create("user-1", { name: "x", scopes: [] }, new Set([SCOPES.PARTS_READ])),
    ).rejects.toBeInstanceOf(ValidationError);
  });

  it("creates a token when every scope is held, returning the plaintext once", async () => {
    const created = fakeToken();
    const create = vi.fn().mockResolvedValue(created);
    const service = createApiTokensService(repoStub({ create }));

    const result = await service.create(
      "user-1",
      { name: "KiCad plugin", scopes: [SCOPES.PARTS_READ] },
      new Set([SCOPES.PARTS_READ, SCOPES.PARTS_WRITE]),
    );

    expect(result.token).toMatch(/^fdr_/);
    expect(result).not.toHaveProperty("tokenHash");
    expect(create).toHaveBeenCalledWith(
      expect.objectContaining({ subject: "user-1", name: "KiCad plugin", expiresAt: null }),
    );
  });

  it("turns expiresInDays into a future expiresAt", async () => {
    const create = vi.fn().mockResolvedValue(fakeToken());
    const service = createApiTokensService(repoStub({ create }));
    const before = Date.now();

    await service.create(
      "user-1",
      { name: "x", scopes: [SCOPES.PARTS_READ], expiresInDays: 30 },
      new Set([SCOPES.PARTS_READ]),
    );

    const { expiresAt } = create.mock.calls[0]![0] as { expiresAt: Date };
    const thirtyDaysMs = 30 * 24 * 60 * 60 * 1000;
    expect(expiresAt.getTime()).toBeGreaterThanOrEqual(before + thirtyDaysMs - 1000);
    expect(expiresAt.getTime()).toBeLessThanOrEqual(before + thirtyDaysMs + 5000);
  });
});

describe("apiTokensService.list", () => {
  it("never exposes tokenHash", async () => {
    const listBySubject = vi.fn().mockResolvedValue([fakeToken()]);
    const service = createApiTokensService(repoStub({ listBySubject }));

    const [summary] = await service.list("user-1");

    expect(summary).not.toHaveProperty("tokenHash");
    expect(summary?.tokenPrefix).toBe("9c4a2b91");
  });
});

describe("apiTokensService.revoke", () => {
  it("throws NotFoundError when the token doesn't exist (or isn't the caller's)", async () => {
    const service = createApiTokensService(
      repoStub({ revoke: vi.fn().mockResolvedValue(undefined) }),
    );
    await expect(service.revoke("user-1", "missing-id")).rejects.toBeInstanceOf(NotFoundError);
  });

  it("resolves when the repository confirms the revoke", async () => {
    const service = createApiTokensService(
      repoStub({ revoke: vi.fn().mockResolvedValue(fakeToken({ revokedAt: new Date() })) }),
    );
    await expect(service.revoke("user-1", fakeToken().id)).resolves.toBeUndefined();
  });
});