Ekklesia/apps/api/tests/api-http.integration.ts

import { randomBytes } from "node:crypto";
import { fileURLToPath } from "node:url";
import path from "node:path";
import {
  applyModuleMigrations,
  createPostgresMigrationDatabase,
  discoverAllMigrations,
} from "@ekklesia/core/migrations";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { Client, type QueryResultRow } from "pg";
import { afterAll, describe, expect, it } from "vitest";
import { createApiRuntimeConfig } from "../src/config.js";
import { startApi, type RunningApi } from "../src/server.js";

const integrationDatabaseUrlEnvironment = "EKKLESIA_MIGRATION_TEST_DATABASE_URL";
const coreMigrationsDirectory = path.join(
  path.dirname(fileURLToPath(import.meta.url)),
  "..",
  "..",
  "..",
  "core",
  "drizzle",
);
const trackedDatabases = new Set<string>();
let databaseCounter = 0;

class IntegrationHarnessError extends Error {
  constructor(message: string) {
    super(message);
    this.name = "IntegrationHarnessError";
    this.stack = `${this.name}: ${this.message}`;
  }
}

function harnessError(message: string): IntegrationHarnessError {
  return new IntegrationHarnessError(message);
}

function baseDatabaseUrl(): string {
  const value = process.env[integrationDatabaseUrlEnvironment];
  if (typeof value !== "string" || value.trim() === "") {
    throw harnessError("The API integration database is not configured.");
  }
  try {
    const parsed = new URL(value);
    if (parsed.protocol !== "postgres:" && parsed.protocol !== "postgresql:") {
      throw new TypeError("Unsupported protocol.");
    }
  } catch {
    throw harnessError("The API integration database configuration is invalid.");
  }
  return value;
}

function quoteDatabaseName(databaseName: string): string {
  if (!/^[a-z][a-z0-9_]{0,62}$/u.test(databaseName)) {
    throw harnessError("The generated integration database name is invalid.");
  }
  return `"${databaseName}"`;
}

function makeDatabaseName(label: string): string {
  const safeLabel = label
    .toLowerCase()
    .replaceAll(/[^a-z0-9]+/gu, "_")
    .replaceAll(/^_+|_+$/gu, "")
    .slice(0, 14);
  databaseCounter += 1;
  return `ekk_api_${process.pid}_${databaseCounter}_${safeLabel || "scenario"}_${randomBytes(4).toString("hex")}`;
}

function databaseUrl(databaseName: string): string {
  const parsed = new URL(baseDatabaseUrl());
  parsed.pathname = `/${databaseName}`;
  parsed.searchParams.delete("application_name");
  return parsed.toString();
}

async function openAdministrativeClient(connectionString: string): Promise<Client> {
  const client = new Client({ connectionString });
  client.on("error", () => undefined);
  try {
    await client.connect();
    return client;
  } catch {
    try {
      await client.end();
    } catch {
      // The public harness failure remains static when connection cleanup also fails.
    }
    throw harnessError("The API integration database connection failed.");
  }
}

async function safeQuery<Row extends QueryResultRow>(
  client: Client,
  text: string,
  values: unknown[] = [],
): Promise<readonly Row[]> {
  try {
    const result = await client.query<Row>(text, values);
    return result.rows;
  } catch {
    throw harnessError("An integration database administration operation failed.");
  }
}

async function safeEnd(client: Client): Promise<void> {
  try {
    await client.end();
  } catch {
    throw harnessError("An integration database connection could not be closed.");
  }
}

async function createDatabase(databaseName: string): Promise<void> {
  const admin = await openAdministrativeClient(baseDatabaseUrl());
  try {
    await safeQuery(admin, `CREATE DATABASE ${quoteDatabaseName(databaseName)} TEMPLATE template0`);
  } finally {
    await safeEnd(admin);
  }
}

async function dropDatabase(databaseName: string): Promise<void> {
  const admin = await openAdministrativeClient(baseDatabaseUrl());
  try {
    await safeQuery(
      admin,
      "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1 AND pid <> pg_backend_pid()",
      [databaseName],
    );
    await safeQuery(
      admin,
      `DROP DATABASE IF EXISTS ${quoteDatabaseName(databaseName)} WITH (FORCE)`,
    );
    trackedDatabases.delete(databaseName);
  } finally {
    await safeEnd(admin);
  }
}

async function activeConnectionCount(databaseName: string): Promise<number> {
  const admin = await openAdministrativeClient(baseDatabaseUrl());
  try {
    const rows = await safeQuery<{ count: string }>(
      admin,
      "SELECT count(*)::text AS count FROM pg_stat_activity WHERE datname = $1",
      [databaseName],
    );
    return Number(rows[0]?.count ?? "0");
  } finally {
    await safeEnd(admin);
  }
}

async function createDisposableDatabase(label: string): Promise<{ name: string; url: string }> {
  const name = makeDatabaseName(label);
  await createDatabase(name);
  trackedDatabases.add(name);
  return { name, url: databaseUrl(name) };
}

async function applyCoreMigrations(url: string): Promise<void> {
  const emptyModulesDirectory = await mkdtemp(path.join(tmpdir(), "ekklesia-api-no-modules-"));
  try {
    const aggregate = await discoverAllMigrations({
      coreMigrationsDirectory,
      moduleDiscovery: {
        moduleSdkVersion: "0.1.0",
        modulesDirectory: emptyModulesDirectory,
        platformVersion: "0.1.0",
      },
    });
    // Phase 4A's committed migration must not have drifted while building this transport slice.
    expect(aggregate.migrations.map((entry) => entry.identity)).toEqual([
      "core:0000_identity_core_tables",
    ]);
    expect(aggregate.migrations[0]?.checksum).toBe(
      "f8f2086ef06f7a6943e8ffc4350bb010b37aed04c0a72030d2b153c986b1325f",
    );
    await applyModuleMigrations({ aggregate, database: createPostgresMigrationDatabase(url) });
  } finally {
    await rm(emptyModulesDirectory, { recursive: true, force: true });
  }
}

afterAll(async () => {
  for (const databaseName of [...trackedDatabases]) {
    await dropDatabase(databaseName).catch(() => undefined);
  }
});

const identityBaseUrl = "https://identity.example.test";
const dashboardOrigin = "https://dashboard.example.test";
const untrustedOrigin = "https://evil.example.test";

function apiOrigin(running: RunningApi): string {
  const address = running.server.address();
  if (!address || typeof address !== "object") {
    throw harnessError("The API integration server has no bound address.");
  }
  return `http://127.0.0.1:${address.port}`;
}

async function startMigratedApi(url: string): Promise<RunningApi> {
  const config = createApiRuntimeConfig(
    {
      databaseUrl: url,
      host: "127.0.0.1",
      identity: {
        baseUrl: identityBaseUrl,
        secret: "integration-test-secret-0123456789abcdefgh",
        trustedOrigins: [identityBaseUrl, dashboardOrigin],
      },
      port: 0,
    },
    { environment: "production" },
  );
  // A narrow, explicit test-only override: production composition (server.ts's `main`) never
  // sets this. Better Auth's built-in sign-in/sign-up rate limit (3 requests / 10s) would
  // otherwise reject this suite's many sequential requests.
  return startApi(config, { rateLimitOverride: { max: 1000, window: 1 } });
}

function setCookieValue(response: Response): string | undefined {
  return response.headers.get("set-cookie") ?? undefined;
}

function firstCookiePair(setCookieHeader: string): string {
  return setCookieHeader.split(",")[0]?.split(";")[0]?.trim() ?? "";
}

interface SignUpResult {
  readonly response: Response;
  readonly body: { token: string | null; user: { id: string; email: string } };
}

async function signUp(
  origin: string,
  email: string,
  password: string,
  headers: Record<string, string> = {},
): Promise<SignUpResult> {
  const response = await fetch(`${origin}/api/auth/sign-up/email`, {
    body: JSON.stringify({ email, name: "Integration Test User", password }),
    headers: { "content-type": "application/json", ...headers },
    method: "POST",
  });
  return { body: (await response.clone().json()) as SignUpResult["body"], response };
}

interface SignInResult {
  readonly cookiePair: string | undefined;
  readonly response: Response;
}

async function signIn(
  origin: string,
  email: string,
  password: string,
  headers: Record<string, string> = {},
): Promise<SignInResult> {
  const response = await fetch(`${origin}/api/auth/sign-in/email`, {
    body: JSON.stringify({ email, password }),
    headers: {
      "content-type": "application/json",
      origin: dashboardOrigin,
      ...headers,
    },
    method: "POST",
  });
  const setCookie = setCookieValue(response);
  return { cookiePair: setCookie ? firstCookiePair(setCookie) : undefined, response };
}

async function fetchPrincipal(
  origin: string,
  headers: Record<string, string> = {},
): Promise<{ body: unknown; response: Response }> {
  const response = await fetch(`${origin}/api/v1/principal`, { headers });
  return { body: await response.clone().json(), response };
}

describe.sequential("live API — signup, sign-in, principal, sign-out", () => {
  let database: { name: string; url: string };
  let running: RunningApi;
  let origin: string;
  const emailOne = "[email protected]";
  const emailTwo = "[email protected]";
  const password = "correct horse battery staple";

  it("applies migrations and starts the API against a freshly migrated database", async () => {
    database = await createDisposableDatabase("signup_flow");
    await applyCoreMigrations(database.url);
    running = await startMigratedApi(database.url);
    origin = apiOrigin(running);

    expect(running.server.listening).toBe(true);
  });

  it("returns the anonymous principal shape before any sign-in", async () => {
    const { body, response } = await fetchPrincipal(origin);
    expect(response.status).toBe(200);
    expect(body).toEqual({ kind: "anonymous" });
  });

  it("publicly creates the first ordinary identity via sign-up, with no automatic session (autoSignIn: false)", async () => {
    const { body, response } = await signUp(origin, emailOne, password);

    expect(response.status).toBe(200);
    expect(body.token).toBeNull();
    expect(body.user.email).toBe(emailOne);
    expect(setCookieValue(response)).toBeUndefined();
  });

  it("does not sign in automatically after sign-up", async () => {
    const { body } = await fetchPrincipal(origin);
    expect(body).toEqual({ kind: "anonymous" });
  });

  it("rejects wrong credentials without leaking raw internal information", async () => {
    const { response } = await signIn(origin, emailOne, "wrong password entirely");
    const text = await response.text();

    expect(response.status).toBe(401);
    expect(text).not.toContain(database.url);
    expect(text).not.toContain("postgres");
    expect(text.toLowerCase()).not.toContain("stack");
  });

  let sessionCookie: string;

  it("signs in explicitly and returns a valid, host-only, HttpOnly, SameSite=Lax, secure session cookie", async () => {
    const { cookiePair, response } = await signIn(origin, emailOne, password);
    const setCookie = setCookieValue(response);

    expect(response.status).toBe(200);
    expect(setCookie).toBeDefined();
    expect(cookiePair).toBeDefined();
    sessionCookie = cookiePair as string;

    const cookieText = setCookie as string;
    expect(cookieText).toContain("HttpOnly");
    expect(cookieText).toContain("SameSite=Lax");
    expect(cookieText).toContain("Secure");
    expect(cookieText).not.toMatch(/domain=/iu);
  });

  it("resolves the authenticated principal containing only kind and the opaque user id", async () => {
    const { body, response } = await fetchPrincipal(origin, { cookie: sessionCookie });

    expect(response.status).toBe(200);
    expect(body).toMatchObject({ kind: "authenticated" });
    const record = body as Record<string, unknown>;
    expect(Object.keys(record).sort()).toEqual(["kind", "userId"]);
    expect(typeof record.userId).toBe("string");
  });

  it("resolves a malformed cookie as anonymous rather than failing", async () => {
    const { body, response } = await fetchPrincipal(origin, {
      cookie: "better-auth.session_token=not-a-real-token",
    });

    expect(response.status).toBe(200);
    expect(body).toEqual({ kind: "anonymous" });
  });

  it("resolves a nonexistent cookie name as anonymous", async () => {
    const { body, response } = await fetchPrincipal(origin, { cookie: "unrelated=value" });
    expect(response.status).toBe(200);
    expect(body).toEqual({ kind: "anonymous" });
  });

  it("does not create a second identity on duplicate sign-up, and does not leak unstable internal details", async () => {
    const { body, response } = await signUp(origin, emailOne, "a totally different password");

    expect(response.status).toBe(200);
    expect(body.token).toBeNull();
    expect(typeof body.user.id).toBe("string");
  });

  it("keeps exactly one user row for the duplicated email after the duplicate sign-up attempt", async () => {
    const admin = await openAdministrativeClient(database.url);
    try {
      const rows = await safeQuery<{ count: string }>(
        admin,
        'select count(*)::text as count from "ekklesia_core_user" where email = $1',
        [emailOne],
      );
      expect(rows[0]?.count).toBe("1");
    } finally {
      await safeEnd(admin);
    }
  });

  it("signs out and invalidates the session", async () => {
    const response = await fetch(`${origin}/api/auth/sign-out`, {
      body: "{}",
      headers: {
        "content-type": "application/json",
        cookie: sessionCookie,
        origin: dashboardOrigin,
      },
      method: "POST",
    });

    expect(response.status).toBe(200);
    expect(setCookieValue(response)).toBeDefined();
  });

  it("resolves the old cookie as anonymous after sign-out", async () => {
    const { body, response } = await fetchPrincipal(origin, { cookie: sessionCookie });
    expect(response.status).toBe(200);
    expect(body).toEqual({ kind: "anonymous" });
  });

  let secondUserId: string;

  it("registers and signs in a second, distinct public account", async () => {
    const signUpResult = await signUp(origin, emailTwo, password);
    expect(signUpResult.response.status).toBe(200);

    const signInResult = await signIn(origin, emailTwo, password);
    expect(signInResult.response.status).toBe(200);
    expect(signInResult.cookiePair).toBeDefined();

    const { body } = await fetchPrincipal(origin, {
      cookie: signInResult.cookiePair as string,
    });
    const record = body as { kind: string; userId: string };
    expect(record.kind).toBe("authenticated");
    secondUserId = record.userId;
    expect(secondUserId).toBeTruthy();
  });

  it("gives the first and second account identical principal shapes with no elevation", async () => {
    const first = await signIn(origin, emailOne, password);
    const { body: firstBody } = await fetchPrincipal(origin, {
      cookie: first.cookiePair as string,
    });
    const second = await signIn(origin, emailTwo, password);
    const { body: secondBody } = await fetchPrincipal(origin, {
      cookie: second.cookiePair as string,
    });

    expect(Object.keys(firstBody as object).sort()).toEqual(
      Object.keys(secondBody as object).sort(),
    );
    expect((firstBody as { kind: string }).kind).toBe((secondBody as { kind: string }).kind);
  });

  it("gives neither account owner, role, permission, membership, or volunteer data at the database level", async () => {
    const admin = await openAdministrativeClient(database.url);
    try {
      const columns = await safeQuery<{ column_name: string }>(
        admin,
        "select column_name from information_schema.columns where table_schema = 'public' and table_name = 'ekklesia_core_user'",
      );
      const columnNames = columns.map((row) => row.column_name);
      for (const forbidden of [
        "role",
        "is_admin",
        "is_owner",
        "is_staff",
        "is_volunteer",
        "is_member",
        "permissions",
        "grants",
      ]) {
        expect(columnNames).not.toContain(forbidden);
      }
    } finally {
      await safeEnd(admin);
    }
  });

  it("never stores a plaintext password", async () => {
    const admin = await openAdministrativeClient(database.url);
    try {
      const rows = await safeQuery<{ password: string | null }>(
        admin,
        `select a.password from "ekklesia_core_account" a
         inner join "ekklesia_core_user" u on u.id = a.user_id
         where u.email = $1`,
        [emailOne],
      );
      const stored = rows[0]?.password;
      expect(stored).toBeTruthy();
      expect(stored).not.toBe(password);
      expect(stored?.length ?? 0).toBeGreaterThan(password.length);
    } finally {
      await safeEnd(admin);
    }
  });

  it("supports a server-to-server sign-up request that carries no Origin header at all", async () => {
    const { response } = await signUp(origin, "[email protected]", password);
    expect(response.status).toBe(200);
  });

  it("allows a trusted browser origin for the principal route with credentials", async () => {
    const response = await fetch(`${origin}/api/v1/principal`, {
      headers: { cookie: sessionCookie, origin: dashboardOrigin },
    });

    expect(response.status).toBe(200);
    expect(response.headers.get("access-control-allow-origin")).toBe(dashboardOrigin);
    expect(response.headers.get("access-control-allow-credentials")).toBe("true");
  });

  it("never returns Access-Control-Allow-Origin for an untrusted browser origin", async () => {
    const principalResponse = await fetch(`${origin}/api/v1/principal`, {
      headers: { origin: untrustedOrigin },
    });
    expect(principalResponse.headers.get("access-control-allow-origin")).toBeNull();
  });

  it("leaves Better Auth's handler unavailable outside /api/auth/*", async () => {
    const response = await fetch(`${origin}/sign-in/email`, { method: "POST" });
    expect(response.status).toBe(404);
  });

  it("shuts down cleanly, closing the HTTP listener and the PostgreSQL pool", async () => {
    await running.shutdown();

    await expect(fetch(origin, { signal: AbortSignal.timeout(1_000) })).rejects.toBeTruthy();
    const remainingConnections = await activeConnectionCount(database.name);
    expect(remainingConnections).toBe(0);

    await dropDatabase(database.name);
  });
});

// Better Auth's own server-side rejection of a cookie-bearing state-changing request from an
// untrusted origin (403 INVALID_ORIGIN) was verified directly and repeatedly against this exact
// pinned release and this exact compiled `apps/api` server — signup, sign-in, then a sign-out
// attempt with the valid session cookie and an untrusted Origin header reliably returns 403, and
// the presented session remains valid afterward — but only when driven by a plain Node script
// against the running server. The identical scenario could not be made to reproduce reliably when
// driven through Vitest specifically (the rejection silently does not fire), even in a single
// isolated test with its own fresh database and API instance, and even with `NODE_ENV` forced to
// `"production"` inside the test process. The cause was not pinned down to a documented,
// reproducible contract inside the time available for this slice, so no automated assertion is
// made for this specific request shape here rather than commit a flaky or misleading test. What
// *is* covered by an automated test above is the layer this repository's own code owns: CORS
// never returns `Access-Control-Allow-Origin` for an untrusted origin, which is the actual
// browser-enforced boundary preventing a malicious page from reading a response. See ADR 0011 for
// the full account, including the exact manual reproduction used.

describe.sequential("live API — startup and migration guarantees", () => {
  it("does not create any tables or migration history when started against an unmigrated database", async () => {
    const database = await createDisposableDatabase("unmigrated");
    try {
      const config = createApiRuntimeConfig(
        {
          databaseUrl: database.url,
          host: "127.0.0.1",
          identity: {
            baseUrl: identityBaseUrl,
            secret: "integration-test-secret-0123456789abcdefgh",
            trustedOrigins: [identityBaseUrl],
          },
          port: 0,
        },
        { environment: "production" },
      );
      const running = await startApi(config, { rateLimitOverride: { max: 1000, window: 1 } });
      const origin = apiOrigin(running);

      try {
        // A request that touches the (nonexistent) identity tables fails, but must not repair
        // or create anything. The exact failure body is not asserted here (Better Auth's
        // internal-error shape for this case is not a stable public contract); only that it is
        // not a successful sign-up.
        const response = await fetch(`${origin}/api/auth/sign-up/email`, {
          body: JSON.stringify({
            email: "[email protected]",
            name: "Integration Test User",
            password: "correct horse battery staple",
          }),
          headers: { "content-type": "application/json" },
          method: "POST",
        });
        expect(response.status).not.toBe(200);
      } finally {
        await running.shutdown();
      }

      const admin = await openAdministrativeClient(database.url);
      try {
        const rows = await safeQuery<{ count: string }>(
          admin,
          "select count(*)::text as count from information_schema.tables where table_schema = 'public'",
        );
        expect(rows[0]?.count).toBe("0");
      } finally {
        await safeEnd(admin);
      }
    } finally {
      await dropDatabase(database.name);
    }
  });
});

describe.sequential("live API — principal infrastructure failure is never downgraded to anonymous", () => {
  it("returns a sanitized failure, not a false anonymous 200, when the database becomes unreachable mid-session", async () => {
    const database = await createDisposableDatabase("infra_failure");
    await applyCoreMigrations(database.url);
    const running = await startMigratedApi(database.url);
    const origin = apiOrigin(running);

    await signUp(origin, "[email protected]", "correct horse battery staple");
    const { cookiePair } = await signIn(
      origin,
      "[email protected]",
      "correct horse battery staple",
    );
    expect(cookiePair).toBeDefined();

    // Force the database itself unreachable out from under the running API pool.
    await dropDatabase(database.name);

    const { body, response } = await fetchPrincipal(origin, { cookie: cookiePair as string });
    expect(response.status).toBe(503);
    expect(body).toEqual({ code: "PRINCIPAL_RESOLUTION_FAILED" });

    await running.shutdown().catch(() => undefined);
  });
});