8eba5b2d9e
Follow-up to PR #406 — addresses the two items deferred from the audit: #7 — Centralize auth helpers - New `requireSessionUser(request)` in lib/auth/session.server.ts that returns the user or throws a redirect to /auth/login. - New `requireSessionUserJson(request)` companion that throws a 401 JSON response (for fetcher/JSON endpoints). - Replace the repeated const user = await getSessionUser(request); if (!user) return redirect("/auth/login"); pattern across 18 route loaders/actions. Removes the duplicated guard preamble and gives a single chokepoint to evolve later (e.g., for terms-version gating). #8 — Extract heavy loaders into .server.ts siblings - routes/home.tsx → home.server.ts (DB count query + listActivities + listRecentPublicActivities) - routes/users.$username.tsx → users.$username.server.ts (user lookup + follow state + counts + listPublicRoutes/Activities + persona check) - routes/settings.connections.tsx → settings.connections.server.ts (connected_services join + manifest merge) Each route file shrinks to a thin delegator: `loader` calls `loadXxx(request)`. The component module no longer transitively pulls `getDb` and Drizzle schema into its import graph — Vite's tree-shake already strips server-only code from the client bundle, but the explicit `.server.ts` suffix makes that contract local and auditable. Other 17 routes that mix loader/action with components are left as-is for now: they're each small enough that the split adds churn without buying much clarity. The pattern is documented by the three examples; the rest can convert opportunistically when they grow. Tests: - lib/auth/session.server.test.ts (4 cases — redirect for missing cookie, redirect for ghost userId, success path, JSON 401 variant) Full repo: pnpm typecheck, pnpm lint, pnpm test all green (181 passed | 31 integration-gated skipped). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
85 lines
2.6 KiB
TypeScript
85 lines
2.6 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from "vitest";
|
|
|
|
const mocks = vi.hoisted(() => ({
|
|
getDb: vi.fn(),
|
|
}));
|
|
|
|
vi.mock("../db.ts", () => ({ getDb: mocks.getDb }));
|
|
|
|
import {
|
|
requireSessionUser,
|
|
requireSessionUserJson,
|
|
sessionStorage,
|
|
} from "./session.server.ts";
|
|
|
|
async function requestWithSession(userId: string | null): Promise<Request> {
|
|
const session = await sessionStorage.getSession();
|
|
if (userId) session.set("userId", userId);
|
|
const cookie = await sessionStorage.commitSession(session);
|
|
return new Request("http://test.local/", {
|
|
headers: { cookie },
|
|
});
|
|
}
|
|
|
|
describe("requireSessionUser", () => {
|
|
beforeEach(() => {
|
|
mocks.getDb.mockReset();
|
|
});
|
|
|
|
it("throws a redirect to /auth/login when no session cookie", async () => {
|
|
const req = new Request("http://test.local/");
|
|
try {
|
|
await requireSessionUser(req);
|
|
throw new Error("should have thrown");
|
|
} catch (thrown) {
|
|
expect(thrown).toBeInstanceOf(Response);
|
|
const resp = thrown as Response;
|
|
expect(resp.status).toBe(302);
|
|
expect(resp.headers.get("location")).toBe("/auth/login");
|
|
}
|
|
});
|
|
|
|
it("throws a redirect when session userId points at a missing user", async () => {
|
|
mocks.getDb.mockReturnValue({
|
|
select: () => ({ from: () => ({ where: () => Promise.resolve([]) }) }),
|
|
});
|
|
const req = await requestWithSession("ghost-user");
|
|
try {
|
|
await requireSessionUser(req);
|
|
throw new Error("should have thrown");
|
|
} catch (thrown) {
|
|
expect(thrown).toBeInstanceOf(Response);
|
|
expect((thrown as Response).headers.get("location")).toBe("/auth/login");
|
|
}
|
|
});
|
|
|
|
it("returns the user when the session is valid", async () => {
|
|
const user = { id: "u1", username: "alice" };
|
|
mocks.getDb.mockReturnValue({
|
|
select: () => ({ from: () => ({ where: () => Promise.resolve([user]) }) }),
|
|
});
|
|
const req = await requestWithSession("u1");
|
|
const result = await requireSessionUser(req);
|
|
expect(result).toEqual(user);
|
|
});
|
|
});
|
|
|
|
describe("requireSessionUserJson", () => {
|
|
beforeEach(() => {
|
|
mocks.getDb.mockReset();
|
|
});
|
|
|
|
it("throws a 401 JSON Response when unauthenticated", async () => {
|
|
const req = new Request("http://test.local/");
|
|
try {
|
|
await requireSessionUserJson(req);
|
|
throw new Error("should have thrown");
|
|
} catch (thrown) {
|
|
expect(thrown).toBeInstanceOf(Response);
|
|
const resp = thrown as Response;
|
|
expect(resp.status).toBe(401);
|
|
const body = (await resp.json()) as { error: string };
|
|
expect(body.error).toBe("Unauthorized");
|
|
}
|
|
});
|
|
});
|