feat: add extensive test suite

lib/auth.test.ts

@@ -0,0 +1,80 @@
+import { describe, expect, mock, test } from "bun:test";
+import { checkAdmin } from "./auth-check";
+
+type User = {
+  email: string;
+  name: string;
+  role?: string;
+};
+
+const bypassUser: User = { email: "bypass@localhost", name: "Bypass" };
+const internalUser: User = { email: "internal@localhost", name: "Internal" };
+
+function dependencies(
+  overrides: Partial<Parameters<typeof checkAdmin<User>>[0]> = {},
+) {
+  return {
+    noAuthCheck: undefined,
+    bypassUser,
+    internalUser,
+    getInternalAuth: mock(async () => null),
+    getInternalToken: mock(async () => null),
+    getSession: mock(async () => null),
+    ...overrides,
+  };
+}
+
+describe("checkAdmin", () => {
+  test("only enables NO_AUTH_CHECK for the exact string true", async () => {
+    for (const value of [undefined, "", "1", "TRUE", "false"]) {
+      const deps = dependencies({ noAuthCheck: value });
+      expect(await checkAdmin(deps)).toBeNull();
+      expect(deps.getSession).toHaveBeenCalledTimes(1);
+    }
+
+    const deps = dependencies({ noAuthCheck: "true" });
+    expect(await checkAdmin(deps)).toBe(bypassUser);
+    expect(deps.getInternalAuth).not.toHaveBeenCalled();
+    expect(deps.getSession).not.toHaveBeenCalled();
+  });
+
+  test("accepts a valid internal token without loading a session", async () => {
+    const deps = dependencies({
+      getInternalAuth: mock(async () => "token"),
+      getInternalToken: mock(async () => "valid"),
+    });
+
+    expect(await checkAdmin(deps)).toBe(internalUser);
+    expect(deps.getInternalToken).toHaveBeenCalledWith("token");
+    expect(deps.getSession).not.toHaveBeenCalled();
+  });
+
+  test("falls back to an admin session when Redis fails", async () => {
+    const admin: User = {
+      email: "[email protected]",
+      name: "Admin",
+      role: "admin",
+    };
+    const deps = dependencies({
+      getInternalAuth: mock(async () => "token"),
+      getInternalToken: mock(async () => {
+        throw new Error("Redis unavailable");
+      }),
+      getSession: mock(async () => ({ user: admin })),
+    });
+
+    expect(await checkAdmin(deps)).toBe(admin);
+    expect(deps.getSession).toHaveBeenCalledTimes(1);
+  });
+
+  test("rejects missing and non-admin sessions", async () => {
+    const nonAdmin = dependencies({
+      getSession: mock(async () => ({
+        user: { email: "[email protected]", name: "User", role: "user" },
+      })),
+    });
+
+    expect(await checkAdmin(nonAdmin)).toBeNull();
+    expect(await checkAdmin(dependencies())).toBeNull();
+  });
+});