@joystick.js/db-canary/tests/server/lib/api_key_manager_development.test.js

JoystickDB - A minimalist database server for the Joystick framework

/**
 * @fileoverview Tests for API key manager development mode functionality.
 */

import test from 'ava';
import { 
  validate_api_key,
  create_user,
  initialize_api_key_manager,
  reset_api_key_state,
  create_development_admin_user
} from '../../../src/server/lib/api_key_manager.js';
import { initialize_database, cleanup_database } from '../../../src/server/lib/query_engine.js';

let original_node_env;
let console_log_calls;

test.beforeEach(async (t) => {
  original_node_env = process.env.NODE_ENV;
  console_log_calls = [];
  
  // Mock console.log to capture calls
  console.log = (...args) => {
    console_log_calls.push(args.join(' '));
  };
  
  // Clean up any existing database first
  try {
    await cleanup_database();
  } catch (error) {
    // Ignore cleanup errors
  }
  
  // Clean up any existing API key file and reset state
  reset_api_key_state();
  
  // Initialize database for user storage tests with unique path per test
  const test_db_path = `./test_data_dev_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
  initialize_database(test_db_path);
  
  // Store the test db path for cleanup
  t.context.test_db_path = test_db_path;
});

test.afterEach(async (t) => {
  process.env.NODE_ENV = original_node_env;
  
  // Restore console.log
  console.log = console.log.__original || console.log;
  
  // Clean up database and API key state
  try {
    await cleanup_database(true); // Remove test database directory
  } catch (error) {
    // Ignore cleanup errors
  }
  
  reset_api_key_state();
});

test('validate_api_key bypasses validation in development mode', (t) => {
  process.env.NODE_ENV = 'development';
  
  // Should return true for any API key in development mode
  t.true(validate_api_key('invalid-key'));
  t.true(validate_api_key(''));
  t.true(validate_api_key(null));
  t.true(validate_api_key(undefined));
});

test('validate_api_key enforces validation in production mode', (t) => {
  process.env.NODE_ENV = 'production';
  
  // Should return false for invalid keys in production mode
  t.false(validate_api_key('invalid-key'));
  t.false(validate_api_key(''));
  t.false(validate_api_key(null));
  t.false(validate_api_key(undefined));
});

test('validate_api_key enforces validation when NODE_ENV is not set', (t) => {
  delete process.env.NODE_ENV;
  
  // Should return false for invalid keys when NODE_ENV is not set
  t.false(validate_api_key('invalid-key'));
  t.false(validate_api_key(''));
  t.false(validate_api_key(null));
  t.false(validate_api_key(undefined));
});

test('create_development_admin_user returns null when not in development mode', async (t) => {
  process.env.NODE_ENV = 'production';
  
  const admin_user = await create_development_admin_user();
  
  t.is(admin_user, null);
});

test('initialize_api_key_manager works in development mode', async (t) => {
  process.env.NODE_ENV = 'development';
  
  await t.notThrowsAsync(async () => {
    await initialize_api_key_manager();
  });
  
  // Just verify it doesn't throw - the console output may vary
  t.pass();
});

test('initialize_api_key_manager works in production mode', async (t) => {
  process.env.NODE_ENV = 'production';
  
  await t.notThrowsAsync(async () => {
    await initialize_api_key_manager();
  });
  
  // Should display setup message
  t.true(console_log_calls.some(call => call.includes('JoystickDB Setup')));
});

test('production security is maintained in production mode', async (t) => {
  process.env.NODE_ENV = 'production';
  
  // API key validation should be enforced
  t.false(validate_api_key('invalid-key'));
  
  // Password complexity should be enforced
  const error = await t.throwsAsync(async () => {
    await create_user({
      username: 'testuser',
      password: 'simple',
      role: 'read_write'
    });
  });
  
  t.true(error.message.includes('Password must be at least 8 characters long'));
  
  // Development admin user should not be created
  const admin_user = await create_development_admin_user();
  t.is(admin_user, null);
});

test('production security is maintained when NODE_ENV is undefined', async (t) => {
  delete process.env.NODE_ENV;
  
  // API key validation should be enforced
  t.false(validate_api_key('invalid-key'));
  
  // Password complexity should be enforced
  const error = await t.throwsAsync(async () => {
    await create_user({
      username: 'testuser',
      password: 'simple',
      role: 'read_write'
    });
  });
  
  t.true(error.message.includes('Password must be at least 8 characters long'));
  
  // Development admin user should not be created
  const admin_user = await create_development_admin_user();
  t.is(admin_user, null);
});