|
| 1 | +// @effect-diagnostics nodeBuiltinImport:off -- These tests assert real POSIX modes on a temporary directory. |
| 2 | +import * as NodeFS from "node:fs"; |
| 3 | +import * as NodeOS from "node:os"; |
| 4 | +import * as NodePath from "node:path"; |
| 5 | +import { assert, describe, it } from "@effect/vitest"; |
| 6 | +import { vi } from "vite-plus/test"; |
| 7 | + |
| 8 | +vi.mock("node:fs", { spy: true }); |
| 9 | + |
| 10 | +import { openClerkTokenStorage, type ClerkTokenStorage } from "./ClerkTokenStore.ts"; |
| 11 | + |
| 12 | +// oxlint-disable-next-line t3code/no-global-process-runtime -- Unix mode bits are the assertion; Windows reports them through ACLs. |
| 13 | +const describePosix = describe.skipIf(process.platform === "win32"); |
| 14 | + |
| 15 | +const modeOf = (path: string): number => NodeFS.statSync(path).mode & 0o777; |
| 16 | + |
| 17 | +function writeLoose(path: string, contents: string): void { |
| 18 | + NodeFS.writeFileSync(path, contents, { mode: 0o666 }); |
| 19 | + NodeFS.chmodSync(path, 0o666); |
| 20 | +} |
| 21 | + |
| 22 | +async function withStateDir(run: (stateDir: string) => Promise<void> | void): Promise<void> { |
| 23 | + const stateDir = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-clerk-tokens-")); |
| 24 | + try { |
| 25 | + await run(stateDir); |
| 26 | + } finally { |
| 27 | + NodeFS.rmSync(stateDir, { recursive: true, force: true }); |
| 28 | + } |
| 29 | +} |
| 30 | + |
| 31 | +const idleStorage = (): ClerkTokenStorage => ({ |
| 32 | + getItem: async () => null, |
| 33 | + setItem: async () => undefined, |
| 34 | + removeItem: () => undefined, |
| 35 | +}); |
| 36 | + |
| 37 | +describePosix("ClerkTokenStore", () => { |
| 38 | + it("keeps clerk tokens at 0600 inside a 0700 directory", async () => { |
| 39 | + await withStateDir(async (stateDir) => { |
| 40 | + NodeFS.chmodSync(stateDir, 0o755); |
| 41 | + const directory = NodePath.join(stateDir, "clerk"); |
| 42 | + const legacyPath = NodePath.join(stateDir, "clerk-tokens.json"); |
| 43 | + const tokenPath = NodePath.join(directory, "clerk-tokens.json"); |
| 44 | + NodeFS.mkdirSync(directory, { mode: 0o755 }); |
| 45 | + NodeFS.chmodSync(directory, 0o755); |
| 46 | + writeLoose(legacyPath, '{"__clerk_client_jwt":"enc:existing"}\n'); |
| 47 | + |
| 48 | + const opened: string[] = []; |
| 49 | + const storage = openClerkTokenStorage(stateDir, (cwd) => { |
| 50 | + opened.push(cwd); |
| 51 | + return { |
| 52 | + getItem: async () => { |
| 53 | + writeLoose(tokenPath, "from-get"); |
| 54 | + return "from-get"; |
| 55 | + }, |
| 56 | + setItem: (_key, value) => { |
| 57 | + writeLoose(tokenPath, value); |
| 58 | + }, |
| 59 | + removeItem: () => { |
| 60 | + NodeFS.rmSync(tokenPath, { force: true }); |
| 61 | + }, |
| 62 | + }; |
| 63 | + }); |
| 64 | + |
| 65 | + assert.deepEqual(opened, [directory]); |
| 66 | + assert.equal(modeOf(stateDir), 0o755); |
| 67 | + assert.equal(modeOf(directory), 0o700); |
| 68 | + assert.equal(modeOf(tokenPath), 0o600); |
| 69 | + assert.equal(NodeFS.existsSync(legacyPath), false); |
| 70 | + assert.equal( |
| 71 | + NodeFS.readFileSync(tokenPath, "utf8"), |
| 72 | + '{"__clerk_client_jwt":"enc:existing"}\n', |
| 73 | + ); |
| 74 | + |
| 75 | + assert.equal(await storage.getItem("client"), "from-get"); |
| 76 | + assert.equal(modeOf(tokenPath), 0o600); |
| 77 | + await storage.setItem("client", "from-set"); |
| 78 | + assert.equal(modeOf(tokenPath), 0o600); |
| 79 | + assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "from-set"); |
| 80 | + storage.removeItem("client"); |
| 81 | + assert.equal(NodeFS.existsSync(tokenPath), false); |
| 82 | + |
| 83 | + writeLoose(tokenPath, "kept"); |
| 84 | + writeLoose(legacyPath, "stale"); |
| 85 | + NodeFS.chmodSync(directory, 0o755); |
| 86 | + openClerkTokenStorage(stateDir, () => idleStorage()); |
| 87 | + assert.equal(modeOf(directory), 0o700); |
| 88 | + assert.equal(modeOf(tokenPath), 0o600); |
| 89 | + assert.equal(NodeFS.existsSync(legacyPath), false); |
| 90 | + assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "kept"); |
| 91 | + }); |
| 92 | + }); |
| 93 | + |
| 94 | + it("removes the legacy token file when the private copy already exists", async () => { |
| 95 | + await withStateDir((stateDir) => { |
| 96 | + const directory = NodePath.join(stateDir, "clerk"); |
| 97 | + const legacyPath = NodePath.join(stateDir, "clerk-tokens.json"); |
| 98 | + const tokenPath = NodePath.join(directory, "clerk-tokens.json"); |
| 99 | + NodeFS.mkdirSync(directory, { mode: 0o755 }); |
| 100 | + writeLoose(legacyPath, "stale-credential"); |
| 101 | + writeLoose(tokenPath, "kept-credential"); |
| 102 | + |
| 103 | + openClerkTokenStorage(stateDir, () => idleStorage()); |
| 104 | + |
| 105 | + assert.equal(NodeFS.existsSync(legacyPath), false); |
| 106 | + assert.equal(modeOf(directory), 0o700); |
| 107 | + assert.equal(modeOf(tokenPath), 0o600); |
| 108 | + assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "kept-credential"); |
| 109 | + }); |
| 110 | + }); |
| 111 | + |
| 112 | + it("resolves a relative state directory before opening storage", async () => { |
| 113 | + await withStateDir(async (stateDir) => { |
| 114 | + const relativeStateDir = NodePath.relative(process.cwd(), stateDir); |
| 115 | + const opened: string[] = []; |
| 116 | + openClerkTokenStorage(relativeStateDir, (directory) => { |
| 117 | + opened.push(directory); |
| 118 | + return idleStorage(); |
| 119 | + }); |
| 120 | + |
| 121 | + const directory = NodePath.join(stateDir, "clerk"); |
| 122 | + assert.equal(NodePath.isAbsolute(relativeStateDir), false); |
| 123 | + assert.deepEqual(opened, [directory]); |
| 124 | + assert.equal(modeOf(directory), 0o700); |
| 125 | + }); |
| 126 | + }); |
| 127 | + |
| 128 | + it("migrates relative state paths from Electron userData, not the working directory", async () => { |
| 129 | + await withStateDir((stateDir) => { |
| 130 | + const relativeStateDir = NodePath.relative(process.cwd(), stateDir); |
| 131 | + const userData = NodePath.join( |
| 132 | + stateDir, |
| 133 | + "electron", |
| 134 | + ...relativeStateDir.split(NodePath.sep).map(() => "profile"), |
| 135 | + ); |
| 136 | + const legacyStateDir = NodePath.join(userData, relativeStateDir); |
| 137 | + const legacyPath = NodePath.join(legacyStateDir, "clerk-tokens.json"); |
| 138 | + NodeFS.mkdirSync(legacyStateDir, { recursive: true }); |
| 139 | + writeLoose(legacyPath, "existing-session"); |
| 140 | + const unrelatedPath = NodePath.join(stateDir, "clerk-tokens.json"); |
| 141 | + writeLoose(unrelatedPath, "not-the-electron-session"); |
| 142 | + |
| 143 | + openClerkTokenStorage(relativeStateDir, idleStorage, userData); |
| 144 | + |
| 145 | + const tokenPath = NodePath.join(stateDir, "clerk", "clerk-tokens.json"); |
| 146 | + assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "existing-session"); |
| 147 | + assert.equal(modeOf(tokenPath), 0o600); |
| 148 | + assert.equal(NodeFS.existsSync(legacyPath), false); |
| 149 | + assert.equal(NodeFS.readFileSync(unrelatedPath, "utf8"), "not-the-electron-session"); |
| 150 | + }); |
| 151 | + }); |
| 152 | + |
| 153 | + it("migrates tokens when the legacy directory is on another filesystem", async () => { |
| 154 | + await withStateDir((stateDir) => { |
| 155 | + const legacyPath = NodePath.join(stateDir, "clerk-tokens.json"); |
| 156 | + writeLoose(legacyPath, "existing-session"); |
| 157 | + using _rename = vi.spyOn(NodeFS, "renameSync").mockImplementation(() => { |
| 158 | + throw Object.assign(new Error("cross-device link"), { code: "EXDEV" }); |
| 159 | + }); |
| 160 | + |
| 161 | + openClerkTokenStorage(stateDir, idleStorage); |
| 162 | + |
| 163 | + const tokenPath = NodePath.join(stateDir, "clerk", "clerk-tokens.json"); |
| 164 | + assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "existing-session"); |
| 165 | + assert.equal(modeOf(tokenPath), 0o600); |
| 166 | + assert.equal(NodeFS.existsSync(legacyPath), false); |
| 167 | + }); |
| 168 | + }); |
| 169 | + |
| 170 | + it("does not follow a symlinked clerk directory or token file", async () => { |
| 171 | + await withStateDir(async (stateDir) => { |
| 172 | + const outsideDirectory = NodePath.join(stateDir, "outside-dir"); |
| 173 | + NodeFS.mkdirSync(outsideDirectory, { mode: 0o755 }); |
| 174 | + NodeFS.chmodSync(outsideDirectory, 0o755); |
| 175 | + NodeFS.symlinkSync(outsideDirectory, NodePath.join(stateDir, "clerk")); |
| 176 | + |
| 177 | + assert.throws(() => openClerkTokenStorage(stateDir, idleStorage), /must be a real directory/); |
| 178 | + assert.equal(modeOf(outsideDirectory), 0o755); |
| 179 | + NodeFS.unlinkSync(NodePath.join(stateDir, "clerk")); |
| 180 | + |
| 181 | + const outsideFile = NodePath.join(stateDir, "outside.json"); |
| 182 | + NodeFS.writeFileSync(outsideFile, "secret", { mode: 0o644 }); |
| 183 | + NodeFS.chmodSync(outsideFile, 0o644); |
| 184 | + NodeFS.symlinkSync(outsideFile, NodePath.join(stateDir, "clerk-tokens.json")); |
| 185 | + assert.throws(() => openClerkTokenStorage(stateDir, idleStorage), /must be a regular file/); |
| 186 | + assert.equal(modeOf(outsideFile), 0o644); |
| 187 | + }); |
| 188 | + }); |
| 189 | +}); |
0 commit comments