test(server): add unit tests for device token reading

- Test device token cookie parsing in auth middleware
- Test device token context passing in graphile preset
- Covers edge cases: missing cookie, URL encoding, special chars

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: theothersideofgod

graphql/server/src/middleware/__tests__/auth-device-token.test.ts

@@ -0,0 +1,88 @@
+import type { Request, Response, NextFunction } from 'express';
+import { DEVICE_TOKEN_COOKIE_NAME } from '../cookie';
+
+/**
+ * Test the device token reading functionality in auth middleware.
+ *
+ * The actual createAuthenticateMiddleware requires database connections,
+ * so we test the device token parsing logic in isolation.
+ */
+
+/** Cookie parsing function - mirrors the implementation in auth.ts */
+const parseCookieToken = (req: Request, cookieName: string): string | undefined => {
+  const header = req.headers.cookie;
+  if (!header) return undefined;
+  const match = header.split(';').find((c) => c.trim().startsWith(`${cookieName}=`));
+  return match ? decodeURIComponent(match.split('=')[1].trim()) : undefined;
+};
+
+describe('auth middleware device token handling', () => {
+  const createMockRequest = (cookies?: string): Partial<Request> => ({
+    headers: cookies ? { cookie: cookies } : {},
+  });
+
+  describe('device token cookie parsing', () => {
+    it('should extract device token from cookie header', () => {
+      const req = createMockRequest(`${DEVICE_TOKEN_COOKIE_NAME}=device-abc123`);
+      const deviceToken = parseCookieToken(req as Request, DEVICE_TOKEN_COOKIE_NAME);
+      expect(deviceToken).toBe('device-abc123');
+    });
+
+    it('should return undefined when device token cookie is not present', () => {
+      const req = createMockRequest('other_cookie=value');
+      const deviceToken = parseCookieToken(req as Request, DEVICE_TOKEN_COOKIE_NAME);
+      expect(deviceToken).toBeUndefined();
+    });
+
+    it('should return undefined when no cookies are present', () => {
+      const req = createMockRequest();
+      const deviceToken = parseCookieToken(req as Request, DEVICE_TOKEN_COOKIE_NAME);
+      expect(deviceToken).toBeUndefined();
+    });
+
+    it('should handle multiple cookies and extract device token', () => {
+      const req = createMockRequest(
+        `session=abc; ${DEVICE_TOKEN_COOKIE_NAME}=device-xyz789; csrf=token123`
+      );
+      const deviceToken = parseCookieToken(req as Request, DEVICE_TOKEN_COOKIE_NAME);
+      expect(deviceToken).toBe('device-xyz789');
+    });
+
+    it('should decode URL-encoded device token values', () => {
+      const req = createMockRequest(`${DEVICE_TOKEN_COOKIE_NAME}=device%2Ftoken%3D123`);
+      const deviceToken = parseCookieToken(req as Request, DEVICE_TOKEN_COOKIE_NAME);
+      expect(deviceToken).toBe('device/token=123');
+    });
+
+    it('should handle device token with special characters', () => {
+      const req = createMockRequest(`${DEVICE_TOKEN_COOKIE_NAME}=abc-123_XYZ.test`);
+      const deviceToken = parseCookieToken(req as Request, DEVICE_TOKEN_COOKIE_NAME);
+      expect(deviceToken).toBe('abc-123_XYZ.test');
+    });
+  });
+
+  describe('device token attachment to request', () => {
+    it('should set deviceToken on request when cookie is present', () => {
+      const req = createMockRequest(`${DEVICE_TOKEN_COOKIE_NAME}=device-token-value`) as Request;
+
+      // Simulate what auth middleware does
+      const deviceToken = parseCookieToken(req, DEVICE_TOKEN_COOKIE_NAME);
+      if (deviceToken) {
+        (req as any).deviceToken = deviceToken;
+      }
+
+      expect((req as any).deviceToken).toBe('device-token-value');
+    });
+
+    it('should not set deviceToken when cookie is absent', () => {
+      const req = createMockRequest('other=value') as Request;
+
+      const deviceToken = parseCookieToken(req, DEVICE_TOKEN_COOKIE_NAME);
+      if (deviceToken) {
+        (req as any).deviceToken = deviceToken;
+      }
+
+      expect((req as any).deviceToken).toBeUndefined();
+    });
+  });
+});

graphql/server/src/middleware/__tests__/graphile-device-token.test.ts

@@ -0,0 +1,104 @@
+import type { Request } from 'express';
+
+/**
+ * Test that device token is correctly passed to GraphQL context.
+ *
+ * This tests the context building logic that passes req.deviceToken
+ * to jwt.claims.device_token for DB procedures to access.
+ */
+
+describe('graphile context device token handling', () => {
+  /**
+   * Simulates the context building logic from graphile.ts buildPreset
+   */
+  const buildContext = (req: Partial<Request> & { deviceToken?: string }) => {
+    const context: Record<string, string> = {};
+
+    if (req.databaseId) {
+      context['jwt.claims.database_id'] = req.databaseId;
+    }
+    if (req.clientIp) {
+      context['jwt.claims.ip_address'] = req.clientIp;
+    }
+    if (req.deviceToken) {
+      context['jwt.claims.device_token'] = req.deviceToken;
+    }
+
+    return context;
+  };
+
+  describe('device token in context', () => {
+    it('should include device_token in jwt.claims when present on request', () => {
+      const req = {
+        deviceToken: 'device-abc123',
+        databaseId: 'db-1',
+        clientIp: '127.0.0.1',
+      };
+
+      const context = buildContext(req);
+
+      expect(context['jwt.claims.device_token']).toBe('device-abc123');
+    });
+
+    it('should not include device_token when not present on request', () => {
+      const req = {
+        databaseId: 'db-1',
+        clientIp: '127.0.0.1',
+      };
+
+      const context = buildContext(req);
+
+      expect(context['jwt.claims.device_token']).toBeUndefined();
+    });
+
+    it('should include device_token alongside other claims', () => {
+      const req = {
+        deviceToken: 'device-xyz789',
+        databaseId: 'test-db',
+        clientIp: '192.168.1.1',
+      };
+
+      const context = buildContext(req);
+
+      expect(context).toEqual({
+        'jwt.claims.database_id': 'test-db',
+        'jwt.claims.ip_address': '192.168.1.1',
+        'jwt.claims.device_token': 'device-xyz789',
+      });
+    });
+
+    it('should handle empty device token string', () => {
+      const req = {
+        deviceToken: '',
+        databaseId: 'db-1',
+      };
+
+      const context = buildContext(req);
+
+      // Empty string is falsy, so should not be included
+      expect(context['jwt.claims.device_token']).toBeUndefined();
+    });
+  });
+
+  describe('device token format', () => {
+    it('should preserve UUID-style device tokens', () => {
+      const req = {
+        deviceToken: '550e8400-e29b-41d4-a716-446655440000',
+      };
+
+      const context = buildContext(req);
+
+      expect(context['jwt.claims.device_token']).toBe('550e8400-e29b-41d4-a716-446655440000');
+    });
+
+    it('should preserve device tokens with special characters', () => {
+      const req = {
+        deviceToken: 'device_token-123.abc',
+      };
+
+      const context = buildContext(req);
+
+      expect(context['jwt.claims.device_token']).toBe('device_token-123.abc');
+    });
+  });
+});