Merge pull request #242 from geturbackend/feature/auth-fixes-and-react-sdk-tests

Author: yash-pouranik

AGENTS.md

@@ -10,6 +10,11 @@ Main apps:
 - `apps/web-dashboard`: React/Vite dashboard
 - `packages/common`: shared models, validation, middleware, encryption, DB/model utilities
 
+SDKs:
+- `sdks/urbackend-sdk`: Core TypeScript/JavaScript SDK (Framework-agnostic)
+- `sdks/urbackend-react`: React SDK (`UrProvider`, `useUrContext`, UI components)
+- `sdks/urbackend-python`: Official Python SDK (Requests-based)
+
 Workspace scripts are defined in [package.json](/package.json).
 
 ## Important project rules
@@ -69,6 +74,7 @@ Behavior:
 ## Redis key patterns
 - Refresh session: `project:auth:refresh:session:{tokenId}`
 - OAuth state: `project:auth:oauth:state:{state}` (10min TTL)
+- Social Refresh Exchange: `project:social-auth:refresh-exchange:{rtCode}` (Uses atomic `GETDEL` for concurrency safety)
 - Mail count: `project:mail:count:{projectId}:{YYYY-MM}` (TTL = end of month)
 - Do NOT change these patterns — existing sessions will break
 
@@ -144,11 +150,26 @@ cd apps/web-dashboard
 npm run build
 ```
 
+Run SDK tests:
+```bash
+# JS Core SDK
+npm run test --workspace=@urbackend/sdk
+
+# React SDK (Vitest)
+npm run test --workspace=@urbackend/react
+
+# Python SDK (pytest)
+cd sdks/urbackend-python
+pytest
+```
+
 ## Testing expectations
 
 Before shipping auth, RLS, or schema changes:
 - run `apps/public-api` tests
 - run `apps/dashboard-api` tests
+- run `@urbackend/sdk` tests
+- run `@urbackend/react` tests
 - run `apps/web-dashboard` lint
 - run `apps/web-dashboard` build when frontend changed
 

apps/consumer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "consumer",
-  "version": "1.0.0",
+  "version": "0.1.0",
   "description": "",
   "main": "src/app.js",
   "scripts": {

apps/dashboard-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dashboard-api",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "private": true,
   "license": "AGPL-3.0-only",
   "main": "src/app.js",

apps/dashboard-api/src/__tests__/billing.controller.test.js

@@ -2,7 +2,7 @@
 
 const crypto = require('crypto');
 
-class AppError extends Error {
+class mockAppError extends Error {
     constructor(statusCode, message) {
         super(message);
         this.statusCode = statusCode;
@@ -22,7 +22,7 @@ jest.mock('@urbackend/common', () => ({
         findById: jest.fn(),
         sort: jest.fn().mockReturnThis(),
     },
-    AppError,
+    AppError: mockAppError,
     sendProRequestConfirmationEmail: jest.fn().mockResolvedValue(true),
     sanitizeNonEmptyString: jest.fn(str => (typeof str === 'string' && str.trim() !== '' ? str.trim() : null)),
     sanitizeObjectId: jest.fn(id => id),
@@ -64,7 +64,7 @@ describe('Billing Controller', () => {
     describe('createCheckout', () => {
         test('returns 403 immediately due to Beta toggle', async () => {
             await controller.createCheckout(req, res, next);
-            expect(next).toHaveBeenCalledWith(expect.any(AppError));
+            expect(next).toHaveBeenCalledWith(expect.any(mockAppError));
             expect(next.mock.calls[0][0].statusCode).toBe(403);
             expect(next.mock.calls[0][0].message).toContain('Automatic payments are disabled');
         });
@@ -91,7 +91,7 @@ describe('Billing Controller', () => {
 
             await controller.createProRequest(req, res, next);
 
-            expect(next).toHaveBeenCalledWith(expect.any(AppError));
+            expect(next).toHaveBeenCalledWith(expect.any(mockAppError));
             expect(next.mock.calls[0][0].statusCode).toBe(400);
             expect(ProRequest.create).not.toHaveBeenCalled();
         });
@@ -102,7 +102,7 @@ describe('Billing Controller', () => {
 
             await controller.createProRequest(req, res, next);
 
-            expect(next).toHaveBeenCalledWith(expect.any(AppError));
+            expect(next).toHaveBeenCalledWith(expect.any(mockAppError));
             expect(next.mock.calls[0][0].statusCode).toBe(400);
             expect(ProRequest.create).not.toHaveBeenCalled();
         });
@@ -112,7 +112,7 @@ describe('Billing Controller', () => {
         test('returns 403 if user is not admin', async () => {
             req.user.isAdmin = false;
             await controller.getProRequests(req, res, next);
-            expect(next).toHaveBeenCalledWith(expect.any(AppError));
+            expect(next).toHaveBeenCalledWith(expect.any(mockAppError));
             expect(next.mock.calls[0][0].statusCode).toBe(403);
         });
 
@@ -133,7 +133,7 @@ describe('Billing Controller', () => {
         test('returns 403 if user is not admin', async () => {
             req.user.isAdmin = false;
             await controller.approveProRequest(req, res, next);
-            expect(next).toHaveBeenCalledWith(expect.any(AppError));
+            expect(next).toHaveBeenCalledWith(expect.any(mockAppError));
             expect(next.mock.calls[0][0].statusCode).toBe(403);
         });
 
@@ -166,7 +166,7 @@ describe('Billing Controller', () => {
 
             await controller.approveProRequest(req, res, next);
 
-            expect(next).toHaveBeenCalledWith(expect.any(AppError));
+            expect(next).toHaveBeenCalledWith(expect.any(mockAppError));
             expect(next.mock.calls[0][0].statusCode).toBe(400);
             expect(next.mock.calls[0][0].message).toContain('already approved');
         });

apps/public-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "public-api",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "private": true,
   "license": "AGPL-3.0-only",
   "main": "src/app.js",

apps/public-api/src/__tests__/userAuth.refresh.test.js

@@ -213,6 +213,36 @@ describe('public userAuth refresh flow', () => {
         );
     });
 
+    test('refresh-token returns 403 when user is soft-deleted', async () => {
+        const incoming = 'token_2.secret_2';
+        const session = {
+            tokenId: 'token_2',
+            projectId: 'project_1',
+            userId: 'user_1',
+            tokenHash: hashToken(incoming),
+            isUsed: false,
+            revokedAt: null,
+            expiresAt: new Date(Date.now() + 60_000).toISOString(),
+        };
+
+        getRefreshSession.mockResolvedValueOnce(session);
+        Project.__chain.lean.mockResolvedValueOnce(makeProject());
+        mockModel.findOne.mockReturnValueOnce({
+            lean: jest.fn().mockResolvedValue({ _id: 'user_1', isDeleted: true, deletedAt: new Date().toISOString() }),
+        });
+
+        const req = makeReq({
+            headers: { 'x-refresh-token': incoming },
+        });
+        const res = makeRes();
+
+        await controller.refreshToken(req, res);
+
+        expect(res.status).toHaveBeenCalledWith(403);
+        expect(res.json).toHaveBeenCalledWith({ success: false, data: {}, message: expect.stringContaining('deletion') });
+        expect(res.clearCookie).toHaveBeenCalledWith('refreshToken', expect.any(Object));
+    });
+
     test('logout revokes current refresh session when provided', async () => {
         const rawToken = 'token_2.secret_2';
         const session = {

apps/public-api/src/__tests__/userAuth.social.test.js

@@ -51,6 +51,7 @@ jest.mock('@urbackend/common', () => {
         redis: {
             set: jest.fn().mockResolvedValue('OK'),
             get: jest.fn(),
+            getdel: jest.fn(),
             del: jest.fn().mockResolvedValue(1),
         },
         Project: {
@@ -441,7 +442,7 @@ describe('public userAuth social auth', () => {
     });
 
     test('exchangeSocialRefreshToken returns refresh token and deletes exchange code', async () => {
-        redis.get.mockResolvedValueOnce(JSON.stringify({
+        redis.getdel.mockResolvedValueOnce(JSON.stringify({
             token: 'issued_access_token',
             refreshToken: 'issued_refresh_token',
         }));
@@ -455,8 +456,7 @@ describe('public userAuth social auth', () => {
 
         await controller.exchangeSocialRefreshToken(req, res);
 
-        expect(redis.get).toHaveBeenCalledWith('project:social-auth:refresh-exchange:code_123');
-        expect(redis.del).toHaveBeenCalledWith('project:social-auth:refresh-exchange:code_123');
+        expect(redis.getdel).toHaveBeenCalledWith('project:social-auth:refresh-exchange:code_123');
         expect(res.status).toHaveBeenCalledWith(200);
         expect(res.json).toHaveBeenCalledWith({
             success: true,
@@ -468,7 +468,7 @@ describe('public userAuth social auth', () => {
     });
 
     test('exchangeSocialRefreshToken rejects invalid or expired code', async () => {
-        redis.get.mockResolvedValueOnce(null);
+        redis.getdel.mockResolvedValueOnce(null);
 
         const req = makeReq();
         req.body = {
@@ -482,12 +482,13 @@ describe('public userAuth social auth', () => {
         expect(res.status).toHaveBeenCalledWith(400);
         expect(res.json).toHaveBeenCalledWith({
             success: false,
+            data: {},
             message: 'Invalid or expired refresh token exchange code',
         });
     });
 
     test('exchangeSocialRefreshToken rejects mismatched token and deletes exchange code', async () => {
-        redis.get.mockResolvedValueOnce(JSON.stringify({
+        redis.getdel.mockResolvedValueOnce(JSON.stringify({
             token: 'expected_access_token',
             refreshToken: 'issued_refresh_token',
         }));
@@ -500,11 +501,10 @@ describe('public userAuth social auth', () => {
         const res = makeRes();
 
         await controller.exchangeSocialRefreshToken(req, res);
-
-        expect(redis.del).toHaveBeenCalledWith('project:social-auth:refresh-exchange:code_456');
         expect(res.status).toHaveBeenCalledWith(403);
         expect(res.json).toHaveBeenCalledWith({
             success: false,
+            data: {},
             message: 'Invalid refresh token exchange payload',
         });
     });
@@ -611,4 +611,83 @@ describe('public userAuth social auth', () => {
         expect(res.redirect).toHaveBeenCalledWith(expect.stringContaining('error='));
         expect(res.redirect).toHaveBeenCalledWith(expect.stringContaining('not+verified'));
     });
+
+    test('handleSocialAuthCallback rejects soft-deleted user by provider id', async () => {
+        redis.get.mockResolvedValueOnce(JSON.stringify({
+            projectId: 'project_1',
+            provider: 'github',
+            callbackUrl: 'http://localhost:5173/auth/callback',
+        }));
+        mockProjectFindByIdChain.lean.mockResolvedValueOnce(makeProject());
+
+        // mock soft deleted user
+        mockUsersModel.findOne.mockResolvedValueOnce({
+            _id: 'deleted_user',
+            githubId: '123',
+            isDeleted: true,
+            deletedAt: new Date().toISOString()
+        });
+
+        global.fetch
+            .mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({ access_token: 'github_access_token' }),
+            })
+            .mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({ id: 123, login: 'alice', avatar_url: '' }),
+            })
+            .mockResolvedValueOnce({
+                ok: true,
+                json: async () => ([{ email: 'alice@example.com', primary: true, verified: true }]),
+            });
+
+        const req = makeReq({ params: { provider: 'github' }, query: { code: 'code_1', state: 'state_1' } });
+        const res = makeRes();
+
+        await controller.handleSocialAuthCallback(req, res);
+
+        expect(res.redirect).toHaveBeenCalledWith(expect.stringContaining('error='));
+        expect(res.redirect).toHaveBeenCalledWith(expect.stringContaining('deletion'));
+    });
+
+    test('handleSocialAuthCallback rejects soft-deleted user by verified email', async () => {
+        redis.get.mockResolvedValueOnce(JSON.stringify({
+            projectId: 'project_1',
+            provider: 'github',
+            callbackUrl: 'http://localhost:5173/auth/callback',
+        }));
+        mockProjectFindByIdChain.lean.mockResolvedValueOnce(makeProject());
+
+        mockUsersModel.findOne
+            .mockResolvedValueOnce(null)
+            .mockResolvedValueOnce({
+                _id: 'deleted_user',
+                email: 'alice@example.com',
+                isDeleted: true,
+                deletedAt: new Date().toISOString()
+            });
+
+        global.fetch
+            .mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({ access_token: 'github_access_token' }),
+            })
+            .mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({ id: 123, login: 'alice', avatar_url: '' }),
+            })
+            .mockResolvedValueOnce({
+                ok: true,
+                json: async () => ([{ email: 'alice@example.com', verified: true, primary: true }]),
+            });
+
+        const req = makeReq({ params: { provider: 'github' }, query: { code: 'code_1', state: 'state_1' } });
+        const res = makeRes();
+
+        await controller.handleSocialAuthCallback(req, res);
+
+        expect(res.redirect).toHaveBeenCalledWith(expect.stringContaining('error='));
+        expect(res.redirect).toHaveBeenCalledWith(expect.stringContaining('deletion'));
+    });
 });