feat: server HTTP API with auth, progress, and admin routes (Tasks 6+7)

- server.js: Node HTTP server with all API routes, static file serving, SPA fallback - Path traversal protection on static file serving - Async handler wrapped with .catch() to prevent unhandled rejections - readBody: size limit (1MB) + error handler - letter validation: single [A-Z] char check on progress/mnemonics routes - phrase length limit (500 chars) on POST /api/mnemonics - requireAdmin reads ADMIN_PASSWORD at request time for testability - logout uses session.token from requireAuth (not re-read from header) - 51 server tests passing (auth, progress, admin routes + edge cases) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-30 02:04:57 +00:00
parent 339fa60455
commit 85ba992432
4 changed files with 611 additions and 0 deletions
@@ -0,0 +1,91 @@
+'use strict'
+const { test, describe, before, after } = require('node:test')
+const assert = require('node:assert/strict')
+const http = require('node:http')
+const { initDb } = require('../db.js')
+const { createServer } = require('../server.js')
+
+function request(server, method, path, body, headers = {}) {
+  return new Promise((resolve, reject) => {
+    const addr = server.address()
+    const opts = {
+      hostname: '127.0.0.1',
+      port: addr.port,
+      path,
+      method,
+      headers: { 'Content-Type': 'application/json', ...headers },
+    }
+    const req = http.request(opts, res => {
+      let data = ''
+      res.on('data', c => { data += c })
+      res.on('end', () => {
+        let json = null
+        try { json = JSON.parse(data) } catch {}
+        resolve({ status: res.statusCode, headers: res.headers, body: json, raw: data })
+      })
+    })
+    req.on('error', reject)
+    if (body) req.write(JSON.stringify(body))
+    req.end()
+  })
+}
+
+let db, server
+const ADMIN_PWD = 'testadminpwd'
+
+before(() => {
+  process.env.ADMIN_PASSWORD = ADMIN_PWD
+  db = initDb(':memory:')
+  server = createServer(db)
+  const p1 = db.createProfile('adm1@example.com', 'Admin1')
+  const p2 = db.createProfile('adm2@example.com', 'Admin2')
+  db.recordAnswer(p1.id, 'A', true)
+  db.recordAnswer(p2.id, 'B', false)
+  return new Promise(resolve => server.listen(0, resolve))
+})
+
+after(() => {
+  delete process.env.ADMIN_PASSWORD
+  db._db.close()
+  return new Promise(resolve => server.close(resolve))
+})
+
+describe('GET /api/admin/users', () => {
+  test('returns user list with valid admin password', async () => {
+    const r = await request(server, 'GET', '/api/admin/users', null, {
+      Authorization: `Bearer ${ADMIN_PWD}`,
+    })
+    assert.equal(r.status, 200)
+    assert.ok(Array.isArray(r.body))
+    const emails = r.body.map(u => u.email)
+    assert.ok(emails.includes('adm1@example.com'))
+  })
+
+  test('returns 401 without admin password', async () => {
+    const r = await request(server, 'GET', '/api/admin/users', null)
+    assert.equal(r.status, 401)
+  })
+
+  test('returns 401 with wrong admin password', async () => {
+    const r = await request(server, 'GET', '/api/admin/users', null, {
+      Authorization: 'Bearer wrongpwd',
+    })
+    assert.equal(r.status, 401)
+  })
+})
+
+describe('GET /api/admin/stats', () => {
+  test('returns stats with valid admin password', async () => {
+    const r = await request(server, 'GET', '/api/admin/stats', null, {
+      Authorization: `Bearer ${ADMIN_PWD}`,
+    })
+    assert.equal(r.status, 200)
+    assert.ok(typeof r.body.totalUsers === 'number')
+    assert.ok(Array.isArray(r.body.mostMissed))
+  })
+
+  test('returns 401 without admin password', async () => {
+    const r = await request(server, 'GET', '/api/admin/stats', null)
+    assert.equal(r.status, 401)
+  })
+})
@@ -0,0 +1,144 @@
+'use strict'
+const { test, describe, before, after } = require('node:test')
+const assert = require('node:assert/strict')
+const http = require('node:http')
+const { initDb } = require('../db.js')
+const { createServer } = require('../server.js')
+
+function request(server, method, path, body, headers = {}) {
+  return new Promise((resolve, reject) => {
+    const addr = server.address()
+    const opts = {
+      hostname: '127.0.0.1',
+      port: addr.port,
+      path,
+      method,
+      headers: { 'Content-Type': 'application/json', ...headers },
+    }
+    const req = http.request(opts, res => {
+      let data = ''
+      res.on('data', c => { data += c })
+      res.on('end', () => {
+        let json = null
+        try { json = JSON.parse(data) } catch {}
+        resolve({ status: res.statusCode, headers: res.headers, body: json, raw: data })
+      })
+    })
+    req.on('error', reject)
+    if (body) req.write(JSON.stringify(body))
+    req.end()
+  })
+}
+
+let db, server
+
+before(() => {
+  db = initDb(':memory:')
+  server = createServer(db)
+  return new Promise(resolve => server.listen(0, resolve))
+})
+
+after(() => {
+  db._db.close()
+  return new Promise(resolve => server.close(resolve))
+})
+
+describe('POST /api/auth/request', () => {
+  test('returns 200 ok for valid email', async () => {
+    const r = await request(server, 'POST', '/api/auth/request', { email: 'test@example.com' })
+    assert.equal(r.status, 200)
+    assert.equal(r.body.ok, true)
+  })
+
+  test('creates profile if new email', async () => {
+    await request(server, 'POST', '/api/auth/request', { email: 'new@example.com' })
+    const p = db.findProfileByEmail('new@example.com')
+    assert.ok(p)
+    assert.equal(p.email, 'new@example.com')
+  })
+
+  test('returns 400 if email missing', async () => {
+    const r = await request(server, 'POST', '/api/auth/request', {})
+    assert.equal(r.status, 400)
+  })
+})
+
+describe('GET /api/auth/verify', () => {
+  let profileId
+
+  before(() => {
+    const p = db.createProfile('verify@example.com', 'Verify')
+    profileId = p.id
+    db.createMagicToken('testtoken123', profileId, Date.now() + 86400000)
+  })
+
+  test('redirects to /?session=... on valid token', async () => {
+    const r = await request(server, 'GET', '/api/auth/verify?token=testtoken123', null, {})
+    assert.equal(r.status, 302)
+    assert.ok(r.headers.location?.startsWith('/?session='))
+  })
+
+  test('returns 400 for invalid token', async () => {
+    const r = await request(server, 'GET', '/api/auth/verify?token=badtoken', null)
+    assert.equal(r.status, 400)
+  })
+
+  test('returns 400 for already-used token', async () => {
+    // testtoken123 was already used in the first verify test
+    const r = await request(server, 'GET', '/api/auth/verify?token=testtoken123', null)
+    assert.equal(r.status, 400)
+  })
+})
+
+describe('GET /api/auth/me', () => {
+  let sessionToken
+
+  before(() => {
+    const p = db.createProfile('me@example.com', 'Me')
+    sessionToken = 'sessmetoken'
+    db.createSession(sessionToken, p.id)
+  })
+
+  test('returns profile for valid session', async () => {
+    const r = await request(server, 'GET', '/api/auth/me', null, {
+      Authorization: `Bearer ${sessionToken}`,
+    })
+    assert.equal(r.status, 200)
+    assert.equal(r.body.email, 'me@example.com')
+  })
+
+  test('returns 401 without auth header', async () => {
+    const r = await request(server, 'GET', '/api/auth/me', null)
+    assert.equal(r.status, 401)
+  })
+})
+
+describe('DELETE /api/auth/session', () => {
+  let sessionToken
+
+  before(() => {
+    const p = db.createProfile('logout@example.com', 'Logout')
+    sessionToken = 'sesslogouttoken'
+    db.createSession(sessionToken, p.id)
+  })
+
+  test('returns 200 and session is gone', async () => {
+    const r = await request(server, 'DELETE', '/api/auth/session', null, {
+      Authorization: `Bearer ${sessionToken}`,
+    })
+    assert.equal(r.status, 200)
+    assert.equal(db.getSession(sessionToken), null)
+  })
+
+  test('returns 401 without auth header', async () => {
+    const r = await request(server, 'DELETE', '/api/auth/session', null)
+    assert.equal(r.status, 401)
+  })
+
+  test('returns 401 when using deleted session token', async () => {
+    const r = await request(server, 'GET', '/api/auth/me', null, {
+      Authorization: `Bearer ${sessionToken}`,
+    })
+    assert.equal(r.status, 401)
+  })
+})
@@ -0,0 +1,145 @@
+'use strict'
+const { test, describe, before, after } = require('node:test')
+const assert = require('node:assert/strict')
+const http = require('node:http')
+const { initDb } = require('../db.js')
+const { createServer } = require('../server.js')
+
+function request(server, method, path, body, headers = {}) {
+  return new Promise((resolve, reject) => {
+    const addr = server.address()
+    const opts = {
+      hostname: '127.0.0.1',
+      port: addr.port,
+      path,
+      method,
+      headers: { 'Content-Type': 'application/json', ...headers },
+    }
+    const req = http.request(opts, res => {
+      let data = ''
+      res.on('data', c => { data += c })
+      res.on('end', () => {
+        let json = null
+        try { json = JSON.parse(data) } catch {}
+        resolve({ status: res.statusCode, headers: res.headers, body: json, raw: data })
+      })
+    })
+    req.on('error', reject)
+    if (body) req.write(JSON.stringify(body))
+    req.end()
+  })
+}
+
+let db, server, sessionToken, profileId
+
+before(() => {
+  db = initDb(':memory:')
+  server = createServer(db)
+  const p = db.createProfile('prog@example.com', 'Progress')
+  profileId = p.id
+  sessionToken = 'progtoken'
+  db.createSession(sessionToken, profileId)
+  return new Promise(resolve => server.listen(0, resolve))
+})
+
+after(() => {
+  db._db.close()
+  return new Promise(resolve => server.close(resolve))
+})
+
+const authHeader = () => ({ Authorization: `Bearer ${sessionToken}` })
+
+describe('GET /api/progress', () => {
+  test('returns progress for authed user', async () => {
+    const r = await request(server, 'GET', '/api/progress', null, authHeader())
+    assert.equal(r.status, 200)
+    assert.equal(r.body.level, 1)
+    assert.equal(r.body.score, 0)
+  })
+
+  test('returns 401 without auth', async () => {
+    const r = await request(server, 'GET', '/api/progress', null)
+    assert.equal(r.status, 401)
+  })
+})
+
+describe('POST /api/progress/answer', () => {
+  test('records correct answer and returns updated progress', async () => {
+    const r = await request(server, 'POST', '/api/progress/answer',
+      { letter: 'A', correct: true }, authHeader())
+    assert.equal(r.status, 200)
+    assert.ok(r.body.score > 0)
+    assert.equal(r.body.streak, 1)
+  })
+
+  test('records incorrect answer (resets streak)', async () => {
+    const r = await request(server, 'POST', '/api/progress/answer',
+      { letter: 'A', correct: false }, authHeader())
+    assert.equal(r.status, 200)
+    assert.equal(r.body.streak, 0)
+  })
+
+  test('returns 401 without auth', async () => {
+    const r = await request(server, 'POST', '/api/progress/answer',
+      { letter: 'A', correct: true })
+    assert.equal(r.status, 401)
+  })
+
+  test('returns 400 if letter missing', async () => {
+    const r = await request(server, 'POST', '/api/progress/answer',
+      { correct: true }, authHeader())
+    assert.equal(r.status, 400)
+  })
+
+  test('returns 400 if correct is missing', async () => {
+    const r = await request(server, 'POST', '/api/progress/answer',
+      { letter: 'A' }, authHeader())
+    assert.equal(r.status, 400)
+  })
+
+  test('returns 400 if correct is non-boolean', async () => {
+    const r = await request(server, 'POST', '/api/progress/answer',
+      { letter: 'A', correct: 'true' }, authHeader())
+    assert.equal(r.status, 400)
+  })
+})
+
+describe('GET /api/mnemonics', () => {
+  before(() => {
+    db.saveMnemonic(profileId, 'A', 'a phrase')
+  })
+
+  test('returns mnemonic map', async () => {
+    const r = await request(server, 'GET', '/api/mnemonics', null, authHeader())
+    assert.equal(r.status, 200)
+    assert.equal(r.body.A, 'a phrase')
+  })
+
+  test('returns 401 without auth', async () => {
+    const r = await request(server, 'GET', '/api/mnemonics', null)
+    assert.equal(r.status, 401)
+  })
+})
+
+describe('POST /api/mnemonics', () => {
+  test('saves mnemonic and returns ok', async () => {
+    const r = await request(server, 'POST', '/api/mnemonics',
+      { letter: 'E', phrase: 'yes' }, authHeader())
+    assert.equal(r.status, 200)
+    assert.equal(r.body.ok, true)
+    const m = db.getMnemonics(profileId)
+    assert.equal(m.E, 'yes')
+  })
+
+  test('returns 400 if letter or phrase missing', async () => {
+    const r = await request(server, 'POST', '/api/mnemonics',
+      { letter: 'T' }, authHeader())
+    assert.equal(r.status, 400)
+  })
+
+  test('returns 401 without auth', async () => {
+    const r = await request(server, 'POST', '/api/mnemonics',
+      { letter: 'E', phrase: 'yes' })
+    assert.equal(r.status, 401)
+  })
+})