Authentication

import {
	currentUser,
	defineUser,
	isAuthenticated,
	isOwner,
	isSelf,
	signedIn,
} from '@ultimabase/auth'
import { graphql } from '@ultimabase/graphql'
import { password } from '@ultimabase/password'
import { allow, anyOf, defineModel } from 'ultimabase'

export const User = defineUser({
	name: 'User',
	use: [graphql(), password()],
	fields: (f) => ({
		name: f.string(),
		// Only the server makes an editor: no client writes this field.
		editor: f.boolean({ default: false }).with({ access: allow.readOnly }),
		posts: f.many(() => Post, { inverse: 'author' }),
	}),
}).with({
	// Signed-in users read each other's names; each user changes their own.
	access: { read: isAuthenticated, update: isSelf },
})

// Every rule, hook and function now reads `caller.user` as a `User`.
declare module 'ultimabase' {
	interface Register {
		readonly user: typeof User
	}
}

plugins: [
	// Listens on PORT, or 3000.
	httpPlugin(),
	graphqlPlugin(),
	// Sessions, and the caller of each request.
	authPlugin(),
	// A user signs up with an email, a password and a name, and receives
	// the reset and verification emails sendEmail sends.
	passwordPlugin({ signUp: ['name'], sendEmail }),
],

const response = await post(
	`mutation ($input: SignUpInput!) {
		signUp(input: $input) { token expiresAt user { name } }
	}`,
	{
		input: {
			email: 'ada@example.com',
			password: 'correct horse',
			name: 'Ada',
		},
	},
)
const { token } = signedUp.parse(await response.json()).data.signUp
const bearer = { authorization: `Bearer ${token}` }
expect(await viewer(bearer)).toEqual({ data: { viewer: { name: 'Ada' } } })
expect(await viewer({})).toEqual({ data: { viewer: null } })

/** A GraphQL request, and its response. */
const post = (
	query: string,
	variables: object = {},
	headers: Record<string, string> = {},
): Promise<Response> =>
	fetch(`${running.url}/graphql`, {
		method: 'POST',
		headers: { 'content-type': 'application/json', ...headers },
		body: JSON.stringify({ query, variables }),
	})

const response = await post(
	`mutation ($input: SignInInput!) { signIn(input: $input) { user { name } } }`,
	{ input: { email: 'ada@example.com', password: 'correct horse' } },
)
const set = response.headers.get('set-cookie') ?? ''
expect(set).toMatch(
	/^ultimabase_session=.+; Max-Age=\d+; Path=\/; HttpOnly; SameSite=Lax$/,
)
// A browser sends it back by itself.
const cookie = { cookie: set.split(';')[0] ?? '' }
expect(await viewer(cookie)).toEqual({ data: { viewer: { name: 'Ada' } } })

// signOut ends the session and clears the cookie.
const out = await post('mutation { signOut }', {}, cookie)
expect(await out.json()).toEqual({ data: { signOut: true } })
expect(out.headers.get('set-cookie')).toMatch(
	/^ultimabase_session=; Max-Age=0/,
)
// A stale cookie is anonymous, so the browser can sign in again.
expect(await viewer(cookie)).toEqual({ data: { viewer: null } })

const ada = await User.signUp(
	{
		email: 'ada@example.com',
		password: 'correct horse',
		data: { name: 'Ada' },
	},
	{ as: master },
)
// Opens a session, as the signIn function does, without its cookie.
const { token, user } = await User.signIn({
	email: 'ada@example.com',
	password: 'correct horse',
})
expect(user?.name).toBe('Ada')

// Ends every session of the user, on every device.
await User.revokeSessions({ id: ada.id }, { as: master })
// The request is refused before it runs, whatever it asks.
const revoked = await post(
	'{ viewer { name } }',
	{},
	{
		authorization: `Bearer ${token}`,
	},
)
expect(revoked.status).toBe(401)
expect(await revoked.json()).toEqual({
	code: 'UNAUTHENTICATED',
	message: 'The session expired or was revoked: sign in again.',
})

const ada = await signUp('ada')
const names = '{ users { edges { node { name } } } }'
expect(await request(names)).toEqual({ data: { users: { edges: [] } } })
expect(await request(names, {}, as(ada.token))).toEqual({
	data: { users: { edges: [{ node: { name: 'ada' } }] } },
})

export const Post = defineModel({
	name: 'Post',
	use: [graphql()],
	fields: (f) => ({
		title: f.string(),
		published: f.boolean({ default: false }),
		// Whoever creates the post.
		author: f.one(() => User, { default: currentUser }),
	}),
}).with({
	access: {
		// Everyone reads published posts; an author reads their drafts too.
		read: ({ caller, where }) =>
			caller.kind === 'user'
				? where({
						OR: [
							{ published: { equals: true } },
							{ author: { is: { id: { equals: caller.user.id } } } },
						],
					})
				: where({ published: { equals: true } }),
		// A post is written in its author's name only: the caller's own.
		create: isOwner('author'),
		update: isOwner('author'),
		// An author deletes their posts, an editor anyone's.
		delete: anyOf(
			isOwner('author'),
			signedIn(({ user }) => user.editor),
		),
	},
})

const { ada, grace, post } = await written()
const hello = [{ node: { title: 'Hello' } }]
expect(await titles()).toEqual([])
expect(await titles(as(grace.token))).toEqual([])
expect(await titles(as(ada.token))).toEqual(hello)
const publish = `mutation ($id: ID!) {
	updatePost(where: { id: $id }, data: { published: true }) { published }
}`
// Grace cannot see the draft, so it does not exist for her.
expect(await request(publish, { id: post }, as(grace.token))).toMatchObject(
	refused('NOT_FOUND'),
)
expect(await request(publish, { id: post }, as(ada.token))).toEqual({
	data: { updatePost: { published: true } },
})
expect(await titles()).toEqual(hello)
// Now she sees it, but it is not hers.
expect(await request(publish, { id: post }, as(grace.token))).toMatchObject(
	refused('ACCESS_DENIED'),
)