KirinCode/packages/kirincode/test/server/auth.test.ts

import { afterEach, describe, expect, test } from "bun:test"
import { Option, Redacted } from "effect"
import { Flag } from "@kirincode-ai/core/flag/flag"
import { ServerAuth } from "../../src/server/auth"

const original = {
  KIRINCODE_SERVER_PASSWORD: Flag.KIRINCODE_SERVER_PASSWORD,
  KIRINCODE_SERVER_USERNAME: Flag.KIRINCODE_SERVER_USERNAME,
}

afterEach(() => {
  Flag.KIRINCODE_SERVER_PASSWORD = original.KIRINCODE_SERVER_PASSWORD
  Flag.KIRINCODE_SERVER_USERNAME = original.KIRINCODE_SERVER_USERNAME
})

describe("ServerAuth", () => {
  test("does not emit auth headers without a password", () => {
    Flag.KIRINCODE_SERVER_PASSWORD = undefined
    Flag.KIRINCODE_SERVER_USERNAME = "alice"

    expect(ServerAuth.header()).toBeUndefined()
    expect(ServerAuth.headers()).toBeUndefined()
  })

  test("defaults to the kirincode username", () => {
    Flag.KIRINCODE_SERVER_PASSWORD = "secret"
    Flag.KIRINCODE_SERVER_USERNAME = undefined

    expect(ServerAuth.headers()).toEqual({
      Authorization: `Basic ${Buffer.from("opencode:secret").toString("base64")}`,
    })
  })

  test("uses the configured username", () => {
    Flag.KIRINCODE_SERVER_PASSWORD = "secret"
    Flag.KIRINCODE_SERVER_USERNAME = "alice"

    expect(ServerAuth.headers()).toEqual({
      Authorization: `Basic ${Buffer.from("alice:secret").toString("base64")}`,
    })
  })

  test("prefers explicit credentials", () => {
    Flag.KIRINCODE_SERVER_PASSWORD = "secret"
    Flag.KIRINCODE_SERVER_USERNAME = "alice"

    expect(ServerAuth.headers({ password: "cli-secret", username: "bob" })).toEqual({
      Authorization: `Basic ${Buffer.from("bob:cli-secret").toString("base64")}`,
    })
  })

  test("validates decoded credentials against effect config", () => {
    const config = { password: Option.some("secret"), username: "alice" }

    expect(ServerAuth.required(config)).toBe(true)
    expect(ServerAuth.authorized({ username: "alice", password: Redacted.make("secret") }, config)).toBe(true)
    expect(ServerAuth.authorized({ username: "kirincode", password: Redacted.make("secret") }, config)).toBe(false)
  })
})