feuerwerk/tools/lib/auth.mjs

/**
 * Signing the check tools in. Since #177 every API route but `auth/*` needs a session, so every
 * seed, smoke and e2e run logs in first – as `e2e`, the account that owns the four test projects.
 *
 * The password is never in the repo: it comes from `FEUERWERK_E2E_PASSWORD` or from
 * `data/e2e-password.txt`, which is git-ignored and written once per server (CI writes its own).
 */
import { readFile } from 'node:fs/promises';
import { dirname, resolve } from 'node:path';
import { fileURLToPath } from 'node:url';

export const E2E_USER = 'e2e';
/** The administrator the user management step signs in as (#179); it owns nothing. */
export const E2E_ADMIN = 'e2e-admin';

const DATA = resolve(dirname(fileURLToPath(import.meta.url)), '../../data');
const PASSWORD_FILE = resolve(DATA, 'e2e-password.txt');
const ADMIN_PASSWORD_FILE = resolve(DATA, 'e2e-admin-password.txt');
const COOKIE = 'feuerwerk_session';

/** One session per server for the whole process; logging in per request would be pointless load. */
const cookies = new Map();

/** The password of the `e2e` account; the step that drives the sign-in screen types it in. */
export async function e2ePassword() {
  const fromEnv = process.env.FEUERWERK_E2E_PASSWORD;
  if (fromEnv) return fromEnv;
  try {
    return (await readFile(PASSWORD_FILE, 'utf8')).trim();
  } catch {
    throw new Error(
      `no password for the "${E2E_USER}" account: set FEUERWERK_E2E_PASSWORD or put it in ${PASSWORD_FILE}`,
    );
  }
}

/** The password of `e2e-admin`, from `FEUERWERK_E2E_ADMIN_PASSWORD` or `data/e2e-admin-password.txt`. */
export async function e2eAdminPassword() {
  const fromEnv = process.env.FEUERWERK_E2E_ADMIN_PASSWORD;
  if (fromEnv) return fromEnv;
  try {
    return (await readFile(ADMIN_PASSWORD_FILE, 'utf8')).trim();
  } catch {
    throw new Error(
      `no password for the "${E2E_ADMIN}" account: set FEUERWERK_E2E_ADMIN_PASSWORD or put it in ${ADMIN_PASSWORD_FILE}`,
    );
  }
}

/**
 * Signs in as anyone and answers with a fresh `feuerwerk_session=…`, uncached – for a step that
 * needs a second account beside the tools' own.
 */
export async function logIn(baseUrl, username, password) {
  const res = await fetch(`${baseUrl}api/index.php?r=auth/login`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ username, password }),
    signal: AbortSignal.timeout(20_000),
  });
  if (!res.ok) {
    throw new Error(`could not sign in as "${username}" at ${baseUrl}: HTTP ${res.status}`);
  }
  // `getSetCookie` keeps the headers apart; a joined string cannot be split on commas, because a
  // cookie's own Expires date carries one.
  const set = res.headers.getSetCookie().find((c) => c.startsWith(`${COOKIE}=`));
  if (!set) throw new Error(`signing in at ${baseUrl} returned no ${COOKIE} cookie`);
  return set.split(';')[0];
}

/** `feuerwerk_session=…` for `Cookie` headers, logging in on first use. */
export async function sessionCookie(baseUrl) {
  const cached = cookies.get(baseUrl);
  if (cached) return cached;
  const cookie = await logIn(baseUrl, E2E_USER, await e2ePassword());
  cookies.set(baseUrl, cookie);
  return cookie;
}

/**
 * Drops the cached session, so the next request signs in again. Changing the password ends every
 * other session of the account (#182) – the step that does it leaves the tools' one dead.
 */
export function forgetSession(baseUrl) {
  cookies.delete(baseUrl);
}

/** The headers a tool's `fetch` needs on top of its own. */
export async function authHeaders(baseUrl) {
  return { Cookie: await sessionCookie(baseUrl) };
}

/** The session token alone – what the browser gets handed over CDP. */
export async function sessionToken(baseUrl) {
  return (await sessionCookie(baseUrl)).slice(COOKIE.length + 1);
}

export const SESSION_COOKIE = COOKIE;