Approve devices through Cloudflare API

2026-05-08 18:04:28 -04:00
parent c8ed3128ed
commit da7694d5d2
5 changed files with 634 additions and 122 deletions
@@ -0,0 +1,235 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import { authSessionCacheKvKey, authTokenHash } from "../src/auth.js";
+import { handleRequest } from "../src/index.js";
+import {
+  ACCESS_TOKEN,
+  PUBLIC_KEY,
+  sessionDocument,
+  testD1Database,
+  testEnv,
+} from "./devices_test_support.js";
+
+const DEVICE_APPROVAL_IDEMPOTENCY_KEY = "device-approval-0001";
+
+describe("device approval routes", () => {
+  it("approves a pending device from an approved current device", async () => {
+    const tokenHash = await authTokenHash(ACCESS_TOKEN);
+    const d1 = testD1Database({
+      firstRows: [
+        null,
+        deviceRow({ device_id: "device-01", approval_status: "approved" }),
+        deviceRow({ device_id: "device-02", approval_status: "pending", approved_at: null }),
+        deviceRow({
+          device_id: "device-02",
+          approval_status: "approved",
+          approved_at: 1_780_000_300,
+        }),
+      ],
+    });
+
+    const response = await handleRequest(
+      new Request("https://elydora.test/api/devices/approve", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${ACCESS_TOKEN}`,
+          "content-type": "application/json",
+        },
+        body: JSON.stringify(deviceApprovalBody()),
+      }),
+      testEnv({
+        d1,
+        kvEntries: [[authSessionCacheKvKey("local", tokenHash), sessionDocument("device-01")]],
+      }),
+    );
+
+    assert.equal(response.status, 200);
+    assert.equal(response.headers.get("cache-control"), "no-store");
+    assert.deepEqual(await response.json(), {
+      version: 1,
+      user_id: "user-01",
+      approved_by_device_id: "device-01",
+      approved_at: 1_780_000_300,
+      device: {
+        device_id: "device-02",
+        public_key: PUBLIC_KEY,
+        device_name: "MacBook Pro",
+        platform: "macOS",
+        approval_status: "approved",
+        created_at: 1_780_000_000,
+        approved_at: 1_780_000_300,
+        last_active_at: 1_780_000_020,
+        revoked_at: null,
+        current: false,
+      },
+    });
+    assert.equal(d1.batches[0], 2);
+    assert.ok(d1.queries[0]?.includes("FROM device_approvals"));
+    assert.ok(d1.queries[1]?.includes("approval_status = 'approved'"));
+    assert.ok(d1.queries[3]?.includes("INSERT INTO device_approvals"));
+    assert.ok(d1.queries[4]?.includes("UPDATE user_devices"));
+    assert.deepEqual(d1.binds[0], ["user-01", DEVICE_APPROVAL_IDEMPOTENCY_KEY]);
+    assert.deepEqual(d1.binds[1], ["user-01", "device-01"]);
+    assert.deepEqual(d1.binds[2], ["user-01", "device-02"]);
+    assert.deepEqual(d1.binds[3]?.slice(0, 4), [
+      "user-01",
+      DEVICE_APPROVAL_IDEMPOTENCY_KEY,
+      "device-02",
+      "device-01",
+    ]);
+    assert.equal(d1.binds[3]?.[7], DEVICE_APPROVAL_IDEMPOTENCY_KEY);
+    assert.deepEqual(d1.binds[5], ["user-01", "device-02"]);
+  });
+
+  it("returns the existing approval for an idempotent replay", async () => {
+    const tokenHash = await authTokenHash(ACCESS_TOKEN);
+    const d1 = testD1Database({
+      firstRows: [
+        {
+          device_id: "device-02",
+          requester_device_id: "device-01",
+          status: "approved",
+          decided_at: 1_780_000_300,
+        },
+        deviceRow({
+          device_id: "device-02",
+          approval_status: "approved",
+          approved_at: 1_780_000_300,
+        }),
+      ],
+    });
+
+    const response = await handleRequest(
+      new Request("https://elydora.test/api/devices/approve", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${ACCESS_TOKEN}`,
+          "content-type": "application/json",
+        },
+        body: JSON.stringify(deviceApprovalBody()),
+      }),
+      testEnv({
+        d1,
+        kvEntries: [[authSessionCacheKvKey("local", tokenHash), sessionDocument("device-01")]],
+      }),
+    );
+
+    assert.equal(response.status, 200);
+    const body = (await response.json()) as { approved_at: number };
+    assert.equal(body.approved_at, 1_780_000_300);
+    assert.deepEqual(d1.batches, []);
+    assert.equal(d1.queries.length, 2);
+    assert.deepEqual(d1.binds, [
+      ["user-01", DEVICE_APPROVAL_IDEMPOTENCY_KEY],
+      ["user-01", "device-02"],
+    ]);
+  });
+
+  it("rejects approval from a current device that is not approved", async () => {
+    const tokenHash = await authTokenHash(ACCESS_TOKEN);
+    const d1 = testD1Database({ firstRows: [null, null] });
+    const response = await handleRequest(
+      new Request("https://elydora.test/api/devices/approve", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${ACCESS_TOKEN}`,
+          "content-type": "application/json",
+        },
+        body: JSON.stringify(deviceApprovalBody()),
+      }),
+      testEnv({
+        d1,
+        kvEntries: [[authSessionCacheKvKey("local", tokenHash), sessionDocument("device-01")]],
+      }),
+    );
+
+    assert.equal(response.status, 403);
+    assert.deepEqual(await response.json(), { error: "device_approval_forbidden" });
+    assert.deepEqual(d1.batches, []);
+  });
+
+  it("rejects self approval before D1 writes", async () => {
+    const tokenHash = await authTokenHash(ACCESS_TOKEN);
+    const d1 = testD1Database([]);
+    const response = await handleRequest(
+      new Request("https://elydora.test/api/devices/approve", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${ACCESS_TOKEN}`,
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({ ...deviceApprovalBody(), device_id: "device-01" }),
+      }),
+      testEnv({
+        d1,
+        kvEntries: [[authSessionCacheKvKey("local", tokenHash), sessionDocument("device-01")]],
+      }),
+    );
+
+    assert.equal(response.status, 403);
+    assert.deepEqual(d1.queries, []);
+  });
+
+  it("rejects invalid approval payloads before D1 writes", async () => {
+    const tokenHash = await authTokenHash(ACCESS_TOKEN);
+    const d1 = testD1Database([]);
+    const response = await handleRequest(
+      new Request("https://elydora.test/api/devices/approve", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${ACCESS_TOKEN}`,
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({ ...deviceApprovalBody(), idempotency_key: "short" }),
+      }),
+      testEnv({
+        d1,
+        kvEntries: [[authSessionCacheKvKey("local", tokenHash), sessionDocument("device-01")]],
+      }),
+    );
+
+    assert.equal(response.status, 400);
+    assert.deepEqual(await response.json(), { error: "invalid_device_approval" });
+    assert.deepEqual(d1.queries, []);
+  });
+
+  it("rejects unauthenticated device approval before D1 writes", async () => {
+    const d1 = testD1Database([]);
+    const response = await handleRequest(
+      new Request("https://elydora.test/api/devices/approve", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(deviceApprovalBody()),
+      }),
+      testEnv({ d1 }),
+    );
+
+    assert.equal(response.status, 401);
+    assert.deepEqual(await response.json(), { error: "authorization_missing" });
+    assert.deepEqual(d1.queries, []);
+  });
+});
+
+function deviceApprovalBody(): Record<string, unknown> {
+  return {
+    version: 1,
+    device_id: "device-02",
+    idempotency_key: DEVICE_APPROVAL_IDEMPOTENCY_KEY,
+  };
+}
+
+function deviceRow(overrides: Record<string, unknown>): Record<string, unknown> {
+  return {
+    device_id: "device-01",
+    public_key: PUBLIC_KEY,
+    device_name: "MacBook Pro",
+    platform: "macOS",
+    approval_status: "approved",
+    created_at: 1_780_000_000,
+    approved_at: 1_780_000_010,
+    last_active_at: 1_780_000_020,
+    revoked_at: null,
+    ...overrides,
+  };
+}
@@ -1,18 +1,17 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";

-import type {
-  ElyAnalyticsDataPoint,
-  ElyD1Database,
-  ElyD1PreparedStatement,
-  ElyR2PutOptions,
-  Env,
-} from "../src/bindings.js";
+import type { ElyAnalyticsDataPoint } from "../src/bindings.js";
 import { authSessionCacheKvKey, authTokenHash } from "../src/auth.js";
 import { handleRequest } from "../src/index.js";
+import {
+  ACCESS_TOKEN,
+  PUBLIC_KEY,
+  sessionDocument,
+  testD1Database,
+  testEnv,
+} from "./devices_test_support.js";

-const ACCESS_TOKEN = "D".repeat(48);
-const PUBLIC_KEY = "a".repeat(64);
 const IDEMPOTENCY_KEY = "device-register-0001";

 describe("device routes", () => {
@@ -284,82 +283,6 @@ describe("device routes", () => {
  });
 });

-interface TestEnvOptions {
-  auditEvents?: ElyAnalyticsDataPoint[];
-  d1?: RecordedD1Database;
-  kvEntries?: [string, string][];
-  kvReads?: string[];
-}
-
-interface RecordedD1Database extends ElyD1Database {
-  binds: unknown[][];
-  queries: string[];
-}
-
-function testEnv(options: TestEnvOptions): Env {
-  const values = new Map(options.kvEntries ?? []);
-  return {
-    ELY_ENVIRONMENT: "local",
-    ELY_DB: options.d1 ?? testD1Database([]),
-    ELY_KV: {
-      get(key: string): Promise<string | null> {
-        options.kvReads?.push(key);
-        return Promise.resolve(values.get(key) ?? null);
-      },
-    },
-    ELY_STORAGE: testR2Bucket(),
-    ELY_RATE_LIMITER: {
-      limit(): Promise<{ success: boolean }> {
-        return Promise.resolve({ success: true });
-      },
-    },
-    ELY_API_AUDIT: {
-      writeDataPoint(event?: ElyAnalyticsDataPoint): void {
-        if (event !== undefined) {
-          options.auditEvents?.push(event);
-        }
-      },
-    },
-  };
-}
-
-function testD1Database(rows: unknown[]): RecordedD1Database {
-  const binds: unknown[][] = [];
-  const queries: string[] = [];
-  return {
-    binds,
-    queries,
-    prepare(query: string) {
-      queries.push(query);
-      return testD1PreparedStatement(rows, binds);
-    },
-    batch() {
-      return Promise.resolve([]);
-    },
-    exec() {
-      return Promise.resolve({});
-    },
-  };
-}
-
-function testD1PreparedStatement(rows: unknown[], binds: unknown[][]): ElyD1PreparedStatement {
-  return {
-    bind(...values: unknown[]) {
-      binds.push(values);
-      return this;
-    },
-    first<T>() {
-      return Promise.resolve((rows[0] as T | undefined) ?? null);
-    },
-    all<T>() {
-      return Promise.resolve({ results: rows as T[] });
-    },
-    run() {
-      return Promise.resolve({});
-    },
-  };
-}
-
 function deviceRegistrationBody(): Record<string, unknown> {
  return {
    version: 1,
@@ -370,28 +293,3 @@ function deviceRegistrationBody(): Record<string, unknown> {
    idempotency_key: IDEMPOTENCY_KEY,
  };
 }
-
-function testR2Bucket(): Env["ELY_STORAGE"] {
-  return {
-    get() {
-      return Promise.resolve(null);
-    },
-    put(_key: string, value: ArrayBuffer, _options?: ElyR2PutOptions) {
-      return Promise.resolve({
-        arrayBuffer() {
-          return Promise.resolve(value);
-        },
-      });
-    },
-  };
-}
-
-function sessionDocument(): string {
-  return JSON.stringify({
-    version: 1,
-    user_id: "user-01",
-    session_id: "session-01",
-    device_id: "device-01",
-    expires_at: "2099-01-01T00:00:00.000Z",
-  });
-}
@@ -0,0 +1,128 @@
+import type {
+  ElyAnalyticsDataPoint,
+  ElyD1Database,
+  ElyD1PreparedStatement,
+  ElyR2PutOptions,
+  Env,
+} from "../src/bindings.js";
+
+export const ACCESS_TOKEN = "D".repeat(48);
+export const PUBLIC_KEY = "a".repeat(64);
+
+export interface TestEnvOptions {
+  auditEvents?: ElyAnalyticsDataPoint[];
+  d1?: RecordedD1Database;
+  kvEntries?: [string, string][];
+  kvReads?: string[];
+}
+
+export interface RecordedD1Database extends ElyD1Database {
+  batches: number[];
+  binds: unknown[][];
+  queries: string[];
+}
+
+interface TestD1DatabaseOptions {
+  allRows?: unknown[];
+  firstRows?: unknown[];
+}
+
+export function testEnv(options: TestEnvOptions): Env {
+  const values = new Map(options.kvEntries ?? []);
+  return {
+    ELY_ENVIRONMENT: "local",
+    ELY_DB: options.d1 ?? testD1Database([]),
+    ELY_KV: {
+      get(key: string): Promise<string | null> {
+        options.kvReads?.push(key);
+        return Promise.resolve(values.get(key) ?? null);
+      },
+    },
+    ELY_STORAGE: testR2Bucket(),
+    ELY_RATE_LIMITER: {
+      limit(): Promise<{ success: boolean }> {
+        return Promise.resolve({ success: true });
+      },
+    },
+    ELY_API_AUDIT: {
+      writeDataPoint(event?: ElyAnalyticsDataPoint): void {
+        if (event !== undefined) {
+          options.auditEvents?.push(event);
+        }
+      },
+    },
+  };
+}
+
+export function testD1Database(rows: unknown[] | TestD1DatabaseOptions): RecordedD1Database {
+  const binds: unknown[][] = [];
+  const batches: number[] = [];
+  const queries: string[] = [];
+  const allRows = Array.isArray(rows) ? rows : rows.allRows ?? [];
+  const firstRows = Array.isArray(rows) ? rows : rows.firstRows ?? [];
+  let firstIndex = 0;
+  return {
+    batches,
+    binds,
+    queries,
+    prepare(query: string) {
+      queries.push(query);
+      return testD1PreparedStatement(allRows, firstRows, () => firstIndex++, binds);
+    },
+    batch(statements: ElyD1PreparedStatement[]) {
+      batches.push(statements.length);
+      return Promise.resolve([]);
+    },
+    exec() {
+      return Promise.resolve({});
+    },
+  };
+}
+
+export function sessionDocument(deviceId = "device-01"): string {
+  return JSON.stringify({
+    version: 1,
+    user_id: "user-01",
+    session_id: "session-01",
+    device_id: deviceId,
+    expires_at: "2099-01-01T00:00:00.000Z",
+  });
+}
+
+function testD1PreparedStatement(
+  allRows: unknown[],
+  firstRows: unknown[],
+  nextFirstIndex: () => number,
+  binds: unknown[][],
+): ElyD1PreparedStatement {
+  return {
+    bind(...values: unknown[]) {
+      binds.push(values);
+      return this;
+    },
+    first<T>() {
+      return Promise.resolve((firstRows[nextFirstIndex()] as T | undefined) ?? null);
+    },
+    all<T>() {
+      return Promise.resolve({ results: allRows as T[] });
+    },
+    run() {
+      return Promise.resolve({});
+    },
+  };
+}
+
+function testR2Bucket(): Env["ELY_STORAGE"] {
+  return {
+    get() {
+      return Promise.resolve(null);
+    },
+    put(_key: string, value: ArrayBuffer, _options?: ElyR2PutOptions) {
+      return Promise.resolve({
+        arrayBuffer() {
+          return Promise.resolve(value);
+        },
+      });
+    },
+  };
+}