feat(wabe): protect start with empty root key

lefthook.yml

@@ -3,4 +3,4 @@ pre-commit:
     commands:
         check:
             glob: '*.{js,ts,jsx,tsx}'
-            run: oxlint {staged_files} && bun format && git add {staged_files}
+            run: bun oxlint {staged_files} && bun format && git add {staged_files}

packages/wabe/src/security.test.ts

@@ -1,4 +1,6 @@
 import { describe, it, expect } from 'bun:test'
+import { v4 as uuid } from 'uuid'
+import getPort from 'get-port'
 import { decode, sign } from 'jsonwebtoken'
 import { gql } from 'graphql-request'
 import {
@@ -8,11 +10,38 @@ import {
 	createUserAndUpdateRole,
 	getUserClient,
 } from './utils/helper'
-import { setupTests, closeTests } from './utils/testHelper'
+import { setupTests, closeTests, getDatabaseAdapter } from './utils/testHelper'
 import { RoleEnum } from 'generated/wabe'
 import { Session } from './authentication/Session'
+import { Wabe } from './server'
+import type { DevWabeTypes } from './utils/helper'
 
 describe('Security tests', () => {
+	it('should throw at server startup when rootKey is empty', async () => {
+		const databaseId = uuid()
+		const port = await getPort()
+
+		const wabe = new Wabe<DevWabeTypes>({
+			isProduction: false,
+			rootKey: '',
+			database: {
+				// @ts-expect-error
+				adapter: await getDatabaseAdapter(databaseId),
+			},
+			port,
+			schema: {
+				classes: [
+					{
+						name: 'Collection1',
+						fields: { name: { type: 'String' } },
+					},
+				],
+			},
+		})
+
+		await expect(wabe.start()).rejects.toThrow('rootKey cannot be empty')
+	})
+
 	it('should not return private fields (acl) on createObject, getObject and getObjects if not root', async () => {
 		const setup = await setupTests([
 			{

packages/wabe/src/server/index.ts

@@ -209,6 +209,9 @@ export class Wabe<T extends WabeTypes> {
 	}
 
 	async start() {
+		if (!this.config.rootKey || this.config.rootKey.length === 0)
+			throw new Error('rootKey cannot be empty')
+
 		if (this.config.authentication?.session && !this.config.authentication.session.jwtSecret)
 			throw new Error('Authentication session requires jwt secret')
 

packages/wabe/src/utils/testHelper.ts

@@ -20,6 +20,7 @@ export const setupTests = async (
 	options: {
 		isProduction?: boolean
 		disableCSRFProtection?: boolean
+		rootKey?: string
 	} = {},
 ) => {
 	const databaseId = uuid()
@@ -28,7 +29,7 @@ export const setupTests = async (
 
 	const wabe = new Wabe<DevWabeTypes>({
 		isProduction: !!options.isProduction,
-		rootKey: 'dev',
+		rootKey: options.rootKey ?? 'dev',
 		database: {
 			// @ts-expect-error
 			adapter: await getDatabaseAdapter(databaseId),