@beechcms/api 0.4.0-preview.9 → 0.4.1

package/src/auth/login.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect } from 'vitest'
+import { parseLoginBody, validateLoginInput, verifyPassword, DUMMY_PASSWORD_HASH } from './login'
+import { InMemoryHashProvider } from './in-memory-hash-provider'
+
+describe('parseLoginBody', () => {
+  it('returns credentials for a valid object body', () => {
+    expect(parseLoginBody({ email: 'user@test.com', password: 'pass1234' }))
+      .toEqual({ email: 'user@test.com', password: 'pass1234' })
+  })
+
+  it('trims leading and trailing whitespace from email', () => {
+    expect(parseLoginBody({ email: '  user@test.com  ', password: 'pass' }))
+      .toEqual({ email: 'user@test.com', password: 'pass' })
+  })
+
+  it('returns null for non-object input', () => {
+    expect(parseLoginBody(null)).toBeNull()
+    expect(parseLoginBody('string')).toBeNull()
+    expect(parseLoginBody(42)).toBeNull()
+    expect(parseLoginBody(undefined)).toBeNull()
+  })
+
+  it('returns null when email field is missing', () => {
+    expect(parseLoginBody({ password: 'pass' })).toBeNull()
+  })
+
+  it('returns null when password field is missing', () => {
+    expect(parseLoginBody({ email: 'x@x.com' })).toBeNull()
+  })
+
+  it('returns null when email is an empty string after trimming', () => {
+    expect(parseLoginBody({ email: '   ', password: 'pass' })).toBeNull()
+  })
+
+  it('returns null when email is not a string', () => {
+    expect(parseLoginBody({ email: 42, password: 'pass' })).toBeNull()
+  })
+})
+
+describe('validateLoginInput', () => {
+  it('accepts a valid email and an 8-character password', () => {
+    expect(validateLoginInput('user@test.com', '12345678')).toBe(true)
+  })
+
+  it('rejects an email without an @ sign', () => {
+    expect(validateLoginInput('notanemail', 'password123')).toBe(false)
+  })
+
+  it('rejects an email with nothing before the @', () => {
+    expect(validateLoginInput('@test.com', 'password123')).toBe(false)
+  })
+
+  it('rejects an email with no domain extension', () => {
+    expect(validateLoginInput('user@nodot', 'password123')).toBe(false)
+  })
+
+  it('rejects a password shorter than 8 characters', () => {
+    expect(validateLoginInput('user@test.com', '1234567')).toBe(false)
+  })
+
+  it('rejects a password longer than 128 characters', () => {
+    expect(validateLoginInput('user@test.com', 'a'.repeat(129))).toBe(false)
+  })
+
+  it('accepts passwords at the lower boundary (exactly 8 characters)', () => {
+    expect(validateLoginInput('user@test.com', 'a'.repeat(8))).toBe(true)
+  })
+
+  it('accepts passwords at the upper boundary (exactly 128 characters)', () => {
+    expect(validateLoginInput('user@test.com', 'a'.repeat(128))).toBe(true)
+  })
+})
+
+describe('verifyPassword', () => {
+  const hashProvider = new InMemoryHashProvider()
+
+  it('returns true when the plaintext matches the stored hash', async () => {
+    const hash = await hashProvider.hash('mypassword')
+    expect(await verifyPassword('mypassword', hash, hashProvider)).toBe(true)
+  })
+
+  it('returns false when the plaintext does not match', async () => {
+    const hash = await hashProvider.hash('correct')
+    expect(await verifyPassword('wrong', hash, hashProvider)).toBe(false)
+  })
+})
+
+describe('DUMMY_PASSWORD_HASH', () => {
+  it('has bcrypt format so constant-time comparison runs even when no user is found', () => {
+    expect(DUMMY_PASSWORD_HASH).toMatch(/^\$2[aby]\$\d+\$/)
+  })
+})

package/src/auth/login.ts

@@ -1,91 +1,74 @@
-/// <reference types="@cloudflare/workers-types" />
-import bcrypt from 'bcryptjs'
-
-export type LoginCredentials = {
-  email: string
-  password: string
-}
-
-export type UserRecord = {
-  id: string
-  email: string
-  password_hash: string
-}
-
-/** Regex per validare formato email (deve contenere @ e punto dopo @) */
-const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
-
-/** Lunghezza minima password (caratteri) */
-const MIN_PASSWORD_LENGTH = 8
-
-/** Lunghezza massima password (caratteri) - limite ragionevole per evitare DoS */
-const MAX_PASSWORD_LENGTH = 128
-
-/**
- * Hash bcrypt dummy valido.
- * Usato quando l'utente non esiste per evitare timing attack
- * (stesso tempo di risposta che con password errata).
- */
-export const DUMMY_PASSWORD_HASH =
-  '$2a$10$SbkRFOafACxVM2ahxerVDu3tSkCXWm29b62WdB.4WGG02Qjsfzni6'
-
-/**
- * Estrae e valida email e password dal body della richiesta.
- * @param body - Body grezzo (tipicamente da req.json())
- * @returns Oggetto {email, password} se valido, null altrimenti
- */
-export function parseLoginBody(body: unknown): LoginCredentials | null {
-  if (body === null || typeof body !== 'object') return null
-  const obj = body as Record<string, unknown>
-  const email = obj.email
-  const password = obj.password
-  if (typeof email !== 'string' || typeof password !== 'string') return null
-  if (!email.trim() || !password) return null
-  return { email: email.trim(), password }
-}
-
-/**
- * Verifica che email e password rispettino i formati richiesti.
- * @param email - Email da validare (deve contenere @ e punto dopo @)
- * @param password - Password (8-128 caratteri)
- * @returns true se valido
- */
-export function validateLoginInput(email: string, password: string): boolean {
-  return (
-    EMAIL_REGEX.test(email) &&
-    password.length >= MIN_PASSWORD_LENGTH &&
-    password.length <= MAX_PASSWORD_LENGTH
-  )
-}
-
-/**
- * Cerca un utente nel database D1 per email.
- * @param db - Istanza D1Database
- * @param email - Email dell'utente
- * @returns UserRecord se trovato, null altrimenti
- */
-export async function findUserByEmail(
-  db: D1Database,
-  email: string
-): Promise<UserRecord | null> {
-  // IMPORTANTE: non interpolare mai direttamente l'email (o altri input utente)
-  // dentro la stringa SQL, usa sempre il placeholder "?" con .bind(...) per evitare SQL injection.
-  const stmt = db.prepare(
-    'SELECT id, email, password_hash FROM users WHERE email = ? LIMIT 1'
-  )
-  const row = await stmt.bind(email).first<UserRecord>()
-  return row
-}
-
-/**
- * Verifica che la password in chiaro corrisponda all'hash bcrypt salvato.
- * @param plainPassword - Password in chiaro
- * @param hash - Hash bcrypt salvato nel DB
- * @returns true se la password è corretta
- */
-export async function verifyPassword(
-  plainPassword: string,
-  hash: string
-): Promise<boolean> {
-  return bcrypt.compare(plainPassword, hash)
-}
+/// <reference types="@cloudflare/workers-types" />
+import type { IHashProvider } from '@beechcms/core'
+
+export type LoginCredentials = {
+  email: string
+  password: string
+}
+
+/** 
+ * Regex per validare formato email.
+ * Utilizza classi di caratteri che non si sovrappongono per evitare il backtracking catastrofico (ReDoS).
+ */
+const EMAIL_REGEX = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/
+/** Lunghezza massima email secondo standard RFC 5321 */
+const MAX_EMAIL_LENGTH = 254
+
+/** Lunghezza minima password (caratteri) */
+const MIN_PASSWORD_LENGTH = 8
+
+/** Lunghezza massima password (caratteri) - limite ragionevole per evitare DoS */
+const MAX_PASSWORD_LENGTH = 128
+
+/**
+ * Hash bcrypt dummy valido.
+ * Usato quando l'utente non esiste per evitare timing attack
+ * (stesso tempo di risposta che con password errata).
+ */
+export const DUMMY_PASSWORD_HASH =
+  '$2a$10$SbkRFOafACxVM2ahxerVDu3tSkCXWm29b62WdB.4WGG02Qjsfzni6'
+
+/**
+ * Estrae e valida email e password dal body della richiesta.
+ * @param body - Body grezzo (tipicamente da req.json())
+ * @returns Oggetto {email, password} se valido, null altrimenti
+ */
+export function parseLoginBody(body: unknown): LoginCredentials | null {
+  if (body === null || typeof body !== 'object') return null
+  const obj = body as Record<string, unknown>
+  const email = obj.email
+  const password = obj.password
+  if (typeof email !== 'string' || typeof password !== 'string') return null
+  if (!email.trim() || !password) return null
+  return { email: email.trim(), password }
+}
+
+/**
+ * Verifica che email e password rispettino i formati richiesti.
+ * @param email - Email da validare (deve contenere @ e punto dopo @)
+ * @param password - Password (8-128 caratteri)
+ * @returns true se valido
+ */
+export function validateLoginInput(email: string, password: string): boolean {
+  return (
+    email.length <= MAX_EMAIL_LENGTH &&
+    EMAIL_REGEX.test(email) &&
+    password.length >= MIN_PASSWORD_LENGTH &&
+    password.length <= MAX_PASSWORD_LENGTH
+  )
+}
+
+/**
+ * Verifica che la password in chiaro corrisponda all'hash salvato.
+ * @param plainPassword - Password in chiaro
+ * @param hash - Hash salvato nel DB
+ * @param hashProvider - Provider usato per la comparazione costante-time
+ * @returns true se la password è corretta
+ */
+export async function verifyPassword(
+  plainPassword: string,
+  hash: string,
+  hashProvider: IHashProvider
+): Promise<boolean> {
+  return hashProvider.verify(plainPassword, hash)
+}

package/src/auth/refresh.ts

@@ -1,127 +1,5 @@
-/// <reference types="@cloudflare/workers-types" />
-import { SignJWT } from 'jose'
-
-/** Secondi in un giorno (per calcolo scadenza) */
-const SECONDS_PER_DAY = 24 * 60 * 60
-
-export type JwtTokenOptions = {
-  issuer?: string
-  audience?: string
-}
-
-export type RefreshTokenRecord = {
-  id: string
-  user_id: string
-  token_hash: string
-  expires_at: number
-  created_at: number
-  revoked_at: number | null
-}
-
-/** Genera un refresh token sicuro (UUID v4) - usa Web Crypto API globale */
-export function generateRefreshToken(): string {
-  return crypto.randomUUID()
-}
-
-/**
- * Hash SHA-256 del refresh token per storage sicuro.
- * Usa Web Crypto API (crypto.subtle.digest).
- */
-export async function hashRefreshToken(token: string): Promise<string> {
-  const encoder = new TextEncoder()
-  const data = encoder.encode(token)
-  const hashBuffer = await crypto.subtle.digest('SHA-256', data)
-  const hashBytes = Array.from(new Uint8Array(hashBuffer))
-  return hashBytes.map((byte) => byte.toString(16).padStart(2, '0')).join('')
-}
-
-/**
- * Salva refresh token in DB (solo hash, mai in chiaro).
- * @param expiresInDays - Giorni di validità (default 7)
- */
-export async function saveRefreshToken(
-  db: D1Database,
-  userId: string,
-  token: string,
-  expiresInDays: number = 7
-): Promise<void> {
-  const id = crypto.randomUUID()
-  const tokenHash = await hashRefreshToken(token)
-  const expiresAt = Math.floor(Date.now() / 1000) + expiresInDays * SECONDS_PER_DAY
-  
-  await db.prepare(
-    `INSERT INTO refresh_tokens (id, user_id, token_hash, expires_at) 
-     VALUES (?, ?, ?, ?)`
-  ).bind(id, userId, tokenHash, expiresAt).run()
-}
-
-/**
- * Valida refresh token: verifica hash in DB, scadenza e che non sia revocato.
- * @returns { valid, userId? } - userId presente solo se valido
- */
-export async function validateRefreshToken(
-  db: D1Database,
-  token: string
-): Promise<{ valid: boolean; userId?: string }> {
-  const tokenHash = await hashRefreshToken(token)
-  const now = Math.floor(Date.now() / 1000)
-  
-  const row = await db.prepare(
-    `SELECT user_id, expires_at, revoked_at 
-     FROM refresh_tokens 
-     WHERE token_hash = ? LIMIT 1`
-  ).bind(tokenHash).first<RefreshTokenRecord>()
-  
-  if (!row) return { valid: false }
-  if (row.revoked_at !== null) return { valid: false }
-  if (row.expires_at < now) return { valid: false }
-  
-  return { valid: true, userId: row.user_id }
-}
-
-/**
- * Revoca un refresh token impostando revoked_at.
- * Il token non potrà più essere usato per il refresh.
- */
-export async function revokeRefreshToken(
-  db: D1Database,
-  token: string
-): Promise<boolean> {
-  const tokenHash = await hashRefreshToken(token)
-  const now = Math.floor(Date.now() / 1000)
-  
-  const result = await db.prepare(
-    `UPDATE refresh_tokens
-     SET revoked_at = ?
-     WHERE token_hash = ?
-       AND revoked_at IS NULL
-       AND expires_at >= ?`
-  ).bind(now, tokenHash, now).run()
-
-  const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
-  return changes > 0
-}
-
-/**
- * Genera JWT access token con scadenza breve (15 min).
- * Payload: sub (userId), email, name (opzionale). Algoritmo HS256.
- */
-export async function generateAccessToken(
-  userId: string,
-  email: string,
-  secret: string,
-  options: JwtTokenOptions = {},
-  name?: string
-): Promise<string> {
-  const payload: Record<string, string> = { email }
-  if (name) payload.name = name
-  const secretBytes = new TextEncoder().encode(secret)
-  let jwt = new SignJWT(payload)
-    .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
-    .setSubject(userId)
-    .setIssuedAt()
-    .setExpirationTime('15m')
-  if (options.issuer) jwt = jwt.setIssuer(options.issuer)
-  if (options.audience) jwt = jwt.setAudience(options.audience)
-  return jwt.sign(secretBytes)
-}
+/// <reference types="@cloudflare/workers-types" />
+
+export function generateRefreshToken(): string {
+  return crypto.randomUUID()
+}

package/src/auth/static-token-service.ts

@@ -0,0 +1,18 @@
+import type { ITokenService, IssueTokenOptions, JwtClaims } from '@beechcms/core'
+
+const TEST_TOKEN_PREFIX = 'test:'
+
+export class StaticTokenService implements ITokenService {
+  private readonly issuedClaims = new Map<string, JwtClaims>()
+
+  async issue(claims: JwtClaims, _options?: IssueTokenOptions): Promise<string> {
+    const token = TEST_TOKEN_PREFIX + claims.sub
+    this.issuedClaims.set(token, claims)
+    return token
+  }
+
+  async verify(token: string): Promise<JwtClaims | null> {
+    if (!token.startsWith(TEST_TOKEN_PREFIX)) return null
+    return this.issuedClaims.get(token) ?? null
+  }
+}

package/src/auth/token-service.test.ts

@@ -0,0 +1,82 @@
+import { describe, it, expect } from 'vitest'
+import { SystemClock } from '@beechcms/core'
+import { JoseTokenService } from './jose-token-service'
+import { StaticTokenService } from './static-token-service'
+
+const TEST_SECRET = 'super-secret-key-used-only-in-the-vitest-suite-min-length'
+
+describe('JoseTokenService', () => {
+  const service = new JoseTokenService(TEST_SECRET, {}, SystemClock)
+
+  it('issue returns a three-part JWT string', async () => {
+    const token = await service.issue({ sub: 'user-1', email: 'a@b.com' })
+    expect(token.split('.')).toHaveLength(3)
+  })
+
+  it('verify returns the original claims for a valid token', async () => {
+    const token = await service.issue({ sub: 'user-1', email: 'a@b.com' })
+    const claims = await service.verify(token)
+    expect(claims?.sub).toBe('user-1')
+    expect(claims?.email).toBe('a@b.com')
+  })
+
+  it('verify returns null for a malformed token', async () => {
+    expect(await service.verify('not.a.valid.jwt')).toBeNull()
+  })
+
+  it('verify returns null for a token signed with a different secret', async () => {
+    const otherService = new JoseTokenService('completely-different-secret-key-xyz', {}, SystemClock)
+    const token = await otherService.issue({ sub: 'user-1' })
+    expect(await service.verify(token)).toBeNull()
+  })
+
+  it('verify returns null for an expired token (ttlSeconds = -1)', async () => {
+    const token = await service.issue({ sub: 'user-1' }, { ttlSeconds: -1 })
+    expect(await service.verify(token)).toBeNull()
+  })
+
+  it('issuer mismatch causes verify to return null', async () => {
+    const issuerA = new JoseTokenService(TEST_SECRET, { issuer: 'issuer-a' }, SystemClock)
+    const issuerB = new JoseTokenService(TEST_SECRET, { issuer: 'issuer-b' }, SystemClock)
+    const token = await issuerA.issue({ sub: 'user-1' })
+    expect(await issuerB.verify(token)).toBeNull()
+  })
+
+  it('custom TTL is respected — token issued with longer TTL verifies successfully', async () => {
+    const token = await service.issue({ sub: 'user-1' }, { ttlSeconds: 3600 })
+    const claims = await service.verify(token)
+    expect(claims?.sub).toBe('user-1')
+  })
+})
+
+describe('StaticTokenService', () => {
+  it('issue returns "test:" + claims.sub', async () => {
+    const service = new StaticTokenService()
+    expect(await service.issue({ sub: 'abc' })).toBe('test:abc')
+  })
+
+  it('verify returns the stored claims for an issued token', async () => {
+    const service = new StaticTokenService()
+    await service.issue({ sub: 'abc', email: 'x@y.com' })
+    const claims = await service.verify('test:abc')
+    expect(claims?.email).toBe('x@y.com')
+    expect(claims?.sub).toBe('abc')
+  })
+
+  it('verify returns null for an unknown test sub', async () => {
+    const service = new StaticTokenService()
+    expect(await service.verify('test:unknown')).toBeNull()
+  })
+
+  it('verify returns null for a token that does not start with "test:"', async () => {
+    const service = new StaticTokenService()
+    expect(await service.verify('real.jwt.token')).toBeNull()
+  })
+
+  it('each StaticTokenService instance has its own isolated claims store', async () => {
+    const serviceA = new StaticTokenService()
+    const serviceB = new StaticTokenService()
+    await serviceA.issue({ sub: 'user-1' })
+    expect(await serviceB.verify('test:user-1')).toBeNull()
+  })
+})