npm - @beechcms/api - Versions diffs - 0.4.0 → 0.4.1 - Mend

@beechcms/api 0.4.0 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (86) hide show

package/assets/dashboard/assets/index-CH13idU1.js +554 -0
package/assets/dashboard/index.html +1 -1
package/package.json +2 -2
package/src/auth/bcrypt-hash-provider.ts +20 -0
package/src/auth/constants.ts +3 -3
package/src/auth/generate-refresh-token.test.ts +19 -0
package/src/auth/hash-provider.test.ts +46 -0
package/src/auth/in-memory-hash-provider.ts +13 -0
package/src/auth/jose-token-service.ts +55 -0
package/src/auth/login.test.ts +92 -0
package/src/auth/login.ts +15 -32
package/src/auth/refresh.ts +0 -122
package/src/auth/static-token-service.ts +18 -0
package/src/auth/token-service.test.ts +82 -0
package/src/factory.ts +70 -78
package/src/features/content/handlers/create.ts +14 -10
package/src/features/content/handlers/delete.ts +13 -9
package/src/features/content/handlers/update.ts +13 -9
package/src/features/draft/draft.handler.ts +23 -12
package/src/features/notifications/notifications.handler.ts +25 -54
package/src/features/password-reset/request.ts +17 -41
package/src/features/password-reset/reset.ts +18 -54
package/src/features/rotate-field/rotate-field.handler.ts +15 -19
package/src/features/schema/schema.handler.ts +1 -1
package/src/features/settings/settings.handler.ts +62 -175
package/src/features/setup/index.ts +12 -17
package/src/features/stats/stats.handler.ts +110 -138
package/src/middleware/auth-providers.middleware.ts +32 -0
package/src/middleware/observability.middleware.ts +52 -0
package/src/middleware/rate-limit.middleware.ts +41 -0
package/src/middleware/repository.middleware.ts +41 -5
package/src/middleware.ts +15 -35
package/src/public/public-add.ts +5 -15
package/src/public/public-edit.ts +4 -3
package/src/public/public-read.ts +3 -3
package/src/public/public-routes.ts +2 -2
package/src/public/query-builder.test.ts +220 -0
package/src/public/rate-limit-middleware.ts +7 -19
package/src/rate-limit/cloudflare-rate-limiter.test.ts +26 -0
package/src/rate-limit/cloudflare-rate-limiter.ts +11 -0
package/src/rate-limit/in-memory-rate-limiter.test.ts +33 -0
package/src/rate-limit/in-memory-rate-limiter.ts +13 -0
package/src/rate-limit/no-op-rate-limiter.test.ts +18 -0
package/src/rate-limit/no-op-rate-limiter.ts +7 -0
package/src/search-utils.test.ts +207 -0
package/src/search-utils.ts +18 -1
package/src/search.ts +24 -35
package/src/shared/apply-policies.test.ts +77 -0
package/src/shared/background-notification-service.test.ts +58 -0
package/src/shared/background-notification-service.ts +48 -0
package/src/shared/content-utils.test.ts +161 -0
package/src/shared/content.repository.d1.test.ts +312 -0
package/src/shared/d1-activity-log.repository.test.ts +136 -0
package/src/shared/d1-activity-log.repository.ts +101 -0
package/src/shared/d1-activity-logger.test.ts +82 -0
package/src/shared/d1-activity-logger.ts +63 -0
package/src/shared/d1-analytics.repository.test.ts +74 -0
package/src/shared/d1-analytics.repository.ts +81 -0
package/src/shared/d1-content-scan.repository.ts +29 -0
package/src/shared/d1-notification.repository.test.ts +124 -0
package/src/shared/d1-notification.repository.ts +114 -0
package/src/shared/d1-password-reset-token.repository.test.ts +77 -0
package/src/shared/d1-password-reset-token.repository.ts +52 -0
package/src/shared/d1-search.repository.test.ts +83 -0
package/src/shared/d1-search.repository.ts +84 -0
package/src/shared/d1-session.repository.test.ts +121 -0
package/src/shared/d1-session.repository.ts +98 -0
package/src/shared/d1-user.repository.test.ts +147 -0
package/src/shared/d1-user.repository.ts +109 -0
package/src/shared/d1-widget.repository.test.ts +217 -0
package/src/shared/d1-widget.repository.ts +337 -0
package/src/shared/fixed-clock.ts +21 -0
package/src/shared/idempotency.repository.d1.test.ts +79 -0
package/src/shared/in-memory-activity-logger.ts +15 -0
package/src/shared/in-memory-notification-service.ts +15 -0
package/src/shared/media.repository.d1.test.ts +103 -0
package/src/shared/media.repository.d1.ts +1 -1
package/src/shared/request-utils.ts +22 -0
package/src/shared/sequential-id-generator.ts +22 -0
package/src/shared/system-stats.repository.d1.test.ts +54 -0
package/src/types.ts +20 -3
package/src/upload.ts +14 -7
package/src/widget.ts +112 -253
package/assets/dashboard/assets/index-FQ6JhvRH.js +0 -554
package/src/shared/activity-logger.ts +0 -79
package/src/shared/notification-service.ts +0 -56

package/assets/dashboard/index.html CHANGED Viewed

@@ -9,7 +9,7 @@
     <!-- Poppins: pesi normali + italic. Inter: fallback con piena copertura degli stili. -->
     <link href="https://fonts.googleapis.com/css2?family=Inter:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,500;1,600;1,700&family=Poppins:ital,wght@0,300;0,400;0,500;0,600;0,700;1,300;1,400;1,500;1,600;1,700&display=swap" rel="stylesheet" />
     <title>dashboard</title>
-    <script type="module" crossorigin src="/admin/assets/index-FQ6JhvRH.js"></script>
+    <script type="module" crossorigin src="/admin/assets/index-CH13idU1.js"></script>
     <link rel="stylesheet" crossorigin href="/admin/assets/index-CewtCjom.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/api",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "exports": {
     ".": "./src/factory.ts"
@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.995.0",
-    "@beechcms/core": "^0.4.0",
+    "@beechcms/core": "^0.4.1",
     "bcryptjs": "^2.4.3",
     "hono": "^4.11.9",
     "jose": "^6.1.3"

package/src/auth/bcrypt-hash-provider.ts ADDED Viewed

@@ -0,0 +1,20 @@
+import bcrypt from 'bcryptjs'
+import type { IHashProvider } from '@beechcms/core'
+const DEFAULT_BCRYPT_ROUNDS = 10
+export class BcryptHashProvider implements IHashProvider {
+  private readonly saltRounds: number
+  constructor(saltRounds: number = DEFAULT_BCRYPT_ROUNDS) {
+    this.saltRounds = saltRounds
+  }
+  async hash(plaintextPassword: string): Promise<string> {
+    return bcrypt.hash(plaintextPassword, this.saltRounds)
+  }
+  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
+    return bcrypt.compare(plaintextPassword, storedHash)
+  }
+}

package/src/auth/constants.ts CHANGED Viewed

@@ -1,10 +1,10 @@
-/** Messaggi di errore API auth - usati da handler e test */
+/** API auth error messages - used by handlers and tests */
 export const AUTH_ERRORS = {
   INVALID_REQUEST: 'Invalid request',
   INVALID_CREDENTIALS: 'Invalid credentials',
   DATABASE_ERROR: 'Database error',
-  /** Messaggio generico per errori 500 - non rivela dettagli del sistema */
+  /** Generic message for 500 errors - does not reveal system details */
   GENERIC_ERROR: 'An error occurred',
-  /** Rate limit superato */
+  /** Rate limit exceeded */
   RATE_LIMIT_EXCEEDED: 'Too many requests',
 } as const

package/src/auth/generate-refresh-token.test.ts ADDED Viewed

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest'
+import { generateRefreshToken } from './refresh'
+describe('generateRefreshToken', () => {
+  it('returns a non-empty string', () => {
+    expect(generateRefreshToken().length).toBeGreaterThan(0)
+  })
+  it('returns a UUID-shaped value (8-4-4-4-12 hex groups)', () => {
+    expect(generateRefreshToken()).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+    )
+  })
+  it('returns a different token on every call', () => {
+    const tokens = new Set(Array.from({ length: 10 }, () => generateRefreshToken()))
+    expect(tokens.size).toBe(10)
+  })
+})

package/src/auth/hash-provider.test.ts ADDED Viewed

@@ -0,0 +1,46 @@
+import { describe, it, expect } from 'vitest'
+import { InMemoryHashProvider } from './in-memory-hash-provider'
+import { BcryptHashProvider } from './bcrypt-hash-provider'
+describe('InMemoryHashProvider', () => {
+  const provider = new InMemoryHashProvider()
+  it('hash returns the HASH: prefix concatenated with the plaintext', async () => {
+    expect(await provider.hash('mypassword')).toBe('HASH:mypassword')
+  })
+  it('verify returns true when the plaintext matches the stored hash', async () => {
+    const hash = await provider.hash('correct')
+    expect(await provider.verify('correct', hash)).toBe(true)
+  })
+  it('verify returns false when the plaintext does not match', async () => {
+    const hash = await provider.hash('correct')
+    expect(await provider.verify('wrong', hash)).toBe(false)
+  })
+  it('verify returns false for a string that does not follow the HASH: format', async () => {
+    expect(await provider.verify('anything', 'not-a-prefixed-hash')).toBe(false)
+  })
+})
+describe('BcryptHashProvider', () => {
+  // Use 4 salt rounds so the test runs in milliseconds.
+  const provider = new BcryptHashProvider(4)
+  it('hash and verify roundtrip: correct password returns true', async () => {
+    const hash = await provider.hash('secure-password')
+    expect(await provider.verify('secure-password', hash)).toBe(true)
+  })
+  it('verify returns false for an incorrect password', async () => {
+    const hash = await provider.hash('correct')
+    expect(await provider.verify('incorrect', hash)).toBe(false)
+  })
+  it('verify returns false against the DUMMY_PASSWORD_HASH for any plaintext', async () => {
+    // The dummy hash is used for timing-attack mitigation; it must not match real passwords.
+    const dummyHash = '$2a$10$SbkRFOafACxVM2ahxerVDu3tSkCXWm29b62WdB.4WGG02Qjsfzni6'
+    expect(await provider.verify('password123', dummyHash)).toBe(false)
+  })
+})

package/src/auth/in-memory-hash-provider.ts ADDED Viewed

@@ -0,0 +1,13 @@
+import type { IHashProvider } from '@beechcms/core'
+const HASH_PREFIX = 'HASH:'
+export class InMemoryHashProvider implements IHashProvider {
+  async hash(plaintextPassword: string): Promise<string> {
+    return HASH_PREFIX + plaintextPassword
+  }
+  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
+    return storedHash === HASH_PREFIX + plaintextPassword
+  }
+}

package/src/auth/jose-token-service.ts ADDED Viewed

@@ -0,0 +1,55 @@
+import { SignJWT, jwtVerify } from 'jose'
+import type { ITokenService, IssueTokenOptions, JwtClaims, IClock } from '@beechcms/core'
+const DEFAULT_TOKEN_TTL_SECONDS = 900
+const DEFAULT_ALGORITHM = 'HS256' as const
+export interface JoseTokenServiceConfig {
+  issuer?: string
+  audience?: string
+  algorithm?: 'HS256' | 'HS384' | 'HS512'
+}
+export class JoseTokenService implements ITokenService {
+  private readonly secretBytes: Uint8Array
+  private readonly config: JoseTokenServiceConfig
+  private readonly clock: IClock
+  constructor(secret: string, config: JoseTokenServiceConfig, clock: IClock) {
+    this.secretBytes = new TextEncoder().encode(secret)
+    this.config = config
+    this.clock = clock
+  }
+  async issue(claims: JwtClaims, options?: IssueTokenOptions): Promise<string> {
+    const { sub, ...remainingClaims } = claims
+    const ttlSeconds = options?.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS
+    const algorithm = this.config.algorithm ?? DEFAULT_ALGORITHM
+    const issuedAtSeconds = this.clock.nowSeconds()
+    let builder = new SignJWT(remainingClaims)
+      .setProtectedHeader({ alg: algorithm, typ: 'JWT' })
+      .setSubject(sub)
+      .setIssuedAt(issuedAtSeconds)
+      .setExpirationTime(issuedAtSeconds + ttlSeconds)
+    if (this.config.issuer) builder = builder.setIssuer(this.config.issuer)
+    if (this.config.audience) builder = builder.setAudience(this.config.audience)
+    return builder.sign(this.secretBytes)
+  }
+  async verify(token: string): Promise<JwtClaims | null> {
+    try {
+      const algorithm = this.config.algorithm ?? DEFAULT_ALGORITHM
+      const { payload } = await jwtVerify(token, this.secretBytes, {
+        algorithms: [algorithm],
+        issuer: this.config.issuer,
+        audience: this.config.audience,
+      })
+      return payload as JwtClaims
+    } catch {
+      return null
+    }
+  }
+}

package/src/auth/login.test.ts ADDED Viewed

@@ -0,0 +1,92 @@
+import { describe, it, expect } from 'vitest'
+import { parseLoginBody, validateLoginInput, verifyPassword, DUMMY_PASSWORD_HASH } from './login'
+import { InMemoryHashProvider } from './in-memory-hash-provider'
+describe('parseLoginBody', () => {
+  it('returns credentials for a valid object body', () => {
+    expect(parseLoginBody({ email: 'user@test.com', password: 'pass1234' }))
+      .toEqual({ email: 'user@test.com', password: 'pass1234' })
+  })
+  it('trims leading and trailing whitespace from email', () => {
+    expect(parseLoginBody({ email: '  user@test.com  ', password: 'pass' }))
+      .toEqual({ email: 'user@test.com', password: 'pass' })
+  })
+  it('returns null for non-object input', () => {
+    expect(parseLoginBody(null)).toBeNull()
+    expect(parseLoginBody('string')).toBeNull()
+    expect(parseLoginBody(42)).toBeNull()
+    expect(parseLoginBody(undefined)).toBeNull()
+  })
+  it('returns null when email field is missing', () => {
+    expect(parseLoginBody({ password: 'pass' })).toBeNull()
+  })
+  it('returns null when password field is missing', () => {
+    expect(parseLoginBody({ email: 'x@x.com' })).toBeNull()
+  })
+  it('returns null when email is an empty string after trimming', () => {
+    expect(parseLoginBody({ email: '   ', password: 'pass' })).toBeNull()
+  })
+  it('returns null when email is not a string', () => {
+    expect(parseLoginBody({ email: 42, password: 'pass' })).toBeNull()
+  })
+})
+describe('validateLoginInput', () => {
+  it('accepts a valid email and an 8-character password', () => {
+    expect(validateLoginInput('user@test.com', '12345678')).toBe(true)
+  })
+  it('rejects an email without an @ sign', () => {
+    expect(validateLoginInput('notanemail', 'password123')).toBe(false)
+  })
+  it('rejects an email with nothing before the @', () => {
+    expect(validateLoginInput('@test.com', 'password123')).toBe(false)
+  })
+  it('rejects an email with no domain extension', () => {
+    expect(validateLoginInput('user@nodot', 'password123')).toBe(false)
+  })
+  it('rejects a password shorter than 8 characters', () => {
+    expect(validateLoginInput('user@test.com', '1234567')).toBe(false)
+  })
+  it('rejects a password longer than 128 characters', () => {
+    expect(validateLoginInput('user@test.com', 'a'.repeat(129))).toBe(false)
+  })
+  it('accepts passwords at the lower boundary (exactly 8 characters)', () => {
+    expect(validateLoginInput('user@test.com', 'a'.repeat(8))).toBe(true)
+  })
+  it('accepts passwords at the upper boundary (exactly 128 characters)', () => {
+    expect(validateLoginInput('user@test.com', 'a'.repeat(128))).toBe(true)
+  })
+})
+describe('verifyPassword', () => {
+  const hashProvider = new InMemoryHashProvider()
+  it('returns true when the plaintext matches the stored hash', async () => {
+    const hash = await hashProvider.hash('mypassword')
+    expect(await verifyPassword('mypassword', hash, hashProvider)).toBe(true)
+  })
+  it('returns false when the plaintext does not match', async () => {
+    const hash = await hashProvider.hash('correct')
+    expect(await verifyPassword('wrong', hash, hashProvider)).toBe(false)
+  })
+})
+describe('DUMMY_PASSWORD_HASH', () => {
+  it('has bcrypt format so constant-time comparison runs even when no user is found', () => {
+    expect(DUMMY_PASSWORD_HASH).toMatch(/^\$2[aby]\$\d+\$/)
+  })
+})

package/src/auth/login.ts CHANGED Viewed

@@ -1,19 +1,18 @@
 /// <reference types="@cloudflare/workers-types" />
-import bcrypt from 'bcryptjs'
+import type { IHashProvider } from '@beechcms/core'
 export type LoginCredentials = {
   email: string
   password: string
 }
-export type UserRecord = {
-  id: string
-  email: string
-  password_hash: string
-}
-/** Regex per validare formato email (deve contenere @ e punto dopo @) */
-const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+/**
+ * Regex per validare formato email.
+ * Utilizza classi di caratteri che non si sovrappongono per evitare il backtracking catastrofico (ReDoS).
+ */
+const EMAIL_REGEX = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/
+/** Lunghezza massima email secondo standard RFC 5321 */
+const MAX_EMAIL_LENGTH = 254
 /** Lunghezza minima password (caratteri) */
 const MIN_PASSWORD_LENGTH = 8
@@ -52,6 +51,7 @@ export function parseLoginBody(body: unknown): LoginCredentials | null {
  */
 export function validateLoginInput(email: string, password: string): boolean {
   return (
+    email.length <= MAX_EMAIL_LENGTH &&
     EMAIL_REGEX.test(email) &&
     password.length >= MIN_PASSWORD_LENGTH &&
     password.length <= MAX_PASSWORD_LENGTH
@@ -59,33 +59,16 @@ export function validateLoginInput(email: string, password: string): boolean {
 }
 /**
- * Cerca un utente nel database D1 per email.
- * @param db - Istanza D1Database
- * @param email - Email dell'utente
- * @returns UserRecord se trovato, null altrimenti
- */
-export async function findUserByEmail(
-  db: D1Database,
-  email: string
-): Promise<UserRecord | null> {
-  // IMPORTANTE: non interpolare mai direttamente l'email (o altri input utente)
-  // dentro la stringa SQL, usa sempre il placeholder "?" con .bind(...) per evitare SQL injection.
-  const stmt = db.prepare(
-    'SELECT id, email, password_hash FROM users WHERE email = ? LIMIT 1'
-  )
-  const row = await stmt.bind(email).first<UserRecord>()
-  return row
-}
-/**
- * Verifica che la password in chiaro corrisponda all'hash bcrypt salvato.
+ * Verifica che la password in chiaro corrisponda all'hash salvato.
  * @param plainPassword - Password in chiaro
- * @param hash - Hash bcrypt salvato nel DB
+ * @param hash - Hash salvato nel DB
+ * @param hashProvider - Provider usato per la comparazione costante-time
  * @returns true se la password è corretta
  */
 export async function verifyPassword(
   plainPassword: string,
-  hash: string
+  hash: string,
+  hashProvider: IHashProvider
 ): Promise<boolean> {
-  return bcrypt.compare(plainPassword, hash)
+  return hashProvider.verify(plainPassword, hash)
 }

package/src/auth/refresh.ts CHANGED Viewed

@@ -1,127 +1,5 @@
 /// <reference types="@cloudflare/workers-types" />
-import { SignJWT } from 'jose'
-/** Secondi in un giorno (per calcolo scadenza) */
-const SECONDS_PER_DAY = 24 * 60 * 60
-export type JwtTokenOptions = {
-  issuer?: string
-  audience?: string
-}
-export type RefreshTokenRecord = {
-  id: string
-  user_id: string
-  token_hash: string
-  expires_at: number
-  created_at: number
-  revoked_at: number | null
-}
-/** Genera un refresh token sicuro (UUID v4) - usa Web Crypto API globale */
 export function generateRefreshToken(): string {
   return crypto.randomUUID()
 }
-/**
- * Hash SHA-256 del refresh token per storage sicuro.
- * Usa Web Crypto API (crypto.subtle.digest).
- */
-export async function hashRefreshToken(token: string): Promise<string> {
-  const encoder = new TextEncoder()
-  const data = encoder.encode(token)
-  const hashBuffer = await crypto.subtle.digest('SHA-256', data)
-  const hashBytes = Array.from(new Uint8Array(hashBuffer))
-  return hashBytes.map((byte) => byte.toString(16).padStart(2, '0')).join('')
-}
-/**
- * Salva refresh token in DB (solo hash, mai in chiaro).
- * @param expiresInDays - Giorni di validità (default 7)
- */
-export async function saveRefreshToken(
-  db: D1Database,
-  userId: string,
-  token: string,
-  expiresInDays: number = 7
-): Promise<void> {
-  const id = crypto.randomUUID()
-  const tokenHash = await hashRefreshToken(token)
-  const expiresAt = Math.floor(Date.now() / 1000) + expiresInDays * SECONDS_PER_DAY
-  await db.prepare(
-    `INSERT INTO refresh_tokens (id, user_id, token_hash, expires_at)
-     VALUES (?, ?, ?, ?)`
-  ).bind(id, userId, tokenHash, expiresAt).run()
-}
-/**
- * Valida refresh token: verifica hash in DB, scadenza e che non sia revocato.
- * @returns { valid, userId? } - userId presente solo se valido
- */
-export async function validateRefreshToken(
-  db: D1Database,
-  token: string
-): Promise<{ valid: boolean; userId?: string }> {
-  const tokenHash = await hashRefreshToken(token)
-  const now = Math.floor(Date.now() / 1000)
-  const row = await db.prepare(
-    `SELECT user_id, expires_at, revoked_at
-     FROM refresh_tokens
-     WHERE token_hash = ? LIMIT 1`
-  ).bind(tokenHash).first<RefreshTokenRecord>()
-  if (!row) return { valid: false }
-  if (row.revoked_at !== null) return { valid: false }
-  if (row.expires_at < now) return { valid: false }
-  return { valid: true, userId: row.user_id }
-}
-/**
- * Revoca un refresh token impostando revoked_at.
- * Il token non potrà più essere usato per il refresh.
- */
-export async function revokeRefreshToken(
-  db: D1Database,
-  token: string
-): Promise<boolean> {
-  const tokenHash = await hashRefreshToken(token)
-  const now = Math.floor(Date.now() / 1000)
-  const result = await db.prepare(
-    `UPDATE refresh_tokens
-     SET revoked_at = ?
-     WHERE token_hash = ?
-       AND revoked_at IS NULL
-       AND expires_at >= ?`
-  ).bind(now, tokenHash, now).run()
-  const changes = (result as unknown as { meta?: { changes?: number } })?.meta?.changes ?? 0
-  return changes > 0
-}
-/**
- * Genera JWT access token con scadenza breve (15 min).
- * Payload: sub (userId), email, name (opzionale). Algoritmo HS256.
- */
-export async function generateAccessToken(
-  userId: string,
-  email: string,
-  secret: string,
-  options: JwtTokenOptions = {},
-  name?: string
-): Promise<string> {
-  const payload: Record<string, string> = { email }
-  if (name) payload.name = name
-  const secretBytes = new TextEncoder().encode(secret)
-  let jwt = new SignJWT(payload)
-    .setProtectedHeader({ alg: 'HS256', typ: 'JWT' })
-    .setSubject(userId)
-    .setIssuedAt()
-    .setExpirationTime('15m')
-  if (options.issuer) jwt = jwt.setIssuer(options.issuer)
-  if (options.audience) jwt = jwt.setAudience(options.audience)
-  return jwt.sign(secretBytes)
-}

package/src/auth/static-token-service.ts ADDED Viewed

@@ -0,0 +1,18 @@
+import type { ITokenService, IssueTokenOptions, JwtClaims } from '@beechcms/core'
+const TEST_TOKEN_PREFIX = 'test:'
+export class StaticTokenService implements ITokenService {
+  private readonly issuedClaims = new Map<string, JwtClaims>()
+  async issue(claims: JwtClaims, _options?: IssueTokenOptions): Promise<string> {
+    const token = TEST_TOKEN_PREFIX + claims.sub
+    this.issuedClaims.set(token, claims)
+    return token
+  }
+  async verify(token: string): Promise<JwtClaims | null> {
+    if (!token.startsWith(TEST_TOKEN_PREFIX)) return null
+    return this.issuedClaims.get(token) ?? null
+  }
+}

package/src/auth/token-service.test.ts ADDED Viewed

@@ -0,0 +1,82 @@
+import { describe, it, expect } from 'vitest'
+import { SystemClock } from '@beechcms/core'
+import { JoseTokenService } from './jose-token-service'
+import { StaticTokenService } from './static-token-service'
+const TEST_SECRET = 'super-secret-key-used-only-in-the-vitest-suite-min-length'
+describe('JoseTokenService', () => {
+  const service = new JoseTokenService(TEST_SECRET, {}, SystemClock)
+  it('issue returns a three-part JWT string', async () => {
+    const token = await service.issue({ sub: 'user-1', email: 'a@b.com' })
+    expect(token.split('.')).toHaveLength(3)
+  })
+  it('verify returns the original claims for a valid token', async () => {
+    const token = await service.issue({ sub: 'user-1', email: 'a@b.com' })
+    const claims = await service.verify(token)
+    expect(claims?.sub).toBe('user-1')
+    expect(claims?.email).toBe('a@b.com')
+  })
+  it('verify returns null for a malformed token', async () => {
+    expect(await service.verify('not.a.valid.jwt')).toBeNull()
+  })
+  it('verify returns null for a token signed with a different secret', async () => {
+    const otherService = new JoseTokenService('completely-different-secret-key-xyz', {}, SystemClock)
+    const token = await otherService.issue({ sub: 'user-1' })
+    expect(await service.verify(token)).toBeNull()
+  })
+  it('verify returns null for an expired token (ttlSeconds = -1)', async () => {
+    const token = await service.issue({ sub: 'user-1' }, { ttlSeconds: -1 })
+    expect(await service.verify(token)).toBeNull()
+  })
+  it('issuer mismatch causes verify to return null', async () => {
+    const issuerA = new JoseTokenService(TEST_SECRET, { issuer: 'issuer-a' }, SystemClock)
+    const issuerB = new JoseTokenService(TEST_SECRET, { issuer: 'issuer-b' }, SystemClock)
+    const token = await issuerA.issue({ sub: 'user-1' })
+    expect(await issuerB.verify(token)).toBeNull()
+  })
+  it('custom TTL is respected — token issued with longer TTL verifies successfully', async () => {
+    const token = await service.issue({ sub: 'user-1' }, { ttlSeconds: 3600 })
+    const claims = await service.verify(token)
+    expect(claims?.sub).toBe('user-1')
+  })
+})
+describe('StaticTokenService', () => {
+  it('issue returns "test:" + claims.sub', async () => {
+    const service = new StaticTokenService()
+    expect(await service.issue({ sub: 'abc' })).toBe('test:abc')
+  })
+  it('verify returns the stored claims for an issued token', async () => {
+    const service = new StaticTokenService()
+    await service.issue({ sub: 'abc', email: 'x@y.com' })
+    const claims = await service.verify('test:abc')
+    expect(claims?.email).toBe('x@y.com')
+    expect(claims?.sub).toBe('abc')
+  })
+  it('verify returns null for an unknown test sub', async () => {
+    const service = new StaticTokenService()
+    expect(await service.verify('test:unknown')).toBeNull()
+  })
+  it('verify returns null for a token that does not start with "test:"', async () => {
+    const service = new StaticTokenService()
+    expect(await service.verify('real.jwt.token')).toBeNull()
+  })
+  it('each StaticTokenService instance has its own isolated claims store', async () => {
+    const serviceA = new StaticTokenService()
+    const serviceB = new StaticTokenService()
+    await serviceA.issue({ sub: 'user-1' })
+    expect(await serviceB.verify('test:user-1')).toBeNull()
+  })
+})