@beechcms/api 0.5.0 → 0.6.0-preview.2

package/migrations/0030_test_seeds.sql

@@ -1,125 +1,125 @@
-  -- content_products
-CREATE TABLE IF NOT EXISTS content_products (
-  id         TEXT    NOT NULL PRIMARY KEY,
-  slug       TEXT    NOT NULL UNIQUE,
-  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
-  name  TEXT NOT NULL,
-  description  TEXT,
-  price  REAL,
-  inventory  REAL,
-  rating  REAL,
-  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
-  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
-);
-
-CREATE INDEX IF NOT EXISTS idx_products_status ON content_products(status);
-CREATE INDEX IF NOT EXISTS idx_products_created_at ON content_products(created_at);
-CREATE INDEX IF NOT EXISTS idx_products_name ON content_products(name);
-CREATE INDEX IF NOT EXISTS idx_products_price ON content_products(price);
-CREATE INDEX IF NOT EXISTS idx_products_inventory ON content_products(inventory);
-CREATE INDEX IF NOT EXISTS idx_products_rating ON content_products(rating);
-
-CREATE VIRTUAL TABLE IF NOT EXISTS fts_products USING fts5(
-  entry_id UNINDEXED,
-  name,
-  description,
-  tokenize = 'unicode61'
-);
-
-CREATE TRIGGER IF NOT EXISTS fts_products_insert
-AFTER INSERT ON content_products BEGIN
-  INSERT INTO fts_products(entry_id, name, description) VALUES (new.id, new.name, new.description);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_products_update
-AFTER UPDATE OF name, description ON content_products BEGIN
-  DELETE FROM fts_products WHERE entry_id = old.id;
-  INSERT INTO fts_products(entry_id, name, description) VALUES (new.id, new.name, new.description);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_products_delete
-AFTER DELETE ON content_products BEGIN
-  DELETE FROM fts_products WHERE entry_id = old.id;
-END;
-
-  -- content_reviews
-CREATE TABLE IF NOT EXISTS content_reviews (
-  id         TEXT    NOT NULL PRIMARY KEY,
-  slug       TEXT    NOT NULL UNIQUE,
-  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
-  title  TEXT NOT NULL,
-  body  TEXT,
-  score  REAL,
-  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
-  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
-);
-
-CREATE INDEX IF NOT EXISTS idx_reviews_status ON content_reviews(status);
-CREATE INDEX IF NOT EXISTS idx_reviews_created_at ON content_reviews(created_at);
-CREATE INDEX IF NOT EXISTS idx_reviews_title ON content_reviews(title);
-CREATE INDEX IF NOT EXISTS idx_reviews_body ON content_reviews(body);
-CREATE INDEX IF NOT EXISTS idx_reviews_score ON content_reviews(score);
-
-CREATE VIRTUAL TABLE IF NOT EXISTS fts_reviews USING fts5(
-  entry_id UNINDEXED,
-  title,
-  body,
-  tokenize = 'unicode61'
-);
-
-CREATE TRIGGER IF NOT EXISTS fts_reviews_insert
-AFTER INSERT ON content_reviews BEGIN
-  INSERT INTO fts_reviews(entry_id, title, body) VALUES (new.id, new.title, new.body);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_reviews_update
-AFTER UPDATE OF title, body ON content_reviews BEGIN
-  DELETE FROM fts_reviews WHERE entry_id = old.id;
-  INSERT INTO fts_reviews(entry_id, title, body) VALUES (new.id, new.title, new.body);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_reviews_delete
-AFTER DELETE ON content_reviews BEGIN
-  DELETE FROM fts_reviews WHERE entry_id = old.id;
-END;
-
-  -- content_tasks
-CREATE TABLE IF NOT EXISTS content_tasks (
-  id         TEXT    NOT NULL PRIMARY KEY,
-  slug       TEXT    NOT NULL UNIQUE,
-  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
-  title  TEXT NOT NULL,
-  taskStatus  TEXT,
-  completion  REAL,
-  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
-  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
-);
-
-CREATE INDEX IF NOT EXISTS idx_tasks_status ON content_tasks(status);
-CREATE INDEX IF NOT EXISTS idx_tasks_created_at ON content_tasks(created_at);
-CREATE INDEX IF NOT EXISTS idx_tasks_title ON content_tasks(title);
-CREATE INDEX IF NOT EXISTS idx_tasks_taskStatus ON content_tasks(taskStatus);
-CREATE INDEX IF NOT EXISTS idx_tasks_completion ON content_tasks(completion);
-
-CREATE VIRTUAL TABLE IF NOT EXISTS fts_tasks USING fts5(
-  entry_id UNINDEXED,
-  title,
-  taskStatus,
-  tokenize = 'unicode61'
-);
-
-CREATE TRIGGER IF NOT EXISTS fts_tasks_insert
-AFTER INSERT ON content_tasks BEGIN
-  INSERT INTO fts_tasks(entry_id, title, taskStatus) VALUES (new.id, new.title, new.taskStatus);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_tasks_update
-AFTER UPDATE OF title, taskStatus ON content_tasks BEGIN
-  DELETE FROM fts_tasks WHERE entry_id = old.id;
-  INSERT INTO fts_tasks(entry_id, title, taskStatus) VALUES (new.id, new.title, new.taskStatus);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_tasks_delete
-AFTER DELETE ON content_tasks BEGIN
-  DELETE FROM fts_tasks WHERE entry_id = old.id;
-END;
+  -- content_products
+CREATE TABLE IF NOT EXISTS content_products (
+  id         TEXT    NOT NULL PRIMARY KEY,
+  slug       TEXT    NOT NULL UNIQUE,
+  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
+  name  TEXT NOT NULL,
+  description  TEXT,
+  price  REAL,
+  inventory  REAL,
+  rating  REAL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_products_status ON content_products(status);
+CREATE INDEX IF NOT EXISTS idx_products_created_at ON content_products(created_at);
+CREATE INDEX IF NOT EXISTS idx_products_name ON content_products(name);
+CREATE INDEX IF NOT EXISTS idx_products_price ON content_products(price);
+CREATE INDEX IF NOT EXISTS idx_products_inventory ON content_products(inventory);
+CREATE INDEX IF NOT EXISTS idx_products_rating ON content_products(rating);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_products USING fts5(
+  entry_id UNINDEXED,
+  name,
+  description,
+  tokenize = 'unicode61'
+);
+
+CREATE TRIGGER IF NOT EXISTS fts_products_insert
+AFTER INSERT ON content_products BEGIN
+  INSERT INTO fts_products(entry_id, name, description) VALUES (new.id, new.name, new.description);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_products_update
+AFTER UPDATE OF name, description ON content_products BEGIN
+  DELETE FROM fts_products WHERE entry_id = old.id;
+  INSERT INTO fts_products(entry_id, name, description) VALUES (new.id, new.name, new.description);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_products_delete
+AFTER DELETE ON content_products BEGIN
+  DELETE FROM fts_products WHERE entry_id = old.id;
+END;
+
+  -- content_reviews
+CREATE TABLE IF NOT EXISTS content_reviews (
+  id         TEXT    NOT NULL PRIMARY KEY,
+  slug       TEXT    NOT NULL UNIQUE,
+  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
+  title  TEXT NOT NULL,
+  body  TEXT,
+  score  REAL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_reviews_status ON content_reviews(status);
+CREATE INDEX IF NOT EXISTS idx_reviews_created_at ON content_reviews(created_at);
+CREATE INDEX IF NOT EXISTS idx_reviews_title ON content_reviews(title);
+CREATE INDEX IF NOT EXISTS idx_reviews_body ON content_reviews(body);
+CREATE INDEX IF NOT EXISTS idx_reviews_score ON content_reviews(score);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_reviews USING fts5(
+  entry_id UNINDEXED,
+  title,
+  body,
+  tokenize = 'unicode61'
+);
+
+CREATE TRIGGER IF NOT EXISTS fts_reviews_insert
+AFTER INSERT ON content_reviews BEGIN
+  INSERT INTO fts_reviews(entry_id, title, body) VALUES (new.id, new.title, new.body);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_reviews_update
+AFTER UPDATE OF title, body ON content_reviews BEGIN
+  DELETE FROM fts_reviews WHERE entry_id = old.id;
+  INSERT INTO fts_reviews(entry_id, title, body) VALUES (new.id, new.title, new.body);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_reviews_delete
+AFTER DELETE ON content_reviews BEGIN
+  DELETE FROM fts_reviews WHERE entry_id = old.id;
+END;
+
+  -- content_tasks
+CREATE TABLE IF NOT EXISTS content_tasks (
+  id         TEXT    NOT NULL PRIMARY KEY,
+  slug       TEXT    NOT NULL UNIQUE,
+  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
+  title  TEXT NOT NULL,
+  taskStatus  TEXT,
+  completion  REAL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_tasks_status ON content_tasks(status);
+CREATE INDEX IF NOT EXISTS idx_tasks_created_at ON content_tasks(created_at);
+CREATE INDEX IF NOT EXISTS idx_tasks_title ON content_tasks(title);
+CREATE INDEX IF NOT EXISTS idx_tasks_taskStatus ON content_tasks(taskStatus);
+CREATE INDEX IF NOT EXISTS idx_tasks_completion ON content_tasks(completion);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_tasks USING fts5(
+  entry_id UNINDEXED,
+  title,
+  taskStatus,
+  tokenize = 'unicode61'
+);
+
+CREATE TRIGGER IF NOT EXISTS fts_tasks_insert
+AFTER INSERT ON content_tasks BEGIN
+  INSERT INTO fts_tasks(entry_id, title, taskStatus) VALUES (new.id, new.title, new.taskStatus);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_tasks_update
+AFTER UPDATE OF title, taskStatus ON content_tasks BEGIN
+  DELETE FROM fts_tasks WHERE entry_id = old.id;
+  INSERT INTO fts_tasks(entry_id, title, taskStatus) VALUES (new.id, new.title, new.taskStatus);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_tasks_delete
+AFTER DELETE ON content_tasks BEGIN
+  DELETE FROM fts_tasks WHERE entry_id = old.id;
+END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/api",
-  "version": "0.5.0",
+  "version": "0.6.0-preview.2",
   "type": "module",
   "exports": {
     ".": "./src/factory.ts"
@@ -15,8 +15,8 @@
   "scripts": {
     "dev": "wrangler dev --port 8789",
     "build": "tsc -p tsconfig.build.json --noEmit",
-    "db:migrate:local": "wrangler d1 execute beech-db --local --file=./migrations/0000_v040_base.sql && wrangler d1 execute beech-db --local --file=./migrations/0029_automations.sql && wrangler d1 execute beech-db --local --file=./migrations/0030_test_seeds.sql",
-    "db:reset:local": "node -e \"require('fs').rmSync('.wrangler/state', {recursive:true,force:true})\" && npm run db:migrate:local && cd ../.. && node bin/cli.mjs seed:load --local && cd apps/api && wrangler d1 execute beech-db --local --file=./migrations/0028_v040_seed_data.sql",
+    "db:migrate:local": "node ./scripts/bootstrap-d1.mjs",
+    "db:reset:local": "node -e \"require('fs').rmSync('.wrangler/state', {recursive:true,force:true})\" && node ./scripts/bootstrap-d1.mjs",
     "deploy": "wrangler deploy --minify",
     "cf-typegen": "wrangler types --env-interface CloudflareBindings",
     "test": "vitest run",
@@ -24,16 +24,20 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.995.0",
-    "@beechcms/core": "^0.5.0",
+    "@aws-sdk/s3-request-presigner": "^3.995.0",
+    "@beechcms/core": "^0.6.0-preview.2",
+    "@upstash/qstash": "^2.11.0",
     "bcryptjs": "^2.4.3",
-    "hono": "^4.11.9",
+    "hono": "^4.12.21",
     "jose": "^6.1.3"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260213.0",
     "@types/bcryptjs": "^2.4.6",
-    "@vitest/coverage-v8": "^3.2.4",
-    "vitest": "^3.2.4",
-    "wrangler": "^4.4.0"
-  }
+    "@vitest/coverage-v8": "^4.1.0",
+    "vitest": "^4.1.0",
+    "wrangler": "^4.98.0"
+  },
+  "license": "BUSL-1.1",
+  "licenseFile": "../../LICENSE"
 }

package/src/auth/{in-memory-hash-provider.ts → __fixtures__/in-memory-hash-provider.ts}

@@ -1,13 +1,17 @@
-import type { IHashProvider } from '@beechcms/core'
-
-const HASH_PREFIX = 'HASH:'
-
-export class InMemoryHashProvider implements IHashProvider {
-  async hash(plaintextPassword: string): Promise<string> {
-    return HASH_PREFIX + plaintextPassword
-  }
-
-  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
-    return storedHash === HASH_PREFIX + plaintextPassword
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import type { IHashProvider } from '@beechcms/core'
+
+const HASH_PREFIX = 'HASH:'
+
+export class InMemoryHashProvider implements IHashProvider {
+  async hash(plaintextPassword: string): Promise<string> {
+    return HASH_PREFIX + plaintextPassword
+  }
+
+  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
+    return storedHash === HASH_PREFIX + plaintextPassword
+  }
+}

package/src/auth/{static-token-service.ts → __fixtures__/static-token-service.ts}

@@ -1,18 +1,22 @@
-import type { ITokenService, IssueTokenOptions, JwtClaims } from '@beechcms/core'
-
-const TEST_TOKEN_PREFIX = 'test:'
-
-export class StaticTokenService implements ITokenService {
-  private readonly issuedClaims = new Map<string, JwtClaims>()
-
-  async issue(claims: JwtClaims, _options?: IssueTokenOptions): Promise<string> {
-    const token = TEST_TOKEN_PREFIX + claims.sub
-    this.issuedClaims.set(token, claims)
-    return token
-  }
-
-  async verify(token: string): Promise<JwtClaims | null> {
-    if (!token.startsWith(TEST_TOKEN_PREFIX)) return null
-    return this.issuedClaims.get(token) ?? null
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import type { ITokenService, IssueTokenOptions, JwtClaims } from '@beechcms/core'
+
+const TEST_TOKEN_PREFIX = 'test:'
+
+export class StaticTokenService implements ITokenService {
+  private readonly issuedClaims = new Map<string, JwtClaims>()
+
+  async issue(claims: JwtClaims, _options?: IssueTokenOptions): Promise<string> {
+    const token = TEST_TOKEN_PREFIX + claims.sub
+    this.issuedClaims.set(token, claims)
+    return token
+  }
+
+  async verify(token: string): Promise<JwtClaims | null> {
+    if (!token.startsWith(TEST_TOKEN_PREFIX)) return null
+    return this.issuedClaims.get(token) ?? null
+  }
+}

package/src/auth/bcrypt-hash-provider.ts

@@ -1,20 +1,24 @@
-import bcrypt from 'bcryptjs'
-import type { IHashProvider } from '@beechcms/core'
-
-const DEFAULT_BCRYPT_ROUNDS = 10
-
-export class BcryptHashProvider implements IHashProvider {
-  private readonly saltRounds: number
-
-  constructor(saltRounds: number = DEFAULT_BCRYPT_ROUNDS) {
-    this.saltRounds = saltRounds
-  }
-
-  async hash(plaintextPassword: string): Promise<string> {
-    return bcrypt.hash(plaintextPassword, this.saltRounds)
-  }
-
-  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
-    return bcrypt.compare(plaintextPassword, storedHash)
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import bcrypt from 'bcryptjs'
+import type { IHashProvider } from '@beechcms/core'
+
+export const BCRYPT_SALT_ROUNDS = 10
+
+export class BcryptHashProvider implements IHashProvider {
+  private readonly saltRounds: number
+
+  constructor(saltRounds: number = BCRYPT_SALT_ROUNDS) {
+    this.saltRounds = saltRounds
+  }
+
+  async hash(plaintextPassword: string): Promise<string> {
+    return bcrypt.hash(plaintextPassword, this.saltRounds)
+  }
+
+  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
+    return bcrypt.compare(plaintextPassword, storedHash)
+  }
+}

package/src/auth/constants.ts

@@ -1,10 +1,14 @@
-/** API auth error messages - used by handlers and tests */
-export const AUTH_ERRORS = {
-  INVALID_REQUEST: 'Invalid request',
-  INVALID_CREDENTIALS: 'Invalid credentials',
-  DATABASE_ERROR: 'Database error',
-  /** Generic message for 500 errors - does not reveal system details */
-  GENERIC_ERROR: 'An error occurred',
-  /** Rate limit exceeded */
-  RATE_LIMIT_EXCEEDED: 'Too many requests',
-} as const
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/** API auth error messages - used by handlers and tests */
+export const AUTH_ERRORS = {
+  INVALID_REQUEST: 'Invalid request',
+  INVALID_CREDENTIALS: 'Invalid credentials',
+  DATABASE_ERROR: 'Database error',
+  /** Generic message for 500 errors - does not reveal system details */
+  GENERIC_ERROR: 'An error occurred',
+  /** Rate limit exceeded */
+  RATE_LIMIT_EXCEEDED: 'Too many requests',
+} as const

package/src/auth/generate-refresh-token.test.ts

@@ -1,19 +1,23 @@
-import { describe, it, expect } from 'vitest'
-import { generateRefreshToken } from './refresh'
-
-describe('generateRefreshToken', () => {
-  it('returns a non-empty string', () => {
-    expect(generateRefreshToken().length).toBeGreaterThan(0)
-  })
-
-  it('returns a UUID-shaped value (8-4-4-4-12 hex groups)', () => {
-    expect(generateRefreshToken()).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
-    )
-  })
-
-  it('returns a different token on every call', () => {
-    const tokens = new Set(Array.from({ length: 10 }, () => generateRefreshToken()))
-    expect(tokens.size).toBe(10)
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect } from 'vitest'
+import { generateRefreshToken } from './refresh'
+
+describe('generateRefreshToken', () => {
+  it('returns a non-empty string', () => {
+    expect(generateRefreshToken().length).toBeGreaterThan(0)
+  })
+
+  it('returns a 64-character hex string (256-bit / 32 bytes of entropy)', () => {
+    const token = generateRefreshToken()
+    expect(token).toHaveLength(64)
+    expect(token).toMatch(/^[0-9a-f]+$/)
+  })
+
+  it('returns a different token on every call', () => {
+    const tokens = new Set(Array.from({ length: 10 }, () => generateRefreshToken()))
+    expect(tokens.size).toBe(10)
+  })
+})

package/src/auth/hash-provider.test.ts

@@ -1,46 +1,55 @@
-import { describe, it, expect } from 'vitest'
-import { InMemoryHashProvider } from './in-memory-hash-provider'
-import { BcryptHashProvider } from './bcrypt-hash-provider'
-
-describe('InMemoryHashProvider', () => {
-  const provider = new InMemoryHashProvider()
-
-  it('hash returns the HASH: prefix concatenated with the plaintext', async () => {
-    expect(await provider.hash('mypassword')).toBe('HASH:mypassword')
-  })
-
-  it('verify returns true when the plaintext matches the stored hash', async () => {
-    const hash = await provider.hash('correct')
-    expect(await provider.verify('correct', hash)).toBe(true)
-  })
-
-  it('verify returns false when the plaintext does not match', async () => {
-    const hash = await provider.hash('correct')
-    expect(await provider.verify('wrong', hash)).toBe(false)
-  })
-
-  it('verify returns false for a string that does not follow the HASH: format', async () => {
-    expect(await provider.verify('anything', 'not-a-prefixed-hash')).toBe(false)
-  })
-})
-
-describe('BcryptHashProvider', () => {
-  // Use 4 salt rounds so the test runs in milliseconds.
-  const provider = new BcryptHashProvider(4)
-
-  it('hash and verify roundtrip: correct password returns true', async () => {
-    const hash = await provider.hash('secure-password')
-    expect(await provider.verify('secure-password', hash)).toBe(true)
-  })
-
-  it('verify returns false for an incorrect password', async () => {
-    const hash = await provider.hash('correct')
-    expect(await provider.verify('incorrect', hash)).toBe(false)
-  })
-
-  it('verify returns false against the DUMMY_PASSWORD_HASH for any plaintext', async () => {
-    // The dummy hash is used for timing-attack mitigation; it must not match real passwords.
-    const dummyHash = '$2a$10$SbkRFOafACxVM2ahxerVDu3tSkCXWm29b62WdB.4WGG02Qjsfzni6'
-    expect(await provider.verify('password123', dummyHash)).toBe(false)
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect } from 'vitest'
+import { InMemoryHashProvider } from './__fixtures__/in-memory-hash-provider'
+import { BcryptHashProvider, BCRYPT_SALT_ROUNDS } from './bcrypt-hash-provider'
+import { DUMMY_PASSWORD_HASH } from './login'
+
+describe('InMemoryHashProvider', () => {
+  const provider = new InMemoryHashProvider()
+
+  it('hash returns the HASH: prefix concatenated with the plaintext', async () => {
+    expect(await provider.hash('mypassword')).toBe('HASH:mypassword')
+  })
+
+  it('verify returns true when the plaintext matches the stored hash', async () => {
+    const hash = await provider.hash('correct')
+    expect(await provider.verify('correct', hash)).toBe(true)
+  })
+
+  it('verify returns false when the plaintext does not match', async () => {
+    const hash = await provider.hash('correct')
+    expect(await provider.verify('wrong', hash)).toBe(false)
+  })
+
+  it('verify returns false for a string that does not follow the HASH: format', async () => {
+    expect(await provider.verify('anything', 'not-a-prefixed-hash')).toBe(false)
+  })
+})
+
+describe('BcryptHashProvider', () => {
+  // Use 4 salt rounds so the test runs in milliseconds.
+  const provider = new BcryptHashProvider(4)
+
+  it('hash and verify roundtrip: correct password returns true', async () => {
+    const hash = await provider.hash('secure-password')
+    expect(await provider.verify('secure-password', hash)).toBe(true)
+  })
+
+  it('verify returns false for an incorrect password', async () => {
+    const hash = await provider.hash('correct')
+    expect(await provider.verify('incorrect', hash)).toBe(false)
+  })
+
+  it('verify returns false against the DUMMY_PASSWORD_HASH for any plaintext', async () => {
+    expect(await provider.verify('password123', DUMMY_PASSWORD_HASH)).toBe(false)
+  })
+
+  it('DUMMY_PASSWORD_HASH bcrypt cost matches BCRYPT_SALT_ROUNDS — timing oracle invariant', () => {
+    const match = DUMMY_PASSWORD_HASH.match(/^\$2[aby]\$(\d+)\$/)
+    expect(match).not.toBeNull()
+    expect(Number(match![1])).toBe(BCRYPT_SALT_ROUNDS)
+  })
+})