@beechcms/api 0.5.0 → 0.6.0-preview.2

package/src/auth/jose-token-service.ts

@@ -1,55 +1,62 @@
-import { SignJWT, jwtVerify } from 'jose'
-import type { ITokenService, IssueTokenOptions, JwtClaims, IClock } from '@beechcms/core'
-
-const DEFAULT_TOKEN_TTL_SECONDS = 900
-const DEFAULT_ALGORITHM = 'HS256' as const
-
-export interface JoseTokenServiceConfig {
-  issuer?: string
-  audience?: string
-  algorithm?: 'HS256' | 'HS384' | 'HS512'
-}
-
-export class JoseTokenService implements ITokenService {
-  private readonly secretBytes: Uint8Array
-  private readonly config: JoseTokenServiceConfig
-  private readonly clock: IClock
-
-  constructor(secret: string, config: JoseTokenServiceConfig, clock: IClock) {
-    this.secretBytes = new TextEncoder().encode(secret)
-    this.config = config
-    this.clock = clock
-  }
-
-  async issue(claims: JwtClaims, options?: IssueTokenOptions): Promise<string> {
-    const { sub, ...remainingClaims } = claims
-    const ttlSeconds = options?.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS
-    const algorithm = this.config.algorithm ?? DEFAULT_ALGORITHM
-    const issuedAtSeconds = this.clock.nowSeconds()
-
-    let builder = new SignJWT(remainingClaims)
-      .setProtectedHeader({ alg: algorithm, typ: 'JWT' })
-      .setSubject(sub)
-      .setIssuedAt(issuedAtSeconds)
-      .setExpirationTime(issuedAtSeconds + ttlSeconds)
-
-    if (this.config.issuer) builder = builder.setIssuer(this.config.issuer)
-    if (this.config.audience) builder = builder.setAudience(this.config.audience)
-
-    return builder.sign(this.secretBytes)
-  }
-
-  async verify(token: string): Promise<JwtClaims | null> {
-    try {
-      const algorithm = this.config.algorithm ?? DEFAULT_ALGORITHM
-      const { payload } = await jwtVerify(token, this.secretBytes, {
-        algorithms: [algorithm],
-        issuer: this.config.issuer,
-        audience: this.config.audience,
-      })
-      return payload as JwtClaims
-    } catch {
-      return null
-    }
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { SignJWT, jwtVerify } from 'jose'
+import type { ITokenService, IssueTokenOptions, JwtClaims, IClock } from '@beechcms/core'
+
+const DEFAULT_TOKEN_TTL_SECONDS = 900
+const DEFAULT_ALGORITHM = 'HS256' as const
+
+export interface JoseTokenServiceConfig {
+  issuer?: string
+  audience?: string
+  algorithm?: 'HS256' | 'HS384' | 'HS512'
+}
+
+export class JoseTokenService implements ITokenService {
+  private readonly secretBytes: Uint8Array
+  private readonly config: JoseTokenServiceConfig
+  private readonly clock: IClock
+
+  constructor(secret: string, config: JoseTokenServiceConfig, clock: IClock) {
+    this.secretBytes = new TextEncoder().encode(secret)
+    if (this.secretBytes.length < 32) {
+      throw new Error('JWT secret must be at least 32 bytes (256-bit)')
+    }
+    this.config = config
+    this.clock = clock
+  }
+
+  async issue(claims: JwtClaims, options?: IssueTokenOptions): Promise<string> {
+    const { sub, ...remainingClaims } = claims
+    const ttlSeconds = options?.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS
+    const algorithm = this.config.algorithm ?? DEFAULT_ALGORITHM
+    const issuedAtSeconds = this.clock.nowSeconds()
+
+    let builder = new SignJWT(remainingClaims)
+      .setProtectedHeader({ alg: algorithm, typ: 'JWT' })
+      .setSubject(sub)
+      .setIssuedAt(issuedAtSeconds)
+      .setExpirationTime(issuedAtSeconds + ttlSeconds)
+
+    if (this.config.issuer) builder = builder.setIssuer(this.config.issuer)
+    if (this.config.audience) builder = builder.setAudience(this.config.audience)
+
+    return builder.sign(this.secretBytes)
+  }
+
+  async verify(token: string): Promise<JwtClaims | null> {
+    try {
+      const algorithm = this.config.algorithm ?? DEFAULT_ALGORITHM
+      const { payload } = await jwtVerify(token, this.secretBytes, {
+        algorithms: [algorithm],
+        issuer: this.config.issuer,
+        audience: this.config.audience,
+      })
+      return payload as JwtClaims
+    } catch {
+      return null
+    }
+  }
+}

package/src/auth/jwt-claims-passthrough.test.ts

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/**
+ * Sprint 04-pre Part B5 — JWT claims pass-through test.
+ *
+ * Verifies that `role` and `surname` claims issued in a JWT token are
+ * preserved end-to-end through the authMiddleware and available on
+ * `context.get('jwtPayload')`. Without the JwtClaims unification these
+ * fields would be type-erased and come back undefined.
+ */
+
+import { describe, it, expect } from 'vitest'
+import { Hono } from 'hono'
+import { SystemClock } from '@beechcms/core'
+import type { JwtClaims } from '@beechcms/core'
+import { JoseTokenService } from './jose-token-service'
+import { authMiddleware } from '../middleware'
+import type { Env, Variables } from '../types'
+
+const TEST_SECRET = 'super-secret-key-used-only-in-the-vitest-suite-min-length'
+
+describe('JWT claims pass-through (sprint 04-pre)', () => {
+  const tokenService = new JoseTokenService(TEST_SECRET, {}, SystemClock)
+
+  async function buildApp() {
+    const app = new Hono<{ Bindings: Env; Variables: Variables }>()
+
+    app.use('*', async (c, next) => {
+      c.set('tokenService', tokenService)
+      await next()
+    })
+
+    app.use('/protected', authMiddleware())
+
+    app.get('/protected', (c) => {
+      const payload = c.get('jwtPayload')
+      return c.json(payload)
+    })
+
+    return app
+  }
+
+  it('role and surname claims survive the authMiddleware round-trip', async () => {
+    const app = await buildApp()
+
+    const claims: JwtClaims = {
+      sub: 'user-123',
+      email: 'admin@example.com',
+      name: 'Admin',
+      surname: 'User',
+      role: 'admin',
+    }
+
+    const token = await tokenService.issue(claims)
+
+    const res = await app.request('/protected', {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${token}` },
+    })
+
+    expect(res.status).toBe(200)
+    const body = await res.json<JwtClaims>()
+    expect(body.sub).toBe('user-123')
+    expect(body.role).toBe('admin')
+    expect(body.surname).toBe('User')
+    expect(body.email).toBe('admin@example.com')
+  })
+
+  it('a token without role/surname returns undefined for those fields', async () => {
+    const app = await buildApp()
+
+    const token = await tokenService.issue({ sub: 'user-456', email: 'plain@example.com' })
+
+    const res = await app.request('/protected', {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${token}` },
+    })
+
+    expect(res.status).toBe(200)
+    const body = await res.json<JwtClaims>()
+    expect(body.sub).toBe('user-456')
+    expect(body.role).toBeUndefined()
+    expect(body.surname).toBeUndefined()
+  })
+})

package/src/auth/login.test.ts

@@ -1,92 +1,100 @@
-import { describe, it, expect } from 'vitest'
-import { parseLoginBody, validateLoginInput, verifyPassword, DUMMY_PASSWORD_HASH } from './login'
-import { InMemoryHashProvider } from './in-memory-hash-provider'
-
-describe('parseLoginBody', () => {
-  it('returns credentials for a valid object body', () => {
-    expect(parseLoginBody({ email: 'user@test.com', password: 'pass1234' }))
-      .toEqual({ email: 'user@test.com', password: 'pass1234' })
-  })
-
-  it('trims leading and trailing whitespace from email', () => {
-    expect(parseLoginBody({ email: '  user@test.com  ', password: 'pass' }))
-      .toEqual({ email: 'user@test.com', password: 'pass' })
-  })
-
-  it('returns null for non-object input', () => {
-    expect(parseLoginBody(null)).toBeNull()
-    expect(parseLoginBody('string')).toBeNull()
-    expect(parseLoginBody(42)).toBeNull()
-    expect(parseLoginBody(undefined)).toBeNull()
-  })
-
-  it('returns null when email field is missing', () => {
-    expect(parseLoginBody({ password: 'pass' })).toBeNull()
-  })
-
-  it('returns null when password field is missing', () => {
-    expect(parseLoginBody({ email: 'x@x.com' })).toBeNull()
-  })
-
-  it('returns null when email is an empty string after trimming', () => {
-    expect(parseLoginBody({ email: '   ', password: 'pass' })).toBeNull()
-  })
-
-  it('returns null when email is not a string', () => {
-    expect(parseLoginBody({ email: 42, password: 'pass' })).toBeNull()
-  })
-})
-
-describe('validateLoginInput', () => {
-  it('accepts a valid email and an 8-character password', () => {
-    expect(validateLoginInput('user@test.com', '12345678')).toBe(true)
-  })
-
-  it('rejects an email without an @ sign', () => {
-    expect(validateLoginInput('notanemail', 'password123')).toBe(false)
-  })
-
-  it('rejects an email with nothing before the @', () => {
-    expect(validateLoginInput('@test.com', 'password123')).toBe(false)
-  })
-
-  it('rejects an email with no domain extension', () => {
-    expect(validateLoginInput('user@nodot', 'password123')).toBe(false)
-  })
-
-  it('rejects a password shorter than 8 characters', () => {
-    expect(validateLoginInput('user@test.com', '1234567')).toBe(false)
-  })
-
-  it('rejects a password longer than 128 characters', () => {
-    expect(validateLoginInput('user@test.com', 'a'.repeat(129))).toBe(false)
-  })
-
-  it('accepts passwords at the lower boundary (exactly 8 characters)', () => {
-    expect(validateLoginInput('user@test.com', 'a'.repeat(8))).toBe(true)
-  })
-
-  it('accepts passwords at the upper boundary (exactly 128 characters)', () => {
-    expect(validateLoginInput('user@test.com', 'a'.repeat(128))).toBe(true)
-  })
-})
-
-describe('verifyPassword', () => {
-  const hashProvider = new InMemoryHashProvider()
-
-  it('returns true when the plaintext matches the stored hash', async () => {
-    const hash = await hashProvider.hash('mypassword')
-    expect(await verifyPassword('mypassword', hash, hashProvider)).toBe(true)
-  })
-
-  it('returns false when the plaintext does not match', async () => {
-    const hash = await hashProvider.hash('correct')
-    expect(await verifyPassword('wrong', hash, hashProvider)).toBe(false)
-  })
-})
-
-describe('DUMMY_PASSWORD_HASH', () => {
-  it('has bcrypt format so constant-time comparison runs even when no user is found', () => {
-    expect(DUMMY_PASSWORD_HASH).toMatch(/^\$2[aby]\$\d+\$/)
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect } from 'vitest'
+import { parseLoginBody, validateLoginInput, verifyPassword, DUMMY_PASSWORD_HASH } from './login'
+import { InMemoryHashProvider } from './__fixtures__/in-memory-hash-provider'
+
+describe('parseLoginBody', () => {
+  it('returns credentials for a valid object body', () => {
+    expect(parseLoginBody({ email: 'user@test.com', password: 'pass1234' }))
+      .toEqual({ email: 'user@test.com', password: 'pass1234' })
+  })
+
+  it('trims leading and trailing whitespace from email', () => {
+    expect(parseLoginBody({ email: '  user@test.com  ', password: 'pass' }))
+      .toEqual({ email: 'user@test.com', password: 'pass' })
+  })
+
+  it('returns null for non-object input', () => {
+    expect(parseLoginBody(null)).toBeNull()
+    expect(parseLoginBody('string')).toBeNull()
+    expect(parseLoginBody(42)).toBeNull()
+    expect(parseLoginBody(undefined)).toBeNull()
+  })
+
+  it('returns null when email field is missing', () => {
+    expect(parseLoginBody({ password: 'pass' })).toBeNull()
+  })
+
+  it('returns null when password field is missing', () => {
+    expect(parseLoginBody({ email: 'x@x.com' })).toBeNull()
+  })
+
+  it('returns null when email is an empty string after trimming', () => {
+    expect(parseLoginBody({ email: '   ', password: 'pass' })).toBeNull()
+  })
+
+  it('returns null when email is not a string', () => {
+    expect(parseLoginBody({ email: 42, password: 'pass' })).toBeNull()
+  })
+})
+
+describe('validateLoginInput', () => {
+  it('accepts a valid email and an 8-character password', () => {
+    expect(validateLoginInput('user@test.com', '12345678')).toBe(true)
+  })
+
+  it('rejects an email without an @ sign', () => {
+    expect(validateLoginInput('notanemail', 'password123')).toBe(false)
+  })
+
+  it('rejects an email with nothing before the @', () => {
+    expect(validateLoginInput('@test.com', 'password123')).toBe(false)
+  })
+
+  it('rejects an email with no domain extension', () => {
+    expect(validateLoginInput('user@nodot', 'password123')).toBe(false)
+  })
+
+  it('rejects a password shorter than 8 characters', () => {
+    expect(validateLoginInput('user@test.com', '1234567')).toBe(false)
+  })
+
+  it('rejects a password longer than 128 characters', () => {
+    expect(validateLoginInput('user@test.com', 'a'.repeat(129))).toBe(false)
+  })
+
+  it('accepts passwords at the lower boundary (exactly 8 characters)', () => {
+    expect(validateLoginInput('user@test.com', 'a'.repeat(8))).toBe(true)
+  })
+
+  it('accepts passwords at the upper boundary (exactly 128 characters)', () => {
+    expect(validateLoginInput('user@test.com', 'a'.repeat(128))).toBe(true)
+  })
+
+  it('rejects a password made only of whitespace', () => {
+    expect(validateLoginInput('user@test.com', ' '.repeat(8))).toBe(false)
+  })
+})
+
+describe('verifyPassword', () => {
+  const hashProvider = new InMemoryHashProvider()
+
+  it('returns true when the plaintext matches the stored hash', async () => {
+    const hash = await hashProvider.hash('mypassword')
+    expect(await verifyPassword('mypassword', hash, hashProvider)).toBe(true)
+  })
+
+  it('returns false when the plaintext does not match', async () => {
+    const hash = await hashProvider.hash('correct')
+    expect(await verifyPassword('wrong', hash, hashProvider)).toBe(false)
+  })
+})
+
+describe('DUMMY_PASSWORD_HASH', () => {
+  it('has bcrypt format so constant-time comparison runs even when no user is found', () => {
+    expect(DUMMY_PASSWORD_HASH).toMatch(/^\$2[aby]\$\d+\$/)
+  })
+})

package/src/auth/login.ts

@@ -1,74 +1,78 @@
-/// <reference types="@cloudflare/workers-types" />
-import type { IHashProvider } from '@beechcms/core'
-
-export type LoginCredentials = {
-  email: string
-  password: string
-}
-
-/** 
- * Regex per validare formato email.
- * Utilizza classi di caratteri che non si sovrappongono per evitare il backtracking catastrofico (ReDoS).
- */
-const EMAIL_REGEX = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/
-/** Lunghezza massima email secondo standard RFC 5321 */
-const MAX_EMAIL_LENGTH = 254
-
-/** Lunghezza minima password (caratteri) */
-const MIN_PASSWORD_LENGTH = 8
-
-/** Lunghezza massima password (caratteri) - limite ragionevole per evitare DoS */
-const MAX_PASSWORD_LENGTH = 128
-
-/**
- * Hash bcrypt dummy valido.
- * Usato quando l'utente non esiste per evitare timing attack
- * (stesso tempo di risposta che con password errata).
- */
-export const DUMMY_PASSWORD_HASH =
-  '$2a$10$SbkRFOafACxVM2ahxerVDu3tSkCXWm29b62WdB.4WGG02Qjsfzni6'
-
-/**
- * Estrae e valida email e password dal body della richiesta.
- * @param body - Body grezzo (tipicamente da req.json())
- * @returns Oggetto {email, password} se valido, null altrimenti
- */
-export function parseLoginBody(body: unknown): LoginCredentials | null {
-  if (body === null || typeof body !== 'object') return null
-  const obj = body as Record<string, unknown>
-  const email = obj.email
-  const password = obj.password
-  if (typeof email !== 'string' || typeof password !== 'string') return null
-  if (!email.trim() || !password) return null
-  return { email: email.trim(), password }
-}
-
-/**
- * Verifica che email e password rispettino i formati richiesti.
- * @param email - Email da validare (deve contenere @ e punto dopo @)
- * @param password - Password (8-128 caratteri)
- * @returns true se valido
- */
-export function validateLoginInput(email: string, password: string): boolean {
-  return (
-    email.length <= MAX_EMAIL_LENGTH &&
-    EMAIL_REGEX.test(email) &&
-    password.length >= MIN_PASSWORD_LENGTH &&
-    password.length <= MAX_PASSWORD_LENGTH
-  )
-}
-
-/**
- * Verifica che la password in chiaro corrisponda all'hash salvato.
- * @param plainPassword - Password in chiaro
- * @param hash - Hash salvato nel DB
- * @param hashProvider - Provider usato per la comparazione costante-time
- * @returns true se la password è corretta
- */
-export async function verifyPassword(
-  plainPassword: string,
-  hash: string,
-  hashProvider: IHashProvider
-): Promise<boolean> {
-  return hashProvider.verify(plainPassword, hash)
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/// <reference types="@cloudflare/workers-types" />
+import type { IHashProvider } from '@beechcms/core'
+
+export type LoginCredentials = {
+  email: string
+  password: string
+}
+
+/** 
+ * Regex per validare formato email.
+ * Utilizza classi di caratteri che non si sovrappongono per evitare il backtracking catastrofico (ReDoS).
+ */
+const EMAIL_REGEX = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/
+/** Lunghezza massima email secondo standard RFC 5321 */
+const MAX_EMAIL_LENGTH = 254
+
+/** Lunghezza minima password (caratteri) */
+const MIN_PASSWORD_LENGTH = 8
+
+/** Lunghezza massima password (caratteri) - limite ragionevole per evitare DoS */
+const MAX_PASSWORD_LENGTH = 128
+
+/**
+ * Hash bcrypt dummy valido.
+ * Usato quando l'utente non esiste per evitare timing attack
+ * (stesso tempo di risposta che con password errata).
+ */
+export const DUMMY_PASSWORD_HASH =
+  '$2a$10$SbkRFOafACxVM2ahxerVDu3tSkCXWm29b62WdB.4WGG02Qjsfzni6'
+
+/**
+ * Estrae e valida email e password dal body della richiesta.
+ * @param body - Body grezzo (tipicamente da req.json())
+ * @returns Oggetto {email, password} se valido, null altrimenti
+ */
+export function parseLoginBody(body: unknown): LoginCredentials | null {
+  if (body === null || typeof body !== 'object') return null
+  const obj = body as Record<string, unknown>
+  const email = obj.email
+  const password = obj.password
+  if (typeof email !== 'string' || typeof password !== 'string') return null
+  if (!email.trim() || !password) return null
+  return { email: email.trim(), password }
+}
+
+/**
+ * Verifica che email e password rispettino i formati richiesti.
+ * @param email - Email da validare (deve contenere @ e punto dopo @)
+ * @param password - Password (8-128 caratteri)
+ * @returns true se valido
+ */
+export function validateLoginInput(email: string, password: string): boolean {
+  return (
+    email.length <= MAX_EMAIL_LENGTH &&
+    EMAIL_REGEX.test(email) &&
+    password.trim().length >= MIN_PASSWORD_LENGTH &&
+    password.length <= MAX_PASSWORD_LENGTH
+  )
+}
+
+/**
+ * Verifica che la password in chiaro corrisponda all'hash salvato.
+ * @param plainPassword - Password in chiaro
+ * @param hash - Hash salvato nel DB
+ * @param hashProvider - Provider usato per la comparazione costante-time
+ * @returns true se la password è corretta
+ */
+export async function verifyPassword(
+  plainPassword: string,
+  hash: string,
+  hashProvider: IHashProvider
+): Promise<boolean> {
+  return hashProvider.verify(plainPassword, hash)
+}

package/src/auth/refresh.ts

@@ -1,5 +1,11 @@
-/// <reference types="@cloudflare/workers-types" />
-
-export function generateRefreshToken(): string {
-  return crypto.randomUUID()
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/// <reference types="@cloudflare/workers-types" />
+
+export function generateRefreshToken(): string {
+  const bytes = new Uint8Array(32)
+  crypto.getRandomValues(bytes)
+  return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('')
+}