@beechcms/api 0.6.0-preview.1 → 0.6.0-preview.2

package/migrations/0029_automations.sql

@@ -1,14 +1,14 @@
-CREATE TABLE IF NOT EXISTS automations (
-  id                 TEXT    NOT NULL PRIMARY KEY,
-  seed_slug          TEXT    NOT NULL,
-  name               TEXT    NOT NULL,
-  enabled            INTEGER NOT NULL DEFAULT 1,
-  triggers           TEXT    NOT NULL DEFAULT '[]',
-  trigger_conditions TEXT,
-  actions            TEXT    NOT NULL,
-  created_at         INTEGER NOT NULL DEFAULT (unixepoch()),
-  updated_at         INTEGER NOT NULL DEFAULT (unixepoch())
-);
-
-CREATE INDEX IF NOT EXISTS idx_automations_seed_slug ON automations(seed_slug);
-CREATE INDEX IF NOT EXISTS idx_automations_enabled   ON automations(enabled);
+CREATE TABLE IF NOT EXISTS automations (
+  id                 TEXT    NOT NULL PRIMARY KEY,
+  seed_slug          TEXT    NOT NULL,
+  name               TEXT    NOT NULL,
+  enabled            INTEGER NOT NULL DEFAULT 1,
+  triggers           TEXT    NOT NULL DEFAULT '[]',
+  trigger_conditions TEXT,
+  actions            TEXT    NOT NULL,
+  created_at         INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at         INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_automations_seed_slug ON automations(seed_slug);
+CREATE INDEX IF NOT EXISTS idx_automations_enabled   ON automations(enabled);

package/migrations/0030_test_seeds.sql

@@ -1,125 +1,125 @@
-  -- content_products
-CREATE TABLE IF NOT EXISTS content_products (
-  id         TEXT    NOT NULL PRIMARY KEY,
-  slug       TEXT    NOT NULL UNIQUE,
-  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
-  name  TEXT NOT NULL,
-  description  TEXT,
-  price  REAL,
-  inventory  REAL,
-  rating  REAL,
-  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
-  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
-);
-
-CREATE INDEX IF NOT EXISTS idx_products_status ON content_products(status);
-CREATE INDEX IF NOT EXISTS idx_products_created_at ON content_products(created_at);
-CREATE INDEX IF NOT EXISTS idx_products_name ON content_products(name);
-CREATE INDEX IF NOT EXISTS idx_products_price ON content_products(price);
-CREATE INDEX IF NOT EXISTS idx_products_inventory ON content_products(inventory);
-CREATE INDEX IF NOT EXISTS idx_products_rating ON content_products(rating);
-
-CREATE VIRTUAL TABLE IF NOT EXISTS fts_products USING fts5(
-  entry_id UNINDEXED,
-  name,
-  description,
-  tokenize = 'unicode61'
-);
-
-CREATE TRIGGER IF NOT EXISTS fts_products_insert
-AFTER INSERT ON content_products BEGIN
-  INSERT INTO fts_products(entry_id, name, description) VALUES (new.id, new.name, new.description);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_products_update
-AFTER UPDATE OF name, description ON content_products BEGIN
-  DELETE FROM fts_products WHERE entry_id = old.id;
-  INSERT INTO fts_products(entry_id, name, description) VALUES (new.id, new.name, new.description);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_products_delete
-AFTER DELETE ON content_products BEGIN
-  DELETE FROM fts_products WHERE entry_id = old.id;
-END;
-
-  -- content_reviews
-CREATE TABLE IF NOT EXISTS content_reviews (
-  id         TEXT    NOT NULL PRIMARY KEY,
-  slug       TEXT    NOT NULL UNIQUE,
-  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
-  title  TEXT NOT NULL,
-  body  TEXT,
-  score  REAL,
-  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
-  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
-);
-
-CREATE INDEX IF NOT EXISTS idx_reviews_status ON content_reviews(status);
-CREATE INDEX IF NOT EXISTS idx_reviews_created_at ON content_reviews(created_at);
-CREATE INDEX IF NOT EXISTS idx_reviews_title ON content_reviews(title);
-CREATE INDEX IF NOT EXISTS idx_reviews_body ON content_reviews(body);
-CREATE INDEX IF NOT EXISTS idx_reviews_score ON content_reviews(score);
-
-CREATE VIRTUAL TABLE IF NOT EXISTS fts_reviews USING fts5(
-  entry_id UNINDEXED,
-  title,
-  body,
-  tokenize = 'unicode61'
-);
-
-CREATE TRIGGER IF NOT EXISTS fts_reviews_insert
-AFTER INSERT ON content_reviews BEGIN
-  INSERT INTO fts_reviews(entry_id, title, body) VALUES (new.id, new.title, new.body);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_reviews_update
-AFTER UPDATE OF title, body ON content_reviews BEGIN
-  DELETE FROM fts_reviews WHERE entry_id = old.id;
-  INSERT INTO fts_reviews(entry_id, title, body) VALUES (new.id, new.title, new.body);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_reviews_delete
-AFTER DELETE ON content_reviews BEGIN
-  DELETE FROM fts_reviews WHERE entry_id = old.id;
-END;
-
-  -- content_tasks
-CREATE TABLE IF NOT EXISTS content_tasks (
-  id         TEXT    NOT NULL PRIMARY KEY,
-  slug       TEXT    NOT NULL UNIQUE,
-  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
-  title  TEXT NOT NULL,
-  taskStatus  TEXT,
-  completion  REAL,
-  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
-  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
-);
-
-CREATE INDEX IF NOT EXISTS idx_tasks_status ON content_tasks(status);
-CREATE INDEX IF NOT EXISTS idx_tasks_created_at ON content_tasks(created_at);
-CREATE INDEX IF NOT EXISTS idx_tasks_title ON content_tasks(title);
-CREATE INDEX IF NOT EXISTS idx_tasks_taskStatus ON content_tasks(taskStatus);
-CREATE INDEX IF NOT EXISTS idx_tasks_completion ON content_tasks(completion);
-
-CREATE VIRTUAL TABLE IF NOT EXISTS fts_tasks USING fts5(
-  entry_id UNINDEXED,
-  title,
-  taskStatus,
-  tokenize = 'unicode61'
-);
-
-CREATE TRIGGER IF NOT EXISTS fts_tasks_insert
-AFTER INSERT ON content_tasks BEGIN
-  INSERT INTO fts_tasks(entry_id, title, taskStatus) VALUES (new.id, new.title, new.taskStatus);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_tasks_update
-AFTER UPDATE OF title, taskStatus ON content_tasks BEGIN
-  DELETE FROM fts_tasks WHERE entry_id = old.id;
-  INSERT INTO fts_tasks(entry_id, title, taskStatus) VALUES (new.id, new.title, new.taskStatus);
-END;
-
-CREATE TRIGGER IF NOT EXISTS fts_tasks_delete
-AFTER DELETE ON content_tasks BEGIN
-  DELETE FROM fts_tasks WHERE entry_id = old.id;
-END;
+  -- content_products
+CREATE TABLE IF NOT EXISTS content_products (
+  id         TEXT    NOT NULL PRIMARY KEY,
+  slug       TEXT    NOT NULL UNIQUE,
+  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
+  name  TEXT NOT NULL,
+  description  TEXT,
+  price  REAL,
+  inventory  REAL,
+  rating  REAL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_products_status ON content_products(status);
+CREATE INDEX IF NOT EXISTS idx_products_created_at ON content_products(created_at);
+CREATE INDEX IF NOT EXISTS idx_products_name ON content_products(name);
+CREATE INDEX IF NOT EXISTS idx_products_price ON content_products(price);
+CREATE INDEX IF NOT EXISTS idx_products_inventory ON content_products(inventory);
+CREATE INDEX IF NOT EXISTS idx_products_rating ON content_products(rating);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_products USING fts5(
+  entry_id UNINDEXED,
+  name,
+  description,
+  tokenize = 'unicode61'
+);
+
+CREATE TRIGGER IF NOT EXISTS fts_products_insert
+AFTER INSERT ON content_products BEGIN
+  INSERT INTO fts_products(entry_id, name, description) VALUES (new.id, new.name, new.description);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_products_update
+AFTER UPDATE OF name, description ON content_products BEGIN
+  DELETE FROM fts_products WHERE entry_id = old.id;
+  INSERT INTO fts_products(entry_id, name, description) VALUES (new.id, new.name, new.description);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_products_delete
+AFTER DELETE ON content_products BEGIN
+  DELETE FROM fts_products WHERE entry_id = old.id;
+END;
+
+  -- content_reviews
+CREATE TABLE IF NOT EXISTS content_reviews (
+  id         TEXT    NOT NULL PRIMARY KEY,
+  slug       TEXT    NOT NULL UNIQUE,
+  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
+  title  TEXT NOT NULL,
+  body  TEXT,
+  score  REAL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_reviews_status ON content_reviews(status);
+CREATE INDEX IF NOT EXISTS idx_reviews_created_at ON content_reviews(created_at);
+CREATE INDEX IF NOT EXISTS idx_reviews_title ON content_reviews(title);
+CREATE INDEX IF NOT EXISTS idx_reviews_body ON content_reviews(body);
+CREATE INDEX IF NOT EXISTS idx_reviews_score ON content_reviews(score);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_reviews USING fts5(
+  entry_id UNINDEXED,
+  title,
+  body,
+  tokenize = 'unicode61'
+);
+
+CREATE TRIGGER IF NOT EXISTS fts_reviews_insert
+AFTER INSERT ON content_reviews BEGIN
+  INSERT INTO fts_reviews(entry_id, title, body) VALUES (new.id, new.title, new.body);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_reviews_update
+AFTER UPDATE OF title, body ON content_reviews BEGIN
+  DELETE FROM fts_reviews WHERE entry_id = old.id;
+  INSERT INTO fts_reviews(entry_id, title, body) VALUES (new.id, new.title, new.body);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_reviews_delete
+AFTER DELETE ON content_reviews BEGIN
+  DELETE FROM fts_reviews WHERE entry_id = old.id;
+END;
+
+  -- content_tasks
+CREATE TABLE IF NOT EXISTS content_tasks (
+  id         TEXT    NOT NULL PRIMARY KEY,
+  slug       TEXT    NOT NULL UNIQUE,
+  status     TEXT    NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'review', 'published', 'archived')),
+  title  TEXT NOT NULL,
+  taskStatus  TEXT,
+  completion  REAL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_tasks_status ON content_tasks(status);
+CREATE INDEX IF NOT EXISTS idx_tasks_created_at ON content_tasks(created_at);
+CREATE INDEX IF NOT EXISTS idx_tasks_title ON content_tasks(title);
+CREATE INDEX IF NOT EXISTS idx_tasks_taskStatus ON content_tasks(taskStatus);
+CREATE INDEX IF NOT EXISTS idx_tasks_completion ON content_tasks(completion);
+
+CREATE VIRTUAL TABLE IF NOT EXISTS fts_tasks USING fts5(
+  entry_id UNINDEXED,
+  title,
+  taskStatus,
+  tokenize = 'unicode61'
+);
+
+CREATE TRIGGER IF NOT EXISTS fts_tasks_insert
+AFTER INSERT ON content_tasks BEGIN
+  INSERT INTO fts_tasks(entry_id, title, taskStatus) VALUES (new.id, new.title, new.taskStatus);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_tasks_update
+AFTER UPDATE OF title, taskStatus ON content_tasks BEGIN
+  DELETE FROM fts_tasks WHERE entry_id = old.id;
+  INSERT INTO fts_tasks(entry_id, title, taskStatus) VALUES (new.id, new.title, new.taskStatus);
+END;
+
+CREATE TRIGGER IF NOT EXISTS fts_tasks_delete
+AFTER DELETE ON content_tasks BEGIN
+  DELETE FROM fts_tasks WHERE entry_id = old.id;
+END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beechcms/api",
-  "version": "0.6.0-preview.1",
+  "version": "0.6.0-preview.2",
   "type": "module",
   "exports": {
     ".": "./src/factory.ts"
@@ -25,7 +25,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.995.0",
     "@aws-sdk/s3-request-presigner": "^3.995.0",
-    "@beechcms/core": "^0.6.0-preview.1",
+    "@beechcms/core": "^0.6.0-preview.2",
     "@upstash/qstash": "^2.11.0",
     "bcryptjs": "^2.4.3",
     "hono": "^4.12.21",

package/src/auth/__fixtures__/in-memory-hash-provider.ts

@@ -1,17 +1,17 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import type { IHashProvider } from '@beechcms/core'
-
-const HASH_PREFIX = 'HASH:'
-
-export class InMemoryHashProvider implements IHashProvider {
-  async hash(plaintextPassword: string): Promise<string> {
-    return HASH_PREFIX + plaintextPassword
-  }
-
-  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
-    return storedHash === HASH_PREFIX + plaintextPassword
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import type { IHashProvider } from '@beechcms/core'
+
+const HASH_PREFIX = 'HASH:'
+
+export class InMemoryHashProvider implements IHashProvider {
+  async hash(plaintextPassword: string): Promise<string> {
+    return HASH_PREFIX + plaintextPassword
+  }
+
+  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
+    return storedHash === HASH_PREFIX + plaintextPassword
+  }
+}

package/src/auth/__fixtures__/static-token-service.ts

@@ -1,22 +1,22 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import type { ITokenService, IssueTokenOptions, JwtClaims } from '@beechcms/core'
-
-const TEST_TOKEN_PREFIX = 'test:'
-
-export class StaticTokenService implements ITokenService {
-  private readonly issuedClaims = new Map<string, JwtClaims>()
-
-  async issue(claims: JwtClaims, _options?: IssueTokenOptions): Promise<string> {
-    const token = TEST_TOKEN_PREFIX + claims.sub
-    this.issuedClaims.set(token, claims)
-    return token
-  }
-
-  async verify(token: string): Promise<JwtClaims | null> {
-    if (!token.startsWith(TEST_TOKEN_PREFIX)) return null
-    return this.issuedClaims.get(token) ?? null
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import type { ITokenService, IssueTokenOptions, JwtClaims } from '@beechcms/core'
+
+const TEST_TOKEN_PREFIX = 'test:'
+
+export class StaticTokenService implements ITokenService {
+  private readonly issuedClaims = new Map<string, JwtClaims>()
+
+  async issue(claims: JwtClaims, _options?: IssueTokenOptions): Promise<string> {
+    const token = TEST_TOKEN_PREFIX + claims.sub
+    this.issuedClaims.set(token, claims)
+    return token
+  }
+
+  async verify(token: string): Promise<JwtClaims | null> {
+    if (!token.startsWith(TEST_TOKEN_PREFIX)) return null
+    return this.issuedClaims.get(token) ?? null
+  }
+}

package/src/auth/bcrypt-hash-provider.ts

@@ -1,24 +1,24 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import bcrypt from 'bcryptjs'
-import type { IHashProvider } from '@beechcms/core'
-
-export const BCRYPT_SALT_ROUNDS = 10
-
-export class BcryptHashProvider implements IHashProvider {
-  private readonly saltRounds: number
-
-  constructor(saltRounds: number = BCRYPT_SALT_ROUNDS) {
-    this.saltRounds = saltRounds
-  }
-
-  async hash(plaintextPassword: string): Promise<string> {
-    return bcrypt.hash(plaintextPassword, this.saltRounds)
-  }
-
-  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
-    return bcrypt.compare(plaintextPassword, storedHash)
-  }
-}
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import bcrypt from 'bcryptjs'
+import type { IHashProvider } from '@beechcms/core'
+
+export const BCRYPT_SALT_ROUNDS = 10
+
+export class BcryptHashProvider implements IHashProvider {
+  private readonly saltRounds: number
+
+  constructor(saltRounds: number = BCRYPT_SALT_ROUNDS) {
+    this.saltRounds = saltRounds
+  }
+
+  async hash(plaintextPassword: string): Promise<string> {
+    return bcrypt.hash(plaintextPassword, this.saltRounds)
+  }
+
+  async verify(plaintextPassword: string, storedHash: string): Promise<boolean> {
+    return bcrypt.compare(plaintextPassword, storedHash)
+  }
+}

package/src/auth/constants.ts

@@ -1,14 +1,14 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/** API auth error messages - used by handlers and tests */
-export const AUTH_ERRORS = {
-  INVALID_REQUEST: 'Invalid request',
-  INVALID_CREDENTIALS: 'Invalid credentials',
-  DATABASE_ERROR: 'Database error',
-  /** Generic message for 500 errors - does not reveal system details */
-  GENERIC_ERROR: 'An error occurred',
-  /** Rate limit exceeded */
-  RATE_LIMIT_EXCEEDED: 'Too many requests',
-} as const
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+/** API auth error messages - used by handlers and tests */
+export const AUTH_ERRORS = {
+  INVALID_REQUEST: 'Invalid request',
+  INVALID_CREDENTIALS: 'Invalid credentials',
+  DATABASE_ERROR: 'Database error',
+  /** Generic message for 500 errors - does not reveal system details */
+  GENERIC_ERROR: 'An error occurred',
+  /** Rate limit exceeded */
+  RATE_LIMIT_EXCEEDED: 'Too many requests',
+} as const

package/src/auth/generate-refresh-token.test.ts

@@ -1,23 +1,23 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect } from 'vitest'
-import { generateRefreshToken } from './refresh'
-
-describe('generateRefreshToken', () => {
-  it('returns a non-empty string', () => {
-    expect(generateRefreshToken().length).toBeGreaterThan(0)
-  })
-
-  it('returns a 64-character hex string (256-bit / 32 bytes of entropy)', () => {
-    const token = generateRefreshToken()
-    expect(token).toHaveLength(64)
-    expect(token).toMatch(/^[0-9a-f]+$/)
-  })
-
-  it('returns a different token on every call', () => {
-    const tokens = new Set(Array.from({ length: 10 }, () => generateRefreshToken()))
-    expect(tokens.size).toBe(10)
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect } from 'vitest'
+import { generateRefreshToken } from './refresh'
+
+describe('generateRefreshToken', () => {
+  it('returns a non-empty string', () => {
+    expect(generateRefreshToken().length).toBeGreaterThan(0)
+  })
+
+  it('returns a 64-character hex string (256-bit / 32 bytes of entropy)', () => {
+    const token = generateRefreshToken()
+    expect(token).toHaveLength(64)
+    expect(token).toMatch(/^[0-9a-f]+$/)
+  })
+
+  it('returns a different token on every call', () => {
+    const tokens = new Set(Array.from({ length: 10 }, () => generateRefreshToken()))
+    expect(tokens.size).toBe(10)
+  })
+})

package/src/auth/hash-provider.test.ts

@@ -1,55 +1,55 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect } from 'vitest'
-import { InMemoryHashProvider } from './__fixtures__/in-memory-hash-provider'
-import { BcryptHashProvider, BCRYPT_SALT_ROUNDS } from './bcrypt-hash-provider'
-import { DUMMY_PASSWORD_HASH } from './login'
-
-describe('InMemoryHashProvider', () => {
-  const provider = new InMemoryHashProvider()
-
-  it('hash returns the HASH: prefix concatenated with the plaintext', async () => {
-    expect(await provider.hash('mypassword')).toBe('HASH:mypassword')
-  })
-
-  it('verify returns true when the plaintext matches the stored hash', async () => {
-    const hash = await provider.hash('correct')
-    expect(await provider.verify('correct', hash)).toBe(true)
-  })
-
-  it('verify returns false when the plaintext does not match', async () => {
-    const hash = await provider.hash('correct')
-    expect(await provider.verify('wrong', hash)).toBe(false)
-  })
-
-  it('verify returns false for a string that does not follow the HASH: format', async () => {
-    expect(await provider.verify('anything', 'not-a-prefixed-hash')).toBe(false)
-  })
-})
-
-describe('BcryptHashProvider', () => {
-  // Use 4 salt rounds so the test runs in milliseconds.
-  const provider = new BcryptHashProvider(4)
-
-  it('hash and verify roundtrip: correct password returns true', async () => {
-    const hash = await provider.hash('secure-password')
-    expect(await provider.verify('secure-password', hash)).toBe(true)
-  })
-
-  it('verify returns false for an incorrect password', async () => {
-    const hash = await provider.hash('correct')
-    expect(await provider.verify('incorrect', hash)).toBe(false)
-  })
-
-  it('verify returns false against the DUMMY_PASSWORD_HASH for any plaintext', async () => {
-    expect(await provider.verify('password123', DUMMY_PASSWORD_HASH)).toBe(false)
-  })
-
-  it('DUMMY_PASSWORD_HASH bcrypt cost matches BCRYPT_SALT_ROUNDS — timing oracle invariant', () => {
-    const match = DUMMY_PASSWORD_HASH.match(/^\$2[aby]\$(\d+)\$/)
-    expect(match).not.toBeNull()
-    expect(Number(match![1])).toBe(BCRYPT_SALT_ROUNDS)
-  })
-})
+// SPDX-License-Identifier: BUSL-1.1
+// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
+// See LICENSE in the repository root for license terms.
+
+import { describe, it, expect } from 'vitest'
+import { InMemoryHashProvider } from './__fixtures__/in-memory-hash-provider'
+import { BcryptHashProvider, BCRYPT_SALT_ROUNDS } from './bcrypt-hash-provider'
+import { DUMMY_PASSWORD_HASH } from './login'
+
+describe('InMemoryHashProvider', () => {
+  const provider = new InMemoryHashProvider()
+
+  it('hash returns the HASH: prefix concatenated with the plaintext', async () => {
+    expect(await provider.hash('mypassword')).toBe('HASH:mypassword')
+  })
+
+  it('verify returns true when the plaintext matches the stored hash', async () => {
+    const hash = await provider.hash('correct')
+    expect(await provider.verify('correct', hash)).toBe(true)
+  })
+
+  it('verify returns false when the plaintext does not match', async () => {
+    const hash = await provider.hash('correct')
+    expect(await provider.verify('wrong', hash)).toBe(false)
+  })
+
+  it('verify returns false for a string that does not follow the HASH: format', async () => {
+    expect(await provider.verify('anything', 'not-a-prefixed-hash')).toBe(false)
+  })
+})
+
+describe('BcryptHashProvider', () => {
+  // Use 4 salt rounds so the test runs in milliseconds.
+  const provider = new BcryptHashProvider(4)
+
+  it('hash and verify roundtrip: correct password returns true', async () => {
+    const hash = await provider.hash('secure-password')
+    expect(await provider.verify('secure-password', hash)).toBe(true)
+  })
+
+  it('verify returns false for an incorrect password', async () => {
+    const hash = await provider.hash('correct')
+    expect(await provider.verify('incorrect', hash)).toBe(false)
+  })
+
+  it('verify returns false against the DUMMY_PASSWORD_HASH for any plaintext', async () => {
+    expect(await provider.verify('password123', DUMMY_PASSWORD_HASH)).toBe(false)
+  })
+
+  it('DUMMY_PASSWORD_HASH bcrypt cost matches BCRYPT_SALT_ROUNDS — timing oracle invariant', () => {
+    const match = DUMMY_PASSWORD_HASH.match(/^\$2[aby]\$(\d+)\$/)
+    expect(match).not.toBeNull()
+    expect(Number(match![1])).toBe(BCRYPT_SALT_ROUNDS)
+  })
+})