@beechcms/api 0.6.0-preview.1 → 0.6.0-preview.3

package/src/auth/generate-refresh-token.test.ts

@@ -1,23 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect } from 'vitest'
-import { generateRefreshToken } from './refresh'
-
-describe('generateRefreshToken', () => {
-  it('returns a non-empty string', () => {
-    expect(generateRefreshToken().length).toBeGreaterThan(0)
-  })
-
-  it('returns a 64-character hex string (256-bit / 32 bytes of entropy)', () => {
-    const token = generateRefreshToken()
-    expect(token).toHaveLength(64)
-    expect(token).toMatch(/^[0-9a-f]+$/)
-  })
-
-  it('returns a different token on every call', () => {
-    const tokens = new Set(Array.from({ length: 10 }, () => generateRefreshToken()))
-    expect(tokens.size).toBe(10)
-  })
-})

package/src/auth/hash-provider.test.ts

@@ -1,55 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect } from 'vitest'
-import { InMemoryHashProvider } from './__fixtures__/in-memory-hash-provider'
-import { BcryptHashProvider, BCRYPT_SALT_ROUNDS } from './bcrypt-hash-provider'
-import { DUMMY_PASSWORD_HASH } from './login'
-
-describe('InMemoryHashProvider', () => {
-  const provider = new InMemoryHashProvider()
-
-  it('hash returns the HASH: prefix concatenated with the plaintext', async () => {
-    expect(await provider.hash('mypassword')).toBe('HASH:mypassword')
-  })
-
-  it('verify returns true when the plaintext matches the stored hash', async () => {
-    const hash = await provider.hash('correct')
-    expect(await provider.verify('correct', hash)).toBe(true)
-  })
-
-  it('verify returns false when the plaintext does not match', async () => {
-    const hash = await provider.hash('correct')
-    expect(await provider.verify('wrong', hash)).toBe(false)
-  })
-
-  it('verify returns false for a string that does not follow the HASH: format', async () => {
-    expect(await provider.verify('anything', 'not-a-prefixed-hash')).toBe(false)
-  })
-})
-
-describe('BcryptHashProvider', () => {
-  // Use 4 salt rounds so the test runs in milliseconds.
-  const provider = new BcryptHashProvider(4)
-
-  it('hash and verify roundtrip: correct password returns true', async () => {
-    const hash = await provider.hash('secure-password')
-    expect(await provider.verify('secure-password', hash)).toBe(true)
-  })
-
-  it('verify returns false for an incorrect password', async () => {
-    const hash = await provider.hash('correct')
-    expect(await provider.verify('incorrect', hash)).toBe(false)
-  })
-
-  it('verify returns false against the DUMMY_PASSWORD_HASH for any plaintext', async () => {
-    expect(await provider.verify('password123', DUMMY_PASSWORD_HASH)).toBe(false)
-  })
-
-  it('DUMMY_PASSWORD_HASH bcrypt cost matches BCRYPT_SALT_ROUNDS — timing oracle invariant', () => {
-    const match = DUMMY_PASSWORD_HASH.match(/^\$2[aby]\$(\d+)\$/)
-    expect(match).not.toBeNull()
-    expect(Number(match![1])).toBe(BCRYPT_SALT_ROUNDS)
-  })
-})

package/src/auth/jose-token-service.ts

@@ -1,62 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { SignJWT, jwtVerify } from 'jose'
-import type { ITokenService, IssueTokenOptions, JwtClaims, IClock } from '@beechcms/core'
-
-const DEFAULT_TOKEN_TTL_SECONDS = 900
-const DEFAULT_ALGORITHM = 'HS256' as const
-
-export interface JoseTokenServiceConfig {
-  issuer?: string
-  audience?: string
-  algorithm?: 'HS256' | 'HS384' | 'HS512'
-}
-
-export class JoseTokenService implements ITokenService {
-  private readonly secretBytes: Uint8Array
-  private readonly config: JoseTokenServiceConfig
-  private readonly clock: IClock
-
-  constructor(secret: string, config: JoseTokenServiceConfig, clock: IClock) {
-    this.secretBytes = new TextEncoder().encode(secret)
-    if (this.secretBytes.length < 32) {
-      throw new Error('JWT secret must be at least 32 bytes (256-bit)')
-    }
-    this.config = config
-    this.clock = clock
-  }
-
-  async issue(claims: JwtClaims, options?: IssueTokenOptions): Promise<string> {
-    const { sub, ...remainingClaims } = claims
-    const ttlSeconds = options?.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS
-    const algorithm = this.config.algorithm ?? DEFAULT_ALGORITHM
-    const issuedAtSeconds = this.clock.nowSeconds()
-
-    let builder = new SignJWT(remainingClaims)
-      .setProtectedHeader({ alg: algorithm, typ: 'JWT' })
-      .setSubject(sub)
-      .setIssuedAt(issuedAtSeconds)
-      .setExpirationTime(issuedAtSeconds + ttlSeconds)
-
-    if (this.config.issuer) builder = builder.setIssuer(this.config.issuer)
-    if (this.config.audience) builder = builder.setAudience(this.config.audience)
-
-    return builder.sign(this.secretBytes)
-  }
-
-  async verify(token: string): Promise<JwtClaims | null> {
-    try {
-      const algorithm = this.config.algorithm ?? DEFAULT_ALGORITHM
-      const { payload } = await jwtVerify(token, this.secretBytes, {
-        algorithms: [algorithm],
-        issuer: this.config.issuer,
-        audience: this.config.audience,
-      })
-      return payload as JwtClaims
-    } catch {
-      return null
-    }
-  }
-}

package/src/auth/jwt-claims-passthrough.test.ts

@@ -1,87 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/**
- * Sprint 04-pre Part B5 — JWT claims pass-through test.
- *
- * Verifies that `role` and `surname` claims issued in a JWT token are
- * preserved end-to-end through the authMiddleware and available on
- * `context.get('jwtPayload')`. Without the JwtClaims unification these
- * fields would be type-erased and come back undefined.
- */
-
-import { describe, it, expect } from 'vitest'
-import { Hono } from 'hono'
-import { SystemClock } from '@beechcms/core'
-import type { JwtClaims } from '@beechcms/core'
-import { JoseTokenService } from './jose-token-service'
-import { authMiddleware } from '../middleware'
-import type { Env, Variables } from '../types'
-
-const TEST_SECRET = 'super-secret-key-used-only-in-the-vitest-suite-min-length'
-
-describe('JWT claims pass-through (sprint 04-pre)', () => {
-  const tokenService = new JoseTokenService(TEST_SECRET, {}, SystemClock)
-
-  async function buildApp() {
-    const app = new Hono<{ Bindings: Env; Variables: Variables }>()
-
-    app.use('*', async (c, next) => {
-      c.set('tokenService', tokenService)
-      await next()
-    })
-
-    app.use('/protected', authMiddleware())
-
-    app.get('/protected', (c) => {
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    return app
-  }
-
-  it('role and surname claims survive the authMiddleware round-trip', async () => {
-    const app = await buildApp()
-
-    const claims: JwtClaims = {
-      sub: 'user-123',
-      email: 'admin@example.com',
-      name: 'Admin',
-      surname: 'User',
-      role: 'admin',
-    }
-
-    const token = await tokenService.issue(claims)
-
-    const res = await app.request('/protected', {
-      method: 'GET',
-      headers: { Authorization: `Bearer ${token}` },
-    })
-
-    expect(res.status).toBe(200)
-    const body = await res.json<JwtClaims>()
-    expect(body.sub).toBe('user-123')
-    expect(body.role).toBe('admin')
-    expect(body.surname).toBe('User')
-    expect(body.email).toBe('admin@example.com')
-  })
-
-  it('a token without role/surname returns undefined for those fields', async () => {
-    const app = await buildApp()
-
-    const token = await tokenService.issue({ sub: 'user-456', email: 'plain@example.com' })
-
-    const res = await app.request('/protected', {
-      method: 'GET',
-      headers: { Authorization: `Bearer ${token}` },
-    })
-
-    expect(res.status).toBe(200)
-    const body = await res.json<JwtClaims>()
-    expect(body.sub).toBe('user-456')
-    expect(body.role).toBeUndefined()
-    expect(body.surname).toBeUndefined()
-  })
-})

package/src/auth/login.test.ts

@@ -1,100 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect } from 'vitest'
-import { parseLoginBody, validateLoginInput, verifyPassword, DUMMY_PASSWORD_HASH } from './login'
-import { InMemoryHashProvider } from './__fixtures__/in-memory-hash-provider'
-
-describe('parseLoginBody', () => {
-  it('returns credentials for a valid object body', () => {
-    expect(parseLoginBody({ email: 'user@test.com', password: 'pass1234' }))
-      .toEqual({ email: 'user@test.com', password: 'pass1234' })
-  })
-
-  it('trims leading and trailing whitespace from email', () => {
-    expect(parseLoginBody({ email: '  user@test.com  ', password: 'pass' }))
-      .toEqual({ email: 'user@test.com', password: 'pass' })
-  })
-
-  it('returns null for non-object input', () => {
-    expect(parseLoginBody(null)).toBeNull()
-    expect(parseLoginBody('string')).toBeNull()
-    expect(parseLoginBody(42)).toBeNull()
-    expect(parseLoginBody(undefined)).toBeNull()
-  })
-
-  it('returns null when email field is missing', () => {
-    expect(parseLoginBody({ password: 'pass' })).toBeNull()
-  })
-
-  it('returns null when password field is missing', () => {
-    expect(parseLoginBody({ email: 'x@x.com' })).toBeNull()
-  })
-
-  it('returns null when email is an empty string after trimming', () => {
-    expect(parseLoginBody({ email: '   ', password: 'pass' })).toBeNull()
-  })
-
-  it('returns null when email is not a string', () => {
-    expect(parseLoginBody({ email: 42, password: 'pass' })).toBeNull()
-  })
-})
-
-describe('validateLoginInput', () => {
-  it('accepts a valid email and an 8-character password', () => {
-    expect(validateLoginInput('user@test.com', '12345678')).toBe(true)
-  })
-
-  it('rejects an email without an @ sign', () => {
-    expect(validateLoginInput('notanemail', 'password123')).toBe(false)
-  })
-
-  it('rejects an email with nothing before the @', () => {
-    expect(validateLoginInput('@test.com', 'password123')).toBe(false)
-  })
-
-  it('rejects an email with no domain extension', () => {
-    expect(validateLoginInput('user@nodot', 'password123')).toBe(false)
-  })
-
-  it('rejects a password shorter than 8 characters', () => {
-    expect(validateLoginInput('user@test.com', '1234567')).toBe(false)
-  })
-
-  it('rejects a password longer than 128 characters', () => {
-    expect(validateLoginInput('user@test.com', 'a'.repeat(129))).toBe(false)
-  })
-
-  it('accepts passwords at the lower boundary (exactly 8 characters)', () => {
-    expect(validateLoginInput('user@test.com', 'a'.repeat(8))).toBe(true)
-  })
-
-  it('accepts passwords at the upper boundary (exactly 128 characters)', () => {
-    expect(validateLoginInput('user@test.com', 'a'.repeat(128))).toBe(true)
-  })
-
-  it('rejects a password made only of whitespace', () => {
-    expect(validateLoginInput('user@test.com', ' '.repeat(8))).toBe(false)
-  })
-})
-
-describe('verifyPassword', () => {
-  const hashProvider = new InMemoryHashProvider()
-
-  it('returns true when the plaintext matches the stored hash', async () => {
-    const hash = await hashProvider.hash('mypassword')
-    expect(await verifyPassword('mypassword', hash, hashProvider)).toBe(true)
-  })
-
-  it('returns false when the plaintext does not match', async () => {
-    const hash = await hashProvider.hash('correct')
-    expect(await verifyPassword('wrong', hash, hashProvider)).toBe(false)
-  })
-})
-
-describe('DUMMY_PASSWORD_HASH', () => {
-  it('has bcrypt format so constant-time comparison runs even when no user is found', () => {
-    expect(DUMMY_PASSWORD_HASH).toMatch(/^\$2[aby]\$\d+\$/)
-  })
-})

package/src/auth/login.ts

@@ -1,78 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-import type { IHashProvider } from '@beechcms/core'
-
-export type LoginCredentials = {
-  email: string
-  password: string
-}
-
-/** 
- * Regex per validare formato email.
- * Utilizza classi di caratteri che non si sovrappongono per evitare il backtracking catastrofico (ReDoS).
- */
-const EMAIL_REGEX = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/
-/** Lunghezza massima email secondo standard RFC 5321 */
-const MAX_EMAIL_LENGTH = 254
-
-/** Lunghezza minima password (caratteri) */
-const MIN_PASSWORD_LENGTH = 8
-
-/** Lunghezza massima password (caratteri) - limite ragionevole per evitare DoS */
-const MAX_PASSWORD_LENGTH = 128
-
-/**
- * Hash bcrypt dummy valido.
- * Usato quando l'utente non esiste per evitare timing attack
- * (stesso tempo di risposta che con password errata).
- */
-export const DUMMY_PASSWORD_HASH =
-  '$2a$10$SbkRFOafACxVM2ahxerVDu3tSkCXWm29b62WdB.4WGG02Qjsfzni6'
-
-/**
- * Estrae e valida email e password dal body della richiesta.
- * @param body - Body grezzo (tipicamente da req.json())
- * @returns Oggetto {email, password} se valido, null altrimenti
- */
-export function parseLoginBody(body: unknown): LoginCredentials | null {
-  if (body === null || typeof body !== 'object') return null
-  const obj = body as Record<string, unknown>
-  const email = obj.email
-  const password = obj.password
-  if (typeof email !== 'string' || typeof password !== 'string') return null
-  if (!email.trim() || !password) return null
-  return { email: email.trim(), password }
-}
-
-/**
- * Verifica che email e password rispettino i formati richiesti.
- * @param email - Email da validare (deve contenere @ e punto dopo @)
- * @param password - Password (8-128 caratteri)
- * @returns true se valido
- */
-export function validateLoginInput(email: string, password: string): boolean {
-  return (
-    email.length <= MAX_EMAIL_LENGTH &&
-    EMAIL_REGEX.test(email) &&
-    password.trim().length >= MIN_PASSWORD_LENGTH &&
-    password.length <= MAX_PASSWORD_LENGTH
-  )
-}
-
-/**
- * Verifica che la password in chiaro corrisponda all'hash salvato.
- * @param plainPassword - Password in chiaro
- * @param hash - Hash salvato nel DB
- * @param hashProvider - Provider usato per la comparazione costante-time
- * @returns true se la password è corretta
- */
-export async function verifyPassword(
-  plainPassword: string,
-  hash: string,
-  hashProvider: IHashProvider
-): Promise<boolean> {
-  return hashProvider.verify(plainPassword, hash)
-}

package/src/auth/refresh.ts

@@ -1,11 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-/// <reference types="@cloudflare/workers-types" />
-
-export function generateRefreshToken(): string {
-  const bytes = new Uint8Array(32)
-  crypto.getRandomValues(bytes)
-  return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('')
-}

package/src/auth/token-service.test.ts

@@ -1,90 +0,0 @@
-// SPDX-License-Identifier: BUSL-1.1
-// Copyright (c) 2024–2026 Flavio De Musso. All rights reserved.
-// See LICENSE in the repository root for license terms.
-
-import { describe, it, expect } from 'vitest'
-import { SystemClock } from '@beechcms/core'
-import { JoseTokenService } from './jose-token-service'
-import { StaticTokenService } from './__fixtures__/static-token-service'
-
-const TEST_SECRET = 'super-secret-key-used-only-in-the-vitest-suite-min-length'
-
-describe('JoseTokenService', () => {
-  const service = new JoseTokenService(TEST_SECRET, {}, SystemClock)
-
-  it('issue returns a three-part JWT string', async () => {
-    const token = await service.issue({ sub: 'user-1', email: 'a@b.com' })
-    expect(token.split('.')).toHaveLength(3)
-  })
-
-  it('verify returns the original claims for a valid token', async () => {
-    const token = await service.issue({ sub: 'user-1', email: 'a@b.com' })
-    const claims = await service.verify(token)
-    expect(claims?.sub).toBe('user-1')
-    expect(claims?.email).toBe('a@b.com')
-  })
-
-  it('verify returns null for a malformed token', async () => {
-    expect(await service.verify('not.a.valid.jwt')).toBeNull()
-  })
-
-  it('verify returns null for a token signed with a different secret', async () => {
-    const otherService = new JoseTokenService('completely-different-secret-key-xyz', {}, SystemClock)
-    const token = await otherService.issue({ sub: 'user-1' })
-    expect(await service.verify(token)).toBeNull()
-  })
-
-  it('verify returns null for an expired token (ttlSeconds = -1)', async () => {
-    const token = await service.issue({ sub: 'user-1' }, { ttlSeconds: -1 })
-    expect(await service.verify(token)).toBeNull()
-  })
-
-  it('issuer mismatch causes verify to return null', async () => {
-    const issuerA = new JoseTokenService(TEST_SECRET, { issuer: 'issuer-a' }, SystemClock)
-    const issuerB = new JoseTokenService(TEST_SECRET, { issuer: 'issuer-b' }, SystemClock)
-    const token = await issuerA.issue({ sub: 'user-1' })
-    expect(await issuerB.verify(token)).toBeNull()
-  })
-
-  it('custom TTL is respected — token issued with longer TTL verifies successfully', async () => {
-    const token = await service.issue({ sub: 'user-1' }, { ttlSeconds: 3600 })
-    const claims = await service.verify(token)
-    expect(claims?.sub).toBe('user-1')
-  })
-
-  it('throws if the secret is shorter than 32 bytes', () => {
-    expect(() => new JoseTokenService('short-secret', {}, SystemClock)).toThrow('JWT secret must be at least 32 bytes')
-  })
-})
-
-describe('StaticTokenService', () => {
-  it('issue returns "test:" + claims.sub', async () => {
-    const service = new StaticTokenService()
-    expect(await service.issue({ sub: 'abc' })).toBe('test:abc')
-  })
-
-  it('verify returns the stored claims for an issued token', async () => {
-    const service = new StaticTokenService()
-    await service.issue({ sub: 'abc', email: 'x@y.com' })
-    const claims = await service.verify('test:abc')
-    expect(claims?.email).toBe('x@y.com')
-    expect(claims?.sub).toBe('abc')
-  })
-
-  it('verify returns null for an unknown test sub', async () => {
-    const service = new StaticTokenService()
-    expect(await service.verify('test:unknown')).toBeNull()
-  })
-
-  it('verify returns null for a token that does not start with "test:"', async () => {
-    const service = new StaticTokenService()
-    expect(await service.verify('real.jwt.token')).toBeNull()
-  })
-
-  it('each StaticTokenService instance has its own isolated claims store', async () => {
-    const serviceA = new StaticTokenService()
-    const serviceB = new StaticTokenService()
-    await serviceA.issue({ sub: 'user-1' })
-    expect(await serviceB.verify('test:user-1')).toBeNull()
-  })
-})