@bhooai/nexus-auth 0.1.0

package/tests/auth.test.ts

@@ -0,0 +1,230 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { Router, NexusServer, bodyParser } from '@bhooai/nexus-core/http';
+import { request } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import {
+  hashPassword,
+  verifyPassword,
+  signAccessToken,
+  verifyToken,
+  MemorySessionStore,
+  AuthService,
+  RoleRegistry,
+  requireAuth,
+  requireRole,
+  requirePermission,
+  authToken,
+  setAuthCookies,
+  buildGoogleAuthUrl,
+  buildFacebookAuthUrl,
+  computePkceChallenge,
+  generatePkceVerifier,
+  MemoryOAuthStateStore,
+  type GoogleOAuthConfig,
+  type FacebookOAuthConfig,
+} from '../src/index.js';
+
+const JWT = { secret: 'test-secret-key-very-long-for-hs256-testing', issuer: 'nexus-test', accessTtl: 60, refreshTtl: 3600 };
+
+function call(port: number, opts: { method?: string; path?: string; headers?: Record<string, string>; body?: string } = {}): Promise<{ status: number; body: string; headers: Record<string, string | string[] | undefined> }> {
+  return new Promise((resolve, reject) => {
+    const req = request(
+      { hostname: '127.0.0.1', port, path: opts.path ?? '/', method: opts.method ?? 'GET', headers: opts.headers },
+      (res) => {
+        let body = '';
+        res.on('data', (c) => (body += c));
+        res.on('end', () => resolve({ status: res.statusCode ?? 0, body, headers: res.headers }));
+      },
+    );
+    req.on('error', reject);
+    if (opts.body) req.write(opts.body);
+    req.end();
+  });
+}
+
+describe('auth: passwords', () => {
+  it('hashes and verifies a password', async () => {
+    const hash = await hashPassword('hunter2');
+    expect(hash).not.toBe('hunter2');
+    expect(await verifyPassword('hunter2', hash)).toBe(true);
+    expect(await verifyPassword('wrong', hash)).toBe(false);
+  });
+});
+
+describe('auth: jwt', () => {
+  it('signs and verifies an access token with roles', async () => {
+    const token = await signAccessToken('user-1', ['admin'], JWT);
+    const payload = await verifyToken(token, JWT);
+    expect(payload.sub).toBe('user-1');
+    expect(payload.roles).toEqual(['admin']);
+    expect(payload.kind).toBe('access');
+  });
+
+  it('rejects a token signed with a different secret', async () => {
+    const token = await signAccessToken('user-1', [], JWT);
+    await expect(verifyToken(token, { ...JWT, secret: 'other-secret-also-long-enough-for-hs' })).rejects.toThrow();
+  });
+});
+
+describe('auth: session store', () => {
+  it('creates, retrieves, and destroys sessions', async () => {
+    const store = new MemorySessionStore();
+    const s = await store.create('u1', ['user']);
+    expect(await store.get(s.id)).not.toBeNull();
+    await store.destroy(s.id);
+    expect(await store.get(s.id)).toBeNull();
+  });
+
+  it('destroyAllForUser removes every session for that user', async () => {
+    const store = new MemorySessionStore();
+    const a = await store.create('u1', ['user']);
+    const b = await store.create('u1', ['user']);
+    await store.destroyAllForUser('u1');
+    expect(await store.get(a.id)).toBeNull();
+    expect(await store.get(b.id)).toBeNull();
+  });
+});
+
+describe('auth: AuthService login / refresh / reuse detection', () => {
+  it('issues a token pair on login and refreshes with rotation', async () => {
+    const service = new AuthService(JWT, new MemorySessionStore());
+    const pair = await service.login({ userId: 'u1', roles: ['user'] });
+    expect(pair.accessToken).toBeTruthy();
+    expect(pair.refreshToken).toBeTruthy();
+    expect(pair.sessionId).toBeTruthy();
+
+    const refreshed = await service.refresh(pair.refreshToken);
+    expect(refreshed.refreshToken).not.toBe(pair.refreshToken); // rotated
+
+    // The old refresh token is now invalid (jti mismatch → reuse → family revoked)
+    await expect(service.refresh(pair.refreshToken)).rejects.toThrow(/reuse|expired|Session/);
+  });
+
+  it('verifyAccessToken accepts the access token', async () => {
+    const service = new AuthService(JWT, new MemorySessionStore());
+    const pair = await service.login({ userId: 'u1', roles: ['user'] });
+    const payload = await service.verifyAccessToken(pair.accessToken);
+    expect(payload.sub).toBe('u1');
+  });
+
+  it('logout ends the session so refresh fails', async () => {
+    const service = new AuthService(JWT, new MemorySessionStore());
+    const pair = await service.login({ userId: 'u1', roles: ['user'] });
+    await service.logout(pair.sessionId);
+    await expect(service.refresh(pair.refreshToken)).rejects.toThrow();
+  });
+});
+
+describe('auth: RBAC', () => {
+  it('resolves inherited permissions and powers requirePermission middleware', async () => {
+    const registry = new RoleRegistry().defineAll({
+      viewer: { permissions: ['read:posts'] },
+      editor: { permissions: ['write:posts'], inherits: ['viewer'] },
+      admin: { permissions: ['delete:posts'], inherits: ['editor'] },
+    });
+    expect(registry.can('editor', 'read:posts')).toBe(true);
+    expect(registry.can('editor', 'delete:posts')).toBe(false);
+    expect(registry.can('admin', 'delete:posts')).toBe(true);
+    expect(registry.canAny(['editor'], 'write:posts')).toBe(true);
+  });
+});
+
+describe('auth: authToken + requireRole middleware (live server)', () => {
+  let server: NexusServer;
+  let port: number;
+  let service: AuthService;
+  afterEach(async () => server && (await server.close()));
+
+  async function boot(roles: string[]) {
+    service = new AuthService(JWT, new MemorySessionStore());
+    const registry = new RoleRegistry().define('admin', { permissions: ['billing:read'] });
+    const router = new Router();
+    router.get('/me', (ctx) => ctx.json({ id: (ctx.state.user as { id: string }).id }), [authToken(service), requireAuth()]);
+    router.get('/admin', (ctx) => ctx.json({ ok: true }), [authToken(service), requireRole('admin')]);
+    router.get('/perm', (ctx) => ctx.json({ ok: true }), [authToken(service), requirePermission(registry, 'billing:read')]);
+    server = new NexusServer({ router, middleware: [bodyParser()] });
+    await server.listen(0, '127.0.0.1');
+    port = (server.address as AddressInfo).port;
+    return service.login({ userId: 'u1', roles });
+  }
+
+  it('sets ctx.state.user from a bearer token and allows requireAuth', async () => {
+    const pair = await boot(['user']);
+    const res = await call(port, { path: '/me', headers: { authorization: `Bearer ${pair.accessToken}` } });
+    expect(res.status).toBe(200);
+    expect(JSON.parse(res.body).id).toBe('u1');
+  });
+
+  it('rejects requests with no token (401)', async () => {
+    await boot(['user']);
+    const res = await call(port, { path: '/me' });
+    expect(res.status).toBe(401);
+  });
+
+  it('requireRole allows admins and forbids plain users (403)', async () => {
+    const adminPair = await boot(['admin']);
+    const ok = await call(port, { path: '/admin', headers: { authorization: `Bearer ${adminPair.accessToken}` } });
+    expect(ok.status).toBe(200);
+
+    const userPair = await service.login({ userId: 'u2', roles: ['user'] });
+    const forbidden = await call(port, { path: '/admin', headers: { authorization: `Bearer ${userPair.accessToken}` } });
+    expect(forbidden.status).toBe(403);
+  });
+
+  it('requirePermission checks the registry', async () => {
+    const adminPair = await boot(['admin']);
+    const ok = await call(port, { path: '/perm', headers: { authorization: `Bearer ${adminPair.accessToken}` } });
+    expect(ok.status).toBe(200);
+  });
+});
+
+describe('auth: OAuth helpers (no network)', () => {
+  let server: NexusServer;
+  let port: number;
+  afterEach(async () => server && (await server.close()));
+
+  const google: GoogleOAuthConfig = { clientId: 'g-id', clientSecret: 'g-secret', redirectUri: 'https://app.test/cb' };
+  const facebook: FacebookOAuthConfig = { clientId: 'fb-id', clientSecret: 'fb-secret', redirectUri: 'https://app.test/cb' };
+
+  it('builds a Google auth URL with PKCE challenge and state', () => {
+    const verifier = generatePkceVerifier();
+    const url = buildGoogleAuthUrl(google, { state: 'st', verifier });
+    expect(url).toContain('https://accounts.google.com/o/oauth2/v2/auth');
+    expect(url).toContain('code_challenge_method=S256');
+    expect(url).toContain('state=st');
+    expect(url).toContain(`code_challenge=${computePkceChallenge(verifier)}`);
+  });
+
+  it('builds a Facebook auth URL with state and scope', () => {
+    const url = buildFacebookAuthUrl(facebook, 'st');
+    expect(url).toContain('facebook.com/v19.0/dialog/oauth');
+    expect(url).toContain('state=st');
+    expect(url).toContain('client_id=fb-id');
+  });
+
+  it('state store consumes a value exactly once and rejects expired/unknown', async () => {
+    const store = new MemoryOAuthStateStore();
+    await store.set('s1', { verifier: 'v' }, 1000);
+    expect((await store.consume('s1'))?.verifier).toBe('v');
+    expect(await store.consume('s1')).toBeNull(); // single-use
+    expect(await store.consume('unknown')).toBeNull();
+  });
+
+  it('setAuthCookies writes two httpOnly cookies', async () => {
+    const service = new AuthService(JWT, new MemorySessionStore());
+    const pair = await service.login({ userId: 'u1', roles: ['user'] });
+    const router = new Router();
+    router.get('/c', (ctx) => setAuthCookies(ctx, pair));
+    server = new NexusServer({ router });
+    await server.listen(0, '127.0.0.1');
+    port = (server.address as AddressInfo).port;
+    const res = await call(port, { path: '/c' });
+    const setCookie = res.headers['set-cookie'] as string[] | undefined;
+    expect(setCookie).toBeDefined();
+    expect(setCookie!.some((c) => c.startsWith('nexus_at='))).toBe(true);
+    expect(setCookie!.some((c) => c.startsWith('nexus_rt='))).toBe(true);
+    expect(setCookie!.every((c) => c.includes('HttpOnly'))).toBe(true);
+    await server.close();
+    server = undefined as unknown as NexusServer;
+  });
+});

package/tests/security.test.ts

@@ -0,0 +1,133 @@
+import { describe, it, expect, afterEach } from 'vitest';
+import { Router, NexusServer, bodyParser } from '@bhooai/nexus-core/http';
+import { cors, csrf, securityHeaders, rateLimit } from '../src/index.js';
+import { request } from 'node:http';
+import type { AddressInfo } from 'node:net';
+
+function call(port: number, opts: { method?: string; path?: string; headers?: Record<string, string>; body?: string } = {}): Promise<{ status: number; body: string; headers: Record<string, string | string[] | undefined> }> {
+  return new Promise((resolve, reject) => {
+    const req = request(
+      { hostname: '127.0.0.1', port, path: opts.path ?? '/', method: opts.method ?? 'GET', headers: opts.headers },
+      (res) => {
+        let body = '';
+        res.on('data', (c) => (body += c));
+        res.on('end', () => resolve({ status: res.statusCode ?? 0, body, headers: res.headers }));
+      },
+    );
+    req.on('error', reject);
+    if (opts.body) req.write(opts.body);
+    req.end();
+  });
+}
+
+function extractCookie(setCookie: string | string[] | undefined, name: string): string | undefined {
+  const header = Array.isArray(setCookie) ? setCookie[0] : setCookie;
+  if (!header) return undefined;
+  const match = new RegExp(`${name}=([^;]+)`).exec(header);
+  return match?.[1];
+}
+
+describe('security: CORS', () => {
+  let server: NexusServer;
+  let port: number;
+  afterEach(async () => server && (await server.close()));
+
+  it('reflects origin and handles preflight with credentials', async () => {
+    const router = new Router();
+    router.get('/x', (ctx) => ctx.json({ ok: true }));
+    server = new NexusServer({
+      router,
+      middleware: [cors({ origin: ['http://app.test'], credentials: true })],
+    });
+    await server.listen(0, '127.0.0.1');
+    port = (server.address as AddressInfo).port;
+
+    const preflight = await call(port, {
+      method: 'OPTIONS',
+      path: '/x',
+      headers: { origin: 'http://app.test', 'access-control-request-method': 'GET' },
+    });
+    expect(preflight.status).toBe(204);
+    expect(preflight.headers['access-control-allow-origin']).toBe('http://app.test');
+    expect(preflight.headers['access-control-allow-credentials']).toBe('true');
+    expect(String(preflight.headers['vary'])).toContain('Origin');
+
+    const blocked = await call(port, { method: 'OPTIONS', path: '/x', headers: { origin: 'http://evil.test', 'access-control-request-method': 'GET' } });
+    expect(blocked.headers['access-control-allow-origin']).toBeUndefined();
+  });
+});
+
+describe('security: CSRF', () => {
+  let server: NexusServer;
+  let port: number;
+  afterEach(async () => server && (await server.close()));
+
+  it('blocks unsafe requests without a matching token and allows them with one', async () => {
+    const router = new Router();
+    router.get('/csrf', (ctx) => ctx.json({ token: ctx.state.csrfToken }));
+    router.post('/unsafe', (ctx) => ctx.json({ done: true }));
+    server = new NexusServer({ router, middleware: [bodyParser(), csrf()] });
+    await server.listen(0, '127.0.0.1');
+    port = (server.address as AddressInfo).port;
+
+    // 1. get a token (and its cookie)
+    const tokenRes = await call(port, { path: '/csrf' });
+    const token = JSON.parse(tokenRes.body).token;
+    const cookie = extractCookie(tokenRes.headers['set-cookie'], 'nexus_csrf');
+    expect(token).toBeDefined();
+    expect(cookie).toBe(token);
+
+    // 2. POST without token -> 401
+    const blocked = await call(port, { method: 'POST', path: '/unsafe', headers: { 'content-type': 'application/json' }, body: '{}' });
+    expect(blocked.status).toBe(401);
+
+    // 3. POST with matching token + cookie -> 200
+    const allowed = await call(port, {
+      method: 'POST',
+      path: '/unsafe',
+      headers: { 'content-type': 'application/json', cookie: `nexus_csrf=${cookie}`, 'x-csrf-token': token },
+      body: '{}',
+    });
+    expect(allowed.status).toBe(200);
+    expect(JSON.parse(allowed.body)).toEqual({ done: true });
+  });
+});
+
+describe('security: headers', () => {
+  let server: NexusServer;
+  let port: number;
+  afterEach(async () => server && (await server.close()));
+
+  it('applies helmet-equivalent headers', async () => {
+    const router = new Router();
+    router.get('/', (ctx) => ctx.text('ok'));
+    server = new NexusServer({ router, middleware: [securityHeaders()] });
+    await server.listen(0, '127.0.0.1');
+    port = (server.address as AddressInfo).port;
+    const res = await call(port, { path: '/' });
+    expect(res.headers['x-content-type-options']).toBe('nosniff');
+    expect(res.headers['x-frame-options']).toBe('SAMEORIGIN');
+    expect(String(res.headers['content-security-policy'])).toContain("default-src 'self'");
+  });
+});
+
+describe('security: rateLimit', () => {
+  let server: NexusServer;
+  let port: number;
+  afterEach(async () => server && (await server.close()));
+
+  it('limits requests beyond max within the window', async () => {
+    const router = new Router();
+    router.get('/limited', (ctx) => ctx.text('ok'));
+    server = new NexusServer({ router, middleware: [rateLimit({ windowMs: 10_000, max: 2, keyGenerator: () => 'k' })] });
+    await server.listen(0, '127.0.0.1');
+    port = (server.address as AddressInfo).port;
+    const a = await call(port, { path: '/limited' });
+    const b = await call(port, { path: '/limited' });
+    const c = await call(port, { path: '/limited' });
+    expect(a.status).toBe(200);
+    expect(b.status).toBe(200);
+    expect(c.status).toBe(401);
+    expect(Number(c.headers['rate-limit-remaining'])).toBe(0);
+  });
+});

package/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./dist"
+  },
+  "include": ["src/**/*"],
+  "references": [{ "path": "../nexus-core" }]
+}

package/vitest.config.ts

@@ -0,0 +1,9 @@
+import { defineProject } from 'vitest/config';
+
+export default defineProject({
+  test: {
+    environment: 'node',
+    include: ['tests/**/*.test.ts'],
+    globals: false,
+  },
+});