@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/tests/cases/unit/apiKey/createSessionApiKeyPolicy.test.ts

@@ -0,0 +1,233 @@
+import { expect, test } from 'bun:test'
+import { ApiKeyManager, ApiKeyService, AuthLogService, AuthPolicyResolver, DatabaseContext, Providers } from '../../../../src/index.js'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import PostgresInterval from 'postgres-interval'
+
+const IDENTITY_ID = 'identity-id'
+const NOW = new Date('2026-05-21T12:00:00Z')
+
+const providers: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => NOW,
+	randomBytes: () => Promise.resolve(Buffer.alloc(20)),
+	uuid: () => '00000000-0000-0000-0000-000000000001',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: () => Buffer.alloc(0),
+}
+
+type PolicyRow = {
+	id: string
+	scope: 'global' | 'project'
+	project_id: string | null
+	roles: string[]
+	mfa_required: boolean | null
+	token_expiration: ReturnType<typeof PostgresInterval> | null
+	idle_timeout: ReturnType<typeof PostgresInterval> | null
+	remember_me_allowed: boolean | null
+	created_at: Date
+	updated_at: Date
+}
+
+const configQuery = (overrides: Record<string, unknown> = {}): ExpectedQuery => ({
+	sql: `select *  from "tenant"."config"`,
+	parameters: [],
+	response: {
+		rows: [{
+			id: 'b65949a6-b481-40b5-a0ed-0acdb5a24cb6',
+			passwordless_enabled: 'never',
+			passwordless_url: null,
+			passwordless_expiration: PostgresInterval('00:10:00'),
+			password_min_length: 6,
+			password_require_uppercase: 1,
+			password_require_lowercase: 1,
+			password_require_digit: 1,
+			password_require_special: 0,
+			password_pattern: null,
+			password_check_blacklist: true,
+			password_check_hibp: false,
+			login_base_backoff: PostgresInterval('00:00:01'),
+			login_max_backoff: PostgresInterval('00:01:00'),
+			login_attempt_window: PostgresInterval('00:05:00'),
+			login_reveal_user_exits: true,
+			login_reveal_login_method: true,
+			login_default_token_expiration: PostgresInterval('00:30:00'),
+			login_max_token_expiration: PostgresInterval('12:00:00'),
+			captcha_provider: null,
+			captcha_secret: null,
+			captcha_secret_version: null,
+			captcha_threshold: null,
+			rate_limit_sign_up_per_ip_limit: 0,
+			rate_limit_sign_up_per_ip_window: PostgresInterval('01:00:00'),
+			rate_limit_login_per_ip_limit: 0,
+			rate_limit_login_per_ip_window: PostgresInterval('01:00:00'),
+			rate_limit_password_reset_per_ip_limit: 0,
+			rate_limit_password_reset_per_ip_window: PostgresInterval('01:00:00'),
+			rate_limit_passwordless_init_per_ip_limit: 0,
+			rate_limit_passwordless_init_per_ip_window: PostgresInterval('01:00:00'),
+			...overrides,
+		}],
+	},
+})
+
+const identityQuery = (roles: string[]): ExpectedQuery => ({
+	sql: `select "id", "description", "roles" from "tenant"."identity" where "id" in (?)`,
+	parameters: [IDENTITY_ID],
+	response: { rows: [{ id: IDENTITY_ID, description: null, roles }] },
+})
+
+const authPoliciesQuery = (rows: PolicyRow[] = []): ExpectedQuery => ({
+	sql: `select *  from "tenant"."auth_policy"`,
+	parameters: [],
+	response: { rows },
+})
+
+const projectRolesQuery: ExpectedQuery = {
+	sql: `select "project_id", "role" from "tenant"."project_membership" where "identity_id" = ?`,
+	parameters: [IDENTITY_ID],
+	response: { rows: [] },
+}
+
+const policy = (overrides: Partial<PolicyRow>): PolicyRow => ({
+	id: 'policy-id',
+	scope: 'global',
+	project_id: null,
+	roles: ['editor'],
+	mfa_required: null,
+	token_expiration: null,
+	idle_timeout: null,
+	remember_me_allowed: null,
+	created_at: NOW,
+	updated_at: NOW,
+	...overrides,
+})
+
+// Captures the `type` of the session_policy_applied person_auth_log insert.
+// logSessionEvent passes no personId here, so the InsertBuilder omits the
+// person_id column → columns are id, invoked_by_id, type, success, metadata, event_data.
+const authLogInsert = (capture: { type?: string }): ExpectedQuery => ({
+	sql: `insert into  "tenant"."person_auth_log" ("id", "invoked_by_id", "type", "success", "metadata", "event_data") values  (?, ?, ?, ?, ?, ?)`,
+	parameters: [
+		() => true,
+		() => true,
+		(value: any) => {
+			capture.type = value
+			return true
+		},
+		() => true,
+		() => true,
+		() => true,
+	],
+	response: { rowCount: 1 },
+})
+
+// "non-inert" mirrors ApiKeyManager's guard: any policy field actually set.
+const isPolicyApplied = (policies: PolicyRow[]): boolean =>
+	policies.some(p =>
+		p.mfa_required === true
+		|| p.token_expiration !== null
+		|| p.idle_timeout !== null
+		|| p.remember_me_allowed !== null
+	)
+
+const run = async (args: {
+	expiration?: number
+	policies?: PolicyRow[]
+	roles?: string[]
+}): Promise<{ insertParams: any[]; authLog: { type?: string } }> => {
+	const manager = new ApiKeyManager(new ApiKeyService(), new AuthPolicyResolver(), new AuthLogService())
+	const policies = args.policies ?? []
+	const queries: ExpectedQuery[] = [
+		configQuery(),
+		identityQuery(args.roles ?? ['editor']),
+		authPoliciesQuery(policies),
+	]
+	if (policies.length > 0) {
+		queries.push(projectRolesQuery)
+	}
+	const hasComputedMaxExpiry = (args.policies ?? []).some(p => p.token_expiration !== null)
+	const insertSql = hasComputedMaxExpiry
+		? `INSERT INTO "tenant"."api_key" ("id", "token_hash", "type", "identity_id", "disabled_at", "expires_at", "expiration", "created_at", "created_ip", "created_user_agent", "trust_forwarded_info", "issued_at", "idle_timeout", "max_expires_at") VALUES (?, ?, ?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?, ?, ?, ?, now() + make_interval(secs => ?))`
+		: `INSERT INTO "tenant"."api_key" ("id", "token_hash", "type", "identity_id", "disabled_at", "expires_at", "expiration", "created_at", "created_ip", "created_user_agent", "trust_forwarded_info", "issued_at", "idle_timeout", "max_expires_at") VALUES (?, ?, ?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?, ?, ?, ?, ?)`
+	const insertParams: any[] = new Array(14)
+	queries.push({
+		sql: insertSql,
+		// Each positional matcher records the value and always matches.
+		parameters: Array.from({ length: 14 }, (_, i) => (value: any) => {
+			insertParams[i] = value
+			return true
+		}),
+		response: { rowCount: 1 },
+	})
+	const authLog: { type?: string } = {}
+	if (isPolicyApplied(policies)) {
+		queries.push(authLogInsert(authLog))
+	}
+	const connection = createConnectionMock(queries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const db = new DatabaseContext(client, providers)
+	await manager.createSessionApiKey(db, IDENTITY_ID, args.expiration)
+	return { insertParams, authLog }
+}
+
+// INSERT column order:
+// 0 id, 1 token_hash, 2 type, 3 identity_id, 4 disabled_at, 5 expires_at,
+// 6 expiration, 7 created_at, 8 created_ip, 9 created_user_agent,
+// 10 trust_forwarded_info, 11 issued_at, 12 idle_timeout, 13 max_expires_at
+const EXPIRES_AT = 5
+const EXPIRATION = 6
+const ISSUED_AT = 11
+const IDLE_TIMEOUT = 12
+const MAX_EXPIRES_AT = 13
+
+test('A19: no policy → identical to today (no idle_timeout / max_expires_at, default 30m window)', async () => {
+	const { insertParams: params, authLog } = await run({})
+	expect(params[EXPIRATION]).toBe(30)
+	expect(params[EXPIRES_AT]).toBe(1800)
+	expect(params[IDLE_TIMEOUT]).toBeNull()
+	expect(params[MAX_EXPIRES_AT]).toBeNull()
+	// issued_at is always set for session keys.
+	expect(params[ISSUED_AT]).toEqual(NOW)
+	// No policy in effect → no session_policy_applied audit (no extra insert).
+	expect(authLog.type).toBeUndefined()
+})
+
+test('A19: tokenExpiration policy → max_expires_at set and initial expiry capped to the policy', async () => {
+	// Client asks for 600 min, but policy caps token lifetime to 10 minutes.
+	const { insertParams: params, authLog } = await run({
+		expiration: 600,
+		policies: [policy({ token_expiration: PostgresInterval('00:10:00') })],
+	})
+	expect(params[EXPIRATION]).toBe(10)
+	expect(params[EXPIRES_AT]).toBe(600)
+	expect(params[MAX_EXPIRES_AT]).toBe(600)
+	// Non-inert policy applied → session_policy_applied audit fires.
+	expect(authLog.type).toBe('session_policy_applied')
+})
+
+test('A19: idleTimeout policy → idle_timeout snapshotted onto the key', async () => {
+	const { insertParams: params, authLog } = await run({
+		policies: [policy({ idle_timeout: PostgresInterval('00:15:00') })],
+	})
+	// Serialized via postgres-interval's toPostgres().
+	expect(params[IDLE_TIMEOUT]).toBe('15 minutes')
+	expect(params[MAX_EXPIRES_AT]).toBeNull()
+	expect(authLog.type).toBe('session_policy_applied')
+})
+
+test('A19: rememberMeAllowed=false → client longer expiration is ignored, forced to default', async () => {
+	// Client asks for 600 min, but remember-me is denied → default 30m.
+	const { insertParams: params, authLog } = await run({
+		expiration: 600,
+		policies: [policy({ remember_me_allowed: false })],
+	})
+	expect(params[EXPIRATION]).toBe(30)
+	expect(params[EXPIRES_AT]).toBe(1800)
+	expect(authLog.type).toBe('session_policy_applied')
+})

package/tests/cases/unit/apiKey/prolongApiKeyCommand.test.ts

@@ -0,0 +1,190 @@
+import { expect, test } from 'bun:test'
+import { ApiKey, ApiKeyRequestInfo, ApiKeyTrackingState, DatabaseContext, ProlongApiKeyCommand, Providers } from '../../../../src/index.js'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+
+const baseProviders: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => new Date('2026-05-12T12:00:00Z'),
+	randomBytes: () => Promise.resolve(Buffer.alloc(0)),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: () => Buffer.alloc(0),
+}
+
+const exec = async (args: {
+	now: Date
+	currentExpiration: Date | null
+	requestInfo?: ApiKeyRequestInfo
+	tracking?: ApiKeyTrackingState
+	maxExpiresAt?: Date | null
+	expectedQueries: ExpectedQuery[]
+}) => {
+	const cmd = new ProlongApiKeyCommand(
+		'api-key-id',
+		ApiKey.Type.SESSION,
+		30,
+		args.currentExpiration,
+		args.requestInfo,
+		args.tracking,
+		args.maxExpiresAt,
+	)
+	const connection = createConnectionMock(args.expectedQueries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const providers: Providers = { ...baseProviders, now: () => args.now }
+	const db = new DatabaseContext(client, providers)
+	await db.commandBus.execute(cmd)
+	expect(args.expectedQueries).toHaveLength(0)
+}
+
+test('no-op when no requestInfo and prolongation is throttled', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:29:30Z')
+	await exec({ now, currentExpiration, expectedQueries: [] })
+})
+
+test('updates expires_at when prolongation is significant', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:25:00Z')
+	await exec({
+		now,
+		currentExpiration,
+		expectedQueries: [
+			{
+				sql: `update "tenant"."api_key" set "expires_at" = LEAST(now() + make_interval(secs => ?), "max_expires_at") where "id" = ?`,
+				parameters: [1800, 'api-key-id'],
+				response: { rowCount: 1 },
+			},
+		],
+	})
+})
+
+test('updates last_* on first usage', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:29:30Z')
+	await exec({
+		now,
+		currentExpiration,
+		requestInfo: { ip: '203.0.113.5', userAgent: 'curl' },
+		tracking: { lastIp: null, lastUserAgent: null, lastUsedAt: null },
+		expectedQueries: [
+			{
+				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = now() where "id" = ?`,
+				parameters: ['203.0.113.5', 'curl', 'api-key-id'],
+				response: { rowCount: 1 },
+			},
+		],
+	})
+})
+
+test('throttles last_* within window for same IP+UA', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:29:30Z')
+	await exec({
+		now,
+		currentExpiration,
+		requestInfo: { ip: '203.0.113.5', userAgent: 'curl' },
+		tracking: {
+			lastIp: '203.0.113.5',
+			lastUserAgent: 'curl',
+			lastUsedAt: new Date('2026-05-12T11:59:50Z'),
+		},
+		expectedQueries: [],
+	})
+})
+
+test('throttles last_* within window when IP changes', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:29:30Z')
+	await exec({
+		now,
+		currentExpiration,
+		requestInfo: { ip: '198.51.100.7', userAgent: 'curl' },
+		tracking: {
+			lastIp: '203.0.113.5',
+			lastUserAgent: 'curl',
+			lastUsedAt: new Date('2026-05-12T11:59:50Z'),
+		},
+		expectedQueries: [],
+	})
+})
+
+test('writes changed IP once the window has passed', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:29:30Z')
+	await exec({
+		now,
+		currentExpiration,
+		requestInfo: { ip: '198.51.100.7', userAgent: 'curl' },
+		tracking: {
+			lastIp: '203.0.113.5',
+			lastUserAgent: 'curl',
+			lastUsedAt: new Date('2026-05-12T11:58:59Z'),
+		},
+		expectedQueries: [
+			{
+				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = now() where "id" = ?`,
+				parameters: ['198.51.100.7', 'curl', 'api-key-id'],
+				response: { rowCount: 1 },
+			},
+		],
+	})
+})
+
+test('A19: clamps expires_at at max_expires_at when the sliding window would exceed it', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	// 30-minute window would push expires_at to 12:30, but the absolute cap is 12:10.
+	const currentExpiration = new Date('2026-05-12T12:05:00Z')
+	const maxExpiresAt = new Date('2026-05-12T12:10:00Z')
+	await exec({
+		now,
+		currentExpiration,
+		maxExpiresAt,
+		expectedQueries: [
+			{
+				sql: `update "tenant"."api_key" set "expires_at" = LEAST(now() + make_interval(secs => ?), "max_expires_at") where "id" = ?`,
+				parameters: [1800, 'api-key-id'],
+				response: { rowCount: 1 },
+			},
+		],
+	})
+})
+
+test('A19: unaffected when max_expires_at is null (today behavior)', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:25:00Z')
+	await exec({
+		now,
+		currentExpiration,
+		maxExpiresAt: null,
+		expectedQueries: [
+			{
+				sql: `update "tenant"."api_key" set "expires_at" = LEAST(now() + make_interval(secs => ?), "max_expires_at") where "id" = ?`,
+				parameters: [1800, 'api-key-id'],
+				response: { rowCount: 1 },
+			},
+		],
+	})
+})
+
+test('throttles last_* within window when User-Agent changes', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:29:30Z')
+	await exec({
+		now,
+		currentExpiration,
+		requestInfo: { ip: '203.0.113.5', userAgent: 'browser/2' },
+		tracking: {
+			lastIp: '203.0.113.5',
+			lastUserAgent: 'curl',
+			lastUsedAt: new Date('2026-05-12T11:59:50Z'),
+		},
+		expectedQueries: [],
+	})
+})

package/tests/cases/unit/apiKey/unpersistedApiKeyManager.test.ts

@@ -0,0 +1,136 @@
+import { expect, test } from 'bun:test'
+import {
+	ApiKeyManager,
+	ApiKeyService,
+	AuthLogService,
+	AuthPolicyResolver,
+	computeTokenHash,
+	DatabaseContext,
+	Providers,
+	TenantRole,
+	UNPERSISTED_ROOT_IDENTITY_ID,
+	UnpersistedApiKeyManager,
+} from '../../../../src/index.js'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+
+const baseProviders: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => new Date('2026-05-12T12:00:00Z'),
+	randomBytes: () => Promise.resolve(Buffer.alloc(0)),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	encryptionEnabled: false,
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	hash: () => Buffer.alloc(0),
+}
+
+test('verify returns null when no root tokens are configured', () => {
+	const manager = new UnpersistedApiKeyManager()
+	expect(manager.isEmpty).toBe(true)
+	expect(manager.verify('anything')).toBeNull()
+})
+
+test('verify resolves a configured plain root token to super-admin', () => {
+	const manager = UnpersistedApiKeyManager.createForRootTokens({ tokens: ['my-secret-root-token'] })
+	expect(manager.isEmpty).toBe(false)
+
+	const result = manager.verify('my-secret-root-token')
+	expect(result).not.toBeNull()
+	expect(result!.identityId).toBe(UNPERSISTED_ROOT_IDENTITY_ID)
+	expect(result!.roles).toEqual([TenantRole.SUPER_ADMIN])
+	expect(result!.personId).toBeNull()
+})
+
+test('verify resolves a configured root token hash to super-admin', () => {
+	const tokenHash = computeTokenHash('hashed-root-token')
+	const manager = UnpersistedApiKeyManager.createForRootTokens({ tokenHashes: [tokenHash] })
+
+	const result = manager.verify('hashed-root-token')
+	expect(result).not.toBeNull()
+	expect(result!.identityId).toBe(UNPERSISTED_ROOT_IDENTITY_ID)
+	expect(result!.roles).toEqual([TenantRole.SUPER_ADMIN])
+})
+
+test('verify accepts upper-case token hashes', () => {
+	const tokenHash = computeTokenHash('case-insensitive').toUpperCase()
+	const manager = UnpersistedApiKeyManager.createForRootTokens({ tokenHashes: [tokenHash] })
+	expect(manager.verify('case-insensitive')).not.toBeNull()
+})
+
+test('verify returns null for a non-matching token', () => {
+	const manager = UnpersistedApiKeyManager.createForRootTokens({ tokens: ['correct'] })
+	expect(manager.verify('wrong')).toBeNull()
+})
+
+test('verify resolves every configured token, regardless of position', () => {
+	// Mix of plain tokens and a pre-computed hash; every one must resolve.
+	// This also guards the constant-time loop, which intentionally does not
+	// early-return on the first match.
+	const manager = UnpersistedApiKeyManager.createForRootTokens({
+		tokens: ['first-token', 'second-token'],
+		tokenHashes: [computeTokenHash('third-token')],
+	})
+
+	for (const token of ['first-token', 'second-token', 'third-token']) {
+		const result = manager.verify(token)
+		expect(result).not.toBeNull()
+		expect(result!.identityId).toBe(UNPERSISTED_ROOT_IDENTITY_ID)
+		expect(result!.roles).toEqual([TenantRole.SUPER_ADMIN])
+	}
+	expect(manager.verify('unknown-token')).toBeNull()
+})
+
+test('createForRootTokens rejects malformed token hashes', () => {
+	expect(() => UnpersistedApiKeyManager.createForRootTokens({ tokenHashes: ['not-a-valid-hash'] })).toThrow()
+})
+
+test('createForRootTokens ignores empty entries', () => {
+	const manager = UnpersistedApiKeyManager.createForRootTokens({ tokens: ['', 'real'], tokenHashes: [''] })
+	expect(manager.verify('real')).not.toBeNull()
+	expect(manager.verify('')).toBeNull()
+})
+
+const createDbContext = (expectedQueries: ExpectedQuery[]) => {
+	const connection = createConnectionMock(expectedQueries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	return new DatabaseContext(client, baseProviders)
+}
+
+test('verifyAndProlong short-circuits an unpersisted root token without touching the database', async () => {
+	const unpersisted = UnpersistedApiKeyManager.createForRootTokens({ tokens: ['unpersisted-root'] })
+	const manager = new ApiKeyManager(new ApiKeyService(), new AuthPolicyResolver(), new AuthLogService(), unpersisted)
+
+	// No expected queries: any DB access would throw.
+	const dbContext = createDbContext([])
+	const readDbContext = createDbContext([])
+
+	const response = await manager.verifyAndProlong(dbContext, readDbContext, 'unpersisted-root')
+	expect(response.ok).toBe(true)
+	if (response.ok) {
+		expect(response.result.identityId).toBe(UNPERSISTED_ROOT_IDENTITY_ID)
+		expect(response.result.roles).toEqual([TenantRole.SUPER_ADMIN])
+	}
+})
+
+test('verifyAndProlong falls through to the database for a non-matching token', async () => {
+	const unpersisted = UnpersistedApiKeyManager.createForRootTokens({ tokens: ['unpersisted-root'] })
+	const manager = new ApiKeyManager(new ApiKeyService(), new AuthPolicyResolver(), new AuthLogService(), unpersisted)
+
+	const tokenHash = computeTokenHash('some-db-token')
+	const dbContext = createDbContext([
+		{
+			sql:
+				'select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at", "api_key"."expires_at" is not null and "api_key"."expires_at" <= now() as "is_expired", "api_key"."max_expires_at" is not null and "api_key"."max_expires_at" <= now() as "is_max_expired", "api_key"."idle_timeout" is not null and "api_key"."last_used_at" is not null and "api_key"."last_used_at" < now() - "api_key"."idle_timeout" - make_interval(secs => ?) as "is_idle_expired" from "tenant"."api_key" inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id" left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id" where "token_hash" = ?',
+			parameters: [60, tokenHash],
+			response: { rows: [] },
+		},
+	])
+
+	const response = await manager.verifyAndProlong(dbContext, dbContext, 'some-db-token')
+	expect(response.ok).toBe(false)
+})