@dax-crafta/auth 2.1.6 → 2.1.8

package/src/utils/mfa.js

@@ -2,30 +2,39 @@
 const speakeasy = require('speakeasy');
 const qrcode = require('qrcode');
 const crypto = require('crypto');
+const ApiError = require('./api-error');
 
 class MFAService {
   async generateSecret(label, issuer = 'App') {
-    const secret = speakeasy.generateSecret({
-      length: 32,
-      name: label,
-      issuer
-    });
-
-    const qrCodeUrl = await qrcode.toDataURL(secret.otpauth_url);
-
-    return {
-      secret: secret.base32,
-      qrCode: qrCodeUrl
-    };
+    try {
+      const secret = speakeasy.generateSecret({
+        length: 32,
+        name: label,
+        issuer
+      });
+
+      const qrCodeUrl = await qrcode.toDataURL(secret.otpauth_url);
+
+      return {
+        secret: secret.base32,
+        qrCode: qrCodeUrl
+      };
+    } catch (err) {
+      throw ApiError.internal('Failed to generate MFA secret');
+    }
   }
 
   verifyToken(token, secret) {
-    return speakeasy.totp.verify({
-      secret,
-      encoding: 'base32',
-      token,
-      window: 1
-    });
+    try {
+      return speakeasy.totp.verify({
+        secret,
+        encoding: 'base32',
+        token,
+        window: 1
+      });
+    } catch (err) {
+      return false;
+    }
   }
 
   // Generate hashed backup codes (safer)

package/src/utils/password-policy.js

@@ -1,5 +1,6 @@
 // packages/auth/src/utils/password-policy.js
 const zxcvbn = require('zxcvbn');
+const { getPasswordStrength } = require('./password-strength');
 
 class PasswordPolicy {
   constructor(config = {}) {
@@ -37,10 +38,14 @@ class PasswordPolicy {
     if (strength.score < this.config.minStrength)
       errors.push('Password is too weak. Please choose a stronger password');
 
+    // Lightweight heuristic strength score (0-4), complementing zxcvbn
+    const heuristicScore = getPasswordStrength(password);
+
     return {
       isValid: errors.length === 0,
       errors,
-      strength: strength.score
+      strength: strength.score,
+      strengthScore: heuristicScore
     };
   }
 

package/src/utils/password-strength.js

@@ -0,0 +1,68 @@
+// packages/auth/src/utils/password-strength.js
+/**
+ * Password strength scoring utility.
+ *
+ * Returns a strength score from 0 (very weak) to 4 (very strong) based on
+ * length, character variety, and common-pattern detection.
+ *
+ * This complements the zxcvbn-based strength check inside PasswordPolicy,
+ * providing a lightweight, dependency-free heuristic for quick feedback.
+ */
+const COMMON_PASSWORDS = [
+  'password', '123456', '12345678', '123456789', 'qwerty', 'abc123',
+  '111111', '123123', 'admin', 'letmein', 'welcome', 'monkey',
+  'football', 'iloveyou', 'sunshine', 'princess', 'dragon', 'baseball'
+];
+
+const COMMON_SEQUENCES = [
+  'abcdefghijklmnopqrstuvwxyz',
+  '0123456789',
+  'qwertyuiop',
+  'asdfghjkl',
+  'zxcvbnm'
+];
+
+function hasCommonSequence(password, length) {
+  const lower = password.toLowerCase();
+  for (const seq of COMMON_SEQUENCES) {
+    for (let i = 0; i + length <= seq.length; i++) {
+      if (lower.includes(seq.slice(i, i + length))) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Calculate a strength score (0-4) for a password.
+ *
+ * @param {string} password - The password to evaluate.
+ * @returns {number} Score from 0 (very weak) to 4 (very strong).
+ */
+function getPasswordStrength(password) {
+  if (!password || typeof password !== 'string') return 0;
+
+  const lower = password.toLowerCase();
+  const hasLower = /[a-z]/.test(password);
+  const hasUpper = /[A-Z]/.test(password);
+  const hasNumber = /\d/.test(password);
+  const hasSpecial = /[^a-zA-Z0-9]/.test(password);
+
+  let score = 0;
+
+  // Length scoring
+  if (password.length >= 8) score++;
+  if (password.length >= 12) score++;
+
+  // Complexity scoring
+  const varietyCount = [hasLower, hasUpper, hasNumber, hasSpecial].filter(Boolean).length;
+  if (varietyCount >= 3) score++;
+
+  // Penalize common patterns
+  if (COMMON_PASSWORDS.includes(lower)) return 0;
+  if (hasCommonSequence(password, 3)) score--;
+  if (/(.)\1{2,}/.test(password)) score--; // repeated chars like "aaa"
+
+  return Math.max(0, Math.min(4, score));
+}
+
+module.exports = { getPasswordStrength };

package/test/01-register-login.test.js

@@ -0,0 +1,134 @@
+/**
+ * 01 — Register, login, refresh, logout, profile
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('01-register-login', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+  });
+  after(async () => { await stopApp(); });
+
+  it('register creates a user', async () => {
+    const res = await req('POST', '/register', {
+      name: 'Test User',
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    assert.strictEqual(res.status, 201, `expected 201, got ${res.status} ${JSON.stringify(res.body)}`);
+    assert.strictEqual(res.body.success, true);
+    assert.strictEqual(res.body.message, 'Registration successful');
+  });
+
+  it('register rejects duplicate email', async () => {
+    const res = await req('POST', '/register', {
+      name: 'Dup User',
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    assert.strictEqual(res.status, 409, `expected 409, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_CONFLICT');
+  });
+
+  it('register rejects weak password', async () => {
+    const res = await req('POST', '/register', {
+      name: 'Weak User',
+      email: 'weak@example.com',
+      password: 'abc',
+    });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+    assert.ok(res.body.error || res.body.code, 'should have error message');
+  });
+
+  it('login succeeds with valid creds', async () => {
+    const res = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status}`);
+    assert.ok(res.body.accessToken);
+    assert.ok(res.body.refreshToken);
+  });
+
+  it('login rejects wrong password', async () => {
+    const res = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Wrong@Pass1',
+    });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_INVALID_CREDENTIALS');
+  });
+
+  it('login rejects unknown email', async () => {
+    const res = await req('POST', '/login', {
+      email: 'nobody@example.com',
+      password: 'Strong@Pass1',
+    });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_INVALID_CREDENTIALS');
+  });
+
+  it('refresh token rotates and old token is invalidated', async () => {
+    const login = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    const oldRefresh = login.body.refreshToken;
+
+    const refresh = await req('POST', '/refresh-token', { refreshToken: oldRefresh });
+    assert.strictEqual(refresh.status, 200, `expected 200, got ${refresh.status}`);
+    assert.ok(refresh.body.accessToken);
+    assert.notStrictEqual(refresh.body.refreshToken, oldRefresh, 'refresh token should rotate');
+
+    // Old token must be rejected
+    const reuse = await req('POST', '/refresh-token', { refreshToken: oldRefresh });
+    assert.strictEqual(reuse.status, 401, `old refresh token should be rejected, got ${reuse.status}`);
+    assert.strictEqual(reuse.body.code, 'AUTH_INVALID_TOKEN');
+  });
+
+  it('protected profile returns user data with valid token', async () => {
+    const login = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    const res = await req('PUT', '/profile', { name: 'Test User Updated' }, {
+      Authorization: `Bearer ${login.body.accessToken}`,
+    });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status} ${JSON.stringify(res.body)}`);
+    assert.strictEqual(res.body.user.email, 'alice@example.com');
+  });
+
+  it('protected route rejects missing token', async () => {
+    const res = await req('PUT', '/profile', { name: 'X' });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_UNAUTHORIZED');
+  });
+
+  it('protected route rejects invalid token', async () => {
+    const res = await req('PUT', '/profile', { name: 'X' }, {
+      Authorization: 'Bearer not-a-real-token',
+    });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_INVALID_TOKEN');
+  });
+
+  it('logout revokes refresh token', async () => {
+    const login = await req('POST', '/login', {
+      email: 'alice@example.com',
+      password: 'Strong@Pass1',
+    });
+    const logout = await req('POST', '/logout', { refreshToken: login.body.refreshToken }, {
+      Authorization: `Bearer ${login.body.accessToken}`,
+    });
+    assert.strictEqual(logout.status, 200, `expected 200, got ${logout.status} ${JSON.stringify(logout.body)}`);
+
+    // Refresh token should now be dead
+    const after = await req('POST', '/refresh-token', { refreshToken: login.body.refreshToken });
+    assert.strictEqual(after.status, 401, `expected 401 after logout, got ${after.status}`);
+  });
+});

package/test/02-password-reset.test.js

@@ -0,0 +1,50 @@
+/**
+ * 02 — Password reset flow + forgot password
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('02-password-reset', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+    await req('POST', '/register', {
+      name: 'Bob Reset',
+      email: 'bob@example.com',
+      password: 'Strong@Pass1',
+    });
+  });
+  after(async () => { await stopApp(); });
+
+  it('forgot-password returns 200 even for unknown email', async () => {
+    const res = await req('POST', '/forgot-password', { email: 'ghost@example.com' });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status}`);
+    assert.strictEqual(res.body.success, true);
+  });
+
+  it('reset-password rejects invalid token', async () => {
+    const res = await req('POST', '/reset-password', {
+      token: 'invalid-token',
+      newPassword: 'New@Pass1',
+    });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+    assert.ok(res.body.code, 'should have error code');
+  });
+
+  it('reset-password rejects weak new password', async () => {
+    const res = await req('POST', '/reset-password', {
+      token: 'some-token',
+      newPassword: 'weak',
+    });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+    assert.ok(res.body.error || res.body.code, 'should have error message');
+  });
+
+  it('reset-password rejects missing token', async () => {
+    const res = await req('POST', '/reset-password', { newPassword: 'New@Pass1' });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+  });
+});

package/test/03-2fa.test.js

@@ -0,0 +1,54 @@
+/**
+ * 03 — 2FA / MFA flow
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const mongoose = require('mongoose');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('03-2fa', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+    // Register user
+    await req('POST', '/register', {
+      name: 'Two FA User',
+      email: 'two@example.com',
+      password: 'Strong@Pass1',
+    });
+    // Enable 2FA directly by setting twoFactorSecret and twoFactorEnabled
+    require('../src/models/user');
+    const User = mongoose.model('User');
+    const crypto = require('crypto');
+    const secret = crypto.randomBytes(20).toString('hex');
+    await User.findOneAndUpdate(
+      { email: 'two@example.com' },
+      { twoFactorSecret: secret, twoFactorEnabled: true }
+    );
+  });
+  after(async () => { await stopApp(); });
+
+  it('2fa verify rejects missing code', async () => {
+    require('../src/models/user');
+    const User = mongoose.model('User');
+    const user = await User.findOne({ email: 'two@example.com' });
+    const res = await req('POST', '/2fa', { userId: user._id });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+  });
+
+  it('2fa verify rejects unknown user', async () => {
+    const res = await req('POST', '/2fa', { userId: '000000000000000000000000', code: '123456' });
+    assert.strictEqual(res.status, 404, `expected 404, got ${res.status}`);
+  });
+
+  it('2fa verify rejects invalid code', async () => {
+    require('../src/models/user');
+    const User = mongoose.model('User');
+    const user = await User.findOne({ email: 'two@example.com' });
+    const res = await req('POST', '/2fa', { userId: user._id, code: '000000' });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_2FA_FAILED');
+  });
+});

package/test/04-rbac.test.js

@@ -0,0 +1,51 @@
+/**
+ * 04 — RBAC: roles + permissions
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const mongoose = require('mongoose');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('04-rbac', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+    await req('POST', '/register', {
+      name: 'Admin User',
+      email: 'admin@example.com',
+      password: 'Strong@Pass1',
+    });
+    require('../src/models/user');
+    const User = mongoose.model('User');
+    await User.findOneAndUpdate({ email: 'admin@example.com' }, { role: 'admin' });
+  });
+  after(async () => { await stopApp(); });
+
+  it('create role succeeds as admin', async () => {
+    const login = await req('POST', '/login', {
+      email: 'admin@example.com',
+      password: 'Strong@Pass1',
+    });
+    const res = await req('POST', '/roles', {
+      name: 'editor',
+      permissions: [{ resource: 'posts', actions: ['create', 'read'] }],
+    }, { Authorization: `Bearer ${login.body.accessToken}` });
+    assert.strictEqual(res.status, 201, `expected 201, got ${res.status} ${JSON.stringify(res.body)}`);
+    assert.strictEqual(res.body.role.name, 'editor');
+  });
+
+  it('reject duplicate role name', async () => {
+    const login = await req('POST', '/login', {
+      email: 'admin@example.com',
+      password: 'Strong@Pass1',
+    });
+    const res = await req('POST', '/roles', {
+      name: 'editor',
+      permissions: [],
+    }, { Authorization: `Bearer ${login.body.accessToken}` });
+    assert.strictEqual(res.status, 409, `expected 409, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_CONFLICT');
+  });
+});

package/test/05-audit-webhook.test.js

@@ -0,0 +1,78 @@
+/**
+ * 05 — Audit logging + webhooks
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const http = require('http');
+const mongoose = require('mongoose');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+let webhookServer;
+let receivedWebhooks = [];
+
+describe('05-audit-webhook', () => {
+  before(async () => {
+    webhookServer = http.createServer((req, res) => {
+      let body = '';
+      req.on('data', (c) => (body += c));
+      req.on('end', () => {
+        try {
+          receivedWebhooks.push({
+            event: req.headers['x-crafta-event'],
+            signature: req.headers['x-crafta-signature'],
+            body: JSON.parse(body),
+          });
+        } catch {}
+        res.writeHead(200);
+        res.end('ok');
+      });
+    });
+    await new Promise((r) => webhookServer.listen(0, r));
+    const port = webhookServer.address().port;
+
+    const app = buildApp({
+      webhooks: {
+        url: `http://127.0.0.1:${port}`,
+        secret: 'test-secret',
+        events: ['user.registered', 'user.login', 'user.logout'],
+      },
+      features: { auditLogs: true, webhooks: true },
+    });
+    server = await startApp();
+
+    await req('POST', '/register', {
+      name: 'Audit User',
+      email: 'audit@example.com',
+      password: 'Strong@Pass1',
+    });
+  });
+  after(async () => {
+    await stopApp();
+    await new Promise((r) => webhookServer.close(r));
+  });
+
+  it('webhook fires on register with HMAC signature', async () => {
+    const found = receivedWebhooks.find((w) => w.event === 'user.registered');
+    assert.ok(found, `register webhook should fire. Got: ${JSON.stringify(receivedWebhooks)}`);
+    assert.ok(found.signature, 'webhook should be signed');
+    assert.strictEqual(found.body.data.email, 'audit@example.com');
+  });
+
+  it('audit log is written to MongoDB', async () => {
+    require('../src/models/audit-log');
+    const AuditLog = mongoose.model('AuditLog');
+    const count = await AuditLog.countDocuments({ action: 'register' });
+    assert.ok(count > 0, 'audit log entry for register should exist');
+  });
+
+  it('audit log has required enum actions', async () => {
+    require('../src/models/audit-log');
+    const AuditLog = mongoose.model('AuditLog');
+    const actions = AuditLog.schema.path('action').enumValues;
+    const required = ['login', 'logout', 'register', 'email_verify', '2fa_verify', 'refresh_token', 'social_login', 'backup_codes_generated', 'account_locked', 'password_reset', 'password_change', 'profile_update', 'role_change', '2fa_enabled', '2fa_disabled', 'password_reset_request'];
+    for (const a of required) {
+      assert.ok(actions.includes(a), `missing audit action: ${a}`);
+    }
+  });
+});

package/test/06-sessions.test.js

@@ -0,0 +1,36 @@
+/**
+ * 06 — Session management
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('06-sessions', () => {
+  before(async () => {
+    const app = buildApp({ session: { maxSessions: 3, sessionExpiryMs: 30 * 24 * 60 * 60 * 1000 } });
+    server = await startApp();
+    await req('POST', '/register', {
+      name: 'Session User',
+      email: 'session@example.com',
+      password: 'Strong@Pass1',
+    });
+  });
+  after(async () => { await stopApp(); });
+
+  it('logout-all invalidates all sessions', async () => {
+    const l1 = await req('POST', '/login', { email: 'session@example.com', password: 'Strong@Pass1' });
+    const l2 = await req('POST', '/login', { email: 'session@example.com', password: 'Strong@Pass1' });
+
+    const res = await req('POST', '/logout-all', {}, {
+      Authorization: `Bearer ${l1.body.accessToken}`,
+    });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status} ${JSON.stringify(res.body)}`);
+
+    const p1 = await req('PUT', '/profile', { name: 'X' }, { Authorization: `Bearer ${l1.body.accessToken}` });
+    const p2 = await req('PUT', '/profile', { name: 'X' }, { Authorization: `Bearer ${l2.body.accessToken}` });
+    assert.strictEqual(p1.status, 401, 'session 1 token should be dead');
+    assert.strictEqual(p2.status, 401, 'session 2 token should be dead');
+  });
+});

package/test/07-error-normalization.test.js

@@ -0,0 +1,64 @@
+/**
+ * 07 — Error normalization + standardized error codes
+ */
+const { describe, it } = require('./tiny-test');
+const assert = require('assert');
+const ApiError = require('../src/utils/api-error');
+
+describe('07-error-normalization', () => {
+  it('has all 19 factory methods', () => {
+    const methods = [
+      'unauthorized', 'forbidden', 'notFound', 'validation', 'badRequest',
+      'conflict', 'tooManyRequests', 'accountLocked', 'invalidCredentials',
+      'invalidToken', 'expiredToken', 'emailNotVerified', 'twoFactorRequired',
+      'twoFactorFailed', 'passwordPolicy', 'passwordReuse', 'smtpDisabled',
+      'socialAuthFailed', 'internal'
+    ];
+    for (const m of methods) {
+      assert.strictEqual(typeof ApiError[m], 'function', `ApiError.${m} should be a function`);
+      const err = ApiError[m]();
+      assert.ok(err instanceof ApiError, `${m} should return ApiError instance`);
+      assert.ok(err.code, `${m} should set a code`);
+      assert.ok(err.status, `${m} should set a status`);
+    }
+  });
+
+  it('normalize converts Mongoose ValidationError', () => {
+    const err = { name: 'ValidationError', message: 'bad', errors: { email: { message: 'x' } } };
+    const normalized = ApiError.normalize(err);
+    assert.strictEqual(normalized.code, 'AUTH_VALIDATION');
+    assert.strictEqual(normalized.status, 400);
+  });
+
+  it('normalize converts JWT errors', () => {
+    const expired = ApiError.normalize({ name: 'TokenExpiredError', message: 'expired' });
+    assert.strictEqual(expired.code, 'AUTH_EXPIRED_TOKEN');
+    const invalid = ApiError.normalize({ name: 'JsonWebTokenError', message: 'bad' });
+    assert.strictEqual(invalid.code, 'AUTH_INVALID_TOKEN');
+  });
+
+  it('normalize converts duplicate key 11000', () => {
+    const dup = ApiError.normalize({ code: 11000, message: 'dup', keyValue: { email: 'a@b.com' } });
+    assert.strictEqual(dup.code, 'AUTH_CONFLICT');
+  });
+
+  it('normalize converts generic Error', () => {
+    const gen = ApiError.normalize(new Error('boom'));
+    assert.strictEqual(gen.code, 'AUTH_INTERNAL');
+    assert.strictEqual(gen.status, 500);
+  });
+
+  it('normalize passes through ApiError unchanged', () => {
+    const orig = ApiError.forbidden('nope');
+    const same = ApiError.normalize(orig);
+    assert.strictEqual(same, orig);
+  });
+
+  it('error response shape has success:false + code + error', () => {
+    const err = ApiError.unauthorized('need token');
+    const json = { success: false, code: err.code, error: err.message };
+    assert.strictEqual(json.success, false);
+    assert.strictEqual(json.code, 'AUTH_UNAUTHORIZED');
+    assert.strictEqual(json.error, 'need token');
+  });
+});

package/test/08-cors-health.test.js

@@ -0,0 +1,45 @@
+/**
+ * 08 — CORS + health endpoint
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('08-cors-health', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+  });
+  after(async () => { await stopApp(); });
+
+  it('health endpoint returns ok + db status', async () => {
+    const res = await req('GET', '/auth/health');
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status}`);
+    assert.strictEqual(res.body.status, 'ok');
+    assert.strictEqual(res.body.db, 'connected');
+    assert.ok(res.body.version, 'should report version');
+    assert.strictEqual(typeof res.body.features, 'object');
+  });
+
+  it('CORS preflight returns 204 with origin header', async () => {
+    const url = `http://127.0.0.1:${server.address().port}/login`;
+    const res = await fetch(url, {
+      method: 'OPTIONS',
+      headers: {
+        Origin: 'https://example.com',
+        'Access-Control-Request-Method': 'POST',
+      },
+    });
+    assert.strictEqual(res.status, 204, `expected 204, got ${res.status}`);
+    const origin = res.headers.get('access-control-allow-origin');
+    assert.ok(origin, 'should have allow-origin header');
+  });
+
+  it('CORS actual request includes allow-origin header', async () => {
+    const res = await req('POST', '/login', { email: 'x', password: 'y' }, { Origin: 'https://example.com' });
+    // Login with invalid creds returns 401 (or 400 if validation fails)
+    assert.ok(res.status === 400 || res.status === 401, `expected 400/401, got ${res.status}`);
+  });
+});