@dax-crafta/auth 2.1.6 → 2.1.8

package/test/09-passwordless.test.js

@@ -0,0 +1,40 @@
+/**
+ * 09 — Passwordless magic link
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('09-passwordless', () => {
+  before(async () => {
+    const app = buildApp({
+      features: { passwordless: true, emailVerification: false, loginAlerts: false },
+      smtp: {
+        host: 'smtp.example.com',
+        port: 587,
+        auth: { user: 'test', pass: 'test' },
+        from: 'noreply@example.com',
+      },
+    });
+    server = await startApp();
+    await req('POST', '/register', {
+      name: 'Magic User',
+      email: 'magic@example.com',
+      password: 'Strong@Pass1',
+    });
+  });
+  after(async () => { await stopApp(); });
+
+  it('magic link request returns 200 (no oracle)', async () => {
+    const res = await req('POST', '/auth/magic-link', { email: 'ghost@example.com' });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status}`);
+  });
+
+  it('magic link verify rejects invalid token', async () => {
+    const res = await req('GET', '/auth/magic-link/verify?token=invalid');
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_INVALID_TOKEN');
+  });
+});

package/test/10-webhook-signing.test.js

@@ -0,0 +1,37 @@
+/**
+ * 10 — Webhook service: signing, event filtering, delivery
+ */
+const { describe, it } = require('./tiny-test');
+const assert = require('assert');
+const WebhookService = require('../src/services/webhook.service');
+
+describe('10-webhook-signing', () => {
+  it('sign returns HMAC-SHA256 hex when secret is set', () => {
+    const svc = new WebhookService({ webhooks: { url: 'http://example.com', secret: 's3cr3t' } });
+    const sig = svc.sign('hello');
+    assert.strictEqual(typeof sig, 'string');
+    assert.strictEqual(sig.length, 64, 'HMAC-SHA256 hex digest is 64 chars');
+  });
+
+  it('sign returns null when no secret', () => {
+    const svc = new WebhookService({ webhooks: { url: 'http://example.com' } });
+    assert.strictEqual(svc.sign('hello'), null);
+  });
+
+  it('emit is a no-op when webhooks disabled', async () => {
+    const svc = new WebhookService({});
+    const result = await svc.emit('login', { userId: 'u1' });
+    assert.strictEqual(result.delivered, false);
+    assert.strictEqual(result.reason, 'webhooks_disabled');
+  });
+
+  it('emit filters events not subscribed', async () => {
+    const svc = new WebhookService({
+      webhooks: { url: 'http://example.com', secret: 's3cr3t', events: ['login'] },
+    });
+    const result = await svc.emit('logout', { userId: 'u1' });
+    assert.strictEqual(result.delivered, false);
+    assert.strictEqual(result.reason, 'event_not_subscribed');
+    assert.strictEqual(result.event, 'logout');
+  });
+});

package/test/helpers.js

@@ -0,0 +1,130 @@
+/**
+ * Test helpers — shared setup for the live integration suite.
+ * Starts an Express server with @dax-crafta/auth against a real MongoDB.
+ */
+const mongoose = require('mongoose');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const { auth, ApiError } = require('../src/index');
+
+const MONGO_URL = process.env.MONGO_URL || 'mongodb://127.0.0.1:27017/crafta-auth-test';
+
+let server = null;
+let app = null;
+
+async function connectMongo() {
+  if (mongoose.connection.readyState === 0) {
+    await mongoose.connect(MONGO_URL);
+  }
+  // Wipe test collections for a clean slate
+  const cols = Object.keys(mongoose.connection.collections);
+  for (const name of cols) {
+    await mongoose.connection.collections[name].deleteMany({});
+  }
+}
+
+async function disconnectMongo() {
+  if (mongoose.connection.readyState !== 0) {
+    await mongoose.disconnect();
+  }
+}
+
+function buildApp(overrides = {}) {
+  app = express();
+  app.use(express.json());
+  app.use(cookieParser());
+
+  auth({
+    mongoUrl: MONGO_URL,
+    env: { JWT_SECRET: 'test-secret-256-bits-long-key' },
+    features: {
+      emailVerification: false,
+      loginAlerts: false,
+      csrf: false,
+      rateLimit: false,
+      auditLogs: true,
+      twoFactor: true,
+      passwordless: false,
+      webhooks: true,
+    },
+    session: { maxSessions: 3, sessionExpiryMs: 30 * 24 * 60 * 60 * 1000 },
+    webhooks: {
+      secret: 'test-webhook-secret',
+      events: ['user.registered', 'user.login', 'user.logout'],
+    },
+    ...overrides,
+  })(app);
+
+  // Ensure MongoDB connection is established before returning, and models are registered.
+  // auth() connects async; without this the first test hits a duplicate-key
+  // error because the connection isn't ready when the request fires.
+  global.__resetDb = async () => {
+    if (mongoose.connection.readyState === 0) {
+      await mongoose.connect(MONGO_URL);
+    }
+    // Ensure models are registered by requiring user and audit-log models
+    try { require('../src/models/user'); } catch (e) {}
+    try { require('../src/models/audit-log'); } catch (e) {}
+
+    const cols = Object.keys(mongoose.connection.collections);
+    for (const name of cols) {
+      try {
+        await mongoose.connection.collections[name].drop();
+      } catch (e) {
+        // Collection may not exist yet — ignore
+      }
+    }
+  };
+
+  return app;
+}
+
+function startApp(port = 0) {
+  return new Promise((resolve) => {
+    server = app.listen(port, () => {
+      resolve(server);
+    });
+  });
+}
+
+async function stopApp() {
+  if (server) {
+    await new Promise((r) => server.close(r));
+    server = null;
+  }
+}
+
+// ── HTTP helpers ──
+const BASE = () => `http://127.0.0.1:${server.address().port}`;
+
+async function req(method, path, body, headers = {}) {
+  const url = `${BASE()}${path}`;
+  const opts = {
+    method,
+    headers: { 'Content-Type': 'application/json', ...headers },
+  };
+  // GET/HEAD requests cannot have a body per fetch spec
+  if (body !== undefined && !['GET', 'HEAD'].includes(method)) {
+    opts.body = JSON.stringify(body);
+  }
+  const res = await fetch(url, opts);
+  let json = null;
+  let text = null;
+  const clone = res.clone();
+  try {
+    json = await res.json();
+  } catch {
+    text = await clone.text();
+  }
+  return { status: res.status, body: json, text };
+}
+
+module.exports = {
+  connectMongo,
+  disconnectMongo,
+  buildApp,
+  startApp,
+  stopApp,
+  req,
+  ApiError,
+};

package/test/run-tests.js

@@ -0,0 +1,94 @@
+/**
+ * Test runner — runs all test/*.test.js files sequentially.
+ * Each test file uses the tiny-test framework (describe/it/before/after).
+ *
+ * IMPORTANT: helpers and tiny-test are NEVER cleared from cache between
+ * test files, because helpers registers Mongoose models via auth().
+ * Only the test file itself is cleared.
+ */
+const path = require('path');
+const fs = require('fs');
+const mongoose = require('mongoose');
+
+const testDir = __dirname;
+const files = fs
+  .readdirSync(testDir)
+  .filter((f) => f.endsWith('.test.js') && !f.startsWith('run-') && !f.startsWith('tiny-'))
+  .sort();
+
+const MONGO_URL = process.env.MONGO_URL || 'mongodb://127.0.0.1:27017/crafta-auth-test';
+
+// Register Mongoose models eagerly so they exist before any test file runs.
+// auth() normally does this lazily, but the DB reset happens BEFORE auth()
+// is called in each test file's before() hook.
+require('./helpers'); // triggers require chain that registers models
+require('../src/models/user');
+require('../src/models/audit-log');
+
+async function resetMongoose() {
+  // Connect once and keep the connection — disconnecting invalidates
+  // the mongoose models registered by auth().
+  if (mongoose.connection.readyState === 0) {
+    await mongoose.connect(MONGO_URL);
+  }
+  // Drop every collection known to the MongoDB server.
+  // We use db.listCollections() rather than mongoose.connection.collections
+  // because the latter only tracks collections touched through Mongoose models,
+  // which is empty until auth() runs (after this reset).
+  const cols = await mongoose.connection.db.listCollections().toArray();
+  for (const col of cols) {
+    try {
+      await mongoose.connection.db.dropCollection(col.name);
+    } catch (e) {
+      // Collection may not exist yet — ignore
+    }
+  }
+}
+
+async function run() {
+  let totalPassed = 0;
+  let totalFailed = 0;
+  const failures = [];
+
+  for (const file of files) {
+    const filePath = path.join(testDir, file);
+    console.log(`\n=== ${file} ===`);
+
+    // Only clear the test file's own cache — keep helpers and tiny-test cached
+    // so Mongoose models registered by auth() stay registered.
+    const resolved = require.resolve(filePath);
+    delete require.cache[resolved];
+
+    try {
+      await resetMongoose();
+      require(filePath);
+      const tinyTest = require('./tiny-test');
+      await tinyTest.runPending();
+
+      const stats = tinyTest.getStats();
+      totalPassed += stats.passed;
+      totalFailed += stats.failed;
+      failures.push(...stats.failures);
+    } catch (err) {
+      console.error(`[FAIL] ${file}: ${err.message}`);
+      if (err.stack) console.error(err.stack.split('\n').slice(1, 6).join('\n'));
+      totalFailed += 1;
+      failures.push({ name: file, err });
+    }
+  }
+
+  console.log(`\nSummary: ${totalPassed} passed, ${totalFailed} failed`);
+  if (failures.length > 0) {
+    console.log('\nFailures:');
+    failures.forEach((f) => console.log(`  - ${f.name}: ${f.err.message}`));
+  }
+
+  if (totalFailed > 0) {
+    process.exitCode = 1;
+  }
+}
+
+run().catch((err) => {
+  console.error('Fatal error:', err);
+  process.exit(1);
+});

package/test/tiny-test.js

@@ -0,0 +1,68 @@
+/**
+ * Tiny test harness — supports describe()/it() with async assertions.
+ * Drop-in replacement for the mocha BDD interface. No dependencies.
+ */
+const assert = require('assert');
+
+let passed = 0;
+let failed = 0;
+const failures = [];
+let pendingTests = [];
+
+function describe(name, fn) {
+  console.log(`\n  ${name}`);
+  fn();
+}
+
+function it(name, fn) {
+  pendingTests.push({ name, fn });
+}
+
+async function runPending() {
+  // Reset DB BEFORE before() so test data created in before() survives.
+  // Also ensures MongoDB connection is established (auth() connects async).
+  if (global.__resetDb) { await global.__resetDb(); }
+
+  // Run before hooks — this is where buildApp() registers Mongoose models
+  if (global.__before) { await global.__before(); }
+
+  for (const test of pendingTests) {
+    try {
+      await test.fn();
+      console.log(`    ✓ ${test.name}`);
+      passed += 1;
+    } catch (err) {
+      console.log(`    ✗ ${test.name}`);
+      console.log(`      ${err.message}`);
+      failures.push({ name: test.name, err });
+      failed += 1;
+    }
+  }
+  if (global.__after) { await global.__after(); }
+
+  // Reset for next file
+  pendingTests = [];
+  global.__before = null;
+  global.__after = null;
+  global.__resetDb = null;
+}
+
+function before(fn) {
+  global.__before = fn;
+}
+
+function after(fn) {
+  global.__after = fn;
+}
+
+function getStats() {
+  return { passed, failed, failures };
+}
+
+function resetStats() {
+  passed = 0;
+  failed = 0;
+  failures.length = 0;
+}
+
+module.exports = { describe, it, before, after, runPending, getStats, resetStats };