@dax-crafta/auth 2.1.7 → 2.1.8

package/test/02-password-reset.test.js

@@ -0,0 +1,50 @@
+/**
+ * 02 — Password reset flow + forgot password
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('02-password-reset', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+    await req('POST', '/register', {
+      name: 'Bob Reset',
+      email: 'bob@example.com',
+      password: 'Strong@Pass1',
+    });
+  });
+  after(async () => { await stopApp(); });
+
+  it('forgot-password returns 200 even for unknown email', async () => {
+    const res = await req('POST', '/forgot-password', { email: 'ghost@example.com' });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status}`);
+    assert.strictEqual(res.body.success, true);
+  });
+
+  it('reset-password rejects invalid token', async () => {
+    const res = await req('POST', '/reset-password', {
+      token: 'invalid-token',
+      newPassword: 'New@Pass1',
+    });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+    assert.ok(res.body.code, 'should have error code');
+  });
+
+  it('reset-password rejects weak new password', async () => {
+    const res = await req('POST', '/reset-password', {
+      token: 'some-token',
+      newPassword: 'weak',
+    });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+    assert.ok(res.body.error || res.body.code, 'should have error message');
+  });
+
+  it('reset-password rejects missing token', async () => {
+    const res = await req('POST', '/reset-password', { newPassword: 'New@Pass1' });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+  });
+});

package/test/03-2fa.test.js

@@ -0,0 +1,54 @@
+/**
+ * 03 — 2FA / MFA flow
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const mongoose = require('mongoose');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('03-2fa', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+    // Register user
+    await req('POST', '/register', {
+      name: 'Two FA User',
+      email: 'two@example.com',
+      password: 'Strong@Pass1',
+    });
+    // Enable 2FA directly by setting twoFactorSecret and twoFactorEnabled
+    require('../src/models/user');
+    const User = mongoose.model('User');
+    const crypto = require('crypto');
+    const secret = crypto.randomBytes(20).toString('hex');
+    await User.findOneAndUpdate(
+      { email: 'two@example.com' },
+      { twoFactorSecret: secret, twoFactorEnabled: true }
+    );
+  });
+  after(async () => { await stopApp(); });
+
+  it('2fa verify rejects missing code', async () => {
+    require('../src/models/user');
+    const User = mongoose.model('User');
+    const user = await User.findOne({ email: 'two@example.com' });
+    const res = await req('POST', '/2fa', { userId: user._id });
+    assert.strictEqual(res.status, 400, `expected 400, got ${res.status}`);
+  });
+
+  it('2fa verify rejects unknown user', async () => {
+    const res = await req('POST', '/2fa', { userId: '000000000000000000000000', code: '123456' });
+    assert.strictEqual(res.status, 404, `expected 404, got ${res.status}`);
+  });
+
+  it('2fa verify rejects invalid code', async () => {
+    require('../src/models/user');
+    const User = mongoose.model('User');
+    const user = await User.findOne({ email: 'two@example.com' });
+    const res = await req('POST', '/2fa', { userId: user._id, code: '000000' });
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_2FA_FAILED');
+  });
+});

package/test/04-rbac.test.js

@@ -0,0 +1,51 @@
+/**
+ * 04 — RBAC: roles + permissions
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const mongoose = require('mongoose');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('04-rbac', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+    await req('POST', '/register', {
+      name: 'Admin User',
+      email: 'admin@example.com',
+      password: 'Strong@Pass1',
+    });
+    require('../src/models/user');
+    const User = mongoose.model('User');
+    await User.findOneAndUpdate({ email: 'admin@example.com' }, { role: 'admin' });
+  });
+  after(async () => { await stopApp(); });
+
+  it('create role succeeds as admin', async () => {
+    const login = await req('POST', '/login', {
+      email: 'admin@example.com',
+      password: 'Strong@Pass1',
+    });
+    const res = await req('POST', '/roles', {
+      name: 'editor',
+      permissions: [{ resource: 'posts', actions: ['create', 'read'] }],
+    }, { Authorization: `Bearer ${login.body.accessToken}` });
+    assert.strictEqual(res.status, 201, `expected 201, got ${res.status} ${JSON.stringify(res.body)}`);
+    assert.strictEqual(res.body.role.name, 'editor');
+  });
+
+  it('reject duplicate role name', async () => {
+    const login = await req('POST', '/login', {
+      email: 'admin@example.com',
+      password: 'Strong@Pass1',
+    });
+    const res = await req('POST', '/roles', {
+      name: 'editor',
+      permissions: [],
+    }, { Authorization: `Bearer ${login.body.accessToken}` });
+    assert.strictEqual(res.status, 409, `expected 409, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_CONFLICT');
+  });
+});

package/test/05-audit-webhook.test.js

@@ -0,0 +1,78 @@
+/**
+ * 05 — Audit logging + webhooks
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const http = require('http');
+const mongoose = require('mongoose');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+let webhookServer;
+let receivedWebhooks = [];
+
+describe('05-audit-webhook', () => {
+  before(async () => {
+    webhookServer = http.createServer((req, res) => {
+      let body = '';
+      req.on('data', (c) => (body += c));
+      req.on('end', () => {
+        try {
+          receivedWebhooks.push({
+            event: req.headers['x-crafta-event'],
+            signature: req.headers['x-crafta-signature'],
+            body: JSON.parse(body),
+          });
+        } catch {}
+        res.writeHead(200);
+        res.end('ok');
+      });
+    });
+    await new Promise((r) => webhookServer.listen(0, r));
+    const port = webhookServer.address().port;
+
+    const app = buildApp({
+      webhooks: {
+        url: `http://127.0.0.1:${port}`,
+        secret: 'test-secret',
+        events: ['user.registered', 'user.login', 'user.logout'],
+      },
+      features: { auditLogs: true, webhooks: true },
+    });
+    server = await startApp();
+
+    await req('POST', '/register', {
+      name: 'Audit User',
+      email: 'audit@example.com',
+      password: 'Strong@Pass1',
+    });
+  });
+  after(async () => {
+    await stopApp();
+    await new Promise((r) => webhookServer.close(r));
+  });
+
+  it('webhook fires on register with HMAC signature', async () => {
+    const found = receivedWebhooks.find((w) => w.event === 'user.registered');
+    assert.ok(found, `register webhook should fire. Got: ${JSON.stringify(receivedWebhooks)}`);
+    assert.ok(found.signature, 'webhook should be signed');
+    assert.strictEqual(found.body.data.email, 'audit@example.com');
+  });
+
+  it('audit log is written to MongoDB', async () => {
+    require('../src/models/audit-log');
+    const AuditLog = mongoose.model('AuditLog');
+    const count = await AuditLog.countDocuments({ action: 'register' });
+    assert.ok(count > 0, 'audit log entry for register should exist');
+  });
+
+  it('audit log has required enum actions', async () => {
+    require('../src/models/audit-log');
+    const AuditLog = mongoose.model('AuditLog');
+    const actions = AuditLog.schema.path('action').enumValues;
+    const required = ['login', 'logout', 'register', 'email_verify', '2fa_verify', 'refresh_token', 'social_login', 'backup_codes_generated', 'account_locked', 'password_reset', 'password_change', 'profile_update', 'role_change', '2fa_enabled', '2fa_disabled', 'password_reset_request'];
+    for (const a of required) {
+      assert.ok(actions.includes(a), `missing audit action: ${a}`);
+    }
+  });
+});

package/test/06-sessions.test.js

@@ -0,0 +1,36 @@
+/**
+ * 06 — Session management
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('06-sessions', () => {
+  before(async () => {
+    const app = buildApp({ session: { maxSessions: 3, sessionExpiryMs: 30 * 24 * 60 * 60 * 1000 } });
+    server = await startApp();
+    await req('POST', '/register', {
+      name: 'Session User',
+      email: 'session@example.com',
+      password: 'Strong@Pass1',
+    });
+  });
+  after(async () => { await stopApp(); });
+
+  it('logout-all invalidates all sessions', async () => {
+    const l1 = await req('POST', '/login', { email: 'session@example.com', password: 'Strong@Pass1' });
+    const l2 = await req('POST', '/login', { email: 'session@example.com', password: 'Strong@Pass1' });
+
+    const res = await req('POST', '/logout-all', {}, {
+      Authorization: `Bearer ${l1.body.accessToken}`,
+    });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status} ${JSON.stringify(res.body)}`);
+
+    const p1 = await req('PUT', '/profile', { name: 'X' }, { Authorization: `Bearer ${l1.body.accessToken}` });
+    const p2 = await req('PUT', '/profile', { name: 'X' }, { Authorization: `Bearer ${l2.body.accessToken}` });
+    assert.strictEqual(p1.status, 401, 'session 1 token should be dead');
+    assert.strictEqual(p2.status, 401, 'session 2 token should be dead');
+  });
+});

package/test/07-error-normalization.test.js

@@ -0,0 +1,64 @@
+/**
+ * 07 — Error normalization + standardized error codes
+ */
+const { describe, it } = require('./tiny-test');
+const assert = require('assert');
+const ApiError = require('../src/utils/api-error');
+
+describe('07-error-normalization', () => {
+  it('has all 19 factory methods', () => {
+    const methods = [
+      'unauthorized', 'forbidden', 'notFound', 'validation', 'badRequest',
+      'conflict', 'tooManyRequests', 'accountLocked', 'invalidCredentials',
+      'invalidToken', 'expiredToken', 'emailNotVerified', 'twoFactorRequired',
+      'twoFactorFailed', 'passwordPolicy', 'passwordReuse', 'smtpDisabled',
+      'socialAuthFailed', 'internal'
+    ];
+    for (const m of methods) {
+      assert.strictEqual(typeof ApiError[m], 'function', `ApiError.${m} should be a function`);
+      const err = ApiError[m]();
+      assert.ok(err instanceof ApiError, `${m} should return ApiError instance`);
+      assert.ok(err.code, `${m} should set a code`);
+      assert.ok(err.status, `${m} should set a status`);
+    }
+  });
+
+  it('normalize converts Mongoose ValidationError', () => {
+    const err = { name: 'ValidationError', message: 'bad', errors: { email: { message: 'x' } } };
+    const normalized = ApiError.normalize(err);
+    assert.strictEqual(normalized.code, 'AUTH_VALIDATION');
+    assert.strictEqual(normalized.status, 400);
+  });
+
+  it('normalize converts JWT errors', () => {
+    const expired = ApiError.normalize({ name: 'TokenExpiredError', message: 'expired' });
+    assert.strictEqual(expired.code, 'AUTH_EXPIRED_TOKEN');
+    const invalid = ApiError.normalize({ name: 'JsonWebTokenError', message: 'bad' });
+    assert.strictEqual(invalid.code, 'AUTH_INVALID_TOKEN');
+  });
+
+  it('normalize converts duplicate key 11000', () => {
+    const dup = ApiError.normalize({ code: 11000, message: 'dup', keyValue: { email: 'a@b.com' } });
+    assert.strictEqual(dup.code, 'AUTH_CONFLICT');
+  });
+
+  it('normalize converts generic Error', () => {
+    const gen = ApiError.normalize(new Error('boom'));
+    assert.strictEqual(gen.code, 'AUTH_INTERNAL');
+    assert.strictEqual(gen.status, 500);
+  });
+
+  it('normalize passes through ApiError unchanged', () => {
+    const orig = ApiError.forbidden('nope');
+    const same = ApiError.normalize(orig);
+    assert.strictEqual(same, orig);
+  });
+
+  it('error response shape has success:false + code + error', () => {
+    const err = ApiError.unauthorized('need token');
+    const json = { success: false, code: err.code, error: err.message };
+    assert.strictEqual(json.success, false);
+    assert.strictEqual(json.code, 'AUTH_UNAUTHORIZED');
+    assert.strictEqual(json.error, 'need token');
+  });
+});

package/test/08-cors-health.test.js

@@ -0,0 +1,45 @@
+/**
+ * 08 — CORS + health endpoint
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('08-cors-health', () => {
+  before(async () => {
+    const app = buildApp();
+    server = await startApp();
+  });
+  after(async () => { await stopApp(); });
+
+  it('health endpoint returns ok + db status', async () => {
+    const res = await req('GET', '/auth/health');
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status}`);
+    assert.strictEqual(res.body.status, 'ok');
+    assert.strictEqual(res.body.db, 'connected');
+    assert.ok(res.body.version, 'should report version');
+    assert.strictEqual(typeof res.body.features, 'object');
+  });
+
+  it('CORS preflight returns 204 with origin header', async () => {
+    const url = `http://127.0.0.1:${server.address().port}/login`;
+    const res = await fetch(url, {
+      method: 'OPTIONS',
+      headers: {
+        Origin: 'https://example.com',
+        'Access-Control-Request-Method': 'POST',
+      },
+    });
+    assert.strictEqual(res.status, 204, `expected 204, got ${res.status}`);
+    const origin = res.headers.get('access-control-allow-origin');
+    assert.ok(origin, 'should have allow-origin header');
+  });
+
+  it('CORS actual request includes allow-origin header', async () => {
+    const res = await req('POST', '/login', { email: 'x', password: 'y' }, { Origin: 'https://example.com' });
+    // Login with invalid creds returns 401 (or 400 if validation fails)
+    assert.ok(res.status === 400 || res.status === 401, `expected 400/401, got ${res.status}`);
+  });
+});

package/test/09-passwordless.test.js

@@ -0,0 +1,40 @@
+/**
+ * 09 — Passwordless magic link
+ */
+const { describe, it, before, after } = require('./tiny-test');
+const assert = require('assert');
+const { buildApp, startApp, stopApp, req } = require('./helpers');
+
+let server;
+
+describe('09-passwordless', () => {
+  before(async () => {
+    const app = buildApp({
+      features: { passwordless: true, emailVerification: false, loginAlerts: false },
+      smtp: {
+        host: 'smtp.example.com',
+        port: 587,
+        auth: { user: 'test', pass: 'test' },
+        from: 'noreply@example.com',
+      },
+    });
+    server = await startApp();
+    await req('POST', '/register', {
+      name: 'Magic User',
+      email: 'magic@example.com',
+      password: 'Strong@Pass1',
+    });
+  });
+  after(async () => { await stopApp(); });
+
+  it('magic link request returns 200 (no oracle)', async () => {
+    const res = await req('POST', '/auth/magic-link', { email: 'ghost@example.com' });
+    assert.strictEqual(res.status, 200, `expected 200, got ${res.status}`);
+  });
+
+  it('magic link verify rejects invalid token', async () => {
+    const res = await req('GET', '/auth/magic-link/verify?token=invalid');
+    assert.strictEqual(res.status, 401, `expected 401, got ${res.status}`);
+    assert.strictEqual(res.body.code, 'AUTH_INVALID_TOKEN');
+  });
+});

package/test/10-webhook-signing.test.js

@@ -0,0 +1,37 @@
+/**
+ * 10 — Webhook service: signing, event filtering, delivery
+ */
+const { describe, it } = require('./tiny-test');
+const assert = require('assert');
+const WebhookService = require('../src/services/webhook.service');
+
+describe('10-webhook-signing', () => {
+  it('sign returns HMAC-SHA256 hex when secret is set', () => {
+    const svc = new WebhookService({ webhooks: { url: 'http://example.com', secret: 's3cr3t' } });
+    const sig = svc.sign('hello');
+    assert.strictEqual(typeof sig, 'string');
+    assert.strictEqual(sig.length, 64, 'HMAC-SHA256 hex digest is 64 chars');
+  });
+
+  it('sign returns null when no secret', () => {
+    const svc = new WebhookService({ webhooks: { url: 'http://example.com' } });
+    assert.strictEqual(svc.sign('hello'), null);
+  });
+
+  it('emit is a no-op when webhooks disabled', async () => {
+    const svc = new WebhookService({});
+    const result = await svc.emit('login', { userId: 'u1' });
+    assert.strictEqual(result.delivered, false);
+    assert.strictEqual(result.reason, 'webhooks_disabled');
+  });
+
+  it('emit filters events not subscribed', async () => {
+    const svc = new WebhookService({
+      webhooks: { url: 'http://example.com', secret: 's3cr3t', events: ['login'] },
+    });
+    const result = await svc.emit('logout', { userId: 'u1' });
+    assert.strictEqual(result.delivered, false);
+    assert.strictEqual(result.reason, 'event_not_subscribed');
+    assert.strictEqual(result.event, 'logout');
+  });
+});

package/test/helpers.js

@@ -0,0 +1,130 @@
+/**
+ * Test helpers — shared setup for the live integration suite.
+ * Starts an Express server with @dax-crafta/auth against a real MongoDB.
+ */
+const mongoose = require('mongoose');
+const express = require('express');
+const cookieParser = require('cookie-parser');
+const { auth, ApiError } = require('../src/index');
+
+const MONGO_URL = process.env.MONGO_URL || 'mongodb://127.0.0.1:27017/crafta-auth-test';
+
+let server = null;
+let app = null;
+
+async function connectMongo() {
+  if (mongoose.connection.readyState === 0) {
+    await mongoose.connect(MONGO_URL);
+  }
+  // Wipe test collections for a clean slate
+  const cols = Object.keys(mongoose.connection.collections);
+  for (const name of cols) {
+    await mongoose.connection.collections[name].deleteMany({});
+  }
+}
+
+async function disconnectMongo() {
+  if (mongoose.connection.readyState !== 0) {
+    await mongoose.disconnect();
+  }
+}
+
+function buildApp(overrides = {}) {
+  app = express();
+  app.use(express.json());
+  app.use(cookieParser());
+
+  auth({
+    mongoUrl: MONGO_URL,
+    env: { JWT_SECRET: 'test-secret-256-bits-long-key' },
+    features: {
+      emailVerification: false,
+      loginAlerts: false,
+      csrf: false,
+      rateLimit: false,
+      auditLogs: true,
+      twoFactor: true,
+      passwordless: false,
+      webhooks: true,
+    },
+    session: { maxSessions: 3, sessionExpiryMs: 30 * 24 * 60 * 60 * 1000 },
+    webhooks: {
+      secret: 'test-webhook-secret',
+      events: ['user.registered', 'user.login', 'user.logout'],
+    },
+    ...overrides,
+  })(app);
+
+  // Ensure MongoDB connection is established before returning, and models are registered.
+  // auth() connects async; without this the first test hits a duplicate-key
+  // error because the connection isn't ready when the request fires.
+  global.__resetDb = async () => {
+    if (mongoose.connection.readyState === 0) {
+      await mongoose.connect(MONGO_URL);
+    }
+    // Ensure models are registered by requiring user and audit-log models
+    try { require('../src/models/user'); } catch (e) {}
+    try { require('../src/models/audit-log'); } catch (e) {}
+
+    const cols = Object.keys(mongoose.connection.collections);
+    for (const name of cols) {
+      try {
+        await mongoose.connection.collections[name].drop();
+      } catch (e) {
+        // Collection may not exist yet — ignore
+      }
+    }
+  };
+
+  return app;
+}
+
+function startApp(port = 0) {
+  return new Promise((resolve) => {
+    server = app.listen(port, () => {
+      resolve(server);
+    });
+  });
+}
+
+async function stopApp() {
+  if (server) {
+    await new Promise((r) => server.close(r));
+    server = null;
+  }
+}
+
+// ── HTTP helpers ──
+const BASE = () => `http://127.0.0.1:${server.address().port}`;
+
+async function req(method, path, body, headers = {}) {
+  const url = `${BASE()}${path}`;
+  const opts = {
+    method,
+    headers: { 'Content-Type': 'application/json', ...headers },
+  };
+  // GET/HEAD requests cannot have a body per fetch spec
+  if (body !== undefined && !['GET', 'HEAD'].includes(method)) {
+    opts.body = JSON.stringify(body);
+  }
+  const res = await fetch(url, opts);
+  let json = null;
+  let text = null;
+  const clone = res.clone();
+  try {
+    json = await res.json();
+  } catch {
+    text = await clone.text();
+  }
+  return { status: res.status, body: json, text };
+}
+
+module.exports = {
+  connectMongo,
+  disconnectMongo,
+  buildApp,
+  startApp,
+  stopApp,
+  req,
+  ApiError,
+};

package/test/run-tests.js

@@ -0,0 +1,94 @@
+/**
+ * Test runner — runs all test/*.test.js files sequentially.
+ * Each test file uses the tiny-test framework (describe/it/before/after).
+ *
+ * IMPORTANT: helpers and tiny-test are NEVER cleared from cache between
+ * test files, because helpers registers Mongoose models via auth().
+ * Only the test file itself is cleared.
+ */
+const path = require('path');
+const fs = require('fs');
+const mongoose = require('mongoose');
+
+const testDir = __dirname;
+const files = fs
+  .readdirSync(testDir)
+  .filter((f) => f.endsWith('.test.js') && !f.startsWith('run-') && !f.startsWith('tiny-'))
+  .sort();
+
+const MONGO_URL = process.env.MONGO_URL || 'mongodb://127.0.0.1:27017/crafta-auth-test';
+
+// Register Mongoose models eagerly so they exist before any test file runs.
+// auth() normally does this lazily, but the DB reset happens BEFORE auth()
+// is called in each test file's before() hook.
+require('./helpers'); // triggers require chain that registers models
+require('../src/models/user');
+require('../src/models/audit-log');
+
+async function resetMongoose() {
+  // Connect once and keep the connection — disconnecting invalidates
+  // the mongoose models registered by auth().
+  if (mongoose.connection.readyState === 0) {
+    await mongoose.connect(MONGO_URL);
+  }
+  // Drop every collection known to the MongoDB server.
+  // We use db.listCollections() rather than mongoose.connection.collections
+  // because the latter only tracks collections touched through Mongoose models,
+  // which is empty until auth() runs (after this reset).
+  const cols = await mongoose.connection.db.listCollections().toArray();
+  for (const col of cols) {
+    try {
+      await mongoose.connection.db.dropCollection(col.name);
+    } catch (e) {
+      // Collection may not exist yet — ignore
+    }
+  }
+}
+
+async function run() {
+  let totalPassed = 0;
+  let totalFailed = 0;
+  const failures = [];
+
+  for (const file of files) {
+    const filePath = path.join(testDir, file);
+    console.log(`\n=== ${file} ===`);
+
+    // Only clear the test file's own cache — keep helpers and tiny-test cached
+    // so Mongoose models registered by auth() stay registered.
+    const resolved = require.resolve(filePath);
+    delete require.cache[resolved];
+
+    try {
+      await resetMongoose();
+      require(filePath);
+      const tinyTest = require('./tiny-test');
+      await tinyTest.runPending();
+
+      const stats = tinyTest.getStats();
+      totalPassed += stats.passed;
+      totalFailed += stats.failed;
+      failures.push(...stats.failures);
+    } catch (err) {
+      console.error(`[FAIL] ${file}: ${err.message}`);
+      if (err.stack) console.error(err.stack.split('\n').slice(1, 6).join('\n'));
+      totalFailed += 1;
+      failures.push({ name: file, err });
+    }
+  }
+
+  console.log(`\nSummary: ${totalPassed} passed, ${totalFailed} failed`);
+  if (failures.length > 0) {
+    console.log('\nFailures:');
+    failures.forEach((f) => console.log(`  - ${f.name}: ${f.err.message}`));
+  }
+
+  if (totalFailed > 0) {
+    process.exitCode = 1;
+  }
+}
+
+run().catch((err) => {
+  console.error('Fatal error:', err);
+  process.exit(1);
+});