@etus/bhono-app 0.1.1

package/templates/base/src/server/lib/errors.test.ts

@@ -0,0 +1,49 @@
+import { describe, it, expect } from 'vitest'
+import {
+  ValidationError,
+  UnauthorizedError,
+  ForbiddenError,
+  NotFoundError,
+  ConflictError,
+  InternalError,
+  getErrorCode,
+} from './errors'
+
+describe('Error Classes', () => {
+  describe('getErrorCode', () => {
+    it('returns VALIDATION_ERROR for ValidationError', () => {
+      const error = new ValidationError('Invalid input')
+      expect(getErrorCode(error)).toBe('VALIDATION_ERROR')
+    })
+
+    it('returns UNAUTHORIZED for UnauthorizedError', () => {
+      const error = new UnauthorizedError()
+      expect(getErrorCode(error)).toBe('UNAUTHORIZED')
+    })
+
+    it('returns FORBIDDEN for ForbiddenError', () => {
+      const error = new ForbiddenError()
+      expect(getErrorCode(error)).toBe('FORBIDDEN')
+    })
+
+    it('returns NOT_FOUND for NotFoundError', () => {
+      const error = new NotFoundError('User')
+      expect(getErrorCode(error)).toBe('NOT_FOUND')
+    })
+
+    it('returns CONFLICT for ConflictError', () => {
+      const error = new ConflictError()
+      expect(getErrorCode(error)).toBe('CONFLICT')
+    })
+
+    it('returns INTERNAL_ERROR for InternalError', () => {
+      const error = new InternalError()
+      expect(getErrorCode(error)).toBe('INTERNAL_ERROR')
+    })
+
+    it('returns INTERNAL_ERROR for unknown errors', () => {
+      const error = new Error('Unknown')
+      expect(getErrorCode(error)).toBe('INTERNAL_ERROR')
+    })
+  })
+})

package/templates/base/src/server/lib/errors.ts

@@ -0,0 +1,64 @@
+import { HTTPException } from 'hono/http-exception'
+
+export const ERROR_CODES = {
+  VALIDATION_ERROR: 'VALIDATION_ERROR',
+  UNAUTHORIZED: 'UNAUTHORIZED',
+  FORBIDDEN: 'FORBIDDEN',
+  NOT_FOUND: 'NOT_FOUND',
+  CONFLICT: 'CONFLICT',
+  INTERNAL_ERROR: 'INTERNAL_ERROR',
+} as const
+
+export type ErrorCode = (typeof ERROR_CODES)[keyof typeof ERROR_CODES]
+
+export class ValidationError extends HTTPException {
+  readonly code = ERROR_CODES.VALIDATION_ERROR
+  constructor(message: string, details?: unknown) {
+    super(400, { message, cause: details })
+  }
+}
+
+export class UnauthorizedError extends HTTPException {
+  readonly code = ERROR_CODES.UNAUTHORIZED
+  constructor(message = 'Unauthorized') {
+    super(401, { message })
+  }
+}
+
+export class ForbiddenError extends HTTPException {
+  readonly code = ERROR_CODES.FORBIDDEN
+  constructor(message = 'Forbidden') {
+    super(403, { message })
+  }
+}
+
+export class NotFoundError extends HTTPException {
+  readonly code = ERROR_CODES.NOT_FOUND
+  constructor(resource = 'Resource') {
+    super(404, { message: `${resource} not found` })
+  }
+}
+
+export class ConflictError extends HTTPException {
+  readonly code = ERROR_CODES.CONFLICT
+  constructor(message = 'Resource already exists') {
+    super(409, { message })
+  }
+}
+
+export class InternalError extends HTTPException {
+  readonly code = ERROR_CODES.INTERNAL_ERROR
+  constructor(message = 'Internal server error') {
+    super(500, { message })
+  }
+}
+
+export function getErrorCode(error: unknown): ErrorCode {
+  if (error instanceof ValidationError) return ERROR_CODES.VALIDATION_ERROR
+  if (error instanceof UnauthorizedError) return ERROR_CODES.UNAUTHORIZED
+  if (error instanceof ForbiddenError) return ERROR_CODES.FORBIDDEN
+  if (error instanceof NotFoundError) return ERROR_CODES.NOT_FOUND
+  if (error instanceof ConflictError) return ERROR_CODES.CONFLICT
+  if (error instanceof InternalError) return ERROR_CODES.INTERNAL_ERROR
+  return ERROR_CODES.INTERNAL_ERROR
+}

package/templates/base/src/server/lib/oauth.test.ts

@@ -0,0 +1,238 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import {
+  generateState,
+  generateCodeVerifier,
+  generateCodeChallenge,
+  buildGoogleAuthUrl,
+  exchangeCodeForTokens,
+  getGoogleUserInfo,
+  decodeIdToken,
+} from './oauth'
+
+// Mock fetch globally
+const mockFetch = vi.fn()
+vi.stubGlobal('fetch', mockFetch)
+
+const mockEnv = {
+  GOOGLE_CLIENT_ID: 'test-client-id',
+  GOOGLE_CLIENT_SECRET: 'test-client-secret',
+  GOOGLE_REDIRECT_URI: 'http://localhost:3000/auth/callback',
+} as any
+
+// Create a valid JWT-like token for testing
+function createMockIdToken(payload: object): string {
+  const header = btoa(JSON.stringify({ alg: 'RS256', typ: 'JWT' }))
+  const encodedPayload = btoa(JSON.stringify(payload))
+    .replaceAll('+', '-')
+    .replaceAll('/', '_')
+    .replaceAll('=', '')
+  const signature = 'mock-signature'
+  return `${header}.${encodedPayload}.${signature}`
+}
+
+describe('generateState', () => {
+  it('should generate random state string', () => {
+    const state = generateState()
+    expect(state).toBeDefined()
+    expect(typeof state).toBe('string')
+    expect(state.length).toBeGreaterThan(0)
+  })
+
+  it('should generate unique states each time', () => {
+    const states = new Set<string>()
+    for (let i = 0; i < 100; i++) {
+      states.add(generateState())
+    }
+    expect(states.size).toBe(100)
+  })
+})
+
+describe('generateCodeVerifier', () => {
+  it('should generate random verifier string', () => {
+    const verifier = generateCodeVerifier()
+    expect(verifier).toBeDefined()
+    expect(typeof verifier).toBe('string')
+    expect(verifier.length).toBeGreaterThan(0)
+  })
+
+  it('should generate unique verifiers each time', () => {
+    const verifiers = new Set<string>()
+    for (let i = 0; i < 100; i++) {
+      verifiers.add(generateCodeVerifier())
+    }
+    expect(verifiers.size).toBe(100)
+  })
+})
+
+describe('generateCodeChallenge', () => {
+  it('should generate SHA-256 hash of verifier', async () => {
+    const verifier = 'test-verifier-string'
+    const challenge = await generateCodeChallenge(verifier)
+
+    expect(challenge).toBeDefined()
+    expect(typeof challenge).toBe('string')
+    expect(challenge.length).toBeGreaterThan(0)
+
+    // Same input should produce same output
+    const challenge2 = await generateCodeChallenge(verifier)
+    expect(challenge).toBe(challenge2)
+
+    // Different input should produce different output
+    const challenge3 = await generateCodeChallenge('different-verifier')
+    expect(challenge).not.toBe(challenge3)
+  })
+})
+
+describe('buildGoogleAuthUrl', () => {
+  it('should build valid Google OAuth URL with all parameters', () => {
+    const state = 'test-state'
+    const codeChallenge = 'test-code-challenge'
+
+    const url = buildGoogleAuthUrl(mockEnv, state, codeChallenge)
+
+    expect(url).toContain('https://accounts.google.com/o/oauth2/v2/auth')
+    expect(url).toContain('client_id=test-client-id')
+    expect(url).toContain('redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fcallback')
+    expect(url).toContain('response_type=code')
+    expect(url).toContain('scope=openid+email+profile')
+    expect(url).toContain('code_challenge_method=S256')
+    expect(url).toContain('access_type=offline')
+    expect(url).toContain('prompt=consent')
+  })
+
+  it('should include state and code_challenge', () => {
+    const state = 'my-state-123'
+    const codeChallenge = 'my-challenge-456'
+
+    const url = buildGoogleAuthUrl(mockEnv, state, codeChallenge)
+
+    expect(url).toContain(`state=${state}`)
+    expect(url).toContain(`code_challenge=${codeChallenge}`)
+  })
+})
+
+describe('exchangeCodeForTokens', () => {
+  beforeEach(() => {
+    mockFetch.mockReset()
+  })
+
+  afterEach(() => {
+    mockFetch.mockReset()
+  })
+
+  it('should return tokens on success', async () => {
+    const mockTokenResponse = {
+      access_token: 'mock-access-token',
+      expires_in: 3600,
+      id_token: 'mock-id-token',
+      scope: 'openid email profile',
+      token_type: 'Bearer',
+      refresh_token: 'mock-refresh-token',
+    }
+
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: async () => mockTokenResponse,
+    })
+
+    const result = await exchangeCodeForTokens(mockEnv, 'auth-code', 'code-verifier')
+
+    expect(result).toEqual(mockTokenResponse)
+    expect(mockFetch).toHaveBeenCalledWith(
+      'https://oauth2.googleapis.com/token',
+      expect.objectContaining({
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      })
+    )
+  })
+
+  it('should throw error on failure', async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      text: async () => 'Invalid grant',
+    })
+
+    await expect(
+      exchangeCodeForTokens(mockEnv, 'invalid-code', 'code-verifier')
+    ).rejects.toThrow('Failed to exchange code: Invalid grant')
+  })
+})
+
+describe('getGoogleUserInfo', () => {
+  beforeEach(() => {
+    mockFetch.mockReset()
+  })
+
+  afterEach(() => {
+    mockFetch.mockReset()
+  })
+
+  it('should return user info on success', async () => {
+    const mockUserInfo = {
+      sub: 'google-123',
+      email: 'test@example.com',
+      email_verified: true,
+      name: 'Test User',
+      picture: 'https://example.com/photo.jpg',
+      given_name: 'Test',
+      family_name: 'User',
+    }
+
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: async () => mockUserInfo,
+    })
+
+    const result = await getGoogleUserInfo('mock-access-token')
+
+    expect(result).toEqual(mockUserInfo)
+    expect(mockFetch).toHaveBeenCalledWith(
+      'https://www.googleapis.com/oauth2/v3/userinfo',
+      {
+        headers: { Authorization: 'Bearer mock-access-token' },
+      }
+    )
+  })
+
+  it('should throw error on failure', async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+    })
+
+    await expect(getGoogleUserInfo('invalid-token')).rejects.toThrow(
+      'Failed to get user info from Google'
+    )
+  })
+})
+
+describe('decodeIdToken', () => {
+  it('should decode valid JWT payload', () => {
+    const payload = {
+      sub: 'google-123',
+      email: 'test@example.com',
+      email_verified: true,
+      name: 'Test User',
+      picture: 'https://example.com/photo.jpg',
+      given_name: 'Test',
+      family_name: 'User',
+    }
+    const token = createMockIdToken(payload)
+
+    const result = decodeIdToken(token)
+
+    expect(result.sub).toBe('google-123')
+    expect(result.email).toBe('test@example.com')
+    expect(result.email_verified).toBe(true)
+    expect(result.name).toBe('Test User')
+    expect(result.picture).toBe('https://example.com/photo.jpg')
+    expect(result.given_name).toBe('Test')
+    expect(result.family_name).toBe('User')
+  })
+
+  it('should throw error for invalid token format', () => {
+    expect(() => decodeIdToken('invalid-token')).toThrow('Invalid ID token format')
+    expect(() => decodeIdToken('only.two')).toThrow('Invalid ID token format')
+    expect(() => decodeIdToken('')).toThrow('Invalid ID token format')
+  })
+})

package/templates/base/src/server/lib/oauth.ts

@@ -0,0 +1,113 @@
+// src/lib/oauth.ts
+import type { Env } from '../env'
+import type { GoogleTokenResponse, GoogleUserInfo } from '../types/auth'
+
+const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth'
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token'
+const GOOGLE_USERINFO_URL = 'https://www.googleapis.com/oauth2/v3/userinfo'
+
+export function generateCodeVerifier(): string {
+  const array = new Uint8Array(32)
+  crypto.getRandomValues(array)
+  return base64UrlEncode(array)
+}
+
+export async function generateCodeChallenge(verifier: string): Promise<string> {
+  const encoder = new TextEncoder()
+  const data = encoder.encode(verifier)
+  const hash = await crypto.subtle.digest('SHA-256', data)
+  return base64UrlEncode(new Uint8Array(hash))
+}
+
+export function generateState(): string {
+  const array = new Uint8Array(16)
+  crypto.getRandomValues(array)
+  return base64UrlEncode(array)
+}
+
+function base64UrlEncode(buffer: Uint8Array): string {
+  const base64 = btoa(String.fromCharCode(...buffer))
+  return base64.replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '')
+}
+
+export function buildGoogleAuthUrl(env: Env, state: string, codeChallenge: string): string {
+  const params = new URLSearchParams({
+    client_id: env.GOOGLE_CLIENT_ID,
+    redirect_uri: env.GOOGLE_REDIRECT_URI,
+    response_type: 'code',
+    scope: 'openid email profile',
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: 'S256',
+    access_type: 'offline',
+    prompt: 'consent',
+  })
+  return `${GOOGLE_AUTH_URL}?${params.toString()}`
+}
+
+export async function exchangeCodeForTokens(
+  env: Env,
+  code: string,
+  codeVerifier: string
+): Promise<GoogleTokenResponse> {
+  const response = await fetch(GOOGLE_TOKEN_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      client_id: env.GOOGLE_CLIENT_ID,
+      client_secret: env.GOOGLE_CLIENT_SECRET,
+      code,
+      code_verifier: codeVerifier,
+      grant_type: 'authorization_code',
+      redirect_uri: env.GOOGLE_REDIRECT_URI,
+    }),
+  })
+
+  if (!response.ok) {
+    const error = await response.text()
+    throw new Error(`Failed to exchange code: ${error}`)
+  }
+
+  return response.json()
+}
+
+export async function getGoogleUserInfo(accessToken: string): Promise<GoogleUserInfo> {
+  const response = await fetch(GOOGLE_USERINFO_URL, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+  })
+
+  if (!response.ok) {
+    throw new Error('Failed to get user info from Google')
+  }
+
+  return response.json()
+}
+
+export function decodeIdToken(idToken: string): GoogleUserInfo {
+  const parts = idToken.split('.')
+  if (parts.length !== 3) {
+    throw new Error('Invalid ID token format')
+  }
+
+  // Decode base64url payload with UTF-8 support
+  // 1. Convert base64url to standard base64
+  const base64 = parts[1].replaceAll('-', '+').replaceAll('_', '/')
+  // 2. Decode to binary string (Latin-1 code points 0-255)
+  const binary = atob(base64)
+  // 3. Convert binary string to Uint8Array
+  const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0))
+  // 4. Decode as UTF-8 to handle multi-byte characters
+  const jsonStr = new TextDecoder('utf-8').decode(bytes)
+  // 5. Parse JSON
+  const payload = JSON.parse(jsonStr) as GoogleUserInfo
+
+  return {
+    sub: payload.sub,
+    email: payload.email,
+    email_verified: payload.email_verified,
+    name: payload.name,
+    picture: payload.picture,
+    given_name: payload.given_name,
+    family_name: payload.family_name,
+  }
+}

package/templates/base/src/server/lib/pagination.test.ts

@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest'
+import { createPaginationMeta, PaginationQuerySchema } from './pagination'
+
+describe('pagination', () => {
+  describe('createPaginationMeta', () => {
+    it('should calculate correct pagination meta', () => {
+      const meta = createPaginationMeta(100, 2, 10)
+
+      expect(meta.currentPage).toBe(2)
+      expect(meta.limit).toBe(10)
+      expect(meta.totalItems).toBe(100)
+      expect(meta.totalPages).toBe(10)
+      expect(meta.hasPreviousPage).toBe(true)
+      expect(meta.hasNextPage).toBe(true)
+    })
+
+    it('should return hasPreviousPage false on first page', () => {
+      const meta = createPaginationMeta(100, 1, 10)
+      expect(meta.hasPreviousPage).toBe(false)
+    })
+
+    it('should return hasNextPage false on last page', () => {
+      const meta = createPaginationMeta(100, 10, 10)
+      expect(meta.hasNextPage).toBe(false)
+    })
+
+    it('should handle empty results', () => {
+      const meta = createPaginationMeta(0, 1, 10)
+      expect(meta.totalPages).toBe(0)
+      expect(meta.hasNextPage).toBe(false)
+    })
+  })
+
+  describe('PaginationQuerySchema', () => {
+    it('should use defaults for missing values', () => {
+      const result = PaginationQuerySchema.parse({})
+      expect(result.page).toBe(1)
+      expect(result.limit).toBe(50)
+      expect(result.sortOrder).toBe('DESC')
+    })
+
+    it('should coerce string numbers', () => {
+      const result = PaginationQuerySchema.parse({ page: '2', limit: '25' })
+      expect(result.page).toBe(2)
+      expect(result.limit).toBe(25)
+    })
+
+    it('should enforce limit max of 100', () => {
+      expect(() => PaginationQuerySchema.parse({ limit: 200 })).toThrow()
+    })
+  })
+})

package/templates/base/src/server/lib/pagination.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod'
+import type { PaginationMeta } from '../types'
+
+export const PaginationQuerySchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  limit: z.coerce.number().min(1).max(100).default(50),
+  sortBy: z.string().optional(),
+  sortOrder: z.enum(['ASC', 'DESC']).default('DESC'),
+  query: z.string().optional(),
+})
+
+export type PaginationQuery = z.infer<typeof PaginationQuerySchema>
+
+export function createPaginationMeta(
+  totalItems: number,
+  page: number,
+  limit: number
+): PaginationMeta {
+  const totalPages = Math.ceil(totalItems / limit)
+  return {
+    currentPage: page,
+    limit,
+    totalItems,
+    totalPages,
+    hasPreviousPage: page > 1,
+    hasNextPage: page < totalPages,
+  }
+}
+
+export function calculateOffset(page: number, limit: number): number {
+  return (page - 1) * limit
+}

package/templates/base/src/server/lib/password.test.ts

@@ -0,0 +1,151 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { generateStrongPassword, isStrongPassword } from './password'
+
+// Store original crypto.getRandomValues
+const originalGetRandomValues = crypto.getRandomValues.bind(crypto)
+
+describe('generateStrongPassword', () => {
+  it('generates password with default length of 20', () => {
+    const password = generateStrongPassword()
+    expect(password.length).toBe(20)
+  })
+
+  it('generates password with custom length', () => {
+    const password = generateStrongPassword(24)
+    expect(password.length).toBe(24)
+  })
+
+  it('enforces minimum length of 16', () => {
+    const password = generateStrongPassword(10)
+    expect(password.length).toBe(16)
+  })
+
+  it('contains at least 3 of 4 character types', () => {
+    // Generate multiple passwords to ensure consistency
+    for (let i = 0; i < 10; i++) {
+      const password = generateStrongPassword()
+      let typeCount = 0
+
+      if (/[a-z]/.test(password)) typeCount++
+      if (/[A-Z]/.test(password)) typeCount++
+      if (/[0-9]/.test(password)) typeCount++
+      if (/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(password)) typeCount++
+
+      expect(typeCount).toBeGreaterThanOrEqual(3)
+    }
+  })
+
+  it('does not have more than 2 identical consecutive characters', () => {
+    for (let i = 0; i < 10; i++) {
+      const password = generateStrongPassword()
+      expect(password).not.toMatch(/(.)\1{2,}/)
+    }
+  })
+
+  it('generates unique passwords each time', () => {
+    const passwords = new Set<string>()
+    for (let i = 0; i < 100; i++) {
+      passwords.add(generateStrongPassword())
+    }
+    expect(passwords.size).toBe(100)
+  })
+})
+
+describe('isStrongPassword', () => {
+  it('returns true for valid strong password', () => {
+    expect(isStrongPassword('Abc123!@#defGHI456')).toBe(true)
+  })
+
+  it('returns false for password shorter than 16 characters', () => {
+    expect(isStrongPassword('Abc123!@#')).toBe(false)
+  })
+
+  it('returns false for password with less than 3 character types', () => {
+    expect(isStrongPassword('abcdefghijklmnop')).toBe(false) // only lowercase
+    expect(isStrongPassword('ABCDEFGHIJKLMNOP')).toBe(false) // only uppercase
+    expect(isStrongPassword('1234567890123456')).toBe(false) // only numbers
+  })
+
+  it('returns false for password with 3+ consecutive identical characters', () => {
+    expect(isStrongPassword('Abc111defGHI456!@')).toBe(false)
+    expect(isStrongPassword('AAAbc123defGHI!@#')).toBe(false)
+  })
+
+  it('returns true for password with exactly 2 consecutive identical characters', () => {
+    expect(isStrongPassword('Aabbcc123!@#DEFGH')).toBe(true)
+  })
+})
+
+describe('generateStrongPassword fallback path', () => {
+  afterEach(() => {
+    // Restore original crypto.getRandomValues
+    vi.restoreAllMocks()
+    Object.defineProperty(crypto, 'getRandomValues', {
+      value: originalGetRandomValues,
+      writable: true,
+      configurable: true,
+    })
+  })
+
+  it('falls back to constructGuaranteedPassword when random generation fails repeatedly', () => {
+    let callCount = 0
+
+    // Mock crypto.getRandomValues to always return invalid passwords until fallback
+    Object.defineProperty(crypto, 'getRandomValues', {
+      value: <T extends ArrayBufferView | null>(array: T): T => {
+        callCount++
+
+        if (array instanceof Uint32Array) {
+          // For the first 100 calls, produce only lowercase 'a' (invalid)
+          // After that, produce varied chars for fallback
+          if (callCount <= 100) {
+            for (let i = 0; i < array.length; i++) {
+              array[i] = 0
+            }
+          } else {
+            // For constructGuaranteedPassword, use varied values
+            for (let i = 0; i < array.length; i++) {
+              array[i] = (i * 30 + callCount) % 1000000
+            }
+          }
+        }
+        return array
+      },
+      writable: true,
+      configurable: true,
+    })
+
+    const password = generateStrongPassword()
+
+    // The fallback should produce a valid password
+    expect(password.length).toBeGreaterThanOrEqual(16)
+    expect(isStrongPassword(password)).toBe(true)
+
+    // Verify we hit the fallback (> 100 calls)
+    expect(callCount).toBeGreaterThan(100)
+  })
+})
+
+describe('isStrongPassword edge cases', () => {
+  it('handles empty string', () => {
+    expect(isStrongPassword('')).toBe(false)
+  })
+
+  it('handles string with only whitespace', () => {
+    expect(isStrongPassword('                ')).toBe(false)
+  })
+
+  it('handles string with unicode characters', () => {
+    // Unicode characters should not count towards special chars
+    expect(isStrongPassword('Abc123üäöéñ')).toBe(false) // too short
+  })
+
+  it('correctly validates password at exact boundary (16 chars)', () => {
+    // Exactly 16 characters with 3 types
+    expect(isStrongPassword('Abcd1234efghijkl')).toBe(true)
+  })
+
+  it('correctly validates password just under boundary (15 chars)', () => {
+    expect(isStrongPassword('Abcd1234efghijk')).toBe(false)
+  })
+})