@flusys/nestjs-auth 6.0.1 → 6.1.0

package/fesm/helpers/token.helper.spec.js

@@ -0,0 +1,82 @@
+import { generateTokens, parseExpiryToMs } from './token.helper';
+describe('token.helper', ()=>{
+    describe('generateTokens', ()=>{
+        let mockJwtService;
+        let mockAuthConfig;
+        beforeEach(()=>{
+            mockJwtService = {
+                sign: jest.fn()
+            };
+            mockAuthConfig = {
+                getJwtSecret: jest.fn().mockReturnValue('jwt-secret'),
+                getJwtExpiration: jest.fn().mockReturnValue('1h'),
+                getRefreshTokenSecret: jest.fn().mockReturnValue('refresh-secret'),
+                getRefreshTokenExpiration: jest.fn().mockReturnValue('7d')
+            };
+        });
+        it('signs an access token and a refresh token with distinct secrets', ()=>{
+            mockJwtService.sign.mockReturnValueOnce('access-token-value').mockReturnValueOnce('refresh-token-value');
+            const result = generateTokens(mockJwtService, mockAuthConfig, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            });
+            expect(result).toEqual({
+                accessToken: 'access-token-value',
+                refreshToken: 'refresh-token-value'
+            });
+            expect(mockJwtService.sign).toHaveBeenNthCalledWith(1, expect.objectContaining({
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            }), expect.objectContaining({
+                secret: 'jwt-secret',
+                expiresIn: '1h',
+                algorithm: 'HS256'
+            }));
+            expect(mockJwtService.sign).toHaveBeenNthCalledWith(2, expect.objectContaining({
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'refresh'
+            }), expect.objectContaining({
+                secret: 'refresh-secret',
+                expiresIn: '7d',
+                algorithm: 'HS256'
+            }));
+        });
+        it('includes companyId and branchId in the signed payload when provided', ()=>{
+            mockJwtService.sign.mockReturnValue('token');
+            generateTokens(mockJwtService, mockAuthConfig, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access',
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            });
+            expect(mockJwtService.sign).toHaveBeenCalledWith(expect.objectContaining({
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            }), expect.anything());
+        });
+    });
+    describe('parseExpiryToMs', ()=>{
+        it('parses seconds', ()=>{
+            expect(parseExpiryToMs('30s')).toBe(30 * 1000);
+        });
+        it('parses minutes', ()=>{
+            expect(parseExpiryToMs('15m')).toBe(15 * 60 * 1000);
+        });
+        it('parses hours', ()=>{
+            expect(parseExpiryToMs('2h')).toBe(2 * 60 * 60 * 1000);
+        });
+        it('parses days', ()=>{
+            expect(parseExpiryToMs('7d')).toBe(7 * 24 * 60 * 60 * 1000);
+        });
+        it('falls back to 7 days for an unparsable value', ()=>{
+            expect(parseExpiryToMs('not-a-duration')).toBe(7 * 24 * 60 * 60 * 1000);
+        });
+        it('falls back to 7 days for an unknown unit', ()=>{
+            expect(parseExpiryToMs('5y')).toBe(7 * 24 * 60 * 60 * 1000);
+        });
+    });
+});

package/fesm/index.js

@@ -4,6 +4,7 @@ export * from './docs';
 export * from './dtos';
 export * from './entities';
 export * from './enums';
+export * from './helpers';
 export * from './interceptors';
 export * from './interfaces';
 export * from './modules';

package/fesm/interceptors/clear-token.interceptor.spec.js

@@ -0,0 +1,103 @@
+import { of } from 'rxjs';
+import { ClearToken } from './clear-token.interceptor';
+import { DEFAULT_COOKIE_NAME } from '../config';
+function buildContext(req, res) {
+    return {
+        switchToHttp: ()=>({
+                getRequest: ()=>req,
+                getResponse: ()=>res
+            })
+    };
+}
+function buildCallHandler(value) {
+    return {
+        handle: ()=>of(value)
+    };
+}
+describe('ClearToken', ()=>{
+    let mockAuthConfig;
+    beforeEach(()=>{
+        mockAuthConfig = {
+            getRefreshTokenCookieName: jest.fn().mockReturnValue('custom_refresh_token')
+        };
+    });
+    it('clears the cookie for a browser request', (done)=>{
+        const interceptor = new ClearToken(mockAuthConfig);
+        const clearCookie = jest.fn();
+        const req = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 Chrome/1.0'
+            }
+        };
+        const res = {
+            clearCookie
+        };
+        interceptor.intercept(buildContext(req, res), buildCallHandler({
+            success: true
+        })).subscribe((result)=>{
+            expect(clearCookie).toHaveBeenCalledWith('custom_refresh_token', expect.objectContaining({
+                httpOnly: true,
+                path: '/'
+            }));
+            expect(result).toEqual({
+                success: true
+            });
+            done();
+        });
+    });
+    it('does not clear the cookie for a non-browser (API) request', (done)=>{
+        const interceptor = new ClearToken(mockAuthConfig);
+        const clearCookie = jest.fn();
+        const req = {
+            headers: {
+                'user-agent': 'PostmanRuntime/7.0'
+            }
+        };
+        const res = {
+            clearCookie
+        };
+        interceptor.intercept(buildContext(req, res), buildCallHandler({
+            success: true
+        })).subscribe(()=>{
+            expect(clearCookie).not.toHaveBeenCalled();
+            done();
+        });
+    });
+    it('falls back to the default cookie name when authConfig is unavailable', (done)=>{
+        const interceptor = new ClearToken(undefined);
+        const clearCookie = jest.fn();
+        const req = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 Chrome/1.0'
+            }
+        };
+        const res = {
+            clearCookie
+        };
+        interceptor.intercept(buildContext(req, res), buildCallHandler({
+            success: true
+        })).subscribe(()=>{
+            expect(clearCookie).toHaveBeenCalledWith(DEFAULT_COOKIE_NAME, expect.anything());
+            done();
+        });
+    });
+    it('passes through the emitted value unchanged', (done)=>{
+        const interceptor = new ClearToken(mockAuthConfig);
+        const req = {
+            headers: {
+                'user-agent': 'PostmanRuntime/7.0'
+            }
+        };
+        const res = {
+            clearCookie: jest.fn()
+        };
+        const payload = {
+            success: true,
+            message: 'Logged out successfully'
+        };
+        interceptor.intercept(buildContext(req, res), buildCallHandler(payload)).subscribe((result)=>{
+            expect(result).toBe(payload);
+            done();
+        });
+    });
+});

package/fesm/interceptors/set-token.interceptor.spec.js

@@ -0,0 +1,161 @@
+import { PayloadTooLargeException } from '@nestjs/common';
+import { of } from 'rxjs';
+import { SetToken } from './set-token.interceptor';
+import { DEFAULT_COOKIE_NAME } from '../config';
+function buildContext(req, res) {
+    return {
+        switchToHttp: ()=>({
+                getRequest: ()=>req,
+                getResponse: ()=>res
+            })
+    };
+}
+function buildCallHandler(value) {
+    return {
+        handle: ()=>of(value)
+    };
+}
+const browserReq = {
+    headers: {
+        'user-agent': 'Mozilla/5.0 Chrome/1.0'
+    }
+};
+const apiReq = {
+    headers: {
+        'user-agent': 'PostmanRuntime/7.0'
+    }
+};
+describe('SetToken', ()=>{
+    let mockAuthConfig;
+    beforeEach(()=>{
+        mockAuthConfig = {
+            getRefreshTokenCookieName: jest.fn().mockReturnValue('custom_refresh_token'),
+            getRefreshTokenExpiration: jest.fn().mockReturnValue('7d')
+        };
+    });
+    it('sets a refresh token cookie and strips refreshToken from data for browser requests', (done)=>{
+        const interceptor = new SetToken(mockAuthConfig);
+        const cookie = jest.fn();
+        const res = {
+            cookie
+        };
+        const payload = {
+            success: true,
+            data: {
+                accessToken: 'access-1',
+                refreshToken: 'refresh-1',
+                user: {
+                    id: 'u1'
+                }
+            }
+        };
+        interceptor.intercept(buildContext(browserReq, res), buildCallHandler(payload)).subscribe((result)=>{
+            expect(cookie).toHaveBeenCalledWith('custom_refresh_token', 'refresh-1', expect.objectContaining({
+                httpOnly: true,
+                path: '/'
+            }));
+            expect(result).toEqual({
+                success: true,
+                data: {
+                    accessToken: 'access-1',
+                    user: {
+                        id: 'u1'
+                    }
+                }
+            });
+            expect(result.data.refreshToken).toBeUndefined();
+            done();
+        });
+    });
+    it('does not set a cookie or modify data for non-browser (API) requests', (done)=>{
+        const interceptor = new SetToken(mockAuthConfig);
+        const cookie = jest.fn();
+        const res = {
+            cookie
+        };
+        const payload = {
+            success: true,
+            data: {
+                accessToken: 'access-1',
+                refreshToken: 'refresh-1'
+            }
+        };
+        interceptor.intercept(buildContext(apiReq, res), buildCallHandler(payload)).subscribe((result)=>{
+            expect(cookie).not.toHaveBeenCalled();
+            expect(result).toBe(payload);
+            done();
+        });
+    });
+    it('passes through non-object values unchanged', (done)=>{
+        const interceptor = new SetToken(mockAuthConfig);
+        const res = {
+            cookie: jest.fn()
+        };
+        interceptor.intercept(buildContext(browserReq, res), buildCallHandler('plain-string')).subscribe((result)=>{
+            expect(result).toBe('plain-string');
+            done();
+        });
+    });
+    it('passes through null values unchanged', (done)=>{
+        const interceptor = new SetToken(mockAuthConfig);
+        const res = {
+            cookie: jest.fn()
+        };
+        interceptor.intercept(buildContext(browserReq, res), buildCallHandler(null)).subscribe((result)=>{
+            expect(result).toBeNull();
+            done();
+        });
+    });
+    it('passes through values without a refreshToken in data unchanged', (done)=>{
+        const interceptor = new SetToken(mockAuthConfig);
+        const cookie = jest.fn();
+        const res = {
+            cookie
+        };
+        const payload = {
+            success: true,
+            data: {
+                accessToken: 'access-1'
+            }
+        };
+        interceptor.intercept(buildContext(browserReq, res), buildCallHandler(payload)).subscribe((result)=>{
+            expect(cookie).not.toHaveBeenCalled();
+            expect(result).toBe(payload);
+            done();
+        });
+    });
+    it('falls back to the default cookie name when authConfig is unavailable', (done)=>{
+        const interceptor = new SetToken(undefined);
+        const cookie = jest.fn();
+        const res = {
+            cookie
+        };
+        const payload = {
+            data: {
+                refreshToken: 'refresh-1'
+            }
+        };
+        interceptor.intercept(buildContext(browserReq, res), buildCallHandler(payload)).subscribe(()=>{
+            expect(cookie).toHaveBeenCalledWith(DEFAULT_COOKIE_NAME, 'refresh-1', expect.anything());
+            done();
+        });
+    });
+    it('throws PayloadTooLargeException when the refresh token exceeds the max cookie size', (done)=>{
+        const interceptor = new SetToken(mockAuthConfig);
+        const res = {
+            cookie: jest.fn()
+        };
+        const oversizedToken = 'a'.repeat(4000);
+        const payload = {
+            data: {
+                refreshToken: oversizedToken
+            }
+        };
+        interceptor.intercept(buildContext(browserReq, res), buildCallHandler(payload)).subscribe({
+            error: (err)=>{
+                expect(err).toBeInstanceOf(PayloadTooLargeException);
+                done();
+            }
+        });
+    });
+});

package/fesm/interfaces/authentication.interface.js

@@ -1 +1 @@
-/** Login Response when email verification is required */ export { };
+/** Company/branch selection or creation data supplied during registration */ export { };

package/fesm/modules/auth.module.spec.js

@@ -0,0 +1,239 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+import { AuthModule } from './auth.module';
+import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
+import { AuthenticationController, BranchController, CompanyController, CompanySelectionController, EmailVerificationController, UserController, UserPermissionController } from '../controllers';
+import { AuthEmailService, BranchService, CompanySelectionSessionService, CompanyService, UserPermissionService } from '../services';
+function providerTokens(providers) {
+    return providers.map((p)=>typeof p === 'function' ? p : p.provide);
+}
+describe('AuthModule', ()=>{
+    describe('forRoot', ()=>{
+        it('should build a non-global module by default with the minimal feature set', ()=>{
+            const dynamicModule = AuthModule.forRoot({
+                bootstrapAppConfig: {
+                    enableEmailVerification: false
+                }
+            });
+            expect(dynamicModule.module).toBe(AuthModule);
+            expect(dynamicModule.global).toBe(false);
+            expect(dynamicModule.controllers).toEqual([
+                AuthenticationController,
+                UserController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).not.toContain(AuthEmailService);
+            expect(providerTokens(dynamicModule.providers)).not.toContain(CompanyService);
+        });
+        it('should respect global: true', ()=>{
+            const dynamicModule = AuthModule.forRoot({
+                global: true
+            });
+            expect(dynamicModule.global).toBe(true);
+        });
+        it('should register no controllers when includeController is false', ()=>{
+            const dynamicModule = AuthModule.forRoot({
+                includeController: false
+            });
+            expect(dynamicModule.controllers).toEqual([]);
+        });
+        it('should enable email verification by default (bootstrapAppConfig omitted)', ()=>{
+            const dynamicModule = AuthModule.forRoot({});
+            expect(dynamicModule.controllers).toContain(EmailVerificationController);
+            expect(providerTokens(dynamicModule.providers)).toContain(AuthEmailService);
+            expect(dynamicModule.exports).toContain(AuthEmailService);
+        });
+        it('should omit email verification controller/provider/export when explicitly disabled', ()=>{
+            const dynamicModule = AuthModule.forRoot({
+                bootstrapAppConfig: {
+                    enableEmailVerification: false
+                }
+            });
+            expect(dynamicModule.controllers).not.toContain(EmailVerificationController);
+            expect(providerTokens(dynamicModule.providers)).not.toContain(AuthEmailService);
+            expect(dynamicModule.exports).not.toContain(AuthEmailService);
+        });
+        it('should add company controllers/providers/exports when enableCompanyFeature is true', ()=>{
+            const dynamicModule = AuthModule.forRoot({
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                CompanySelectionController,
+                CompanyController,
+                BranchController,
+                UserPermissionController
+            ]));
+            expect(providerTokens(dynamicModule.providers)).toEqual(expect.arrayContaining([
+                CompanySelectionSessionService,
+                CompanyService,
+                BranchService,
+                UserPermissionService
+            ]));
+            expect(dynamicModule.exports).toEqual(expect.arrayContaining([
+                CompanyService,
+                BranchService,
+                UserPermissionService
+            ]));
+        });
+        it('should register an AUTH_MODULE_OPTIONS provider carrying the given options', ()=>{
+            const options = {
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            };
+            const dynamicModule = AuthModule.forRoot(options);
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === AUTH_MODULE_OPTIONS);
+            expect(optionsProvider.useValue).toBe(options);
+        });
+        it('should append any caller-supplied extra providers', ()=>{
+            const extraProvider = {
+                provide: 'EXTRA',
+                useValue: 'x'
+            };
+            const dynamicModule = AuthModule.forRoot({
+                providers: [
+                    extraProvider
+                ]
+            });
+            expect(dynamicModule.providers).toEqual(expect.arrayContaining([
+                extraProvider
+            ]));
+        });
+    });
+    describe('forRootAsync', ()=>{
+        it('should default AUTH_MODULE_OPTIONS to the static options when no useFactory/useClass/useExisting is given', async ()=>{
+            const dynamicModule = AuthModule.forRootAsync({
+                bootstrapAppConfig: {},
+                global: true
+            });
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === AUTH_MODULE_OPTIONS);
+            expect(optionsProvider.useValue).toEqual({
+                global: true,
+                includeController: undefined,
+                bootstrapAppConfig: {}
+            });
+        });
+        it('should resolve config via useFactory and merge it with the static options', async ()=>{
+            const useFactory = jest.fn().mockResolvedValue({
+                jwtSecret: 'from-factory'
+            });
+            const dynamicModule = AuthModule.forRootAsync({
+                bootstrapAppConfig: {},
+                useFactory,
+                inject: [
+                    'SOME_TOKEN'
+                ]
+            });
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === AUTH_MODULE_OPTIONS);
+            expect(optionsProvider.inject).toEqual([
+                'SOME_TOKEN'
+            ]);
+            const resolved = await optionsProvider.useFactory('injected-value');
+            expect(useFactory).toHaveBeenCalledWith('injected-value');
+            expect(resolved).toEqual({
+                global: undefined,
+                includeController: undefined,
+                bootstrapAppConfig: {},
+                config: {
+                    jwtSecret: 'from-factory'
+                }
+            });
+        });
+        it('should resolve config via a useClass factory', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createAuthOptions", jest.fn().mockResolvedValue({
+                        jwtSecret: 'from-class'
+                    }));
+                }
+            };
+            const dynamicModule = AuthModule.forRootAsync({
+                bootstrapAppConfig: {},
+                useClass: MyOptionsFactory
+            });
+            const classProvider = dynamicModule.providers.find((p)=>p.provide === MyOptionsFactory);
+            expect(classProvider.useClass).toBe(MyOptionsFactory);
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === AUTH_MODULE_OPTIONS);
+            expect(optionsProvider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const factoryInstance = new MyOptionsFactory();
+            const resolved = await optionsProvider.useFactory(factoryInstance);
+            expect(factoryInstance.createAuthOptions).toHaveBeenCalled();
+            expect(resolved.config).toEqual({
+                jwtSecret: 'from-class'
+            });
+        });
+        it('should resolve config via a useExisting factory', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createAuthOptions", jest.fn().mockResolvedValue({
+                        jwtSecret: 'from-existing'
+                    }));
+                }
+            };
+            const dynamicModule = AuthModule.forRootAsync({
+                bootstrapAppConfig: {},
+                useExisting: MyOptionsFactory
+            });
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === AUTH_MODULE_OPTIONS);
+            expect(optionsProvider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const factoryInstance = new MyOptionsFactory();
+            const resolved = await optionsProvider.useFactory(factoryInstance);
+            expect(resolved.config).toEqual({
+                jwtSecret: 'from-existing'
+            });
+        });
+        it('should forward the async `imports` array into the built module', ()=>{
+            let FakeImportedModule = class FakeImportedModule {
+            };
+            const dynamicModule = AuthModule.forRootAsync({
+                bootstrapAppConfig: {},
+                imports: [
+                    FakeImportedModule
+                ]
+            });
+            expect(dynamicModule.imports).toEqual(expect.arrayContaining([
+                FakeImportedModule
+            ]));
+        });
+        it('should append any caller-supplied extra providers alongside the async options provider', ()=>{
+            const extraProvider = {
+                provide: 'EXTRA',
+                useValue: 'x'
+            };
+            const dynamicModule = AuthModule.forRootAsync({
+                bootstrapAppConfig: {},
+                providers: [
+                    extraProvider
+                ]
+            });
+            expect(dynamicModule.providers).toEqual(expect.arrayContaining([
+                extraProvider
+            ]));
+        });
+    });
+    describe('getEntities', ()=>{
+        it('should delegate to getAuthEntitiesByConfig with the bootstrap flags', ()=>{
+            const entitiesWithDefaults = AuthModule.getEntities({});
+            const entitiesWithCompany = AuthModule.getEntities({
+                enableCompanyFeature: true
+            });
+            expect(entitiesWithDefaults.length).toBeLessThan(entitiesWithCompany.length);
+        });
+    });
+});

package/fesm/services/auth-config.service.spec.js

@@ -0,0 +1,93 @@
+import { InternalServerErrorException } from '@nestjs/common';
+import { envConfig } from '@flusys/nestjs-core/config';
+import { AuthConfigService } from './auth-config.service';
+jest.mock('@flusys/nestjs-core/config', ()=>({
+        envConfig: {
+            isProduction: jest.fn().mockReturnValue(false)
+        }
+    }));
+describe('AuthConfigService', ()=>{
+    afterEach(()=>{
+        jest.clearAllMocks();
+    });
+    describe('with no injected options', ()=>{
+        it('defaults database mode to single and company feature to disabled', ()=>{
+            const service = new AuthConfigService();
+            expect(service.getDatabaseMode()).toBe('single');
+            expect(service.isMultiTenant()).toBe(false);
+            expect(service.isCompanyFeatureEnabled()).toBe(false);
+            expect(service.isEmailVerificationEnabled()).toBe(true);
+            expect(service.isPermissionModeFound()).toBe(false);
+        });
+        it('throws when reading the JWT secret without configuration', ()=>{
+            const service = new AuthConfigService();
+            expect(()=>service.getJwtSecret()).toThrow(InternalServerErrorException);
+        });
+        it('falls back to the JWT secret for refresh token secret outside production', ()=>{
+            const service = new AuthConfigService({
+                global: false,
+                includeController: true,
+                config: {
+                    jwtSecret: 'shared-secret'
+                }
+            });
+            expect(service.getRefreshTokenSecret()).toBe('shared-secret');
+        });
+        it('returns default JWT expiration and refresh token expiration', ()=>{
+            const service = new AuthConfigService();
+            expect(service.getJwtExpiration()).toBe('1h');
+            expect(service.getRefreshTokenExpiration()).toBe('7d');
+            expect(service.getRefreshTokenCookieName()).toBe('fsn_refresh_token');
+        });
+    });
+    describe('with injected options', ()=>{
+        function buildOptions(overrides = {}) {
+            return {
+                global: false,
+                includeController: true,
+                bootstrapAppConfig: {
+                    databaseMode: 'multi-tenant',
+                    enableCompanyFeature: true,
+                    enableEmailVerification: false,
+                    permissionMode: 'RBAC'
+                },
+                config: {
+                    jwtSecret: 'jwt-secret',
+                    jwtExpiration: '30m',
+                    refreshTokenSecret: 'refresh-secret',
+                    refreshTokenExpiration: '14d',
+                    refreshTokenCookieName: 'custom_cookie'
+                },
+                ...overrides
+            };
+        }
+        it('reflects multi-tenant database mode', ()=>{
+            const service = new AuthConfigService(buildOptions());
+            expect(service.getDatabaseMode()).toBe('multi-tenant');
+            expect(service.isMultiTenant()).toBe(true);
+        });
+        it('reflects enabled company feature and email verification flags', ()=>{
+            const service = new AuthConfigService(buildOptions());
+            expect(service.isCompanyFeatureEnabled()).toBe(true);
+            expect(service.isEmailVerificationEnabled()).toBe(false);
+            expect(service.isPermissionModeFound()).toBe(true);
+        });
+        it('returns configured JWT and refresh token values', ()=>{
+            const service = new AuthConfigService(buildOptions());
+            expect(service.getJwtSecret()).toBe('jwt-secret');
+            expect(service.getJwtExpiration()).toBe('30m');
+            expect(service.getRefreshTokenSecret()).toBe('refresh-secret');
+            expect(service.getRefreshTokenExpiration()).toBe('14d');
+            expect(service.getRefreshTokenCookieName()).toBe('custom_cookie');
+        });
+        it('throws in production when refresh token secret is missing (security: prevents shared-secret fallback)', ()=>{
+            envConfig.isProduction.mockReturnValue(true);
+            const service = new AuthConfigService(buildOptions({
+                config: {
+                    jwtSecret: 'jwt-secret'
+                }
+            }));
+            expect(()=>service.getRefreshTokenSecret()).toThrow(InternalServerErrorException);
+        });
+    });
+});