@flusys/nestjs-auth 7.1.0 → 8.0.0

package/cjs/providers/linkedin.social-provider.js

@@ -1,66 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "linkedInSocialProvider", {
-    enumerable: true,
-    get: function() {
-        return linkedInSocialProvider;
-    }
-});
-const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
-const _oauthhttputil = require("./oauth-http.util");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-const AUTHORIZE_URL = 'https://www.linkedin.com/oauth/v2/authorization';
-const TOKEN_URL = 'https://www.linkedin.com/oauth/v2/accessToken';
-const USERINFO_URL = 'https://api.linkedin.com/v2/userinfo';
-let LinkedInSocialProvider = class LinkedInSocialProvider {
-    buildAuthorizationUrl(credentials, state) {
-        const query = (0, _oauthhttputil.buildQuery)({
-            response_type: 'code',
-            client_id: credentials.clientId,
-            redirect_uri: credentials.redirectUri,
-            scope: (0, _oauthhttputil.resolveScopes)(credentials, this.defaultScopes),
-            state
-        });
-        return `${AUTHORIZE_URL}?${query}`;
-    }
-    async fetchProfile(credentials, code) {
-        const token = await (0, _oauthhttputil.postForm)(this.provider, TOKEN_URL, {
-            grant_type: 'authorization_code',
-            code,
-            client_id: credentials.clientId,
-            client_secret: credentials.clientSecret,
-            redirect_uri: credentials.redirectUri
-        });
-        const profile = await (0, _oauthhttputil.getJson)(this.provider, USERINFO_URL, (0, _oauthhttputil.readAccessToken)(this.provider, token));
-        return {
-            providerUserId: (0, _oauthhttputil.readString)(profile, 'sub') ?? '',
-            email: (0, _oauthhttputil.readString)(profile, 'email'),
-            emailVerified: profile['email_verified'] === true,
-            name: (0, _oauthhttputil.readString)(profile, 'name'),
-            avatarUrl: (0, _oauthhttputil.readString)(profile, 'picture')
-        };
-    }
-    constructor(){
-        _define_property(this, "provider", _socialprovidertypeenum.SocialProviderTypeEnum.LINKEDIN);
-        _define_property(this, "defaultScopes", [
-            'openid',
-            'profile',
-            'email'
-        ]);
-    }
-};
-const linkedInSocialProvider = new LinkedInSocialProvider();

package/cjs/providers/microsoft.social-provider.js

@@ -1,78 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "microsoftSocialProvider", {
-    enumerable: true,
-    get: function() {
-        return microsoftSocialProvider;
-    }
-});
-const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
-const _oauthhttputil = require("./oauth-http.util");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-const GRAPH_ME_URL = 'https://graph.microsoft.com/v1.0/me';
-const DEFAULT_TENANT = 'common';
-function resolveTenant(credentials) {
-    const tenantId = credentials.extraConfig?.['tenantId'];
-    return typeof tenantId === 'string' && tenantId ? tenantId : DEFAULT_TENANT;
-}
-function endpoint(credentials, action) {
-    return `https://login.microsoftonline.com/${resolveTenant(credentials)}/oauth2/v2.0/${action}`;
-}
-let MicrosoftSocialProvider = class MicrosoftSocialProvider {
-    buildAuthorizationUrl(credentials, state) {
-        const query = (0, _oauthhttputil.buildQuery)({
-            client_id: credentials.clientId,
-            response_type: 'code',
-            redirect_uri: credentials.redirectUri,
-            response_mode: 'query',
-            scope: (0, _oauthhttputil.resolveScopes)(credentials, this.defaultScopes),
-            state
-        });
-        return `${endpoint(credentials, 'authorize')}?${query}`;
-    }
-    async fetchProfile(credentials, code) {
-        const token = await (0, _oauthhttputil.postForm)(this.provider, endpoint(credentials, 'token'), {
-            client_id: credentials.clientId,
-            client_secret: credentials.clientSecret,
-            code,
-            redirect_uri: credentials.redirectUri,
-            grant_type: 'authorization_code',
-            scope: (0, _oauthhttputil.resolveScopes)(credentials, this.defaultScopes)
-        });
-        const profile = await (0, _oauthhttputil.getJson)(this.provider, GRAPH_ME_URL, (0, _oauthhttputil.readAccessToken)(this.provider, token));
-        // `mail` is Microsoft's confirmed mailbox claim; `userPrincipalName` is a sign-in
-        // identifier that is not guaranteed to be a verified, owned mailbox address.
-        const verifiedEmail = (0, _oauthhttputil.readString)(profile, 'mail');
-        return {
-            providerUserId: (0, _oauthhttputil.readString)(profile, 'id') ?? '',
-            email: verifiedEmail ?? (0, _oauthhttputil.readString)(profile, 'userPrincipalName'),
-            emailVerified: !!verifiedEmail,
-            name: (0, _oauthhttputil.readString)(profile, 'displayName'),
-            avatarUrl: null
-        };
-    }
-    constructor(){
-        _define_property(this, "provider", _socialprovidertypeenum.SocialProviderTypeEnum.MICROSOFT);
-        _define_property(this, "defaultScopes", [
-            'openid',
-            'profile',
-            'email',
-            'User.Read'
-        ]);
-    }
-};
-const microsoftSocialProvider = new MicrosoftSocialProvider();

package/cjs/providers/oauth-http.util.js

@@ -1,107 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get buildQuery () {
-        return buildQuery;
-    },
-    get getJson () {
-        return getJson;
-    },
-    get postForm () {
-        return postForm;
-    },
-    get readAccessToken () {
-        return readAccessToken;
-    },
-    get readString () {
-        return readString;
-    },
-    get resolveScopes () {
-        return resolveScopes;
-    }
-});
-const _common = require("@nestjs/common");
-const _messagekeys = require("../config/message-keys");
-const OAUTH_HTTP_TIMEOUT_MS = 10_000;
-function failExchange(provider, detail) {
-    throw new _common.UnauthorizedException({
-        message: `Social sign-in with ${provider} failed: ${detail}`,
-        messageKey: _messagekeys.SOCIAL_AUTH_MESSAGES.EXCHANGE_FAILED,
-        messageVariables: {
-            provider
-        }
-    });
-}
-async function fetchWithTimeout(provider, url, init) {
-    try {
-        return await fetch(url, {
-            ...init,
-            signal: AbortSignal.timeout(OAUTH_HTTP_TIMEOUT_MS)
-        });
-    } catch (error) {
-        if (error instanceof Error && error.name === 'TimeoutError') {
-            failExchange(provider, 'request timed out');
-        }
-        throw error;
-    }
-}
-async function readJson(provider, response) {
-    const body = await response.text();
-    if (!response.ok) {
-        failExchange(provider, `${response.status} ${body.slice(0, 200)}`);
-    }
-    try {
-        return JSON.parse(body);
-    } catch  {
-        return failExchange(provider, 'response was not JSON');
-    }
-}
-async function postForm(provider, url, form) {
-    const response = await fetchWithTimeout(provider, url, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/x-www-form-urlencoded',
-            Accept: 'application/json'
-        },
-        body: new URLSearchParams(form).toString()
-    });
-    return readJson(provider, response);
-}
-async function getJson(provider, url, accessToken) {
-    const response = await fetchWithTimeout(provider, url, {
-        headers: {
-            Authorization: `Bearer ${accessToken}`,
-            Accept: 'application/json'
-        }
-    });
-    return readJson(provider, response);
-}
-function readAccessToken(provider, token) {
-    const accessToken = token['access_token'];
-    if (typeof accessToken !== 'string' || !accessToken) {
-        failExchange(provider, 'no access token returned');
-    }
-    return accessToken;
-}
-function readString(source, key) {
-    const value = source[key];
-    return typeof value === 'string' && value ? value : null;
-}
-function buildQuery(params) {
-    const query = new URLSearchParams();
-    for (const [key, value] of Object.entries(params)){
-        if (value) query.append(key, value);
-    }
-    return query.toString();
-}
-function resolveScopes(credentials, defaults, separator = ' ') {
-    return (credentials.scopes?.length ? credentials.scopes : defaults).join(separator);
-}

package/cjs/providers/social-provider.registry.js

@@ -1,24 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "getSocialProvider", {
-    enumerable: true,
-    get: function() {
-        return getSocialProvider;
-    }
-});
-const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
-const _facebooksocialprovider = require("./facebook.social-provider");
-const _googlesocialprovider = require("./google.social-provider");
-const _linkedinsocialprovider = require("./linkedin.social-provider");
-const _microsoftsocialprovider = require("./microsoft.social-provider");
-const PROVIDERS = {
-    [_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE]: _googlesocialprovider.googleSocialProvider,
-    [_socialprovidertypeenum.SocialProviderTypeEnum.FACEBOOK]: _facebooksocialprovider.facebookSocialProvider,
-    [_socialprovidertypeenum.SocialProviderTypeEnum.LINKEDIN]: _linkedinsocialprovider.linkedInSocialProvider,
-    [_socialprovidertypeenum.SocialProviderTypeEnum.MICROSOFT]: _microsoftsocialprovider.microsoftSocialProvider
-};
-function getSocialProvider(provider) {
-    return PROVIDERS[provider];
-}

package/cjs/providers/social-provider.registry.spec.js

@@ -1,135 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _common = require("@nestjs/common");
-const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
-const _socialproviderregistry = require("./social-provider.registry");
-const CREDENTIALS = {
-    clientId: 'client-id',
-    clientSecret: 'client-secret',
-    redirectUri: 'http://localhost:2001/auth/social/callback'
-};
-function mockFetchSequence(...responses) {
-    const fetchMock = jest.fn();
-    for (const response of responses){
-        fetchMock.mockResolvedValueOnce({
-            ok: response.ok ?? true,
-            status: response.status ?? 200,
-            text: async ()=>JSON.stringify(response.body)
-        });
-    }
-    globalThis.fetch = fetchMock;
-    return fetchMock;
-}
-describe('social providers', ()=>{
-    afterEach(()=>jest.restoreAllMocks());
-    describe('buildAuthorizationUrl', ()=>{
-        it.each(Object.values(_socialprovidertypeenum.SocialProviderTypeEnum))('carries the client id, redirect URI and state for %s', (provider)=>{
-            const url = new URL((0, _socialproviderregistry.getSocialProvider)(provider).buildAuthorizationUrl(CREDENTIALS, 'state-token'));
-            expect(url.searchParams.get('client_id')).toBe('client-id');
-            expect(url.searchParams.get('redirect_uri')).toBe(CREDENTIALS.redirectUri);
-            expect(url.searchParams.get('state')).toBe('state-token');
-            expect(url.searchParams.get('scope')).toBeTruthy();
-        });
-        it('uses the configured scopes over the provider defaults', ()=>{
-            const url = new URL((0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE).buildAuthorizationUrl({
-                ...CREDENTIALS,
-                scopes: [
-                    'openid',
-                    'email'
-                ]
-            }, 'state-token'));
-            expect(url.searchParams.get('scope')).toBe('openid email');
-        });
-        it('targets the common Microsoft directory unless a tenant is configured', ()=>{
-            const provider = (0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.MICROSOFT);
-            expect(provider.buildAuthorizationUrl(CREDENTIALS, 'state-token')).toContain('login.microsoftonline.com/common/');
-            expect(provider.buildAuthorizationUrl({
-                ...CREDENTIALS,
-                extraConfig: {
-                    tenantId: 'contoso'
-                }
-            }, 'state-token')).toContain('login.microsoftonline.com/contoso/');
-        });
-    });
-    describe('fetchProfile', ()=>{
-        it('normalises a Google OpenID profile', async ()=>{
-            mockFetchSequence({
-                body: {
-                    access_token: 'token'
-                }
-            }, {
-                body: {
-                    sub: 'google-1',
-                    email: 'user@example.com',
-                    email_verified: true,
-                    name: 'Test User',
-                    picture: 'https://cdn.test/avatar.png'
-                }
-            });
-            const profile = await (0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE).fetchProfile(CREDENTIALS, 'code');
-            expect(profile).toEqual({
-                providerUserId: 'google-1',
-                email: 'user@example.com',
-                emailVerified: true,
-                name: 'Test User',
-                avatarUrl: 'https://cdn.test/avatar.png'
-            });
-        });
-        it('reads the nested avatar Facebook returns', async ()=>{
-            mockFetchSequence({
-                body: {
-                    access_token: 'token'
-                }
-            }, {
-                body: {
-                    id: 'fb-1',
-                    name: 'Test User',
-                    email: 'user@example.com',
-                    picture: {
-                        data: {
-                            url: 'https://cdn.test/fb.png'
-                        }
-                    }
-                }
-            });
-            const profile = await (0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.FACEBOOK).fetchProfile(CREDENTIALS, 'code');
-            expect(profile.avatarUrl).toBe('https://cdn.test/fb.png');
-            expect(profile.emailVerified).toBe(true);
-        });
-        it('falls back to the Microsoft principal name when no mailbox is set', async ()=>{
-            mockFetchSequence({
-                body: {
-                    access_token: 'token'
-                }
-            }, {
-                body: {
-                    id: 'ms-1',
-                    displayName: 'Test User',
-                    userPrincipalName: 'user@contoso.com'
-                }
-            });
-            const profile = await (0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.MICROSOFT).fetchProfile(CREDENTIALS, 'code');
-            expect(profile.email).toBe('user@contoso.com');
-        });
-        it('rejects when the token endpoint fails', async ()=>{
-            mockFetchSequence({
-                ok: false,
-                status: 400,
-                body: {
-                    error: 'invalid_grant'
-                }
-            });
-            await expect((0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.LINKEDIN).fetchProfile(CREDENTIALS, 'code')).rejects.toThrow(_common.UnauthorizedException);
-        });
-        it('rejects when the token response carries no access token', async ()=>{
-            mockFetchSequence({
-                body: {
-                    token_type: 'bearer'
-                }
-            });
-            await expect((0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE).fetchProfile(CREDENTIALS, 'code')).rejects.toThrow(_common.UnauthorizedException);
-        });
-    });
-});

package/cjs/services/auth-config.service.js

@@ -1,113 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "AuthConfigService", {
-    enumerable: true,
-    get: function() {
-        return AuthConfigService;
-    }
-});
-const _config = require("@flusys/nestjs-core/config");
-const _constants = require("@flusys/nestjs-shared/constants");
-const _common = require("@nestjs/common");
-const _authconstants = require("../config/auth.constants");
-const _authmoduleoptionsinterface = require("../interfaces/auth-module-options.interface");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-let AuthConfigService = class AuthConfigService {
-    // Database Mode (required by IModuleConfigService)
-    getDatabaseMode() {
-        return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
-    }
-    isMultiTenant() {
-        return this.getDatabaseMode() === 'multi-tenant';
-    }
-    // Feature Flags
-    isCompanyFeatureEnabled() {
-        return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
-    }
-    isEmailVerificationEnabled() {
-        return this.options.bootstrapAppConfig?.enableEmailVerification ?? true;
-    }
-    isSignUpEnabled() {
-        return this.options.bootstrapAppConfig?.enableSignUp ?? true;
-    }
-    isPermissionModeFound() {
-        return this.options.bootstrapAppConfig?.permissionMode !== undefined;
-    }
-    // JWT Configuration
-    getJwtSecret() {
-        if (!this.config.jwtSecret) {
-            throw new _common.InternalServerErrorException({
-                message: '[AuthModule] JWT_SECRET is required - set via environment or module config',
-                messageKey: _constants.SYSTEM_MESSAGES.CONFIG_REQUIRED
-            });
-        }
-        return this.config.jwtSecret;
-    }
-    getJwtExpiration() {
-        return this.config.jwtExpiration ?? '1h';
-    }
-    getRefreshTokenSecret() {
-        if (this.config.refreshTokenSecret) {
-            return this.config.refreshTokenSecret;
-        }
-        if (_config.envConfig.isProduction()) {
-            throw new _common.InternalServerErrorException({
-                message: '[AuthModule] REFRESH_TOKEN_SECRET is required in production - using the same secret for access and refresh tokens is a security risk',
-                messageKey: _constants.SYSTEM_MESSAGES.CONFIG_REQUIRED
-            });
-        }
-        return this.getJwtSecret();
-    }
-    getRefreshTokenExpiration() {
-        return this.config.refreshTokenExpiration ?? '7d';
-    }
-    getRefreshTokenCookieName() {
-        return this.config.refreshTokenCookieName ?? 'fsn_refresh_token';
-    }
-    constructor(injectedOptions){
-        _define_property(this, "options", void 0);
-        _define_property(this, "config", void 0);
-        this.options = injectedOptions ?? {
-            global: false,
-            includeController: true
-        };
-        this.config = this.options.config ?? {};
-    }
-};
-AuthConfigService = _ts_decorate([
-    (0, _common.Injectable)(),
-    _ts_param(0, (0, _common.Optional)()),
-    _ts_param(0, (0, _common.Inject)(_authconstants.AUTH_MODULE_OPTIONS)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _authmoduleoptionsinterface.AuthModuleOptions === "undefined" ? Object : _authmoduleoptionsinterface.AuthModuleOptions
-    ])
-], AuthConfigService);

package/cjs/services/auth-config.service.spec.js

@@ -1,100 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _common = require("@nestjs/common");
-const _config = require("@flusys/nestjs-core/config");
-const _authconfigservice = require("./auth-config.service");
-jest.mock('@flusys/nestjs-core/config', ()=>({
-        envConfig: {
-            isProduction: jest.fn().mockReturnValue(false)
-        }
-    }));
-describe('AuthConfigService', ()=>{
-    afterEach(()=>{
-        jest.clearAllMocks();
-    });
-    describe('with no injected options', ()=>{
-        it('defaults database mode to single and company feature to disabled', ()=>{
-            const service = new _authconfigservice.AuthConfigService();
-            expect(service.getDatabaseMode()).toBe('single');
-            expect(service.isMultiTenant()).toBe(false);
-            expect(service.isCompanyFeatureEnabled()).toBe(false);
-            expect(service.isEmailVerificationEnabled()).toBe(true);
-            expect(service.isSignUpEnabled()).toBe(true);
-            expect(service.isPermissionModeFound()).toBe(false);
-        });
-        it('throws when reading the JWT secret without configuration', ()=>{
-            const service = new _authconfigservice.AuthConfigService();
-            expect(()=>service.getJwtSecret()).toThrow(_common.InternalServerErrorException);
-        });
-        it('falls back to the JWT secret for refresh token secret outside production', ()=>{
-            const service = new _authconfigservice.AuthConfigService({
-                global: false,
-                includeController: true,
-                config: {
-                    jwtSecret: 'shared-secret'
-                }
-            });
-            expect(service.getRefreshTokenSecret()).toBe('shared-secret');
-        });
-        it('returns default JWT expiration and refresh token expiration', ()=>{
-            const service = new _authconfigservice.AuthConfigService();
-            expect(service.getJwtExpiration()).toBe('1h');
-            expect(service.getRefreshTokenExpiration()).toBe('7d');
-            expect(service.getRefreshTokenCookieName()).toBe('fsn_refresh_token');
-        });
-    });
-    describe('with injected options', ()=>{
-        function buildOptions(overrides = {}) {
-            return {
-                global: false,
-                includeController: true,
-                bootstrapAppConfig: {
-                    databaseMode: 'multi-tenant',
-                    enableCompanyFeature: true,
-                    enableEmailVerification: false,
-                    enableSignUp: false,
-                    permissionMode: 'RBAC'
-                },
-                config: {
-                    jwtSecret: 'jwt-secret',
-                    jwtExpiration: '30m',
-                    refreshTokenSecret: 'refresh-secret',
-                    refreshTokenExpiration: '14d',
-                    refreshTokenCookieName: 'custom_cookie'
-                },
-                ...overrides
-            };
-        }
-        it('reflects multi-tenant database mode', ()=>{
-            const service = new _authconfigservice.AuthConfigService(buildOptions());
-            expect(service.getDatabaseMode()).toBe('multi-tenant');
-            expect(service.isMultiTenant()).toBe(true);
-        });
-        it('reflects enabled company feature and email verification flags', ()=>{
-            const service = new _authconfigservice.AuthConfigService(buildOptions());
-            expect(service.isCompanyFeatureEnabled()).toBe(true);
-            expect(service.isEmailVerificationEnabled()).toBe(false);
-            expect(service.isSignUpEnabled()).toBe(false);
-            expect(service.isPermissionModeFound()).toBe(true);
-        });
-        it('returns configured JWT and refresh token values', ()=>{
-            const service = new _authconfigservice.AuthConfigService(buildOptions());
-            expect(service.getJwtSecret()).toBe('jwt-secret');
-            expect(service.getJwtExpiration()).toBe('30m');
-            expect(service.getRefreshTokenSecret()).toBe('refresh-secret');
-            expect(service.getRefreshTokenExpiration()).toBe('14d');
-            expect(service.getRefreshTokenCookieName()).toBe('custom_cookie');
-        });
-        it('throws in production when refresh token secret is missing (security: prevents shared-secret fallback)', ()=>{
-            _config.envConfig.isProduction.mockReturnValue(true);
-            const service = new _authconfigservice.AuthConfigService(buildOptions({
-                config: {
-                    jwtSecret: 'jwt-secret'
-                }
-            }));
-            expect(()=>service.getRefreshTokenSecret()).toThrow(_common.InternalServerErrorException);
-        });
-    });
-});