@flusys/nestjs-shared 6.0.1 → 6.1.0

package/cjs/utils/html-sanitizer.util.spec.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _htmlsanitizerutil = require("./html-sanitizer.util");
+describe('html-sanitizer.util', ()=>{
+    describe('escapeHtml', ()=>{
+        it('should escape all special HTML characters', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtml)('<script>alert("xss")</script>')).toBe('&lt;script&gt;alert(&quot;xss&quot;)&lt;&#x2F;script&gt;');
+        });
+        it('should escape ampersands', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtml)('a & b')).toBe('a &amp; b');
+        });
+        it('should escape single quotes, backticks, and equals signs', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtml)(`a='b' c=\`d\``)).toBe('a&#x3D;&#x27;b&#x27; c&#x3D;&#x60;d&#x60;');
+        });
+        it('should return an empty string for empty input', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtml)('')).toBe('');
+        });
+        it('should return input unchanged when it has no special characters', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtml)('Hello World 123')).toBe('Hello World 123');
+        });
+        it('should return non-string input coerced via nullish fallback', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtml)(null)).toBe('');
+            expect((0, _htmlsanitizerutil.escapeHtml)(undefined)).toBe('');
+        });
+        it('should return non-string, truthy input unchanged (not throw)', ()=>{
+            // e.g. a number passed at runtime despite the TS signature
+            expect((0, _htmlsanitizerutil.escapeHtml)(42)).toBe(42);
+        });
+    });
+    describe('escapeHtmlVariables', ()=>{
+        it('should escape string values', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtmlVariables)({
+                name: '<b>bold</b>'
+            })).toEqual({
+                name: '&lt;b&gt;bold&lt;&#x2F;b&gt;'
+            });
+        });
+        it('should convert numbers and booleans to strings without escaping', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtmlVariables)({
+                count: 5,
+                active: true
+            })).toEqual({
+                count: '5',
+                active: 'true'
+            });
+        });
+        it('should stringify and escape object/array values', ()=>{
+            const result = (0, _htmlsanitizerutil.escapeHtmlVariables)({
+                meta: {
+                    a: '<x>'
+                }
+            });
+            expect(result.meta).toBe((0, _htmlsanitizerutil.escapeHtml)(JSON.stringify({
+                a: '<x>'
+            })));
+        });
+        it('should convert null/undefined values to empty string', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtmlVariables)({
+                a: null,
+                b: undefined
+            })).toEqual({
+                a: '',
+                b: ''
+            });
+        });
+        it('should return an empty object for null/non-object input', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtmlVariables)(null)).toEqual({});
+            expect((0, _htmlsanitizerutil.escapeHtmlVariables)(undefined)).toEqual({});
+        });
+        it('should return an empty object for an empty input object', ()=>{
+            expect((0, _htmlsanitizerutil.escapeHtmlVariables)({})).toEqual({});
+        });
+    });
+});

package/cjs/utils/index.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 _export_star(require("./date-time.util"), exports);
 _export_star(require("./html-sanitizer.util"), exports);
+_export_star(require("./permission-cache-key.util"), exports);
 _export_star(require("./query-helpers.util"), exports);
 _export_star(require("./request.util"), exports);
 _export_star(require("./string.util"), exports);

package/cjs/utils/permission-cache-key.util.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get DEFAULT_COMPANY_PERMISSION_KEY_FORMAT () {
+        return DEFAULT_COMPANY_PERMISSION_KEY_FORMAT;
+    },
+    get DEFAULT_USER_PERMISSION_KEY_FORMAT () {
+        return DEFAULT_USER_PERMISSION_KEY_FORMAT;
+    },
+    get buildPermissionCacheKey () {
+        return buildPermissionCacheKey;
+    }
+});
+const _constants = require("../constants");
+const DEFAULT_USER_PERMISSION_KEY_FORMAT = `${_constants.PERMISSIONS_CACHE_PREFIX}:user:{userId}`;
+const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants.PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`;
+function buildPermissionCacheKey(options, config) {
+    const isCompanyScope = Boolean(config?.enableCompanyFeature && options.companyId);
+    if (isCompanyScope) {
+        return (config?.companyPermissionKeyFormat || DEFAULT_COMPANY_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId).replace('{companyId}', options.companyId).replace('{branchId}', options.branchId || 'null');
+    }
+    return (config?.userPermissionKeyFormat || DEFAULT_USER_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId);
+}

package/cjs/utils/permission-cache-key.util.spec.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _permissioncachekeyutil = require("./permission-cache-key.util");
+describe('permission-cache-key.util', ()=>{
+    describe('buildPermissionCacheKey', ()=>{
+        it('should build a user-scoped key when no config is provided', ()=>{
+            const key = (0, _permissioncachekeyutil.buildPermissionCacheKey)({
+                userId: 'user-1'
+            });
+            expect(key).toBe(_permissioncachekeyutil.DEFAULT_USER_PERMISSION_KEY_FORMAT.replace('{userId}', 'user-1'));
+        });
+        it('should build a user-scoped key when company feature is disabled', ()=>{
+            const key = (0, _permissioncachekeyutil.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1'
+            }, {
+                enableCompanyFeature: false
+            });
+            expect(key).toBe(_permissioncachekeyutil.DEFAULT_USER_PERMISSION_KEY_FORMAT.replace('{userId}', 'user-1'));
+        });
+        it('should build a user-scoped key when company feature enabled but no companyId given', ()=>{
+            const key = (0, _permissioncachekeyutil.buildPermissionCacheKey)({
+                userId: 'user-1'
+            }, {
+                enableCompanyFeature: true
+            });
+            expect(key).toBe(_permissioncachekeyutil.DEFAULT_USER_PERMISSION_KEY_FORMAT.replace('{userId}', 'user-1'));
+        });
+        it('should build a company-scoped key when company feature is enabled and companyId is present', ()=>{
+            const key = (0, _permissioncachekeyutil.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            }, {
+                enableCompanyFeature: true
+            });
+            expect(key).toBe(_permissioncachekeyutil.DEFAULT_COMPANY_PERMISSION_KEY_FORMAT.replace('{userId}', 'user-1').replace('{companyId}', 'company-1').replace('{branchId}', 'branch-1'));
+        });
+        it('should default branchId placeholder to "null" when branchId is missing', ()=>{
+            const key = (0, _permissioncachekeyutil.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1'
+            }, {
+                enableCompanyFeature: true
+            });
+            expect(key).toContain(':branch:null:');
+        });
+        it('should default branchId placeholder to "null" when branchId is explicitly null', ()=>{
+            const key = (0, _permissioncachekeyutil.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: null
+            }, {
+                enableCompanyFeature: true
+            });
+            expect(key).toContain(':branch:null:');
+        });
+        it('should use a custom userPermissionKeyFormat when provided', ()=>{
+            const key = (0, _permissioncachekeyutil.buildPermissionCacheKey)({
+                userId: 'user-1'
+            }, {
+                userPermissionKeyFormat: 'custom:{userId}'
+            });
+            expect(key).toBe('custom:user-1');
+        });
+        it('should use a custom companyPermissionKeyFormat when provided', ()=>{
+            const key = (0, _permissioncachekeyutil.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1'
+            }, {
+                enableCompanyFeature: true,
+                companyPermissionKeyFormat: 'custom:{companyId}:{userId}:{branchId}'
+            });
+            expect(key).toBe('custom:company-1:user-1:null');
+        });
+        it('should treat an empty-string companyId as no company scope', ()=>{
+            const key = (0, _permissioncachekeyutil.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: ''
+            }, {
+                enableCompanyFeature: true
+            });
+            expect(key).toBe(_permissioncachekeyutil.DEFAULT_USER_PERMISSION_KEY_FORMAT.replace('{userId}', 'user-1'));
+        });
+    });
+});

package/cjs/utils/query-helpers.util.spec.js

@@ -0,0 +1,209 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _common = require("@nestjs/common");
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _queryhelpersutil = require("./query-helpers.util");
+function createMockQueryBuilder() {
+    return {
+        andWhere: jest.fn().mockReturnThis()
+    };
+}
+describe('query-helpers.util', ()=>{
+    describe('applyCompanyFilter', ()=>{
+        it('should apply the company filter when feature enabled and user has companyId', ()=>{
+            const query = createMockQueryBuilder();
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            (0, _queryhelpersutil.applyCompanyFilter)(query, {
+                isCompanyFeatureEnabled: true,
+                entityAlias: 'file'
+            }, user);
+            expect(query.andWhere).toHaveBeenCalledWith('file.companyId = :companyId', {
+                companyId: 'company-1'
+            });
+        });
+        it('should use a custom column name when provided', ()=>{
+            const query = createMockQueryBuilder();
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            (0, _queryhelpersutil.applyCompanyFilter)(query, {
+                isCompanyFeatureEnabled: true,
+                entityAlias: 'file',
+                columnName: 'company_id'
+            }, user);
+            expect(query.andWhere).toHaveBeenCalledWith('file.company_id = :companyId', {
+                companyId: 'company-1'
+            });
+        });
+        it('should not apply filter when feature disabled', ()=>{
+            const query = createMockQueryBuilder();
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            (0, _queryhelpersutil.applyCompanyFilter)(query, {
+                isCompanyFeatureEnabled: false,
+                entityAlias: 'file'
+            }, user);
+            expect(query.andWhere).not.toHaveBeenCalled();
+        });
+        it('should not apply filter when user is null', ()=>{
+            const query = createMockQueryBuilder();
+            (0, _queryhelpersutil.applyCompanyFilter)(query, {
+                isCompanyFeatureEnabled: true,
+                entityAlias: 'file'
+            }, null);
+            expect(query.andWhere).not.toHaveBeenCalled();
+        });
+        it('should not apply filter when user has no companyId', ()=>{
+            const query = createMockQueryBuilder();
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: undefined
+            });
+            (0, _queryhelpersutil.applyCompanyFilter)(query, {
+                isCompanyFeatureEnabled: true,
+                entityAlias: 'file'
+            }, user);
+            expect(query.andWhere).not.toHaveBeenCalled();
+        });
+        it('should return the same query builder instance', ()=>{
+            const query = createMockQueryBuilder();
+            const result = (0, _queryhelpersutil.applyCompanyFilter)(query, {
+                isCompanyFeatureEnabled: false,
+                entityAlias: 'file'
+            }, null);
+            expect(result).toBe(query);
+        });
+    });
+    describe('buildCompanyWhereCondition', ()=>{
+        it('should add companyId when feature enabled and user has one', ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            const result = (0, _queryhelpersutil.buildCompanyWhereCondition)({
+                id: '1'
+            }, true, user);
+            expect(result).toEqual({
+                id: '1',
+                companyId: 'company-1'
+            });
+        });
+        it('should return base where unchanged when feature disabled', ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            const result = (0, _queryhelpersutil.buildCompanyWhereCondition)({
+                id: '1'
+            }, false, user);
+            expect(result).toEqual({
+                id: '1'
+            });
+        });
+        it('should return base where unchanged when user is null', ()=>{
+            const result = (0, _queryhelpersutil.buildCompanyWhereCondition)({
+                id: '1'
+            }, true, null);
+            expect(result).toEqual({
+                id: '1'
+            });
+        });
+        it('should return base where unchanged when user has no companyId', ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: undefined
+            });
+            const result = (0, _queryhelpersutil.buildCompanyWhereCondition)({
+                id: '1'
+            }, true, user);
+            expect(result).toEqual({
+                id: '1'
+            });
+        });
+    });
+    describe('hasCompanyId', ()=>{
+        it('should return true for an object with a companyId property', ()=>{
+            expect((0, _queryhelpersutil.hasCompanyId)({
+                companyId: 'company-1'
+            })).toBe(true);
+        });
+        it('should return true even when companyId is explicitly undefined but present', ()=>{
+            expect((0, _queryhelpersutil.hasCompanyId)({
+                companyId: undefined
+            })).toBe(true);
+        });
+        it('should return false for an object without a companyId property', ()=>{
+            expect((0, _queryhelpersutil.hasCompanyId)({
+                id: '1'
+            })).toBe(false);
+        });
+        it('should return false for null', ()=>{
+            expect((0, _queryhelpersutil.hasCompanyId)(null)).toBe(false);
+        });
+        it('should return false for non-object values', ()=>{
+            expect((0, _queryhelpersutil.hasCompanyId)('string')).toBe(false);
+            expect((0, _queryhelpersutil.hasCompanyId)(42)).toBe(false);
+        });
+    });
+    describe('validateCompanyOwnership', ()=>{
+        it('should not throw when feature disabled', ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            expect(()=>(0, _queryhelpersutil.validateCompanyOwnership)({
+                    companyId: 'company-2'
+                }, user, false, 'Entity')).not.toThrow();
+        });
+        it('should not throw when user is null', ()=>{
+            expect(()=>(0, _queryhelpersutil.validateCompanyOwnership)({
+                    companyId: 'company-2'
+                }, null, true, 'Entity')).not.toThrow();
+        });
+        it('should not throw when entity has no companyId', ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            expect(()=>(0, _queryhelpersutil.validateCompanyOwnership)({
+                    id: '1'
+                }, user, true, 'Entity')).not.toThrow();
+        });
+        it('should not throw when entity companyId is falsy', ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            expect(()=>(0, _queryhelpersutil.validateCompanyOwnership)({
+                    companyId: null
+                }, user, true, 'Entity')).not.toThrow();
+        });
+        it('should not throw when entity companyId matches user companyId', ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            expect(()=>(0, _queryhelpersutil.validateCompanyOwnership)({
+                    companyId: 'company-1'
+                }, user, true, 'Entity')).not.toThrow();
+        });
+        it('should throw BadRequestException when entity belongs to a different company', ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            expect(()=>(0, _queryhelpersutil.validateCompanyOwnership)({
+                    companyId: 'company-2'
+                }, user, true, 'Email configuration')).toThrow(_common.BadRequestException);
+        });
+        it('should include the entity name in the thrown exception message', ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            try {
+                (0, _queryhelpersutil.validateCompanyOwnership)({
+                    companyId: 'company-2'
+                }, user, true, 'Email configuration');
+                fail('expected to throw');
+            } catch (error) {
+                expect(error.getResponse().message).toContain('Email configuration');
+            }
+        });
+    });
+});

package/cjs/utils/request.util.spec.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _requestutil = require("./request.util");
+const isProductionMock = jest.fn();
+const getOriginsMock = jest.fn();
+jest.mock('@flusys/nestjs-core/config', ()=>({
+        envConfig: {
+            isProduction: ()=>isProductionMock(),
+            getOrigins: ()=>getOriginsMock()
+        }
+    }));
+function buildRequest(overrides = {}) {
+    return {
+        headers: {},
+        hostname: 'app.example.com',
+        secure: false,
+        get: jest.fn((name)=>overrides.headers?.[name.toLowerCase()]),
+        ...overrides
+    };
+}
+describe('request.util', ()=>{
+    beforeEach(()=>{
+        isProductionMock.mockReset().mockReturnValue(false);
+        getOriginsMock.mockReset().mockReturnValue([]);
+    });
+    describe('isBrowserRequest', ()=>{
+        it('should return true when x-client-type header is "browser"', ()=>{
+            const req = buildRequest({
+                headers: {
+                    'x-client-type': 'browser'
+                }
+            });
+            expect((0, _requestutil.isBrowserRequest)(req)).toBe(true);
+        });
+        it('should return true when x-client-type header is "web"', ()=>{
+            const req = buildRequest({
+                headers: {
+                    'x-client-type': 'WEB'
+                }
+            });
+            expect((0, _requestutil.isBrowserRequest)(req)).toBe(true);
+        });
+        it('should return false when x-client-type header is a non-browser value', ()=>{
+            const req = buildRequest({
+                headers: {
+                    'x-client-type': 'mobile'
+                }
+            });
+            expect((0, _requestutil.isBrowserRequest)(req)).toBe(false);
+        });
+        it('should return true when accept header includes text/html', ()=>{
+            const req = buildRequest({
+                headers: {
+                    accept: 'text/html,application/xhtml+xml'
+                }
+            });
+            expect((0, _requestutil.isBrowserRequest)(req)).toBe(true);
+        });
+        it('should return true for a recognized browser user-agent', ()=>{
+            const req = buildRequest({
+                headers: {
+                    'user-agent': 'Mozilla/5.0 Chrome/100.0 Safari/537.36'
+                }
+            });
+            expect((0, _requestutil.isBrowserRequest)(req)).toBe(true);
+        });
+        it('should return false for Postman user-agent even if it matches browser patterns', ()=>{
+            const req = buildRequest({
+                headers: {
+                    'user-agent': 'PostmanRuntime/7.0 chrome'
+                }
+            });
+            expect((0, _requestutil.isBrowserRequest)(req)).toBe(false);
+        });
+        it('should return false when no headers indicate a browser', ()=>{
+            const req = buildRequest({
+                headers: {
+                    'user-agent': 'curl/7.79.1'
+                }
+            });
+            expect((0, _requestutil.isBrowserRequest)(req)).toBe(false);
+        });
+    });
+    describe('buildCookieOptions', ()=>{
+        it('should mark cookies secure and sameSite strict in production', ()=>{
+            isProductionMock.mockReturnValue(true);
+            const req = buildRequest({
+                headers: {}
+            });
+            const options = (0, _requestutil.buildCookieOptions)(req);
+            expect(options.secure).toBe(true);
+            expect(options.sameSite).toBe('strict');
+        });
+        it('should mark cookies insecure and sameSite lax in dev with no forwarded proto', ()=>{
+            isProductionMock.mockReturnValue(false);
+            const req = buildRequest({
+                headers: {}
+            });
+            const options = (0, _requestutil.buildCookieOptions)(req);
+            expect(options.secure).toBe(false);
+            expect(options.sameSite).toBe('lax');
+        });
+        it('should treat x-forwarded-proto: https as secure', ()=>{
+            isProductionMock.mockReturnValue(false);
+            const req = buildRequest({
+                headers: {
+                    'x-forwarded-proto': 'https'
+                }
+            });
+            const options = (0, _requestutil.buildCookieOptions)(req);
+            expect(options.secure).toBe(true);
+            expect(options.sameSite).toBe('strict');
+        });
+        it('should treat an https origin header as secure', ()=>{
+            isProductionMock.mockReturnValue(false);
+            const req = buildRequest({
+                headers: {
+                    origin: 'https://app.example.com'
+                }
+            });
+            const options = (0, _requestutil.buildCookieOptions)(req);
+            expect(options.secure).toBe(true);
+        });
+        it('should treat req.secure as secure', ()=>{
+            isProductionMock.mockReturnValue(false);
+            const req = buildRequest({
+                headers: {},
+                secure: true
+            });
+            const options = (0, _requestutil.buildCookieOptions)(req);
+            expect(options.secure).toBe(true);
+        });
+        it('should not set a domain for a localhost hostname', ()=>{
+            isProductionMock.mockReturnValue(false);
+            const req = buildRequest({
+                headers: {},
+                hostname: 'localhost'
+            });
+            const options = (0, _requestutil.buildCookieOptions)(req);
+            expect(options.domain).toBeUndefined();
+        });
+        it('should not set a domain for a bare two-part hostname', ()=>{
+            isProductionMock.mockReturnValue(false);
+            const req = buildRequest({
+                headers: {},
+                hostname: 'example.com'
+            });
+            const options = (0, _requestutil.buildCookieOptions)(req);
+            expect(options.domain).toBeUndefined();
+        });
+        it('should set a leading-dot domain for a subdomain hostname', ()=>{
+            isProductionMock.mockReturnValue(false);
+            const req = buildRequest({
+                headers: {},
+                hostname: 'app.example.com'
+            });
+            const options = (0, _requestutil.buildCookieOptions)(req);
+            expect(options.domain).toBe('.example.com');
+        });
+    });
+    describe('parseDurationToMs', ()=>{
+        it('should parse seconds', ()=>{
+            expect((0, _requestutil.parseDurationToMs)('30s')).toBe(30 * 1000);
+        });
+        it('should parse minutes', ()=>{
+            expect((0, _requestutil.parseDurationToMs)('15m')).toBe(15 * 60 * 1000);
+        });
+        it('should parse hours', ()=>{
+            expect((0, _requestutil.parseDurationToMs)('2h')).toBe(2 * 60 * 60 * 1000);
+        });
+        it('should parse days', ()=>{
+            expect((0, _requestutil.parseDurationToMs)('7d')).toBe(7 * 24 * 60 * 60 * 1000);
+        });
+        it('should parse weeks', ()=>{
+            expect((0, _requestutil.parseDurationToMs)('2w')).toBe(2 * 7 * 24 * 60 * 60 * 1000);
+        });
+        it('should return the default when the string does not match the pattern', ()=>{
+            expect((0, _requestutil.parseDurationToMs)('garbage')).toBe(7 * 24 * 60 * 60 * 1000);
+        });
+        it('should return a custom default when provided and pattern does not match', ()=>{
+            expect((0, _requestutil.parseDurationToMs)('garbage', 12345)).toBe(12345);
+        });
+    });
+    describe('extractFrontendUrl', ()=>{
+        it('should return the matched allowed origin when the request origin starts with it', ()=>{
+            getOriginsMock.mockReturnValue([
+                'https://app.example.com'
+            ]);
+            const req = buildRequest({
+                headers: {
+                    origin: 'https://app.example.com'
+                },
+                get: jest.fn((name)=>{
+                    if (name === 'origin') return 'https://app.example.com';
+                    return undefined;
+                })
+            });
+            expect((0, _requestutil.extractFrontendUrl)(req)).toBe('https://app.example.com');
+        });
+        it('should fall back to referer when origin header is absent', ()=>{
+            getOriginsMock.mockReturnValue([
+                'https://app.example.com'
+            ]);
+            const req = buildRequest({
+                get: jest.fn((name)=>{
+                    if (name === 'referer') return 'https://app.example.com/some/path';
+                    return undefined;
+                })
+            });
+            expect((0, _requestutil.extractFrontendUrl)(req)).toBe('https://app.example.com');
+        });
+        it('should fall back to protocol + host when no origin matches an allowed origin', ()=>{
+            getOriginsMock.mockReturnValue([
+                'https://other.example.com'
+            ]);
+            const req = buildRequest({
+                get: jest.fn((name)=>{
+                    if (name === 'host') return 'app.example.com';
+                    return undefined;
+                }),
+                protocol: 'https'
+            });
+            expect((0, _requestutil.extractFrontendUrl)(req)).toBe('https://app.example.com');
+        });
+        it('should throw when no origin/referer matches and no host header is present', ()=>{
+            getOriginsMock.mockReturnValue([]);
+            const req = buildRequest({
+                get: jest.fn(()=>undefined)
+            });
+            expect(()=>(0, _requestutil.extractFrontendUrl)(req)).toThrow('Unable to determine frontend URL from request');
+        });
+    });
+    describe('buildFrontendUrl', ()=>{
+        it('should append the path to the resolved frontend base URL', ()=>{
+            getOriginsMock.mockReturnValue([
+                'https://app.example.com'
+            ]);
+            const req = buildRequest({
+                get: jest.fn((name)=>{
+                    if (name === 'origin') return 'https://app.example.com';
+                    return undefined;
+                })
+            });
+            expect((0, _requestutil.buildFrontendUrl)(req, '/reset-password?token=abc')).toBe('https://app.example.com/reset-password?token=abc');
+        });
+    });
+});