@forjio/engine-auth 0.1.0

package/dist/__tests__/api-keys.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=api-keys.test.d.ts.map

package/dist/__tests__/api-keys.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/api-keys.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api-keys.test.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const api_keys_1 = require("../api-keys");
+(0, vitest_1.describe)('api-keys', () => {
+    (0, vitest_1.describe)('generateApiKey', () => {
+        (0, vitest_1.it)('should generate key with ek_ prefix', () => {
+            const key = (0, api_keys_1.generateApiKey)();
+            (0, vitest_1.expect)(key.startsWith('ek_')).toBe(true);
+        });
+        (0, vitest_1.it)('should generate unique keys', () => {
+            const key1 = (0, api_keys_1.generateApiKey)();
+            const key2 = (0, api_keys_1.generateApiKey)();
+            (0, vitest_1.expect)(key1).not.toBe(key2);
+        });
+        (0, vitest_1.it)('should generate key of expected length', () => {
+            const key = (0, api_keys_1.generateApiKey)();
+            // ek_ prefix (3) + 32 bytes hex encoded (64) = 67 chars
+            (0, vitest_1.expect)(key.length).toBe(67);
+        });
+        (0, vitest_1.it)('should accept a custom prefix', () => {
+            const key = (0, api_keys_1.generateApiKey)('custom_');
+            (0, vitest_1.expect)(key.startsWith('custom_')).toBe(true);
+        });
+    });
+    (0, vitest_1.describe)('hashApiKey', () => {
+        (0, vitest_1.it)('should return consistent hash for same key', () => {
+            const key = 'ek_abc123';
+            const hash1 = (0, api_keys_1.hashApiKey)(key);
+            const hash2 = (0, api_keys_1.hashApiKey)(key);
+            (0, vitest_1.expect)(hash1).toBe(hash2);
+        });
+        (0, vitest_1.it)('should return different hash for different key', () => {
+            const hash1 = (0, api_keys_1.hashApiKey)('ek_key1');
+            const hash2 = (0, api_keys_1.hashApiKey)('ek_key2');
+            (0, vitest_1.expect)(hash1).not.toBe(hash2);
+        });
+        (0, vitest_1.it)('should not be reversible (hash !== key)', () => {
+            const key = (0, api_keys_1.generateApiKey)();
+            const hash = (0, api_keys_1.hashApiKey)(key);
+            (0, vitest_1.expect)(hash).not.toBe(key);
+            (0, vitest_1.expect)(hash).not.toContain('ek_');
+        });
+    });
+    (0, vitest_1.describe)('validateApiKeyFormat', () => {
+        (0, vitest_1.it)('should accept valid ek_ prefixed key', () => {
+            const key = (0, api_keys_1.generateApiKey)();
+            (0, vitest_1.expect)((0, api_keys_1.validateApiKeyFormat)(key)).toBe(true);
+        });
+        (0, vitest_1.it)('should reject key without prefix', () => {
+            const hex = 'a'.repeat(64);
+            (0, vitest_1.expect)((0, api_keys_1.validateApiKeyFormat)(hex)).toBe(false);
+        });
+        (0, vitest_1.it)('should reject empty string', () => {
+            (0, vitest_1.expect)((0, api_keys_1.validateApiKeyFormat)('')).toBe(false);
+        });
+        (0, vitest_1.it)('should reject key with wrong length', () => {
+            (0, vitest_1.expect)((0, api_keys_1.validateApiKeyFormat)('ek_tooshort')).toBe(false);
+        });
+        (0, vitest_1.it)('should reject key with non-hex characters', () => {
+            const badKey = 'ek_' + 'z'.repeat(64);
+            (0, vitest_1.expect)((0, api_keys_1.validateApiKeyFormat)(badKey)).toBe(false);
+        });
+    });
+    (0, vitest_1.describe)('createApiKeyPair', () => {
+        (0, vitest_1.it)('should return both plain key and hash', () => {
+            const pair = (0, api_keys_1.createApiKeyPair)();
+            (0, vitest_1.expect)(pair.plainKey).toBeDefined();
+            (0, vitest_1.expect)(pair.hashedKey).toBeDefined();
+            (0, vitest_1.expect)(pair.plainKey).not.toBe(pair.hashedKey);
+        });
+        (0, vitest_1.it)('should return hash that matches hashing the plain key', () => {
+            const pair = (0, api_keys_1.createApiKeyPair)();
+            (0, vitest_1.expect)((0, api_keys_1.hashApiKey)(pair.plainKey)).toBe(pair.hashedKey);
+        });
+    });
+});
+//# sourceMappingURL=api-keys.test.js.map

package/dist/__tests__/api-keys.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.test.js","sourceRoot":"","sources":["../../src/__tests__/api-keys.test.ts"],"names":[],"mappings":";;AAAA,mCAA8C;AAC9C,0CAKqB;AAErB,IAAA,iBAAQ,EAAC,UAAU,EAAE,GAAG,EAAE;IACxB,IAAA,iBAAQ,EAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,IAAA,WAAE,EAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,GAAG,GAAG,IAAA,yBAAc,GAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,IAAI,GAAG,IAAA,yBAAc,GAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAA,yBAAc,GAAE,CAAC;YAC9B,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,GAAG,GAAG,IAAA,yBAAc,GAAE,CAAC;YAC7B,wDAAwD;YACxD,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,GAAG,GAAG,IAAA,yBAAc,EAAC,SAAS,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,IAAA,WAAE,EAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,GAAG,GAAG,WAAW,CAAC;YACxB,MAAM,KAAK,GAAG,IAAA,qBAAU,EAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAA,qBAAU,EAAC,GAAG,CAAC,CAAC;YAC9B,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,KAAK,GAAG,IAAA,qBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAA,qBAAU,EAAC,SAAS,CAAC,CAAC;YACpC,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,GAAG,GAAG,IAAA,yBAAc,GAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAA,qBAAU,EAAC,GAAG,CAAC,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,IAAA,WAAE,EAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,GAAG,GAAG,IAAA,yBAAc,GAAE,CAAC;YAC7B,IAAA,eAAM,EAAC,IAAA,+BAAoB,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAA,eAAM,EAAC,IAAA,+BAAoB,EAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,IAAA,eAAM,EAAC,IAAA,+BAAoB,EAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,IAAA,eAAM,EAAC,IAAA,+BAAoB,EAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,MAAM,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtC,IAAA,eAAM,EAAC,IAAA,+BAAoB,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,IAAA,WAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,IAAI,GAAG,IAAA,2BAAgB,GAAE,CAAC;YAChC,IAAA,eAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YACpC,IAAA,eAAM,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;YACrC,IAAA,eAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,IAAI,GAAG,IAAA,2BAAgB,GAAE,CAAC;YAChC,IAAA,eAAM,EAAC,IAAA,qBAAU,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/helpers/express-mock.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Creates a mock Express Request object.
+ */
+export declare function createMockReq(overrides?: Record<string, unknown>): any;
+/**
+ * Creates a mock Express Response object with chainable methods.
+ */
+export declare function createMockRes(): any;
+/**
+ * Creates a mock Express next function.
+ */
+export declare function createMockNext(): import("vitest").Mock<(...args: any[]) => any>;
+//# sourceMappingURL=express-mock.d.ts.map

package/dist/__tests__/helpers/express-mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express-mock.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/express-mock.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAM9D,GAAG,CACT;AAED;;GAEG;AACH,wBAAgB,aAAa,QAsB5B;AAED;;GAEG;AACH,wBAAgB,cAAc,mDAE7B"}

package/dist/__tests__/helpers/express-mock.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMockReq = createMockReq;
+exports.createMockRes = createMockRes;
+exports.createMockNext = createMockNext;
+const vitest_1 = require("vitest");
+/**
+ * Creates a mock Express Request object.
+ */
+function createMockReq(overrides = {}) {
+    return {
+        headers: {},
+        authUser: undefined,
+        apiKey: undefined,
+        ...overrides,
+    };
+}
+/**
+ * Creates a mock Express Response object with chainable methods.
+ */
+function createMockRes() {
+    const res = {
+        statusCode: 200,
+        _json: null,
+    };
+    res.status = vitest_1.vi.fn((code) => {
+        res.statusCode = code;
+        return res;
+    });
+    res.json = vitest_1.vi.fn((data) => {
+        res._json = data;
+        return res;
+    });
+    res.send = vitest_1.vi.fn((data) => {
+        res._json = data;
+        return res;
+    });
+    return res;
+}
+/**
+ * Creates a mock Express next function.
+ */
+function createMockNext() {
+    return vitest_1.vi.fn();
+}
+//# sourceMappingURL=express-mock.js.map

package/dist/__tests__/helpers/express-mock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express-mock.js","sourceRoot":"","sources":["../../../src/__tests__/helpers/express-mock.ts"],"names":[],"mappings":";;AAKA,sCAOC;AAKD,sCAsBC;AAKD,wCAEC;AA9CD,mCAA4B;AAE5B;;GAEG;AACH,SAAgB,aAAa,CAAC,YAAqC,EAAE;IACnE,OAAO;QACL,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,SAAS;QACjB,GAAG,SAAS;KACN,CAAC;AACX,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa;IAC3B,MAAM,GAAG,GAAQ;QACf,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,IAAe;KACvB,CAAC;IAEF,GAAG,CAAC,MAAM,GAAG,WAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE;QAClC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,GAAG,WAAE,CAAC,EAAE,CAAC,CAAC,IAAa,EAAE,EAAE;QACjC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;QACjB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,GAAG,WAAE,CAAC,EAAE,CAAC,CAAC,IAAa,EAAE,EAAE;QACjC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;QACjB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc;IAC5B,OAAO,WAAE,CAAC,EAAE,EAAE,CAAC;AACjB,CAAC"}

package/dist/__tests__/helpers/redis-mock.d.ts

@@ -0,0 +1,19 @@
+/**
+ * In-memory Redis mock for testing session store.
+ * Implements the subset of ioredis methods used by session.ts.
+ */
+export declare class RedisMock {
+    private store;
+    private sets;
+    private ttls;
+    get(key: string): Promise<string | null>;
+    setex(key: string, ttl: number, value: string): Promise<'OK'>;
+    del(...keys: string[]): Promise<number>;
+    sadd(key: string, ...members: string[]): Promise<number>;
+    srem(key: string, ...members: string[]): Promise<number>;
+    smembers(key: string): Promise<string[]>;
+    expire(_key: string, _seconds: number): Promise<number>;
+    /** Helper: clear all data between tests */
+    clear(): void;
+}
+//# sourceMappingURL=redis-mock.d.ts.map

package/dist/__tests__/helpers/redis-mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-mock.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/redis-mock.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,IAAI,CAAkC;IAC9C,OAAO,CAAC,IAAI,CAA6B;IAEnC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7D,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAUvC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAUxD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAUxD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKxC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7D,2CAA2C;IAC3C,KAAK,IAAI,IAAI;CAKd"}

package/dist/__tests__/helpers/redis-mock.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisMock = void 0;
+/**
+ * In-memory Redis mock for testing session store.
+ * Implements the subset of ioredis methods used by session.ts.
+ */
+class RedisMock {
+    store = new Map();
+    sets = new Map();
+    ttls = new Map();
+    async get(key) {
+        return this.store.get(key) ?? null;
+    }
+    async setex(key, ttl, value) {
+        this.store.set(key, value);
+        this.ttls.set(key, ttl);
+        return 'OK';
+    }
+    async del(...keys) {
+        let count = 0;
+        for (const key of keys) {
+            if (this.store.delete(key))
+                count++;
+            this.sets.delete(key);
+            this.ttls.delete(key);
+        }
+        return count;
+    }
+    async sadd(key, ...members) {
+        if (!this.sets.has(key))
+            this.sets.set(key, new Set());
+        const set = this.sets.get(key);
+        let added = 0;
+        for (const m of members) {
+            if (!set.has(m)) {
+                set.add(m);
+                added++;
+            }
+        }
+        return added;
+    }
+    async srem(key, ...members) {
+        const set = this.sets.get(key);
+        if (!set)
+            return 0;
+        let removed = 0;
+        for (const m of members) {
+            if (set.delete(m))
+                removed++;
+        }
+        return removed;
+    }
+    async smembers(key) {
+        const set = this.sets.get(key);
+        return set ? Array.from(set) : [];
+    }
+    async expire(_key, _seconds) {
+        return 1;
+    }
+    /** Helper: clear all data between tests */
+    clear() {
+        this.store.clear();
+        this.sets.clear();
+        this.ttls.clear();
+    }
+}
+exports.RedisMock = RedisMock;
+//# sourceMappingURL=redis-mock.js.map

package/dist/__tests__/helpers/redis-mock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-mock.js","sourceRoot":"","sources":["../../../src/__tests__/helpers/redis-mock.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,MAAa,SAAS;IACZ,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtC,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAG,IAAc;QACzB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,GAAG,OAAiB;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,GAAG,OAAiB;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC;QACnB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB;QACzC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,2CAA2C;IAC3C,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;CACF;AA5DD,8BA4DC"}

package/dist/__tests__/jwt.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt.test.d.ts.map

package/dist/__tests__/jwt.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/jwt.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/jwt.test.js

@@ -0,0 +1,98 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const jwt_1 = require("../jwt");
+const TEST_CONFIG = {
+    jwtSecret: 'test-access-secret-key-for-testing',
+    jwtRefreshSecret: 'test-refresh-secret-key-for-testing',
+};
+const TEST_PAYLOAD = {
+    userId: 'user-123',
+    email: 'test@example.com',
+    role: 'user',
+    subscriptionTier: 'pro',
+};
+(0, vitest_1.describe)('jwt', () => {
+    (0, vitest_1.describe)('signAccessToken', () => {
+        (0, vitest_1.it)('should sign a valid JWT with correct expiry', () => {
+            const token = (0, jwt_1.signAccessToken)(TEST_PAYLOAD, TEST_CONFIG);
+            (0, vitest_1.expect)(token).toBeDefined();
+            (0, vitest_1.expect)(typeof token).toBe('string');
+            const decoded = jsonwebtoken_1.default.decode(token);
+            (0, vitest_1.expect)(decoded.exp).toBeDefined();
+            // Default expiry is 15 minutes (900s)
+            const expectedExpiry = decoded.iat + 900;
+            (0, vitest_1.expect)(decoded.exp).toBe(expectedExpiry);
+        });
+        (0, vitest_1.it)('should include userId, email, role in payload', () => {
+            const token = (0, jwt_1.signAccessToken)(TEST_PAYLOAD, TEST_CONFIG);
+            const decoded = jsonwebtoken_1.default.decode(token);
+            (0, vitest_1.expect)(decoded.userId).toBe('user-123');
+            (0, vitest_1.expect)(decoded.email).toBe('test@example.com');
+            (0, vitest_1.expect)(decoded.role).toBe('user');
+            (0, vitest_1.expect)(decoded.subscriptionTier).toBe('pro');
+        });
+        (0, vitest_1.it)('should use custom expiry when configured', () => {
+            const config = {
+                ...TEST_CONFIG,
+                jwtExpiresIn: '1h',
+            };
+            const token = (0, jwt_1.signAccessToken)(TEST_PAYLOAD, config);
+            const decoded = jsonwebtoken_1.default.decode(token);
+            // 1 hour = 3600 seconds
+            const expectedExpiry = decoded.iat + 3600;
+            (0, vitest_1.expect)(decoded.exp).toBe(expectedExpiry);
+        });
+    });
+    (0, vitest_1.describe)('verifyAccessToken', () => {
+        (0, vitest_1.it)('should verify and return payload for valid token', () => {
+            const token = (0, jwt_1.signAccessToken)(TEST_PAYLOAD, TEST_CONFIG);
+            const result = (0, jwt_1.verifyAccessToken)(token, TEST_CONFIG);
+            (0, vitest_1.expect)(result.userId).toBe('user-123');
+            (0, vitest_1.expect)(result.email).toBe('test@example.com');
+            (0, vitest_1.expect)(result.role).toBe('user');
+            (0, vitest_1.expect)(result.subscriptionTier).toBe('pro');
+        });
+        (0, vitest_1.it)('should throw for expired token', () => {
+            const expiredToken = jsonwebtoken_1.default.sign(TEST_PAYLOAD, TEST_CONFIG.jwtSecret, {
+                expiresIn: -10, // already expired
+            });
+            (0, vitest_1.expect)(() => (0, jwt_1.verifyAccessToken)(expiredToken, TEST_CONFIG)).toThrow();
+        });
+        (0, vitest_1.it)('should throw for invalid signature', () => {
+            const token = jsonwebtoken_1.default.sign(TEST_PAYLOAD, 'wrong-secret', {
+                expiresIn: 900,
+            });
+            (0, vitest_1.expect)(() => (0, jwt_1.verifyAccessToken)(token, TEST_CONFIG)).toThrow();
+        });
+        (0, vitest_1.it)('should throw for malformed token', () => {
+            (0, vitest_1.expect)(() => (0, jwt_1.verifyAccessToken)('not-a-jwt', TEST_CONFIG)).toThrow();
+        });
+    });
+    (0, vitest_1.describe)('signRefreshToken / verifyRefreshToken', () => {
+        (0, vitest_1.it)('should sign with refresh secret', () => {
+            const token = (0, jwt_1.signRefreshToken)(TEST_PAYLOAD, TEST_CONFIG);
+            const result = (0, jwt_1.verifyRefreshToken)(token, TEST_CONFIG);
+            (0, vitest_1.expect)(result.userId).toBe('user-123');
+            (0, vitest_1.expect)(result.email).toBe('test@example.com');
+        });
+        (0, vitest_1.it)('should reject access token verified with refresh secret', () => {
+            const accessToken = (0, jwt_1.signAccessToken)(TEST_PAYLOAD, TEST_CONFIG);
+            (0, vitest_1.expect)(() => (0, jwt_1.verifyRefreshToken)(accessToken, TEST_CONFIG)).toThrow();
+        });
+    });
+    (0, vitest_1.describe)('signRememberMeToken', () => {
+        (0, vitest_1.it)('should have 30d expiry', () => {
+            const token = (0, jwt_1.signRememberMeToken)(TEST_PAYLOAD, TEST_CONFIG);
+            const decoded = jsonwebtoken_1.default.decode(token);
+            // 30 days = 2592000 seconds
+            const expectedExpiry = decoded.iat + 30 * 24 * 60 * 60;
+            (0, vitest_1.expect)(decoded.exp).toBe(expectedExpiry);
+        });
+    });
+});
+//# sourceMappingURL=jwt.test.js.map

package/dist/__tests__/jwt.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.test.js","sourceRoot":"","sources":["../../src/__tests__/jwt.test.ts"],"names":[],"mappings":";;;;;AAAA,mCAA8C;AAC9C,gEAA+B;AAC/B,gCAMgB;AAGhB,MAAM,WAAW,GAAe;IAC9B,SAAS,EAAE,oCAAoC;IAC/C,gBAAgB,EAAE,qCAAqC;CACxD,CAAC;AAEF,MAAM,YAAY,GAAe;IAC/B,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,MAAM;IACZ,gBAAgB,EAAE,KAAK;CACxB,CAAC;AAEF,IAAA,iBAAQ,EAAC,KAAK,EAAE,GAAG,EAAE;IACnB,IAAA,iBAAQ,EAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,IAAA,WAAE,EAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,KAAK,GAAG,IAAA,qBAAe,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAEzD,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5B,IAAA,eAAM,EAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEpC,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAmB,CAAC;YACpD,IAAA,eAAM,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,sCAAsC;YACtC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAI,GAAG,GAAG,CAAC;YAC1C,IAAA,eAAM,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,KAAK,GAAG,IAAA,qBAAe,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAmB,CAAC;YAEpD,IAAA,eAAM,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxC,IAAA,eAAM,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC/C,IAAA,eAAM,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,IAAA,eAAM,EAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAe;gBACzB,GAAG,WAAW;gBACd,YAAY,EAAE,IAAI;aACnB,CAAC;YAEF,MAAM,KAAK,GAAG,IAAA,qBAAe,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAmB,CAAC;YAEpD,wBAAwB;YACxB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAI,GAAG,IAAI,CAAC;YAC3C,IAAA,eAAM,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,IAAA,WAAE,EAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,KAAK,GAAG,IAAA,qBAAe,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,IAAA,uBAAiB,EAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAErD,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvC,IAAA,eAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC9C,IAAA,eAAM,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,IAAA,eAAM,EAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,YAAY,GAAG,sBAAG,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,SAAS,EAAE;gBACjE,SAAS,EAAE,CAAC,EAAE,EAAE,kBAAkB;aACnC,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,uBAAiB,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,KAAK,GAAG,sBAAG,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE;gBACnD,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YAEH,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,uBAAiB,EAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,uBAAiB,EAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,uCAAuC,EAAE,GAAG,EAAE;QACrD,IAAA,WAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,KAAK,GAAG,IAAA,sBAAgB,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAA,wBAAkB,EAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAEtD,IAAA,eAAM,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvC,IAAA,eAAM,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,IAAA,WAAE,EAAC,yDAAyD,EAAE,GAAG,EAAE;YACjE,MAAM,WAAW,GAAG,IAAA,qBAAe,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAE/D,IAAA,eAAM,EAAC,GAAG,EAAE,CAAC,IAAA,wBAAkB,EAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,iBAAQ,EAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,IAAA,WAAE,EAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,MAAM,KAAK,GAAG,IAAA,yBAAmB,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAmB,CAAC;YAEpD,4BAA4B;YAC5B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YACxD,IAAA,eAAM,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/middleware.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=middleware.test.d.ts.map

package/dist/__tests__/middleware.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/middleware.test.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const express_mock_1 = require("./helpers/express-mock");
+const middleware_1 = require("../middleware");
+const jwt_1 = require("../jwt");
+const TEST_CONFIG = {
+    jwtSecret: 'test-middleware-secret',
+    jwtRefreshSecret: 'test-middleware-refresh-secret',
+};
+const TEST_PAYLOAD = {
+    userId: 'user-789',
+    email: 'mw@example.com',
+    role: 'admin',
+    subscriptionTier: 'enterprise',
+};
+(0, vitest_1.describe)('authenticateToken', () => {
+    const middleware = (0, middleware_1.authenticateToken)(TEST_CONFIG);
+    (0, vitest_1.it)('should call next() with valid Bearer token', () => {
+        const token = (0, jwt_1.signAccessToken)(TEST_PAYLOAD, TEST_CONFIG);
+        const req = (0, express_mock_1.createMockReq)({
+            headers: { authorization: `Bearer ${token}` },
+        });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        middleware(req, res, next);
+        (0, vitest_1.expect)(next).toHaveBeenCalled();
+        (0, vitest_1.expect)(res.status).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('should set req.authUser with payload', () => {
+        const token = (0, jwt_1.signAccessToken)(TEST_PAYLOAD, TEST_CONFIG);
+        const req = (0, express_mock_1.createMockReq)({
+            headers: { authorization: `Bearer ${token}` },
+        });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        middleware(req, res, next);
+        (0, vitest_1.expect)(req.authUser).toBeDefined();
+        (0, vitest_1.expect)(req.authUser.userId).toBe('user-789');
+        (0, vitest_1.expect)(req.authUser.email).toBe('mw@example.com');
+        (0, vitest_1.expect)(req.authUser.role).toBe('admin');
+    });
+    (0, vitest_1.it)('should return 401 for missing Authorization header', () => {
+        const req = (0, express_mock_1.createMockReq)({ headers: {} });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        middleware(req, res, next);
+        (0, vitest_1.expect)(res.status).toHaveBeenCalledWith(401);
+        (0, vitest_1.expect)(res.json).toHaveBeenCalledWith(vitest_1.expect.objectContaining({ error: vitest_1.expect.any(String) }));
+        (0, vitest_1.expect)(next).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('should return 401 for invalid token', () => {
+        const req = (0, express_mock_1.createMockReq)({
+            headers: { authorization: 'Bearer invalid-token-here' },
+        });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        middleware(req, res, next);
+        (0, vitest_1.expect)(res.status).toHaveBeenCalledWith(401);
+        (0, vitest_1.expect)(next).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('should return 401 for Authorization header without Bearer prefix', () => {
+        const token = (0, jwt_1.signAccessToken)(TEST_PAYLOAD, TEST_CONFIG);
+        const req = (0, express_mock_1.createMockReq)({
+            headers: { authorization: token },
+        });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        middleware(req, res, next);
+        (0, vitest_1.expect)(res.status).toHaveBeenCalledWith(401);
+        (0, vitest_1.expect)(next).not.toHaveBeenCalled();
+    });
+});
+(0, vitest_1.describe)('requireApiKey', () => {
+    const mockApiKey = {
+        id: 'key-1',
+        key: 'ek_hashed',
+        userId: 'user-1',
+        productSlug: 'portal',
+        scopes: ['read', 'write'],
+        expiresAt: null,
+        lastUsedAt: null,
+        createdAt: new Date(),
+    };
+    (0, vitest_1.it)('should call next() when X-API-Key is valid', async () => {
+        const validateKey = vitest_1.vi.fn().mockResolvedValue(mockApiKey);
+        const middleware = (0, middleware_1.requireApiKey)(validateKey);
+        const req = (0, express_mock_1.createMockReq)({
+            headers: { 'x-api-key': 'ek_some_key' },
+        });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        await middleware(req, res, next);
+        (0, vitest_1.expect)(validateKey).toHaveBeenCalledWith('ek_some_key');
+        (0, vitest_1.expect)(next).toHaveBeenCalled();
+        (0, vitest_1.expect)(req.apiKey).toEqual(mockApiKey);
+    });
+    (0, vitest_1.it)('should return 401 when no API key provided', async () => {
+        const validateKey = vitest_1.vi.fn();
+        const middleware = (0, middleware_1.requireApiKey)(validateKey);
+        const req = (0, express_mock_1.createMockReq)({ headers: {} });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        await middleware(req, res, next);
+        (0, vitest_1.expect)(res.status).toHaveBeenCalledWith(401);
+        (0, vitest_1.expect)(next).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('should return 401 when API key validation fails', async () => {
+        const validateKey = vitest_1.vi.fn().mockResolvedValue(null);
+        const middleware = (0, middleware_1.requireApiKey)(validateKey);
+        const req = (0, express_mock_1.createMockReq)({
+            headers: { 'x-api-key': 'ek_invalid' },
+        });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        await middleware(req, res, next);
+        (0, vitest_1.expect)(res.status).toHaveBeenCalledWith(401);
+        (0, vitest_1.expect)(next).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('should return 401 for expired API key', async () => {
+        const expiredKey = {
+            ...mockApiKey,
+            expiresAt: new Date('2020-01-01'),
+        };
+        const validateKey = vitest_1.vi.fn().mockResolvedValue(expiredKey);
+        const middleware = (0, middleware_1.requireApiKey)(validateKey);
+        const req = (0, express_mock_1.createMockReq)({
+            headers: { 'x-api-key': 'ek_expired' },
+        });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        await middleware(req, res, next);
+        (0, vitest_1.expect)(res.status).toHaveBeenCalledWith(401);
+        (0, vitest_1.expect)(next).not.toHaveBeenCalled();
+    });
+});
+(0, vitest_1.describe)('requireRole', () => {
+    (0, vitest_1.it)('should allow matching role', () => {
+        const middleware = (0, middleware_1.requireRole)('admin');
+        const req = (0, express_mock_1.createMockReq)({ authUser: { role: 'admin' } });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        middleware(req, res, next);
+        (0, vitest_1.expect)(next).toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('should reject non-matching role', () => {
+        const middleware = (0, middleware_1.requireRole)('admin');
+        const req = (0, express_mock_1.createMockReq)({ authUser: { role: 'user' } });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        middleware(req, res, next);
+        (0, vitest_1.expect)(res.status).toHaveBeenCalledWith(403);
+        (0, vitest_1.expect)(next).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('should accept any of multiple allowed roles', () => {
+        const middleware = (0, middleware_1.requireRole)('admin', 'moderator');
+        const req = (0, express_mock_1.createMockReq)({ authUser: { role: 'moderator' } });
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        middleware(req, res, next);
+        (0, vitest_1.expect)(next).toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('should return 401 when no authUser is present', () => {
+        const middleware = (0, middleware_1.requireRole)('admin');
+        const req = (0, express_mock_1.createMockReq)({});
+        const res = (0, express_mock_1.createMockRes)();
+        const next = (0, express_mock_1.createMockNext)();
+        middleware(req, res, next);
+        (0, vitest_1.expect)(res.status).toHaveBeenCalledWith(401);
+        (0, vitest_1.expect)(next).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=middleware.test.js.map

package/dist/__tests__/middleware.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.test.js","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":";;AAAA,mCAAkD;AAClD,yDAAsF;AACtF,8CAA8E;AAC9E,gCAAyC;AAGzC,MAAM,WAAW,GAAe;IAC9B,SAAS,EAAE,wBAAwB;IACnC,gBAAgB,EAAE,gCAAgC;CACnD,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,gBAAgB;IACvB,IAAI,EAAE,OAAO;IACb,gBAAgB,EAAE,YAAY;CAC/B,CAAC;AAEF,IAAA,iBAAQ,EAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,MAAM,UAAU,GAAG,IAAA,8BAAiB,EAAC,WAAW,CAAC,CAAC;IAElD,IAAA,WAAE,EAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,KAAK,GAAG,IAAA,qBAAe,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC;YACxB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAChC,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,KAAK,GAAG,IAAA,qBAAe,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC;YACxB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAA,eAAM,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,IAAA,eAAM,EAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAA,eAAM,EAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACnC,eAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,eAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CACvD,CAAC;QACF,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC;YACxB,OAAO,EAAE,EAAE,aAAa,EAAE,2BAA2B,EAAE;SACxD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,IAAA,qBAAe,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC;YACxB,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE;SAClC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,UAAU,GAAW;QACzB,EAAE,EAAE,OAAO;QACX,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;IAEF,IAAA,WAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,WAAW,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAA,0BAAa,EAAC,WAAW,CAAC,CAAC;QAE9C,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC;YACxB,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEjC,IAAA,eAAM,EAAC,WAAW,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACxD,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAChC,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,WAAW,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAA,0BAAa,EAAC,WAAW,CAAC,CAAC;QAE9C,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEjC,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,WAAW,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAA,0BAAa,EAAC,WAAW,CAAC,CAAC;QAE9C,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC;YACxB,OAAO,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE;SACvC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEjC,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,UAAU,GAAW;YACzB,GAAG,UAAU;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;SAClC,CAAC;QACF,MAAM,WAAW,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAA,0BAAa,EAAC,WAAW,CAAC,CAAC;QAE9C,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC;YACxB,OAAO,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE;SACvC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEjC,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAA,WAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,UAAU,GAAG,IAAA,wBAAW,EAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,UAAU,GAAG,IAAA,wBAAW,EAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,UAAU,GAAG,IAAA,wBAAW,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,UAAU,GAAG,IAAA,wBAAW,EAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAA,4BAAa,GAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAA,6BAAc,GAAE,CAAC;QAE9B,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAE3B,IAAA,eAAM,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/session.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session.test.d.ts.map

package/dist/__tests__/session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/session.test.ts"],"names":[],"mappings":""}