@futdevpro/nts-dynamo 1.15.157 → 1.15.160

package/src/_modules/account-security/account-session.control-service.ts

@@ -1,376 +0,0 @@
-import {
-  createHash,
-  randomBytes,
-  randomUUID
-} from 'crypto';
-
-import { DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_global_settings } from '../../_collections/global-settings.const';
-import { DyNTS_AccountRefreshTokenState_Type } from './_enums/account-refresh-token-state.type-enum';
-import { DyNTS_AccountSessionState_Type } from './_enums/account-session-state.type-enum';
-import {
-  DyNTS_AccountRefreshTokenRecord_Interface
-} from './_models/account-refresh-token-record.interface';
-import {
-  DyNTS_AccountSessionAdapter_Interface
-} from './_models/account-session-adapter.interface';
-import { DyNTS_AccountSessionRotate_Interface } from './_models/account-session-rotate.interface';
-import { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
-import { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
-import { DyNTS_AccountSessionRecord_Interface } from './_models/account-session-record.interface';
-import { DyNTS_AccountSessionSettings_Interface } from './_models/account-session-settings.interface';
-import { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
-import { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
-
-const DEFAULT_ACCESS_TTL_MS: number = 15 * 60 * 1000;
-const DEFAULT_REFRESH_TTL_MS: number = 30 * 24 * 60 * 60 * 1000;
-const DEFAULT_TOKEN_BYTES: number = 32;
-const DEFAULT_MAX_REFRESH_ROTATIONS: number = 100;
-
-interface DyNTS_NewSessionMaterial {
-  rawAccessToken: string;
-  rawRefreshToken: string;
-  session: DyNTS_AccountSessionRecord_Interface;
-  refreshToken: DyNTS_AccountRefreshTokenRecord_Interface;
-}
-
-/**
- * Opaque, server-revocable account session families with one-time refresh rotation and replay detection.
- */
-export class DyNTS_AccountSession_ControlService {
-  private readonly adapter: DyNTS_AccountSessionAdapter_Interface;
-  private readonly accessTtlMs: number;
-  private readonly refreshTtlMs: number;
-  private readonly tokenBytes: number;
-  private readonly maxRefreshRotations: number;
-  private readonly clock: () => Date;
-
-  /** Creates a validated session service over an atomic persistence adapter. */
-  constructor(set: DyNTS_AccountSessionSettings_Interface) {
-    this.adapter = set.adapter;
-    this.accessTtlMs = set.accessTtlMs ?? DEFAULT_ACCESS_TTL_MS;
-    this.refreshTtlMs = set.refreshTtlMs ?? DEFAULT_REFRESH_TTL_MS;
-    this.tokenBytes = set.tokenBytes ?? DEFAULT_TOKEN_BYTES;
-    this.maxRefreshRotations = set.maxRefreshRotations ?? DEFAULT_MAX_REFRESH_ROTATIONS;
-    this.clock = set.clock ?? ((): Date => new Date());
-    this.validateSettings();
-  }
-
-  /** Atomically persists a new session family before returning its raw credentials. */
-  public async issueSession(
-    subjectId: string,
-    authorizationVersion: number,
-    context: DyNTS_AccountSessionContext_Interface
-  ): Promise<DyNTS_AccountSessionTokenPair_Interface> {
-    if (
-      !subjectId
-      || subjectId.length > 256
-      || !Number.isSafeInteger(authorizationVersion)
-      || authorizationVersion < 0
-    ) {
-      throw this.buildUnauthorized('SESSION_SUBJECT_MISSING');
-    }
-
-    this.validateContext(context);
-
-    const now: Date = this.clock();
-    const material: DyNTS_NewSessionMaterial = this.createMaterial({
-      subjectId: subjectId,
-      sessionId: randomUUID(),
-      familyId: randomUUID(),
-      generation: 0,
-      revision: 0,
-      authorizationVersion: authorizationVersion,
-      createdAt: now.toISOString(),
-      refreshExpiresAt: new Date(now.getTime() + this.refreshTtlMs).toISOString(),
-      materialCreatedAt: now.toISOString(),
-      context: context,
-    });
-
-    await this.adapter.createSession({
-      session: material.session,
-      refreshToken: material.refreshToken,
-    });
-
-    return this.toTokenPair(material);
-  }
-
-  /** Resolves an opaque access token through the server-side active-session record. */
-  public async authenticateAccessToken(
-    accessToken: string
-  ): Promise<DyNTS_AccountSessionClaims_Interface> {
-    if (!accessToken || accessToken.length > 512) {
-      throw this.buildUnauthorized('ACCESS_TOKEN_INVALID');
-    }
-
-    const now: Date = this.clock();
-    const session: DyNTS_AccountSessionRecord_Interface | null =
-      await this.adapter.findSessionByAccessTokenHash(this.hashToken(accessToken));
-
-    if (
-      session?.state !== DyNTS_AccountSessionState_Type.active
-      || session.accessTokenHash !== this.hashToken(accessToken)
-      || !this.isFutureDate(session.accessExpiresAt, now)
-      || !session.subjectId
-      || !session.sessionId
-      || !session.familyId
-      || !Number.isSafeInteger(session.authorizationVersion)
-      || session.authorizationVersion < 0
-    ) {
-      throw this.buildUnauthorized('ACCESS_TOKEN_INVALID');
-    }
-
-    return {
-      subjectId: session.subjectId,
-      sessionId: session.sessionId,
-      familyId: session.familyId,
-      authorizationVersion: session.authorizationVersion,
-    };
-  }
-
-  /** Rotates a one-time refresh token; replay revokes the complete token family. */
-  public async rotateRefreshToken(
-    refreshToken: string,
-    context: DyNTS_AccountSessionContext_Interface
-  ): Promise<DyNTS_AccountSessionTokenPair_Interface> {
-    if (!refreshToken || refreshToken.length > 512) {
-      throw this.buildUnauthorized('REFRESH_TOKEN_INVALID');
-    }
-
-    this.validateContext(context);
-    const now: Date = this.clock();
-    const tokenHash: string = this.hashToken(refreshToken);
-    const token: DyNTS_AccountRefreshTokenRecord_Interface | null =
-      await this.adapter.findRefreshTokenByHash(tokenHash);
-
-    if (!token) {
-      throw this.buildUnauthorized('REFRESH_TOKEN_INVALID');
-    }
-
-    if (token.state !== DyNTS_AccountRefreshTokenState_Type.active) {
-      await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-token-reuse');
-
-      throw this.buildUnauthorized('REFRESH_TOKEN_REUSE');
-    }
-
-    const session: DyNTS_AccountSessionRecord_Interface | null =
-      await this.adapter.findSessionById(token.sessionId);
-
-    if (
-      session?.state !== DyNTS_AccountSessionState_Type.active
-      || session.familyId !== token.familyId
-      || session.subjectId !== token.subjectId
-      || session.generation !== token.generation
-      || token.tokenHash !== tokenHash
-      || !this.isFutureDate(token.expiresAt, now)
-      || !this.isFutureDate(session.refreshExpiresAt, now)
-    ) {
-      await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-token-invalid-state');
-
-      throw this.buildUnauthorized('REFRESH_TOKEN_INVALID');
-    }
-
-    if (session.generation >= this.maxRefreshRotations) {
-      await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-rotation-limit');
-
-      throw this.buildUnauthorized('REFRESH_ROTATION_LIMIT');
-    }
-
-    const material: DyNTS_NewSessionMaterial = this.createMaterial({
-      subjectId: session.subjectId,
-      sessionId: session.sessionId,
-      familyId: session.familyId,
-      generation: session.generation + 1,
-      revision: session.revision + 1,
-      authorizationVersion: session.authorizationVersion,
-      createdAt: session.createdAt,
-      refreshExpiresAt: session.refreshExpiresAt,
-      materialCreatedAt: now.toISOString(),
-      context: context,
-    });
-    const rotation: DyNTS_AccountSessionRotate_Interface = {
-      expectedSessionRevision: session.revision,
-      currentRefreshTokenHash: tokenHash,
-      usedAt: now.toISOString(),
-      replacementSession: material.session,
-      replacementRefreshToken: material.refreshToken,
-    };
-    const didRotate: boolean = await this.adapter.rotateSession(rotation);
-
-    if (!didRotate) {
-      const winner: DyNTS_AccountRefreshTokenRecord_Interface | null =
-        await this.adapter.findRefreshTokenByHash(tokenHash);
-
-      if (winner?.state === DyNTS_AccountRefreshTokenState_Type.used) {
-        await this.adapter.revokeFamily(token.familyId, now.toISOString(), 'refresh-token-reuse-race');
-
-        throw this.buildUnauthorized('REFRESH_TOKEN_REUSE');
-      }
-
-      throw this.buildUnauthorized('REFRESH_TOKEN_CONFLICT');
-    }
-
-    return this.toTokenPair(material);
-  }
-
-  /** Revokes one server-side session. */
-  public async revokeSession(sessionId: string, reasonCode: string): Promise<void> {
-    this.validateRevocation(sessionId, reasonCode);
-    await this.adapter.revokeSession(sessionId, this.clock().toISOString(), reasonCode);
-  }
-
-  /** Revokes every session belonging to one subject. */
-  public async revokeAllSubjectSessions(subjectId: string, reasonCode: string): Promise<void> {
-    this.validateRevocation(subjectId, reasonCode);
-    await this.adapter.revokeSubject(subjectId, this.clock().toISOString(), reasonCode);
-  }
-
-  /** Returns a user-safe session projection without token hashes. */
-  public async listSubjectSessions(subjectId: string): Promise<DyNTS_AccountSessionView_Interface[]> {
-    if (!subjectId || subjectId.length > 256) {
-      throw this.buildUnauthorized('SESSION_SUBJECT_MISSING');
-    }
-
-    const sessions: DyNTS_AccountSessionRecord_Interface[] =
-      await this.adapter.listSubjectSessions(subjectId);
-
-    return sessions.map((session: DyNTS_AccountSessionRecord_Interface): DyNTS_AccountSessionView_Interface => ({
-      sessionId: session.sessionId,
-      state: session.state,
-      createdAt: session.createdAt,
-      lastRotatedAt: session.lastRotatedAt,
-      accessExpiresAt: session.accessExpiresAt,
-      refreshExpiresAt: session.refreshExpiresAt,
-      context: { ...session.context },
-    }));
-  }
-
-  private createMaterial(set: {
-    subjectId: string;
-    sessionId: string;
-    familyId: string;
-    generation: number;
-    revision: number;
-    authorizationVersion: number;
-    createdAt: string;
-    refreshExpiresAt: string;
-    materialCreatedAt: string;
-    context: DyNTS_AccountSessionContext_Interface;
-  }): DyNTS_NewSessionMaterial {
-    const rawAccessToken: string = randomBytes(this.tokenBytes).toString('base64url');
-    const rawRefreshToken: string = randomBytes(this.tokenBytes).toString('base64url');
-    const materialCreatedAt: Date = new Date(set.materialCreatedAt);
-    const accessExpiresAt: string = new Date(materialCreatedAt.getTime() + this.accessTtlMs).toISOString();
-    const session: DyNTS_AccountSessionRecord_Interface = {
-      sessionId: set.sessionId,
-      familyId: set.familyId,
-      subjectId: set.subjectId,
-      accessTokenHash: this.hashToken(rawAccessToken),
-      accessExpiresAt: accessExpiresAt,
-      refreshExpiresAt: set.refreshExpiresAt,
-      state: DyNTS_AccountSessionState_Type.active,
-      generation: set.generation,
-      revision: set.revision,
-      authorizationVersion: set.authorizationVersion,
-      createdAt: set.createdAt,
-      lastRotatedAt: set.materialCreatedAt,
-      revokedAt: '',
-      revocationReason: '',
-      context: { ...set.context },
-    };
-    const refreshTokenRecord: DyNTS_AccountRefreshTokenRecord_Interface = {
-      tokenHash: this.hashToken(rawRefreshToken),
-      sessionId: set.sessionId,
-      familyId: set.familyId,
-      subjectId: set.subjectId,
-      generation: set.generation,
-      state: DyNTS_AccountRefreshTokenState_Type.active,
-      expiresAt: set.refreshExpiresAt,
-      usedAt: '',
-    };
-
-    return {
-      rawAccessToken: rawAccessToken,
-      rawRefreshToken: rawRefreshToken,
-      session: session,
-      refreshToken: refreshTokenRecord,
-    };
-  }
-
-  private toTokenPair(material: DyNTS_NewSessionMaterial): DyNTS_AccountSessionTokenPair_Interface {
-    return {
-      sessionId: material.session.sessionId,
-      accessToken: material.rawAccessToken,
-      refreshToken: material.rawRefreshToken,
-      accessExpiresAt: material.session.accessExpiresAt,
-      refreshExpiresAt: material.session.refreshExpiresAt,
-    };
-  }
-
-  private hashToken(token: string): string {
-    return createHash('sha256').update(token).digest('hex');
-  }
-
-  private validateSettings(): void {
-    if (
-      !this.adapter
-      || !Number.isSafeInteger(this.accessTtlMs)
-      || this.accessTtlMs < 1_000
-      || this.accessTtlMs > 24 * 60 * 60 * 1000
-      || !Number.isSafeInteger(this.refreshTtlMs)
-      || this.refreshTtlMs <= this.accessTtlMs
-      || this.refreshTtlMs > 366 * 24 * 60 * 60 * 1000
-      || !Number.isSafeInteger(this.tokenBytes)
-      || this.tokenBytes < 32
-      || this.tokenBytes > 128
-      || !Number.isSafeInteger(this.maxRefreshRotations)
-      || this.maxRefreshRotations < 1
-      || this.maxRefreshRotations > 10_000
-    ) {
-      throw new DyFM_Error({
-        status: 500,
-        errorCode: `${DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|SESSION_SETTINGS_INVALID`,
-        message: 'The account session settings are outside supported safe bounds.',
-        userMessage: 'The account security service is unavailable.',
-        issuerService: this.constructor.name,
-      });
-    }
-  }
-
-  private validateContext(context: DyNTS_AccountSessionContext_Interface): void {
-    if (
-      !context
-      || typeof context.deviceName !== 'string'
-      || typeof context.ipAddressHash !== 'string'
-      || typeof context.userAgentHash !== 'string'
-      || context.deviceName.length > 160
-      || context.ipAddressHash.length > 128
-      || context.userAgentHash.length > 128
-    ) {
-      throw this.buildUnauthorized('SESSION_CONTEXT_INVALID');
-    }
-  }
-
-  private validateRevocation(targetId: string, reasonCode: string): void {
-    if (!targetId || !reasonCode || reasonCode.length > 128) {
-      throw this.buildUnauthorized('SESSION_REVOCATION_INVALID');
-    }
-  }
-
-  private isFutureDate(value: string, now: Date): boolean {
-    const timestamp: number = new Date(value).getTime();
-
-    return Number.isFinite(timestamp) && timestamp > now.getTime();
-  }
-
-  private buildUnauthorized(errorCode: string): DyFM_Error {
-    return new DyFM_Error({
-      status: 401,
-      errorCode: `${DyNTS_global_settings.systemShortCodeName}|ACCOUNT_SECURITY|${errorCode}`,
-      message: 'Opaque account credential validation failed.',
-      userMessage: 'The session is invalid or has expired. Please sign in again.',
-      issuerService: this.constructor.name,
-    });
-  }
-}

package/src/_modules/account-security/index.ts

@@ -1,31 +0,0 @@
-export { DyNTS_AccountPassword_ControlService } from './account-password.control-service';
-export { DyNTS_AccountChallenge_ControlService } from './account-challenge.control-service';
-export { DyNTS_AccountSession_ControlService } from './account-session.control-service';
-export { DyNTS_AccountChallengePurpose_Type } from './_enums/account-challenge-purpose.type-enum';
-export { DyNTS_AccountRefreshTokenState_Type } from './_enums/account-refresh-token-state.type-enum';
-export { DyNTS_AccountSessionState_Type } from './_enums/account-session-state.type-enum';
-export {
-  DyNTS_AccountRefreshTokenRecord_Interface
-} from './_models/account-refresh-token-record.interface';
-export { DyNTS_AccountChallengeAdapter_Interface } from './_models/account-challenge-adapter.interface';
-export { DyNTS_AccountChallengeIssued_Interface } from './_models/account-challenge-issued.interface';
-export { DyNTS_AccountChallengeRecord_Interface } from './_models/account-challenge-record.interface';
-export { DyNTS_AccountChallengeResult_Interface } from './_models/account-challenge-result.interface';
-export { DyNTS_AccountChallengeSettings_Interface } from './_models/account-challenge-settings.interface';
-export {
-  DyNTS_AccountSessionAdapter_Interface
-} from './_models/account-session-adapter.interface';
-export { DyNTS_AccountSessionCreate_Interface } from './_models/account-session-create.interface';
-export { DyNTS_AccountSessionRotate_Interface } from './_models/account-session-rotate.interface';
-export { DyNTS_AccountSessionClaims_Interface } from './_models/account-session-claims.interface';
-export { DyNTS_AccountSessionContext_Interface } from './_models/account-session-context.interface';
-export { DyNTS_AccountSessionRecord_Interface } from './_models/account-session-record.interface';
-export { DyNTS_AccountSessionSettings_Interface } from './_models/account-session-settings.interface';
-export { DyNTS_AccountSessionTokenPair_Interface } from './_models/account-session-token-pair.interface';
-export { DyNTS_AccountSessionView_Interface } from './_models/account-session-view.interface';
-export {
-  DyNTS_AccountPasswordPolicy_Interface
-} from './_models/account-password-policy.interface';
-export {
-  DyNTS_AccountPasswordVerification_Interface
-} from './_models/account-password-verification.interface';

package/src/_modules/admin-auth/_models/admin-api-key-config.interface.ts

@@ -1,33 +0,0 @@
-/**
- * Config a `DyNTS_AdminApiKey_AuthService.configure(...)`-hoz.
- *
- * Minden mezo opcionalis — a default-ok megfelelnek a tipikus hasznalat-eset
- * elvarasanak (DYNTS_ADMIN_API_KEY env var + x-admin-api-key header +
- * Bearer fallback).
- */
-export interface DyNTS_AdminApiKey_Config {
-  /**
-   * Env var nev, ahonnan az admin API key olvasodik.
-   * Default: `DYNTS_ADMIN_API_KEY`.
-   *
-   * Override-olhato pl. multi-tenant deploy-okhoz vagy ha a host app
-   * mas konvenciot kovet (`MY_APP_ADMIN_KEY`, stb.).
-   */
-  envVarName?: string;
-
-  /**
-   * HTTP header nev (case-insensitive — Express normalizalja lowercase-re).
-   * Default: `x-admin-api-key`.
-   */
-  headerName?: string;
-
-  /**
-   * Engedi-e az `Authorization: Bearer <key>` fallback-et a primer header
-   * helyett. Default: `true`.
-   *
-   * Hasznos amikor a kliens egy generikus HTTP klienst hasznal ami csak
-   * az Authorization header-t allitja, vagy amikor proxy-k strippelik
-   * a custom header-eket.
-   */
-  allowAuthorizationBearer?: boolean;
-}

package/src/_modules/admin-auth/admin-api-key.auth-service.spec.ts

@@ -1,200 +0,0 @@
-import { Request, Response } from 'express';
-
-import { DyFM_Error } from '@futdevpro/fsm-dynamo';
-
-import { DyNTS_AdminApiKey_AuthService } from './admin-api-key.auth-service';
-
-
-const TEST_KEY: string = 'super-secret-admin-key-1234567890';
-const TEST_ENV_VAR: string = 'DYNTS_ADMIN_API_KEY';
-
-
-/** Test-only — minimal Request mock-ot ad vissza adott headers-szel. */
-const mockReq = (headers: Record<string, string | undefined> = {}): Request => {
-  return { headers: headers } as unknown as Request;
-};
-
-/** Test-only — minimal Response stub (verify nem irja, csak typing miatt kell). */
-const mockRes = (): Response => {
-  return {} as unknown as Response;
-};
-
-
-describe('| DyNTS_AdminApiKey_AuthService', (): void => {
-  let svc: DyNTS_AdminApiKey_AuthService;
-  let originalEnv: string | undefined;
-
-  beforeEach((): void => {
-    svc = DyNTS_AdminApiKey_AuthService.getInstance();
-    svc._resetForTesting();
-    originalEnv = process.env[TEST_ENV_VAR];
-  });
-
-  afterEach((): void => {
-    svc._resetForTesting();
-    if (originalEnv === undefined) {
-      delete process.env[TEST_ENV_VAR];
-    } else {
-      process.env[TEST_ENV_VAR] = originalEnv;
-    }
-  });
-
-
-  describe('| verify() — config errors', (): void => {
-    it('| 500 ha az env var nincs beallitva', async (): Promise<void> => {
-      delete process.env[TEST_ENV_VAR];
-      let thrown: any = null;
-      try { await svc.verify(mockReq({}), mockRes()); } catch (e) { thrown = e; }
-      expect(thrown).not.toBeNull();
-      expect(DyFM_Error.getErrorStatus(thrown)).toBe(500);
-      expect(DyFM_Error.getErrorCode(thrown)).toContain('DyNTS-AAK-CONFIG');
-    });
-
-    it('| 500 ha az env var ures string', async (): Promise<void> => {
-      process.env[TEST_ENV_VAR] = '';
-      let thrown: any = null;
-      try { await svc.verify(mockReq({}), mockRes()); } catch (e) { thrown = e; }
-      expect(thrown).not.toBeNull();
-      expect(DyFM_Error.getErrorStatus(thrown)).toBe(500);
-    });
-  });
-
-  describe('| verify() — auth errors', (): void => {
-    beforeEach((): void => { process.env[TEST_ENV_VAR] = TEST_KEY; });
-
-    it('| 401 ha a header teljesen hianyzik', async (): Promise<void> => {
-      let thrown: any = null;
-      try { await svc.verify(mockReq({}), mockRes()); } catch (e) { thrown = e; }
-      expect(thrown).not.toBeNull();
-      expect(DyFM_Error.getErrorStatus(thrown)).toBe(401);
-      expect(DyFM_Error.getErrorCode(thrown)).toContain('DyNTS-AAK-MISSING');
-    });
-
-    it('| 401 ha a header rossz erteku', async (): Promise<void> => {
-      let thrown: any = null;
-      try {
-        await svc.verify(mockReq({ 'x-admin-api-key': 'wrong-key' }), mockRes());
-      } catch (e) { thrown = e; }
-      expect(thrown).not.toBeNull();
-      expect(DyFM_Error.getErrorStatus(thrown)).toBe(401);
-      expect(DyFM_Error.getErrorCode(thrown)).toContain('DyNTS-AAK-INVALID');
-    });
-
-    it('| 401 length-mismatch eseten is (timing-safe path)', async (): Promise<void> => {
-      let thrown: any = null;
-      try {
-        await svc.verify(mockReq({ 'x-admin-api-key': 'short' }), mockRes());
-      } catch (e) { thrown = e; }
-      expect(thrown).not.toBeNull();
-      expect(DyFM_Error.getErrorStatus(thrown)).toBe(401);
-      expect(DyFM_Error.getErrorCode(thrown)).toContain('DyNTS-AAK-INVALID');
-    });
-  });
-
-  describe('| verify() — happy paths', (): void => {
-    beforeEach((): void => { process.env[TEST_ENV_VAR] = TEST_KEY; });
-
-    it('| silent pass ha az x-admin-api-key header egyezik', async (): Promise<void> => {
-      await expectAsync(
-        svc.verify(mockReq({ 'x-admin-api-key': TEST_KEY }), mockRes()),
-      ).toBeResolved();
-    });
-
-    it('| silent pass Authorization Bearer fallback-bol (default engedelyezve)', async (): Promise<void> => {
-      await expectAsync(
-        svc.verify(mockReq({ authorization: `Bearer ${TEST_KEY}` }), mockRes()),
-      ).toBeResolved();
-    });
-
-    it('| silent pass Authorization Bearer kis-nagybetu case-insensitive', async (): Promise<void> => {
-      await expectAsync(
-        svc.verify(mockReq({ authorization: `bearer ${TEST_KEY}` }), mockRes()),
-      ).toBeResolved();
-    });
-  });
-
-  describe('| configure() — overrides', (): void => {
-    it('| custom envVarName-bol olvas', async (): Promise<void> => {
-      svc.configure({ envVarName: 'MY_CUSTOM_KEY' });
-      process.env['MY_CUSTOM_KEY'] = TEST_KEY;
-
-      await expectAsync(
-        svc.verify(mockReq({ 'x-admin-api-key': TEST_KEY }), mockRes()),
-      ).toBeResolved();
-
-      delete process.env['MY_CUSTOM_KEY'];
-    });
-
-    it('| custom headerName-rol olvas', async (): Promise<void> => {
-      process.env[TEST_ENV_VAR] = TEST_KEY;
-      svc.configure({ headerName: 'x-my-admin' });
-
-      // Default x-admin-api-key MOSTANTOL NEM mukodik
-      let thrown: any = null;
-      try {
-        await svc.verify(mockReq({ 'x-admin-api-key': TEST_KEY }), mockRes());
-      } catch (e) { thrown = e; }
-      expect(thrown).not.toBeNull();
-      expect(DyFM_Error.getErrorStatus(thrown)).toBe(401);
-
-      // Az uj header viszont igen
-      await expectAsync(
-        svc.verify(mockReq({ 'x-my-admin': TEST_KEY }), mockRes()),
-      ).toBeResolved();
-    });
-
-    it('| allowAuthorizationBearer=false letiltja a Bearer fallback-et', async (): Promise<void> => {
-      process.env[TEST_ENV_VAR] = TEST_KEY;
-      svc.configure({ allowAuthorizationBearer: false });
-
-      let thrown: any = null;
-      try {
-        await svc.verify(mockReq({ authorization: `Bearer ${TEST_KEY}` }), mockRes());
-      } catch (e) { thrown = e; }
-      expect(thrown).not.toBeNull();
-      expect(DyFM_Error.getErrorStatus(thrown)).toBe(401);
-    });
-
-    it('| configure() partial override — a tobbi mezo default marad', (): void => {
-      svc.configure({ headerName: 'x-only-header' });
-      const config = svc.getConfig();
-      expect(config.headerName).toBe('x-only-header');
-      expect(config.envVarName).toBe('DYNTS_ADMIN_API_KEY');
-      expect(config.allowAuthorizationBearer).toBe(true);
-    });
-
-    it('| configure() headerName lowercase-re normalizal', (): void => {
-      svc.configure({ headerName: 'X-Mixed-Case-Header' });
-      expect(svc.getConfig().headerName).toBe('x-mixed-case-header');
-    });
-  });
-
-  describe('| env-read-on-each-call (dynamic)', (): void => {
-    it('| env var update kozben hat: install-utani env-modositas ervenyes', async (): Promise<void> => {
-      delete process.env[TEST_ENV_VAR];
-      // Elso hivas: env hianyzik → 500
-      let thrown: any = null;
-      try { await svc.verify(mockReq({}), mockRes()); } catch (e) { thrown = e; }
-      expect(DyFM_Error.getErrorStatus(thrown)).toBe(500);
-
-      // Most allitsuk be az env-et
-      process.env[TEST_ENV_VAR] = TEST_KEY;
-
-      // Masodik hivas helyes header-rel → pass
-      await expectAsync(
-        svc.verify(mockReq({ 'x-admin-api-key': TEST_KEY }), mockRes()),
-      ).toBeResolved();
-    });
-  });
-
-  describe('| .verify binding', (): void => {
-    it('| verify atadhato preProcesses-be detached method-kent (this-binding megtarttva)', async (): Promise<void> => {
-      process.env[TEST_ENV_VAR] = TEST_KEY;
-      const detached: (req: Request, res: Response) => Promise<void> = svc.verify;
-      // NEM call-ban svc.verify(...) hanem szabad fuggveny-kent — bindelt this-re kell hagyatkozni
-      await expectAsync(
-        detached(mockReq({ 'x-admin-api-key': TEST_KEY }), mockRes()),
-      ).toBeResolved();
-    });
-  });
-});