@hazeljs/auth 0.2.0-beta.55 → 0.2.0-beta.57

package/dist/auth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth.test.d.ts.map

package/dist/auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.d.ts","sourceRoot":"","sources":["../src/auth.test.ts"],"names":[],"mappings":""}

package/dist/auth.test.js

@@ -0,0 +1,331 @@
+"use strict";
+/// <reference types="jest" />
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+jest.mock('@hazeljs/core', () => ({
+    __esModule: true,
+    Service: () => () => undefined,
+    Injectable: () => () => undefined,
+    HazelModule: () => () => undefined,
+    RequestContext: class {
+    },
+    Container: {
+        getInstance: jest.fn(),
+    },
+    Type: class {
+    },
+    logger: { info: jest.fn(), debug: jest.fn(), warn: jest.fn(), error: jest.fn() },
+    default: { info: jest.fn(), debug: jest.fn(), warn: jest.fn(), error: jest.fn() },
+}));
+const core_1 = require("@hazeljs/core");
+const jwt_service_1 = require("./jwt/jwt.service");
+const auth_service_1 = require("./auth.service");
+const auth_guard_1 = require("./auth.guard");
+const auth_guard_2 = require("./auth.guard");
+const jwt_module_1 = require("./jwt/jwt.module");
+const TEST_SECRET = 'test-secret-key-for-unit-tests';
+describe('JwtService', () => {
+    beforeEach(() => {
+        jwt_service_1.JwtService.configure({ secret: TEST_SECRET, expiresIn: '1h' });
+    });
+    afterEach(() => {
+        jwt_service_1.JwtService.configure({});
+    });
+    it('throws if no secret is configured', () => {
+        jwt_service_1.JwtService.configure({});
+        delete process.env.JWT_SECRET;
+        expect(() => new jwt_service_1.JwtService()).toThrow('JWT secret is not configured');
+    });
+    it('uses JWT_SECRET env var when no configure() secret', () => {
+        jwt_service_1.JwtService.configure({});
+        process.env.JWT_SECRET = 'env-secret';
+        expect(() => new jwt_service_1.JwtService()).not.toThrow();
+        delete process.env.JWT_SECRET;
+    });
+    it('signs and verifies a payload', () => {
+        const svc = new jwt_service_1.JwtService();
+        const token = svc.sign({ sub: 'user-1', role: 'admin' });
+        expect(typeof token).toBe('string');
+        const payload = svc.verify(token);
+        expect(payload.sub).toBe('user-1');
+        expect(payload.role).toBe('admin');
+    });
+    it('sign accepts a custom expiresIn', () => {
+        const svc = new jwt_service_1.JwtService();
+        const token = svc.sign({ sub: 'user-2' }, { expiresIn: '2h' });
+        const payload = svc.verify(token);
+        expect(payload.sub).toBe('user-2');
+    });
+    it('decode returns payload without verification', () => {
+        const svc = new jwt_service_1.JwtService();
+        const token = svc.sign({ sub: 'user-3', data: 'test' });
+        const decoded = svc.decode(token);
+        expect(decoded?.sub).toBe('user-3');
+        expect(decoded?.data).toBe('test');
+    });
+    it('decode returns null for invalid token string', () => {
+        const svc = new jwt_service_1.JwtService();
+        const decoded = svc.decode('not-a-jwt');
+        expect(decoded).toBeNull();
+    });
+    it('verify throws for invalid token', () => {
+        const svc = new jwt_service_1.JwtService();
+        expect(() => svc.verify('bad-token')).toThrow();
+    });
+    it('verify throws for token signed with different secret', () => {
+        jwt_service_1.JwtService.configure({ secret: 'other-secret' });
+        const other = new jwt_service_1.JwtService();
+        const token = other.sign({ sub: 'x' });
+        jwt_service_1.JwtService.configure({ secret: TEST_SECRET });
+        const svc = new jwt_service_1.JwtService();
+        expect(() => svc.verify(token)).toThrow();
+    });
+    it('configure() sets module options used by constructor', () => {
+        jwt_service_1.JwtService.configure({
+            secret: 'configured-secret',
+            expiresIn: '30m',
+            issuer: 'hazel',
+            audience: 'app',
+        });
+        const svc = new jwt_service_1.JwtService();
+        const token = svc.sign({ sub: 'u' });
+        expect(typeof token).toBe('string');
+    });
+    it('uses JWT_EXPIRES_IN env var', () => {
+        jwt_service_1.JwtService.configure({ secret: TEST_SECRET });
+        process.env.JWT_EXPIRES_IN = '2h';
+        const svc = new jwt_service_1.JwtService();
+        const token = svc.sign({ sub: 'u' });
+        expect(typeof token).toBe('string');
+        delete process.env.JWT_EXPIRES_IN;
+    });
+    it('uses JWT_ISSUER and JWT_AUDIENCE env vars', () => {
+        jwt_service_1.JwtService.configure({ secret: TEST_SECRET });
+        process.env.JWT_ISSUER = 'my-issuer';
+        process.env.JWT_AUDIENCE = 'my-audience';
+        const svc = new jwt_service_1.JwtService();
+        const token = svc.sign({ sub: 'u' });
+        expect(typeof token).toBe('string');
+        delete process.env.JWT_ISSUER;
+        delete process.env.JWT_AUDIENCE;
+    });
+});
+describe('AuthService', () => {
+    let jwtService;
+    let authService;
+    beforeEach(() => {
+        jwt_service_1.JwtService.configure({ secret: TEST_SECRET });
+        jwtService = new jwt_service_1.JwtService();
+        authService = new auth_service_1.AuthService(jwtService);
+    });
+    afterEach(() => {
+        jwt_service_1.JwtService.configure({});
+    });
+    it('verifyToken returns user for valid token', async () => {
+        const token = jwtService.sign({ sub: 'user-1', role: 'admin', username: 'alice' });
+        const user = await authService.verifyToken(token);
+        expect(user).not.toBeNull();
+        expect(user?.id).toBe('user-1');
+        expect(user?.role).toBe('admin');
+        expect(user?.username).toBe('alice');
+    });
+    it('verifyToken returns user with email as username fallback', async () => {
+        const token = jwtService.sign({ sub: 'user-2', email: 'bob@example.com' });
+        const user = await authService.verifyToken(token);
+        expect(user?.username).toBe('bob@example.com');
+    });
+    it('verifyToken defaults role to "user" when not in payload', async () => {
+        const token = jwtService.sign({ sub: 'user-3' });
+        const user = await authService.verifyToken(token);
+        expect(user?.role).toBe('user');
+    });
+    it('verifyToken returns null for invalid token', async () => {
+        const user = await authService.verifyToken('invalid-token');
+        expect(user).toBeNull();
+    });
+    it('verifyToken returns null when jwtService.verify throws', async () => {
+        const mockJwt = {
+            verify: jest.fn().mockImplementation(() => {
+                throw new Error('jwt expired');
+            }),
+        };
+        const svc = new auth_service_1.AuthService(mockJwt);
+        const user = await svc.verifyToken('any-token');
+        expect(user).toBeNull();
+    });
+});
+describe('AuthGuard', () => {
+    let jwtService;
+    let authService;
+    let guard;
+    function makeContext(overrides = {}) {
+        return {
+            headers: {},
+            method: 'GET',
+            url: '/test',
+            ...overrides,
+        };
+    }
+    beforeEach(() => {
+        jwt_service_1.JwtService.configure({ secret: TEST_SECRET });
+        jwtService = new jwt_service_1.JwtService();
+        authService = new auth_service_1.AuthService(jwtService);
+        guard = new auth_guard_1.AuthGuard(authService);
+    });
+    afterEach(() => {
+        jwt_service_1.JwtService.configure({});
+    });
+    it('throws 400 when no authorization header', async () => {
+        const ctx = makeContext();
+        await expect(guard.canActivate(ctx)).rejects.toMatchObject({
+            message: 'No authorization header',
+            status: 400,
+        });
+    });
+    it('throws 400 when authorization header has no token part', async () => {
+        const ctx = makeContext({ headers: { authorization: 'Bearer' } });
+        await expect(guard.canActivate(ctx)).rejects.toMatchObject({
+            message: 'Invalid authorization header format',
+            status: 400,
+        });
+    });
+    it('throws 401 when token is invalid', async () => {
+        const ctx = makeContext({ headers: { authorization: 'Bearer badtoken' } });
+        await expect(guard.canActivate(ctx)).rejects.toMatchObject({ status: 401 });
+    });
+    it('returns true and attaches user for valid token', async () => {
+        const token = jwtService.sign({ sub: 'u1', role: 'user' });
+        const ctx = makeContext({ headers: { authorization: `Bearer ${token}` } });
+        const result = await guard.canActivate(ctx);
+        expect(result).toBe(true);
+        expect(ctx.user).toBeDefined();
+    });
+    it('throws 403 when user role is not in required roles', async () => {
+        const token = jwtService.sign({ sub: 'u2', role: 'user' });
+        const ctx = makeContext({ headers: { authorization: `Bearer ${token}` } });
+        await expect(guard.canActivate(ctx, { roles: ['admin'] })).rejects.toMatchObject({
+            message: 'Insufficient permissions',
+            status: 403,
+        });
+    });
+    it('returns true when user role matches required roles', async () => {
+        const token = jwtService.sign({ sub: 'u3', role: 'admin' });
+        const ctx = makeContext({ headers: { authorization: `Bearer ${token}` } });
+        const result = await guard.canActivate(ctx, { roles: ['admin', 'superadmin'] });
+        expect(result).toBe(true);
+    });
+    it('logs stack trace in development mode', async () => {
+        const originalEnv = process.env.NODE_ENV;
+        process.env.NODE_ENV = 'development';
+        const ctx = makeContext({ headers: { authorization: 'Bearer bad' } });
+        await expect(guard.canActivate(ctx)).rejects.toBeDefined();
+        process.env.NODE_ENV = originalEnv;
+    });
+});
+describe('Auth decorator', () => {
+    let jwtService;
+    let authService;
+    let guard;
+    beforeEach(() => {
+        jwt_service_1.JwtService.configure({ secret: TEST_SECRET });
+        jwtService = new jwt_service_1.JwtService();
+        authService = new auth_service_1.AuthService(jwtService);
+        guard = new auth_guard_1.AuthGuard(authService);
+    });
+    afterEach(() => {
+        jwt_service_1.JwtService.configure({});
+    });
+    it('calls the original method when auth passes', async () => {
+        core_1.Container.getInstance.mockReturnValue({
+            resolve: jest.fn().mockReturnValue(guard),
+        });
+        const token = jwtService.sign({ sub: 'u1', role: 'user' });
+        class TestController {
+            async getResource(_context) {
+                return 'ok';
+            }
+        }
+        __decorate([
+            (0, auth_guard_2.Auth)(),
+            __metadata("design:type", Function),
+            __metadata("design:paramtypes", [Object]),
+            __metadata("design:returntype", Promise)
+        ], TestController.prototype, "getResource", null);
+        const ctrl = new TestController();
+        const ctx = {
+            headers: { authorization: `Bearer ${token}` },
+            method: 'GET',
+            url: '/test',
+        };
+        const result = await ctrl.getResource(ctx);
+        expect(result).toBe('ok');
+    });
+    it('throws when guard is not found in container', async () => {
+        core_1.Container.getInstance.mockReturnValue({
+            resolve: jest.fn().mockReturnValue(null),
+        });
+        class TestController {
+            async getResource(_context) {
+                return 'ok';
+            }
+        }
+        __decorate([
+            (0, auth_guard_2.Auth)(),
+            __metadata("design:type", Function),
+            __metadata("design:paramtypes", [Object]),
+            __metadata("design:returntype", Promise)
+        ], TestController.prototype, "getResource", null);
+        const ctrl = new TestController();
+        const ctx = {
+            headers: { authorization: 'Bearer sometoken' },
+            method: 'GET',
+            url: '/test',
+        };
+        await expect(ctrl.getResource(ctx)).rejects.toThrow('AuthGuard not found');
+    });
+    it('propagates auth errors from guard', async () => {
+        core_1.Container.getInstance.mockReturnValue({
+            resolve: jest.fn().mockReturnValue(guard),
+        });
+        class TestController {
+            async adminOnly(_context) {
+                return 'admin';
+            }
+        }
+        __decorate([
+            (0, auth_guard_2.Auth)({ roles: ['admin'] }),
+            __metadata("design:type", Function),
+            __metadata("design:paramtypes", [Object]),
+            __metadata("design:returntype", Promise)
+        ], TestController.prototype, "adminOnly", null);
+        const ctrl = new TestController();
+        const token = jwtService.sign({ sub: 'u2', role: 'user' });
+        const ctx = {
+            headers: { authorization: `Bearer ${token}` },
+            method: 'GET',
+            url: '/admin',
+        };
+        await expect(ctrl.adminOnly(ctx)).rejects.toMatchObject({
+            message: 'Insufficient permissions',
+        });
+    });
+});
+describe('JwtModule', () => {
+    it('forRoot returns JwtModule', () => {
+        const result = jwt_module_1.JwtModule.forRoot({ secret: TEST_SECRET });
+        expect(result).toBe(jwt_module_1.JwtModule);
+    });
+    it('forRoot without options returns JwtModule', () => {
+        jwt_service_1.JwtService.configure({ secret: TEST_SECRET });
+        const result = jwt_module_1.JwtModule.forRoot();
+        expect(result).toBe(jwt_module_1.JwtModule);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hazeljs/auth",
-  "version": "0.2.0-beta.55",
+  "version": "0.2.0-beta.57",
   "description": "Authentication and JWT module for HazelJS framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -51,5 +51,5 @@
   "peerDependencies": {
     "@hazeljs/core": ">=0.2.0-beta.0"
   },
-  "gitHead": "f2e54f346eea552595a44607999454a9e388cb9e"
+  "gitHead": "98c84683e8f487c660e344c2beda3a8dcaaff07f"
 }