@lenne.tech/nest-server 11.32.4 → 11.33.0

package/src/core/common/services/brevo.service.spec.ts

@@ -1,266 +0,0 @@
-import { Logger } from '@nestjs/common';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import type { Brevo, BrevoClient as RealBrevoClient } from '@getbrevo/brevo';
-
-import { BrevoService } from './brevo.service';
-import type { ConfigService } from './config.service';
-
-/**
- * Type-level contract against the REAL SDK.
- *
- * Everything below runs against a hand-written mock, so the mock alone could keep passing after a
- * breaking SDK upgrade. `sendMail()` is declared `Promise<unknown>`, which gives tsc nothing to
- * check either. These assertions close that gap: they compile against the installed
- * `@getbrevo/brevo`, and `pnpm run typecheck:tests` covers `src/**\/*.spec.ts`, so a v7 that
- * re-introduces a `.body` envelope or renames the request type fails the build here rather than
- * silently at runtime.
- */
-type SendFn = RealBrevoClient['transactionalEmails']['sendTransacEmail'];
-/** Awaiting the call must yield the payload itself — v3's `{ response, body }` envelope is gone. */
-type AssertNoEnvelope = Awaited<ReturnType<SendFn>> extends { body: unknown } ? never : true;
-/** The request type the service builds must still be assignable to the SDK's parameter. */
-type AssertRequestType = Brevo.SendTransacEmailRequest extends NonNullable<Parameters<SendFn>[0]> ? true : never;
-// Consumed by an assertion below so the contract cannot be dead-code-eliminated or linted away.
-const sdkContract: [AssertNoEnvelope, AssertRequestType] = [true, true];
-
-/**
- * Shared handles into the mocked SDK. `vi.hoisted` runs before the `vi.mock` factory below, so the
- * spies exist by the time the module graph is wired up.
- */
-const brevoMock = vi.hoisted(() => ({
-  /** Every options object the client was constructed with, in call order. */
-  clientOptions: [] as unknown[],
-  sendTransacEmail: vi.fn(),
-}));
-
-vi.mock('@getbrevo/brevo', () => ({
-  BrevoClient: class {
-    transactionalEmails = { sendTransacEmail: brevoMock.sendTransacEmail };
-
-    constructor(options: unknown) {
-      brevoMock.clientOptions.push(options);
-    }
-  },
-}));
-
-const API_KEY = 'test-api-key';
-const SENDER = { email: 'noreply@test.com', name: 'Test Sender' };
-
-/** Matches the per-send `Idempotency-Key` header without pinning the random UUID. */
-const anyIdempotencyHeaders = { 'Idempotency-Key': expect.any(String) as unknown as string };
-
-/**
- * Minimal ConfigService double.
- *
- * `exclude` can be set independently on the mutable (`config`) and the frozen
- * (`configFastButReadOnly`) side so the tests can prove which one the service reads.
- */
-function makeConfigService(
-  options: {
-    exclude?: RegExp;
-    frozenExclude?: RegExp;
-    maxRetries?: number;
-    throwOnError?: boolean;
-    timeoutInSeconds?: number;
-    withBrevo?: boolean;
-  } = {},
-): ConfigService {
-  const { exclude, frozenExclude = exclude, maxRetries, throwOnError, timeoutInSeconds, withBrevo = true } = options;
-  const base = { apiKey: API_KEY, maxRetries, sender: SENDER, throwOnError, timeoutInSeconds };
-  return {
-    config: withBrevo ? { brevo: { ...base, exclude } } : {},
-    configFastButReadOnly: withBrevo ? { brevo: { ...base, exclude: frozenExclude } } : {},
-  } as unknown as ConfigService;
-}
-
-describe('@getbrevo/brevo SDK contract', () => {
-  it('still resolves the payload directly and accepts the request type we build', () => {
-    // The assertion is the COMPILATION of `sdkContract` above, which `pnpm run typecheck:tests`
-    // performs against the really installed SDK. This test body exists so the contract is also
-    // referenced at runtime — otherwise it reads as dead code and invites deletion.
-    expect(sdkContract).toEqual([true, true]);
-  });
-});
-
-describe('BrevoService', () => {
-  let loggerError: ReturnType<typeof vi.spyOn>;
-
-  beforeEach(() => {
-    brevoMock.sendTransacEmail.mockReset();
-    brevoMock.clientOptions.length = 0;
-    loggerError = vi.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
-  });
-
-  afterEach(() => {
-    // The spies above are never restored otherwise. File-level isolation contains it today, but a
-    // leaked Logger spy is the kind of thing that only surfaces as an unrelated flake later.
-    vi.restoreAllMocks();
-  });
-
-  describe('constructor', () => {
-    it('throws when the Brevo configuration is missing', () => {
-      expect(() => new BrevoService(makeConfigService({ withBrevo: false }))).toThrow('Brevo configuration not set!');
-    });
-
-    it('does NOT construct the SDK client eagerly', async () => {
-      // The SDK is ~580 CommonJS modules and BrevoService is re-exported from the package barrel,
-      // so a static import would put that cost on every consumer's cold start — including the
-      // majority that never configure Brevo.
-      const service = new BrevoService(makeConfigService());
-      expect(brevoMock.clientOptions).toEqual([]);
-
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      await service.sendMail('user@example.com', 42);
-      expect(brevoMock.clientOptions).toHaveLength(1);
-    });
-
-    it('creates the client with the configured API key and safe request limits', async () => {
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      const service = new BrevoService(makeConfigService());
-      await service.sendMail('user@example.com', 42);
-
-      // The SDK defaults to 2 retries honouring `Retry-After` with a 60 s cap PER attempt and to
-      // no timeout at all. Both send methods are awaited inside request handlers, so those
-      // defaults would let a rate-limited Brevo park a user-facing request for ~2 minutes.
-      expect(brevoMock.clientOptions).toEqual([{ apiKey: API_KEY, maxRetries: 0, timeoutInSeconds: 10 }]);
-    });
-
-    it('honours configured retry and timeout overrides', async () => {
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      const service = new BrevoService(makeConfigService({ maxRetries: 3, timeoutInSeconds: 30 }));
-      await service.sendMail('user@example.com', 42);
-      expect(brevoMock.clientOptions).toEqual([{ apiKey: API_KEY, maxRetries: 3, timeoutInSeconds: 30 }]);
-    });
-
-    it('reuses the client across sends', async () => {
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      const service = new BrevoService(makeConfigService());
-      await service.sendMail('user@example.com', 42);
-      await service.sendMail('other@example.com', 42);
-      expect(brevoMock.clientOptions).toHaveLength(1);
-    });
-  });
-
-  describe('sendMail', () => {
-    it('rejects incomplete input without calling the API', async () => {
-      const service = new BrevoService(makeConfigService());
-      await expect(service.sendMail('', 42)).resolves.toBe(false);
-      await expect(service.sendMail('user@example.com', 0)).resolves.toBe(false);
-      expect(brevoMock.sendTransacEmail).not.toHaveBeenCalled();
-    });
-
-    it('sends template, recipient and params, and returns the response unwrapped', async () => {
-      const response = { messageId: '<mail-1@brevo>' };
-      brevoMock.sendTransacEmail.mockResolvedValue(response);
-      const service = new BrevoService(makeConfigService());
-
-      // Identity check: v6 resolves the payload directly, there is no `.body` envelope any more
-      await expect(service.sendMail('user@example.com', 42, { name: 'Test' })).resolves.toBe(response);
-      expect(brevoMock.sendTransacEmail).toHaveBeenCalledWith({
-        headers: anyIdempotencyHeaders,
-        params: { name: 'Test' },
-        templateId: 42,
-        to: [{ email: 'user@example.com' }],
-      });
-    });
-
-    it('sends a unique Idempotency-Key per call', async () => {
-      // The SDK retries POSTs on 408/429/5xx. Without a key, a retry issued after a delivered
-      // response whose reply was lost sends the mail twice.
-      brevoMock.sendTransacEmail.mockResolvedValue({ messageId: '<x@brevo>' });
-      const service = new BrevoService(makeConfigService());
-      await service.sendMail('user@example.com', 42);
-      await service.sendMail('user@example.com', 42);
-
-      const keys = brevoMock.sendTransacEmail.mock.calls.map(
-        ([request]) => (request as Brevo.SendTransacEmailRequest).headers?.['Idempotency-Key'],
-      );
-      expect(keys[0]).toBeTypeOf('string');
-      expect(keys[0]).not.toBe(keys[1]);
-    });
-
-    it('skips excluded (test) recipients', async () => {
-      const service = new BrevoService(makeConfigService({ exclude: /@test\.com$/i }));
-      await expect(service.sendMail('user@test.com', 42)).resolves.toBe('TEST_USER!');
-      expect(brevoMock.sendTransacEmail).not.toHaveBeenCalled();
-    });
-
-    it('reads the exclude pattern from the mutable config, not the frozen one', async () => {
-      // A frozen RegExp carrying the `g` flag throws on `.test()` (it assigns `lastIndex`).
-      // Reading `exclude` off `configFastButReadOnly` would therefore fail instead of excluding.
-      const service = new BrevoService(
-        makeConfigService({ exclude: /@test\.com$/i, frozenExclude: Object.freeze(/@test\.com$/gi) }),
-      );
-      await expect(service.sendMail('user@test.com', 42)).resolves.toBe('TEST_USER!');
-    });
-
-    it('returns null when the API call fails', async () => {
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      const service = new BrevoService(makeConfigService());
-      await expect(service.sendMail('user@example.com', 42)).resolves.toBeNull();
-    });
-
-    it('logs the failure through the Nest logger', async () => {
-      // The whole point of the sibling diagnostics work is that silent failures cost debugging
-      // sessions. Asserting only the `null` return would let the observability half regress.
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      const service = new BrevoService(makeConfigService());
-      await service.sendMail('user@example.com', 42);
-      expect(loggerError).toHaveBeenCalledWith(expect.stringContaining('Brevo down'));
-    });
-
-    it('rethrows when throwOnError is enabled', async () => {
-      const service = new BrevoService(makeConfigService({ throwOnError: true }));
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      await expect(service.sendMail('user@example.com', 42)).rejects.toThrow('Brevo down');
-    });
-  });
-
-  describe('sendHtmlMail', () => {
-    it('rejects incomplete input without calling the API', async () => {
-      const service = new BrevoService(makeConfigService());
-      await expect(service.sendHtmlMail('', 'Subject', '<p>Hi</p>')).resolves.toBe(false);
-      await expect(service.sendHtmlMail('user@example.com', '', '<p>Hi</p>')).resolves.toBe(false);
-      await expect(service.sendHtmlMail('user@example.com', 'Subject', '')).resolves.toBe(false);
-      expect(brevoMock.sendTransacEmail).not.toHaveBeenCalled();
-    });
-
-    it('sends html, subject and the configured sender, and returns the response unwrapped', async () => {
-      const response = { messageId: '<mail-2@brevo>' };
-      brevoMock.sendTransacEmail.mockResolvedValue(response);
-      const service = new BrevoService(makeConfigService());
-
-      await expect(
-        service.sendHtmlMail('user@example.com', 'Subject', '<p>Hi</p>', { params: { code: '123' } }),
-      ).resolves.toBe(response);
-      expect(brevoMock.sendTransacEmail).toHaveBeenCalledWith({
-        headers: anyIdempotencyHeaders,
-        htmlContent: '<p>Hi</p>',
-        params: { code: '123' },
-        sender: SENDER,
-        subject: 'Subject',
-        to: [{ email: 'user@example.com' }],
-      });
-    });
-
-    it('skips excluded (test) recipients', async () => {
-      const service = new BrevoService(makeConfigService({ exclude: /@test\.com$/i }));
-      await expect(service.sendHtmlMail('user@test.com', 'Subject', '<p>Hi</p>')).resolves.toBe('TEST_USER!');
-      expect(brevoMock.sendTransacEmail).not.toHaveBeenCalled();
-    });
-
-    it('returns null when the API call fails', async () => {
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      const service = new BrevoService(makeConfigService());
-      await expect(service.sendHtmlMail('user@example.com', 'Subject', '<p>Hi</p>')).resolves.toBeNull();
-    });
-
-    it('logs the failure through the Nest logger', async () => {
-      brevoMock.sendTransacEmail.mockRejectedValue(new Error('Brevo down'));
-      const service = new BrevoService(makeConfigService());
-      await service.sendHtmlMail('user@example.com', 'Subject', '<p>Hi</p>');
-      expect(loggerError).toHaveBeenCalledWith(expect.stringContaining('Brevo down'));
-    });
-  });
-});

package/src/core/modules/file/core-file.controller.spec.ts

@@ -1,164 +0,0 @@
-import { NotFoundException } from '@nestjs/common';
-import type { Response } from 'express';
-import { PassThrough, Readable } from 'stream';
-import { describe, expect, it } from 'vitest';
-
-import type { CoreFileService } from './core-file.service';
-import { CoreFileController, pipeFileToResponse } from './core-file.controller';
-
-/**
- * Build a response stub that records what the handler did to it.
- *
- * A real `Response` is not needed here — what is under test is the decision
- * (status vs. destroy), not Express. Writing it out as a stub also makes the
- * "headers already sent" case reachable, which is awkward to force otherwise.
- *
- * What this stub CANNOT show is how Express itself treats headers: `res.json()`
- * only defaults `Content-Type` when none is set, so a stub whose `json()` merely
- * records a body can never reveal a stale one. That property is pinned at the
- * HTTP level in `tests/file.e2e-spec.ts`; here we assert the removal list.
- */
-function responseStub(headersSent = false) {
-  const sink = new PassThrough();
-  const calls = {
-    destroyed: false,
-    json: undefined as unknown,
-    removed: [] as string[],
-    set: {} as Record<string, string>,
-    status: 0,
-  };
-
-  const res = Object.assign(sink, {
-    destroy: () => {
-      calls.destroyed = true;
-      return res;
-    },
-    headersSent,
-    json: (body: unknown) => {
-      calls.json = body;
-      return res;
-    },
-    removeHeader: (name: string) => {
-      calls.removed.push(name);
-    },
-    setHeader: (name: string, value: string) => {
-      calls.set[name] = value;
-      return res;
-    },
-    status: (code: number) => {
-      calls.status = code;
-      return res;
-    },
-  }) as unknown as Response;
-
-  return { calls, res };
-}
-
-describe('pipeFileToResponse', () => {
-  it('turns a read error into 404 while nothing has been written yet', async () => {
-    // A GridFS record and its bytes are two separate writes, so the record can
-    // outlive the chunks. GridFS reports that on the stream, asynchronously.
-    // A bare `stream.pipe(res)` installs no error handler, so the error goes
-    // unhandled, Node destroys the socket mid-response, and any reverse proxy
-    // in front reports 502 Bad Gateway — "the server is down", which is the one
-    // diagnosis that is wrong while every other route answers normally.
-    const stream = new Readable({ read() {} });
-    const { calls, res } = responseStub(false);
-
-    pipeFileToResponse(stream, res);
-    stream.emit('error', new Error('FileNotFound: file 0123456789ab was not found'));
-    await new Promise((resolve) => setImmediate(resolve));
-
-    expect(calls.status).toBe(404);
-    expect(calls.json).toMatchObject({ statusCode: 404 });
-    expect(calls.destroyed).toBe(false);
-  });
-
-  it('drops every header that describes the file, not just the download one', async () => {
-    // Each of these would otherwise survive onto the error response:
-    // `Content-Disposition` offers a JSON error body as a file to save, a long
-    // `Cache-Control` lets the client cache the failure, `ETag` describes bytes
-    // that were never sent — and `Content-Type` makes an ofetch/`$fetch` client
-    // parse the JSON as an image and lose the message entirely.
-    const stream = new Readable({ read() {} });
-    const { calls, res } = responseStub(false);
-
-    pipeFileToResponse(stream, res);
-    stream.emit('error', new Error('chunks missing'));
-    await new Promise((resolve) => setImmediate(resolve));
-
-    expect(calls.removed).toEqual(
-      expect.arrayContaining(['Cache-Control', 'Content-Disposition', 'Content-Type', 'ETag']),
-    );
-    expect(calls.set['X-Content-Type-Options']).toBe('nosniff');
-  });
-
-  it('closes the connection once bytes are already on the wire', async () => {
-    // Past the first byte there is no status left to send. Dropping the
-    // connection is the only remaining signal — and it is the correct one: it
-    // is what a truncated transfer looks like, so the client does not cache a
-    // half file as if it were complete.
-    const stream = new Readable({ read() {} });
-    const { calls, res } = responseStub(true);
-
-    pipeFileToResponse(stream, res);
-    stream.emit('error', new Error('connection lost mid-stream'));
-    await new Promise((resolve) => setImmediate(resolve));
-
-    expect(calls.destroyed).toBe(true);
-    expect(calls.status).toBe(0);
-  });
-
-  it('answers a refused download exactly like an unknown id', async () => {
-    // `getFileStream()` returns null when the service's own `checkRights()`
-    // refuses — a branch only a CONSUMER project can reach, since the framework's
-    // base implementation always returns true. That is precisely why the
-    // framework has to pin it: consumers cannot, and if the two answers ever
-    // diverge (403 here, 404 there, or different messages) the endpoint becomes
-    // an existence oracle for files the caller may not read.
-    // Invoked through the prototype rather than a subclass: `CoreFileController`
-    // has a protected constructor (it is abstract by design), and a subclass added
-    // only to widen that visibility is exactly what `no-useless-constructor`
-    // strips — leaving code that no longer compiles.
-    const download = (service: Partial<CoreFileService>, res: Response) =>
-      (CoreFileController.prototype.getFileById as (this: unknown, id: string, res: Response) => Promise<unknown>).call(
-        { fileService: service },
-        'abc',
-        res,
-      );
-
-    const file = { contentType: 'image/png', filename: 'secret.png', id: 'abc' };
-    const { res } = responseStub(false);
-
-    const refusedErr = await download(
-      { getFileInfo: async () => file, getFileStream: async () => null } as unknown as Partial<CoreFileService>,
-      res,
-    ).catch((e: unknown) => e);
-    const unknownErr = await download(
-      { getFileInfo: async () => null, getFileStream: async () => null } as unknown as Partial<CoreFileService>,
-      res,
-    ).catch((e: unknown) => e);
-
-    expect(refusedErr).toBeInstanceOf(NotFoundException);
-    expect(unknownErr).toBeInstanceOf(NotFoundException);
-    // Byte-identical answers: same status, same message.
-    expect((refusedErr as NotFoundException).getStatus()).toBe((unknownErr as NotFoundException).getStatus());
-    expect((refusedErr as NotFoundException).getResponse()).toEqual((unknownErr as NotFoundException).getResponse());
-  });
-
-  it('destroys the source stream when the client goes away', async () => {
-    // `pipe()` only ever unpipes the DESTINATION; it never destroys the source.
-    // On a public download route an aborted request would therefore leak the
-    // GridFS read stream and its server-side cursor until the cursor timeout.
-    const stream = new Readable({ read() {} });
-    const { res } = responseStub(false);
-
-    pipeFileToResponse(stream, res);
-    expect(stream.destroyed).toBe(false);
-
-    res.emit('close');
-    await new Promise((resolve) => setImmediate(resolve));
-
-    expect(stream.destroyed).toBe(true);
-  });
-});

package/src/core/modules/hub/core-hub.module.spec.ts

@@ -1,108 +0,0 @@
-import { PATH_METADATA } from '@nestjs/common/constants';
-import { describe, expect, it } from 'vitest';
-
-import { CoreHubController } from './core-hub.controller';
-import { CoreHubModule } from './core-hub.module';
-
-const ctx = { env: 'local', version: '1.0.0' };
-
-describe('CoreHubModule.forRoot', () => {
-  it('builds a dynamic module with the hub controller', () => {
-    const mod = CoreHubModule.forRoot({ config: {}, ctx });
-    expect(mod.module).toBe(CoreHubModule);
-    expect(mod.controllers?.length).toBeGreaterThan(0);
-  });
-
-  it('becomes global and provides the email-capture binding when the mailbox is enabled', () => {
-    const mod = CoreHubModule.forRoot({ config: { mailbox: { mode: 'capture' } }, ctx });
-    expect(mod.global).toBe(true);
-  });
-
-  it('is not global when the mailbox is disabled', () => {
-    const mod = CoreHubModule.forRoot({ config: {}, ctx });
-    expect(mod.global).toBeFalsy();
-  });
-
-  it('throws when mailbox capture mode is used in production (silent mail suppression guard)', () => {
-    expect(() =>
-      CoreHubModule.forRoot({ config: { mailbox: { mode: 'capture' } }, ctx: { env: 'production', version: '1' } }),
-    ).toThrow(/capture.*not permitted/i);
-  });
-
-  it('allows mailbox copy mode in production', () => {
-    expect(() =>
-      CoreHubModule.forRoot({ config: { mailbox: { mode: 'copy' } }, ctx: { env: 'production', version: '1' } }),
-    ).not.toThrow();
-  });
-
-  describe('public-access guard (roles: false in a reachable env)', () => {
-    it('throws when roles:false in production without acknowledgment', () => {
-      expect(() =>
-        CoreHubModule.forRoot({ config: { roles: false }, ctx: { env: 'production', version: '1' } }),
-      ).toThrow(/roles: false.*not permitted/i);
-    });
-
-    it('throws when roles:false in staging without acknowledgment', () => {
-      expect(() => CoreHubModule.forRoot({ config: { roles: false }, ctx: { env: 'staging', version: '1' } })).toThrow(
-        /not permitted/i,
-      );
-    });
-
-    it('throws for CUSTOM reachable env names too (fail-safe — not just production/staging)', () => {
-      // Regression guard for the exact-string bypass: prod / live / preprod / production-eu / staging-2
-      // must all be treated as reachable.
-      for (const env of ['prod', 'live', 'preprod', 'production-eu', 'staging-2']) {
-        expect(() => CoreHubModule.forRoot({ config: { roles: false }, ctx: { env, version: '1' } })).toThrow(
-          /not permitted/i,
-        );
-      }
-    });
-
-    it('allows roles:false in production ONLY with explicit allowPublicAccessInProduction', () => {
-      expect(() =>
-        CoreHubModule.forRoot({
-          config: { allowPublicAccessInProduction: true, roles: false },
-          ctx: { env: 'production', version: '1' },
-        }),
-      ).not.toThrow();
-    });
-
-    it('allows roles:false in non-reachable envs (local, development)', () => {
-      expect(() => CoreHubModule.forRoot({ config: { roles: false }, ctx })).not.toThrow(); // ctx = local
-      expect(() =>
-        CoreHubModule.forRoot({ config: { roles: false }, ctx: { env: 'development', version: '1' } }),
-      ).not.toThrow();
-    });
-
-    it('allows the default ADMIN gate in production (no roles set)', () => {
-      expect(() => CoreHubModule.forRoot({ config: {}, ctx: { env: 'production', version: '1' } })).not.toThrow();
-    });
-  });
-
-  describe('runtime path/roles metadata (shared controller class)', () => {
-    it('writes the configured base path onto the controller class', () => {
-      CoreHubModule.forRoot({ config: { path: 'cockpit' }, ctx });
-      expect(Reflect.getMetadata(PATH_METADATA, CoreHubController)).toBe('cockpit');
-    });
-
-    it('fully overwrites stale metadata on a second forRoot (no cross-instance pollution)', () => {
-      // The controller class is shared across app instances in the same process (parallel tests). A
-      // second forRoot must overwrite the first, never leak the previous path/roles.
-      CoreHubModule.forRoot({ config: { path: 'first', roles: 'admin' }, ctx });
-      expect(Reflect.getMetadata(PATH_METADATA, CoreHubController)).toBe('first');
-      expect(Reflect.getMetadata('roles', CoreHubController)).toEqual(['admin']);
-
-      CoreHubModule.forRoot({ config: { path: 'second', roles: ['ops', 'admin'] }, ctx });
-      expect(Reflect.getMetadata(PATH_METADATA, CoreHubController)).toBe('second');
-      expect(Reflect.getMetadata('roles', CoreHubController)).toEqual(['ops', 'admin']);
-    });
-
-    it('clears the roles metadata when roles: false (public opt-out)', () => {
-      CoreHubModule.forRoot({ config: { roles: 'admin' }, ctx });
-      expect(Reflect.getMetadata('roles', CoreHubController)).toEqual(['admin']);
-
-      CoreHubModule.forRoot({ config: { roles: false }, ctx });
-      expect(Reflect.getMetadata('roles', CoreHubController)).toBeUndefined();
-    });
-  });
-});

package/src/core/modules/hub/helpers/hub-command-shape.helper.spec.ts

@@ -1,48 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { normalizeCommandShape } from './hub-command-shape.helper';
-
-describe('normalizeCommandShape', () => {
-  it('replaces scalar values with a placeholder but keeps keys', () => {
-    const out = normalizeCommandShape({ email: 'alice@example.com', age: 30, active: true });
-    expect(out).toEqual({ active: '?', age: '?', email: '?' });
-  });
-
-  it('keeps Mongo operators as keys (they are structure, not data)', () => {
-    const out = normalizeCommandShape({ age: { $gte: 18, $lt: 65 } });
-    expect(out).toEqual({ age: { $gte: '?', $lt: '?' } });
-  });
-
-  it('collapses scalar arrays ($in) to a single placeholder', () => {
-    const out = normalizeCommandShape({ id: { $in: [1, 2, 3, 4] } });
-    expect(out).toEqual({ id: { $in: ['?'] } });
-  });
-
-  it('keeps per-stage shape for pipeline-like object arrays', () => {
-    const out = normalizeCommandShape([{ $match: { x: 1 } }, { $group: { _id: '$y' } }]) as unknown[];
-    expect(out).toHaveLength(2);
-    expect(out[0]).toEqual({ $match: { x: '?' } });
-  });
-
-  it('does NOT leak the original values (privacy)', () => {
-    const secret = 'super-secret@example.com';
-    const out = normalizeCommandShape({ filter: { email: secret } });
-    expect(JSON.stringify(out)).not.toContain(secret);
-  });
-
-  it('caps recursion depth', () => {
-    let deep: any = 'leaf';
-    for (let i = 0; i < 20; i++) {
-      deep = { nested: deep };
-    }
-    const out = JSON.stringify(normalizeCommandShape(deep));
-    // Must terminate and not blow the stack; the sentinel marks the cut.
-    expect(out).toContain('…');
-  });
-
-  it('produces identical output for identical query shapes (the N+1 template key)', () => {
-    const a = normalizeCommandShape({ filter: { email: 'a@x.com' }, limit: 1 });
-    const b = normalizeCommandShape({ filter: { email: 'b@y.com' }, limit: 999 });
-    expect(JSON.stringify(a)).toBe(JSON.stringify(b));
-  });
-});

package/src/core/modules/hub/helpers/hub-mask.helper.spec.ts

@@ -1,67 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import { maskConfigDeep } from './hub-mask.helper';
-
-describe('maskConfigDeep', () => {
-  it('masks values whose key matches the secret pattern', () => {
-    const out = maskConfigDeep({
-      jwt: { secret: 'SENTINEL_JWT', refresh: { secret: 'SENTINEL_REFRESH' } },
-      port: 3000,
-    });
-
-    expect(out.jwt.secret).toBe('***');
-    expect(out.jwt.refresh.secret).toBe('***');
-    expect(out.port).toBe(3000);
-  });
-
-  it('masks a broad set of secret-ish key names', () => {
-    const out = maskConfigDeep({
-      apiKey: 'AK',
-      betterAuth: { secret: 'BA' },
-      encryptionSecret: 'ENC',
-      password: 'PW',
-      privateKey: 'PK',
-      token: 'TK',
-    });
-
-    for (const value of Object.values(out)) {
-      const flat = JSON.stringify(value);
-      expect(flat).not.toMatch(/AK|BA|ENC|PW|PK|TK/);
-    }
-  });
-
-  it('deep-clones — the input object is never mutated', () => {
-    const input = { jwt: { secret: 'SENTINEL' }, nested: { arr: [{ token: 'T' }] } };
-    const out = maskConfigDeep(input);
-
-    expect(input.jwt.secret).toBe('SENTINEL');
-    expect(input.nested.arr[0].token).toBe('T');
-    expect(out.jwt.secret).toBe('***');
-    expect(out.nested.arr[0].token).toBe('***');
-  });
-
-  it('masks credentials embedded in URI-shaped values', () => {
-    const out = maskConfigDeep({ mongoose: { uri: 'mongodb://user:secretpw@host:27017/db' } });
-
-    expect(out.mongoose.uri).not.toContain('secretpw');
-    expect(out.mongoose.uri).toContain('mongodb://');
-    expect(out.mongoose.uri).toContain('host:27017');
-  });
-
-  it('honors additional explicit secret field names', () => {
-    const out = maskConfigDeep({ customField: 'HIDE_ME', other: 'keep' }, ['customField']);
-
-    expect(out.customField).toBe('***');
-    expect(out.other).toBe('keep');
-  });
-
-  it('passes through null, numbers, booleans and dates', () => {
-    const date = new Date('2026-01-01T00:00:00.000Z');
-    const out = maskConfigDeep({ a: null, b: 42, c: true, d: date });
-
-    expect(out.a).toBeNull();
-    expect(out.b).toBe(42);
-    expect(out.c).toBe(true);
-    expect(out.d).toBeInstanceOf(Date);
-  });
-});