@mandujs/core 0.53.2 → 0.54.0

package/src/auth/__tests__/tokens.test.ts

@@ -1,274 +1,274 @@
-/**
- * @mandujs/core/auth/tokens — store tests.
- *
- * Each case builds a fresh `:memory:` store (gated on Bun.SQL availability)
- * with `gcSchedule: false` so no real cron fires during tests. Closed in
- * `afterEach`.
- */
-
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-
-import {
-  createAuthTokenStore,
-  type AuthTokenStore,
-  type TokenRecord,
-} from "../tokens";
-
-// ─── Gate on Bun.SQL + Bun.CryptoHasher ─────────────────────────────────────
-
-const hasBunSql = (() => {
-  const g = globalThis as unknown as {
-    Bun?: { SQL?: unknown; CryptoHasher?: unknown };
-  };
-  return typeof g.Bun?.SQL === "function" && typeof g.Bun?.CryptoHasher === "function";
-})();
-const describeIfBun = hasBunSql ? describe : describe.skip;
-
-// ─── Fixtures ───────────────────────────────────────────────────────────────
-
-const SECRET = "tokens-test-secret-at-least-32-bytes-long!";
-
-describeIfBun("@mandujs/core/auth/tokens — createAuthTokenStore", () => {
-  let store: AuthTokenStore;
-
-  beforeEach(() => {
-    store = createAuthTokenStore({
-      secret: SECRET,
-      dbPath: ":memory:",
-      gcSchedule: false,
-    });
-  });
-
-  afterEach(async () => {
-    await store.close();
-  });
-
-  it("mint → consume roundtrip returns the record with userId + purpose", async () => {
-    const { token, record } = await store.mint("verify-email", "u-1", {
-      email: "a@b.com",
-    });
-    expect(token).toContain(".");
-    expect(record.userId).toBe("u-1");
-    expect(record.purpose).toBe("verify-email");
-    expect(record.consumedAt).toBeNull();
-    expect(record.tokenHash).toMatch(/^[0-9a-f]{64}$/);
-
-    const consumed = await store.consume("verify-email", token);
-    expect(consumed).not.toBeNull();
-    expect(consumed!.userId).toBe("u-1");
-    expect(consumed!.id).toBe(record.id);
-    expect(consumed!.consumedAt).toBeTypeOf("number");
-    expect(consumed!.consumedAt).not.toBeNull();
-  });
-
-  it("consuming twice: second call returns null (single-use)", async () => {
-    const { token } = await store.mint("verify-email", "u-2", { email: "a@b.com" });
-    const first = await store.consume("verify-email", token);
-    expect(first).not.toBeNull();
-    const second = await store.consume("verify-email", token);
-    expect(second).toBeNull();
-  });
-
-  it("expired token returns null", async () => {
-    // Zero TTL means expires_at == now at insert. The insert completes at
-    // T, and consume() reads `now > T` → treated as expired. We sleep a
-    // few ms to be defensive against same-millisecond flakiness.
-    const shortLived = createAuthTokenStore({
-      secret: SECRET,
-      dbPath: ":memory:",
-      gcSchedule: false,
-      ttlSecondsByPurpose: { "verify-email": 0 },
-    });
-    try {
-      const { token } = await shortLived.mint("verify-email", "u-3");
-      await new Promise((r) => setTimeout(r, 5));
-      const result = await shortLived.consume("verify-email", token);
-      expect(result).toBeNull();
-    } finally {
-      await shortLived.close();
-    }
-  });
-
-  it("tampered nonce returns null (hash mismatch)", async () => {
-    const { token } = await store.mint("verify-email", "u-4");
-    const [id, nonce] = token.split(".");
-    // Flip one character in the nonce. Keep length the same to exercise
-    // the byte-wise hash compare (length mismatch would short-circuit).
-    const flipped = (nonce!.charAt(0) === "A" ? "B" : "A") + nonce!.slice(1);
-    const tampered = `${id}.${flipped}`;
-    const result = await store.consume("verify-email", tampered);
-    expect(result).toBeNull();
-  });
-
-  it("tampered id (pointing to real row) still returns null — hash mismatch", async () => {
-    const { token: a } = await store.mint("verify-email", "u-5a");
-    const { token: b } = await store.mint("verify-email", "u-5b");
-    const aNonce = a.split(".")[1]!;
-    const bId = b.split(".")[0]!;
-    // Forged token: use B's id with A's nonce. B's stored hash was
-    // computed against B's nonce, so the compare fails.
-    const forged = `${bId}.${aNonce}`;
-    const result = await store.consume("verify-email", forged);
-    expect(result).toBeNull();
-
-    // Sanity: the real B token still consumes cleanly afterwards. The
-    // forged attempt did NOT mark B as consumed.
-    const real = await store.consume("verify-email", b);
-    expect(real).not.toBeNull();
-  });
-
-  it("wrong purpose returns null (purpose binds to the hash)", async () => {
-    const { token } = await store.mint("verify-email", "u-6");
-    const result = await store.consume("reset-password", token);
-    expect(result).toBeNull();
-
-    // Real purpose still works — wrong-purpose attempt did NOT mark it
-    // consumed.
-    const real = await store.consume("verify-email", token);
-    expect(real).not.toBeNull();
-  });
-
-  it("unknown id returns null without touching other rows", async () => {
-    const { token } = await store.mint("verify-email", "u-7");
-    // Use a random UUID as the id so the row simply doesn't exist.
-    const fakeId = crypto.randomUUID();
-    const nonce = token.split(".")[1]!;
-    const bogus = `${fakeId}.${nonce}`;
-    const result = await store.consume("verify-email", bogus);
-    expect(result).toBeNull();
-
-    // Real token still usable.
-    const real = await store.consume("verify-email", token);
-    expect(real).not.toBeNull();
-  });
-
-  it("gcNow() sweeps expired + consumed rows and returns the count", async () => {
-    // Consume one row to create a "consumed" candidate.
-    const { token: consumedToken } = await store.mint("verify-email", "u-8a");
-    await store.consume("verify-email", consumedToken);
-
-    // Build a short-lived entry via a second store on the same (in-memory)
-    // semantics — we can't share a :memory: DB across handles, so mint
-    // into a different short-TTL store to prove the delete query works.
-    const expiring = createAuthTokenStore({
-      secret: SECRET,
-      dbPath: ":memory:",
-      gcSchedule: false,
-      ttlSecondsByPurpose: { "verify-email": 0 },
-    });
-    try {
-      await expiring.mint("verify-email", "u-8b");
-      await expiring.mint("verify-email", "u-8c");
-      await new Promise((r) => setTimeout(r, 5));
-      const deleted = await expiring.gcNow();
-      expect(deleted).toBe(2);
-      // Second sweep is a no-op.
-      expect(await expiring.gcNow()).toBe(0);
-    } finally {
-      await expiring.close();
-    }
-
-    // The original store has exactly one row (consumed); gcNow removes it.
-    const cleaned = await store.gcNow();
-    expect(cleaned).toBe(1);
-  });
-
-  it("meta round-trips as JSON for verify-email tokens", async () => {
-    const { token, record: minted } = await store.mint("verify-email", "u-9", {
-      email: "alice@example.com",
-      signupSource: "marketing-page",
-    });
-    expect(minted.meta?.email).toBe("alice@example.com");
-
-    const consumed = await store.consume("verify-email", token);
-    expect(consumed).not.toBeNull();
-    expect(consumed!.meta?.email).toBe("alice@example.com");
-    expect(consumed!.meta?.signupSource).toBe("marketing-page");
-  });
-
-  it("sequential consumes serialise through the UPDATE predicate — only the first wins", async () => {
-    // True wall-clock concurrency is not expressible against a single
-    // SQLite connection (Bun.SQL surfaces "cannot start a transaction
-    // within a transaction" when two callers share the handle). The
-    // atomicity guarantee we actually care about is observable
-    // sequentially: consume #2 must see `consumed_at IS NOT NULL` from
-    // consume #1's committed transaction and return null.
-    //
-    // The defense-in-depth `UPDATE … WHERE consumed_at IS NULL` predicate
-    // is what guards against a hypothetical interleaving if multiple
-    // writer connections ever land in the future (e.g., Postgres).
-    const { token } = await store.mint("verify-email", "u-10");
-    const a = await store.consume("verify-email", token);
-    const b = await store.consume("verify-email", token);
-    const successes: TokenRecord[] = [];
-    if (a) successes.push(a);
-    if (b) successes.push(b);
-    expect(successes).toHaveLength(1);
-    expect(a!.consumedAt).not.toBeNull();
-  });
-
-  it("malformed token (no dot) returns null without throwing", async () => {
-    // Exercise the `parseToken` no-dot path, the empty-string path, and
-    // the multi-dot path — all must collapse to null.
-    const nodot = await store.consume("verify-email", "not-a-token");
-    expect(nodot).toBeNull();
-
-    const empty = await store.consume("verify-email", "");
-    expect(empty).toBeNull();
-
-    const multiDot = await store.consume("verify-email", "a.b.c");
-    expect(multiDot).toBeNull();
-
-    const leadingDot = await store.consume("verify-email", ".nonce");
-    expect(leadingDot).toBeNull();
-
-    const trailingDot = await store.consume("verify-email", "id.");
-    expect(trailingDot).toBeNull();
-  });
-
-  it("close() then mint/consume/gcNow rejects with a clear error", async () => {
-    const tempStore = createAuthTokenStore({
-      secret: SECRET,
-      dbPath: ":memory:",
-      gcSchedule: false,
-    });
-    // Populate one row so gcNow has something to scan.
-    await tempStore.mint("verify-email", "u-11");
-    await tempStore.close();
-
-    await expect(tempStore.mint("verify-email", "u-12")).rejects.toThrow(
-      /store is closed/,
-    );
-    await expect(tempStore.consume("verify-email", "x.y")).rejects.toThrow(
-      /store is closed/,
-    );
-    await expect(tempStore.gcNow()).rejects.toThrow(/store is closed/);
-    // close() is idempotent.
-    await expect(tempStore.close()).resolves.toBeUndefined();
-  });
-
-  it("empty secret is rejected synchronously at construction", () => {
-    expect(() =>
-      createAuthTokenStore({ secret: "", dbPath: ":memory:", gcSchedule: false }),
-    ).toThrow(/secret/);
-  });
-
-  it("invalid table name is rejected synchronously at construction", () => {
-    expect(() =>
-      createAuthTokenStore({
-        secret: SECRET,
-        dbPath: ":memory:",
-        table: "bad-name; DROP TABLE users",
-        gcSchedule: false,
-      }),
-    ).toThrow(/table name/);
-  });
-
-  it("reset-password token consumed at the wrong purpose returns null", async () => {
-    const { token } = await store.mint("reset-password", "u-13");
-    const wrongPurpose = await store.consume("verify-email", token);
-    expect(wrongPurpose).toBeNull();
-    const rightPurpose = await store.consume("reset-password", token);
-    expect(rightPurpose).not.toBeNull();
-  });
-});
+/**
+ * @mandujs/core/auth/tokens — store tests.
+ *
+ * Each case builds a fresh `:memory:` store (gated on Bun.SQL availability)
+ * with `gcSchedule: false` so no real cron fires during tests. Closed in
+ * `afterEach`.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+
+import {
+  createAuthTokenStore,
+  type AuthTokenStore,
+  type TokenRecord,
+} from "../tokens";
+
+// ─── Gate on Bun.SQL + Bun.CryptoHasher ─────────────────────────────────────
+
+const hasBunSql = (() => {
+  const g = globalThis as unknown as {
+    Bun?: { SQL?: unknown; CryptoHasher?: unknown };
+  };
+  return typeof g.Bun?.SQL === "function" && typeof g.Bun?.CryptoHasher === "function";
+})();
+const describeIfBun = hasBunSql ? describe : describe.skip;
+
+// ─── Fixtures ───────────────────────────────────────────────────────────────
+
+const SECRET = "tokens-test-secret-at-least-32-bytes-long!";
+
+describeIfBun("@mandujs/core/auth/tokens — createAuthTokenStore", () => {
+  let store: AuthTokenStore;
+
+  beforeEach(() => {
+    store = createAuthTokenStore({
+      secret: SECRET,
+      dbPath: ":memory:",
+      gcSchedule: false,
+    });
+  });
+
+  afterEach(async () => {
+    await store.close();
+  });
+
+  it("mint → consume roundtrip returns the record with userId + purpose", async () => {
+    const { token, record } = await store.mint("verify-email", "u-1", {
+      email: "a@b.com",
+    });
+    expect(token).toContain(".");
+    expect(record.userId).toBe("u-1");
+    expect(record.purpose).toBe("verify-email");
+    expect(record.consumedAt).toBeNull();
+    expect(record.tokenHash).toMatch(/^[0-9a-f]{64}$/);
+
+    const consumed = await store.consume("verify-email", token);
+    expect(consumed).not.toBeNull();
+    expect(consumed!.userId).toBe("u-1");
+    expect(consumed!.id).toBe(record.id);
+    expect(consumed!.consumedAt).toBeTypeOf("number");
+    expect(consumed!.consumedAt).not.toBeNull();
+  });
+
+  it("consuming twice: second call returns null (single-use)", async () => {
+    const { token } = await store.mint("verify-email", "u-2", { email: "a@b.com" });
+    const first = await store.consume("verify-email", token);
+    expect(first).not.toBeNull();
+    const second = await store.consume("verify-email", token);
+    expect(second).toBeNull();
+  });
+
+  it("expired token returns null", async () => {
+    // Zero TTL means expires_at == now at insert. The insert completes at
+    // T, and consume() reads `now > T` → treated as expired. We sleep a
+    // few ms to be defensive against same-millisecond flakiness.
+    const shortLived = createAuthTokenStore({
+      secret: SECRET,
+      dbPath: ":memory:",
+      gcSchedule: false,
+      ttlSecondsByPurpose: { "verify-email": 0 },
+    });
+    try {
+      const { token } = await shortLived.mint("verify-email", "u-3");
+      await new Promise((r) => setTimeout(r, 5));
+      const result = await shortLived.consume("verify-email", token);
+      expect(result).toBeNull();
+    } finally {
+      await shortLived.close();
+    }
+  });
+
+  it("tampered nonce returns null (hash mismatch)", async () => {
+    const { token } = await store.mint("verify-email", "u-4");
+    const [id, nonce] = token.split(".");
+    // Flip one character in the nonce. Keep length the same to exercise
+    // the byte-wise hash compare (length mismatch would short-circuit).
+    const flipped = (nonce!.charAt(0) === "A" ? "B" : "A") + nonce!.slice(1);
+    const tampered = `${id}.${flipped}`;
+    const result = await store.consume("verify-email", tampered);
+    expect(result).toBeNull();
+  });
+
+  it("tampered id (pointing to real row) still returns null — hash mismatch", async () => {
+    const { token: a } = await store.mint("verify-email", "u-5a");
+    const { token: b } = await store.mint("verify-email", "u-5b");
+    const aNonce = a.split(".")[1]!;
+    const bId = b.split(".")[0]!;
+    // Forged token: use B's id with A's nonce. B's stored hash was
+    // computed against B's nonce, so the compare fails.
+    const forged = `${bId}.${aNonce}`;
+    const result = await store.consume("verify-email", forged);
+    expect(result).toBeNull();
+
+    // Sanity: the real B token still consumes cleanly afterwards. The
+    // forged attempt did NOT mark B as consumed.
+    const real = await store.consume("verify-email", b);
+    expect(real).not.toBeNull();
+  });
+
+  it("wrong purpose returns null (purpose binds to the hash)", async () => {
+    const { token } = await store.mint("verify-email", "u-6");
+    const result = await store.consume("reset-password", token);
+    expect(result).toBeNull();
+
+    // Real purpose still works — wrong-purpose attempt did NOT mark it
+    // consumed.
+    const real = await store.consume("verify-email", token);
+    expect(real).not.toBeNull();
+  });
+
+  it("unknown id returns null without touching other rows", async () => {
+    const { token } = await store.mint("verify-email", "u-7");
+    // Use a random UUID as the id so the row simply doesn't exist.
+    const fakeId = crypto.randomUUID();
+    const nonce = token.split(".")[1]!;
+    const bogus = `${fakeId}.${nonce}`;
+    const result = await store.consume("verify-email", bogus);
+    expect(result).toBeNull();
+
+    // Real token still usable.
+    const real = await store.consume("verify-email", token);
+    expect(real).not.toBeNull();
+  });
+
+  it("gcNow() sweeps expired + consumed rows and returns the count", async () => {
+    // Consume one row to create a "consumed" candidate.
+    const { token: consumedToken } = await store.mint("verify-email", "u-8a");
+    await store.consume("verify-email", consumedToken);
+
+    // Build a short-lived entry via a second store on the same (in-memory)
+    // semantics — we can't share a :memory: DB across handles, so mint
+    // into a different short-TTL store to prove the delete query works.
+    const expiring = createAuthTokenStore({
+      secret: SECRET,
+      dbPath: ":memory:",
+      gcSchedule: false,
+      ttlSecondsByPurpose: { "verify-email": 0 },
+    });
+    try {
+      await expiring.mint("verify-email", "u-8b");
+      await expiring.mint("verify-email", "u-8c");
+      await new Promise((r) => setTimeout(r, 5));
+      const deleted = await expiring.gcNow();
+      expect(deleted).toBe(2);
+      // Second sweep is a no-op.
+      expect(await expiring.gcNow()).toBe(0);
+    } finally {
+      await expiring.close();
+    }
+
+    // The original store has exactly one row (consumed); gcNow removes it.
+    const cleaned = await store.gcNow();
+    expect(cleaned).toBe(1);
+  });
+
+  it("meta round-trips as JSON for verify-email tokens", async () => {
+    const { token, record: minted } = await store.mint("verify-email", "u-9", {
+      email: "alice@example.com",
+      signupSource: "marketing-page",
+    });
+    expect(minted.meta?.email).toBe("alice@example.com");
+
+    const consumed = await store.consume("verify-email", token);
+    expect(consumed).not.toBeNull();
+    expect(consumed!.meta?.email).toBe("alice@example.com");
+    expect(consumed!.meta?.signupSource).toBe("marketing-page");
+  });
+
+  it("sequential consumes serialise through the UPDATE predicate — only the first wins", async () => {
+    // True wall-clock concurrency is not expressible against a single
+    // SQLite connection (Bun.SQL surfaces "cannot start a transaction
+    // within a transaction" when two callers share the handle). The
+    // atomicity guarantee we actually care about is observable
+    // sequentially: consume #2 must see `consumed_at IS NOT NULL` from
+    // consume #1's committed transaction and return null.
+    //
+    // The defense-in-depth `UPDATE … WHERE consumed_at IS NULL` predicate
+    // is what guards against a hypothetical interleaving if multiple
+    // writer connections ever land in the future (e.g., Postgres).
+    const { token } = await store.mint("verify-email", "u-10");
+    const a = await store.consume("verify-email", token);
+    const b = await store.consume("verify-email", token);
+    const successes: TokenRecord[] = [];
+    if (a) successes.push(a);
+    if (b) successes.push(b);
+    expect(successes).toHaveLength(1);
+    expect(a!.consumedAt).not.toBeNull();
+  });
+
+  it("malformed token (no dot) returns null without throwing", async () => {
+    // Exercise the `parseToken` no-dot path, the empty-string path, and
+    // the multi-dot path — all must collapse to null.
+    const nodot = await store.consume("verify-email", "not-a-token");
+    expect(nodot).toBeNull();
+
+    const empty = await store.consume("verify-email", "");
+    expect(empty).toBeNull();
+
+    const multiDot = await store.consume("verify-email", "a.b.c");
+    expect(multiDot).toBeNull();
+
+    const leadingDot = await store.consume("verify-email", ".nonce");
+    expect(leadingDot).toBeNull();
+
+    const trailingDot = await store.consume("verify-email", "id.");
+    expect(trailingDot).toBeNull();
+  });
+
+  it("close() then mint/consume/gcNow rejects with a clear error", async () => {
+    const tempStore = createAuthTokenStore({
+      secret: SECRET,
+      dbPath: ":memory:",
+      gcSchedule: false,
+    });
+    // Populate one row so gcNow has something to scan.
+    await tempStore.mint("verify-email", "u-11");
+    await tempStore.close();
+
+    await expect(tempStore.mint("verify-email", "u-12")).rejects.toThrow(
+      /store is closed/,
+    );
+    await expect(tempStore.consume("verify-email", "x.y")).rejects.toThrow(
+      /store is closed/,
+    );
+    await expect(tempStore.gcNow()).rejects.toThrow(/store is closed/);
+    // close() is idempotent.
+    await expect(tempStore.close()).resolves.toBeUndefined();
+  });
+
+  it("empty secret is rejected synchronously at construction", () => {
+    expect(() =>
+      createAuthTokenStore({ secret: "", dbPath: ":memory:", gcSchedule: false }),
+    ).toThrow(/secret/);
+  });
+
+  it("invalid table name is rejected synchronously at construction", () => {
+    expect(() =>
+      createAuthTokenStore({
+        secret: SECRET,
+        dbPath: ":memory:",
+        table: "bad-name; DROP TABLE users",
+        gcSchedule: false,
+      }),
+    ).toThrow(/table name/);
+  });
+
+  it("reset-password token consumed at the wrong purpose returns null", async () => {
+    const { token } = await store.mint("reset-password", "u-13");
+    const wrongPurpose = await store.consume("verify-email", token);
+    expect(wrongPurpose).toBeNull();
+    const rightPurpose = await store.consume("reset-password", token);
+    expect(rightPurpose).not.toBeNull();
+  });
+});