@mereb/shared-packages 0.0.39 → 0.0.41

package/README.md

@@ -1,44 +1,63 @@
-# Shared Mereb Backend Packages
+# @mereb/shared-packages
 
-This package exposes the shared Fastify/OpenTelemetry helpers used across the backend services. It is built independently with TypeScript and published as `@mereb/shared-packages`.
+Shared backend package consumed by `svc-*` services. It centralizes common auth, config, logging, telemetry, Kafka, Redis, event envelope, and media helper utilities.
+
+## What this package exports
+
+Primary root exports from `src/index.ts`:
+
+- `auth/jwks`: JWT verification helpers (`verifyJwt`, header parsing helpers)
+- `config/env`: env loading and typed env access (`loadEnv`, `getEnv`, `loadThenGetEnvs`, ...)
+- `logger`: pino logger setup + Fastify logger options
+- `observability/otel`: OpenTelemetry bootstrap helpers
+- `messaging/kafka`: Kafka client/config helpers
+- `cache/redis`: Redis client helpers
+- `events/envelope` and `events/publisher`: integration event envelopes + publish helpers
+- `media/s3`: media URL and upload-key helpers
+
+Extra testing exports:
+
+- `@mereb/shared-packages/testing/db`
+- `@mereb/shared-packages/testing/kafka`
+- `@mereb/shared-packages/testing/oidc`
 
 ## Local development
 
 ```bash
-pnpm install
 pnpm --filter @mereb/shared-packages lint
 pnpm --filter @mereb/shared-packages typecheck
+pnpm --filter @mereb/shared-packages test
 pnpm --filter @mereb/shared-packages build
 ```
 
-The compiled JavaScript and type definitions land in `dist/`.
+Build output is written to `dist/`.
 
-## Jenkins publishing workflow
+## Versioning and publishing
 
-The folder contains its own `Jenkinsfile` plus `.ci/ci.yml` so it can run through the `mereb-jenkins` shared library just like the services do.
+Version is controlled in `package.json` and published as `@mereb/shared-packages`.
 
-1. **Version bump** – run `pnpm --filter @mereb/shared-packages version:bump` (optionally pass `major` or `minor`). The script inspects the latest `v*` tag and updates `package.json` to the next version so the release tag and package stay in sync.
-2. **Push to `main`** – Jenkins runs the branch build. After it lints/builds, the `release.autoTag` stage (configured with `allowDirty: true` because the build leaves `node_modules/` around) creates and pushes the next `v<semver>` tag.
-3. **Release stages** – in the same build, the new `releaseStages` block uses that tag (`RELEASE_TAG`) to run `pnpm publish` and then the `release.github` stage publishes release notes.
-4. **Jenkins job** – create a Multibranch Pipeline pointing at this repository. Tags are optional now, but still enable tag discovery if you want Jenkins to react to manual tags.
-5. **Credentials** – add an `npm-registry-token` secret text credential in Jenkins for npm publish, plus `github-credentials` for tagging/GitHub releases. The pipeline writes the npm token to `.npmrc` during the publish stage.
-6. **Registry override (optional)** – set the job environment variable `NPM_REGISTRY` if you publish somewhere other than `https://registry.npmjs.org`.
+Bump version:
 
-Every successful `main` build with a version bump now produces a tag, publishes the package, and creates GitHub release notes without waiting for a second job.
+```bash
+pnpm --filter @mereb/shared-packages version:bump
+```
 
-> Tip: The bump script accepts `major`, `minor`, or `patch` (default) so you can control which segment changes: `pnpm --filter @mereb/shared-packages version:bump minor`.
+Optional bump type:
 
-> The repo installs a Husky `pre-commit` hook that automatically runs `pnpm run version:bump` and stages `services/shared/package.json`, keeping the version aligned with the next release tag before every commit. Jenkins sets `HUSKY=0` (see `.ci/ci.yml`) so the hook never runs in CI; locally you can bypass it with `HUSKY=0 git commit ...`.
+```bash
+pnpm --filter @mereb/shared-packages version:bump minor
+pnpm --filter @mereb/shared-packages version:bump major
+```
 
-## Manual publish (fallback)
+The repository includes Jenkins + `.ci/ci.yml` automation for tag/release/publish flow.
 
-If you need to publish outside Jenkins:
+## Manual publish fallback
 
 ```bash
 cd services/shared
 pnpm install
-pnpm lint && pnpm typecheck && pnpm build
+pnpm lint
+pnpm typecheck
+pnpm build
 NPM_TOKEN=... pnpm publish --registry https://registry.npmjs.org --no-git-checks
 ```
-
-Ensure the git tag matches the package version before publishing so the CI job can take over again on the next release.

package/dist/messaging/kafka.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kafka.d.ts","sourceRoot":"","sources":["../../src/messaging/kafka.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,EAER,MAAM,SAAS,CAAC;AAKjB,wBAAgB,QAAQ,CAAC,MAAM,EAAE,WAAW,SAG3C;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CASxE;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAK5F;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,uBAAuB,CACnC,IAAI,GAAE,qBAA0B,GACjC,WAAW,GAAG,IAAI,CA8BpB;AAED,wBAAsB,iBAAiB,CACnC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,UAAU,SAAI,EACd,iBAAiB,SAAI,GACtB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,kBAAkB,kBAKvC"}
+{"version":3,"file":"kafka.d.ts","sourceRoot":"","sources":["../../src/messaging/kafka.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,KAAK,QAAQ,EAEb,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,EAER,MAAM,SAAS,CAAC;AAOjB,wBAAgB,QAAQ,CAAC,MAAM,EAAE,WAAW,SAG3C;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CASxE;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAK5F;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,uBAAuB,CACnC,IAAI,GAAE,qBAA0B,GACjC,WAAW,GAAG,IAAI,CA4DpB;AAED,wBAAsB,iBAAiB,CACnC,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,EACb,UAAU,SAAI,EACd,iBAAiB,SAAI,GACtB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,kBAAkB,kBAKvC"}

package/dist/messaging/kafka.js

@@ -1,4 +1,6 @@
 import { Kafka, Partitioners } from 'kafkajs';
+import net from 'node:net';
+import tls from 'node:tls';
 let kafkaInstance;
 let producerInstance;
 export function getKafka(config) {
@@ -35,9 +37,30 @@ export function buildKafkaConfigFromEnv(opts = {}) {
     const sslEnabled = (process.env.KAFKA_SSL ?? String(opts.sslDefault ?? false)) === 'true';
     const sslInsecure = (process.env.KAFKA_SSL_INSECURE ?? String(opts.sslInsecureDefault ?? false)) ===
         'true';
+    const portForwardHost = process.env.KAFKA_PORT_FORWARD_HOST;
+    const portForwardPortRaw = process.env.KAFKA_PORT_FORWARD_PORT;
+    const portForwardPort = portForwardPortRaw ? Number(portForwardPortRaw) : undefined;
+    const socketFactory = portForwardHost && portForwardPort
+        ? ({ host, ssl, onConnect }) => {
+            if (sslEnabled) {
+                return tls.connect({
+                    ...ssl,
+                    host: portForwardHost,
+                    port: portForwardPort,
+                    servername: host,
+                    rejectUnauthorized: !sslInsecure
+                }, onConnect);
+            }
+            return net.connect({
+                host: portForwardHost,
+                port: portForwardPort
+            }, onConnect);
+        }
+        : undefined;
     return {
         clientId,
         brokers,
+        socketFactory,
         ssl: sslEnabled
             ? {
                 rejectUnauthorized: !sslInsecure

package/dist/testing/db.d.ts

@@ -0,0 +1,17 @@
+export interface SqlExecutor {
+    $executeRawUnsafe(query: string): Promise<unknown>;
+}
+export interface RunPrismaMigrateDeployInput {
+    cwd: string;
+    schemaPath?: string;
+    databaseUrl: string;
+}
+export declare function createTemporarySchemaName(prefix: string): string;
+export declare function withSchema(databaseUrl: string, schema: string): string;
+export declare function provisionSchema(adminClient: SqlExecutor, input: {
+    schema: string;
+    ownerRole: string;
+}): Promise<void>;
+export declare function dropSchema(adminClient: SqlExecutor, schema: string): Promise<void>;
+export declare function runPrismaMigrateDeploy(input: RunPrismaMigrateDeployInput): Promise<void>;
+//# sourceMappingURL=db.d.ts.map

package/dist/testing/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/testing/db.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIhE;AAED,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAItE;AAED,wBAAsB,eAAe,CACnC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,UAAU,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAExF;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,IAAI,CAAC,CAmCf"}

package/dist/testing/db.js

@@ -0,0 +1,41 @@
+import { spawn } from 'node:child_process';
+import { resolve } from 'node:path';
+export function createTemporarySchemaName(prefix) {
+    const timestamp = Date.now().toString(36);
+    const random = Math.random().toString(36).slice(2, 8);
+    return `${prefix}_${timestamp}_${random}`.replace(/[^a-zA-Z0-9_]/g, '_');
+}
+export function withSchema(databaseUrl, schema) {
+    const next = new URL(databaseUrl);
+    next.searchParams.set('schema', schema);
+    return next.toString();
+}
+export async function provisionSchema(adminClient, input) {
+    await adminClient.$executeRawUnsafe(`CREATE SCHEMA IF NOT EXISTS "${input.schema}" AUTHORIZATION "${input.ownerRole}"`);
+    await adminClient.$executeRawUnsafe(`GRANT USAGE, CREATE ON SCHEMA "${input.schema}" TO "${input.ownerRole}"`);
+}
+export async function dropSchema(adminClient, schema) {
+    await adminClient.$executeRawUnsafe(`DROP SCHEMA IF EXISTS "${schema}" CASCADE`);
+}
+export async function runPrismaMigrateDeploy(input) {
+    const prismaBinary = resolve(input.cwd, 'node_modules', '.bin', process.platform === 'win32' ? 'prisma.cmd' : 'prisma');
+    const schemaPath = input.schemaPath ?? resolve(input.cwd, 'prisma', 'schema.prisma');
+    await new Promise((resolvePromise, rejectPromise) => {
+        const child = spawn(prismaBinary, ['migrate', 'deploy', '--schema', schemaPath], {
+            cwd: input.cwd,
+            stdio: 'inherit',
+            env: {
+                ...process.env,
+                DATABASE_URL: input.databaseUrl
+            }
+        });
+        child.on('error', rejectPromise);
+        child.on('exit', (code) => {
+            if (code === 0) {
+                resolvePromise();
+                return;
+            }
+            rejectPromise(new Error(`prisma migrate deploy failed in ${input.cwd} with code ${code}`));
+        });
+    });
+}

package/dist/testing/kafka.d.ts

@@ -0,0 +1,42 @@
+import { type KafkaConfig } from 'kafkajs';
+export interface EnsureKafkaTopicExistsInput {
+    brokers: string[];
+    topic: string;
+    clientId?: string;
+    partitions?: number;
+    replicationFactor?: number;
+    ssl?: KafkaConfig['ssl'];
+    socketFactory?: KafkaConfig['socketFactory'];
+}
+export interface WaitForKafkaMessageInput {
+    brokers: string[];
+    topic: string;
+    groupId: string;
+    clientId?: string;
+    timeoutMs?: number;
+    fromBeginning?: boolean;
+    ssl?: KafkaConfig['ssl'];
+    socketFactory?: KafkaConfig['socketFactory'];
+    predicate?: (message: KafkaMessageRecord) => boolean | Promise<boolean>;
+}
+export interface WaitForKafkaTopicMessagesInput {
+    brokers: string[];
+    topic: string;
+    minMessages?: number;
+    clientId?: string;
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+    ssl?: KafkaConfig['ssl'];
+    socketFactory?: KafkaConfig['socketFactory'];
+}
+export interface KafkaMessageRecord {
+    key: string | null;
+    value: string;
+    headers: Record<string, string | undefined>;
+    partition: number;
+    offset: string;
+}
+export declare function ensureKafkaTopicExists(input: EnsureKafkaTopicExistsInput): Promise<void>;
+export declare function waitForKafkaMessage(input: WaitForKafkaMessageInput): Promise<KafkaMessageRecord>;
+export declare function waitForKafkaTopicMessages(input: WaitForKafkaTopicMessagesInput): Promise<number>;
+//# sourceMappingURL=kafka.d.ts.map

package/dist/testing/kafka.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kafka.d.ts","sourceRoot":"","sources":["../../src/testing/kafka.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAEjE,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACzB,aAAa,CAAC,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,GAAG,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACzB,aAAa,CAAC,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;IAC7C,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACzB,aAAa,CAAC,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AA8CD,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA4D7B;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,MAAM,CAAC,CA8BjB"}

package/dist/testing/kafka.js

@@ -0,0 +1,129 @@
+import { Kafka } from 'kafkajs';
+function createKafkaConfig(input) {
+    return {
+        clientId: input.clientId ?? 'mereb-test',
+        brokers: input.brokers,
+        ssl: input.ssl,
+        socketFactory: input.socketFactory
+    };
+}
+function toHeaderValue(value) {
+    if (Array.isArray(value)) {
+        return toHeaderValue(value[0]);
+    }
+    if (Buffer.isBuffer(value)) {
+        return value.toString('utf8');
+    }
+    return value;
+}
+function toMessageRecord(input) {
+    return {
+        key: input.key?.toString('utf8') ?? null,
+        value: input.value?.toString('utf8') ?? '',
+        headers: Object.fromEntries(Object.entries(input.headers ?? {}).map(([key, value]) => [
+            key,
+            toHeaderValue(value)
+        ])),
+        partition: input.partition,
+        offset: input.offset
+    };
+}
+export async function ensureKafkaTopicExists(input) {
+    const kafka = new Kafka(createKafkaConfig(input));
+    const admin = kafka.admin();
+    await admin.connect();
+    try {
+        const topics = await admin.listTopics();
+        if (!topics.includes(input.topic)) {
+            await admin.createTopics({
+                topics: [
+                    {
+                        topic: input.topic,
+                        numPartitions: input.partitions ?? 1,
+                        replicationFactor: input.replicationFactor ?? 1
+                    }
+                ]
+            });
+        }
+    }
+    finally {
+        await admin.disconnect();
+    }
+}
+export async function waitForKafkaMessage(input) {
+    const kafka = new Kafka(createKafkaConfig(input));
+    const consumer = kafka.consumer({ groupId: input.groupId });
+    await consumer.connect();
+    await consumer.subscribe({
+        topic: input.topic,
+        fromBeginning: input.fromBeginning ?? false
+    });
+    return new Promise((resolvePromise, rejectPromise) => {
+        let settled = false;
+        const timeout = setTimeout(async () => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            await consumer.disconnect().catch(() => undefined);
+            rejectPromise(new Error(`Timed out waiting for Kafka message on ${input.topic}`));
+        }, input.timeoutMs ?? 30_000);
+        void consumer.run({
+            eachMessage: async ({ partition, message }) => {
+                if (settled) {
+                    return;
+                }
+                const candidate = toMessageRecord({
+                    key: message.key,
+                    value: message.value,
+                    headers: message.headers,
+                    partition,
+                    offset: message.offset
+                });
+                const matches = input.predicate
+                    ? await input.predicate(candidate)
+                    : true;
+                if (!matches) {
+                    return;
+                }
+                settled = true;
+                clearTimeout(timeout);
+                await consumer.disconnect();
+                resolvePromise(candidate);
+            }
+        }).catch(async (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            clearTimeout(timeout);
+            await consumer.disconnect().catch(() => undefined);
+            rejectPromise(error);
+        });
+    });
+}
+export async function waitForKafkaTopicMessages(input) {
+    const kafka = new Kafka(createKafkaConfig(input));
+    const admin = kafka.admin();
+    await admin.connect();
+    const deadline = Date.now() + (input.timeoutMs ?? 30_000);
+    const minMessages = input.minMessages ?? 1;
+    const pollIntervalMs = input.pollIntervalMs ?? 250;
+    try {
+        while (Date.now() <= deadline) {
+            const offsets = await admin.fetchTopicOffsets(input.topic);
+            const messageCount = offsets.reduce((sum, offset) => {
+                const value = Number(offset.offset);
+                return sum + (Number.isNaN(value) ? 0 : value);
+            }, 0);
+            if (messageCount >= minMessages) {
+                return messageCount;
+            }
+            await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+        }
+    }
+    finally {
+        await admin.disconnect();
+    }
+    throw new Error(`Timed out waiting for ${minMessages} Kafka message(s) on ${input.topic}`);
+}

package/dist/testing/oidc.d.ts

@@ -0,0 +1,19 @@
+export interface OidcTokenOptions {
+    subject?: string;
+    audience?: string | string[];
+    issuer?: string;
+    expiresIn?: string;
+    additionalClaims?: Record<string, unknown>;
+}
+export interface OidcTestIssuer {
+    issuer: string;
+    audience: string;
+    jwksUrl: string;
+    issueToken(options?: OidcTokenOptions): Promise<string>;
+    close(): Promise<void>;
+}
+export declare function startOidcTestIssuer(input?: {
+    issuerPath?: string;
+    audience?: string;
+}): Promise<OidcTestIssuer>;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/testing/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../src/testing/oidc.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,mBAAmB,CAAC,KAAK,GAAE;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,cAAc,CAAC,CAoE/B"}

package/dist/testing/oidc.js

@@ -0,0 +1,63 @@
+import { createServer } from 'node:http';
+import { generateKeyPair, exportJWK, SignJWT } from 'jose';
+export async function startOidcTestIssuer(input = {}) {
+    const issuerPath = input.issuerPath ?? '/realms/test';
+    const audience = input.audience ?? 'test-audience';
+    const { privateKey, publicKey } = await generateKeyPair('RS256');
+    const publicJwk = await exportJWK(publicKey);
+    const kid = 'mereb-test-key';
+    const jwk = {
+        ...publicJwk,
+        alg: 'RS256',
+        kid,
+        use: 'sig'
+    };
+    const server = createServer((request, response) => {
+        if (request.url === `${issuerPath}/protocol/openid-connect/certs`) {
+            response.writeHead(200, { 'content-type': 'application/json' });
+            response.end(JSON.stringify({ keys: [jwk] }));
+            return;
+        }
+        response.writeHead(404, { 'content-type': 'application/json' });
+        response.end(JSON.stringify({ error: 'Not found' }));
+    });
+    await new Promise((resolvePromise) => {
+        server.listen(0, '127.0.0.1', () => resolvePromise());
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Failed to determine OIDC issuer address');
+    }
+    const issuer = `http://127.0.0.1:${address.port}${issuerPath}`;
+    return {
+        issuer,
+        audience,
+        jwksUrl: `${issuer}/protocol/openid-connect/certs`,
+        async issueToken(options = {}) {
+            const jwtAudience = options.audience ?? audience;
+            const jwtIssuer = options.issuer ?? issuer;
+            const subject = options.subject ?? 'user-1';
+            return new SignJWT({
+                sub: subject,
+                ...options.additionalClaims
+            })
+                .setProtectedHeader({ alg: 'RS256', kid })
+                .setIssuer(jwtIssuer)
+                .setAudience(jwtAudience)
+                .setIssuedAt()
+                .setExpirationTime(options.expiresIn ?? '5m')
+                .sign(privateKey);
+        },
+        async close() {
+            await new Promise((resolvePromise, rejectPromise) => {
+                server.close((error) => {
+                    if (error) {
+                        rejectPromise(error);
+                        return;
+                    }
+                    resolvePromise();
+                });
+            });
+        }
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mereb/shared-packages",
-  "version": "0.0.39",
+  "version": "0.0.41",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -11,6 +11,18 @@
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
+    },
+    "./testing/db": {
+      "import": "./dist/testing/db.js",
+      "types": "./dist/testing/db.d.ts"
+    },
+    "./testing/kafka": {
+      "import": "./dist/testing/kafka.js",
+      "types": "./dist/testing/kafka.d.ts"
+    },
+    "./testing/oidc": {
+      "import": "./dist/testing/oidc.js",
+      "types": "./dist/testing/oidc.d.ts"
     }
   },
   "dependencies": {
@@ -42,6 +54,7 @@
     "@types/node": "^20.12.7",
     "@typescript-eslint/eslint-plugin": "^8.18.1",
     "@typescript-eslint/parser": "^8.18.1",
+    "@vitest/coverage-v8": "^1.6.0",
     "eslint": "^9.26.0",
     "husky": "^9.1.7",
     "rimraf": "^5.0.5",
@@ -52,7 +65,7 @@
     "build": "tsc -b",
     "clean": "rimraf dist",
     "lint": "eslint \"src/**/*.{ts,tsx}\"",
-    "test": "vitest run",
+    "test": "vitest run --coverage",
     "typecheck": "tsc --noEmit",
     "version:bump": "node ./scripts/bump-version.mjs"
   }