@nathapp/nestjs-csrf 4.0.0 → 4.0.1

package/test/csrf.module.spec.ts

@@ -1,267 +0,0 @@
-/* eslint-disable @typescript-eslint/no-var-requires */
-import {
-  Controller,
-  Get,
-  INestApplication,
-  Post,
-} from '@nestjs/common';
-import { Test } from '@nestjs/testing';
-import { CsrfModule, SkipCsrf } from '../lib';
-
-@Controller()
-class AppController {
-  @Get('page')
-  getPage(): { ok: boolean } {
-    return { ok: true };
-  }
-
-  @Post('action')
-  postAction(): { ok: boolean } {
-    return { ok: true };
-  }
-
-  @Post('skip')
-  @SkipCsrf()
-  skipAction(): { ok: boolean } {
-    return { ok: true };
-  }
-}
-
-function extractCsrfTokenFromSetCookie(
-  setCookieHeader: string | string[] | undefined,
-): string {
-  const raw = Array.isArray(setCookieHeader)
-    ? setCookieHeader[0]
-    : setCookieHeader;
-  if (!raw) return '';
-  const part = raw.split(';')[0];
-  const eqIdx = part.indexOf('=');
-  return eqIdx >= 0 ? part.slice(eqIdx + 1) : '';
-}
-
-describe('CsrfModule assembly and exports', () => {
-  describe('AC1: CsrfModule.register returns global dynamic module', () => {
-    it('AC1: returned DynamicModule has global === true when secret is provided', () => {
-      const dynamicModule = CsrfModule.register({ secret: 's' });
-      expect(dynamicModule).toBeDefined();
-      expect((dynamicModule as { global?: boolean }).global).toBe(true);
-    });
-  });
-
-  describe('AC2: POST without CSRF tokens returns 403 from a globally wired app', () => {
-    let app: INestApplication;
-
-    beforeAll(async () => {
-      const moduleRef = await Test.createTestingModule({
-        imports: [CsrfModule.register({ secret: 's' })],
-        controllers: [AppController],
-      }).compile();
-      app = moduleRef.createNestApplication();
-      await app.init();
-    });
-
-    afterAll(async () => {
-      await app?.close();
-    });
-
-    it('AC2: POST /action with no CSRF cookie or header returns 403', async () => {
-      const supertest = require('supertest');
-      const res = await supertest(app.getHttpServer()).post('/action');
-      expect(res.statusCode).toBe(403);
-    });
-  });
-
-  describe('AC3: GET returns 2xx and issues Set-Cookie header for the CSRF cookie', () => {
-    let app: INestApplication;
-
-    beforeAll(async () => {
-      const moduleRef = await Test.createTestingModule({
-        imports: [CsrfModule.register({ secret: 's' })],
-        controllers: [AppController],
-      }).compile();
-      app = moduleRef.createNestApplication();
-      await app.init();
-    });
-
-    afterAll(async () => {
-      await app?.close();
-    });
-
-    it('AC3: GET /page returns 2xx and Set-Cookie header contains the configured CSRF cookie', async () => {
-      const supertest = require('supertest');
-      const res = await supertest(app.getHttpServer()).get('/page');
-      expect(res.statusCode).toBeGreaterThanOrEqual(200);
-      expect(res.statusCode).toBeLessThan(300);
-      const setCookie: string | string[] | undefined = res.headers['set-cookie'];
-      expect(setCookie).toBeDefined();
-      const cookieStr = Array.isArray(setCookie)
-        ? setCookie.join(', ')
-        : setCookie ?? '';
-      expect(cookieStr).toContain('csrf-token');
-      const tokenValue = extractCsrfTokenFromSetCookie(setCookie);
-      expect(tokenValue.length).toBeGreaterThan(0);
-    });
-  });
-
-  describe('AC4: full double-submit round-trip returns 2xx', () => {
-    let app: INestApplication;
-
-    beforeAll(async () => {
-      const moduleRef = await Test.createTestingModule({
-        imports: [CsrfModule.register({ secret: 's' })],
-        controllers: [AppController],
-      }).compile();
-      app = moduleRef.createNestApplication();
-      const cookieParser = require('cookie-parser');
-      app.use(cookieParser());
-      await app.init();
-    });
-
-    afterAll(async () => {
-      await app?.close();
-    });
-
-    it('AC4: GET-obtained CSRF cookie echoed in cookie + x-csrf-token header lets POST return 2xx', async () => {
-      const supertest = require('supertest');
-      const getRes = await supertest(app.getHttpServer()).get('/page');
-      expect(getRes.statusCode).toBeGreaterThanOrEqual(200);
-      const tokenValue = extractCsrfTokenFromSetCookie(getRes.headers['set-cookie']);
-      expect(tokenValue.length).toBeGreaterThan(0);
-
-      const postRes = await supertest(app.getHttpServer())
-        .post('/action')
-        .set('Cookie', `csrf-token=${tokenValue}`)
-        .set('x-csrf-token', tokenValue);
-      expect(postRes.statusCode).toBeGreaterThanOrEqual(200);
-      expect(postRes.statusCode).toBeLessThan(300);
-    });
-  });
-
-  describe('AC5: enabled: false short-circuits CSRF protection', () => {
-    let app: INestApplication;
-
-    beforeAll(async () => {
-      const moduleRef = await Test.createTestingModule({
-        imports: [CsrfModule.register({ secret: 's', enabled: false })],
-        controllers: [AppController],
-      }).compile();
-      app = moduleRef.createNestApplication();
-      await app.init();
-    });
-
-    afterAll(async () => {
-      await app?.close();
-    });
-
-    it('AC5: POST /action without CSRF tokens returns 2xx when enabled is false', async () => {
-      const supertest = require('supertest');
-      const res = await supertest(app.getHttpServer()).post('/action');
-      expect(res.statusCode).toBeGreaterThanOrEqual(200);
-      expect(res.statusCode).toBeLessThan(300);
-    });
-  });
-
-  describe('AC6: @SkipCsrf() handler bypasses CSRF protection', () => {
-    let app: INestApplication;
-
-    beforeAll(async () => {
-      const moduleRef = await Test.createTestingModule({
-        imports: [CsrfModule.register({ secret: 's' })],
-        controllers: [AppController],
-      }).compile();
-      app = moduleRef.createNestApplication();
-      await app.init();
-    });
-
-    afterAll(async () => {
-      await app?.close();
-    });
-
-    it('AC6: POST /skip with no CSRF tokens returns 2xx because the handler is decorated with @SkipCsrf()', async () => {
-      const supertest = require('supertest');
-      const res = await supertest(app.getHttpServer()).post('/skip');
-      expect(res.statusCode).toBeGreaterThanOrEqual(200);
-      expect(res.statusCode).toBeLessThan(300);
-    });
-  });
-
-  describe('AC7: registerAsync applies the guard and rejects tokenless POST', () => {
-    let app: INestApplication;
-
-    beforeAll(async () => {
-      const moduleRef = await Test.createTestingModule({
-        imports: [
-          CsrfModule.registerAsync({ useFactory: () => ({ secret: 's' }) }),
-        ],
-        controllers: [AppController],
-      }).compile();
-      app = moduleRef.createNestApplication();
-      await app.init();
-    });
-
-    afterAll(async () => {
-      await app?.close();
-    });
-
-    it('AC7: POST /action without CSRF tokens returns 403 when registered via registerAsync', async () => {
-      const supertest = require('supertest');
-      const res = await supertest(app.getHttpServer()).post('/action');
-      expect(res.statusCode).toBe(403);
-    });
-  });
-
-  describe('AC7 (boundary): registerAsync validates resolved options and fails fast on empty/missing secret', () => {
-    it('AC7 (boundary): registerAsync throws an Error mentioning "secret" when the factory resolves an empty secret at module compile time', async () => {
-      let thrownError: Error | undefined;
-      try {
-        // Validation happens when Nest resolves the async provider during compile
-        await Test.createTestingModule({
-          imports: [
-            CsrfModule.registerAsync({
-              useFactory: () => ({ secret: '' }) as never,
-            }),
-          ],
-          controllers: [AppController],
-        }).compile();
-      } catch (err) {
-        thrownError = err as Error;
-      }
-      expect(thrownError).toBeDefined();
-      expect(thrownError).toBeInstanceOf(Error);
-      expect(thrownError!.message).toMatch(/secret/i);
-    });
-
-    it('AC7 (boundary): registerAsync throws an Error mentioning "secret" when the factory resolves without a secret key at module compile time', async () => {
-      let thrownError: Error | undefined;
-      try {
-        await Test.createTestingModule({
-          imports: [
-            CsrfModule.registerAsync({
-              useFactory: () => ({}) as never,
-            }),
-          ],
-          controllers: [AppController],
-        }).compile();
-      } catch (err) {
-        thrownError = err as Error;
-      }
-      expect(thrownError).toBeDefined();
-      expect(thrownError).toBeInstanceOf(Error);
-      expect(thrownError!.message).toMatch(/secret/i);
-    });
-  });
-
-  describe('AC8: register without secret throws at registration time', () => {
-    it('AC8: throws an Error whose message mentions "secret"', () => {
-      let thrownError: Error | undefined;
-      try {
-        CsrfModule.register({} as never);
-      } catch (err) {
-        thrownError = err as Error;
-      }
-      expect(thrownError).toBeDefined();
-      expect(thrownError).toBeInstanceOf(Error);
-      expect(thrownError!.message).toMatch(/secret/i);
-    });
-  });
-});

package/test/guard/csrf.guard.spec.ts

@@ -1,347 +0,0 @@
-/* eslint-disable @typescript-eslint/no-var-requires */
-describe('DefaultCsrfGuard', () => {
-  const SECRET = 'super-secret';
-
-  const loadDeps = () => {
-    const mod = require('../../lib');
-    const errors = require('@nathapp/nestjs-common');
-    const core = require('@nestjs/core');
-    return {
-      DefaultCsrfGuard: mod.DefaultCsrfGuard,
-      CsrfTokenService: mod.CsrfTokenService,
-      SKIP_CSRF_METADATA_KEY: mod.SKIP_CSRF_METADATA_KEY,
-      CSRF_MODULE_OPTIONS: mod.CSRF_MODULE_OPTIONS,
-      ForbiddenAppException: errors.ForbiddenAppException,
-      Reflector: core.Reflector,
-      Test: require('@nestjs/testing').Test,
-    };
-  };
-
-  function assertGuardAvailable(deps) {
-    expect(typeof deps.DefaultCsrfGuard).toBe('function');
-  }
-
-  function buildContext(req, res, handler) {
-    return {
-      switchToHttp: () => ({
-        getRequest: () => req,
-        getResponse: () => res,
-      }),
-      getHandler: () => handler,
-      getClass: () => undefined,
-    };
-  }
-
-  function buildSkipCsrfReflector(reflector, metadataKey) {
-    reflector.getAllAndOverride = jest.fn().mockImplementation((key) => {
-      if (key === metadataKey) return true;
-      return undefined;
-    });
-    return reflector;
-  }
-
-  describe('AC1: provider resolution', () => {
-    it('AC1: resolves from a compiled Nest testing module and exposes canActivate', async () => {
-      const deps = loadDeps();
-      expect(typeof deps.DefaultCsrfGuard).toBe('function');
-
-      const moduleRef = await deps.Test.createTestingModule({
-        providers: [
-          deps.CsrfTokenService,
-          {
-            provide: deps.CSRF_MODULE_OPTIONS,
-            useValue: { secret: SECRET },
-          },
-          {
-            provide: deps.DefaultCsrfGuard,
-            useFactory: (options, tokens, reflector) =>
-              new deps.DefaultCsrfGuard(options, tokens, reflector),
-            inject: [deps.CSRF_MODULE_OPTIONS, deps.CsrfTokenService, deps.Reflector],
-          },
-        ],
-      }).compile();
-
-      const guard = moduleRef.get(deps.DefaultCsrfGuard);
-      expect(guard).toBeDefined();
-      expect(typeof guard.canActivate).toBe('function');
-    });
-  });
-
-  describe('AC2: Express GET auto-issues via res.cookie', () => {
-    it('AC2: returns true and calls res.cookie with the configured cookie name and a minted token', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard({ secret: SECRET }, tokens, reflector);
-
-      const cookieFn = jest.fn();
-      const req = { method: 'GET', headers: {}, cookies: {} };
-      const res = { cookie: cookieFn };
-      const context = buildContext(req, res, undefined);
-
-      const result = guard.canActivate(context);
-
-      expect(result).toBe(true);
-      expect(cookieFn).toHaveBeenCalledTimes(1);
-      const [name, tokenValue] = cookieFn.mock.calls[0];
-      expect(name).toBe('csrf-token');
-      expect(typeof tokenValue).toBe('string');
-      expect(tokenValue).toMatch(/^[0-9a-f]{64}\.[0-9a-f]{64}$/);
-    });
-  });
-
-  describe('AC3: Fastify GET auto-issues via res.setCookie', () => {
-    it('AC3: returns true and calls res.setCookie (not res.cookie) with the configured cookie name', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard({ secret: SECRET }, tokens, reflector);
-
-      const setCookieFn = jest.fn();
-      const cookieFn = jest.fn();
-      const fastifyRaw = { id: 'fastify-raw' };
-      const req = {
-        method: 'GET',
-        headers: {},
-        cookies: {},
-        raw: fastifyRaw,
-      };
-      const res = { setCookie: setCookieFn, cookie: cookieFn };
-      const context = buildContext(req, res, undefined);
-
-      const result = guard.canActivate(context);
-
-      expect(result).toBe(true);
-      expect(setCookieFn).toHaveBeenCalledTimes(1);
-      expect(cookieFn).not.toHaveBeenCalled();
-      const [name, tokenValue] = setCookieFn.mock.calls[0];
-      expect(name).toBe('csrf-token');
-      expect(typeof tokenValue).toBe('string');
-      expect(tokenValue).toMatch(/^[0-9a-f]{64}\.[0-9a-f]{64}$/);
-    });
-  });
-
-  describe('AC4: @SkipCsrf() handler bypass', () => {
-    it('AC4: returns true on a POST with no token when the handler is decorated with @SkipCsrf()', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard({ secret: SECRET }, tokens, reflector);
-      buildSkipCsrfReflector(reflector, deps.SKIP_CSRF_METADATA_KEY);
-
-      const verifySpy = jest.spyOn(tokens, 'verify');
-
-      const req = { method: 'POST', headers: {}, cookies: {} };
-      const res = { cookie: jest.fn(), setCookie: jest.fn() };
-      const handler = {};
-      const context = buildContext(req, res, handler);
-
-      const result = guard.canActivate(context);
-
-      expect(result).toBe(true);
-      expect(verifySpy).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('AC5: Bearer authorization bypass', () => {
-    it('AC5: returns true when authorization header is Bearer and skipWhenBearer is true', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard(
-        { secret: SECRET, skipWhenBearer: true },
-        tokens,
-        reflector,
-      );
-
-      const verifySpy = jest.spyOn(tokens, 'verify');
-
-      const req = {
-        method: 'POST',
-        headers: { authorization: 'Bearer abc' },
-        cookies: {},
-      };
-      const res = { cookie: jest.fn(), setCookie: jest.fn() };
-      const context = buildContext(req, res, undefined);
-
-      const result = guard.canActivate(context);
-
-      expect(result).toBe(true);
-      expect(verifySpy).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('AC6 + AC7: valid double-submit verification', () => {
-    it('AC6: returns true when cookie and x-csrf-token header both equal a valid minted token', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard({ secret: SECRET }, tokens, reflector);
-
-      const token = tokens.mint(SECRET);
-      const req = {
-        method: 'POST',
-        headers: { 'x-csrf-token': token },
-        cookies: { 'csrf-token': token },
-      };
-      const res = { cookie: jest.fn(), setCookie: jest.fn() };
-      const context = buildContext(req, res, undefined);
-
-      const result = guard.canActivate(context);
-
-      expect(result).toBe(true);
-    });
-
-    it('AC7: invokes CsrfTokenService.verify with the cookie and header values', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard({ secret: SECRET }, tokens, reflector);
-
-      const token = tokens.mint(SECRET);
-      const verifySpy = jest.spyOn(tokens, 'verify');
-
-      const req = {
-        method: 'POST',
-        headers: { 'x-csrf-token': token },
-        cookies: { 'csrf-token': token },
-      };
-      const res = { cookie: jest.fn(), setCookie: jest.fn() };
-      const context = buildContext(req, res, undefined);
-
-      guard.canActivate(context);
-
-      expect(verifySpy).toHaveBeenCalledTimes(1);
-      const [secretArg, cookieArg, headerArg] = verifySpy.mock.calls[0];
-      expect(secretArg).toBe(SECRET);
-      expect(cookieArg).toBe(token);
-      expect(headerArg).toBe(token);
-    });
-  });
-
-  describe('AC8: cookie present, header missing', () => {
-    it('AC8: throws ForbiddenAppException with HTTP status 403 when x-csrf-token header is absent', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard({ secret: SECRET }, tokens, reflector);
-
-      const token = tokens.mint(SECRET);
-      const req = {
-        method: 'POST',
-        headers: {},
-        cookies: { 'csrf-token': token },
-      };
-      const res = { cookie: jest.fn(), setCookie: jest.fn() };
-      const context = buildContext(req, res, undefined);
-
-      try {
-        guard.canActivate(context);
-        throw new Error('Expected canActivate to throw ForbiddenAppException');
-      } catch (err) {
-        expect(err).toBeInstanceOf(deps.ForbiddenAppException);
-        expect(err.getStatus()).toBe(403);
-      }
-    });
-  });
-
-  describe('AC9: cookie and header differ', () => {
-    it('AC9: throws ForbiddenAppException with HTTP status 403 when cookie and header hold different values', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard({ secret: SECRET }, tokens, reflector);
-
-      const cookieToken = tokens.mint(SECRET);
-      const headerToken = tokens.mint(SECRET);
-      expect(cookieToken).not.toBe(headerToken);
-
-      const req = {
-        method: 'POST',
-        headers: { 'x-csrf-token': headerToken },
-        cookies: { 'csrf-token': cookieToken },
-      };
-      const res = { cookie: jest.fn(), setCookie: jest.fn() };
-      const context = buildContext(req, res, undefined);
-
-      try {
-        guard.canActivate(context);
-        throw new Error('Expected canActivate to throw ForbiddenAppException');
-      } catch (err) {
-        expect(err).toBeInstanceOf(deps.ForbiddenAppException);
-        expect(err.getStatus()).toBe(403);
-      }
-    });
-  });
-
-  describe('AC10: header present, cookie missing', () => {
-    it('AC10: throws ForbiddenAppException with HTTP status 403 when CSRF cookie is absent', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard({ secret: SECRET }, tokens, reflector);
-
-      const token = tokens.mint(SECRET);
-      const req = {
-        method: 'POST',
-        headers: { 'x-csrf-token': token },
-        cookies: {},
-      };
-      const res = { cookie: jest.fn(), setCookie: jest.fn() };
-      const context = buildContext(req, res, undefined);
-
-      try {
-        guard.canActivate(context);
-        throw new Error('Expected canActivate to throw ForbiddenAppException');
-      } catch (err) {
-        expect(err).toBeInstanceOf(deps.ForbiddenAppException);
-        expect(err.getStatus()).toBe(403);
-      }
-    });
-  });
-
-  describe('AC11: cookie parser not enabled', () => {
-    it('AC11: throws ForbiddenAppException with HTTP status 403 when req.cookies is undefined', () => {
-      const deps = loadDeps();
-      assertGuardAvailable(deps);
-
-      const tokens = new deps.CsrfTokenService();
-      const reflector = new deps.Reflector();
-      const guard = new deps.DefaultCsrfGuard({ secret: SECRET }, tokens, reflector);
-
-      const req = {
-        method: 'POST',
-        headers: { 'x-csrf-token': 'irrelevant' },
-        cookies: undefined,
-      };
-      const res = { cookie: jest.fn(), setCookie: jest.fn() };
-      const context = buildContext(req, res, undefined);
-
-      try {
-        guard.canActivate(context);
-        throw new Error('Expected canActivate to throw ForbiddenAppException');
-      } catch (err) {
-        expect(err).toBeInstanceOf(deps.ForbiddenAppException);
-        expect(err.getStatus()).toBe(403);
-      }
-    });
-  });
-});

package/test/jest-nax.json

@@ -1,27 +0,0 @@
-{
-  "moduleFileExtensions": ["js", "json", "ts", "d.ts"],
-  "rootDir": "../",
-  "testEnvironment": "node",
-  "testMatch": ["**/.nax/**/*.test.ts"],
-  "transform": {
-    "^.+\\.(t)s$": [
-      "ts-jest",
-      {
-        "diagnostics": true,
-        "tsconfig": {
-          "esModuleInterop": true,
-          "emitDecoratorMetadata": true,
-          "experimentalDecorators": true
-        }
-      }
-    ]
-  },
-  "collectCoverageFrom": [
-    "lib/**/*.ts",
-    "!lib/**/*.spec.ts",
-    "!lib/**/*.d.ts",
-    "!**/node_modules/**"
-  ],
-  "forceExit": true,
-  "maxWorkers": 1
-}

package/test/jest-test.json

@@ -1,28 +0,0 @@
-{
-  "moduleFileExtensions": [
-    "js",
-    "json",
-    "ts",
-    "d.ts"
-  ],
-  "rootDir": "../",
-  "testEnvironment": "node",
-  "testRegex": ".spec.ts$",
-  "transform": {
-    "^.+\\.(t)s$": [
-      "ts-jest",
-      {
-        "diagnostics": true
-      }
-    ]
-  },
-  "collectCoverageFrom": [
-    "lib/**/*.ts",
-    "!lib/**/*.spec.ts",
-    "!lib/**/*.d.ts",
-    "!lib/**/index.ts",
-    "!lib/**/*.interface.ts",
-    "!**/node_modules/**"
-  ],
-  "coverageProvider": "v8"
-}