@nauth-toolkit/core 0.1.0 → 0.1.5

package/src/services/jwt.service.spec.ts

@@ -1,882 +0,0 @@
-import * as crypto from 'crypto';
-import { JwtService } from './jwt.service';
-import { JwtConfig } from '../interfaces/config.interface';
-import { NAuthException } from '../exceptions/nauth.exception';
-
-/**
- * JWT Service Unit Tests
- *
- * Covers:
- * - Token generation (access and refresh tokens)
- * - Token validation (access and refresh tokens)
- * - Multiple algorithms (HS256, HS384, HS512, RS256, RS384, RS512)
- * - Token expiration handling
- * - Token family tracking
- * - Token utilities (hash, decode, extract)
- * - Error handling
- * - Configuration edge cases
- */
-describe('JwtService', () => {
-  let service: JwtService;
-  let config: JwtConfig;
-
-  // Generate RSA key pair for asymmetric algorithm testing
-  const generateRSAKeyPair = (): { privateKey: string; publicKey: string } => {
-    const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
-      modulusLength: 2048,
-      publicKeyEncoding: {
-        type: 'spki',
-        format: 'pem',
-      },
-      privateKeyEncoding: {
-        type: 'pkcs8',
-        format: 'pem',
-      },
-    });
-    return { privateKey, publicKey };
-  };
-
-  const defaultConfig: JwtConfig = {
-    algorithm: 'HS256',
-    accessToken: {
-      secret: 'test-access-secret-min-32-characters',
-      expiresIn: '15m',
-    },
-    refreshToken: {
-      secret: 'test-refresh-secret-min-32-characters',
-      expiresIn: '30d',
-      rotation: true,
-      reuseDetection: true,
-    },
-    issuer: 'nauth-toolkit',
-    audience: 'test-app',
-  };
-
-  beforeEach(() => {
-    config = { ...defaultConfig };
-    service = new JwtService(config);
-  });
-
-  // ============================================================================
-  // Service Initialization
-  // ============================================================================
-
-  describe('constructor', () => {
-    it('should initialize with valid config', () => {
-      expect(service).toBeDefined();
-    });
-
-    it('should use default algorithm HS256 when not specified', () => {
-      const configWithoutAlgorithm = {
-        ...defaultConfig,
-        algorithm: undefined,
-      };
-      const serviceDefault = new JwtService(configWithoutAlgorithm);
-      expect(serviceDefault).toBeDefined();
-    });
-  });
-
-  // ============================================================================
-  // Token Generation
-  // ============================================================================
-
-  describe('generateTokenPair', () => {
-    it('should generate access and refresh tokens', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      expect(tokens.accessToken).toBeDefined();
-      expect(tokens.refreshToken).toBeDefined();
-      expect(tokens.expiresIn).toBe(900); // 15 minutes
-    });
-
-    it('should include token family in both tokens', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const accessDecoded = service.decodeToken(tokens.accessToken);
-      const refreshDecoded = service.decodeToken(tokens.refreshToken);
-
-      expect(accessDecoded?.tokenFamily).toBeDefined();
-      expect(refreshDecoded?.tokenFamily).toBeDefined();
-      expect(accessDecoded?.tokenFamily).toBe(refreshDecoded?.tokenFamily);
-    });
-
-    it('should reuse provided token family', async () => {
-      const providedFamily = 'existing-family-id';
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-        tokenFamily: providedFamily,
-      });
-
-      const accessDecoded = service.decodeToken(tokens.accessToken);
-      expect(accessDecoded?.tokenFamily).toBe(providedFamily);
-    });
-
-    it('should include all required fields in tokens', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const accessDecoded = service.decodeToken(tokens.accessToken);
-      expect(accessDecoded?.sub).toBe('user-123');
-      expect(accessDecoded?.email).toBe('test@example.com');
-      expect(accessDecoded?.sessionId).toBe('session-456');
-      expect(accessDecoded?.type).toBe('access');
-      expect(accessDecoded?.iat).toBeDefined();
-      expect(accessDecoded?.exp).toBeDefined();
-    });
-  });
-
-  describe('generateAccessToken', () => {
-    it('should generate access token with issuer and audience', async () => {
-      const token = await service.generateAccessToken({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-        tokenFamily: 'family-123',
-      });
-
-      expect(token).toBeDefined();
-      const decoded = service.decodeToken(token);
-      expect(decoded?.iss).toBe('nauth-toolkit');
-      expect(decoded?.aud).toBe('test-app');
-    });
-
-    it('should generate access token without issuer and audience', async () => {
-      const configWithoutIssuer = {
-        ...defaultConfig,
-        issuer: undefined,
-        audience: undefined,
-      };
-      const serviceWithoutIssuer = new JwtService(configWithoutIssuer);
-
-      const token = await serviceWithoutIssuer.generateAccessToken({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-        tokenFamily: 'family-123',
-      });
-
-      expect(token).toBeDefined();
-      const decoded = serviceWithoutIssuer.decodeToken(token);
-      expect(decoded?.iss).toBeUndefined();
-      expect(decoded?.aud).toBeUndefined();
-    });
-
-    it('should generate access token with array audience', async () => {
-      const configWithArrayAudience = {
-        ...defaultConfig,
-        audience: ['app1', 'app2'],
-      };
-      const serviceWithArrayAudience = new JwtService(configWithArrayAudience);
-
-      const token = await serviceWithArrayAudience.generateAccessToken({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-        tokenFamily: 'family-123',
-      });
-
-      expect(token).toBeDefined();
-      const decoded = serviceWithArrayAudience.decodeToken(token);
-      expect(Array.isArray(decoded?.aud)).toBe(true);
-      expect((decoded?.aud as string[]).length).toBe(2);
-    });
-
-    it('should throw error when access token key not configured', async () => {
-      const configWithoutKey: JwtConfig = {
-        ...defaultConfig,
-        accessToken: {
-          expiresIn: '15m',
-        },
-      };
-      const serviceWithoutKey = new JwtService(configWithoutKey);
-
-      try {
-        await serviceWithoutKey.generateAccessToken({
-          userId: 'user-123',
-          email: 'test@example.com',
-          sessionId: 'session-456',
-          tokenFamily: 'family-123',
-        });
-        fail('Should have thrown NAuthException');
-      } catch (error) {
-        expect(error).toBeInstanceOf(NAuthException);
-      }
-    });
-  });
-
-  describe('generateRefreshToken', () => {
-    it('should generate refresh token', async () => {
-      const token = await service.generateRefreshToken({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-        tokenFamily: 'family-123',
-      });
-
-      expect(token).toBeDefined();
-      const decoded = service.decodeToken(token);
-      expect(decoded?.type).toBe('refresh');
-    });
-
-    it('should throw error when refresh token secret not configured', async () => {
-      const configWithoutSecret: JwtConfig = {
-        ...defaultConfig,
-        refreshToken: {
-          secret: '', // Empty secret to trigger error
-          expiresIn: '30d',
-        },
-      };
-      // Create service that will fail during key preparation
-      const serviceWithoutSecret = new JwtService(configWithoutSecret);
-
-      try {
-        await serviceWithoutSecret.generateRefreshToken({
-          userId: 'user-123',
-          email: 'test@example.com',
-          sessionId: 'session-456',
-          tokenFamily: 'family-123',
-        });
-        fail('Should have thrown NAuthException');
-      } catch (error) {
-        expect(error).toBeInstanceOf(NAuthException);
-      }
-    });
-  });
-
-  // ============================================================================
-  // Algorithm Support
-  // ============================================================================
-
-  describe('algorithm support', () => {
-    const symmetricAlgorithms: Array<'HS256' | 'HS384' | 'HS512'> = ['HS256', 'HS384', 'HS512'];
-    const asymmetricAlgorithms: Array<'RS256' | 'RS384' | 'RS512'> = ['RS256', 'RS384', 'RS512'];
-
-    symmetricAlgorithms.forEach((algorithm) => {
-      it(`should generate and validate tokens with ${algorithm}`, async () => {
-        const configWithAlgorithm = {
-          ...defaultConfig,
-          algorithm,
-        };
-        const serviceWithAlgorithm = new JwtService(configWithAlgorithm);
-
-        const tokens = await serviceWithAlgorithm.generateTokenPair({
-          userId: 'user-123',
-          email: 'test@example.com',
-          sessionId: 'session-456',
-        });
-
-        const result = await serviceWithAlgorithm.validateAccessToken(tokens.accessToken);
-        expect(result.valid).toBe(true);
-        expect(result.payload?.sub).toBe('user-123');
-      });
-    });
-
-    asymmetricAlgorithms.forEach((algorithm) => {
-      it(`should generate and validate tokens with ${algorithm}`, async () => {
-        const { privateKey, publicKey } = generateRSAKeyPair();
-        const configWithAlgorithm: JwtConfig = {
-          ...defaultConfig,
-          algorithm,
-          accessToken: {
-            privateKey,
-            publicKey,
-            expiresIn: '15m',
-          },
-        };
-        const serviceWithAlgorithm = new JwtService(configWithAlgorithm);
-
-        const tokens = await serviceWithAlgorithm.generateTokenPair({
-          userId: 'user-123',
-          email: 'test@example.com',
-          sessionId: 'session-456',
-        });
-
-        const result = await serviceWithAlgorithm.validateAccessToken(tokens.accessToken);
-        expect(result.valid).toBe(true);
-        expect(result.payload?.sub).toBe('user-123');
-      });
-    });
-
-    it('should use HS256 for refresh token when access token uses asymmetric algorithm', async () => {
-      const { privateKey, publicKey } = generateRSAKeyPair();
-      const configWithRS256: JwtConfig = {
-        ...defaultConfig,
-        algorithm: 'RS256',
-        accessToken: {
-          privateKey,
-          publicKey,
-          expiresIn: '15m',
-        },
-      };
-      const serviceWithRS256 = new JwtService(configWithRS256);
-
-      const tokens = await serviceWithRS256.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      // Refresh token should still validate (uses HS256)
-      const refreshResult = await serviceWithRS256.validateRefreshToken(tokens.refreshToken);
-      expect(refreshResult.valid).toBe(true);
-    });
-  });
-
-  // ============================================================================
-  // Token Validation
-  // ============================================================================
-
-  describe('validateAccessToken', () => {
-    it('should validate valid access token', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const result = await service.validateAccessToken(tokens.accessToken);
-
-      expect(result.valid).toBe(true);
-      expect(result.payload).toBeDefined();
-      expect(result.payload?.sub).toBe('user-123');
-      expect(result.payload?.email).toBe('test@example.com');
-      expect(result.payload?.type).toBe('access');
-    });
-
-    it('should reject refresh token as access token', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const result = await service.validateAccessToken(tokens.refreshToken);
-
-      expect(result.valid).toBe(false);
-      expect(result.errorType).toBe('invalid');
-    });
-
-    it('should reject malformed token', async () => {
-      const result = await service.validateAccessToken('invalid-token');
-
-      expect(result.valid).toBe(false);
-      // jose library may return 'invalid' or 'malformed' for malformed tokens
-      expect(result.errorType).toBeDefined();
-      expect(['invalid', 'malformed']).toContain(result.errorType!);
-    });
-
-    it('should reject expired token', async () => {
-      // Create token with very short expiration (using real-world string format)
-      const configWithShortExpiry = {
-        ...defaultConfig,
-        accessToken: {
-          ...defaultConfig.accessToken,
-          expiresIn: '1s', // 1 second - matches real-world config format ('15m', '30d', etc.)
-        },
-      };
-      const serviceWithShortExpiry = new JwtService(configWithShortExpiry);
-
-      const tokens = await serviceWithShortExpiry.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      // Wait for token to expire (add buffer for clock skew and parsing)
-      await new Promise((resolve) => setTimeout(resolve, 2100));
-
-      const result = await serviceWithShortExpiry.validateAccessToken(tokens.accessToken);
-
-      expect(result.valid).toBe(false);
-      expect(result.errorType).toBe('expired');
-    });
-
-    it('should reject token with wrong signature', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      // Create service with different secret
-      const differentConfig = {
-        ...defaultConfig,
-        accessToken: {
-          ...defaultConfig.accessToken,
-          secret: 'different-secret-min-32-characters-long',
-        },
-      };
-      const differentService = new JwtService(differentConfig);
-
-      const result = await differentService.validateAccessToken(tokens.accessToken);
-
-      expect(result.valid).toBe(false);
-      // jose library may return 'invalid' or 'malformed' for wrong signature
-      expect(result.errorType).toBeDefined();
-      expect(['invalid', 'malformed']).toContain(result.errorType!);
-    });
-
-    it('should validate token with public key for asymmetric algorithm', async () => {
-      const { privateKey, publicKey } = generateRSAKeyPair();
-      const configWithRS256: JwtConfig = {
-        ...defaultConfig,
-        algorithm: 'RS256',
-        accessToken: {
-          privateKey,
-          publicKey,
-          expiresIn: '15m',
-        },
-      };
-      const serviceWithRS256 = new JwtService(configWithRS256);
-
-      const tokens = await serviceWithRS256.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const result = await serviceWithRS256.validateAccessToken(tokens.accessToken);
-      expect(result.valid).toBe(true);
-      expect(result.payload?.sub).toBe('user-123');
-    });
-
-    it('should reject token when issuer mismatch', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const configWithDifferentIssuer = {
-        ...defaultConfig,
-        issuer: 'different-issuer',
-      };
-      const serviceWithDifferentIssuer = new JwtService(configWithDifferentIssuer);
-
-      const result = await serviceWithDifferentIssuer.validateAccessToken(tokens.accessToken);
-
-      expect(result.valid).toBe(false);
-      // jose library may return 'invalid' or 'malformed' for issuer mismatch
-      expect(result.errorType).toBeDefined();
-      expect(['invalid', 'malformed']).toContain(result.errorType!);
-    });
-
-    it('should reject token when audience mismatch', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const configWithDifferentAudience = {
-        ...defaultConfig,
-        audience: 'different-audience',
-      };
-      const serviceWithDifferentAudience = new JwtService(configWithDifferentAudience);
-
-      const result = await serviceWithDifferentAudience.validateAccessToken(tokens.accessToken);
-
-      expect(result.valid).toBe(false);
-      // jose library may return 'invalid' or 'malformed' for audience mismatch
-      expect(result.errorType).toBeDefined();
-      expect(['invalid', 'malformed']).toContain(result.errorType!);
-    });
-
-    it('should handle missing public key gracefully for asymmetric algorithm', async () => {
-      const { privateKey } = generateRSAKeyPair();
-      const configWithoutPublicKey: JwtConfig = {
-        ...defaultConfig,
-        algorithm: 'RS256',
-        accessToken: {
-          privateKey,
-          expiresIn: '15m',
-        },
-      };
-      const serviceWithoutPublicKey = new JwtService(configWithoutPublicKey);
-
-      const tokens = await serviceWithoutPublicKey.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      // Validation should fail without public key
-      const result = await serviceWithoutPublicKey.validateAccessToken(tokens.accessToken);
-      expect(result.valid).toBe(false);
-    });
-  });
-
-  describe('validateRefreshToken', () => {
-    it('should validate valid refresh token', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const result = await service.validateRefreshToken(tokens.refreshToken);
-
-      expect(result.valid).toBe(true);
-      expect(result.payload).toBeDefined();
-      expect(result.payload?.type).toBe('refresh');
-      expect(result.payload?.sub).toBe('user-123');
-    });
-
-    it('should reject access token as refresh token', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const result = await service.validateRefreshToken(tokens.accessToken);
-
-      expect(result.valid).toBe(false);
-      expect(result.errorType).toBe('invalid');
-    });
-
-    it('should reject malformed refresh token', async () => {
-      const result = await service.validateRefreshToken('invalid-token');
-
-      expect(result.valid).toBe(false);
-      // jose library may return 'invalid' or 'malformed' for malformed tokens
-      expect(result.errorType).toBeDefined();
-      expect(['invalid', 'malformed']).toContain(result.errorType!);
-    });
-
-    it('should reject expired refresh token', async () => {
-      const configWithShortExpiry = {
-        ...defaultConfig,
-        refreshToken: {
-          ...defaultConfig.refreshToken,
-          expiresIn: '1s', // 1 second - matches real-world config format ('30d', '7d', etc.)
-        },
-      };
-      const serviceWithShortExpiry = new JwtService(configWithShortExpiry);
-
-      const tokens = await serviceWithShortExpiry.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      // Wait for token to expire (add buffer for clock skew and parsing)
-      await new Promise((resolve) => setTimeout(resolve, 2100));
-
-      const result = await serviceWithShortExpiry.validateRefreshToken(tokens.refreshToken);
-
-      expect(result.valid).toBe(false);
-      expect(result.errorType).toBe('expired');
-    });
-
-    it('should handle missing refresh token key during validation', async () => {
-      const configWithoutSecret: JwtConfig = {
-        ...defaultConfig,
-        refreshToken: {
-          secret: '', // Empty secret
-          expiresIn: '30d',
-        },
-      };
-      const serviceWithoutSecret = new JwtService(configWithoutSecret);
-
-      // Validation should fail without secret
-      const result = await serviceWithoutSecret.validateRefreshToken('any-token');
-      expect(result.valid).toBe(false);
-    });
-  });
-
-  // ============================================================================
-  // Token Utilities
-  // ============================================================================
-
-  describe('decodeToken', () => {
-    it('should decode token without verification', async () => {
-      const tokens = await service.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      const decoded = service.decodeToken(tokens.accessToken);
-
-      expect(decoded).toBeDefined();
-      expect(decoded?.sub).toBe('user-123');
-      expect(decoded?.email).toBe('test@example.com');
-      expect(decoded?.sessionId).toBe('session-456');
-    });
-
-    it('should return null for malformed token', () => {
-      const decoded = service.decodeToken('invalid-token');
-      expect(decoded).toBeNull();
-    });
-
-    it('should decode expired token', async () => {
-      const configWithShortExpiry = {
-        ...defaultConfig,
-        accessToken: {
-          ...defaultConfig.accessToken,
-          expiresIn: '1s', // 1 second - matches real-world config format
-        },
-      };
-      const serviceWithShortExpiry = new JwtService(configWithShortExpiry);
-
-      const tokens = await serviceWithShortExpiry.generateTokenPair({
-        userId: 'user-123',
-        email: 'test@example.com',
-        sessionId: 'session-456',
-      });
-
-      // Wait for token to expire (add buffer for clock skew and parsing)
-      await new Promise((resolve) => setTimeout(resolve, 2100));
-
-      // Decode should still work (no verification)
-      const decoded = serviceWithShortExpiry.decodeToken(tokens.accessToken);
-      expect(decoded).toBeDefined();
-      expect(decoded?.sub).toBe('user-123');
-    });
-  });
-
-  describe('hashToken', () => {
-    it('should generate consistent hash for same token', () => {
-      const token = 'test-token';
-      const hash1 = service.hashToken(token);
-      const hash2 = service.hashToken(token);
-
-      expect(hash1).toBe(hash2);
-      expect(hash1.length).toBe(64); // SHA-256 hex length
-    });
-
-    it('should generate different hashes for different tokens', () => {
-      const hash1 = service.hashToken('token1');
-      const hash2 = service.hashToken('token2');
-
-      expect(hash1).not.toBe(hash2);
-    });
-
-    it('should generate hash for empty token', () => {
-      const hash = service.hashToken('');
-      expect(hash).toBeDefined();
-      expect(hash.length).toBe(64);
-    });
-  });
-
-  describe('extractTokenFromHeader', () => {
-    it('should extract token from Bearer header', () => {
-      const token = service.extractTokenFromHeader('Bearer eyJhbGc...');
-      expect(token).toBe('eyJhbGc...');
-    });
-
-    it('should return null for missing header', () => {
-      const token = service.extractTokenFromHeader(undefined);
-      expect(token).toBeNull();
-    });
-
-    it('should return null for invalid format', () => {
-      const token = service.extractTokenFromHeader('Basic abc123');
-      expect(token).toBeNull();
-    });
-
-    it('should return null for Bearer without token', () => {
-      const token = service.extractTokenFromHeader('Bearer ');
-      expect(token).toBeNull();
-    });
-
-    it('should return null for Bearer with only whitespace', () => {
-      const token = service.extractTokenFromHeader('Bearer   ');
-      expect(token).toBeNull();
-    });
-
-    it('should extract token with multiple spaces (first token after split)', () => {
-      // Note: split(' ') splits on single space, so 'Bearer   token' becomes ['Bearer', '', '', 'token']
-      // The implementation returns the second element, which would be empty string
-      // This test verifies the actual behavior (may need implementation fix)
-      const token = service.extractTokenFromHeader('Bearer   eyJhbGc...');
-      // Implementation returns first token after split, which is empty string for multiple spaces
-      expect(token).toBeNull(); // Current implementation returns empty string which becomes null
-    });
-
-    it('should return null for empty string', () => {
-      const token = service.extractTokenFromHeader('');
-      expect(token).toBeNull();
-    });
-  });
-
-  describe('generateTokenFamily', () => {
-    it('should generate unique token families', () => {
-      const family1 = service.generateTokenFamily();
-      const family2 = service.generateTokenFamily();
-
-      expect(family1).toBeDefined();
-      expect(family2).toBeDefined();
-      expect(family1).not.toBe(family2);
-      expect(family1.length).toBe(64); // 32 bytes hex (256 bits - SECURITY FIX #10)
-    });
-
-    it('should generate token families with correct format', () => {
-      const family = service.generateTokenFamily();
-      expect(family).toMatch(/^[a-f0-9]{64}$/); // Hex string, 64 characters
-    });
-
-    it('should generate many unique token families', () => {
-      const families = new Set<string>();
-      for (let i = 0; i < 100; i++) {
-        families.add(service.generateTokenFamily());
-      }
-      expect(families.size).toBe(100); // All unique
-    });
-  });
-
-  // ============================================================================
-  // Expiration Time Utilities
-  // ============================================================================
-
-  describe('getAccessTokenExpiry', () => {
-    it('should return expiry time in seconds', () => {
-      const expiry = service.getAccessTokenExpiry();
-      expect(expiry).toBe(900); // 15 minutes
-    });
-
-    it('should handle different expiry formats', () => {
-      const configWithNumberExpiry = {
-        ...defaultConfig,
-        accessToken: {
-          ...defaultConfig.accessToken,
-          expiresIn: 3600, // 1 hour in seconds
-        },
-      };
-      const serviceWithNumberExpiry = new JwtService(configWithNumberExpiry);
-      expect(serviceWithNumberExpiry.getAccessTokenExpiry()).toBe(3600);
-    });
-  });
-
-  describe('getRefreshTokenTTL', () => {
-    it('should return TTL in seconds', () => {
-      const ttl = service.getRefreshTokenTTL();
-      expect(ttl).toBe(2592000); // 30 days
-    });
-
-    it('should handle different TTL formats', () => {
-      const configWithNumberTTL = {
-        ...defaultConfig,
-        refreshToken: {
-          ...defaultConfig.refreshToken,
-          expiresIn: 604800, // 7 days in seconds
-        },
-      };
-      const serviceWithNumberTTL = new JwtService(configWithNumberTTL);
-      expect(serviceWithNumberTTL.getRefreshTokenTTL()).toBe(604800);
-    });
-  });
-
-  // ============================================================================
-  // Expiration Time Parsing
-  // ============================================================================
-
-  describe('parseExpiresIn edge cases', () => {
-    it('should parse numeric expiresIn', async () => {
-      const configWithNumber = {
-        ...defaultConfig,
-        accessToken: {
-          ...defaultConfig.accessToken,
-          expiresIn: 3600,
-        },
-      };
-      const serviceWithNumber = new JwtService(configWithNumber);
-      expect(serviceWithNumber.getAccessTokenExpiry()).toBe(3600);
-    });
-
-    it('should parse expiresIn with different units', async () => {
-      const testCases = [
-        { value: '60s', expected: 60 },
-        { value: '1m', expected: 60 },
-        { value: '1h', expected: 3600 },
-        { value: '1d', expected: 86400 },
-      ];
-
-      for (const testCase of testCases) {
-        const config = {
-          ...defaultConfig,
-          accessToken: {
-            ...defaultConfig.accessToken,
-            expiresIn: testCase.value,
-          },
-        };
-        const service = new JwtService(config);
-        expect(service.getAccessTokenExpiry()).toBe(testCase.expected);
-      }
-    });
-
-    it('should throw error for invalid expiresIn format', async () => {
-      const configWithInvalidFormat: JwtConfig = {
-        ...defaultConfig,
-        accessToken: {
-          ...defaultConfig.accessToken,
-          expiresIn: 'invalid' as any,
-        },
-      };
-
-      // parseExpiresIn is called during token generation, not construction
-      const serviceWithInvalidFormat = new JwtService(configWithInvalidFormat);
-
-      try {
-        await serviceWithInvalidFormat.generateTokenPair({
-          userId: 'user-123',
-          email: 'test@example.com',
-          sessionId: 'session-456',
-        });
-        fail('Should have thrown an error');
-      } catch (error) {
-        // May throw NAuthException or TypeError from jose library
-        expect(error).toBeDefined();
-        expect(error instanceof NAuthException || error instanceof Error).toBe(true);
-      }
-    });
-  });
-
-  // ============================================================================
-  // Error Handling
-  // ============================================================================
-
-  describe('error handling', () => {
-    it('should handle validation errors gracefully', async () => {
-      const result = await service.validateAccessToken('not.a.valid.jwt.token');
-      expect(result.valid).toBe(false);
-      expect(result.errorType).toBeDefined();
-    });
-
-    it('should handle missing keys error', async () => {
-      const configWithoutKeys: JwtConfig = {
-        ...defaultConfig,
-        accessToken: {
-          expiresIn: '15m',
-        },
-      };
-      const serviceWithoutKeys = new JwtService(configWithoutKeys);
-
-      try {
-        await serviceWithoutKeys.generateAccessToken({
-          userId: 'user-123',
-          email: 'test@example.com',
-          sessionId: 'session-456',
-          tokenFamily: 'family-123',
-        });
-        fail('Should have thrown NAuthException');
-      } catch (error) {
-        expect(error).toBeInstanceOf(NAuthException);
-      }
-    });
-  });
-});