@onlineapps/service-common 1.1.0 → 1.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlineapps/service-common",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Common utilities for both infrastructure services and business services (JWT auth, Redis/Postgres clients, business errors, runtime config)",
   "main": "src/index.js",
   "scripts": {

package/tests/unit/BusinessError.test.js

@@ -1,171 +0,0 @@
-'use strict';
-
-const {
-  BusinessError,
-  NotFoundError,
-  ValidationError,
-  ConflictError,
-  BusinessRuleError,
-  AuthorizationError,
-  ServiceUnavailableError,
-  isBusinessError,
-  businessErrorHandler,
-  notFoundHandler
-} = require('../../src/errors');
-
-describe('BusinessError hierarchy', () => {
-  test('BusinessError has correct defaults', () => {
-    const err = new BusinessError('Something went wrong');
-    expect(err).toBeInstanceOf(Error);
-    expect(err).toBeInstanceOf(BusinessError);
-    expect(err.name).toBe('BusinessError');
-    expect(err.message).toBe('Something went wrong');
-    expect(err.statusCode).toBe(500);
-    expect(err.errorCode).toBe('INTERNAL_ERROR');
-    expect(err.type).toBe('BUSINESS');
-    expect(err.details).toEqual([]);
-  });
-
-  test('NotFoundError sets 404', () => {
-    const err = new NotFoundError('Document not found', {
-      details: ['UUID abc123 does not exist'],
-      operation: 'getDocument'
-    });
-    expect(err).toBeInstanceOf(BusinessError);
-    expect(err.statusCode).toBe(404);
-    expect(err.errorCode).toBe('RESOURCE_NOT_FOUND');
-    expect(err.type).toBe('BUSINESS');
-    expect(err.details).toEqual(['UUID abc123 does not exist']);
-    expect(err.operation).toBe('getDocument');
-  });
-
-  test('ValidationError sets 400', () => {
-    const err = new ValidationError('Invalid input', { details: ['field X is required'] });
-    expect(err.statusCode).toBe(400);
-    expect(err.errorCode).toBe('VALIDATION_FAILED');
-    expect(err.type).toBe('VALIDATION');
-  });
-
-  test('ConflictError sets 409', () => {
-    const err = new ConflictError('Duplicate');
-    expect(err.statusCode).toBe(409);
-    expect(err.errorCode).toBe('DUPLICATE_RESOURCE');
-  });
-
-  test('BusinessRuleError sets 422', () => {
-    const err = new BusinessRuleError('Cannot invoice draft');
-    expect(err.statusCode).toBe(422);
-    expect(err.errorCode).toBe('BUSINESS_RULE_VIOLATED');
-    expect(err.type).toBe('VALIDATION');
-  });
-
-  test('AuthorizationError sets 403', () => {
-    const err = new AuthorizationError('No access');
-    expect(err.statusCode).toBe(403);
-    expect(err.errorCode).toBe('FORBIDDEN');
-  });
-
-  test('ServiceUnavailableError sets 503', () => {
-    const err = new ServiceUnavailableError('DB down');
-    expect(err.statusCode).toBe(503);
-    expect(err.errorCode).toBe('SERVICE_UNAVAILABLE');
-    expect(err.type).toBe('TRANSIENT');
-  });
-
-  test('isBusinessError returns true for BusinessError subtypes', () => {
-    expect(isBusinessError(new NotFoundError('x'))).toBe(true);
-    expect(isBusinessError(new Error('x'))).toBe(false);
-    expect(isBusinessError(null)).toBe(false);
-  });
-
-  test('toJSON returns structured error', () => {
-    const err = new NotFoundError('Not found', {
-      details: ['detail1'],
-      operation: 'findDoc',
-      service: 'invoicing'
-    });
-    const json = err.toJSON();
-    expect(json).toEqual({
-      code: 'RESOURCE_NOT_FOUND',
-      message: 'Not found',
-      statusCode: 404,
-      details: ['detail1'],
-      service: 'invoicing',
-      operation: 'findDoc'
-    });
-  });
-
-  test('custom errorCode can be overridden', () => {
-    const err = new NotFoundError('Tenant missing', { errorCode: 'TENANT_NOT_FOUND' });
-    expect(err.errorCode).toBe('TENANT_NOT_FOUND');
-  });
-});
-
-describe('businessErrorHandler middleware', () => {
-  let req, res, next;
-
-  beforeEach(() => {
-    req = { method: 'GET', originalUrl: '/api/test', app: { locals: { logger: { warn: jest.fn(), error: jest.fn() } } } };
-    res = { status: jest.fn().mockReturnThis(), json: jest.fn().mockReturnThis(), headersSent: false };
-    next = jest.fn();
-  });
-
-  test('formats BusinessError as structured JSON', () => {
-    const err = new NotFoundError('Doc not found', { details: ['UUID 123'] });
-    businessErrorHandler(err, req, res, next);
-
-    expect(res.status).toHaveBeenCalledWith(404);
-    expect(res.json).toHaveBeenCalledWith({
-      error: {
-        code: 'RESOURCE_NOT_FOUND',
-        message: 'Doc not found',
-        statusCode: 404,
-        details: ['UUID 123'],
-        service: undefined,
-        operation: undefined
-      }
-    });
-  });
-
-  test('wraps generic Error as INTERNAL_ERROR 500', () => {
-    const err = new Error('kaboom');
-    businessErrorHandler(err, req, res, next);
-
-    expect(res.status).toHaveBeenCalledWith(500);
-    const body = res.json.mock.calls[0][0];
-    expect(body.error.code).toBe('INTERNAL_ERROR');
-    expect(body.error.statusCode).toBe(500);
-  });
-
-  test('does not leak stack in production', () => {
-    const origEnv = process.env.NODE_ENV;
-    process.env.NODE_ENV = 'production';
-
-    const err = new Error('secret details');
-    businessErrorHandler(err, req, res, next);
-
-    const body = res.json.mock.calls[0][0];
-    expect(body.error.message).toBe('Internal server error');
-
-    process.env.NODE_ENV = origEnv;
-  });
-
-  test('calls next() if headers already sent', () => {
-    res.headersSent = true;
-    const err = new Error('late');
-    businessErrorHandler(err, req, res, next);
-    expect(next).toHaveBeenCalledWith(err);
-    expect(res.status).not.toHaveBeenCalled();
-  });
-});
-
-describe('notFoundHandler middleware', () => {
-  test('returns ROUTE_NOT_FOUND 404', () => {
-    const req = { method: 'GET', originalUrl: '/unknown', app: { locals: { logger: { warn: jest.fn() } } } };
-    const res = { status: jest.fn().mockReturnThis(), json: jest.fn().mockReturnThis() };
-    notFoundHandler(req, res);
-
-    expect(res.status).toHaveBeenCalledWith(404);
-    expect(res.json.mock.calls[0][0].error.code).toBe('ROUTE_NOT_FOUND');
-  });
-});

package/tests/unit/defaults.test.js

@@ -1,48 +0,0 @@
-'use strict';
-
-const defaults = require('../../src/defaults');
-const { getCriticalConfigWithFallbacks, getInfrastructureHealthConfig } = require('../../src/runtime-config');
-const { buildRedisUrl } = require('../../src/redisClient');
-
-describe('@onlineapps/service-common defaults @unit', () => {
-  test('should export stable module-owned defaults', () => {
-    expect(defaults.infrastructureHealthQueueName).toBe('infrastructure.health.checks');
-    expect(defaults.infrastructureHealthPublishIntervalMs).toBe(5000);
-    expect(defaults.infrastructureHealthWaitMaxTimeMs).toBe(60000);
-    expect(defaults.infrastructureHealthWaitCheckIntervalMs).toBe(2000);
-    expect(defaults.infrastructureHealthTimeoutMs).toBe(15000);
-    expect(defaults.infrastructureHealthRedisTtlSeconds).toBe(30);
-    expect(defaults.infrastructureHealthCleanupIntervalMs).toBe(10000);
-    expect(defaults.infrastructureHealthQueueWaitMaxTimeMs).toBe(60000);
-    expect(defaults.infrastructureHealthQueueWaitCheckIntervalMs).toBe(2000);
-  });
-
-  test('getCriticalConfigWithFallbacks should fail-fast when env is missing (no topology defaults)', () => {
-    const oldRedis = process.env.REDIS_URL;
-    const oldRabbit = process.env.RABBITMQ_URL;
-    delete process.env.REDIS_URL;
-    delete process.env.RABBITMQ_URL;
-
-    expect(() => getCriticalConfigWithFallbacks()).toThrow(/Missing required config/i);
-
-    if (oldRedis !== undefined) process.env.REDIS_URL = oldRedis;
-    if (oldRabbit !== undefined) process.env.RABBITMQ_URL = oldRabbit;
-  });
-
-  test('getInfrastructureHealthConfig should default queue name from module defaults', () => {
-    const old = process.env.INFRASTRUCTURE_HEALTH_QUEUE;
-    delete process.env.INFRASTRUCTURE_HEALTH_QUEUE;
-
-    const cfg = getInfrastructureHealthConfig();
-    expect(cfg.queueName).toBe(defaults.infrastructureHealthQueueName);
-
-    if (old !== undefined) process.env.INFRASTRUCTURE_HEALTH_QUEUE = old;
-  });
-
-  test('buildRedisUrl should fall back to module defaults host/port', () => {
-    expect(() => buildRedisUrl({ env: {}, defaults: {} })).toThrow(/Missing required config/i);
-  });
-});
-
-
-

package/tests/unit/jwt/createJwtValidator.test.js

@@ -1,170 +0,0 @@
-'use strict';
-
-const jwt = require('jsonwebtoken');
-
-const TEST_SECRET = 'test-jwt-secret-at-least-16-chars';
-
-function createValidAccessToken(overrides = {}) {
-  const payload = {
-    sub: 'u_person-uuid',
-    person_id: 42,
-    email: 'test@example.com',
-    tenants: [{ tenant_uuid: 'a_t1', tenant_id: 1, role: 'OWNER' }],
-    type: 'access',
-    ...overrides
-  };
-  return jwt.sign(payload, TEST_SECRET, { issuer: 'oa-auth', expiresIn: '15m' });
-}
-
-function mockRes() {
-  const res = {
-    statusCode: null,
-    body: null,
-    status(code) { res.statusCode = code; return res; },
-    json(data) { res.body = data; return res; }
-  };
-  return res;
-}
-
-describe('createJwtValidator @unit', () => {
-  const originalEnv = process.env.JWT_SECRET;
-
-  beforeEach(() => {
-    process.env.JWT_SECRET = TEST_SECRET;
-    jest.resetModules();
-  });
-
-  afterEach(() => {
-    if (originalEnv !== undefined) {
-      process.env.JWT_SECRET = originalEnv;
-    } else {
-      delete process.env.JWT_SECRET;
-    }
-  });
-
-  function loadModule() {
-    return require('../../../src/jwt/createJwtValidator');
-  }
-
-  const logger = { info: jest.fn(), warn: jest.fn(), error: jest.fn(), debug: jest.fn() };
-
-  it('throws if logger is missing', () => {
-    const { createJwtValidator } = loadModule();
-    expect(() => createJwtValidator({ logger: null })).toThrow('Logger is required');
-  });
-
-  it('returns 401 when Authorization header is missing', () => {
-    const { createJwtValidator } = loadModule();
-    const middleware = createJwtValidator({ logger });
-    const req = { path: '/test', headers: {} };
-    const res = mockRes();
-    const next = jest.fn();
-
-    middleware(req, res, next);
-
-    expect(res.statusCode).toBe(401);
-    expect(res.body.error).toContain('Missing or invalid Authorization header');
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('returns 401 when Authorization header has no Bearer prefix', () => {
-    const { createJwtValidator } = loadModule();
-    const middleware = createJwtValidator({ logger });
-    const req = { path: '/test', headers: { authorization: 'Basic abc123' } };
-    const res = mockRes();
-    const next = jest.fn();
-
-    middleware(req, res, next);
-
-    expect(res.statusCode).toBe(401);
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('sets req.auth and calls next() for valid token', () => {
-    const { createJwtValidator } = loadModule();
-    const middleware = createJwtValidator({ logger });
-    const token = createValidAccessToken();
-    const req = { path: '/test', headers: { authorization: `Bearer ${token}` } };
-    const res = mockRes();
-    const next = jest.fn();
-
-    middleware(req, res, next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(req.auth).toBeDefined();
-    expect(req.auth.person_uuid).toBe('u_person-uuid');
-    expect(req.auth.person_id).toBe(42);
-    expect(req.auth.email).toBe('test@example.com');
-    expect(req.auth.tenants).toHaveLength(1);
-  });
-
-  it('returns 401 with refresh instruction for expired token', () => {
-    const { createJwtValidator } = loadModule();
-    const middleware = createJwtValidator({ logger });
-    const token = jwt.sign(
-      { sub: 'u_test', person_id: 1, type: 'access' },
-      TEST_SECRET,
-      { issuer: 'oa-auth', expiresIn: '0s' }
-    );
-    const req = { path: '/test', headers: { authorization: `Bearer ${token}` } };
-    const res = mockRes();
-    const next = jest.fn();
-
-    middleware(req, res, next);
-
-    expect(res.statusCode).toBe(401);
-    expect(res.body.error).toContain('expired');
-    expect(res.body.error).toContain('refresh');
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('returns 401 for refresh token (wrong type)', () => {
-    const { createJwtValidator } = loadModule();
-    const middleware = createJwtValidator({ logger });
-    const token = jwt.sign(
-      { sub: 'u_test', person_id: 1, type: 'refresh' },
-      TEST_SECRET,
-      { issuer: 'oa-auth', expiresIn: '7d' }
-    );
-    const req = { path: '/test', headers: { authorization: `Bearer ${token}` } };
-    const res = mockRes();
-    const next = jest.fn();
-
-    middleware(req, res, next);
-
-    expect(res.statusCode).toBe(401);
-    expect(res.body.error).toContain('Invalid token type');
-    expect(next).not.toHaveBeenCalled();
-  });
-
-  it('skips validation for excluded paths', () => {
-    const { createJwtValidator } = loadModule();
-    const middleware = createJwtValidator({ logger, excludePaths: ['/health', '/public'] });
-    const req = { path: '/health', headers: {} };
-    const res = mockRes();
-    const next = jest.fn();
-
-    middleware(req, res, next);
-
-    expect(next).toHaveBeenCalledTimes(1);
-    expect(res.statusCode).toBeNull();
-  });
-
-  it('logs warning on invalid token', () => {
-    const { createJwtValidator } = loadModule();
-    const warnFn = jest.fn();
-    const testLogger = { ...logger, warn: warnFn };
-    const middleware = createJwtValidator({ logger: testLogger });
-    const req = { path: '/test', headers: { authorization: 'Bearer invalid.token.here' } };
-    const res = mockRes();
-    const next = jest.fn();
-
-    middleware(req, res, next);
-
-    expect(warnFn).toHaveBeenCalledWith(
-      '[JWT] Token verification failed',
-      expect.objectContaining({ error: expect.any(String) })
-    );
-    expect(res.statusCode).toBe(401);
-  });
-});

package/tests/unit/jwt/extractTenantContext.test.js

@@ -1,148 +0,0 @@
-'use strict';
-
-describe('extractTenantContext @unit', () => {
-  function loadModule() {
-    return require('../../../src/jwt/extractTenantContext');
-  }
-
-  const singleTenantAuth = {
-    person_uuid: 'u_person1',
-    person_id: 42,
-    email: 'test@example.com',
-    tenants: [
-      { tenant_uuid: 'a_tenant1', tenant_id: 10, role: 'OWNER' }
-    ]
-  };
-
-  const multiTenantAuth = {
-    person_uuid: 'u_person1',
-    person_id: 42,
-    email: 'test@example.com',
-    tenants: [
-      { tenant_uuid: 'a_tenant1', tenant_id: 10, role: 'OWNER' },
-      { tenant_uuid: 'a_tenant2', tenant_id: 20, role: 'EDITOR' }
-    ]
-  };
-
-  it('throws 400 for single tenant without workspace header (requireWorkspace: true)', () => {
-    const { extractTenantContext } = loadModule();
-    expect(() => extractTenantContext(singleTenantAuth, {})).toThrow('Missing x-workspace-id');
-  });
-
-  it('auto-picks single tenant without workspace when requireWorkspace: false', () => {
-    const { extractTenantContext } = loadModule();
-    const ctx = extractTenantContext(singleTenantAuth, {}, { requireWorkspace: false });
-
-    expect(ctx).toEqual({
-      tenant_id: 10,
-      tenant_uuid: 'a_tenant1',
-      workspace_id: null,
-      person_id: 42,
-      person_uuid: 'u_person1',
-      role: 'OWNER'
-    });
-  });
-
-  it('uses workspace from header when provided', () => {
-    const { extractTenantContext } = loadModule();
-    const ctx = extractTenantContext(singleTenantAuth, { 'x-workspace-id': '5' });
-
-    expect(ctx.workspace_id).toBe(5);
-  });
-
-  it('picks correct tenant when x-tenant-uuid is provided', () => {
-    const { extractTenantContext } = loadModule();
-    const ctx = extractTenantContext(multiTenantAuth, { 'x-tenant-uuid': 'a_tenant2', 'x-workspace-id': '1' });
-
-    expect(ctx.tenant_id).toBe(20);
-    expect(ctx.tenant_uuid).toBe('a_tenant2');
-    expect(ctx.role).toBe('EDITOR');
-    expect(ctx.workspace_id).toBe(1);
-  });
-
-  it('picks correct tenant with custom workspace', () => {
-    const { extractTenantContext } = loadModule();
-    const ctx = extractTenantContext(multiTenantAuth, {
-      'x-tenant-uuid': 'a_tenant1',
-      'x-workspace-id': '3'
-    });
-
-    expect(ctx.tenant_id).toBe(10);
-    expect(ctx.workspace_id).toBe(3);
-  });
-
-  it('throws 400 when multiple tenants and no x-tenant-uuid (requireWorkspace: false)', () => {
-    const { extractTenantContext } = loadModule();
-
-    expect(() => extractTenantContext(multiTenantAuth, {}, { requireWorkspace: false })).toThrow('Missing tenant context');
-    try {
-      extractTenantContext(multiTenantAuth, {}, { requireWorkspace: false });
-    } catch (err) {
-      expect(err.statusCode).toBe(400);
-    }
-  });
-
-  it('throws 403 when x-tenant-uuid does not match any membership', () => {
-    const { extractTenantContext } = loadModule();
-
-    expect(() => extractTenantContext(singleTenantAuth, { 'x-tenant-uuid': 'a_nonexistent', 'x-workspace-id': '1' }))
-      .toThrow('No membership for specified tenant');
-    try {
-      extractTenantContext(singleTenantAuth, { 'x-tenant-uuid': 'a_nonexistent', 'x-workspace-id': '1' });
-    } catch (err) {
-      expect(err.statusCode).toBe(403);
-    }
-  });
-
-  it('parses workspace header as integer', () => {
-    const { extractTenantContext } = loadModule();
-    const ctx = extractTenantContext(singleTenantAuth, { 'x-workspace-id': '42' });
-
-    expect(ctx.workspace_id).toBe(42);
-    expect(typeof ctx.workspace_id).toBe('number');
-  });
-
-  it('throws 401 when auth is null', () => {
-    const { extractTenantContext } = loadModule();
-
-    expect(() => extractTenantContext(null, {})).toThrow('Missing auth data');
-    try {
-      extractTenantContext(null, {});
-    } catch (err) {
-      expect(err.statusCode).toBe(401);
-    }
-  });
-
-  it('throws 401 when auth.tenants is not an array', () => {
-    const { extractTenantContext } = loadModule();
-
-    expect(() => extractTenantContext({ person_id: 1 }, {})).toThrow('Missing auth data');
-  });
-
-  it('single tenant with only x-workspace-id header (no x-tenant-uuid)', () => {
-    const { extractTenantContext } = loadModule();
-    const ctx = extractTenantContext(singleTenantAuth, { 'x-workspace-id': '7' });
-
-    expect(ctx.tenant_id).toBe(10);
-    expect(ctx.workspace_id).toBe(7);
-  });
-
-  it('multiple tenants with only x-workspace-id header throws 400', () => {
-    const { extractTenantContext } = loadModule();
-
-    expect(() => extractTenantContext(multiTenantAuth, { 'x-workspace-id': '2' }))
-      .toThrow('Missing tenant context');
-  });
-
-  it('workspace_id null when requireWorkspace false and no header', () => {
-    const { extractTenantContext } = loadModule();
-    const ctx = extractTenantContext(singleTenantAuth, {}, { requireWorkspace: false });
-    expect(ctx.workspace_id).toBeNull();
-  });
-
-  it('workspace_id from header even when requireWorkspace false', () => {
-    const { extractTenantContext } = loadModule();
-    const ctx = extractTenantContext(singleTenantAuth, { 'x-workspace-id': '9' }, { requireWorkspace: false });
-    expect(ctx.workspace_id).toBe(9);
-  });
-});

package/tests/unit/jwt/verifyAccessToken.test.js

@@ -1,137 +0,0 @@
-'use strict';
-
-const jwt = require('jsonwebtoken');
-
-const TEST_SECRET = 'test-jwt-secret-at-least-16-chars';
-const WRONG_SECRET = 'wrong-secret-also-16-chars-long';
-
-function createValidAccessToken(overrides = {}) {
-  const payload = {
-    sub: 'u_test-person-uuid',
-    person_id: 42,
-    email: 'test@example.com',
-    tenants: [{ tenant_uuid: 'a_tenant1', tenant_id: 1, role: 'OWNER' }],
-    type: 'access',
-    ...overrides
-  };
-  return jwt.sign(payload, TEST_SECRET, { issuer: 'oa-auth', expiresIn: '15m' });
-}
-
-describe('verifyAccessToken @unit', () => {
-  const originalEnv = process.env.JWT_SECRET;
-
-  beforeEach(() => {
-    process.env.JWT_SECRET = TEST_SECRET;
-    jest.resetModules();
-  });
-
-  afterEach(() => {
-    if (originalEnv !== undefined) {
-      process.env.JWT_SECRET = originalEnv;
-    } else {
-      delete process.env.JWT_SECRET;
-    }
-  });
-
-  function loadModule() {
-    return require('../../../src/jwt/verifyAccessToken');
-  }
-
-  it('returns decoded payload for valid access token', () => {
-    const { verifyAccessToken } = loadModule();
-    const token = createValidAccessToken();
-    const decoded = verifyAccessToken(token);
-
-    expect(decoded.sub).toBe('u_test-person-uuid');
-    expect(decoded.person_id).toBe(42);
-    expect(decoded.email).toBe('test@example.com');
-    expect(decoded.tenants).toHaveLength(1);
-    expect(decoded.type).toBe('access');
-    expect(decoded.iss).toBe('oa-auth');
-  });
-
-  it('throws on expired token', () => {
-    const { verifyAccessToken } = loadModule();
-    const token = jwt.sign(
-      { sub: 'u_test', person_id: 1, type: 'access' },
-      TEST_SECRET,
-      { issuer: 'oa-auth', expiresIn: '0s' }
-    );
-
-    expect(() => verifyAccessToken(token)).toThrow();
-    try {
-      verifyAccessToken(token);
-    } catch (err) {
-      expect(err.name).toBe('TokenExpiredError');
-    }
-  });
-
-  it('throws on invalid signature (wrong secret)', () => {
-    const { verifyAccessToken } = loadModule();
-    const token = jwt.sign(
-      { sub: 'u_test', person_id: 1, type: 'access' },
-      WRONG_SECRET,
-      { issuer: 'oa-auth' }
-    );
-
-    expect(() => verifyAccessToken(token)).toThrow('invalid signature');
-  });
-
-  it('throws when JWT_SECRET is missing', () => {
-    delete process.env.JWT_SECRET;
-    const { verifyAccessToken } = loadModule();
-    const token = createValidAccessToken();
-
-    expect(() => verifyAccessToken(token)).toThrow('JWT_SECRET');
-  });
-
-  it('throws when JWT_SECRET is too short', () => {
-    process.env.JWT_SECRET = 'short';
-    const { verifyAccessToken } = loadModule();
-    const token = createValidAccessToken();
-
-    expect(() => verifyAccessToken(token)).toThrow('at least 16 characters');
-  });
-
-  it('throws on refresh token (type != access)', () => {
-    const { verifyAccessToken } = loadModule();
-    const token = jwt.sign(
-      { sub: 'u_test', person_id: 1, type: 'refresh' },
-      TEST_SECRET,
-      { issuer: 'oa-auth', expiresIn: '7d' }
-    );
-
-    expect(() => verifyAccessToken(token)).toThrow('Invalid token type');
-    try {
-      verifyAccessToken(token);
-    } catch (err) {
-      expect(err.code).toBe('INVALID_TOKEN_TYPE');
-    }
-  });
-
-  it('throws on wrong issuer', () => {
-    const { verifyAccessToken } = loadModule();
-    const token = jwt.sign(
-      { sub: 'u_test', person_id: 1, type: 'access' },
-      TEST_SECRET,
-      { issuer: 'wrong-issuer' }
-    );
-
-    expect(() => verifyAccessToken(token)).toThrow();
-  });
-
-  it('throws on empty token', () => {
-    const { verifyAccessToken } = loadModule();
-
-    expect(() => verifyAccessToken('')).toThrow('Token is required');
-    expect(() => verifyAccessToken(null)).toThrow('Token is required');
-    expect(() => verifyAccessToken(undefined)).toThrow('Token is required');
-  });
-
-  it('throws on non-string token', () => {
-    const { verifyAccessToken } = loadModule();
-
-    expect(() => verifyAccessToken(12345)).toThrow('Token is required');
-    expect(() => verifyAccessToken({})).toThrow('Token is required');
-  });
-});

package/tests/unit/monitoringFallbackEmail.test.js

@@ -1,57 +0,0 @@
-'use strict';
-
-jest.mock('nodemailer', () => {
-  return {
-    createTransport: jest.fn(() => ({
-      sendMail: jest.fn().mockResolvedValue(true)
-    }))
-  };
-});
-
-describe('monitoringFallbackEmail', () => {
-  const ORIGINAL_ENV = process.env;
-
-  beforeEach(() => {
-    jest.resetModules();
-    process.env = { ...ORIGINAL_ENV };
-  });
-
-  afterEach(() => {
-    process.env = ORIGINAL_ENV;
-  });
-
-  function loadReporter() {
-    return require('../../src/reporting/monitoringFallbackEmail');
-  }
-
-  test('returns false when SMTP config missing', async () => {
-    delete process.env.INFRA_REPORT_SMTP_HOST;
-    const { sendMonitoringFailFallbackEmail } = loadReporter();
-    const result = await sendMonitoringFailFallbackEmail('t', 't', '<p>t</p>');
-    expect(result).toBe(false);
-  });
-
-  test('sends email when SMTP config provided', async () => {
-    process.env.INFRA_REPORT_SMTP_HOST = 'smtp.example.com';
-    process.env.INFRA_REPORT_SMTP_PORT = '587';
-    process.env.INFRA_REPORT_SMTP_SECURE = 'false';
-    process.env.INFRA_REPORT_SMTP_USER = 'user@example.com';
-    process.env.INFRA_REPORT_SMTP_PASS = 'secret';
-    process.env.INFRA_REPORT_FROM = 'infra@example.com';
-    process.env.INFRA_REPORT_TO = 'ops@example.com';
-
-    const nodemailer = require('nodemailer');
-    const transportMock = {
-      sendMail: jest.fn().mockResolvedValue(true)
-    };
-    nodemailer.createTransport.mockReturnValue(transportMock);
-
-    const { sendMonitoringFailFallbackEmail } = loadReporter();
-    const result = await sendMonitoringFailFallbackEmail('Subject', 'Body', '<p>Body</p>');
-
-    expect(result).toBe(true);
-    expect(transportMock.sendMail).toHaveBeenCalledTimes(1);
-  });
-});
-
-