@rebasepro/server-core 0.2.3 → 0.2.4

package/test/admin-routes.test.ts

@@ -43,8 +43,7 @@ function mockRole(id: string, isAdmin = false) {
 name: id.charAt(0).toUpperCase() + id.slice(1),
 isAdmin,
 defaultPermissions: null,
-collectionPermissions: null,
-config: null };
+collectionPermissions: null };
 }
 
 
@@ -56,7 +55,7 @@ function createApp(opts: { defaultRole?: string } = {}) {
         getUserByIdentity: jest.fn().mockResolvedValue(null),
         linkUserIdentity: jest.fn().mockResolvedValue(undefined),
         getUserIdentities: jest.fn().mockResolvedValue([]),
-        getUserById: jest.fn().mockResolvedValue(null),
+        getUserById: jest.fn().mockImplementation((id) => Promise.resolve(mockUser({ id }))),
         createUser: jest.fn().mockImplementation((data) =>
             Promise.resolve(mockUser({ email: data.email,
 displayName: data.displayName,
@@ -98,14 +97,12 @@ roles: [mockRole("editor")] };
 name: r.name,
 isAdmin: r.isAdmin || false,
 defaultPermissions: null,
-collectionPermissions: null,
-config: null })),
+collectionPermissions: null })),
         updateRole: jest.fn().mockImplementation((id, r) => Promise.resolve({ id,
 name: r.name,
 isAdmin: r.isAdmin || false,
 defaultPermissions: null,
-collectionPermissions: null,
-config: null })),
+collectionPermissions: null })),
         deleteRole: jest.fn().mockResolvedValue(undefined)
     } as unknown as jest.Mocked<AuthRepository>;
 
@@ -407,6 +404,8 @@ displayName: "Updated" }),
             it("updates roles when specified", async () => {
                 const app = createApp();
                 mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u1" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 2 });
                 mockAuthRepo.getUserWithRoles.mockResolvedValueOnce({
                     user: mockUser({ id: "u1" }),
                     roles: [mockRole("admin")]
@@ -421,6 +420,44 @@ displayName: "Updated" }),
                 expect(mockAuthRepo.setUserRoles).toHaveBeenCalledWith("u1", ["admin"]);
             });
 
+            it("prevents demoting the last admin", async () => {
+                const app = createApp();
+                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u1" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 1 });
+
+                const res = await app.request("/admin/users/u1", {
+                    method: "PUT",
+                    headers: { "Content-Type": "application/json",
+...adminAuth() },
+                    body: JSON.stringify({ roles: ["editor"] })
+                });
+                expect(res.status).toBe(403);
+                const body = await res.json() as any;
+                expect(body.error.code).toBe("LAST_ADMIN");
+                expect(mockAuthRepo.setUserRoles).not.toHaveBeenCalled();
+            });
+
+            it("allows demoting an admin if there are other admins", async () => {
+                const app = createApp();
+                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u1" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 2 });
+                mockAuthRepo.getUserWithRoles.mockResolvedValueOnce({
+                    user: mockUser({ id: "u1" }),
+                    roles: [mockRole("editor")]
+                });
+
+                const res = await app.request("/admin/users/u1", {
+                    method: "PUT",
+                    headers: { "Content-Type": "application/json",
+...adminAuth() },
+                    body: JSON.stringify({ roles: ["editor"] })
+                });
+                expect(res.status).toBe(200);
+                expect(mockAuthRepo.setUserRoles).toHaveBeenCalledWith("u1", ["editor"]);
+            });
+
             it("returns 404 for non-existent user", async () => {
                 const app = createApp();
                 mockAuthRepo.getUserById.mockResolvedValueOnce(null);
@@ -460,6 +497,36 @@ displayName: "Updated" }),
                 expect(body.error.code).toBe("SELF_DELETE");
             });
 
+            it("prevents last-admin deletion", async () => {
+                const app = createApp();
+                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u2" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 1 });
+
+                const res = await app.request("/admin/users/u2", {
+                    method: "DELETE",
+                    headers: { ...adminAuth("admin-1") }
+                });
+                expect(res.status).toBe(403);
+                const body = await res.json() as any;
+                expect(body.error.code).toBe("LAST_ADMIN");
+                expect(mockAuthRepo.deleteUser).not.toHaveBeenCalled();
+            });
+
+            it("allows deleting an admin if there are other admins", async () => {
+                const app = createApp();
+                mockAuthRepo.getUserById.mockResolvedValueOnce(mockUser({ id: "u2" }));
+                mockAuthRepo.getUserRoleIds.mockResolvedValueOnce(["admin"]);
+                mockAuthRepo.listUsersPaginated.mockResolvedValueOnce({ total: 2 });
+
+                const res = await app.request("/admin/users/u2", {
+                    method: "DELETE",
+                    headers: { ...adminAuth("admin-1") }
+                });
+                expect(res.status).toBe(200);
+                expect(mockAuthRepo.deleteUser).toHaveBeenCalledWith("u2");
+            });
+
             it("returns 404 for non-existent user", async () => {
                 const app = createApp();
                 mockAuthRepo.getUserById.mockResolvedValueOnce(null);

package/test/api-generator.test.ts

@@ -168,7 +168,6 @@ values: {} } as any;
             );
         });
     });
-
     describe("Subcollection Routes", () => {
         /**
          * These tests use the flat app (no prefix nesting) to avoid

package/test/api-key-permission-guard.test.ts

@@ -0,0 +1,132 @@
+import {
+    httpMethodToOperation,
+    isOperationAllowed,
+    ApiKeyOperation
+} from "../src/auth/api-keys/api-key-permission-guard";
+import type { ApiKeyPermission } from "../src/auth/api-keys/api-key-types";
+
+describe("httpMethodToOperation", () => {
+    it("maps GET to read", () => {
+        expect(httpMethodToOperation("GET")).toBe("read");
+    });
+
+    it("maps HEAD to read", () => {
+        expect(httpMethodToOperation("HEAD")).toBe("read");
+    });
+
+    it("maps OPTIONS to read", () => {
+        expect(httpMethodToOperation("OPTIONS")).toBe("read");
+    });
+
+    it("maps POST to write", () => {
+        expect(httpMethodToOperation("POST")).toBe("write");
+    });
+
+    it("maps PUT to write", () => {
+        expect(httpMethodToOperation("PUT")).toBe("write");
+    });
+
+    it("maps PATCH to write", () => {
+        expect(httpMethodToOperation("PATCH")).toBe("write");
+    });
+
+    it("maps DELETE to delete", () => {
+        expect(httpMethodToOperation("DELETE")).toBe("delete");
+    });
+
+    it("is case-insensitive", () => {
+        expect(httpMethodToOperation("get")).toBe("read");
+        expect(httpMethodToOperation("post")).toBe("write");
+        expect(httpMethodToOperation("delete")).toBe("delete");
+        expect(httpMethodToOperation("Patch")).toBe("write");
+    });
+
+    it("defaults unknown methods to read", () => {
+        expect(httpMethodToOperation("CONNECT")).toBe("read");
+        expect(httpMethodToOperation("TRACE")).toBe("read");
+        expect(httpMethodToOperation("UNKNOWN")).toBe("read");
+    });
+});
+
+describe("isOperationAllowed", () => {
+    it("allows operation with exact collection match", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read", "write"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(true);
+    });
+
+    it("denies operation not in the operations list", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(false);
+        expect(isOperationAllowed(permissions, "users", "delete")).toBe(false);
+    });
+
+    it("denies operation for non-matching collection", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read", "write", "delete"] }
+        ];
+        expect(isOperationAllowed(permissions, "posts", "read")).toBe(false);
+    });
+
+    it("allows wildcard collection '*' to match any collection", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "*", operations: ["read"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "posts", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "anything", "read")).toBe(true);
+    });
+
+    it("wildcard collection still checks operations", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "*", operations: ["read"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(false);
+        expect(isOperationAllowed(permissions, "users", "delete")).toBe(false);
+    });
+
+    it("returns false for empty permissions array", () => {
+        expect(isOperationAllowed([], "users", "read")).toBe(false);
+    });
+
+    it("checks all permission entries and grants if any match", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read"] },
+            { collection: "posts", operations: ["write"] },
+            { collection: "comments", operations: ["read", "write", "delete"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "posts", "write")).toBe(true);
+        expect(isOperationAllowed(permissions, "comments", "delete")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(false);
+        expect(isOperationAllowed(permissions, "posts", "read")).toBe(false);
+    });
+
+    it("handles overlapping permissions correctly", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "users", operations: ["read"] },
+            { collection: "users", operations: ["write"] }
+        ];
+        expect(isOperationAllowed(permissions, "users", "read")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "delete")).toBe(false);
+    });
+
+    it("handles mixed wildcard and specific permissions", () => {
+        const permissions: ApiKeyPermission[] = [
+            { collection: "*", operations: ["read"] },
+            { collection: "users", operations: ["write", "delete"] }
+        ];
+        // Wildcard read for everything
+        expect(isOperationAllowed(permissions, "posts", "read")).toBe(true);
+        // Specific write/delete for users
+        expect(isOperationAllowed(permissions, "users", "write")).toBe(true);
+        expect(isOperationAllowed(permissions, "users", "delete")).toBe(true);
+        // No write for non-users
+        expect(isOperationAllowed(permissions, "posts", "write")).toBe(false);
+    });
+});

package/test/ast-schema-editor.test.ts

@@ -60,4 +60,30 @@ description: "Product name" },
         expect(newContent).toContain("target: () => categoriesCollection");
         expect(newContent).toContain('description: "Product name"');
     });
+
+    it("should safely escape string values containing quotes and prevent code injection", async () => {
+        // Setup initial file
+        const fileContent = `import { EntityCollection } from "@rebasepro/types";
+const productsCollection: EntityCollection = {
+    name: "Products",
+    slug: "products",
+    properties: {}
+};
+export default productsCollection;
+`;
+        fs.writeFileSync(path.join(testDir, "products.ts"), fileContent);
+
+        // Payload attempting breakout
+        const maliciousData = {
+            name: 'Products", description: "Injected description", breakout: "true',
+            slug: "products",
+            properties: {}
+        };
+
+        await editor.saveCollection("products", maliciousData);
+
+        const newContent = fs.readFileSync(path.join(testDir, "products.ts"), "utf-8");
+        // Verify that the quote was safely escaped and did not break out to create a new property
+        expect(newContent).toContain('name: "Products\\", description: \\"Injected description\\", breakout: \\"true"');
+    });
 });

package/test/auth-routes.test.ts

@@ -54,8 +54,7 @@ function mockRole(id: string, isAdmin = false) {
 name: id.charAt(0).toUpperCase() + id.slice(1),
 isAdmin,
 defaultPermissions: null,
-collectionPermissions: null,
-config: null };
+collectionPermissions: null };
 }
 
 let mockAuthRepo: jest.Mocked<AuthRepository>;

package/test/backend-hooks-admin.test.ts

@@ -49,8 +49,7 @@ function mockRole(id: string, isAdmin = false) {
         name: id.charAt(0).toUpperCase() + id.slice(1),
         isAdmin,
         defaultPermissions: null,
-        collectionPermissions: null,
-        config: null
+        collectionPermissions: null
     };
 }
 
@@ -98,11 +97,11 @@ function createApp(hooks?: BackendHooks) {
         getRoleById: jest.fn().mockResolvedValue(null),
         createRole: jest.fn().mockImplementation(r => Promise.resolve({
             id: r.id, name: r.name, isAdmin: r.isAdmin || false,
-            defaultPermissions: null, collectionPermissions: null, config: null
+            defaultPermissions: null, collectionPermissions: null
         })),
         updateRole: jest.fn().mockImplementation((id, r) => Promise.resolve({
             id, name: r.name, isAdmin: r.isAdmin || false,
-            defaultPermissions: null, collectionPermissions: null, config: null
+            defaultPermissions: null, collectionPermissions: null
         })),
         deleteRole: jest.fn().mockResolvedValue(undefined)
     };

package/test/email-templates.test.ts

@@ -0,0 +1,169 @@
+import {
+    getPasswordResetTemplate,
+    getEmailVerificationTemplate,
+    getUserInvitationTemplate,
+    getWelcomeEmailTemplate
+} from "../src/email/templates";
+
+describe("getPasswordResetTemplate", () => {
+    const user = { email: "john@example.com", displayName: "John Doe" };
+    const resetUrl = "https://example.com/reset?token=abc123";
+
+    it("returns subject, html, and text", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.subject).toBeTruthy();
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+
+    it("subject includes default app name", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.subject).toContain("Rebase");
+    });
+
+    it("subject includes custom app name", () => {
+        const result = getPasswordResetTemplate(resetUrl, user, "MyApp");
+        expect(result.subject).toContain("MyApp");
+    });
+
+    it("html contains the reset URL", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.html).toContain(resetUrl);
+    });
+
+    it("text contains the reset URL", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.text).toContain(resetUrl);
+    });
+
+    it("uses displayName for greeting", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.html).toContain("John Doe");
+        expect(result.text).toContain("John Doe");
+    });
+
+    it("falls back to email prefix when displayName is null", () => {
+        const userNoName = { email: "jane@example.com", displayName: null };
+        const result = getPasswordResetTemplate(resetUrl, userNoName);
+        expect(result.html).toContain("jane");
+        expect(result.text).toContain("jane");
+    });
+
+    it("html contains DOCTYPE and body tags", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.html).toContain("<!DOCTYPE html>");
+        expect(result.html).toContain("<body");
+        expect(result.html).toContain("</body>");
+    });
+});
+
+describe("getEmailVerificationTemplate", () => {
+    const user = { email: "alice@example.com", displayName: "Alice" };
+    const verifyUrl = "https://example.com/verify?token=xyz789";
+
+    it("returns subject, html, and text", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.subject).toBeTruthy();
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+
+    it("subject mentions email verification", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.subject.toLowerCase()).toContain("verify");
+    });
+
+    it("html contains the verification URL", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.html).toContain(verifyUrl);
+    });
+
+    it("text contains the verification URL", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.text).toContain(verifyUrl);
+    });
+
+    it("uses displayName when available", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.html).toContain("Alice");
+    });
+
+    it("uses custom app name", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user, "CustomApp");
+        expect(result.subject).toContain("CustomApp");
+        expect(result.html).toContain("CustomApp");
+    });
+});
+
+describe("getUserInvitationTemplate", () => {
+    const user = { email: "bob@example.com", displayName: "Bob" };
+    const setPasswordUrl = "https://example.com/set-password?token=def456";
+
+    it("returns subject, html, and text", () => {
+        const result = getUserInvitationTemplate(setPasswordUrl, user);
+        expect(result.subject).toBeTruthy();
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+
+    it("subject mentions invitation", () => {
+        const result = getUserInvitationTemplate(setPasswordUrl, user);
+        expect(result.subject.toLowerCase()).toContain("invited");
+    });
+
+    it("html contains the set password URL", () => {
+        const result = getUserInvitationTemplate(setPasswordUrl, user);
+        expect(result.html).toContain(setPasswordUrl);
+    });
+
+    it("text contains the set password URL", () => {
+        const result = getUserInvitationTemplate(setPasswordUrl, user);
+        expect(result.text).toContain(setPasswordUrl);
+    });
+
+    it("falls back to email prefix when no displayName", () => {
+        const userNoName = { email: "charlie@example.com" };
+        const result = getUserInvitationTemplate(setPasswordUrl, userNoName);
+        expect(result.html).toContain("charlie");
+    });
+});
+
+describe("getWelcomeEmailTemplate", () => {
+    const user = { email: "dave@example.com", displayName: "Dave" };
+
+    it("returns subject, html, and text", () => {
+        const result = getWelcomeEmailTemplate(user);
+        expect(result.subject).toBeTruthy();
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+
+    it("includes the app name in subject", () => {
+        const result = getWelcomeEmailTemplate(user, "SuperApp");
+        expect(result.subject).toContain("SuperApp");
+    });
+
+    it("uses displayName for greeting", () => {
+        const result = getWelcomeEmailTemplate(user);
+        expect(result.html).toContain("Dave");
+    });
+
+    it("includes login URL when provided", () => {
+        const loginUrl = "https://example.com/login";
+        const result = getWelcomeEmailTemplate(user, "Rebase", loginUrl);
+        expect(result.html).toContain(loginUrl);
+        expect(result.text).toContain(loginUrl);
+    });
+
+    it("handles missing login URL gracefully", () => {
+        const result = getWelcomeEmailTemplate(user);
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+
+    it("html contains proper structure", () => {
+        const result = getWelcomeEmailTemplate(user);
+        expect(result.html).toContain("<!DOCTYPE html>");
+        expect(result.html).toContain("<body");
+    });
+});

package/test/function-loader.test.ts

@@ -0,0 +1,124 @@
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { Hono } from "hono";
+import { loadFunctionsFromDirectory } from "../src/functions/function-loader";
+import { createFunctionRoutes } from "../src/functions/function-routes";
+
+describe("Function Loader & Routes", () => {
+    let tempDir: string;
+
+    beforeAll(() => {
+        // Create temporary directory in OS temp folder
+        tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "rebase-functions-test-"));
+
+        // 1. Write a valid Hono app default export using CommonJS
+        fs.writeFileSync(
+            path.join(tempDir, "valid-app.js"),
+            `
+            const { Hono } = require("hono");
+            const app = new Hono();
+            app.get("/hello", (c) => c.text("hello from valid-app"));
+            module.exports = app;
+            `
+        );
+
+        // 2. Write a valid Hono app factory default export using CommonJS
+        fs.writeFileSync(
+            path.join(tempDir, "valid-factory.js"),
+            `
+            const { Hono } = require("hono");
+            module.exports = () => {
+                const app = new Hono();
+                app.post("/hello", (c) => c.text("hello from valid-factory"));
+                return app;
+            };
+            `
+        );
+
+        // 3. Write an invalid default export
+        fs.writeFileSync(
+            path.join(tempDir, "invalid-export.js"),
+            `
+            module.exports = { foo: "bar" };
+            `
+        );
+
+        // 4. Write a file with no default export (exports is an object but no module.exports default value)
+        fs.writeFileSync(
+            path.join(tempDir, "no-default.js"),
+            `
+            exports.other = "value";
+            `
+        );
+
+        // 5. Write an ignored non-js/ts file
+        fs.writeFileSync(
+            path.join(tempDir, "ignored.txt"),
+            "some random text"
+        );
+    });
+
+    afterAll(() => {
+        // Clean up temp directory
+        if (tempDir && fs.existsSync(tempDir)) {
+            fs.rmSync(tempDir, { recursive: true, force: true });
+        }
+    });
+
+    describe("loadFunctionsFromDirectory", () => {
+        it("should return empty array if directory does not exist", async () => {
+            const result = await loadFunctionsFromDirectory(path.join(tempDir, "non-existent-folder"));
+            expect(result).toEqual([]);
+        });
+
+        it("should load valid apps and factories while ignoring invalid files", async () => {
+            const loaded = await loadFunctionsFromDirectory(tempDir);
+
+            // We expect exactly 2 functions to be loaded: "valid-app" and "valid-factory"
+            expect(loaded).toHaveLength(2);
+
+            const names = loaded.map(f => f.name);
+            expect(names).toContain("valid-app");
+            expect(names).toContain("valid-factory");
+
+            // Verify they both look like Hono instances
+            const validApp = loaded.find(f => f.name === "valid-app")!;
+            expect(typeof validApp.app.fetch).toBe("function");
+            expect(Array.isArray(validApp.app.routes)).toBe(true);
+
+            const validFactory = loaded.find(f => f.name === "valid-factory")!;
+            expect(typeof validFactory.app.fetch).toBe("function");
+            expect(Array.isArray(validFactory.app.routes)).toBe(true);
+        });
+    });
+
+    describe("createFunctionRoutes", () => {
+        it("should mount and route correctly", async () => {
+            const loaded = await loadFunctionsFromDirectory(tempDir);
+            const routes = createFunctionRoutes(loaded);
+
+            // 1. Verify GET / lists loaded functions
+            const listRes = await routes.request("/");
+            expect(listRes.status).toBe(200);
+            
+            const listData = await listRes.json();
+            expect(listData).toEqual({
+                functions: [
+                    { name: "valid-app", endpoint: "/functions/valid-app" },
+                    { name: "valid-factory", endpoint: "/functions/valid-factory" }
+                ]
+            });
+
+            // 2. Verify routing to valid-app
+            const appRes = await routes.request("/valid-app/hello");
+            expect(appRes.status).toBe(200);
+            expect(await appRes.text()).toBe("hello from valid-app");
+
+            // 3. Verify routing to valid-factory
+            const factoryRes = await routes.request("/valid-factory/hello", { method: "POST" });
+            expect(factoryRes.status).toBe(200);
+            expect(await factoryRes.text()).toBe("hello from valid-factory");
+        });
+    });
+});

package/test/jwt.test.ts

@@ -56,7 +56,8 @@ accessExpiresIn: "2h" });
             const payload = verifyAccessToken(token);
             expect(payload).toEqual({
                 userId: "user-456",
-                roles: ["viewer"]
+                roles: ["viewer"],
+                aal: "aal1"
             });
         });
 
@@ -73,7 +74,8 @@ accessExpiresIn: "2h" });
             const payload = verifyAccessToken(token);
             expect(payload).toEqual({
                 userId: "user-123",
-                roles: ["admin"]
+                roles: ["admin"],
+                aal: "aal1"
             });
         });