npm - @rebasepro/server-core - Versions diffs - 0.2.3 → 0.2.5 - Mend

@rebasepro/server-core 0.2.3 → 0.2.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (116) hide show

package/dist/common/src/collections/default-collections.d.ts +9 -0
package/dist/common/src/collections/index.d.ts +1 -0
package/dist/common/src/util/permissions.d.ts +1 -0
package/dist/{index-BZoAtuqi.js → index-Cr1D21av.js} +11 -3
package/dist/index-Cr1D21av.js.map +1 -0
package/dist/index.es.js +2309 -370
package/dist/index.es.js.map +1 -1
package/dist/index.umd.js +2298 -355
package/dist/index.umd.js.map +1 -1
package/dist/server-core/src/api/logs-routes.d.ts +37 -0
package/dist/server-core/src/api/rest/api-generator.d.ts +6 -0
package/dist/server-core/src/api/types.d.ts +6 -1
package/dist/server-core/src/auth/adapter-middleware.d.ts +7 -3
package/dist/server-core/src/auth/admin-routes.d.ts +3 -3
package/dist/server-core/src/auth/api-keys/api-key-middleware.d.ts +39 -0
package/dist/server-core/src/auth/api-keys/api-key-permission-guard.d.ts +32 -0
package/dist/server-core/src/auth/api-keys/api-key-routes.d.ts +20 -0
package/dist/server-core/src/auth/api-keys/api-key-store.d.ts +35 -0
package/dist/server-core/src/auth/api-keys/api-key-types.d.ts +88 -0
package/dist/server-core/src/auth/api-keys/index.d.ts +17 -0
package/dist/server-core/src/auth/{auth-overrides.d.ts → auth-hooks.d.ts} +69 -11
package/dist/server-core/src/auth/builtin-auth-adapter.d.ts +3 -3
package/dist/server-core/src/auth/index.d.ts +5 -3
package/dist/server-core/src/auth/interfaces.d.ts +93 -3
package/dist/server-core/src/auth/jwt.d.ts +3 -1
package/dist/server-core/src/auth/mfa.d.ts +49 -0
package/dist/server-core/src/auth/middleware.d.ts +7 -0
package/dist/server-core/src/auth/rate-limiter.d.ts +19 -0
package/dist/server-core/src/auth/routes.d.ts +3 -3
package/dist/server-core/src/env.d.ts +6 -0
package/dist/server-core/src/index.d.ts +1 -0
package/dist/server-core/src/init.d.ts +3 -3
package/dist/server-core/src/services/webhook-service.d.ts +29 -0
package/dist/server-core/src/storage/image-transform.d.ts +48 -0
package/dist/server-core/src/storage/index.d.ts +3 -0
package/dist/server-core/src/storage/tus-handler.d.ts +51 -0
package/dist/types/src/controllers/auth.d.ts +4 -26
package/dist/types/src/controllers/client.d.ts +25 -43
package/dist/types/src/controllers/collection_registry.d.ts +1 -1
package/dist/types/src/controllers/data.d.ts +4 -0
package/dist/types/src/controllers/data_driver.d.ts +23 -0
package/dist/types/src/controllers/registry.d.ts +5 -4
package/dist/types/src/rebase_context.d.ts +1 -1
package/dist/types/src/types/auth_adapter.d.ts +5 -60
package/dist/types/src/types/backend.d.ts +2 -2
package/dist/types/src/types/backend_hooks.d.ts +2 -17
package/dist/types/src/types/collections.d.ts +0 -4
package/dist/types/src/types/component_ref.d.ts +1 -1
package/dist/types/src/types/cron.d.ts +1 -1
package/dist/types/src/types/entity_views.d.ts +1 -0
package/dist/types/src/types/export_import.d.ts +1 -1
package/dist/types/src/types/formex.d.ts +2 -2
package/dist/types/src/types/properties.d.ts +9 -7
package/dist/types/src/types/translations.d.ts +28 -12
package/dist/types/src/types/user_management_delegate.d.ts +22 -57
package/dist/types/src/users/index.d.ts +0 -1
package/dist/types/src/users/user.d.ts +0 -1
package/package.json +8 -6
package/src/api/ast-schema-editor.ts +4 -4
package/src/api/errors.ts +16 -7
package/src/api/logs-routes.ts +129 -0
package/src/api/rest/api-generator.ts +42 -2
package/src/api/rest/query-parser.ts +37 -1
package/src/api/types.ts +6 -1
package/src/auth/adapter-middleware.ts +20 -4
package/src/auth/admin-routes.ts +36 -100
package/src/auth/api-keys/api-key-middleware.ts +126 -0
package/src/auth/api-keys/api-key-permission-guard.ts +64 -0
package/src/auth/api-keys/api-key-routes.ts +183 -0
package/src/auth/api-keys/api-key-store.ts +317 -0
package/src/auth/api-keys/api-key-types.ts +94 -0
package/src/auth/api-keys/index.ts +37 -0
package/src/auth/{auth-overrides.ts → auth-hooks.ts} +81 -14
package/src/auth/builtin-auth-adapter.ts +35 -73
package/src/auth/custom-auth-adapter.ts +1 -1
package/src/auth/index.ts +7 -3
package/src/auth/interfaces.ts +111 -3
package/src/auth/jwt.ts +19 -5
package/src/auth/mfa.ts +160 -0
package/src/auth/middleware.ts +20 -1
package/src/auth/rate-limiter.ts +92 -0
package/src/auth/routes.ts +455 -24
package/src/cron/cron-loader.ts +5 -10
package/src/cron/cron-scheduler.ts +11 -12
package/src/cron/cron-store.ts +8 -7
package/src/env.ts +2 -0
package/src/functions/function-loader.ts +6 -9
package/src/index.ts +1 -2
package/src/init.ts +56 -8
package/src/serve-spa.ts +5 -4
package/src/services/webhook-service.ts +155 -0
package/src/storage/image-transform.ts +202 -0
package/src/storage/index.ts +3 -0
package/src/storage/routes.ts +56 -3
package/src/storage/tus-handler.ts +315 -0
package/src/utils/dev-port.ts +14 -0
package/src/utils/logging.ts +9 -7
package/test/admin-routes.test.ts +62 -164
package/test/api-generator.test.ts +0 -1
package/test/api-key-permission-guard.test.ts +132 -0
package/test/ast-schema-editor.test.ts +26 -0
package/test/auth-routes.test.ts +1 -2
package/test/backend-hooks-admin.test.ts +3 -29
package/test/custom-auth-adapter.test.ts +2 -10
package/test/email-templates.test.ts +169 -0
package/test/function-loader.test.ts +124 -0
package/test/jwt.test.ts +4 -2
package/test/mfa.test.ts +197 -0
package/test/middleware.test.ts +10 -5
package/test/webhook-service.test.ts +249 -0
package/vite.config.ts +3 -2
package/dist/index-BZoAtuqi.js.map +0 -1
package/dist/server-core/src/bootstrappers/index.d.ts +0 -0
package/dist/types/src/users/roles.d.ts +0 -22
package/src/bootstrappers/index.ts +0 -1
package/src/singleton.test.ts +0 -28

package/test/email-templates.test.ts ADDED Viewed

@@ -0,0 +1,169 @@
+import {
+    getPasswordResetTemplate,
+    getEmailVerificationTemplate,
+    getUserInvitationTemplate,
+    getWelcomeEmailTemplate
+} from "../src/email/templates";
+describe("getPasswordResetTemplate", () => {
+    const user = { email: "john@example.com", displayName: "John Doe" };
+    const resetUrl = "https://example.com/reset?token=abc123";
+    it("returns subject, html, and text", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.subject).toBeTruthy();
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+    it("subject includes default app name", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.subject).toContain("Rebase");
+    });
+    it("subject includes custom app name", () => {
+        const result = getPasswordResetTemplate(resetUrl, user, "MyApp");
+        expect(result.subject).toContain("MyApp");
+    });
+    it("html contains the reset URL", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.html).toContain(resetUrl);
+    });
+    it("text contains the reset URL", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.text).toContain(resetUrl);
+    });
+    it("uses displayName for greeting", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.html).toContain("John Doe");
+        expect(result.text).toContain("John Doe");
+    });
+    it("falls back to email prefix when displayName is null", () => {
+        const userNoName = { email: "jane@example.com", displayName: null };
+        const result = getPasswordResetTemplate(resetUrl, userNoName);
+        expect(result.html).toContain("jane");
+        expect(result.text).toContain("jane");
+    });
+    it("html contains DOCTYPE and body tags", () => {
+        const result = getPasswordResetTemplate(resetUrl, user);
+        expect(result.html).toContain("<!DOCTYPE html>");
+        expect(result.html).toContain("<body");
+        expect(result.html).toContain("</body>");
+    });
+});
+describe("getEmailVerificationTemplate", () => {
+    const user = { email: "alice@example.com", displayName: "Alice" };
+    const verifyUrl = "https://example.com/verify?token=xyz789";
+    it("returns subject, html, and text", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.subject).toBeTruthy();
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+    it("subject mentions email verification", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.subject.toLowerCase()).toContain("verify");
+    });
+    it("html contains the verification URL", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.html).toContain(verifyUrl);
+    });
+    it("text contains the verification URL", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.text).toContain(verifyUrl);
+    });
+    it("uses displayName when available", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user);
+        expect(result.html).toContain("Alice");
+    });
+    it("uses custom app name", () => {
+        const result = getEmailVerificationTemplate(verifyUrl, user, "CustomApp");
+        expect(result.subject).toContain("CustomApp");
+        expect(result.html).toContain("CustomApp");
+    });
+});
+describe("getUserInvitationTemplate", () => {
+    const user = { email: "bob@example.com", displayName: "Bob" };
+    const setPasswordUrl = "https://example.com/set-password?token=def456";
+    it("returns subject, html, and text", () => {
+        const result = getUserInvitationTemplate(setPasswordUrl, user);
+        expect(result.subject).toBeTruthy();
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+    it("subject mentions invitation", () => {
+        const result = getUserInvitationTemplate(setPasswordUrl, user);
+        expect(result.subject.toLowerCase()).toContain("invited");
+    });
+    it("html contains the set password URL", () => {
+        const result = getUserInvitationTemplate(setPasswordUrl, user);
+        expect(result.html).toContain(setPasswordUrl);
+    });
+    it("text contains the set password URL", () => {
+        const result = getUserInvitationTemplate(setPasswordUrl, user);
+        expect(result.text).toContain(setPasswordUrl);
+    });
+    it("falls back to email prefix when no displayName", () => {
+        const userNoName = { email: "charlie@example.com" };
+        const result = getUserInvitationTemplate(setPasswordUrl, userNoName);
+        expect(result.html).toContain("charlie");
+    });
+});
+describe("getWelcomeEmailTemplate", () => {
+    const user = { email: "dave@example.com", displayName: "Dave" };
+    it("returns subject, html, and text", () => {
+        const result = getWelcomeEmailTemplate(user);
+        expect(result.subject).toBeTruthy();
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+    it("includes the app name in subject", () => {
+        const result = getWelcomeEmailTemplate(user, "SuperApp");
+        expect(result.subject).toContain("SuperApp");
+    });
+    it("uses displayName for greeting", () => {
+        const result = getWelcomeEmailTemplate(user);
+        expect(result.html).toContain("Dave");
+    });
+    it("includes login URL when provided", () => {
+        const loginUrl = "https://example.com/login";
+        const result = getWelcomeEmailTemplate(user, "Rebase", loginUrl);
+        expect(result.html).toContain(loginUrl);
+        expect(result.text).toContain(loginUrl);
+    });
+    it("handles missing login URL gracefully", () => {
+        const result = getWelcomeEmailTemplate(user);
+        expect(result.html).toBeTruthy();
+        expect(result.text).toBeTruthy();
+    });
+    it("html contains proper structure", () => {
+        const result = getWelcomeEmailTemplate(user);
+        expect(result.html).toContain("<!DOCTYPE html>");
+        expect(result.html).toContain("<body");
+    });
+});

package/test/function-loader.test.ts ADDED Viewed

@@ -0,0 +1,124 @@
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { Hono } from "hono";
+import { loadFunctionsFromDirectory } from "../src/functions/function-loader";
+import { createFunctionRoutes } from "../src/functions/function-routes";
+describe("Function Loader & Routes", () => {
+    let tempDir: string;
+    beforeAll(() => {
+        // Create temporary directory in OS temp folder
+        tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "rebase-functions-test-"));
+        // 1. Write a valid Hono app default export using CommonJS
+        fs.writeFileSync(
+            path.join(tempDir, "valid-app.js"),
+            `
+            const { Hono } = require("hono");
+            const app = new Hono();
+            app.get("/hello", (c) => c.text("hello from valid-app"));
+            module.exports = app;
+            `
+        );
+        // 2. Write a valid Hono app factory default export using CommonJS
+        fs.writeFileSync(
+            path.join(tempDir, "valid-factory.js"),
+            `
+            const { Hono } = require("hono");
+            module.exports = () => {
+                const app = new Hono();
+                app.post("/hello", (c) => c.text("hello from valid-factory"));
+                return app;
+            };
+            `
+        );
+        // 3. Write an invalid default export
+        fs.writeFileSync(
+            path.join(tempDir, "invalid-export.js"),
+            `
+            module.exports = { foo: "bar" };
+            `
+        );
+        // 4. Write a file with no default export (exports is an object but no module.exports default value)
+        fs.writeFileSync(
+            path.join(tempDir, "no-default.js"),
+            `
+            exports.other = "value";
+            `
+        );
+        // 5. Write an ignored non-js/ts file
+        fs.writeFileSync(
+            path.join(tempDir, "ignored.txt"),
+            "some random text"
+        );
+    });
+    afterAll(() => {
+        // Clean up temp directory
+        if (tempDir && fs.existsSync(tempDir)) {
+            fs.rmSync(tempDir, { recursive: true, force: true });
+        }
+    });
+    describe("loadFunctionsFromDirectory", () => {
+        it("should return empty array if directory does not exist", async () => {
+            const result = await loadFunctionsFromDirectory(path.join(tempDir, "non-existent-folder"));
+            expect(result).toEqual([]);
+        });
+        it("should load valid apps and factories while ignoring invalid files", async () => {
+            const loaded = await loadFunctionsFromDirectory(tempDir);
+            // We expect exactly 2 functions to be loaded: "valid-app" and "valid-factory"
+            expect(loaded).toHaveLength(2);
+            const names = loaded.map(f => f.name);
+            expect(names).toContain("valid-app");
+            expect(names).toContain("valid-factory");
+            // Verify they both look like Hono instances
+            const validApp = loaded.find(f => f.name === "valid-app")!;
+            expect(typeof validApp.app.fetch).toBe("function");
+            expect(Array.isArray(validApp.app.routes)).toBe(true);
+            const validFactory = loaded.find(f => f.name === "valid-factory")!;
+            expect(typeof validFactory.app.fetch).toBe("function");
+            expect(Array.isArray(validFactory.app.routes)).toBe(true);
+        });
+    });
+    describe("createFunctionRoutes", () => {
+        it("should mount and route correctly", async () => {
+            const loaded = await loadFunctionsFromDirectory(tempDir);
+            const routes = createFunctionRoutes(loaded);
+            // 1. Verify GET / lists loaded functions
+            const listRes = await routes.request("/");
+            expect(listRes.status).toBe(200);
+            const listData = await listRes.json();
+            expect(listData).toEqual({
+                functions: [
+                    { name: "valid-app", endpoint: "/functions/valid-app" },
+                    { name: "valid-factory", endpoint: "/functions/valid-factory" }
+                ]
+            });
+            // 2. Verify routing to valid-app
+            const appRes = await routes.request("/valid-app/hello");
+            expect(appRes.status).toBe(200);
+            expect(await appRes.text()).toBe("hello from valid-app");
+            // 3. Verify routing to valid-factory
+            const factoryRes = await routes.request("/valid-factory/hello", { method: "POST" });
+            expect(factoryRes.status).toBe(200);
+            expect(await factoryRes.text()).toBe("hello from valid-factory");
+        });
+    });
+});

package/test/jwt.test.ts CHANGED Viewed

@@ -56,7 +56,8 @@ accessExpiresIn: "2h" });
             const payload = verifyAccessToken(token);
             expect(payload).toEqual({
                 userId: "user-456",
-                roles: ["viewer"]
+                roles: ["viewer"],
+                aal: "aal1"
             });
         });
@@ -73,7 +74,8 @@ accessExpiresIn: "2h" });
             const payload = verifyAccessToken(token);
             expect(payload).toEqual({
                 userId: "user-123",
-                roles: ["admin"]
+                roles: ["admin"],
+                aal: "aal1"
             });
         });

package/test/mfa.test.ts ADDED Viewed

@@ -0,0 +1,197 @@
+import {
+    base32Encode,
+    base32Decode,
+    generateTotp,
+    verifyTotp,
+    generateTotpSecret,
+    generateRecoveryCodes,
+    hashRecoveryCode
+} from "../src/auth/mfa";
+describe("base32Encode / base32Decode", () => {
+    it("round-trips a known buffer", () => {
+        const original = Buffer.from("Hello, World!");
+        const encoded = base32Encode(original);
+        const decoded = base32Decode(encoded);
+        expect(decoded.toString()).toBe("Hello, World!");
+    });
+    it("encodes known test vectors (RFC 4648)", () => {
+        // RFC 4648 test vectors
+        expect(base32Encode(Buffer.from(""))).toBe("");
+        expect(base32Encode(Buffer.from("f"))).toBe("MY");
+        expect(base32Encode(Buffer.from("fo"))).toBe("MZXQ");
+        expect(base32Encode(Buffer.from("foo"))).toBe("MZXW6");
+        expect(base32Encode(Buffer.from("foob"))).toBe("MZXW6YQ");
+        expect(base32Encode(Buffer.from("fooba"))).toBe("MZXW6YTB");
+        expect(base32Encode(Buffer.from("foobar"))).toBe("MZXW6YTBOI");
+    });
+    it("decodes base32 with trailing padding characters", () => {
+        const decoded = base32Decode("MZXW6===");
+        expect(decoded.toString()).toBe("foo");
+    });
+    it("is case-insensitive when decoding", () => {
+        const upper = base32Decode("MZXW6YTBOI");
+        const lower = base32Decode("mzxw6ytboi");
+        expect(upper.equals(lower)).toBe(true);
+    });
+    it("handles single byte", () => {
+        const buf = Buffer.from([0xff]);
+        const encoded = base32Encode(buf);
+        const decoded = base32Decode(encoded);
+        expect(decoded[0]).toBe(0xff);
+    });
+    it("round-trips random 20-byte secret", () => {
+        const original = Buffer.from("abcdefghij1234567890");
+        const encoded = base32Encode(original);
+        const decoded = base32Decode(encoded);
+        expect(decoded.toString()).toBe(original.toString());
+    });
+});
+describe("generateTotp", () => {
+    it("returns a 6-digit string", () => {
+        const secret = Buffer.from("12345678901234567890");
+        const code = generateTotp(secret);
+        expect(code).toMatch(/^\d{6}$/);
+    });
+    it("returns consistent results for the same time step", () => {
+        const secret = Buffer.from("test-secret-1234567");
+        const code1 = generateTotp(secret);
+        const code2 = generateTotp(secret);
+        expect(code1).toBe(code2);
+    });
+    it("pads short codes with leading zeros", () => {
+        // Generate many codes to increase chance of seeing leading zeros behavior
+        const secret = Buffer.from("12345678901234567890");
+        const code = generateTotp(secret);
+        expect(code.length).toBe(6);
+    });
+});
+describe("verifyTotp", () => {
+    it("verifies a freshly generated token", () => {
+        const secret = Buffer.from("12345678901234567890");
+        const token = generateTotp(secret);
+        expect(verifyTotp(secret, token)).toBe(true);
+    });
+    it("rejects an incorrect token", () => {
+        const secret = Buffer.from("12345678901234567890");
+        expect(verifyTotp(secret, "000000")).toBe(false);
+    });
+    it("rejects token from different secret", () => {
+        const secret1 = Buffer.from("secret-one-12345678");
+        const secret2 = Buffer.from("secret-two-12345678");
+        const token = generateTotp(secret1);
+        expect(verifyTotp(secret2, token)).toBe(false);
+    });
+    it("uses window parameter to check adjacent time steps", () => {
+        const secret = Buffer.from("12345678901234567890");
+        const token = generateTotp(secret);
+        // Window of 0 should still pass for current step
+        expect(verifyTotp(secret, token, 0)).toBe(true);
+        // Window of 2 should also pass for current step
+        expect(verifyTotp(secret, token, 2)).toBe(true);
+    });
+});
+describe("generateTotpSecret", () => {
+    it("returns a base32 secret and otpauth URI", () => {
+        const result = generateTotpSecret("MyApp", "user@example.com");
+        expect(result.secret).toBeTruthy();
+        expect(result.uri).toBeTruthy();
+    });
+    it("generates a valid otpauth URI format", () => {
+        const result = generateTotpSecret("MyApp", "user@example.com");
+        expect(result.uri).toMatch(/^otpauth:\/\/totp\//);
+        expect(result.uri).toContain("secret=");
+        expect(result.uri).toContain("issuer=MyApp");
+        expect(result.uri).toContain("algorithm=SHA1");
+        expect(result.uri).toContain("digits=6");
+        expect(result.uri).toContain("period=30");
+    });
+    it("encodes special characters in issuer and account", () => {
+        const result = generateTotpSecret("My App & Co.", "user+test@example.com");
+        expect(result.uri).toContain(encodeURIComponent("My App & Co."));
+        expect(result.uri).toContain(encodeURIComponent("user+test@example.com"));
+    });
+    it("generates unique secrets on each call", () => {
+        const result1 = generateTotpSecret("App", "user@test.com");
+        const result2 = generateTotpSecret("App", "user@test.com");
+        expect(result1.secret).not.toBe(result2.secret);
+    });
+    it("secret can be decoded back to a 20-byte buffer", () => {
+        const result = generateTotpSecret("App", "user@test.com");
+        const decoded = base32Decode(result.secret);
+        expect(decoded.length).toBe(20);
+    });
+});
+describe("generateRecoveryCodes", () => {
+    it("generates 10 codes by default", () => {
+        const codes = generateRecoveryCodes();
+        expect(codes).toHaveLength(10);
+    });
+    it("generates the specified number of codes", () => {
+        const codes = generateRecoveryCodes(5);
+        expect(codes).toHaveLength(5);
+    });
+    it("generates codes in XXXXX-XXXXX format", () => {
+        const codes = generateRecoveryCodes();
+        for (const code of codes) {
+            expect(code).toMatch(/^[A-F0-9]{5}-[A-F0-9]{5}$/);
+        }
+    });
+    it("generates unique codes", () => {
+        const codes = generateRecoveryCodes(20);
+        const unique = new Set(codes);
+        expect(unique.size).toBe(codes.length);
+    });
+});
+describe("hashRecoveryCode", () => {
+    it("returns a hex string", () => {
+        const hash = hashRecoveryCode("ABC12-DEF34");
+        expect(hash).toMatch(/^[a-f0-9]{64}$/);
+    });
+    it("is deterministic", () => {
+        const hash1 = hashRecoveryCode("ABC12-DEF34");
+        const hash2 = hashRecoveryCode("ABC12-DEF34");
+        expect(hash1).toBe(hash2);
+    });
+    it("strips dashes before hashing", () => {
+        const withDashes = hashRecoveryCode("ABC12-DEF34");
+        const withoutDashes = hashRecoveryCode("ABC12DEF34");
+        expect(withDashes).toBe(withoutDashes);
+    });
+    it("normalizes to uppercase before hashing", () => {
+        const upper = hashRecoveryCode("ABC12-DEF34");
+        const lower = hashRecoveryCode("abc12-def34");
+        expect(upper).toBe(lower);
+    });
+    it("different codes produce different hashes", () => {
+        const hash1 = hashRecoveryCode("ABC12-DEF34");
+        const hash2 = hashRecoveryCode("XYZ98-UVW76");
+        expect(hash1).not.toBe(hash2);
+    });
+});

package/test/middleware.test.ts CHANGED Viewed

@@ -67,7 +67,8 @@ describe("Auth Middleware", () => {
             expect(nextFn).toHaveBeenCalled();
             expect(getUser()).toEqual({
                 userId: "user-123",
-                roles: ["admin", "editor"]
+                roles: ["admin", "editor"],
+                aal: "aal1"
             });
         });
@@ -144,7 +145,8 @@ describe("Auth Middleware", () => {
             expect(nextFn).toHaveBeenCalled();
             expect(getUser()).toEqual({
                 userId: "user-123",
-                roles: ["viewer"]
+                roles: ["viewer"],
+                aal: "aal1"
             });
         });
     });
@@ -159,7 +161,8 @@ describe("Auth Middleware", () => {
             expect(nextFn).toHaveBeenCalled();
             expect(getUser()).toEqual({
                 userId: "user-456",
-                roles: ["viewer"]
+                roles: ["viewer"],
+                aal: "aal1"
             });
         });
@@ -273,7 +276,8 @@ roles: ["schema-adminstration", "admins", "admin "] } });
             expect(payload).toEqual({
                 userId: "ws-user-123",
-                roles: ["admin"]
+                roles: ["admin"],
+                aal: "aal1"
             });
         });
@@ -293,7 +297,8 @@ roles: ["schema-adminstration", "admins", "admin "] } });
             expect(payload).toEqual({
                 userId: "user-no-roles",
-                roles: []
+                roles: [],
+                aal: "aal1"
             });
         });
     });