@starci/hfs 5.0.8 → 5.2.0

package/templates/fe/transport/graphql/clients/links/attach-access-token.ts

@@ -2,7 +2,7 @@ import { SetContextLink } from "@apollo/client/link/context"
 import { contextHeaders } from "./context-headers"
 
 /** Attaches `Authorization: Bearer <access token>` from modules/auth when a session exists; an anonymous call goes out without it. */
-export const createAttachAccessTokenLink = (accessToken: () => Promise<string | undefined>) =>
+export const createAttachAccessTokenLink = (accessToken: () => Promise<string | undefined>): SetContextLink =>
     new SetContextLink(async (context) => {
         const token = await accessToken()
         if (token === undefined) return {}

package/templates/fe/transport/graphql/clients/links/error.ts

@@ -15,7 +15,7 @@ const codeOf = (error: GraphQLErrorEntry): string =>
  * Reports what came back from downstream to `report` when the app passes one. The operation maps every error to its
  * GraphQLResponse, so this link never swallows or rewrites one.
  */
-export const createErrorLink = (report?: ErrorReporter) =>
+export const createErrorLink = (report?: ErrorReporter): ErrorLink =>
     new ErrorLink(({ error, operation }) => {
         if (report === undefined) return
         if (CombinedGraphQLErrors.is(error)) {

package/templates/fe/transport/graphql/clients/links/http.ts

@@ -8,7 +8,7 @@ export interface CreateHttpLinkParams {
 }
 
 /** The terminal link: POSTs the operation to the back end's GraphQL endpoint (modules/config). */
-export const createHttpLink = ({ withCredentials = false, signal }: CreateHttpLinkParams) =>
+export const createHttpLink = ({ withCredentials = false, signal }: CreateHttpLinkParams): HttpLink =>
     new HttpLink({
         uri: graphqlUrl(),
         credentials: withCredentials ? "include" : "same-origin",

package/templates/fe/transport/graphql/clients/links/locale.ts

@@ -6,7 +6,7 @@ const documentLocale = (): string | undefined =>
     typeof document === "undefined" || document.documentElement.lang === "" ? undefined : document.documentElement.lang
 
 /** The one writer of `Accept-Language`: every operation declares the language the back end answers and localizes its errors in. */
-export const createAttachLocaleLink = (locale: () => string | undefined = documentLocale) =>
+export const createAttachLocaleLink = (locale: () => string | undefined = documentLocale): SetContextLink =>
     new SetContextLink((context) => {
         const value = locale()
         if (value === undefined) return {}

package/templates/fe/transport/graphql/clients/links/refresh-token.ts

@@ -15,7 +15,7 @@ const isUnauthenticated = (error: unknown): boolean =>
  * On an UNAUTHENTICATED answer, asks modules/auth for a fresh access token once and replays the operation with it. When no
  * token comes back (the session ended) the original error travels on.
  */
-export const createRefreshTokenLink = (refreshAccessToken: () => Promise<string | undefined>) =>
+export const createRefreshTokenLink = (refreshAccessToken: () => Promise<string | undefined>): ErrorLink =>
     new ErrorLink(({ error, operation, forward }) => {
         if (!isUnauthenticated(error) || operation.getContext()[REFRESHED] === true) return
         return new Observable((observer) => {

package/templates/fe/transport/graphql/clients/links/retry.ts

@@ -6,7 +6,7 @@ import { RETRY_POLICY } from "./options"
  * Retries a transient network failure with jittered exponential backoff. A GraphQL error is an answer of the back end and
  * is never retried. First in the chain, so every other link sees the operation once per attempt.
  */
-export const createRetryLink = () =>
+export const createRetryLink = (): RetryLink =>
     new RetryLink({
         delay: { initial: RETRY_POLICY.initialDelayMs, max: RETRY_POLICY.maxDelayMs, jitter: true },
         attempts: {

package/templates/fe/transport/graphql/clients/links/timeout.ts

@@ -2,7 +2,7 @@ import { ApolloLink, Observable } from "@apollo/client"
 import { OPERATION_TIMEOUT_MS } from "./options"
 
 /** Fails the operation when no answer arrived within the timeout; the upstream links see the timeout as an error. */
-export const createTimeoutLink = (timeoutMs = OPERATION_TIMEOUT_MS) =>
+export const createTimeoutLink = (timeoutMs: number = OPERATION_TIMEOUT_MS): ApolloLink =>
     new ApolloLink(
         (operation, forward) =>
             new Observable((observer) => {

package/templates/fe/units/page/index.tsx.tpl

@@ -1,4 +1,5 @@
 import type { Metadata } from "next"
+import type { ReactElement } from "react"
 import { getTranslations } from "next-intl/server"
 import { APP_ROUTES } from "@/modules/routes"
 import { {{Name}}Base } from "./component"
@@ -23,7 +24,7 @@ const copyOf = async (isLoading: boolean): Promise<{{Name}}BaseProps["props"]> =
 }
 
 /** The {{route}} page: a server owner that resolves its copy and composes its blocks; it reads no data. */
-export const {{Name}} = async () => <{{Name}}Base props={await copyOf(false)} />
+export const {{Name}} = async (): Promise<ReactElement> => <{{Name}}Base props={await copyOf(false)} />
 
 /** The {{route}} route's loading view: the same page drawn in skeleton mode, never a separate layout (STATE-8). */
-export const {{LoadingName}} = async () => <{{Name}}Base props={await copyOf(true)} />
+export const {{LoadingName}} = async (): Promise<ReactElement> => <{{Name}}Base props={await copyOf(true)} />

package/templates/fe/units/slot/SlotView.tsx.tpl

@@ -15,7 +15,7 @@ type SlotViewProps<T> = {
 }
 
 /** The one status view (FE-ERROR-1): every region renders its loading, forbidden, error and empty status through here. */
-export const SlotView = <T,>(props: SlotViewProps<T>) => {
+export const SlotView = <T,>(props: SlotViewProps<T>): ReactNode => {
     const { slot } = props
     if (slot.isLoading === true) return props.render(props.placeholder, true)
     if (slot.isForbidden === true) return props.forbidden === "hide" ? null : <EmptyNotice message={props.labels.forbidden} />

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/Caddyfile

@@ -1,16 +0,0 @@
-{
-    admin 127.0.0.1:2019
-    auto_https off
-}
-
-http://dev.{{project}}.example.invalid {
-    handle /graphql* {
-        reverse_proxy api:3001
-    }
-    handle /health/* {
-        reverse_proxy api:3001
-    }
-    handle {
-        reverse_proxy web:3000
-    }
-}

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/owner-actions.md

@@ -1,11 +0,0 @@
-# Development prerequisite record
-
-Status: pending owner execution. This record states intended configuration and contains no completed operational receipt.
-
-## DNS
-
-The development operator replaces `dev.{{project}}.example.invalid` with a locally owned development name, updates the manifest, Caddyfile and public configuration together, and resolves the name to the Swarm node. Record the actual resolver mapping and dated verification here.
-
-## TLS
-
-The local development route uses HTTP on ingress port 80 with `auto_https off`. The development operator owns this local-only choice and both external ingress volumes. Record any change to locally issued TLS, certificate custody and verification here before exposing the development stack outside the local network.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/recovery/restore-proof.md

@@ -1,7 +0,0 @@
-# Development recovery record
-
-Status: pending owner execution. No backup or restore has been run by scaffolding.
-
-The development operator owns recovery of the db service's volume `{{project}}-dev-db-data` and both external ingress volumes, `{{project}}-dev-ingress-data` and `{{project}}-dev-ingress-config-data`. Retain seven daily encrypted off-host exports or snapshots for each target.
-
-Before relying on the backup policy, restore a database export and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored ingress configuration and state. Attach the dated result here without credentials.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/current.yaml

@@ -1,6 +0,0 @@
-schema: starci/release-pointer@1
-environment: dev
-status: pending-owner-release
-release: null
-verification: null
-# Write a real release digest and dated health receipt only after convergence and verification.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/images.lock.yaml

@@ -1,8 +0,0 @@
-# Illustrative inventory only. Replace application digests with verified published images.
-schema: starci/images-lock@1
-environment: dev
-status: pending-owner-release
-images:
-  api: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-  web: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-  ingress: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/previous.yaml

@@ -1,6 +0,0 @@
-schema: starci/release-pointer@1
-environment: dev
-status: no-previous-release
-release: null
-verification: null
-# Before moving current, retain the last accepted release here for rollback.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/stack.yaml

@@ -1,186 +0,0 @@
-# Illustrative development model. Replace all-zero application digests with verified published release digests before use.
-services:
-  api:
-    image: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-    environment:
-      NODE_ENV: development
-      PORT: "3001"
-      HTTP_SECURITY_ALLOWED_ORIGINS: http://dev.{{project}}.example.invalid
-      PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
-      PRIMARY_DB_SCHEMA: public
-      GOOGLE_CLIENT_ID: REPLACE_WITH_GOOGLE_OAUTH_CLIENT_ID
-      GOOGLE_CLIENT_SECRET_FILE: /run/secrets/google-client-secret
-      GOOGLE_CALLBACK_URL: http://dev.{{project}}.example.invalid/auth/google/callback
-      AUTH_JWT_ISSUER: http://dev.{{project}}.example.invalid
-      AUTH_JWT_AUDIENCE: {{project}}
-      AUTH_JWT_KEY_ID: dev-1
-      AUTH_JWT_PRIVATE_KEY_FILE: /run/secrets/auth-jwt-private-key
-      STORAGE_ENDPOINT: https://storage.{{project}}.example.invalid
-      STORAGE_REGION: us-east-1
-      STORAGE_BUCKET: {{project}}-dev
-      STORAGE_ACCESS_KEY_ID_FILE: /run/secrets/storage-access-key-id
-      STORAGE_SECRET_ACCESS_KEY_FILE: /run/secrets/storage-secret-access-key
-    secrets:
-      - source: primary-db-url
-        target: primary-db-url
-      - source: google-client-secret
-        target: google-client-secret
-      - source: auth-jwt-private-key
-        target: auth-jwt-private-key
-      - source: storage-access-key-id
-        target: storage-access-key-id
-      - source: storage-secret-access-key
-        target: storage-secret-access-key
-    networks: [app]
-    healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
-      interval: 30s
-      timeout: 5s
-      start_period: 20s
-      retries: 3
-    deploy:
-      replicas: 1
-      placement:
-        constraints: ["node.labels.{{project}} == dev"]
-      update_config:
-        parallelism: 1
-        order: start-first
-        failure_action: rollback
-        monitor: 30s
-      # Stateless and served behind the ingress: roll back start-first so the serving task stays up until the old release is healthy.
-      rollback_config:
-        parallelism: 1
-        order: start-first
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-  web:
-    image: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-    environment:
-      NODE_ENV: development
-      PORT: "3000"
-      HOSTNAME: 0.0.0.0
-      NEXT_PUBLIC_SITE_URL: http://dev.{{project}}.example.invalid
-    networks: [app]
-    healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
-      interval: 30s
-      timeout: 5s
-      start_period: 20s
-      retries: 3
-    deploy:
-      replicas: 1
-      placement:
-        constraints: ["node.labels.{{project}} == dev"]
-      update_config:
-        parallelism: 1
-        order: start-first
-        failure_action: rollback
-        monitor: 30s
-      # Stateless and served behind the ingress: roll back start-first so the serving task stays up until the old release is healthy.
-      rollback_config:
-        parallelism: 1
-        order: start-first
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-  db:
-    image: "{{project}}/db:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
-    environment:
-      POSTGRES_DB: postgres
-      POSTGRES_PASSWORD_FILE: /run/secrets/db-password
-    secrets:
-      - source: db-password
-        target: db-password
-    volumes:
-      - db-data:/var/lib/postgresql/data
-    networks: [app]
-    healthcheck:
-      test: ["CMD", "pg_isready", "-U", "postgres", "-h", "127.0.0.1"]
-      interval: 10s
-      timeout: 5s
-      start_period: 30s
-      retries: 5
-    deploy:
-      replicas: 1
-      placement:
-        constraints: ["node.labels.{{project}} == dev"]
-      update_config:
-        parallelism: 1
-        order: stop-first
-        failure_action: rollback
-        monitor: 30s
-      # The database owns a data volume and is single-writer: never run two at once, so rollback stays stop-first.
-      rollback_config:
-        parallelism: 1
-        order: stop-first
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-  ingress:
-    image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
-    configs:
-      - source: ingress-config
-        target: /etc/caddy/Caddyfile
-    ports:
-      - { target: 80, published: 80, protocol: tcp, mode: ingress }
-    volumes:
-      - ingress-data:/data
-      - ingress-config-data:/config
-    networks: [app]
-    healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    deploy:
-      replicas: 1
-      placement:
-        constraints: ["node.labels.{{project}} == dev"]
-      update_config:
-        parallelism: 1
-        order: stop-first
-        failure_action: rollback
-        monitor: 30s
-      # The ingress owns published ports and a certificate volume: never run two at once, so rollback stays stop-first.
-      rollback_config:
-        parallelism: 1
-        order: stop-first
-      restart_policy:
-        condition: on-failure
-        delay: 5s
-networks:
-  app:
-    driver: overlay
-secrets:
-  primary-db-url:
-    external: true
-    name: "{{project}}-dev-primary-db-url-v1"
-  db-password:
-    external: true
-    name: "{{project}}-dev-db-password-v1"
-  google-client-secret:
-    external: true
-    name: "{{project}}-dev-google-client-secret-v1"
-  auth-jwt-private-key:
-    external: true
-    name: "{{project}}-dev-auth-jwt-private-key-v1"
-  storage-access-key-id:
-    external: true
-    name: "{{project}}-dev-storage-access-key-id-v1"
-  storage-secret-access-key:
-    external: true
-    name: "{{project}}-dev-storage-secret-access-key-v1"
-configs:
-  ingress-config:
-    file: ./Caddyfile
-volumes:
-  db-data:
-    external: true
-    name: "{{project}}-dev-db-data"
-  ingress-data:
-    external: true
-    name: "{{project}}-dev-ingress-data"
-  ingress-config-data:
-    external: true
-    name: "{{project}}-dev-ingress-config-data"

package/templates/be/skeleton-lite/src/modules/integrations/object-storage/object-storage.client.spec.ts

@@ -1,22 +0,0 @@
-import { Secret } from "@modules/platform/config"
-import { createObjectStorage } from "./object-storage.client"
-
-const options = {
-    endpoint: "http://127.0.0.1:9000",
-    region: "us-east-1",
-    bucket: "app",
-    accessKeyId: new Secret("access"),
-    secretAccessKey: new Secret("secret"),
-    presignTtlSeconds: 300,
-}
-
-describe("createObjectStorage", () => {
-    it("presigns a path-style PUT of one key in the bucket, valid for the configured lifetime", async () => {
-        const storage = createObjectStorage(options, () => new Date("2026-10-29T00:00:00.000Z"))
-        const request = await storage.presignPut("users/u1/avatar.png", "image/png")
-
-        expect(new URL(request.url).pathname).toBe("/app/users/u1/avatar.png")
-        expect(new URL(request.url).searchParams.get("X-Amz-Expires")).toBe("300")
-        expect(request.expiresAt).toBe("2026-10-29T00:05:00.000Z")
-    })
-})

package/templates/be/skeleton-lite/src/modules/integrations/object-storage/object-storage.client.ts

@@ -1,25 +0,0 @@
-import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3"
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner"
-import type { ObjectStorage, PresignedRequest, ObjectStorageOptions } from "./object-storage.options"
-
-/** The one S3 client of the app over S3-compatible storage (path-style, as MinIO serves it). */
-export const createObjectStorage = (options: ObjectStorageOptions, now: () => Date = () => new Date()): ObjectStorage => {
-    const client = new S3Client({
-        endpoint: options.endpoint,
-        region: options.region,
-        forcePathStyle: true,
-        credentials: { accessKeyId: options.accessKeyId.reveal(), secretAccessKey: options.secretAccessKey.reveal() },
-    })
-    const expiresAt = (): string => new Date(now().getTime() + options.presignTtlSeconds * 1000).toISOString()
-    const presign = async (command: PutObjectCommand | GetObjectCommand): Promise<PresignedRequest> => ({
-        url: await getSignedUrl(client, command, { expiresIn: options.presignTtlSeconds }),
-        expiresAt: expiresAt(),
-    })
-    return {
-        presignPut: (key, contentType) => presign(new PutObjectCommand({ Bucket: options.bucket, Key: key, ContentType: contentType })),
-        presignGet: (key) => presign(new GetObjectCommand({ Bucket: options.bucket, Key: key })),
-        remove: async (key) => {
-            await client.send(new DeleteObjectCommand({ Bucket: options.bucket, Key: key }))
-        },
-    }
-}

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.cookie.spec.ts

@@ -1,104 +0,0 @@
-import { Test } from "@nestjs/testing"
-import type { Request, Response } from "express"
-import { mock } from "@starci/jest-preset"
-import { clearRefreshCookie, newRefreshToken, refreshTokenHash, setRefreshCookie } from "./passport.cookie"
-import { CookieStateStore } from "./strategies/oauth-state.store"
-
-const COOKIE: unique symbol = Symbol("passport.cookie")
-
-const OPTIONS = { name: "refresh", path: "/auth/refresh", ttlSeconds: 600 }
-
-const build = async () => {
-    const moduleRef = await Test.createTestingModule({
-        providers: [{ provide: COOKIE, useValue: { clearRefreshCookie, newRefreshToken, refreshTokenHash, setRefreshCookie } }],
-    }).compile()
-    return moduleRef.get<{
-        clearRefreshCookie: typeof clearRefreshCookie
-        newRefreshToken: typeof newRefreshToken
-        refreshTokenHash: typeof refreshTokenHash
-        setRefreshCookie: typeof setRefreshCookie
-    }>(COOKIE)
-}
-
-describe("refresh tokens", () => {
-    it("stores the sha256 of a token, never the token", async () => {
-        const subject = await build()
-
-        expect(subject.refreshTokenHash("abc")).toBe("ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad")
-    })
-
-    it("mints a 256-bit base64url token paired with its own hash", async () => {
-        const subject = await build()
-        const minted = subject.newRefreshToken()
-
-        expect(Buffer.from(minted.token, "base64url")).toHaveLength(32)
-        expect(minted.hash).toBe(subject.refreshTokenHash(minted.token))
-        expect(subject.newRefreshToken().token).not.toBe(minted.token)
-    })
-})
-
-describe("refresh cookie", () => {
-    it("sets the rotated token httpOnly, Secure, SameSite=Strict on the refresh path for its lifetime", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.setRefreshCookie(response, OPTIONS, "token-1")
-
-        expect(response.cookie).toHaveBeenCalledWith("refresh", "token-1", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh", maxAge: 600_000 })
-    })
-
-    it("clears the cookie with the attributes it was set with", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.clearRefreshCookie(response, OPTIONS)
-
-        expect(response.clearCookie).toHaveBeenCalledWith("refresh", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh" })
-    })
-
-    it("stays host-only: no Domain attribute is set or cleared when no cookie domain is configured", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.setRefreshCookie(response, OPTIONS, "token-1")
-        subject.clearRefreshCookie(response, OPTIONS)
-
-        expect(response.cookie).toHaveBeenCalledWith("refresh", "token-1", expect.not.objectContaining({ domain: expect.anything() }))
-        expect(response.clearCookie).toHaveBeenCalledWith("refresh", expect.not.objectContaining({ domain: expect.anything() }))
-    })
-
-    it("sets the rotated token with Domain=<cookieDomain> so a sibling host can forward it", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.setRefreshCookie(response, { ...OPTIONS, cookieDomain: "example.com" }, "token-1")
-
-        expect(response.cookie).toHaveBeenCalledWith("refresh", "token-1", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh", domain: "example.com", maxAge: 600_000 })
-    })
-
-    it("clears the cookie with the same Domain it was set with, or the browser keeps it", async () => {
-        const subject = await build()
-        const response = mock<Response>()
-
-        subject.clearRefreshCookie(response, { ...OPTIONS, cookieDomain: "example.com" })
-
-        expect(response.clearCookie).toHaveBeenCalledWith("refresh", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh", domain: "example.com" })
-    })
-})
-
-describe("oauth state cookie", () => {
-    const request = (response: Response): Request => ({ res: response, headers: {} }) as unknown as Request
-
-    it("is host-only without a cookie domain and carries Domain=<cookieDomain> with one, on set and on clear", () => {
-        const hostOnly = mock<Response>()
-        const shared = mock<Response>()
-
-        new CookieStateStore("/auth/google/callback").store(request(hostOnly), "verifier", undefined, undefined, () => undefined)
-        new CookieStateStore("/auth/google/callback", "example.com").store(request(shared), "verifier", undefined, undefined, () => undefined)
-        new CookieStateStore("/auth/google/callback", "example.com").verify(request(shared), "state", () => undefined)
-
-        expect(hostOnly.cookie).toHaveBeenCalledWith("oauth_state", expect.stringMatching(/^[A-Za-z0-9_-]{32}[.]verifier$/), expect.not.objectContaining({ domain: expect.anything() }))
-        expect(shared.cookie).toHaveBeenCalledWith("oauth_state", expect.stringMatching(/^[A-Za-z0-9_-]{32}[.]verifier$/), expect.objectContaining({ domain: "example.com" }))
-        expect(shared.clearCookie).toHaveBeenCalledWith("oauth_state", expect.objectContaining({ domain: "example.com" }))
-    })
-})

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.cookie.ts

@@ -1,34 +0,0 @@
-import { createHash, randomBytes } from "node:crypto"
-import type { CookieOptions, Response } from "express"
-import type { RefreshCookieOptions } from "./passport.options"
-
-/** A fresh opaque refresh token (256 bits) and the sha256 the session store keeps instead of it. */
-export const newRefreshToken = (): { readonly token: string; readonly hash: string } => {
-    const token = randomBytes(32).toString("base64url")
-    return { token, hash: refreshTokenHash(token) }
-}
-
-/** The sha256 a refresh token is stored and looked up by; the token itself is never stored. */
-export const refreshTokenHash = (token: string): string => createHash("sha256").update(token).digest("hex")
-
-/** `Domain=<cookieDomain>` when the app configured one; absent (host-only) otherwise. Setting and clearing must agree on it. */
-export const domainAttribute = (cookieDomain: string | undefined): Pick<CookieOptions, "domain"> =>
-    cookieDomain === undefined ? {} : { domain: cookieDomain }
-
-const attributes = (options: RefreshCookieOptions): CookieOptions => ({
-    httpOnly: true,
-    secure: true,
-    sameSite: "strict",
-    path: options.path,
-    ...domainAttribute(options.cookieDomain),
-})
-
-/** Sets the rotated refresh token: httpOnly, Secure, SameSite=Strict and sent to the refresh door only. */
-export const setRefreshCookie = (response: Response, options: RefreshCookieOptions, token: string): void => {
-    response.cookie(options.name, token, { ...attributes(options), maxAge: options.ttlSeconds * 1000 })
-}
-
-/** Clears the refresh cookie on sign-out or on a detected reuse. */
-export const clearRefreshCookie = (response: Response, options: RefreshCookieOptions): void => {
-    response.clearCookie(options.name, attributes(options))
-}

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.password.spec.ts

@@ -1,28 +0,0 @@
-import { Test } from "@nestjs/testing"
-import { hashPassword, verifyPassword } from "./passport.password"
-
-const PASSWORD: unique symbol = Symbol("passport.password")
-
-const build = async () => {
-    const moduleRef = await Test.createTestingModule({
-        providers: [{ provide: PASSWORD, useValue: { hashPassword, verifyPassword } }],
-    }).compile()
-    return moduleRef.get<{ hashPassword: typeof hashPassword; verifyPassword: typeof verifyPassword }>(PASSWORD)
-}
-
-describe("hashPassword and verifyPassword", () => {
-    it("hashes at bcrypt cost 12 and verifies only the password it hashed", async () => {
-        const subject = await build()
-        const stored = await subject.hashPassword("correct horse")
-
-        expect(stored.slice(0, 7)).toBe("$2b$12$")
-        expect(await subject.verifyPassword("correct horse", stored)).toBe(true)
-        expect(await subject.verifyPassword("wrong horse", stored)).toBe(false)
-    })
-
-    it("never matches an account that has no password hash", async () => {
-        const subject = await build()
-
-        expect(await subject.verifyPassword("correct horse", null)).toBe(false)
-    })
-})

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.password.ts

@@ -1,11 +0,0 @@
-import { compare, hash } from "bcryptjs"
-
-/** The bcrypt cost of a new password hash; existing `$2a$`/`$2b$` hashes (auth.users.encrypted_password) verify at their own cost. */
-const COST = 12
-
-/** Hashes a new password with bcrypt. */
-export const hashPassword = (password: string): Promise<string> => hash(password, COST)
-
-/** True when `password` matches the stored bcrypt hash; a missing hash never matches. */
-export const verifyPassword = async (password: string, stored: string | null): Promise<boolean> =>
-    stored === null ? false : compare(password, stored)