@stjoseph/prumo 0.2.0 → 0.3.0

package/templates/api/src/infra/http/server.ts

@@ -1,8 +1,6 @@
 // tsyringe reads decorator metadata as each class is loaded, so this must come before any other import.
 import 'reflect-metadata'
 import { MikroORM } from '@mikro-orm/postgresql'
-import type { Pool } from 'pg'
-import { AUTH, type Auth } from '@/infra/auth/auth.factory'
 import { loadEnv } from '@/infra/config/env'
 import { createOrmConfig } from '@/infra/database/mikroorm/mikro-orm.factory'
 import { createContainer } from '@/infra/di'
@@ -18,10 +16,9 @@ async function main(): Promise<void> {
   const container = createContainer({ env, orm })
   const app = await buildApp(container)
 
-  // Handling the signals takes away Node's default exit, so every open pool must close for the process to end.
+  // Handling the signals takes away Node's default exit, so the pool must close for the process to end.
   app.addHook('onClose', async () => {
     await orm.close()
-    await (container.resolve<Auth>(AUTH).options.database as Pool).end()
   })
 
   for (const signal of ['SIGINT', 'SIGTERM'] as const) {

package/templates/api/src/infra/mcp/mcp.server.ts

@@ -1,7 +1,17 @@
 import { createMcpHandler, type McpHttpHandler, McpServer } from '@modelcontextprotocol/server'
 import type { DependencyContainer } from 'tsyringe'
+import type { Env } from '@/infra/config/env'
 import { registerUserTools } from './tools/users.tool'
 
+// The protected resource MCP clients ask a token for; its access tokens carry it as their audience.
+export function mcpResource(env: Pick<Env, 'API_URL'>): string {
+  return `${env.API_URL}/api/mcp`
+}
+
+export function mcpResourceMetadataUrl(env: Pick<Env, 'API_URL'>): string {
+  return `${env.API_URL}/.well-known/oauth-protected-resource/api/mcp`
+}
+
 // One server per request: the protocol is stateless, and each instance knows only its caller.
 export function createMcpServerHandler(container: DependencyContainer): McpHttpHandler {
   return createMcpHandler(

package/templates/api/src/infra/oauth/crypto-authorization-codes.adapter.ts

@@ -0,0 +1,21 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
+import type { AuthorizationCodes } from '@/domain/oauth/ports/authorization-codes.port'
+
+const sha256 = (value: string) => createHash('sha256').update(value).digest('base64url')
+
+export class CryptoAuthorizationCodes implements AuthorizationCodes {
+  create(): string {
+    return randomBytes(32).toString('base64url')
+  }
+
+  digest(code: string): string {
+    return sha256(code)
+  }
+
+  matchesChallenge(verifier: string, challenge: string): boolean {
+    const expected = Buffer.from(sha256(verifier))
+    const given = Buffer.from(challenge)
+
+    return expected.length === given.length && timingSafeEqual(expected, given)
+  }
+}

package/templates/api/src/infra/oauth/https-client-metadata.adapter.ts

@@ -0,0 +1,231 @@
+import { type LookupAddress, lookup } from 'node:dns'
+import { request } from 'node:https'
+import { BlockList, isIP } from 'node:net'
+import { z } from 'zod'
+import { InvalidClientError } from '@/domain/oauth/errors/invalid-client.error'
+import type {
+  ClientMetadata,
+  ClientMetadataSource,
+} from '@/domain/oauth/ports/client-metadata.port'
+
+// The draft's recommended ceiling: a description of a client has no reason to be larger.
+const MAX_BYTES = 5 * 1024
+const TIMEOUT_MS = 5000
+const MAX_CACHE_MS = 60 * 60 * 1000
+
+// Anything that is not the public internet. The client chooses the URL, so without this list it could make the API
+// read its own network.
+const PRIVATE = new BlockList()
+
+for (const [network, prefix] of [
+  ['0.0.0.0', 8],
+  ['10.0.0.0', 8],
+  ['100.64.0.0', 10],
+  ['127.0.0.0', 8],
+  ['169.254.0.0', 16],
+  ['172.16.0.0', 12],
+  ['192.0.0.0', 24],
+  ['192.0.2.0', 24],
+  ['192.168.0.0', 16],
+  ['198.18.0.0', 15],
+  ['198.51.100.0', 24],
+  ['203.0.113.0', 24],
+  ['224.0.0.0', 4],
+  ['240.0.0.0', 4],
+] as const) {
+  PRIVATE.addSubnet(network, prefix, 'ipv4')
+}
+
+// An IPv4-mapped address (::ffff:127.0.0.1) is checked against the IPv4 rules by BlockList itself; a rule for the
+// whole mapped range would match every IPv4 address, public ones included.
+for (const [network, prefix] of [
+  ['::', 127],
+  ['64:ff9b::', 96],
+  ['100::', 64],
+  ['2001:db8::', 32],
+  ['fc00::', 7],
+  ['fe80::', 10],
+  ['ff00::', 8],
+] as const) {
+  PRIVATE.addSubnet(network, prefix, 'ipv6')
+}
+
+export function isPrivateAddress(address: string): boolean {
+  return PRIVATE.check(address, isIP(address) === 6 ? 'ipv6' : 'ipv4')
+}
+
+const documentSchema = z.object({
+  client_id: z.string(),
+  client_name: z.string().trim().min(1).max(200),
+  redirect_uris: z.array(z.string()).min(1).max(20),
+  // A document is public by nature, so it cannot hold a secret, and a key-based method is not supported here.
+  token_endpoint_auth_method: z.literal('none').optional(),
+  client_secret: z.never().optional(),
+  client_secret_expires_at: z.never().optional(),
+})
+
+function parseJson(text: string): unknown {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return undefined
+  }
+}
+
+function fail(message: string): never {
+  throw new InvalidClientError(message)
+}
+
+// https, a path, no credentials, no query, no fragment, no dot segments: and written exactly as the URL parser
+// would write it, since the document's client_id is compared to it character by character.
+function clientUrl(clientId: string): URL {
+  const url = URL.canParse(clientId) ? new URL(clientId) : fail('client_id is not a URL')
+
+  if (
+    url.protocol !== 'https:' ||
+    url.username !== '' ||
+    url.password !== '' ||
+    url.search !== '' ||
+    url.hash !== '' ||
+    url.pathname === '/' ||
+    url.href !== clientId
+  ) {
+    fail('client_id must be a canonical https URL with a path, and nothing else')
+  }
+
+  return url
+}
+
+// HTTPS anywhere, or plain HTTP back to this device, as MCP allows for native clients.
+function isAllowedRedirect(uri: string): boolean {
+  if (!URL.canParse(uri)) {
+    return false
+  }
+
+  const url = new URL(uri)
+  const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)
+
+  return url.hash === '' && (url.protocol === 'https:' || (url.protocol === 'http:' && loopback))
+}
+
+// The connection goes to the address checked here, so a name that resolves differently a second time cannot reach
+// the private network after passing.
+function guardedLookup(
+  hostname: string,
+  options: { all?: boolean },
+  callback: (error: Error | null, address: string | LookupAddress[], family?: number) => void,
+): void {
+  lookup(hostname, { all: true }, (error, addresses) => {
+    if (error !== null) {
+      callback(error, [])
+      return
+    }
+
+    if (addresses.length === 0 || addresses.some((entry) => isPrivateAddress(entry.address))) {
+      callback(new Error(`${hostname} resolves to a private address`), [])
+      return
+    }
+
+    const [first] = addresses as [LookupAddress]
+
+    if (options.all === true) {
+      callback(null, addresses)
+    } else {
+      callback(null, first.address, first.family)
+    }
+  })
+}
+
+function download(url: URL): Promise<{ body: string; maxAgeMs: number }> {
+  return new Promise((resolve, reject) => {
+    const req = request(
+      url,
+      { method: 'GET', headers: { accept: 'application/json' }, lookup: guardedLookup as never },
+      (res) => {
+        if (res.statusCode !== 200) {
+          res.destroy()
+          reject(new Error(`answered ${res.statusCode}`))
+          return
+        }
+
+        const chunks: Buffer[] = []
+        let size = 0
+
+        res.on('data', (chunk: Buffer) => {
+          size += chunk.length
+
+          if (size > MAX_BYTES) {
+            res.destroy(new Error(`is larger than ${MAX_BYTES} bytes`))
+          } else {
+            chunks.push(chunk)
+          }
+        })
+        res.on('error', reject)
+        res.on('end', () => {
+          const maxAge = /max-age=(\d+)/.exec(res.headers['cache-control'] ?? '')?.[1]
+          const cacheable = !/no-store|no-cache/.test(res.headers['cache-control'] ?? '')
+
+          resolve({
+            body: Buffer.concat(chunks).toString('utf8'),
+            maxAgeMs:
+              cacheable && maxAge !== undefined ? Math.min(Number(maxAge) * 1000, MAX_CACHE_MS) : 0,
+          })
+        })
+      },
+    )
+
+    req.setTimeout(TIMEOUT_MS, () => req.destroy(new Error('timed out')))
+    req.on('error', reject)
+    req.end()
+  })
+}
+
+export class HttpsClientMetadata implements ClientMetadataSource {
+  private readonly cache = new Map<string, { metadata: ClientMetadata; until: number }>()
+
+  async read(clientId: string): Promise<ClientMetadata> {
+    const cached = this.cache.get(clientId)
+
+    if (cached !== undefined && cached.until > Date.now()) {
+      return cached.metadata
+    }
+
+    const url = clientUrl(clientId)
+    const host = url.hostname.replace(/^\[|\]$/g, '')
+
+    // A literal address is connected to directly, without the lookup that guards a name.
+    if (isIP(host) !== 0 && isPrivateAddress(host)) {
+      fail('client_id points at a private address')
+    }
+
+    const { body, maxAgeMs } = await download(url).catch((error: Error) =>
+      fail(`The client metadata document could not be read: ${error.message}`),
+    )
+    const parsed = documentSchema.safeParse(parseJson(body))
+
+    if (!parsed.success) {
+      fail('The client metadata document is not a valid public client description')
+    }
+
+    if (parsed.data.client_id !== clientId) {
+      fail('The client metadata document names another client_id')
+    }
+
+    if (!parsed.data.redirect_uris.every(isAllowedRedirect)) {
+      fail('Every redirect URI must be https, or http to localhost')
+    }
+
+    const metadata = {
+      clientId,
+      clientName: parsed.data.client_name,
+      redirectUris: parsed.data.redirect_uris,
+    }
+
+    // Only a valid document is kept, and only as long as its server says it may be.
+    if (maxAgeMs > 0) {
+      this.cache.set(clientId, { metadata, until: Date.now() + maxAgeMs })
+    }
+
+    return metadata
+  }
+}

package/templates/api/test/domain/auth/entities/session.entity.spec.ts

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest'
+import { ROTATION_GRACE_MS, Session } from '@/domain/auth/entities/session.entity'
+
+const NOW = new Date('2026-10-02T12:00:00Z')
+const later = (ms: number) => new Date(NOW.getTime() + ms)
+
+describe('Session', () => {
+  it('accepts the current token, and after a rotation only the new one', () => {
+    const session = new Session('user-1', 'first', NOW)
+
+    expect(session.check('first', NOW)).toBe('valid')
+
+    session.rotate('second', later(1000))
+
+    expect(session.check('second', later(2000))).toBe('valid')
+  })
+
+  it('tells a token rotated a moment ago from one kept and replayed', () => {
+    const session = new Session('user-1', 'first', NOW)
+
+    session.rotate('second', NOW)
+
+    expect(session.check('first', later(ROTATION_GRACE_MS - 1))).toBe('superseded')
+    expect(session.check('first', later(ROTATION_GRACE_MS))).toBe('reused')
+    expect(session.check('never-issued', NOW)).toBe('reused')
+  })
+
+  it('refuses every token once revoked or expired', () => {
+    const revoked = new Session('user-1', 'first', NOW)
+    revoked.revoke(NOW)
+
+    expect(revoked.check('first', NOW)).toBe('expired')
+    expect(new Session('user-1', 'first', NOW).check('first', later(31 * 86_400_000))).toBe(
+      'expired',
+    )
+  })
+
+  it('reads back the refresh token it writes, and nothing malformed', () => {
+    const session = new Session('user-1', 'hash', NOW)
+    session.id = '0199a7e2-0000-7000-8000-000000000000'
+
+    expect(Session.parseRefreshToken(session.refreshToken('s3cret'))).toEqual({
+      sessionId: session.id,
+      secret: 's3cret',
+    })
+    for (const token of ['', 'no-dot', 'not-a-uuid.secret', `${session.id}.`]) {
+      expect(Session.parseRefreshToken(token), token).toBeNull()
+    }
+  })
+})

package/templates/api/test/domain/auth/use-cases/refresh-session.use-case.spec.ts

@@ -0,0 +1,66 @@
+import { authFakes } from '@test/support/fakes/auth-fakes'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ROTATION_GRACE_MS } from '@/domain/auth/entities/session.entity'
+import { InvalidSessionError } from '@/domain/auth/errors/invalid-session.error'
+import { SupersededTokenError } from '@/domain/auth/errors/superseded-token.error'
+
+const ANA = { name: 'Ana', email: 'ana@example.com', password: 'correct-horse-battery' }
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('RefreshSessionUseCase', () => {
+  it('rotates the refresh token on every use', async () => {
+    const { signUp, refresh } = authFakes()
+    const first = await signUp.execute(ANA)
+
+    const second = await refresh.execute(first.refreshToken)
+    const third = await refresh.execute(second.refreshToken)
+
+    expect(new Set([first.refreshToken, second.refreshToken, third.refreshToken]).size).toBe(3)
+  })
+
+  it('asks a client that lost a race to retry, and revokes nothing', async () => {
+    const { signUp, refresh, sessions } = authFakes()
+    const first = await signUp.execute(ANA)
+
+    const second = await refresh.execute(first.refreshToken)
+
+    await expect(refresh.execute(first.refreshToken)).rejects.toBeInstanceOf(SupersededTokenError)
+    expect([...sessions.rows.values()][0]?.revokedAt).toBeNull()
+    await expect(refresh.execute(second.refreshToken)).resolves.toBeDefined()
+  })
+
+  it('ends the session when a token comes back after the grace period', async () => {
+    vi.useFakeTimers()
+    const { signUp, refresh, sessions } = authFakes()
+    const first = await signUp.execute(ANA)
+    const second = await refresh.execute(first.refreshToken)
+
+    vi.advanceTimersByTime(ROTATION_GRACE_MS)
+
+    await expect(refresh.execute(first.refreshToken)).rejects.toBeInstanceOf(InvalidSessionError)
+    expect([...sessions.rows.values()][0]?.revokedAt).not.toBeNull()
+    // The thief's replay also locked out the rightful client: that is the point.
+    await expect(refresh.execute(second.refreshToken)).rejects.toBeInstanceOf(InvalidSessionError)
+  })
+
+  it('refuses a token that names no session or is not one at all', async () => {
+    const { refresh } = authFakes()
+
+    for (const token of ['garbage', '0199a7e2-0000-7000-8000-000000000000.secret']) {
+      await expect(refresh.execute(token), token).rejects.toBeInstanceOf(InvalidSessionError)
+    }
+  })
+
+  it('refuses every token of a session signed out of', async () => {
+    const { signUp, signOut, refresh, sessions } = authFakes()
+    const tokens = await signUp.execute(ANA)
+    const session = [...sessions.rows.values()][0]
+
+    await signOut.execute(session?.userId ?? '', session?.id ?? '')
+
+    await expect(refresh.execute(tokens.refreshToken)).rejects.toBeInstanceOf(InvalidSessionError)
+  })
+})

package/templates/api/test/domain/auth/use-cases/sign-in.use-case.spec.ts

@@ -0,0 +1,29 @@
+import { authFakes } from '@test/support/fakes/auth-fakes'
+import { describe, expect, it } from 'vitest'
+import { InvalidCredentialsError } from '@/domain/auth/errors/invalid-credentials.error'
+
+const ANA = { name: 'Ana', email: 'ana@example.com', password: 'correct-horse-battery' }
+
+describe('SignInUseCase', () => {
+  it('starts a session for the right password, whatever the case of the email', async () => {
+    const { signUp, signIn, sessions } = authFakes()
+    await signUp.execute(ANA)
+
+    await signIn.execute({ email: 'ANA@example.com', password: ANA.password })
+
+    expect(sessions.rows.size).toBe(2)
+  })
+
+  it('answers a wrong password and an unknown email alike, after checking a password both times', async () => {
+    const { signUp, signIn, hasher } = authFakes()
+    await signUp.execute(ANA)
+
+    await expect(signIn.execute({ email: ANA.email, password: 'wrong' })).rejects.toBeInstanceOf(
+      InvalidCredentialsError,
+    )
+    await expect(
+      signIn.execute({ email: 'nobody@example.com', password: ANA.password }),
+    ).rejects.toBeInstanceOf(InvalidCredentialsError)
+    expect(hasher.verifications).toBe(2)
+  })
+})

package/templates/api/test/domain/auth/use-cases/sign-up.use-case.spec.ts

@@ -0,0 +1,33 @@
+import { authFakes } from '@test/support/fakes/auth-fakes'
+import { describe, expect, it } from 'vitest'
+import { EmailTakenError } from '@/domain/auth/errors/email-taken.error'
+
+const ANA = { name: 'Ana', email: ' Ana@Example.com', password: 'correct-horse-battery' }
+
+describe('SignUpUseCase', () => {
+  it('creates the user and the profile together, and starts a session', async () => {
+    const { signUp, users, profiles, sessions } = authFakes()
+
+    const tokens = await signUp.execute(ANA)
+    const [user] = [...users.rows.values()]
+
+    expect(user).toMatchObject({
+      email: 'ana@example.com',
+      passwordHash: 'hashed:correct-horse-battery',
+    })
+    expect(profiles.rows.get(user?.id ?? '')).toMatchObject({ displayName: 'Ana' })
+    expect(sessions.rows.size).toBe(1)
+    expect(tokens.refreshToken.startsWith(`${[...sessions.rows.keys()][0]}.`)).toBe(true)
+  })
+
+  it('refuses an email already taken, whatever its case', async () => {
+    const { signUp, profiles } = authFakes()
+
+    await signUp.execute(ANA)
+
+    await expect(signUp.execute({ ...ANA, email: 'ana@example.COM' })).rejects.toBeInstanceOf(
+      EmailTakenError,
+    )
+    expect(profiles.rows.size).toBe(1)
+  })
+})

package/templates/api/test/domain/oauth/entities/authorization.entity.spec.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AUTHORIZATION_CODE_LIFETIME_MS,
+  AUTHORIZATION_REQUEST_LIFETIME_MS,
+  Authorization,
+} from '@/domain/oauth/entities/authorization.entity'
+
+const NOW = new Date('2026-10-02T12:00:00Z')
+const later = (ms: number) => new Date(NOW.getTime() + ms)
+
+const request = {
+  clientId: 'https://client.example.com/client.json',
+  clientName: 'Client',
+  redirectUri: 'https://client.example.com/callback',
+  codeChallenge: 'challenge',
+  clientState: null,
+  resource: 'http://localhost:3000/api/mcp',
+}
+
+describe('Authorization', () => {
+  it('waits for an answer until the request expires', () => {
+    const authorization = new Authorization(request, NOW)
+
+    expect(authorization.isPending(later(AUTHORIZATION_REQUEST_LIFETIME_MS - 1))).toBe(true)
+    expect(authorization.isPending(later(AUTHORIZATION_REQUEST_LIFETIME_MS))).toBe(false)
+  })
+
+  it('gives an approved code one minute, and no second exchange', () => {
+    const authorization = new Authorization(request, NOW)
+
+    authorization.approve('user-1', 'hash', NOW)
+
+    expect(authorization.isPending(NOW)).toBe(false)
+    expect(authorization.isRedeemable(later(AUTHORIZATION_CODE_LIFETIME_MS - 1))).toBe(true)
+    expect(authorization.isRedeemable(later(AUTHORIZATION_CODE_LIFETIME_MS))).toBe(false)
+
+    authorization.exchange('session-1')
+
+    expect(authorization.isRedeemable(NOW)).toBe(false)
+  })
+
+  it('reads back the code it writes, and nothing malformed', () => {
+    const authorization = new Authorization(request, NOW)
+    authorization.id = '0199a7e2-0000-7000-8000-000000000000'
+
+    expect(Authorization.parseCode(authorization.code('s3cret'))).toEqual({
+      authorizationId: authorization.id,
+      secret: 's3cret',
+    })
+    expect(Authorization.parseCode('nonsense')).toBeNull()
+  })
+})

package/templates/api/test/infra/auth/argon2-password-hasher.adapter.spec.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { Argon2PasswordHasher } from '@/infra/auth/argon2-password-hasher.adapter'
+
+describe('Argon2PasswordHasher', () => {
+  it('stores Argon2id with OWASP’s minimum, and verifies only the right password', async () => {
+    const hasher = new Argon2PasswordHasher()
+    const stored = await hasher.hash('correct-horse-battery')
+
+    expect(stored).toMatch(/^\$argon2id\$v=19\$m=19456,t=2,p=1\$/)
+    expect(await hasher.verify(stored, 'correct-horse-battery')).toBe(true)
+    expect(await hasher.verify(stored, 'wrong')).toBe(false)
+  })
+
+  it('answers false without a hash, after doing the same work', async () => {
+    expect(await new Argon2PasswordHasher().verify(undefined, 'anything')).toBe(false)
+  })
+})

package/templates/api/test/infra/auth/jose-access-tokens.adapter.spec.ts

@@ -0,0 +1,57 @@
+import { SignJWT, UnsecuredJWT } from 'jose'
+import { describe, expect, it } from 'vitest'
+import { JoseAccessTokens } from '@/infra/auth/jose-access-tokens.adapter'
+
+const ENV = {
+  JWT_SECRET: 'a-secret-that-is-at-least-32-characters',
+  API_URL: 'http://localhost:3000',
+}
+const CLAIMS = { userId: '0199a7e2-0000-7000-8000-000000000001', sessionId: 'session-1' }
+const inAMinute = () => new Date(Date.now() + 60_000)
+
+describe('JoseAccessTokens', () => {
+  it('reads back the claims of a token it issued', async () => {
+    const tokens = new JoseAccessTokens(ENV)
+    const { token } = await tokens.issue(CLAIMS, inAMinute())
+
+    expect(await tokens.verify(token)).toEqual(CLAIMS)
+  })
+
+  it('refuses an expired token, another secret, another issuer and garbage', async () => {
+    const tokens = new JoseAccessTokens(ENV)
+    const expired = await tokens.issue(CLAIMS, new Date(Date.now() - 1000))
+    const otherSecret = await new JoseAccessTokens({ ...ENV, JWT_SECRET: 'x'.repeat(40) }).issue(
+      CLAIMS,
+      inAMinute(),
+    )
+    const otherIssuer = await new JoseAccessTokens({ ...ENV, API_URL: 'https://elsewhere' }).issue(
+      CLAIMS,
+      inAMinute(),
+    )
+
+    for (const token of [expired.token, otherSecret.token, otherIssuer.token, 'not.a.jwt']) {
+      expect(await tokens.verify(token)).toBeNull()
+    }
+  })
+
+  it('refuses a token that names no algorithm or another one', async () => {
+    const tokens = new JoseAccessTokens(ENV)
+    const claims = { sid: CLAIMS.sessionId }
+    const unsigned = new UnsecuredJWT(claims)
+      .setSubject(CLAIMS.userId)
+      .setIssuer(ENV.API_URL)
+      .setAudience(ENV.API_URL)
+      .setExpirationTime('1m')
+      .encode()
+    const hs512 = await new SignJWT(claims)
+      .setProtectedHeader({ alg: 'HS512' })
+      .setSubject(CLAIMS.userId)
+      .setIssuer(ENV.API_URL)
+      .setAudience(ENV.API_URL)
+      .setExpirationTime('1m')
+      .sign(new TextEncoder().encode(`${ENV.JWT_SECRET}${'-'.repeat(32)}`))
+
+    expect(await tokens.verify(unsigned)).toBeNull()
+    expect(await tokens.verify(hs512)).toBeNull()
+  })
+})

package/templates/api/test/infra/database/mikroorm/mikro-orm.factory.spec.ts

@@ -2,7 +2,7 @@ import { testOrm } from '@test/support/setup'
 import { describe, expect, it } from 'vitest'
 
 describe('createOrmConfig', () => {
-  it('finds nothing to change once migrated, and leaves Better Auth’s schema alone', async () => {
+  it('finds nothing to change once migrated', async () => {
     await expect(testOrm().schema.getUpdateSchemaSQL({ wrap: false })).resolves.toBe('')
   })
 })

package/templates/api/test/infra/database/mikroorm/repositories/mikroorm-user.repository.spec.ts

@@ -0,0 +1,28 @@
+import { testOrm } from '@test/support/setup'
+import { describe, expect, it } from 'vitest'
+import { User } from '@/domain/auth/entities/user.entity'
+import { EmailTakenError } from '@/domain/auth/errors/email-taken.error'
+import { MikroOrmUserRepository } from '@/infra/database/mikroorm/repositories/mikroorm-user.repository'
+
+describe('MikroOrmUserRepository', () => {
+  it('finds a user by its normalized email', async () => {
+    const repository = new MikroOrmUserRepository(testOrm().em.fork())
+    const user = new User('Ana@Example.com', 'hash')
+
+    await repository.save(user)
+
+    expect(
+      await new MikroOrmUserRepository(testOrm().em.fork()).findByEmail('ana@example.com'),
+    ).toMatchObject({
+      id: user.id,
+    })
+  })
+
+  it('turns the unique index into EmailTakenError when two sign-ups race', async () => {
+    await new MikroOrmUserRepository(testOrm().em.fork()).save(new User('ana@example.com', 'hash'))
+
+    await expect(
+      new MikroOrmUserRepository(testOrm().em.fork()).save(new User('ana@example.com', 'hash')),
+    ).rejects.toBeInstanceOf(EmailTakenError)
+  })
+})