@stjoseph/prumo 0.2.0 → 0.4.0

package/templates/api/src/infra/oauth/https-client-metadata.adapter.ts

@@ -0,0 +1,231 @@
+import { type LookupAddress, lookup } from 'node:dns'
+import { request } from 'node:https'
+import { BlockList, isIP } from 'node:net'
+import { z } from 'zod'
+import { InvalidClientError } from '@/domain/oauth/errors/invalid-client.error'
+import type {
+  ClientMetadata,
+  ClientMetadataSource,
+} from '@/domain/oauth/ports/client-metadata.port'
+
+// The draft's recommended ceiling: a description of a client has no reason to be larger.
+const MAX_BYTES = 5 * 1024
+const TIMEOUT_MS = 5000
+const MAX_CACHE_MS = 60 * 60 * 1000
+
+// Anything that is not the public internet. The client chooses the URL, so without this list it could make the API
+// read its own network.
+const PRIVATE = new BlockList()
+
+for (const [network, prefix] of [
+  ['0.0.0.0', 8],
+  ['10.0.0.0', 8],
+  ['100.64.0.0', 10],
+  ['127.0.0.0', 8],
+  ['169.254.0.0', 16],
+  ['172.16.0.0', 12],
+  ['192.0.0.0', 24],
+  ['192.0.2.0', 24],
+  ['192.168.0.0', 16],
+  ['198.18.0.0', 15],
+  ['198.51.100.0', 24],
+  ['203.0.113.0', 24],
+  ['224.0.0.0', 4],
+  ['240.0.0.0', 4],
+] as const) {
+  PRIVATE.addSubnet(network, prefix, 'ipv4')
+}
+
+// An IPv4-mapped address (::ffff:127.0.0.1) is checked against the IPv4 rules by BlockList itself; a rule for the
+// whole mapped range would match every IPv4 address, public ones included.
+for (const [network, prefix] of [
+  ['::', 127],
+  ['64:ff9b::', 96],
+  ['100::', 64],
+  ['2001:db8::', 32],
+  ['fc00::', 7],
+  ['fe80::', 10],
+  ['ff00::', 8],
+] as const) {
+  PRIVATE.addSubnet(network, prefix, 'ipv6')
+}
+
+export function isPrivateAddress(address: string): boolean {
+  return PRIVATE.check(address, isIP(address) === 6 ? 'ipv6' : 'ipv4')
+}
+
+const documentSchema = z.object({
+  client_id: z.string(),
+  client_name: z.string().trim().min(1).max(200),
+  redirect_uris: z.array(z.string()).min(1).max(20),
+  // A document is public by nature, so it cannot hold a secret, and a key-based method is not supported here.
+  token_endpoint_auth_method: z.literal('none').optional(),
+  client_secret: z.never().optional(),
+  client_secret_expires_at: z.never().optional(),
+})
+
+function parseJson(text: string): unknown {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return undefined
+  }
+}
+
+function fail(message: string): never {
+  throw new InvalidClientError(message)
+}
+
+// https, a path, no credentials, no query, no fragment, no dot segments: and written exactly as the URL parser
+// would write it, since the document's client_id is compared to it character by character.
+function clientUrl(clientId: string): URL {
+  const url = URL.canParse(clientId) ? new URL(clientId) : fail('client_id is not a URL')
+
+  if (
+    url.protocol !== 'https:' ||
+    url.username !== '' ||
+    url.password !== '' ||
+    url.search !== '' ||
+    url.hash !== '' ||
+    url.pathname === '/' ||
+    url.href !== clientId
+  ) {
+    fail('client_id must be a canonical https URL with a path, and nothing else')
+  }
+
+  return url
+}
+
+// HTTPS anywhere, or plain HTTP back to this device, as MCP allows for native clients.
+function isAllowedRedirect(uri: string): boolean {
+  if (!URL.canParse(uri)) {
+    return false
+  }
+
+  const url = new URL(uri)
+  const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)
+
+  return url.hash === '' && (url.protocol === 'https:' || (url.protocol === 'http:' && loopback))
+}
+
+// The connection goes to the address checked here, so a name that resolves differently a second time cannot reach
+// the private network after passing.
+function guardedLookup(
+  hostname: string,
+  options: { all?: boolean },
+  callback: (error: Error | null, address: string | LookupAddress[], family?: number) => void,
+): void {
+  lookup(hostname, { all: true }, (error, addresses) => {
+    if (error !== null) {
+      callback(error, [])
+      return
+    }
+
+    if (addresses.length === 0 || addresses.some((entry) => isPrivateAddress(entry.address))) {
+      callback(new Error(`${hostname} resolves to a private address`), [])
+      return
+    }
+
+    const [first] = addresses as [LookupAddress]
+
+    if (options.all === true) {
+      callback(null, addresses)
+    } else {
+      callback(null, first.address, first.family)
+    }
+  })
+}
+
+function download(url: URL): Promise<{ body: string; maxAgeMs: number }> {
+  return new Promise((resolve, reject) => {
+    const req = request(
+      url,
+      { method: 'GET', headers: { accept: 'application/json' }, lookup: guardedLookup as never },
+      (res) => {
+        if (res.statusCode !== 200) {
+          res.destroy()
+          reject(new Error(`answered ${res.statusCode}`))
+          return
+        }
+
+        const chunks: Buffer[] = []
+        let size = 0
+
+        res.on('data', (chunk: Buffer) => {
+          size += chunk.length
+
+          if (size > MAX_BYTES) {
+            res.destroy(new Error(`is larger than ${MAX_BYTES} bytes`))
+          } else {
+            chunks.push(chunk)
+          }
+        })
+        res.on('error', reject)
+        res.on('end', () => {
+          const maxAge = /max-age=(\d+)/.exec(res.headers['cache-control'] ?? '')?.[1]
+          const cacheable = !/no-store|no-cache/.test(res.headers['cache-control'] ?? '')
+
+          resolve({
+            body: Buffer.concat(chunks).toString('utf8'),
+            maxAgeMs:
+              cacheable && maxAge !== undefined ? Math.min(Number(maxAge) * 1000, MAX_CACHE_MS) : 0,
+          })
+        })
+      },
+    )
+
+    req.setTimeout(TIMEOUT_MS, () => req.destroy(new Error('timed out')))
+    req.on('error', reject)
+    req.end()
+  })
+}
+
+export class HttpsClientMetadata implements ClientMetadataSource {
+  private readonly cache = new Map<string, { metadata: ClientMetadata; until: number }>()
+
+  async read(clientId: string): Promise<ClientMetadata> {
+    const cached = this.cache.get(clientId)
+
+    if (cached !== undefined && cached.until > Date.now()) {
+      return cached.metadata
+    }
+
+    const url = clientUrl(clientId)
+    const host = url.hostname.replace(/^\[|\]$/g, '')
+
+    // A literal address is connected to directly, without the lookup that guards a name.
+    if (isIP(host) !== 0 && isPrivateAddress(host)) {
+      fail('client_id points at a private address')
+    }
+
+    const { body, maxAgeMs } = await download(url).catch((error: Error) =>
+      fail(`The client metadata document could not be read: ${error.message}`),
+    )
+    const parsed = documentSchema.safeParse(parseJson(body))
+
+    if (!parsed.success) {
+      fail('The client metadata document is not a valid public client description')
+    }
+
+    if (parsed.data.client_id !== clientId) {
+      fail('The client metadata document names another client_id')
+    }
+
+    if (!parsed.data.redirect_uris.every(isAllowedRedirect)) {
+      fail('Every redirect URI must be https, or http to localhost')
+    }
+
+    const metadata = {
+      clientId,
+      clientName: parsed.data.client_name,
+      redirectUris: parsed.data.redirect_uris,
+    }
+
+    // Only a valid document is kept, and only as long as its server says it may be.
+    if (maxAgeMs > 0) {
+      this.cache.set(clientId, { metadata, until: Date.now() + maxAgeMs })
+    }
+
+    return metadata
+  }
+}

package/templates/api/src/infra/social/openid-identity-providers.adapter.ts

@@ -0,0 +1,199 @@
+import { importPKCS8, SignJWT } from 'jose'
+import * as oidc from 'openid-client'
+import { SocialSignInFailedError } from '@/domain/auth/errors/social-sign-in-failed.error'
+import type {
+  IdentityProviders,
+  ProviderCallback,
+  ProviderName,
+  ProviderProfile,
+  ProviderRedirect,
+} from '@/domain/auth/ports/identity-providers.port'
+import { DomainError } from '@/domain/shared/errors/domain-error'
+import type { Env } from '@/infra/config/env'
+
+type Settings = {
+  issuer: URL
+  clientId: string
+  scope: string
+  // Apple answers with a POST when the email is asked for; Google redirects back with a GET.
+  formPost: boolean
+  secret: () => Promise<string>
+}
+
+type Options = {
+  // A test points a provider at a local issuer, over plain HTTP.
+  issuers?: Partial<Record<ProviderName, URL>>
+  insecure?: boolean
+}
+
+// Apple accepts a client secret valid for up to six months; one hour keeps a leaked one short-lived.
+const SECRET_LIFETIME_MS = 60 * 60 * 1000
+
+export class OpenIdIdentityProviders implements IdentityProviders {
+  private readonly configurations = new Map<
+    ProviderName,
+    { configuration: oidc.Configuration; until: number }
+  >()
+
+  constructor(
+    private readonly env: Env,
+    private readonly options: Options = {},
+  ) {}
+
+  private settings(provider: ProviderName): Settings | null {
+    const { env } = this
+    const issuer = (fallback: string) => this.options.issuers?.[provider] ?? new URL(fallback)
+
+    switch (provider) {
+      // prumo:google
+      case 'google': {
+        const secret = env.GOOGLE_CLIENT_SECRET
+
+        return env.GOOGLE_CLIENT_ID === undefined || secret === undefined
+          ? null
+          : {
+              issuer: issuer('https://accounts.google.com'),
+              clientId: env.GOOGLE_CLIENT_ID,
+              scope: 'openid email profile',
+              formPost: false,
+              secret: async () => secret,
+            }
+      }
+      // prumo:end-google
+      // prumo:apple
+      case 'apple': {
+        const { APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_PRIVATE_KEY } = env
+
+        if (
+          APPLE_CLIENT_ID === undefined ||
+          APPLE_TEAM_ID === undefined ||
+          APPLE_KEY_ID === undefined ||
+          APPLE_PRIVATE_KEY === undefined
+        ) {
+          return null
+        }
+
+        return {
+          issuer: issuer('https://appleid.apple.com'),
+          clientId: APPLE_CLIENT_ID,
+          scope: 'openid email name',
+          formPost: true,
+          // Apple's client secret is a JWT signed with the team's .p8 key, not a string it hands out.
+          secret: async () =>
+            new SignJWT({})
+              .setProtectedHeader({ alg: 'ES256', kid: APPLE_KEY_ID })
+              .setIssuer(APPLE_TEAM_ID)
+              .setSubject(APPLE_CLIENT_ID)
+              .setAudience('https://appleid.apple.com')
+              .setIssuedAt()
+              .setExpirationTime(Math.floor((Date.now() + SECRET_LIFETIME_MS) / 1000))
+              .sign(await importPKCS8(APPLE_PRIVATE_KEY.replaceAll('\\n', '\n'), 'ES256')),
+        }
+      }
+      // prumo:end-apple
+    }
+
+    return null
+  }
+
+  private redirectUri(provider: ProviderName): string {
+    return `${this.env.API_URL}/api/auth/social/${provider}/callback`
+  }
+
+  private async configuration(provider: ProviderName, settings: Settings) {
+    const cached = this.configurations.get(provider)
+
+    if (cached !== undefined && cached.until > Date.now()) {
+      return cached.configuration
+    }
+
+    const configuration = await oidc.discovery(
+      settings.issuer,
+      settings.clientId,
+      undefined,
+      oidc.ClientSecretPost(await settings.secret()),
+      { execute: this.options.insecure === true ? [oidc.allowInsecureRequests] : [] },
+    )
+
+    // Renewed before the secret it was built with expires.
+    this.configurations.set(provider, {
+      configuration,
+      until: Date.now() + SECRET_LIFETIME_MS / 2,
+    })
+
+    return configuration
+  }
+
+  isConfigured(provider: ProviderName): boolean {
+    return this.settings(provider) !== null
+  }
+
+  async redirect(provider: ProviderName, state: string): Promise<ProviderRedirect> {
+    const settings = this.settings(provider)
+
+    if (settings === null) {
+      throw new SocialSignInFailedError(`Sign-in with ${provider} is not configured`)
+    }
+
+    const configuration = await this.configuration(provider, settings)
+    const nonce = oidc.randomNonce()
+    // PKCE where the provider says it takes it: Google does, Apple's metadata names none, and relies on state and nonce.
+    const codeVerifier = configuration.serverMetadata().supportsPKCE()
+      ? oidc.randomPKCECodeVerifier()
+      : null
+    const url = oidc.buildAuthorizationUrl(configuration, {
+      redirect_uri: this.redirectUri(provider),
+      scope: settings.scope,
+      state,
+      nonce,
+      ...(codeVerifier !== null && {
+        code_challenge: await oidc.calculatePKCECodeChallenge(codeVerifier),
+        code_challenge_method: 'S256',
+      }),
+      ...(settings.formPost && { response_mode: 'form_post' }),
+    })
+
+    return { url: url.href, codeVerifier, nonce }
+  }
+
+  async profile(provider: ProviderName, callback: ProviderCallback): Promise<ProviderProfile> {
+    const settings = this.settings(provider)
+
+    if (settings === null) {
+      throw new SocialSignInFailedError(`Sign-in with ${provider} is not configured`)
+    }
+
+    try {
+      const tokens = await oidc.authorizationCodeGrant(
+        await this.configuration(provider, settings),
+        callback.callbackUrl,
+        {
+          expectedState: callback.state,
+          expectedNonce: callback.nonce,
+          idTokenExpected: true,
+          ...(callback.codeVerifier !== null && { pkceCodeVerifier: callback.codeVerifier }),
+        },
+      )
+      // Read only after openid-client checked the ID token's signature, issuer, audience, expiry and nonce.
+      const claims = tokens.claims()
+
+      if (claims === undefined || typeof claims.email !== 'string') {
+        throw new SocialSignInFailedError('The provider did not share an email address')
+      }
+
+      return {
+        subject: claims.sub,
+        email: claims.email,
+        // Apple writes it as the string "true".
+        emailVerified: claims.email_verified === true || claims.email_verified === 'true',
+        name: typeof claims.name === 'string' ? claims.name : callback.name,
+      }
+    } catch (error) {
+      if (error instanceof DomainError) {
+        throw error
+      }
+
+      throw new SocialSignInFailedError()
+    }
+  }
+}

package/templates/api/test/domain/auth/entities/session.entity.spec.ts

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest'
+import { ROTATION_GRACE_MS, Session } from '@/domain/auth/entities/session.entity'
+
+const NOW = new Date('2026-10-02T12:00:00Z')
+const later = (ms: number) => new Date(NOW.getTime() + ms)
+
+describe('Session', () => {
+  it('accepts the current token, and after a rotation only the new one', () => {
+    const session = new Session('user-1', 'first', NOW)
+
+    expect(session.check('first', NOW)).toBe('valid')
+
+    session.rotate('second', later(1000))
+
+    expect(session.check('second', later(2000))).toBe('valid')
+  })
+
+  it('tells a token rotated a moment ago from one kept and replayed', () => {
+    const session = new Session('user-1', 'first', NOW)
+
+    session.rotate('second', NOW)
+
+    expect(session.check('first', later(ROTATION_GRACE_MS - 1))).toBe('superseded')
+    expect(session.check('first', later(ROTATION_GRACE_MS))).toBe('reused')
+    expect(session.check('never-issued', NOW)).toBe('reused')
+  })
+
+  it('refuses every token once revoked or expired', () => {
+    const revoked = new Session('user-1', 'first', NOW)
+    revoked.revoke(NOW)
+
+    expect(revoked.check('first', NOW)).toBe('expired')
+    expect(new Session('user-1', 'first', NOW).check('first', later(31 * 86_400_000))).toBe(
+      'expired',
+    )
+  })
+
+  it('reads back the refresh token it writes, and nothing malformed', () => {
+    const session = new Session('user-1', 'hash', NOW)
+    session.id = '0199a7e2-0000-7000-8000-000000000000'
+
+    expect(Session.parseRefreshToken(session.refreshToken('s3cret'))).toEqual({
+      sessionId: session.id,
+      secret: 's3cret',
+    })
+    for (const token of ['', 'no-dot', 'not-a-uuid.secret', `${session.id}.`]) {
+      expect(Session.parseRefreshToken(token), token).toBeNull()
+    }
+  })
+})

package/templates/api/test/domain/auth/use-cases/email.use-case.spec.ts

@@ -0,0 +1,87 @@
+import { authFakes } from '@test/support/fakes/auth-fakes'
+import { describe, expect, it } from 'vitest'
+import { EMAIL_CODE_ATTEMPTS } from '@/domain/auth/entities/email-code.entity'
+import { EmailNotVerifiedError } from '@/domain/auth/errors/email-not-verified.error'
+import { InvalidCodeError } from '@/domain/auth/errors/invalid-code.error'
+
+const ANA = { name: 'Ana', email: 'ana@example.com', password: 'correct-horse-battery' }
+
+describe('email verification', () => {
+  it('refuses to sign in an unconfirmed account, and lets it in once confirmed', async () => {
+    const { signUp, signIn, verifyEmail, mailer } = authFakes()
+    await signUp.execute(ANA)
+
+    await expect(signIn.execute(ANA)).rejects.toBeInstanceOf(EmailNotVerifiedError)
+
+    await verifyEmail.execute({ email: ANA.email, code: mailer.lastCode(ANA.email) })
+
+    await expect(signIn.execute(ANA)).resolves.toBeDefined()
+  })
+
+  it('kills a code after five wrong guesses, even if the right one comes next', async () => {
+    const { signUp, verifyEmail, mailer } = authFakes()
+    await signUp.execute(ANA)
+    const code = mailer.lastCode(ANA.email)
+
+    for (let i = 0; i < EMAIL_CODE_ATTEMPTS; i += 1) {
+      await expect(
+        verifyEmail.execute({ email: ANA.email, code: '000000' }),
+      ).rejects.toBeInstanceOf(InvalidCodeError)
+    }
+
+    await expect(verifyEmail.execute({ email: ANA.email, code })).rejects.toBeInstanceOf(
+      InvalidCodeError,
+    )
+  })
+
+  it('answers an unknown email as it answers a wrong code', async () => {
+    const { verifyEmail } = authFakes()
+
+    await expect(
+      verifyEmail.execute({ email: 'nobody@example.com', code: '123456' }),
+    ).rejects.toBeInstanceOf(InvalidCodeError)
+  })
+})
+
+describe('password reset', () => {
+  it('sets the new password, ends every old session, and confirms the email it reached', async () => {
+    const { register, signIn, sessions, users, requestPasswordReset, resetPassword, mailer } =
+      authFakes()
+    await register(ANA)
+    await signIn.execute(ANA)
+
+    await requestPasswordReset.execute(ANA.email)
+    await resetPassword.execute({
+      email: ANA.email,
+      code: mailer.lastCode(ANA.email),
+      password: 'another-good-password',
+    })
+
+    const revoked = [...sessions.rows.values()].filter((session) => session.revokedAt !== null)
+    const [user] = [...users.rows.values()]
+
+    expect(revoked).toHaveLength(2)
+    expect(user?.passwordHash).toBe('hashed:another-good-password')
+    await expect(signIn.execute(ANA)).rejects.toThrow()
+  })
+
+  it('sends nothing for an unknown email, and says nothing about it either', async () => {
+    const { requestPasswordReset, mailer } = authFakes()
+
+    await expect(requestPasswordReset.execute('nobody@example.com')).resolves.toBeUndefined()
+    expect(mailer.sent).toEqual([])
+  })
+
+  it('voids the previous code when a new one is sent', async () => {
+    const { register, requestPasswordReset, resetPassword, mailer } = authFakes()
+    await register(ANA)
+
+    await requestPasswordReset.execute(ANA.email)
+    const first = mailer.lastCode(ANA.email)
+    await requestPasswordReset.execute(ANA.email)
+
+    await expect(
+      resetPassword.execute({ email: ANA.email, code: first, password: 'another-good-password' }),
+    ).rejects.toBeInstanceOf(InvalidCodeError)
+  })
+})

package/templates/api/test/domain/auth/use-cases/refresh-session.use-case.spec.ts

@@ -0,0 +1,66 @@
+import { authFakes } from '@test/support/fakes/auth-fakes'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ROTATION_GRACE_MS } from '@/domain/auth/entities/session.entity'
+import { InvalidSessionError } from '@/domain/auth/errors/invalid-session.error'
+import { SupersededTokenError } from '@/domain/auth/errors/superseded-token.error'
+
+const ANA = { name: 'Ana', email: 'ana@example.com', password: 'correct-horse-battery' }
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('RefreshSessionUseCase', () => {
+  it('rotates the refresh token on every use', async () => {
+    const { register, refresh } = authFakes()
+    const first = await register(ANA)
+
+    const second = await refresh.execute(first.refreshToken)
+    const third = await refresh.execute(second.refreshToken)
+
+    expect(new Set([first.refreshToken, second.refreshToken, third.refreshToken]).size).toBe(3)
+  })
+
+  it('asks a client that lost a race to retry, and revokes nothing', async () => {
+    const { register, refresh, sessions } = authFakes()
+    const first = await register(ANA)
+
+    const second = await refresh.execute(first.refreshToken)
+
+    await expect(refresh.execute(first.refreshToken)).rejects.toBeInstanceOf(SupersededTokenError)
+    expect([...sessions.rows.values()][0]?.revokedAt).toBeNull()
+    await expect(refresh.execute(second.refreshToken)).resolves.toBeDefined()
+  })
+
+  it('ends the session when a token comes back after the grace period', async () => {
+    vi.useFakeTimers()
+    const { register, refresh, sessions } = authFakes()
+    const first = await register(ANA)
+    const second = await refresh.execute(first.refreshToken)
+
+    vi.advanceTimersByTime(ROTATION_GRACE_MS)
+
+    await expect(refresh.execute(first.refreshToken)).rejects.toBeInstanceOf(InvalidSessionError)
+    expect([...sessions.rows.values()][0]?.revokedAt).not.toBeNull()
+    // The thief's replay also locked out the rightful client: that is the point.
+    await expect(refresh.execute(second.refreshToken)).rejects.toBeInstanceOf(InvalidSessionError)
+  })
+
+  it('refuses a token that names no session or is not one at all', async () => {
+    const { refresh } = authFakes()
+
+    for (const token of ['garbage', '0199a7e2-0000-7000-8000-000000000000.secret']) {
+      await expect(refresh.execute(token), token).rejects.toBeInstanceOf(InvalidSessionError)
+    }
+  })
+
+  it('refuses every token of a session signed out of', async () => {
+    const { register, signOut, refresh, sessions } = authFakes()
+    const tokens = await register(ANA)
+    const session = [...sessions.rows.values()][0]
+
+    await signOut.execute(session?.userId ?? '', session?.id ?? '')
+
+    await expect(refresh.execute(tokens.refreshToken)).rejects.toBeInstanceOf(InvalidSessionError)
+  })
+})

package/templates/api/test/domain/auth/use-cases/sign-in.use-case.spec.ts

@@ -0,0 +1,29 @@
+import { authFakes } from '@test/support/fakes/auth-fakes'
+import { describe, expect, it } from 'vitest'
+import { InvalidCredentialsError } from '@/domain/auth/errors/invalid-credentials.error'
+
+const ANA = { name: 'Ana', email: 'ana@example.com', password: 'correct-horse-battery' }
+
+describe('SignInUseCase', () => {
+  it('starts a session for the right password, whatever the case of the email', async () => {
+    const { register, signIn, sessions } = authFakes()
+    await register(ANA)
+
+    await signIn.execute({ email: 'ANA@example.com', password: ANA.password })
+
+    expect(sessions.rows.size).toBe(2)
+  })
+
+  it('answers a wrong password and an unknown email alike, after checking a password both times', async () => {
+    const { register, signIn, hasher } = authFakes()
+    await register(ANA)
+
+    await expect(signIn.execute({ email: ANA.email, password: 'wrong' })).rejects.toBeInstanceOf(
+      InvalidCredentialsError,
+    )
+    await expect(
+      signIn.execute({ email: 'nobody@example.com', password: ANA.password }),
+    ).rejects.toBeInstanceOf(InvalidCredentialsError)
+    expect(hasher.verifications).toBe(2)
+  })
+})