@stjoseph/prumo 0.2.0 → 0.4.0

package/templates/api/test/domain/auth/use-cases/sign-up.use-case.spec.ts

@@ -0,0 +1,41 @@
+import { authFakes } from '@test/support/fakes/auth-fakes'
+import { describe, expect, it } from 'vitest'
+import { EmailTakenError } from '@/domain/auth/errors/email-taken.error'
+
+const ANA = { name: 'Ana', email: ' Ana@Example.com', password: 'correct-horse-battery' }
+
+describe('SignUpUseCase', () => {
+  it('creates the user and the profile together', async () => {
+    const { signUp, users, profiles } = authFakes()
+
+    await signUp.execute(ANA)
+    const [user] = [...users.rows.values()]
+
+    expect(user).toMatchObject({
+      email: 'ana@example.com',
+      passwordHash: 'hashed:correct-horse-battery',
+    })
+    expect(profiles.rows.get(user?.id ?? '')).toMatchObject({ displayName: 'Ana' })
+  })
+
+  it('refuses an email already taken, whatever its case', async () => {
+    const { signUp, profiles } = authFakes()
+
+    await signUp.execute(ANA)
+
+    await expect(signUp.execute({ ...ANA, email: 'ana@example.COM' })).rejects.toBeInstanceOf(
+      EmailTakenError,
+    )
+    expect(profiles.rows.size).toBe(1)
+  })
+
+  // prumo:email
+  it('sends a code and opens no session until the email is confirmed', async () => {
+    const { signUp, sessions, mailer } = authFakes()
+
+    expect(await signUp.execute(ANA)).toBeNull()
+    expect(sessions.rows.size).toBe(0)
+    expect(mailer.lastCode('ana@example.com')).toMatch(/^\d{6}$/)
+  })
+  // prumo:end-email
+})

package/templates/api/test/domain/auth/use-cases/social.use-case.spec.ts

@@ -0,0 +1,148 @@
+import { socialFakes } from '@test/support/fakes/social-fakes'
+import { describe, expect, it } from 'vitest'
+import { ProviderEmailUnverifiedError } from '@/domain/auth/errors/provider-email-unverified.error'
+import { ProviderNotConfiguredError } from '@/domain/auth/errors/provider-not-configured.error'
+import { SocialSignInFailedError } from '@/domain/auth/errors/social-sign-in-failed.error'
+
+const ANA = { name: 'Ana', email: 'ana@example.com', password: 'correct-horse-battery' }
+const GOOGLE = {
+  subject: 'google-sub-1',
+  email: 'Ana@Example.com',
+  emailVerified: true,
+  name: 'Ana G',
+}
+
+describe('LinkIdentityUseCase', () => {
+  it('creates a verified, password-less account with its profile for someone new', async () => {
+    const { linkIdentity, users, profiles, identities } = socialFakes()
+
+    const userId = await linkIdentity.execute('google', GOOGLE)
+    const user = users.rows.get(userId)
+
+    expect(user).toMatchObject({ email: 'ana@example.com', passwordHash: null })
+    expect(user?.emailVerifiedAt).not.toBeNull()
+    expect(profiles.rows.get(userId)).toMatchObject({ displayName: 'Ana G' })
+    expect(identities.rows).toEqual([expect.objectContaining({ provider: 'google', userId })])
+  })
+
+  it('recognises the provider account the next time, by subject even if the email changed', async () => {
+    const { linkIdentity } = socialFakes()
+
+    const first = await linkIdentity.execute('google', GOOGLE)
+    const again = await linkIdentity.execute('google', { ...GOOGLE, email: 'new@example.com' })
+
+    expect(again).toBe(first)
+  })
+
+  it('links to a confirmed account and leaves its password alone', async () => {
+    const { register, linkIdentity, users, signIn } = socialFakes()
+    await register(ANA)
+    // Confirmed by a code where the project verifies emails; marked here so the rule is proved either way.
+    for (const user of users.rows.values()) {
+      user.verifyEmail(new Date())
+    }
+
+    const userId = await linkIdentity.execute('google', GOOGLE)
+
+    expect(users.rows.get(userId)?.passwordHash).toBe('hashed:correct-horse-battery')
+    await expect(signIn.execute(ANA)).resolves.toBeDefined()
+  })
+
+  // The attack: someone signs up with another person's email first, and waits for them to arrive by Google.
+  it('takes an unconfirmed account from whoever chose its password, ending their sessions', async () => {
+    const { signUp, linkIdentity, users, sessions } = socialFakes()
+    await signUp.execute(ANA)
+    const squatter = [...users.rows.values()][0]
+
+    const userId = await linkIdentity.execute('google', GOOGLE)
+
+    expect(userId).toBe(squatter?.id)
+    expect(users.rows.get(userId)?.passwordHash).toBeNull()
+    expect([...sessions.rows.values()].every((session) => session.revokedAt !== null)).toBe(true)
+  })
+
+  it('refuses an email the provider has not verified', async () => {
+    const { linkIdentity } = socialFakes()
+
+    await expect(
+      linkIdentity.execute('google', { ...GOOGLE, emailVerified: false }),
+    ).rejects.toBeInstanceOf(ProviderEmailUnverifiedError)
+  })
+})
+
+describe('a social sign-in, start to session', () => {
+  it('signs the web in on return, and only the browser that started', async () => {
+    const { start, complete } = socialFakes()
+    const { url, browserToken } = await start.execute({
+      provider: 'google',
+      client: 'web',
+      returnTo: '/orders',
+    })
+    const state = new URL(url).searchParams.get('state') ?? ''
+    const callback = {
+      provider: 'google' as const,
+      state,
+      callbackUrl: new URL('http://localhost:3000/cb'),
+      name: null,
+    }
+
+    await expect(complete.execute({ ...callback, browserToken: undefined })).rejects.toBeInstanceOf(
+      SocialSignInFailedError,
+    )
+
+    const outcome = await complete.execute({ ...callback, browserToken })
+
+    expect(outcome).toMatchObject({ client: 'web', returnTo: '/orders' })
+    await expect(complete.execute({ ...callback, browserToken })).rejects.toBeInstanceOf(
+      SocialSignInFailedError,
+    )
+  })
+
+  it('gives a mobile app a code it can exchange once', async () => {
+    const { start, complete, exchange } = socialFakes()
+    const { url, browserToken } = await start.execute({
+      provider: 'apple',
+      client: 'mobile',
+      returnTo: '/',
+    })
+    const outcome = await complete.execute({
+      provider: 'apple',
+      state: new URL(url).searchParams.get('state') ?? '',
+      browserToken,
+      callbackUrl: new URL('http://localhost:3000/cb'),
+      name: 'Ana',
+    })
+
+    if (outcome.client !== 'mobile') {
+      throw new Error('expected a code for the mobile app')
+    }
+
+    await expect(exchange.execute(outcome.code)).resolves.toBeDefined()
+    await expect(exchange.execute(outcome.code)).rejects.toBeInstanceOf(SocialSignInFailedError)
+  })
+
+  it('refuses a provider without credentials, and a callback for another provider', async () => {
+    const { start, complete, providers } = socialFakes()
+    const { url, browserToken } = await start.execute({
+      provider: 'google',
+      client: 'web',
+      returnTo: '/',
+    })
+
+    await expect(
+      complete.execute({
+        provider: 'apple',
+        state: new URL(url).searchParams.get('state') ?? '',
+        browserToken,
+        callbackUrl: new URL('http://localhost:3000/cb'),
+        name: null,
+      }),
+    ).rejects.toBeInstanceOf(SocialSignInFailedError)
+
+    Object.assign(providers, { configured: [] })
+
+    await expect(
+      start.execute({ provider: 'google', client: 'web', returnTo: '/' }),
+    ).rejects.toBeInstanceOf(ProviderNotConfiguredError)
+  })
+})

package/templates/api/test/domain/oauth/entities/authorization.entity.spec.ts

@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest'
+import {
+  AUTHORIZATION_CODE_LIFETIME_MS,
+  AUTHORIZATION_REQUEST_LIFETIME_MS,
+  Authorization,
+} from '@/domain/oauth/entities/authorization.entity'
+
+const NOW = new Date('2026-10-02T12:00:00Z')
+const later = (ms: number) => new Date(NOW.getTime() + ms)
+
+const request = {
+  clientId: 'https://client.example.com/client.json',
+  clientName: 'Client',
+  redirectUri: 'https://client.example.com/callback',
+  codeChallenge: 'challenge',
+  clientState: null,
+  resource: 'http://localhost:3000/api/mcp',
+  scope: 'profile:read',
+}
+
+describe('Authorization', () => {
+  it('waits for an answer until the request expires', () => {
+    const authorization = new Authorization(request, NOW)
+
+    expect(authorization.isPending(later(AUTHORIZATION_REQUEST_LIFETIME_MS - 1))).toBe(true)
+    expect(authorization.isPending(later(AUTHORIZATION_REQUEST_LIFETIME_MS))).toBe(false)
+  })
+
+  it('gives an approved code one minute, and no second exchange', () => {
+    const authorization = new Authorization(request, NOW)
+
+    authorization.approve('user-1', 'hash', NOW)
+
+    expect(authorization.isPending(NOW)).toBe(false)
+    expect(authorization.isRedeemable(later(AUTHORIZATION_CODE_LIFETIME_MS - 1))).toBe(true)
+    expect(authorization.isRedeemable(later(AUTHORIZATION_CODE_LIFETIME_MS))).toBe(false)
+
+    authorization.exchange('session-1')
+
+    expect(authorization.isRedeemable(NOW)).toBe(false)
+  })
+
+  it('reads back the code it writes, and nothing malformed', () => {
+    const authorization = new Authorization(request, NOW)
+    authorization.id = '0199a7e2-0000-7000-8000-000000000000'
+
+    expect(Authorization.parseCode(authorization.code('s3cret'))).toEqual({
+      authorizationId: authorization.id,
+      secret: 's3cret',
+    })
+    expect(Authorization.parseCode('nonsense')).toBeNull()
+  })
+})

package/templates/api/test/infra/auth/argon2-password-hasher.adapter.spec.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { Argon2PasswordHasher } from '@/infra/auth/argon2-password-hasher.adapter'
+
+describe('Argon2PasswordHasher', () => {
+  it('stores Argon2id with OWASP’s minimum, and verifies only the right password', async () => {
+    const hasher = new Argon2PasswordHasher()
+    const stored = await hasher.hash('correct-horse-battery')
+
+    expect(stored).toMatch(/^\$argon2id\$v=19\$m=19456,t=2,p=1\$/)
+    expect(await hasher.verify(stored, 'correct-horse-battery')).toBe(true)
+    expect(await hasher.verify(stored, 'wrong')).toBe(false)
+  })
+
+  it('answers false without a hash, after doing the same work', async () => {
+    expect(await new Argon2PasswordHasher().verify(undefined, 'anything')).toBe(false)
+  })
+})

package/templates/api/test/infra/auth/jose-access-tokens.adapter.spec.ts

@@ -0,0 +1,57 @@
+import { SignJWT, UnsecuredJWT } from 'jose'
+import { describe, expect, it } from 'vitest'
+import { JoseAccessTokens } from '@/infra/auth/jose-access-tokens.adapter'
+
+const ENV = {
+  JWT_SECRET: 'a-secret-that-is-at-least-32-characters',
+  API_URL: 'http://localhost:3000',
+}
+const CLAIMS = { userId: '0199a7e2-0000-7000-8000-000000000001', sessionId: 'session-1' }
+const inAMinute = () => new Date(Date.now() + 60_000)
+
+describe('JoseAccessTokens', () => {
+  it('reads back the claims of a token it issued', async () => {
+    const tokens = new JoseAccessTokens(ENV)
+    const { token } = await tokens.issue(CLAIMS, inAMinute())
+
+    expect(await tokens.verify(token)).toEqual(CLAIMS)
+  })
+
+  it('refuses an expired token, another secret, another issuer and garbage', async () => {
+    const tokens = new JoseAccessTokens(ENV)
+    const expired = await tokens.issue(CLAIMS, new Date(Date.now() - 1000))
+    const otherSecret = await new JoseAccessTokens({ ...ENV, JWT_SECRET: 'x'.repeat(40) }).issue(
+      CLAIMS,
+      inAMinute(),
+    )
+    const otherIssuer = await new JoseAccessTokens({ ...ENV, API_URL: 'https://elsewhere' }).issue(
+      CLAIMS,
+      inAMinute(),
+    )
+
+    for (const token of [expired.token, otherSecret.token, otherIssuer.token, 'not.a.jwt']) {
+      expect(await tokens.verify(token)).toBeNull()
+    }
+  })
+
+  it('refuses a token that names no algorithm or another one', async () => {
+    const tokens = new JoseAccessTokens(ENV)
+    const claims = { sid: CLAIMS.sessionId }
+    const unsigned = new UnsecuredJWT(claims)
+      .setSubject(CLAIMS.userId)
+      .setIssuer(ENV.API_URL)
+      .setAudience(ENV.API_URL)
+      .setExpirationTime('1m')
+      .encode()
+    const hs512 = await new SignJWT(claims)
+      .setProtectedHeader({ alg: 'HS512' })
+      .setSubject(CLAIMS.userId)
+      .setIssuer(ENV.API_URL)
+      .setAudience(ENV.API_URL)
+      .setExpirationTime('1m')
+      .sign(new TextEncoder().encode(`${ENV.JWT_SECRET}${'-'.repeat(32)}`))
+
+    expect(await tokens.verify(unsigned)).toBeNull()
+    expect(await tokens.verify(hs512)).toBeNull()
+  })
+})

package/templates/api/test/infra/database/mikroorm/mikro-orm.factory.spec.ts

@@ -2,7 +2,7 @@ import { testOrm } from '@test/support/setup'
 import { describe, expect, it } from 'vitest'
 
 describe('createOrmConfig', () => {
-  it('finds nothing to change once migrated, and leaves Better Auth’s schema alone', async () => {
+  it('finds nothing to change once migrated', async () => {
     await expect(testOrm().schema.getUpdateSchemaSQL({ wrap: false })).resolves.toBe('')
   })
 })

package/templates/api/test/infra/database/mikroorm/repositories/mikroorm-user.repository.spec.ts

@@ -0,0 +1,28 @@
+import { testOrm } from '@test/support/setup'
+import { describe, expect, it } from 'vitest'
+import { User } from '@/domain/auth/entities/user.entity'
+import { EmailTakenError } from '@/domain/auth/errors/email-taken.error'
+import { MikroOrmUserRepository } from '@/infra/database/mikroorm/repositories/mikroorm-user.repository'
+
+describe('MikroOrmUserRepository', () => {
+  it('finds a user by its normalized email', async () => {
+    const repository = new MikroOrmUserRepository(testOrm().em.fork())
+    const user = new User('Ana@Example.com', 'hash')
+
+    await repository.save(user)
+
+    expect(
+      await new MikroOrmUserRepository(testOrm().em.fork()).findByEmail('ana@example.com'),
+    ).toMatchObject({
+      id: user.id,
+    })
+  })
+
+  it('turns the unique index into EmailTakenError when two sign-ups race', async () => {
+    await new MikroOrmUserRepository(testOrm().em.fork()).save(new User('ana@example.com', 'hash'))
+
+    await expect(
+      new MikroOrmUserRepository(testOrm().em.fork()).save(new User('ana@example.com', 'hash')),
+    ).rejects.toBeInstanceOf(EmailTakenError)
+  })
+})

package/templates/api/test/infra/email/hmac-one-time-codes.adapter.spec.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest'
+import { HmacOneTimeCodes } from '@/infra/email/hmac-one-time-codes.adapter'
+
+describe('HmacOneTimeCodes', () => {
+  it('makes six digits, and a digest that depends on the secret', () => {
+    const codes = new HmacOneTimeCodes({ JWT_SECRET: 'a'.repeat(40) })
+    const other = new HmacOneTimeCodes({ JWT_SECRET: 'b'.repeat(40) })
+
+    for (let i = 0; i < 50; i += 1) {
+      expect(codes.create()).toMatch(/^\d{6}$/)
+    }
+    expect(codes.digest('123456')).toBe(codes.digest('123456'))
+    expect(codes.digest('123456')).not.toBe(other.digest('123456'))
+  })
+})

package/templates/api/test/infra/http/controllers/auth-email.controller.spec.ts

@@ -0,0 +1,92 @@
+import type { FakeMailer } from '@test/support/fakes/fake-mailer'
+import { ORIGIN, PASSWORD, testApp } from '@test/support/test-app'
+import type { FastifyInstance } from 'fastify'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+const BEARER = { 'x-auth-transport': 'bearer' }
+
+let app: FastifyInstance
+let mailer: FakeMailer
+
+const post = (
+  url: string,
+  payload: Record<string, string>,
+  headers: Record<string, string> = BEARER,
+) => app.inject({ method: 'POST', url, headers, payload })
+
+beforeEach(async () => {
+  ;({ app, mailer } = await testApp())
+})
+
+afterEach(async () => {
+  await app.close()
+})
+
+describe('email verification over HTTP', () => {
+  it('opens no session at sign-up, refuses sign-in, and signs in once the code is entered', async () => {
+    const email = 'ana@example.com'
+    const signUp = await post('/api/auth/sign-up', { name: 'Ana', email, password: PASSWORD })
+    const refused = await post('/api/auth/sign-in', { email, password: PASSWORD })
+
+    expect(signUp.statusCode).toBe(201)
+    expect(signUp.json()).toEqual({ verificationRequired: true })
+    expect(refused.statusCode).toBe(403)
+    expect(refused.json()).toMatchObject({ code: 'email_not_verified' })
+
+    await post('/api/auth/email/verification', { email })
+    const verified = await post('/api/auth/email/verify', { email, code: mailer.lastCode(email) })
+
+    expect(verified.statusCode).toBe(200)
+    expect(verified.json().accessToken).toEqual(expect.any(String))
+  })
+
+  it('delivers the web its cookies once the code is entered', async () => {
+    const email = 'ana@example.com'
+    await post('/api/auth/sign-up', { name: 'Ana', email, password: PASSWORD }, { origin: ORIGIN })
+
+    const verified = await post(
+      '/api/auth/email/verify',
+      { email, code: mailer.lastCode(email) },
+      { origin: ORIGIN },
+    )
+
+    expect(verified.statusCode).toBe(204)
+    expect(verified.cookies.map((cookie) => cookie.name).sort()).toEqual([
+      'access_token',
+      'refresh_token',
+    ])
+  })
+
+  it('answers a wrong code with invalid_code, and an unknown email with 204 and no mail', async () => {
+    await post('/api/auth/sign-up', { name: 'Ana', email: 'ana@example.com', password: PASSWORD })
+
+    const wrong = await post('/api/auth/email/verify', { email: 'ana@example.com', code: '000000' })
+    const unknown = await post('/api/auth/email/verification', { email: 'nobody@example.com' })
+
+    expect(wrong.statusCode).toBe(422)
+    expect(wrong.json()).toMatchObject({ code: 'invalid_code' })
+    expect(unknown.statusCode).toBe(204)
+    expect(mailer.sent.map((mail) => mail.to)).not.toContain('nobody@example.com')
+  })
+})
+
+describe('password reset over HTTP', () => {
+  it('resets the password with the mailed code and signs in with the new one', async () => {
+    const email = 'ana@example.com'
+    await post('/api/auth/sign-up', { name: 'Ana', email, password: PASSWORD })
+
+    const forgot = await post('/api/auth/password/forgot', { email })
+    const reset = await post('/api/auth/password/reset', {
+      email,
+      code: mailer.lastCode(email),
+      password: 'another-good-password',
+    })
+    const old = await post('/api/auth/sign-in', { email, password: PASSWORD })
+    const fresh = await post('/api/auth/sign-in', { email, password: 'another-good-password' })
+
+    expect(forgot.statusCode).toBe(204)
+    expect(reset.statusCode).toBe(200)
+    expect(old.statusCode).toBe(401)
+    expect(fresh.statusCode).toBe(200)
+  })
+})

package/templates/api/test/infra/http/controllers/auth.controller.spec.ts

@@ -0,0 +1,168 @@
+import { ORIGIN, PASSWORD, testApp } from '@test/support/test-app'
+import type { FastifyInstance, LightMyRequestResponse } from 'fastify'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+const BEARER = { 'x-auth-transport': 'bearer' }
+
+let app: FastifyInstance
+let signUp: Awaited<ReturnType<typeof testApp>>['signUp']
+
+function cookiesOf(response: LightMyRequestResponse): Record<string, string> {
+  return Object.fromEntries(response.cookies.map((cookie) => [cookie.name, cookie.value]))
+}
+
+function setCookie(response: LightMyRequestResponse, name: string) {
+  return response.cookies.find((cookie) => cookie.name === name)
+}
+
+beforeEach(async () => {
+  ;({ app, signUp } = await testApp())
+})
+
+afterEach(async () => {
+  await app.close()
+})
+
+describe('auth controller, on the web', () => {
+  it('starts a session in httpOnly cookies, the refresh one sent only to its route', async () => {
+    const { response } = await signUp()
+
+    expect(response.body).toBe('')
+    expect(setCookie(response, 'access_token')).toMatchObject({
+      httpOnly: true,
+      sameSite: 'Lax',
+      path: '/',
+    })
+    expect(setCookie(response, 'refresh_token')).toMatchObject({
+      httpOnly: true,
+      path: '/api/auth/refresh',
+    })
+  })
+
+  it('reads the session from the cookie, refreshes it, and signs out', async () => {
+    const { access_token, refresh_token } = cookiesOf((await signUp()).response)
+
+    const session = await app.inject({
+      url: '/api/auth/session',
+      headers: { cookie: `access_token=${access_token}` },
+    })
+    expect(session.json()).toMatchObject({ user: { id: expect.any(String) } })
+
+    const refreshed = await app.inject({
+      method: 'POST',
+      url: '/api/auth/refresh',
+      headers: { cookie: `refresh_token=${refresh_token}`, origin: ORIGIN },
+    })
+    expect(refreshed.statusCode).toBe(204)
+    expect(cookiesOf(refreshed).refresh_token).not.toBe(refresh_token)
+
+    const signOut = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-out',
+      headers: { cookie: `access_token=${cookiesOf(refreshed).access_token}`, origin: ORIGIN },
+    })
+    expect(signOut.statusCode).toBe(204)
+
+    const afterSignOut = await app.inject({
+      method: 'POST',
+      url: '/api/auth/refresh',
+      headers: { cookie: `refresh_token=${cookiesOf(refreshed).refresh_token}`, origin: ORIGIN },
+    })
+    expect(afterSignOut.statusCode).toBe(401)
+  })
+
+  it('refuses a request that leans on a cookie from another origin, or from none', async () => {
+    const cookie = `access_token=${cookiesOf((await signUp()).response).access_token}`
+
+    for (const headers of [{ cookie, origin: 'https://evil.example' }, { cookie }]) {
+      const response = await app.inject({ method: 'POST', url: '/api/auth/sign-out', headers })
+
+      expect(response.statusCode).toBe(403)
+      expect(response.headers['content-type']).toContain('application/problem+json')
+    }
+  })
+})
+
+describe('auth controller, for a native client', () => {
+  it('hands the tokens over in the body, and accepts them as a bearer', async () => {
+    const { response } = await signUp({ bearer: true })
+    const tokens = response.json()
+
+    expect(response.cookies).toEqual([])
+    expect(tokens).toEqual({
+      accessToken: expect.any(String),
+      refreshToken: expect.any(String),
+      expiresIn: 900,
+    })
+
+    const session = await app.inject({
+      url: '/api/auth/session',
+      headers: { authorization: `Bearer ${tokens.accessToken}` },
+    })
+    expect(session.statusCode).toBe(200)
+
+    const refreshed = await app.inject({
+      method: 'POST',
+      url: '/api/auth/refresh',
+      headers: BEARER,
+      payload: { refreshToken: tokens.refreshToken },
+    })
+    expect(refreshed.statusCode).toBe(200)
+    expect(refreshed.json().refreshToken).not.toBe(tokens.refreshToken)
+  })
+})
+
+describe('auth controller, refusing', () => {
+  it('answers a wrong password with 401 and a taken email with 409, as problem+json', async () => {
+    const { email } = await signUp({ bearer: true })
+
+    const wrong = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-in',
+      headers: BEARER,
+      payload: { email, password: 'wrong-password' },
+    })
+    const taken = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-up',
+      headers: BEARER,
+      payload: { name: 'Ana', email, password: PASSWORD },
+    })
+
+    expect(wrong.statusCode).toBe(401)
+    expect(wrong.json()).toMatchObject({ detail: 'Invalid email or password' })
+    expect(taken.statusCode).toBe(409)
+    expect(taken.headers['content-type']).toContain('application/problem+json')
+  })
+
+  it('names the fields a sign-up gets wrong', async () => {
+    const response = await app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-up',
+      headers: BEARER,
+      payload: { name: '', email: 'not-an-email', password: 'short' },
+    })
+
+    expect(response.statusCode).toBe(400)
+    expect(Object.keys(response.json().errors).sort()).toEqual(['email', 'name', 'password'])
+  })
+
+  it('slows down repeated sign-in attempts from one address', async () => {
+    const attempt = () =>
+      app.inject({
+        method: 'POST',
+        url: '/api/auth/sign-in',
+        headers: BEARER,
+        payload: { email: 'nobody@example.com', password: 'whatever' },
+      })
+
+    for (let i = 0; i < 10; i += 1) {
+      expect((await attempt()).statusCode).toBe(401)
+    }
+
+    const limited = await attempt()
+
+    expect(limited.statusCode).toBe(429)
+    expect(limited.headers['content-type']).toContain('application/problem+json')
+  })
+})