@stjoseph/prumo 0.2.0 → 0.4.0

package/templates/api/test/infra/http/controllers/mcp.controller.spec.ts

@@ -1,19 +1,23 @@
 import { createHash, randomBytes } from 'node:crypto'
 import { createServer } from 'node:net'
 import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client'
-import { testEnv, testOrm } from '@test/support/setup'
+import { testEnv } from '@test/support/setup'
+import { cookieHeader, testApp } from '@test/support/test-app'
 import type { FastifyInstance } from 'fastify'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { mcpResource } from '@/infra/auth/auth.factory'
-import { createContainer } from '@/infra/di'
-import { buildApp } from '@/infra/http/app'
+import { InvalidClientError } from '@/domain/oauth/errors/invalid-client.error'
+import { CLIENT_METADATA, type ClientMetadata } from '@/domain/oauth/ports/client-metadata.port'
+import { TOOL_SCOPES } from '@/infra/mcp/mcp.scopes'
+import { mcpResource } from '@/infra/mcp/mcp.server'
 
 const ORIGIN = 'http://localhost:5173'
+const CLIENT_ID = 'https://client.example.com/oauth/client.json'
 // A web client needs an https redirect off loopback; the test never follows it.
 const REDIRECT = 'https://client.example.com/callback'
 
 let app: FastifyInstance
 let env: ReturnType<typeof testEnv>
+let register: Awaited<ReturnType<typeof testApp>>['signUp']
 
 function freePort(): Promise<number> {
   return new Promise((resolve) => {
@@ -24,11 +28,25 @@ function freePort(): Promise<number> {
   })
 }
 
-// requireMcpAuth fetches the JWKS from BETTER_AUTH_URL, so the application listens for real.
+// Stands in for the HTTPS fetch of the client's metadata document, which the adapter's own test covers.
+const clients = {
+  async read(clientId: string): Promise<ClientMetadata> {
+    if (clientId !== CLIENT_ID) {
+      throw new InvalidClientError('Unknown client')
+    }
+
+    return { clientId, clientName: 'Example Client', redirectUris: [REDIRECT] }
+  },
+}
+
+// The SDK's client reaches the MCP route over real HTTP, so the application listens.
 beforeEach(async () => {
   const port = await freePort()
-  env = { ...testEnv(), BETTER_AUTH_URL: `http://127.0.0.1:${port}` }
-  app = await buildApp(createContainer({ env, orm: testOrm() }))
+  env = { ...testEnv(), API_URL: `http://127.0.0.1:${port}` }
+  ;({ app, signUp: register } = await testApp({
+    env,
+    configure: (container) => container.register(CLIENT_METADATA, { useValue: clients }),
+  }))
   await app.listen({ port, host: '127.0.0.1' })
 })
 
@@ -37,73 +55,77 @@ afterEach(async () => {
 })
 
 async function signUp(): Promise<string> {
-  const response = await app.inject({
-    method: 'POST',
-    url: '/api/auth/sign-up/email',
-    headers: { origin: ORIGIN },
-    payload: {
-      name: 'Ana',
-      email: `${crypto.randomUUID()}@example.com`,
-      password: 'correct-horse-battery',
-    },
-  })
-  const cookies = [response.headers['set-cookie']].flat().filter((c) => c !== undefined)
-
-  return cookies.map((cookie) => cookie.split(';')[0]).join('; ')
+  return cookieHeader((await register()).response)
 }
 
-// The path an MCP client takes: register, authorize with PKCE, consent, exchange the code.
-async function accessToken(cookie: string): Promise<string> {
-  const client = await app.inject({
-    method: 'POST',
-    url: '/api/auth/oauth2/create-client',
-    headers: { cookie, origin: ORIGIN },
-    payload: { redirect_uris: [REDIRECT], token_endpoint_auth_method: 'none' },
-  })
-  const clientId = client.json().client_id as string
+function pkce() {
   const verifier = randomBytes(32).toString('base64url')
-  const query = new URLSearchParams({
+
+  return { verifier, challenge: createHash('sha256').update(verifier).digest('base64url') }
+}
+
+function authorizeUrl(
+  overrides: Record<string, string | undefined> = {},
+  challenge = pkce().challenge,
+) {
+  const params = {
     response_type: 'code',
-    client_id: clientId,
+    client_id: CLIENT_ID,
     redirect_uri: REDIRECT,
-    scope: 'openid',
-    state: 'state',
-    code_challenge: createHash('sha256').update(verifier).digest('base64url'),
+    state: 'xyz',
+    code_challenge: challenge,
     code_challenge_method: 'S256',
     resource: mcpResource(env),
+    ...overrides,
+  }
+  const query = new URLSearchParams(
+    Object.entries(params).filter((entry): entry is [string, string] => entry[1] !== undefined),
+  )
+
+  return `/api/oauth/authorize?${query}`
+}
+
+function token(form: Record<string, string>) {
+  return app.inject({
+    method: 'POST',
+    url: '/api/oauth/token',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    payload: new URLSearchParams(form).toString(),
   })
-  const authorize = await app.inject({
-    url: `/api/auth/oauth2/authorize?${query}`,
-    headers: { cookie },
-  })
-  const consentPage = new URL(authorize.headers.location as string)
-  const consent = await app.inject({
+}
+
+// The path an MCP client takes: authorize with PKCE, the user consents on the web, the code becomes tokens.
+async function authorize(cookie: string, accept = true, scope?: string) {
+  const { verifier, challenge } = pkce()
+  const started = await app.inject({ url: authorizeUrl({ scope }, challenge) })
+  const consent = new URL(started.headers.location as string)
+  const id = consent.searchParams.get('request') ?? ''
+  const view = await app.inject({ url: `/api/oauth/authorizations/${id}`, headers: { cookie } })
+  const decision = await app.inject({
     method: 'POST',
-    url: '/api/auth/oauth2/consent',
+    url: `/api/oauth/authorizations/${id}/decision`,
     headers: { cookie, origin: ORIGIN },
-    payload: { accept: true, oauth_query: consentPage.search.slice(1) },
+    payload: { accept },
   })
-  const redirect = new URL(consent.json().url ?? consent.json().redirect_uri)
-  const token = await app.inject({
-    method: 'POST',
-    url: '/api/auth/oauth2/token',
-    headers: { 'content-type': 'application/x-www-form-urlencoded' },
-    payload: new URLSearchParams({
-      grant_type: 'authorization_code',
-      code: redirect.searchParams.get('code') ?? '',
-      redirect_uri: REDIRECT,
-      client_id: clientId,
-      code_verifier: verifier,
-      resource: mcpResource(env),
-    }).toString(),
+
+  return { started, consent, view, redirect: new URL(decision.json().redirectTo), verifier }
+}
+
+async function tokens(cookie: string, scope?: string) {
+  const { redirect, verifier } = await authorize(cookie, true, scope)
+  const response = await token({
+    grant_type: 'authorization_code',
+    code: redirect.searchParams.get('code') ?? '',
+    redirect_uri: REDIRECT,
+    client_id: CLIENT_ID,
+    code_verifier: verifier,
+    resource: mcpResource(env),
   })
 
-  return token.json().access_token as string
+  return { response, code: redirect.searchParams.get('code') ?? '', verifier }
 }
 
-// The SDK's own client, speaking the real protocol over HTTP.
-async function connect(token: string): Promise<Client> {
-  // The server rejects 2025-era traffic, as Better Auth's MCP profile asks.
+async function connect(accessToken: string): Promise<Client> {
   const client = new Client(
     { name: 'test', version: '1.0.0' },
     { versionNegotiation: { mode: { pin: '2026-07-28' } } },
@@ -111,25 +133,169 @@ async function connect(token: string): Promise<Client> {
 
   await client.connect(
     new StreamableHTTPClientTransport(new URL(mcpResource(env)), {
-      requestInit: { headers: { authorization: `Bearer ${token}` } },
+      requestInit: { headers: { authorization: `Bearer ${accessToken}` } },
     }),
   )
   return client
 }
 
-describe('mcp controller', () => {
-  it('tells an MCP client where to authorize', async () => {
-    const metadata = await app.inject({ url: '/.well-known/oauth-protected-resource' })
+describe('discovery', () => {
+  it('tells an MCP client where to authorize, from the 401 to the server metadata', async () => {
     const refused = await app.inject({ method: 'POST', url: '/api/mcp', payload: {} })
+    const challenge = refused.headers['www-authenticate'] as string
+    const metadataUrl = /resource_metadata="([^"]+)"/.exec(challenge)?.[1] ?? ''
+    const resource = await app.inject({ url: new URL(metadataUrl).pathname })
+    const server = await app.inject({ url: '/.well-known/oauth-authorization-server' })
 
-    expect(metadata.json()).toMatchObject({ resource: mcpResource(env) })
     expect(refused.statusCode).toBe(401)
-    expect(refused.headers['www-authenticate']).toContain('resource_metadata=')
+    expect(resource.json()).toMatchObject({
+      resource: mcpResource(env),
+      authorization_servers: [env.API_URL],
+    })
+    expect(server.json()).toMatchObject({
+      issuer: env.API_URL,
+      code_challenge_methods_supported: ['S256'],
+      client_id_metadata_document_supported: true,
+      authorization_response_iss_parameter_supported: true,
+    })
+  })
+})
+
+describe('authorization', () => {
+  it('sends the browser to consent, shows who asks and where the code goes, and returns it with iss', async () => {
+    const { started, consent, view, redirect } = await authorize(await signUp())
+
+    expect(started.statusCode).toBe(302)
+    expect(`${consent.origin}${consent.pathname}`).toBe(`${ORIGIN}/consent`)
+    expect(view.json()).toEqual({
+      clientId: CLIENT_ID,
+      clientName: 'Example Client',
+      clientHost: 'client.example.com',
+      redirectHost: 'client.example.com',
+      redirectsToThisDevice: false,
+      // Asked for nothing, so offered everything, each scope worded for a person.
+      scopes: [
+        { scope: 'profile:read', description: 'Read your profile' },
+        { scope: 'profile:write', description: 'Change your display name, language and timezone' },
+      ],
+    })
+    expect(`${redirect.origin}${redirect.pathname}`).toBe(REDIRECT)
+    expect(redirect.searchParams.get('state')).toBe('xyz')
+    expect(redirect.searchParams.get('iss')).toBe(env.API_URL)
+    expect(redirect.searchParams.get('code')).not.toBeNull()
+  })
+
+  it('answers a denial with access_denied', async () => {
+    const { redirect } = await authorize(await signUp(), false)
+
+    expect(redirect.searchParams.get('error')).toBe('access_denied')
+    expect(redirect.searchParams.get('code')).toBeNull()
+  })
+
+  it('never redirects for an unknown client or an unregistered redirect URI', async () => {
+    for (const overrides of [
+      { client_id: 'https://evil.example.com/client.json' },
+      { redirect_uri: 'https://evil.example.com/callback' },
+    ]) {
+      const response = await app.inject({ url: authorizeUrl(overrides) })
+
+      expect(response.statusCode).toBe(422)
+      expect(response.headers.location).toBeUndefined()
+    }
+  })
+
+  it('sends a known client its error: no PKCE, plain PKCE, another resource', async () => {
+    for (const [overrides, error] of [
+      [{ code_challenge_method: undefined }, 'invalid_request'],
+      [{ code_challenge_method: 'plain' }, 'invalid_request'],
+      [{ resource: 'https://elsewhere.example.com/mcp' }, 'invalid_target'],
+    ] as const) {
+      const response = await app.inject({ url: authorizeUrl(overrides) })
+      const location = new URL(response.headers.location as string)
+
+      expect(location.searchParams.get('error')).toBe(error)
+      expect(location.searchParams.get('state')).toBe('xyz')
+      expect(location.searchParams.get('iss')).toBe(env.API_URL)
+    }
   })
+})
+
+describe('scopes', () => {
+  it('are advertised, and named in the 401 a client starts from', async () => {
+    const refused = await app.inject({ method: 'POST', url: '/api/mcp', payload: {} })
+    const resource = await app.inject({ url: '/.well-known/oauth-protected-resource/api/mcp' })
+    const server = await app.inject({ url: '/.well-known/oauth-authorization-server' })
+
+    expect(refused.headers['www-authenticate']).toContain('scope="profile:read profile:write"')
+    expect(resource.json().scopes_supported).toEqual(['profile:read', 'profile:write'])
+    expect(server.json().scopes_supported).toEqual(['profile:read', 'profile:write'])
+  })
+
+  it('let a read-only token read, and refuse its write with the scope it needs', async () => {
+    const { response } = await tokens(await signUp(), 'profile:read')
+    const { access_token, scope } = response.json()
+    const client = await connect(access_token)
+    const read = await client.callTool({ name: 'get_profile', arguments: {} })
+    const write = await app.inject({
+      method: 'POST',
+      url: '/api/mcp',
+      headers: {
+        authorization: `Bearer ${access_token}`,
+        accept: 'application/json, text/event-stream',
+      },
+      payload: {
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/call',
+        params: { name: 'update_profile', arguments: { timezone: 'UTC' } },
+      },
+    })
+
+    expect(scope).toBe('profile:read')
+    expect(read.structuredContent).toMatchObject({ displayName: 'Ana' })
+    expect(write.statusCode).toBe(403)
+    expect(write.headers['www-authenticate']).toContain('error="insufficient_scope"')
+    expect(write.headers['www-authenticate']).toContain('scope="profile:write"')
+
+    await client.close()
+  })
+
+  // A tool missing from TOOL_SCOPES would answer any token, so every tool the server lists must be there.
+  it('cover every tool the server offers', async () => {
+    const client = await connect((await tokens(await signUp())).response.json().access_token)
+    const { tools } = await client.listTools()
 
+    expect(tools.length).toBeGreaterThan(0)
+    for (const tool of tools) {
+      expect(TOOL_SCOPES[tool.name], tool.name).toBeDefined()
+    }
+
+    await client.close()
+  })
+
+  it('keep the scope through a refresh, and refuse one the server does not offer', async () => {
+    const { response } = await tokens(await signUp(), 'profile:read')
+    const refreshed = await token({
+      grant_type: 'refresh_token',
+      refresh_token: response.json().refresh_token,
+      client_id: CLIENT_ID,
+    })
+    const unknown = await app.inject({ url: authorizeUrl({ scope: 'billing:write' }) })
+
+    expect(refreshed.json().scope).toBe('profile:read')
+    expect(new URL(unknown.headers.location as string).searchParams.get('error')).toBe(
+      'invalid_scope',
+    )
+  })
+})
+
+describe('token', () => {
   it('runs a tool for the user who authorized the client, with public fields only', async () => {
-    const client = await connect(await accessToken(await signUp()))
+    const { response } = await tokens(await signUp())
+    const client = await connect(response.json().access_token)
     const result = await client.callTool({ name: 'get_profile', arguments: {} })
+
+    expect(response.headers['cache-control']).toBe('no-store')
     expect(Object.keys(result.structuredContent ?? {}).sort()).toEqual(
       ['createdAt', 'displayName', 'id', 'locale', 'timezone', 'updatedAt', 'userId'].sort(),
     )
@@ -139,7 +305,8 @@ describe('mcp controller', () => {
   })
 
   it('changes the profile through a tool', async () => {
-    const client = await connect(await accessToken(await signUp()))
+    const { response } = await tokens(await signUp())
+    const client = await connect(response.json().access_token)
     const result = await client.callTool({
       name: 'update_profile',
       arguments: { timezone: 'America/Sao_Paulo' },
@@ -149,4 +316,79 @@ describe('mcp controller', () => {
 
     await client.close()
   })
+
+  it('refuses a wrong verifier, and a code spent twice ends what the first use obtained', async () => {
+    const cookie = await signUp()
+    const { redirect } = await authorize(cookie)
+    const wrong = await token({
+      grant_type: 'authorization_code',
+      code: redirect.searchParams.get('code') ?? '',
+      redirect_uri: REDIRECT,
+      client_id: CLIENT_ID,
+      code_verifier: pkce().verifier,
+    })
+
+    expect(wrong.statusCode).toBe(400)
+    expect(wrong.json().error).toBe('invalid_grant')
+
+    const { response, code, verifier } = await tokens(cookie)
+    const replay = await token({
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: REDIRECT,
+      client_id: CLIENT_ID,
+      code_verifier: verifier,
+    })
+    const refresh = await token({
+      grant_type: 'refresh_token',
+      refresh_token: response.json().refresh_token,
+      client_id: CLIENT_ID,
+    })
+
+    expect(replay.json().error).toBe('invalid_grant')
+    expect(refresh.json().error).toBe('invalid_grant')
+  })
+
+  it('rotates the refresh token, and only for the client it was issued to', async () => {
+    const { response } = await tokens(await signUp())
+    const refreshToken = response.json().refresh_token
+    const otherClient = await token({
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: 'https://other.example.com/client.json',
+    })
+    const rotated = await token({
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: CLIENT_ID,
+    })
+
+    expect(otherClient.json().error).toBe('invalid_grant')
+    expect(rotated.statusCode).toBe(200)
+    expect(rotated.json().refresh_token).not.toBe(refreshToken)
+  })
+
+  it('keeps the MCP token and the application’s tokens apart', async () => {
+    const cookie = await signUp()
+    const { response } = await tokens(cookie)
+    const access = cookie
+      .split('; ')
+      .find((pair) => pair.startsWith('access_token='))
+      ?.slice(13)
+
+    const mcpTokenOnApi = await app.inject({
+      url: '/api/v1/users/me',
+      headers: { authorization: `Bearer ${response.json().access_token}` },
+    })
+    const apiTokenOnMcp = await app.inject({
+      method: 'POST',
+      url: '/api/mcp',
+      headers: { authorization: `Bearer ${access}` },
+      payload: {},
+    })
+
+    expect(mcpTokenOnApi.statusCode).toBe(401)
+    expect(apiTokenOnMcp.statusCode).toBe(401)
+    expect(apiTokenOnMcp.headers['www-authenticate']).toContain('error="invalid_token"')
+  })
 })

package/templates/api/test/infra/http/controllers/social.controller.spec.ts

@@ -0,0 +1,108 @@
+import { FakeIdentityProviders } from '@test/support/fakes/social-fakes'
+import { testEnv } from '@test/support/setup'
+import { testApp } from '@test/support/test-app'
+import type { FastifyInstance, LightMyRequestResponse } from 'fastify'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { IDENTITY_PROVIDERS } from '@/domain/auth/ports/identity-providers.port'
+
+const WEB = 'http://localhost:5173'
+
+// Whichever provider the project kept: the flow is the same for each.
+const PROVIDER = [
+  'google', // prumo:google
+  'apple', // prumo:apple
+][0]
+
+let app: FastifyInstance
+
+function browserCookie(response: LightMyRequestResponse): string {
+  const cookie = response.cookies.find((each) => each.name === 'social_sign_in')
+  return `social_sign_in=${cookie?.value ?? ''}`
+}
+
+function stateOf(response: LightMyRequestResponse): string {
+  return new URL(response.headers.location as string).searchParams.get('state') ?? ''
+}
+
+beforeEach(async () => {
+  ;({ app } = await testApp({
+    env: { ...testEnv(), MOBILE_APP_SCHEME: 'acme' },
+    configure: (container) =>
+      container.register(IDENTITY_PROVIDERS, { useValue: new FakeIdentityProviders() }),
+  }))
+})
+
+afterEach(async () => {
+  await app.close()
+})
+
+describe('social sign-in on the web', () => {
+  it('sends the browser to the provider and back into the app, signed in', async () => {
+    const started = await app.inject({ url: `/api/auth/social/${PROVIDER}?returnTo=/orders` })
+    const back = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+      headers: { cookie: browserCookie(started) },
+    })
+
+    expect(started.statusCode).toBe(302)
+    expect(started.headers.location).toMatch(/^https:\/\/\w+\.test\/authorize/)
+    expect(back.statusCode).toBe(302)
+    expect(back.headers.location).toBe(`${WEB}/orders`)
+    expect(back.cookies.map((cookie) => cookie.name)).toEqual(
+      expect.arrayContaining(['access_token', 'refresh_token']),
+    )
+  })
+
+  it('refuses a return without the browser that started it, and a foreign returnTo', async () => {
+    const started = await app.inject({
+      url: `/api/auth/social/${PROVIDER}?returnTo=//evil.example`,
+    })
+    const forwarded = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+    })
+    const back = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+      headers: { cookie: browserCookie(started) },
+    })
+
+    expect(forwarded.headers.location).toBe(`${WEB}/sign-in?error=social_sign_in_failed`)
+    expect(back.headers.location).toBe(`${WEB}/`)
+  })
+
+  it('turns a form post, as Apple sends, into a redirect the browser’s cookie comes with', async () => {
+    const posted = await app.inject({
+      method: 'POST',
+      url: `/api/auth/social/${PROVIDER}/callback`,
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      payload: 'code=c&state=s&user=%7B%7D',
+    })
+
+    expect(posted.statusCode).toBe(303)
+    expect(posted.headers.location).toBe(
+      `http://localhost:3000/api/auth/social/${PROVIDER}/callback?code=c&state=s&user=%7B%7D`,
+    )
+  })
+})
+
+describe('social sign-in on mobile', () => {
+  it('sends the app a code, which it trades once for its tokens', async () => {
+    const started = await app.inject({ url: `/api/auth/social/${PROVIDER}?client=mobile` })
+    const back = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+      headers: { cookie: browserCookie(started) },
+    })
+    const location = new URL(back.headers.location as string)
+    const code = location.searchParams.get('code') ?? ''
+    const exchange = () =>
+      app.inject({
+        method: 'POST',
+        url: '/api/auth/social/exchange',
+        headers: { 'x-auth-transport': 'bearer' },
+        payload: { code },
+      })
+
+    expect(`${location.protocol}//${location.host}`).toBe('acme://social')
+    expect((await exchange()).json().accessToken).toEqual(expect.any(String))
+    expect((await exchange()).statusCode).toBe(401)
+  })
+})

package/templates/api/test/infra/http/controllers/users.controller.spec.ts

@@ -1,37 +1,16 @@
-import { testEnv, testOrm } from '@test/support/setup'
+import { cookieHeader, ORIGIN, testApp } from '@test/support/test-app'
 import type { FastifyInstance } from 'fastify'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { createContainer } from '@/infra/di'
-import { buildApp } from '@/infra/http/app'
-
-const ORIGIN = 'http://localhost:5173'
 
 let app: FastifyInstance
+let signUp: Awaited<ReturnType<typeof testApp>>['signUp']
 
-async function signUp(): Promise<string[]> {
-  const response = await app.inject({
-    method: 'POST',
-    url: '/api/auth/sign-up/email',
-    headers: { origin: ORIGIN },
-    payload: {
-      name: 'Ana',
-      email: `${crypto.randomUUID()}@example.com`,
-      password: 'correct-horse-battery',
-    },
-  })
-
-  expect(response.statusCode).toBe(200)
-
-  const cookies = response.headers['set-cookie']
-  return Array.isArray(cookies) ? cookies : [cookies ?? '']
-}
-
-function cookieHeader(cookies: string[]): string {
-  return cookies.map((cookie) => cookie.split(';')[0]).join('; ')
+async function signedIn(): Promise<string> {
+  return cookieHeader((await signUp()).response)
 }
 
 beforeEach(async () => {
-  app = await buildApp(createContainer({ env: testEnv(), orm: testOrm() }))
+  ;({ app, signUp } = await testApp())
 })
 
 afterEach(async () => {
@@ -47,8 +26,10 @@ describe('users controller', () => {
   })
 
   it('returns the profile created at sign-up, and only its public fields', async () => {
-    const cookie = cookieHeader(await signUp())
-    const response = await app.inject({ url: '/api/v1/users/me', headers: { cookie } })
+    const response = await app.inject({
+      url: '/api/v1/users/me',
+      headers: { cookie: await signedIn() },
+    })
 
     expect(response.statusCode).toBe(200)
     expect(Object.keys(response.json()).sort()).toEqual(
@@ -58,11 +39,10 @@ describe('users controller', () => {
   })
 
   it('updates the profile', async () => {
-    const cookie = cookieHeader(await signUp())
     const response = await app.inject({
       method: 'PATCH',
       url: '/api/v1/users/me',
-      headers: { cookie, origin: ORIGIN },
+      headers: { cookie: await signedIn(), origin: ORIGIN },
       payload: { timezone: 'America/Sao_Paulo' },
     })
 
@@ -71,11 +51,10 @@ describe('users controller', () => {
   })
 
   it('names every rejected field, including one the schema does not know', async () => {
-    const cookie = cookieHeader(await signUp())
     const response = await app.inject({
       method: 'PATCH',
       url: '/api/v1/users/me',
-      headers: { cookie, origin: ORIGIN },
+      headers: { cookie: await signedIn(), origin: ORIGIN },
       payload: { displayName: '', role: 'admin' },
     })
 
@@ -87,14 +66,13 @@ describe('users controller', () => {
   })
 
   it('signs out', async () => {
-    const cookie = cookieHeader(await signUp())
     const response = await app.inject({
       method: 'POST',
       url: '/api/auth/sign-out',
-      headers: { cookie, origin: ORIGIN },
+      headers: { cookie: await signedIn(), origin: ORIGIN },
     })
 
-    expect(response.statusCode).toBe(200)
+    expect(response.statusCode).toBe(204)
   })
 
   it('answers an unknown route with 404, not 401', async () => {

package/templates/api/test/infra/oauth/crypto-authorization-codes.adapter.spec.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest'
+import { CryptoAuthorizationCodes } from '@/infra/oauth/crypto-authorization-codes.adapter'
+
+describe('CryptoAuthorizationCodes', () => {
+  // The example in RFC 7636, Appendix B.
+  it('matches the RFC’s own S256 example, and nothing else', () => {
+    const codes = new CryptoAuthorizationCodes()
+    const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk'
+
+    expect(codes.matchesChallenge(verifier, 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM')).toBe(
+      true,
+    )
+    expect(codes.matchesChallenge(verifier, verifier)).toBe(false)
+    expect(
+      codes.matchesChallenge(`${verifier}x`, 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM'),
+    ).toBe(false)
+  })
+})