@stjoseph/prumo 0.3.0 → 0.4.0

package/templates/api/src/infra/http/session-delivery.ts

@@ -0,0 +1,69 @@
+import type { FastifyReply, FastifyRequest } from 'fastify'
+import type { TokensResponseDto } from '@/domain/auth/dto/tokens-response.dto'
+import type { SessionTokens } from '@/domain/auth/use-cases/start-session.use-case'
+import type { Env } from '@/infra/config/env'
+import { ACCESS_COOKIE } from '@/infra/http/hooks/auth.hook'
+
+export const REFRESH_COOKIE = 'refresh_token'
+
+// The refresh cookie travels only to the one route that reads it, never with an ordinary request.
+const REFRESH_PATH = '/api/auth/refresh'
+
+// A native client asks for its tokens in the body. The web never does: a token JavaScript can read is a token an
+// injected script can take.
+export function wantsBearer(request: FastifyRequest): boolean {
+  return request.headers['x-auth-transport'] === 'bearer'
+}
+
+function asBody(tokens: SessionTokens): TokensResponseDto {
+  return {
+    accessToken: tokens.accessToken.token,
+    refreshToken: tokens.refreshToken,
+    expiresIn: Math.round((tokens.accessToken.expiresAt.getTime() - Date.now()) / 1000),
+  }
+}
+
+// How a started session reaches the client, wherever it was started: sign-in, a confirmed email, a provider.
+export function sessionDelivery(env: Pick<Env, 'API_URL'>) {
+  const cookie = {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: env.API_URL.startsWith('https://'),
+  } as const
+
+  function clearCookies(reply: FastifyReply): void {
+    reply.clearCookie(ACCESS_COOKIE, { ...cookie, path: '/' })
+    reply.clearCookie(REFRESH_COOKIE, { ...cookie, path: REFRESH_PATH })
+  }
+
+  function setCookies(reply: FastifyReply, tokens: SessionTokens): void {
+    reply.setCookie(ACCESS_COOKIE, tokens.accessToken.token, {
+      ...cookie,
+      path: '/',
+      expires: tokens.accessToken.expiresAt,
+    })
+    reply.setCookie(REFRESH_COOKIE, tokens.refreshToken, {
+      ...cookie,
+      path: REFRESH_PATH,
+      expires: tokens.refreshExpiresAt,
+    })
+  }
+
+  // The web gets cookies and an empty body; a native client gets the tokens and no cookie.
+  function deliver(
+    request: FastifyRequest,
+    reply: FastifyReply,
+    tokens: SessionTokens,
+    status: 200 | 201,
+  ) {
+    if (wantsBearer(request)) {
+      return reply.code(status).send(asBody(tokens))
+    }
+
+    setCookies(reply, tokens)
+
+    return reply.code(status === 201 ? 201 : 204).send()
+  }
+
+  return { deliver, setCookies, clearCookies }
+}

package/templates/api/src/infra/mcp/mcp.scopes.ts

@@ -0,0 +1,27 @@
+import { USER_TOOL_SCOPES } from './tools/users.tool'
+
+// Every scope this server offers, as the consent page words it. A module adds its read and write here, with its
+// tools' scopes below.
+export const SCOPES: Record<string, string> = {
+  'profile:read': 'Read your profile',
+  'profile:write': 'Change your display name, language and timezone',
+}
+
+export const TOOL_SCOPES: Record<string, string> = { ...USER_TOOL_SCOPES }
+
+// The scopes a batch of JSON-RPC messages needs and the token lacks, all of them at once: MCP asks for one
+// challenge per operation, not one per retry.
+export function missingScopes(messages: unknown, granted: readonly string[]): string[] {
+  const needed = [messages]
+    .flat()
+    .flatMap((message) => {
+      const call = message as { method?: unknown; params?: { name?: unknown } } | null
+
+      return call?.method === 'tools/call' && typeof call.params?.name === 'string'
+        ? [TOOL_SCOPES[call.params.name]]
+        : []
+    })
+    .filter((scope): scope is string => scope !== undefined)
+
+  return [...new Set(needed)].filter((scope) => !granted.includes(scope))
+}

package/templates/api/src/infra/mcp/tools/users.tool.ts

@@ -16,6 +16,12 @@ function asResult(profile: Profile) {
   }
 }
 
+// The scope each tool needs: reading a module's data is `<module>:read`, changing it `<module>:write`.
+export const USER_TOOL_SCOPES = {
+  get_profile: 'profile:read',
+  update_profile: 'profile:write',
+} as const
+
 export function registerUserTools(
   server: McpServer,
   container: DependencyContainer,

package/templates/api/src/infra/social/openid-identity-providers.adapter.ts

@@ -0,0 +1,199 @@
+import { importPKCS8, SignJWT } from 'jose'
+import * as oidc from 'openid-client'
+import { SocialSignInFailedError } from '@/domain/auth/errors/social-sign-in-failed.error'
+import type {
+  IdentityProviders,
+  ProviderCallback,
+  ProviderName,
+  ProviderProfile,
+  ProviderRedirect,
+} from '@/domain/auth/ports/identity-providers.port'
+import { DomainError } from '@/domain/shared/errors/domain-error'
+import type { Env } from '@/infra/config/env'
+
+type Settings = {
+  issuer: URL
+  clientId: string
+  scope: string
+  // Apple answers with a POST when the email is asked for; Google redirects back with a GET.
+  formPost: boolean
+  secret: () => Promise<string>
+}
+
+type Options = {
+  // A test points a provider at a local issuer, over plain HTTP.
+  issuers?: Partial<Record<ProviderName, URL>>
+  insecure?: boolean
+}
+
+// Apple accepts a client secret valid for up to six months; one hour keeps a leaked one short-lived.
+const SECRET_LIFETIME_MS = 60 * 60 * 1000
+
+export class OpenIdIdentityProviders implements IdentityProviders {
+  private readonly configurations = new Map<
+    ProviderName,
+    { configuration: oidc.Configuration; until: number }
+  >()
+
+  constructor(
+    private readonly env: Env,
+    private readonly options: Options = {},
+  ) {}
+
+  private settings(provider: ProviderName): Settings | null {
+    const { env } = this
+    const issuer = (fallback: string) => this.options.issuers?.[provider] ?? new URL(fallback)
+
+    switch (provider) {
+      // prumo:google
+      case 'google': {
+        const secret = env.GOOGLE_CLIENT_SECRET
+
+        return env.GOOGLE_CLIENT_ID === undefined || secret === undefined
+          ? null
+          : {
+              issuer: issuer('https://accounts.google.com'),
+              clientId: env.GOOGLE_CLIENT_ID,
+              scope: 'openid email profile',
+              formPost: false,
+              secret: async () => secret,
+            }
+      }
+      // prumo:end-google
+      // prumo:apple
+      case 'apple': {
+        const { APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_PRIVATE_KEY } = env
+
+        if (
+          APPLE_CLIENT_ID === undefined ||
+          APPLE_TEAM_ID === undefined ||
+          APPLE_KEY_ID === undefined ||
+          APPLE_PRIVATE_KEY === undefined
+        ) {
+          return null
+        }
+
+        return {
+          issuer: issuer('https://appleid.apple.com'),
+          clientId: APPLE_CLIENT_ID,
+          scope: 'openid email name',
+          formPost: true,
+          // Apple's client secret is a JWT signed with the team's .p8 key, not a string it hands out.
+          secret: async () =>
+            new SignJWT({})
+              .setProtectedHeader({ alg: 'ES256', kid: APPLE_KEY_ID })
+              .setIssuer(APPLE_TEAM_ID)
+              .setSubject(APPLE_CLIENT_ID)
+              .setAudience('https://appleid.apple.com')
+              .setIssuedAt()
+              .setExpirationTime(Math.floor((Date.now() + SECRET_LIFETIME_MS) / 1000))
+              .sign(await importPKCS8(APPLE_PRIVATE_KEY.replaceAll('\\n', '\n'), 'ES256')),
+        }
+      }
+      // prumo:end-apple
+    }
+
+    return null
+  }
+
+  private redirectUri(provider: ProviderName): string {
+    return `${this.env.API_URL}/api/auth/social/${provider}/callback`
+  }
+
+  private async configuration(provider: ProviderName, settings: Settings) {
+    const cached = this.configurations.get(provider)
+
+    if (cached !== undefined && cached.until > Date.now()) {
+      return cached.configuration
+    }
+
+    const configuration = await oidc.discovery(
+      settings.issuer,
+      settings.clientId,
+      undefined,
+      oidc.ClientSecretPost(await settings.secret()),
+      { execute: this.options.insecure === true ? [oidc.allowInsecureRequests] : [] },
+    )
+
+    // Renewed before the secret it was built with expires.
+    this.configurations.set(provider, {
+      configuration,
+      until: Date.now() + SECRET_LIFETIME_MS / 2,
+    })
+
+    return configuration
+  }
+
+  isConfigured(provider: ProviderName): boolean {
+    return this.settings(provider) !== null
+  }
+
+  async redirect(provider: ProviderName, state: string): Promise<ProviderRedirect> {
+    const settings = this.settings(provider)
+
+    if (settings === null) {
+      throw new SocialSignInFailedError(`Sign-in with ${provider} is not configured`)
+    }
+
+    const configuration = await this.configuration(provider, settings)
+    const nonce = oidc.randomNonce()
+    // PKCE where the provider says it takes it: Google does, Apple's metadata names none, and relies on state and nonce.
+    const codeVerifier = configuration.serverMetadata().supportsPKCE()
+      ? oidc.randomPKCECodeVerifier()
+      : null
+    const url = oidc.buildAuthorizationUrl(configuration, {
+      redirect_uri: this.redirectUri(provider),
+      scope: settings.scope,
+      state,
+      nonce,
+      ...(codeVerifier !== null && {
+        code_challenge: await oidc.calculatePKCECodeChallenge(codeVerifier),
+        code_challenge_method: 'S256',
+      }),
+      ...(settings.formPost && { response_mode: 'form_post' }),
+    })
+
+    return { url: url.href, codeVerifier, nonce }
+  }
+
+  async profile(provider: ProviderName, callback: ProviderCallback): Promise<ProviderProfile> {
+    const settings = this.settings(provider)
+
+    if (settings === null) {
+      throw new SocialSignInFailedError(`Sign-in with ${provider} is not configured`)
+    }
+
+    try {
+      const tokens = await oidc.authorizationCodeGrant(
+        await this.configuration(provider, settings),
+        callback.callbackUrl,
+        {
+          expectedState: callback.state,
+          expectedNonce: callback.nonce,
+          idTokenExpected: true,
+          ...(callback.codeVerifier !== null && { pkceCodeVerifier: callback.codeVerifier }),
+        },
+      )
+      // Read only after openid-client checked the ID token's signature, issuer, audience, expiry and nonce.
+      const claims = tokens.claims()
+
+      if (claims === undefined || typeof claims.email !== 'string') {
+        throw new SocialSignInFailedError('The provider did not share an email address')
+      }
+
+      return {
+        subject: claims.sub,
+        email: claims.email,
+        // Apple writes it as the string "true".
+        emailVerified: claims.email_verified === true || claims.email_verified === 'true',
+        name: typeof claims.name === 'string' ? claims.name : callback.name,
+      }
+    } catch (error) {
+      if (error instanceof DomainError) {
+        throw error
+      }
+
+      throw new SocialSignInFailedError()
+    }
+  }
+}

package/templates/api/test/domain/auth/use-cases/email.use-case.spec.ts

@@ -0,0 +1,87 @@
+import { authFakes } from '@test/support/fakes/auth-fakes'
+import { describe, expect, it } from 'vitest'
+import { EMAIL_CODE_ATTEMPTS } from '@/domain/auth/entities/email-code.entity'
+import { EmailNotVerifiedError } from '@/domain/auth/errors/email-not-verified.error'
+import { InvalidCodeError } from '@/domain/auth/errors/invalid-code.error'
+
+const ANA = { name: 'Ana', email: 'ana@example.com', password: 'correct-horse-battery' }
+
+describe('email verification', () => {
+  it('refuses to sign in an unconfirmed account, and lets it in once confirmed', async () => {
+    const { signUp, signIn, verifyEmail, mailer } = authFakes()
+    await signUp.execute(ANA)
+
+    await expect(signIn.execute(ANA)).rejects.toBeInstanceOf(EmailNotVerifiedError)
+
+    await verifyEmail.execute({ email: ANA.email, code: mailer.lastCode(ANA.email) })
+
+    await expect(signIn.execute(ANA)).resolves.toBeDefined()
+  })
+
+  it('kills a code after five wrong guesses, even if the right one comes next', async () => {
+    const { signUp, verifyEmail, mailer } = authFakes()
+    await signUp.execute(ANA)
+    const code = mailer.lastCode(ANA.email)
+
+    for (let i = 0; i < EMAIL_CODE_ATTEMPTS; i += 1) {
+      await expect(
+        verifyEmail.execute({ email: ANA.email, code: '000000' }),
+      ).rejects.toBeInstanceOf(InvalidCodeError)
+    }
+
+    await expect(verifyEmail.execute({ email: ANA.email, code })).rejects.toBeInstanceOf(
+      InvalidCodeError,
+    )
+  })
+
+  it('answers an unknown email as it answers a wrong code', async () => {
+    const { verifyEmail } = authFakes()
+
+    await expect(
+      verifyEmail.execute({ email: 'nobody@example.com', code: '123456' }),
+    ).rejects.toBeInstanceOf(InvalidCodeError)
+  })
+})
+
+describe('password reset', () => {
+  it('sets the new password, ends every old session, and confirms the email it reached', async () => {
+    const { register, signIn, sessions, users, requestPasswordReset, resetPassword, mailer } =
+      authFakes()
+    await register(ANA)
+    await signIn.execute(ANA)
+
+    await requestPasswordReset.execute(ANA.email)
+    await resetPassword.execute({
+      email: ANA.email,
+      code: mailer.lastCode(ANA.email),
+      password: 'another-good-password',
+    })
+
+    const revoked = [...sessions.rows.values()].filter((session) => session.revokedAt !== null)
+    const [user] = [...users.rows.values()]
+
+    expect(revoked).toHaveLength(2)
+    expect(user?.passwordHash).toBe('hashed:another-good-password')
+    await expect(signIn.execute(ANA)).rejects.toThrow()
+  })
+
+  it('sends nothing for an unknown email, and says nothing about it either', async () => {
+    const { requestPasswordReset, mailer } = authFakes()
+
+    await expect(requestPasswordReset.execute('nobody@example.com')).resolves.toBeUndefined()
+    expect(mailer.sent).toEqual([])
+  })
+
+  it('voids the previous code when a new one is sent', async () => {
+    const { register, requestPasswordReset, resetPassword, mailer } = authFakes()
+    await register(ANA)
+
+    await requestPasswordReset.execute(ANA.email)
+    const first = mailer.lastCode(ANA.email)
+    await requestPasswordReset.execute(ANA.email)
+
+    await expect(
+      resetPassword.execute({ email: ANA.email, code: first, password: 'another-good-password' }),
+    ).rejects.toBeInstanceOf(InvalidCodeError)
+  })
+})

package/templates/api/test/domain/auth/use-cases/refresh-session.use-case.spec.ts

@@ -12,8 +12,8 @@ afterEach(() => {
 
 describe('RefreshSessionUseCase', () => {
   it('rotates the refresh token on every use', async () => {
-    const { signUp, refresh } = authFakes()
-    const first = await signUp.execute(ANA)
+    const { register, refresh } = authFakes()
+    const first = await register(ANA)
 
     const second = await refresh.execute(first.refreshToken)
     const third = await refresh.execute(second.refreshToken)
@@ -22,8 +22,8 @@ describe('RefreshSessionUseCase', () => {
   })
 
   it('asks a client that lost a race to retry, and revokes nothing', async () => {
-    const { signUp, refresh, sessions } = authFakes()
-    const first = await signUp.execute(ANA)
+    const { register, refresh, sessions } = authFakes()
+    const first = await register(ANA)
 
     const second = await refresh.execute(first.refreshToken)
 
@@ -34,8 +34,8 @@ describe('RefreshSessionUseCase', () => {
 
   it('ends the session when a token comes back after the grace period', async () => {
     vi.useFakeTimers()
-    const { signUp, refresh, sessions } = authFakes()
-    const first = await signUp.execute(ANA)
+    const { register, refresh, sessions } = authFakes()
+    const first = await register(ANA)
     const second = await refresh.execute(first.refreshToken)
 
     vi.advanceTimersByTime(ROTATION_GRACE_MS)
@@ -55,8 +55,8 @@ describe('RefreshSessionUseCase', () => {
   })
 
   it('refuses every token of a session signed out of', async () => {
-    const { signUp, signOut, refresh, sessions } = authFakes()
-    const tokens = await signUp.execute(ANA)
+    const { register, signOut, refresh, sessions } = authFakes()
+    const tokens = await register(ANA)
     const session = [...sessions.rows.values()][0]
 
     await signOut.execute(session?.userId ?? '', session?.id ?? '')

package/templates/api/test/domain/auth/use-cases/sign-in.use-case.spec.ts

@@ -6,8 +6,8 @@ const ANA = { name: 'Ana', email: 'ana@example.com', password: 'correct-horse-ba
 
 describe('SignInUseCase', () => {
   it('starts a session for the right password, whatever the case of the email', async () => {
-    const { signUp, signIn, sessions } = authFakes()
-    await signUp.execute(ANA)
+    const { register, signIn, sessions } = authFakes()
+    await register(ANA)
 
     await signIn.execute({ email: 'ANA@example.com', password: ANA.password })
 
@@ -15,8 +15,8 @@ describe('SignInUseCase', () => {
   })
 
   it('answers a wrong password and an unknown email alike, after checking a password both times', async () => {
-    const { signUp, signIn, hasher } = authFakes()
-    await signUp.execute(ANA)
+    const { register, signIn, hasher } = authFakes()
+    await register(ANA)
 
     await expect(signIn.execute({ email: ANA.email, password: 'wrong' })).rejects.toBeInstanceOf(
       InvalidCredentialsError,

package/templates/api/test/domain/auth/use-cases/sign-up.use-case.spec.ts

@@ -5,10 +5,10 @@ import { EmailTakenError } from '@/domain/auth/errors/email-taken.error'
 const ANA = { name: 'Ana', email: ' Ana@Example.com', password: 'correct-horse-battery' }
 
 describe('SignUpUseCase', () => {
-  it('creates the user and the profile together, and starts a session', async () => {
-    const { signUp, users, profiles, sessions } = authFakes()
+  it('creates the user and the profile together', async () => {
+    const { signUp, users, profiles } = authFakes()
 
-    const tokens = await signUp.execute(ANA)
+    await signUp.execute(ANA)
     const [user] = [...users.rows.values()]
 
     expect(user).toMatchObject({
@@ -16,8 +16,6 @@ describe('SignUpUseCase', () => {
       passwordHash: 'hashed:correct-horse-battery',
     })
     expect(profiles.rows.get(user?.id ?? '')).toMatchObject({ displayName: 'Ana' })
-    expect(sessions.rows.size).toBe(1)
-    expect(tokens.refreshToken.startsWith(`${[...sessions.rows.keys()][0]}.`)).toBe(true)
   })
 
   it('refuses an email already taken, whatever its case', async () => {
@@ -30,4 +28,14 @@ describe('SignUpUseCase', () => {
     )
     expect(profiles.rows.size).toBe(1)
   })
+
+  // prumo:email
+  it('sends a code and opens no session until the email is confirmed', async () => {
+    const { signUp, sessions, mailer } = authFakes()
+
+    expect(await signUp.execute(ANA)).toBeNull()
+    expect(sessions.rows.size).toBe(0)
+    expect(mailer.lastCode('ana@example.com')).toMatch(/^\d{6}$/)
+  })
+  // prumo:end-email
 })

package/templates/api/test/domain/auth/use-cases/social.use-case.spec.ts

@@ -0,0 +1,148 @@
+import { socialFakes } from '@test/support/fakes/social-fakes'
+import { describe, expect, it } from 'vitest'
+import { ProviderEmailUnverifiedError } from '@/domain/auth/errors/provider-email-unverified.error'
+import { ProviderNotConfiguredError } from '@/domain/auth/errors/provider-not-configured.error'
+import { SocialSignInFailedError } from '@/domain/auth/errors/social-sign-in-failed.error'
+
+const ANA = { name: 'Ana', email: 'ana@example.com', password: 'correct-horse-battery' }
+const GOOGLE = {
+  subject: 'google-sub-1',
+  email: 'Ana@Example.com',
+  emailVerified: true,
+  name: 'Ana G',
+}
+
+describe('LinkIdentityUseCase', () => {
+  it('creates a verified, password-less account with its profile for someone new', async () => {
+    const { linkIdentity, users, profiles, identities } = socialFakes()
+
+    const userId = await linkIdentity.execute('google', GOOGLE)
+    const user = users.rows.get(userId)
+
+    expect(user).toMatchObject({ email: 'ana@example.com', passwordHash: null })
+    expect(user?.emailVerifiedAt).not.toBeNull()
+    expect(profiles.rows.get(userId)).toMatchObject({ displayName: 'Ana G' })
+    expect(identities.rows).toEqual([expect.objectContaining({ provider: 'google', userId })])
+  })
+
+  it('recognises the provider account the next time, by subject even if the email changed', async () => {
+    const { linkIdentity } = socialFakes()
+
+    const first = await linkIdentity.execute('google', GOOGLE)
+    const again = await linkIdentity.execute('google', { ...GOOGLE, email: 'new@example.com' })
+
+    expect(again).toBe(first)
+  })
+
+  it('links to a confirmed account and leaves its password alone', async () => {
+    const { register, linkIdentity, users, signIn } = socialFakes()
+    await register(ANA)
+    // Confirmed by a code where the project verifies emails; marked here so the rule is proved either way.
+    for (const user of users.rows.values()) {
+      user.verifyEmail(new Date())
+    }
+
+    const userId = await linkIdentity.execute('google', GOOGLE)
+
+    expect(users.rows.get(userId)?.passwordHash).toBe('hashed:correct-horse-battery')
+    await expect(signIn.execute(ANA)).resolves.toBeDefined()
+  })
+
+  // The attack: someone signs up with another person's email first, and waits for them to arrive by Google.
+  it('takes an unconfirmed account from whoever chose its password, ending their sessions', async () => {
+    const { signUp, linkIdentity, users, sessions } = socialFakes()
+    await signUp.execute(ANA)
+    const squatter = [...users.rows.values()][0]
+
+    const userId = await linkIdentity.execute('google', GOOGLE)
+
+    expect(userId).toBe(squatter?.id)
+    expect(users.rows.get(userId)?.passwordHash).toBeNull()
+    expect([...sessions.rows.values()].every((session) => session.revokedAt !== null)).toBe(true)
+  })
+
+  it('refuses an email the provider has not verified', async () => {
+    const { linkIdentity } = socialFakes()
+
+    await expect(
+      linkIdentity.execute('google', { ...GOOGLE, emailVerified: false }),
+    ).rejects.toBeInstanceOf(ProviderEmailUnverifiedError)
+  })
+})
+
+describe('a social sign-in, start to session', () => {
+  it('signs the web in on return, and only the browser that started', async () => {
+    const { start, complete } = socialFakes()
+    const { url, browserToken } = await start.execute({
+      provider: 'google',
+      client: 'web',
+      returnTo: '/orders',
+    })
+    const state = new URL(url).searchParams.get('state') ?? ''
+    const callback = {
+      provider: 'google' as const,
+      state,
+      callbackUrl: new URL('http://localhost:3000/cb'),
+      name: null,
+    }
+
+    await expect(complete.execute({ ...callback, browserToken: undefined })).rejects.toBeInstanceOf(
+      SocialSignInFailedError,
+    )
+
+    const outcome = await complete.execute({ ...callback, browserToken })
+
+    expect(outcome).toMatchObject({ client: 'web', returnTo: '/orders' })
+    await expect(complete.execute({ ...callback, browserToken })).rejects.toBeInstanceOf(
+      SocialSignInFailedError,
+    )
+  })
+
+  it('gives a mobile app a code it can exchange once', async () => {
+    const { start, complete, exchange } = socialFakes()
+    const { url, browserToken } = await start.execute({
+      provider: 'apple',
+      client: 'mobile',
+      returnTo: '/',
+    })
+    const outcome = await complete.execute({
+      provider: 'apple',
+      state: new URL(url).searchParams.get('state') ?? '',
+      browserToken,
+      callbackUrl: new URL('http://localhost:3000/cb'),
+      name: 'Ana',
+    })
+
+    if (outcome.client !== 'mobile') {
+      throw new Error('expected a code for the mobile app')
+    }
+
+    await expect(exchange.execute(outcome.code)).resolves.toBeDefined()
+    await expect(exchange.execute(outcome.code)).rejects.toBeInstanceOf(SocialSignInFailedError)
+  })
+
+  it('refuses a provider without credentials, and a callback for another provider', async () => {
+    const { start, complete, providers } = socialFakes()
+    const { url, browserToken } = await start.execute({
+      provider: 'google',
+      client: 'web',
+      returnTo: '/',
+    })
+
+    await expect(
+      complete.execute({
+        provider: 'apple',
+        state: new URL(url).searchParams.get('state') ?? '',
+        browserToken,
+        callbackUrl: new URL('http://localhost:3000/cb'),
+        name: null,
+      }),
+    ).rejects.toBeInstanceOf(SocialSignInFailedError)
+
+    Object.assign(providers, { configured: [] })
+
+    await expect(
+      start.execute({ provider: 'google', client: 'web', returnTo: '/' }),
+    ).rejects.toBeInstanceOf(ProviderNotConfiguredError)
+  })
+})

package/templates/api/test/domain/oauth/entities/authorization.entity.spec.ts

@@ -15,6 +15,7 @@ const request = {
   codeChallenge: 'challenge',
   clientState: null,
   resource: 'http://localhost:3000/api/mcp',
+  scope: 'profile:read',
 }
 
 describe('Authorization', () => {

package/templates/api/test/infra/email/hmac-one-time-codes.adapter.spec.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest'
+import { HmacOneTimeCodes } from '@/infra/email/hmac-one-time-codes.adapter'
+
+describe('HmacOneTimeCodes', () => {
+  it('makes six digits, and a digest that depends on the secret', () => {
+    const codes = new HmacOneTimeCodes({ JWT_SECRET: 'a'.repeat(40) })
+    const other = new HmacOneTimeCodes({ JWT_SECRET: 'b'.repeat(40) })
+
+    for (let i = 0; i < 50; i += 1) {
+      expect(codes.create()).toMatch(/^\d{6}$/)
+    }
+    expect(codes.digest('123456')).toBe(codes.digest('123456'))
+    expect(codes.digest('123456')).not.toBe(other.digest('123456'))
+  })
+})