@stonecrop/casl-middleware 0.14.0 → 0.15.0

package/dist/tests/jwt.test.js

@@ -1,700 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import jwt from 'jsonwebtoken';
-import { createJWTMiddleware, createJWT, createHTTPJWTMiddleware, refreshTokenUtils, } from '../src/middleware/jwt';
-describe('JWT Middleware', () => {
-    const TEST_SECRET = 'test-secret-key-for-testing';
-    const TEST_USER = {
-        id: 'user-123',
-        roles: ['user', 'editor'],
-    };
-    describe('createJWT', () => {
-        it('should create a valid JWT token', () => {
-            const token = createJWT(TEST_USER, {
-                secret: TEST_SECRET,
-                expiresIn: '1h',
-            });
-            expect(token).toBeDefined();
-            expect(token.split('.')).toHaveLength(3);
-            // Verify the token
-            const decoded = jwt.verify(token, TEST_SECRET);
-            expect(decoded.sub).toBe(TEST_USER.id);
-            expect(decoded.roles).toEqual(TEST_USER.roles);
-        });
-        it('should include additional claims', () => {
-            const token = createJWT(TEST_USER, {
-                secret: TEST_SECRET,
-                additionalClaims: {
-                    email: 'user@example.com',
-                    permissions: ['read:posts', 'write:posts'],
-                },
-            });
-            const decoded = jwt.verify(token, TEST_SECRET);
-            expect(decoded.email).toBe('user@example.com');
-            expect(decoded.permissions).toEqual(['read:posts', 'write:posts']);
-        });
-        it('should set issuer and audience', () => {
-            const token = createJWT(TEST_USER, {
-                secret: TEST_SECRET,
-                issuer: 'test-app',
-                audience: 'api.example.com',
-            });
-            const decoded = jwt.verify(token, TEST_SECRET, {
-                issuer: 'test-app',
-                audience: 'api.example.com',
-            });
-            expect(decoded.iss).toBe('test-app');
-            expect(decoded.aud).toBe('api.example.com');
-        });
-    });
-    describe('createJWTMiddleware', () => {
-        let mockContext;
-        let mockNext;
-        beforeEach(() => {
-            mockContext = {
-                req: {
-                    headers: {
-                        get: vi.fn(),
-                    },
-                },
-                user: undefined,
-            };
-            mockNext = vi.fn().mockResolvedValue('next-result');
-        });
-        it('should extract and verify valid JWT token', async () => {
-            const token = createJWT(TEST_USER, { secret: TEST_SECRET });
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue(`Bearer ${token}`);
-            await middleware(mockContext, mockNext);
-            expect(mockContext.user).toBeDefined();
-            expect(mockContext.user?.id).toBe(TEST_USER.id);
-            expect(mockContext.user?.roles).toEqual(TEST_USER.roles);
-            expect(mockNext).toHaveBeenCalled();
-        });
-        it('should handle token without Bearer prefix', async () => {
-            const token = createJWT(TEST_USER, { secret: TEST_SECRET });
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue(token);
-            await middleware(mockContext, mockNext);
-            expect(mockContext.user?.id).toBe(TEST_USER.id);
-            expect(mockNext).toHaveBeenCalled();
-        });
-        it('should throw error for invalid token', async () => {
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue('Bearer invalid-token');
-            await expect(middleware(mockContext, mockNext)).rejects.toThrow('Invalid token');
-            expect(mockNext).not.toHaveBeenCalled();
-        });
-        it('should throw error for expired token', async () => {
-            const token = jwt.sign({ sub: TEST_USER.id, roles: TEST_USER.roles }, TEST_SECRET, { expiresIn: '-1h' } // Already expired
-            );
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue(`Bearer ${token}`);
-            await expect(middleware(mockContext, mockNext)).rejects.toThrow('Token has expired');
-            expect(mockNext).not.toHaveBeenCalled();
-        });
-        it('should handle optional mode when no token is present', async () => {
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-                optional: true,
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue(null);
-            await middleware(mockContext, mockNext);
-            expect(mockContext.user).toBeUndefined();
-            expect(mockNext).toHaveBeenCalled();
-        });
-        it('should handle optional mode with invalid token', async () => {
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-                optional: true,
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue('Bearer invalid-token');
-            // Should not throw in optional mode
-            await middleware(mockContext, mockNext);
-            expect(mockContext.user).toBeUndefined();
-            expect(mockNext).toHaveBeenCalled();
-        });
-        it('should skip when disabled', async () => {
-            const middleware = createJWTMiddleware({
-                enabled: false,
-                secret: TEST_SECRET,
-            });
-            await middleware(mockContext, mockNext);
-            expect(mockContext.user).toBeUndefined();
-            expect(mockNext).toHaveBeenCalled();
-            expect(mockContext.req.headers.get).not.toHaveBeenCalled();
-        });
-        it('should use custom user extractor', async () => {
-            const customUser = {
-                id: 'custom-id',
-                roles: ['custom-role'],
-                customField: 'custom-value',
-            };
-            const token = jwt.sign({ user_id: 'custom-id', user_roles: ['custom-role'], extra: 'custom-value' }, TEST_SECRET);
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-                extractUser: payload => ({
-                    id: payload.user_id,
-                    roles: payload.user_roles,
-                    customField: payload.extra,
-                }),
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue(`Bearer ${token}`);
-            await middleware(mockContext, mockNext);
-            expect(mockContext.user).toEqual(customUser);
-        });
-        it('should verify with specific algorithms', async () => {
-            const token = jwt.sign({ sub: TEST_USER.id, roles: TEST_USER.roles }, TEST_SECRET, { algorithm: 'HS256' });
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-                algorithms: ['HS256'],
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue(`Bearer ${token}`);
-            await middleware(mockContext, mockNext);
-            expect(mockContext.user?.id).toBe(TEST_USER.id);
-        });
-        it('should verify issuer and audience', async () => {
-            const token = jwt.sign({ sub: TEST_USER.id, roles: TEST_USER.roles }, TEST_SECRET, {
-                issuer: 'test-app',
-                audience: 'api.example.com',
-            });
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-                issuer: 'test-app',
-                audience: 'api.example.com',
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue(`Bearer ${token}`);
-            await middleware(mockContext, mockNext);
-            expect(mockContext.user?.id).toBe(TEST_USER.id);
-        });
-        it('should store JWT payload in context', async () => {
-            const token = createJWT(TEST_USER, {
-                secret: TEST_SECRET,
-                additionalClaims: { extra: 'data' },
-            });
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-            });
-            mockContext.req.headers.get = vi.fn().mockReturnValue(`Bearer ${token}`);
-            await middleware(mockContext, mockNext);
-            expect(mockContext.jwtPayload).toBeDefined();
-            expect(mockContext.jwtPayload.extra).toBe('data');
-        });
-    });
-    describe('createHTTPJWTMiddleware', () => {
-        it('should work with Express-style middleware', async () => {
-            const token = createJWT(TEST_USER, { secret: TEST_SECRET });
-            const middleware = createHTTPJWTMiddleware({
-                secret: TEST_SECRET,
-            });
-            const req = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-                user: undefined,
-            };
-            const res = {
-                status: vi.fn().mockReturnThis(),
-                json: vi.fn(),
-            };
-            const next = vi.fn();
-            await middleware(req, res, next);
-            expect(req.user).toBeDefined();
-            expect(req.user?.id).toBe(TEST_USER.id);
-            expect(next).toHaveBeenCalled();
-            expect(res.status).not.toHaveBeenCalled();
-        });
-        it('should return 401 for invalid token', async () => {
-            const middleware = createHTTPJWTMiddleware({
-                secret: TEST_SECRET,
-            });
-            const req = {
-                headers: {
-                    authorization: 'Bearer invalid-token',
-                },
-            };
-            const res = {
-                status: vi.fn().mockReturnThis(),
-                json: vi.fn(),
-            };
-            const next = vi.fn();
-            await middleware(req, res, next);
-            expect(res.status).toHaveBeenCalledWith(401);
-            expect(res.json).toHaveBeenCalledWith({
-                error: 'Invalid token',
-                code: 'UNAUTHORIZED',
-            });
-            expect(next).not.toHaveBeenCalled();
-        });
-        it('should continue in optional mode without token', async () => {
-            const middleware = createHTTPJWTMiddleware({
-                secret: TEST_SECRET,
-                optional: true,
-            });
-            const req = {
-                headers: {},
-                user: undefined,
-            };
-            const res = {
-                status: vi.fn().mockReturnThis(),
-                json: vi.fn(),
-            };
-            const next = vi.fn();
-            await middleware(req, res, next);
-            expect(req.user).toBeUndefined();
-            expect(next).toHaveBeenCalled();
-            expect(res.status).not.toHaveBeenCalled();
-        });
-    });
-    describe('refreshTokenUtils', () => {
-        it('should create access and refresh token pair', () => {
-            const { accessToken, refreshToken } = refreshTokenUtils.createTokenPair(TEST_USER, {
-                accessSecret: TEST_SECRET,
-                refreshSecret: TEST_SECRET + '-refresh',
-            });
-            expect(accessToken).toBeDefined();
-            expect(refreshToken).toBeDefined();
-            // Verify access token
-            const accessPayload = jwt.verify(accessToken, TEST_SECRET);
-            expect(accessPayload.sub).toBe(TEST_USER.id);
-            expect(accessPayload.type).toBe('access');
-            // Verify refresh token
-            const refreshPayload = jwt.verify(refreshToken, TEST_SECRET + '-refresh');
-            expect(refreshPayload.sub).toBe(TEST_USER.id);
-            expect(refreshPayload.type).toBe('refresh');
-        });
-        it('should refresh access token with valid refresh token', async () => {
-            const refreshToken = jwt.sign({ sub: TEST_USER.id, type: 'refresh' }, TEST_SECRET + '-refresh', {
-                expiresIn: '7d',
-            });
-            const mockGetUserById = vi.fn().mockResolvedValue(TEST_USER);
-            const result = await refreshTokenUtils.refreshAccessToken(refreshToken, {
-                accessSecret: TEST_SECRET,
-                refreshSecret: TEST_SECRET + '-refresh',
-                getUserById: mockGetUserById,
-            });
-            expect(result.accessToken).toBeDefined();
-            expect(result.user).toEqual(TEST_USER);
-            expect(mockGetUserById).toHaveBeenCalledWith(TEST_USER.id);
-            // Verify new access token
-            const decoded = jwt.verify(result.accessToken, TEST_SECRET);
-            expect(decoded.sub).toBe(TEST_USER.id);
-            expect(decoded.type).toBe('access');
-        });
-        it('should reject invalid refresh token type', async () => {
-            // Use access token as refresh token (wrong type)
-            const wrongToken = jwt.sign({ sub: TEST_USER.id, type: 'access' }, TEST_SECRET + '-refresh');
-            const mockGetUserById = vi.fn();
-            await expect(refreshTokenUtils.refreshAccessToken(wrongToken, {
-                accessSecret: TEST_SECRET,
-                refreshSecret: TEST_SECRET + '-refresh',
-                getUserById: mockGetUserById,
-            })).rejects.toThrow('Invalid token type');
-            expect(mockGetUserById).not.toHaveBeenCalled();
-        });
-        it('should reject expired refresh token', async () => {
-            const expiredToken = jwt.sign({ sub: TEST_USER.id, type: 'refresh' }, TEST_SECRET + '-refresh', {
-                expiresIn: '-1h',
-            });
-            const mockGetUserById = vi.fn();
-            await expect(refreshTokenUtils.refreshAccessToken(expiredToken, {
-                accessSecret: TEST_SECRET,
-                refreshSecret: TEST_SECRET + '-refresh',
-                getUserById: mockGetUserById,
-            })).rejects.toThrow('Refresh token expired');
-        });
-        it('should reject if user not found', async () => {
-            const refreshToken = jwt.sign({ sub: 'non-existent', type: 'refresh' }, TEST_SECRET + '-refresh');
-            const mockGetUserById = vi.fn().mockResolvedValue(null);
-            await expect(refreshTokenUtils.refreshAccessToken(refreshToken, {
-                accessSecret: TEST_SECRET,
-                refreshSecret: TEST_SECRET + '-refresh',
-                getUserById: mockGetUserById,
-            })).rejects.toThrow('User not found');
-        });
-    });
-    describe('JWT with permissions', () => {
-        it('should handle JWT with embedded permissions', async () => {
-            const tokenWithPermissions = jwt.sign({
-                sub: TEST_USER.id,
-                roles: TEST_USER.roles,
-                permissions: [
-                    { action: 'create', subject: 'Post' },
-                    { action: 'update', subject: 'Post', conditions: { authorId: TEST_USER.id } },
-                ],
-            }, TEST_SECRET);
-            const middleware = createJWTMiddleware({
-                secret: TEST_SECRET,
-            });
-            const mockContext = {
-                req: {
-                    headers: {
-                        get: vi.fn().mockReturnValue(`Bearer ${tokenWithPermissions}`),
-                    },
-                },
-                user: undefined,
-            };
-            await middleware(mockContext, vi.fn());
-            expect(mockContext.user).toBeDefined();
-            expect(mockContext.user.permissions).toHaveLength(2);
-            expect(mockContext.user.permissions[0]).toEqual({
-                action: 'create',
-                subject: 'Post',
-            });
-        });
-    });
-});
-describe('JWT Configuration Validation', () => {
-    it('should throw error if neither secret nor publicKey is provided', () => {
-        expect(() => {
-            createJWTMiddleware({
-                enabled: true,
-                // No secret or publicKey
-            });
-        }).toThrow('JWT middleware requires either secret or publicKey');
-    });
-    it('should not throw when disabled without secret', () => {
-        expect(() => {
-            createJWTMiddleware({
-                enabled: false,
-                // No secret, but disabled
-            });
-        }).not.toThrow();
-    });
-});
-describe('JWT Middleware - Advanced Tests', () => {
-    const SECRET = 'test-secret-key';
-    beforeEach(() => {
-        vi.clearAllMocks();
-        // Clear environment for tests
-        delete process.env.NODE_ENV;
-    });
-    describe('Configuration validation', () => {
-        it('should throw error when enabled without secret or publicKey', () => {
-            expect(() => createJWTMiddleware({ enabled: true })).toThrow('JWT middleware requires either secret or publicKey');
-        });
-        it('should not throw when disabled without secret', () => {
-            expect(() => createJWTMiddleware({ enabled: false })).not.toThrow();
-        });
-        it('should accept publicKey instead of secret', () => {
-            const publicKey = '-----BEGIN PUBLIC KEY-----\ntest\n-----END PUBLIC KEY-----';
-            expect(() => createJWTMiddleware({ enabled: true, publicKey })).not.toThrow();
-        });
-    });
-    describe('Token extraction from different header sources', () => {
-        it('should extract token from req.headers.get', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
-            const context = {
-                req: {
-                    headers: {
-                        get: vi.fn((name) => (name === 'authorization' ? `Bearer ${token}` : null)),
-                    },
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toEqual({ id: '123', roles: ['user'], sub: '123', iat: expect.any(Number) });
-            expect(next).toHaveBeenCalled();
-        });
-        it('should extract token from request.headers.get', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
-            const context = {
-                request: {
-                    headers: {
-                        get: vi.fn((name) => (name === 'authorization' ? `Bearer ${token}` : null)),
-                    },
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toEqual({ id: '123', roles: ['user'], sub: '123', iat: expect.any(Number) });
-            expect(next).toHaveBeenCalled();
-        });
-        it('should extract token from context.headers object', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toEqual({ id: '123', roles: ['user'], sub: '123', iat: expect.any(Number) });
-            expect(next).toHaveBeenCalled();
-        });
-        it('should use custom header name', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, headerName: 'x-auth-token' });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
-            const context = {
-                headers: {
-                    'x-auth-token': `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toBeDefined();
-            expect(next).toHaveBeenCalled();
-        });
-    });
-    describe('Token prefix handling', () => {
-        it('should handle token without Bearer prefix', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, tokenPrefix: '' });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
-            const context = {
-                headers: {
-                    authorization: token,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toBeDefined();
-            expect(next).toHaveBeenCalled();
-        });
-        it('should handle custom token prefix', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, tokenPrefix: 'Token ' });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
-            const context = {
-                headers: {
-                    authorization: `Token ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toBeDefined();
-            expect(next).toHaveBeenCalled();
-        });
-    });
-    describe('Optional mode', () => {
-        it('should continue without error when optional and no token provided', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, optional: true });
-            const context = {
-                headers: {},
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            const result = await middleware(context, next);
-            expect(result).toBe('success');
-            expect(context.user).toBeUndefined();
-            expect(next).toHaveBeenCalled();
-        });
-        it('should log warning in development mode when token is invalid', async () => {
-            process.env.NODE_ENV = 'development';
-            const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => { });
-            const middleware = createJWTMiddleware({ secret: SECRET, optional: true });
-            const context = {
-                headers: {
-                    authorization: 'Bearer invalid-token',
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(consoleSpy).toHaveBeenCalled();
-            expect(next).toHaveBeenCalled();
-            consoleSpy.mockRestore();
-        });
-        it('should not log warning in production mode when token is invalid', async () => {
-            process.env.NODE_ENV = 'production';
-            const consoleSpy = vi.spyOn(console, 'warn').mockImplementation(() => { });
-            const middleware = createJWTMiddleware({ secret: SECRET, optional: true });
-            const context = {
-                headers: {
-                    authorization: 'Bearer invalid-token',
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(consoleSpy).not.toHaveBeenCalled();
-            expect(next).toHaveBeenCalled();
-            consoleSpy.mockRestore();
-        });
-    });
-    describe('Token verification options', () => {
-        it('should verify token with issuer', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, issuer: 'test-issuer' });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { issuer: 'test-issuer' });
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toBeDefined();
-            expect(next).toHaveBeenCalled();
-        });
-        it('should reject token with wrong issuer', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, issuer: 'expected-issuer' });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { issuer: 'wrong-issuer' });
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn();
-            await expect(middleware(context, next)).rejects.toThrow();
-        });
-        it('should verify token with audience', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, audience: 'test-audience' });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { audience: 'test-audience' });
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toBeDefined();
-            expect(next).toHaveBeenCalled();
-        });
-        it('should handle maxAge verification', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, maxAge: '1h' });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET);
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toBeDefined();
-            expect(next).toHaveBeenCalled();
-        });
-        it('should use custom algorithms', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, algorithms: ['HS384'] });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { algorithm: 'HS384' });
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toBeDefined();
-            expect(next).toHaveBeenCalled();
-        });
-    });
-    describe('Custom user extractor', () => {
-        it('should use custom extractUser function', async () => {
-            const customExtractor = (payload) => ({
-                id: payload.user_id,
-                roles: payload.user_roles,
-                email: payload.email,
-            });
-            const middleware = createJWTMiddleware({ secret: SECRET, extractUser: customExtractor });
-            const token = jwt.sign({ user_id: '123', user_roles: ['admin'], email: 'test@example.com' }, SECRET);
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toEqual({
-                id: '123',
-                roles: ['admin'],
-                email: 'test@example.com',
-            });
-            expect(next).toHaveBeenCalled();
-        });
-        it('should handle extractUser returning undefined', async () => {
-            const customExtractor = () => undefined;
-            const middleware = createJWTMiddleware({ secret: SECRET, extractUser: customExtractor });
-            const token = jwt.sign({ sub: '123' }, SECRET);
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.user).toBeUndefined();
-            // jwtPayload is only set when user is defined
-            expect(context.jwtPayload).toBeUndefined();
-            expect(next).toHaveBeenCalled();
-        });
-    });
-    describe('Error handling', () => {
-        it('should throw error when required and no token provided', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET, optional: false });
-            const context = {
-                headers: {},
-            };
-            const next = vi.fn();
-            await expect(middleware(context, next)).rejects.toThrow('No authorization header found');
-        });
-        it('should throw specific error for expired token', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, SECRET, { expiresIn: '-1s' });
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn();
-            await expect(middleware(context, next)).rejects.toThrow('Token has expired');
-        });
-        it('should throw specific error for invalid signature', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET });
-            const token = jwt.sign({ sub: '123', roles: ['user'] }, 'wrong-secret');
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn();
-            await expect(middleware(context, next)).rejects.toThrow('Invalid token');
-        });
-        it('should throw error for malformed token', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET });
-            const context = {
-                headers: {
-                    authorization: 'Bearer malformed.token',
-                },
-            };
-            const next = vi.fn();
-            await expect(middleware(context, next)).rejects.toThrow();
-        });
-    });
-    describe('JWT payload storage', () => {
-        it('should store JWT payload in context', async () => {
-            const middleware = createJWTMiddleware({ secret: SECRET });
-            const payload = { sub: '123', roles: ['user'], custom: 'data' };
-            const token = jwt.sign(payload, SECRET);
-            const context = {
-                headers: {
-                    authorization: `Bearer ${token}`,
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            await middleware(context, next);
-            expect(context.jwtPayload).toBeDefined();
-            expect(context.jwtPayload.sub).toBe('123');
-            expect(context.jwtPayload.custom).toBe('data');
-            expect(next).toHaveBeenCalled();
-        });
-    });
-    describe('Disabled mode', () => {
-        it('should skip JWT verification when disabled', async () => {
-            const middleware = createJWTMiddleware({ enabled: false, secret: SECRET });
-            const context = {
-                headers: {
-                    authorization: 'Bearer invalid-token',
-                },
-            };
-            const next = vi.fn().mockResolvedValue('success');
-            const result = await middleware(context, next);
-            expect(result).toBe('success');
-            expect(context.user).toBeUndefined();
-            expect(next).toHaveBeenCalled();
-        });
-    });
-});