@tstdl/base 0.93.144 → 0.93.146

package/authentication/authentication.api.d.ts

@@ -126,6 +126,9 @@ export declare const authenticationApiDefinition: {
         timestamp: {
             resource: string;
             result: import("../schema/index.js").NumberSchema;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
         };
     };
 };
@@ -248,6 +251,9 @@ export declare function getAuthenticationApiDefinition<AdditionalTokenPayload ex
         timestamp: {
             resource: string;
             result: import("../schema/index.js").NumberSchema;
+            data: {
+                [dontWaitForValidToken]: boolean;
+            };
         };
     };
 };
@@ -365,6 +371,9 @@ export declare function getAuthenticationApiEndpointsDefinition<AdditionalTokenP
     timestamp: {
         resource: string;
         result: import("../schema/index.js").NumberSchema;
+        data: {
+            [dontWaitForValidToken]: boolean;
+        };
     };
 };
 export {};

package/authentication/authentication.api.js

@@ -147,6 +147,9 @@ export function getAuthenticationApiEndpointsDefinition(additionalTokenPayloadSc
         timestamp: {
             resource: 'timestamp',
             result: number(),
+            data: {
+                [dontWaitForValidToken]: true,
+            },
         },
     };
 }

package/authentication/client/authentication.service.js

@@ -420,7 +420,7 @@ let AuthenticationClientService = class AuthenticationClientService {
                         if (stillNeedsRefresh) {
                             await this.refresh();
                         }
-                        if (this.forceRefreshRequested() && (this.token() != currentToken)) {
+                        if (this.forceRefreshRequested() && (this.token()?.jti != currentToken?.jti)) {
                             this.forceRefreshRequested.set(false);
                         }
                     });
@@ -428,7 +428,7 @@ let AuthenticationClientService = class AuthenticationClientService {
                         // Lock held by another instance, wait 5 seconds or until token changes (Passive Sync)
                         const changeReason = await firstValueFrom(race([
                             timer(5000).pipe(map(() => 'timer')),
-                            this.token$.pipe(filter((t) => t != token), map(() => 'token')),
+                            this.token$.pipe(filter((t) => t?.jti != token.jti), map(() => 'token')),
                             from(this.disposeSignal),
                         ]), { defaultValue: undefined });
                         if (changeReason == 'token') {
@@ -442,7 +442,7 @@ let AuthenticationClientService = class AuthenticationClientService {
                 const delay = Math.min(maxRefreshDelay, ((currentToken?.exp ?? 0) - this.estimatedServerTimestampSeconds() - currentRefreshBufferSeconds) * millisecondsPerSecond);
                 const wakeUpSignals = [
                     from(this.disposeSignal),
-                    this.token$.pipe(filter((t) => t != currentToken)),
+                    this.token$.pipe(filter((t) => t?.jti != currentToken?.jti)),
                 ];
                 if (!forceRefresh) {
                     wakeUpSignals.push(this.forceRefreshRequested$.pipe(filter((requested) => requested)));
@@ -451,7 +451,7 @@ let AuthenticationClientService = class AuthenticationClientService {
                     await firstValueFrom(race([timer(delay), ...wakeUpSignals]), { defaultValue: undefined });
                 }
                 else {
-                    await firstValueFrom(race([timer(5000), ...wakeUpSignals]), { defaultValue: undefined });
+                    await firstValueFrom(race([timer(2500), ...wakeUpSignals]), { defaultValue: undefined });
                 }
             }
             catch (error) {
@@ -460,7 +460,7 @@ let AuthenticationClientService = class AuthenticationClientService {
                 await firstValueFrom(race([
                     timer(2500),
                     from(this.disposeSignal),
-                    this.token$.pipe(filter((t) => t != currentToken)),
+                    this.token$.pipe(filter((t) => t?.jti != currentToken?.jti)),
                     this.forceRefreshRequested$.pipe(filter((requested) => requested), skip(this.forceRefreshRequested() ? 1 : 0)),
                 ]), { defaultValue: undefined });
             }

package/authentication/client/http-client.middleware.js

@@ -1,5 +1,6 @@
-import { firstValueFrom, race, timeout } from 'rxjs';
+import { firstValueFrom, race, timeout as rxjsTimeout } from 'rxjs';
 import { HttpError } from '../../http/index.js';
+import { timeout } from '../../utils/timing.js';
 import { isDefined } from '../../utils/type-guards.js';
 import { cacheValueOrAsyncProvider } from '../../utils/value-or-provider.js';
 import { dontWaitForValidToken } from '../authentication.api.js';
@@ -19,10 +20,13 @@ export function waitForAuthenticationCredentialsMiddleware(authenticationService
                     authenticationService.validToken$,
                     request.cancellationSignal,
                 ]);
-                await firstValueFrom(race$.pipe(timeout(30000))).catch(() => undefined);
+                await firstValueFrom(race$.pipe(rxjsTimeout(30000))).catch(() => undefined);
                 if (request.cancellationSignal.isSet) {
                     break;
                 }
+                if (!authenticationService.hasValidToken && authenticationService.isLoggedIn()) {
+                    await timeout(100);
+                }
             }
         }
         await next();

package/authentication/tests/authentication.client-middleware.test.js

@@ -21,6 +21,41 @@ describe('waitForAuthenticationCredentialsMiddleware', () => {
         await middleware({ request }, next);
         expect(next).toHaveBeenCalled();
     });
+    test('should NOT wait if endpoint has dontWaitForValidToken', async () => {
+        const authenticationServiceMock = {
+            isLoggedIn: vi.fn().mockReturnValue(true),
+            hasValidToken: false,
+        };
+        const middleware = waitForAuthenticationCredentialsMiddleware(authenticationServiceMock);
+        const request = new HttpClientRequest('http://localhost');
+        request.context = {
+            endpoint: {
+                credentials: true,
+                data: {
+                    [dontWaitForValidToken]: true,
+                },
+            },
+        };
+        const next = vi.fn().mockResolvedValue(undefined);
+        await middleware({ request }, next);
+        expect(next).toHaveBeenCalled();
+    });
+    test('should NOT wait if credentials is NOT true', async () => {
+        const authenticationServiceMock = {
+            isLoggedIn: vi.fn().mockReturnValue(true),
+            hasValidToken: false,
+        };
+        const middleware = waitForAuthenticationCredentialsMiddleware(authenticationServiceMock);
+        const request = new HttpClientRequest('http://localhost');
+        request.context = {
+            endpoint: {
+                credentials: false,
+            },
+        };
+        const next = vi.fn().mockResolvedValue(undefined);
+        await middleware({ request }, next);
+        expect(next).toHaveBeenCalled();
+    });
 });
 describe('logoutOnUnauthorizedMiddleware', () => {
     test('should call logout on 401 error', async () => {

package/authentication/tests/authentication.client-service-refresh.test.js

@@ -123,4 +123,11 @@ describe('AuthenticationClientService Refresh Loop Reproduction', () => {
         // If it busy loops, this will be much higher than 1.
         expect(mockLock.tryUse.mock.calls.length).toBeLessThan(5);
     });
+    test('refresh() should call timestamp() to sync clock', async () => {
+        service = injector.resolve(AuthenticationClientService);
+        const newToken = { iat: 1000, exp: 2000, jti: 'new' };
+        mockApiClient.refresh.mockResolvedValue(newToken);
+        await service.refresh();
+        expect(mockApiClient.timestamp).toHaveBeenCalled();
+    });
 });

package/authentication/tests/authentication.client-service.test.js

@@ -47,27 +47,23 @@ describe('AuthenticationClientService Integration', () => {
         await clearTenantData(database, schema, ['credentials', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
     });
     test('login and logout should work', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'client-test@example.com', firstName: 'C', lastName: 'T' });
-            await serverService.setCredentials(user, 'Strong-Pass-2026!');
-            expect(service.isLoggedIn()).toBe(false);
-            await service.login({ tenantId, subject: user.id }, 'Strong-Pass-2026!');
-            expect(service.isLoggedIn()).toBe(true);
-            expect(service.subjectId()).toBe(user.id);
-            await service.logout();
-            expect(service.isLoggedIn()).toBe(false);
-        });
+        const user = await subjectService.createUser({ tenantId, email: 'client-test@example.com', firstName: 'C', lastName: 'T' });
+        await serverService.setCredentials(user, 'Strong-Pass-2026!');
+        expect(service.isLoggedIn()).toBe(false);
+        await service.login({ tenantId, subject: user.id }, 'Strong-Pass-2026!');
+        expect(service.isLoggedIn()).toBe(true);
+        expect(service.subjectId()).toBe(user.id);
+        await service.logout();
+        expect(service.isLoggedIn()).toBe(false);
     });
     test('refresh should work', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'refresh-test@example.com', firstName: 'R', lastName: 'T' });
-            await serverService.setCredentials(user, 'Strong-Pass-2026!');
-            await service.login({ tenantId, subject: user.id }, 'Strong-Pass-2026!');
-            const initialToken = service.token()?.jti;
-            await service.refresh();
-            expect(service.token()?.jti).not.toBe(initialToken);
-            expect(service.isLoggedIn()).toBe(true);
-        });
+        const user = await subjectService.createUser({ tenantId, email: 'refresh-test@example.com', firstName: 'R', lastName: 'T' });
+        await serverService.setCredentials(user, 'Strong-Pass-2026!');
+        await service.login({ tenantId, subject: user.id }, 'Strong-Pass-2026!');
+        const initialToken = service.token()?.jti;
+        await service.refresh();
+        expect(service.token()?.jti).not.toBe(initialToken);
+        expect(service.isLoggedIn()).toBe(true);
     });
     test('checkSecret should work', async () => {
         const result = await service.checkSecret('123');

package/authentication/tests/authentication.service.test.js

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'vitest';
 import { ActorType, Auditor } from '../../audit/index.js';
 import { NIL_UUID } from '../../constants.js';
-import { runInInjectionContext } from '../../injector/index.js';
 import { clearTenantData, setupIntegrationTest } from '../../testing/index.js';
 import { AuthenticationAncillaryService } from '../server/authentication-ancillary.service.js';
 import { AuthenticationService } from '../server/authentication.service.js';
@@ -33,151 +32,125 @@ describe('AuthenticationService', () => {
         await clearTenantData(database, schema, ['credentials', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
     });
     test('login should create a session and listSessions should return it', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({
-                tenantId,
-                email: 'test@example.com',
-                firstName: 'John',
-                lastName: 'Doe',
-            });
-            await authenticationService.setCredentials(user, 'Strong-Password-2026!');
-            const tokenResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, auditor.with({ actor: user.id, actorType: ActorType.Subject }));
-            expect(tokenResult.token).toBeDefined();
-            const sessions = await authenticationService.listSessions(tenantId, user.id);
-            expect(sessions).toHaveLength(1);
-            expect(sessions[0]?.id).toBe(tokenResult.jsonToken.payload.session);
+        const user = await subjectService.createUser({
+            tenantId,
+            email: 'test@example.com',
+            firstName: 'John',
+            lastName: 'Doe',
         });
+        await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+        const tokenResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, auditor.with({ actor: user.id, actorType: ActorType.Subject }));
+        expect(tokenResult.token).toBeDefined();
+        const sessions = await authenticationService.listSessions(tenantId, user.id);
+        expect(sessions).toHaveLength(1);
+        expect(sessions[0]?.id).toBe(tokenResult.jsonToken.payload.session);
     });
     test('invalidateAllSessions should end all active sessions', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({
-                tenantId,
-                email: 'test@example.com',
-                firstName: 'John',
-                lastName: 'Doe',
-            });
-            await authenticationService.setCredentials(user, 'Strong-Password-2026!');
-            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-            await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
-            await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
-            let sessions = await authenticationService.listSessions(tenantId, user.id);
-            expect(sessions).toHaveLength(2);
-            const now = Date.now();
-            expect(sessions.every((s) => s.end > now)).toBe(true);
-            await authenticationService.invalidateAllSessions(tenantId, user.id, userAuditor);
-            sessions = await authenticationService.listSessions(tenantId, user.id);
-            expect(sessions.every((s) => s.end <= now + 1000)).toBe(true); // small buffer for test execution time
+        const user = await subjectService.createUser({
+            tenantId,
+            email: 'test@example.com',
+            firstName: 'John',
+            lastName: 'Doe',
         });
+        await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+        await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+        await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+        let sessions = await authenticationService.listSessions(tenantId, user.id);
+        expect(sessions).toHaveLength(2);
+        const now = Date.now();
+        expect(sessions.every((s) => s.end > now)).toBe(true);
+        await authenticationService.invalidateAllSessions(tenantId, user.id, userAuditor);
+        sessions = await authenticationService.listSessions(tenantId, user.id);
+        expect(sessions.every((s) => s.end <= now + 1000)).toBe(true); // small buffer for test execution time
     });
     test('getSession and tryGetSession', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({
-                tenantId,
-                email: 'test@example.com',
-                firstName: 'John',
-                lastName: 'Doe',
-            });
-            await authenticationService.setCredentials(user, 'Strong-Password-2026!');
-            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-            const tokenResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
-            const sessionId = tokenResult.jsonToken.payload.session;
-            const session = await authenticationService.getSession(sessionId);
-            expect(session.id).toBe(sessionId);
-            const triedSession = await authenticationService.tryGetSession(sessionId);
-            expect(triedSession?.id).toBe(sessionId);
-            const nonExistent = await authenticationService.tryGetSession(NIL_UUID);
-            expect(nonExistent).toBeUndefined();
+        const user = await subjectService.createUser({
+            tenantId,
+            email: 'test@example.com',
+            firstName: 'John',
+            lastName: 'Doe',
         });
+        await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+        const tokenResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+        const sessionId = tokenResult.jsonToken.payload.session;
+        const session = await authenticationService.getSession(sessionId);
+        expect(session.id).toBe(sessionId);
+        const triedSession = await authenticationService.tryGetSession(sessionId);
+        expect(triedSession?.id).toBe(sessionId);
+        const nonExistent = await authenticationService.tryGetSession(NIL_UUID);
+        expect(nonExistent).toBeUndefined();
     });
     test('refresh should issue new token and session', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'refresh@example.com', firstName: 'R', lastName: 'F' });
-            await authenticationService.setCredentials(user, 'Strong-Password-2026!');
-            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-            const loginResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
-            const refreshResult = await authenticationService.refresh(loginResult.refreshToken, undefined, {}, userAuditor);
-            expect(refreshResult.token).toBeDefined();
-            expect(refreshResult.refreshToken).not.toBe(loginResult.refreshToken);
-        });
+        const user = await subjectService.createUser({ tenantId, email: 'refresh@example.com', firstName: 'R', lastName: 'F' });
+        await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+        const loginResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+        const refreshResult = await authenticationService.refresh(loginResult.refreshToken, undefined, {}, userAuditor);
+        expect(refreshResult.token).toBeDefined();
+        expect(refreshResult.refreshToken).not.toBe(loginResult.refreshToken);
     });
     test('changeSecret should update credentials', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'change@example.com', firstName: 'C', lastName: 'S' });
-            await authenticationService.setCredentials(user, 'Old-Password-2026!');
-            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-            await authenticationService.changeSecret({ tenantId, subject: user.id }, 'Old-Password-2026!', 'New-Password-2026!', userAuditor);
-            const authResult = await authenticationService.authenticate({ tenantId, subject: user.id }, 'New-Password-2026!');
-            expect(authResult.success).toBe(true);
-        });
+        const user = await subjectService.createUser({ tenantId, email: 'change@example.com', firstName: 'C', lastName: 'S' });
+        await authenticationService.setCredentials(user, 'Old-Password-2026!');
+        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+        await authenticationService.changeSecret({ tenantId, subject: user.id }, 'Old-Password-2026!', 'New-Password-2026!', userAuditor);
+        const authResult = await authenticationService.authenticate({ tenantId, subject: user.id }, 'New-Password-2026!');
+        expect(authResult.success).toBe(true);
     });
     test('checkSecret, testSecret, and validateSecret', async () => {
-        await runInInjectionContext(injector, async () => {
-            const weak = 'abc';
-            const strong = 'Very-Strong-Password-2026-!@#$';
-            expect((await authenticationService.checkSecret(weak)).strength).toBeLessThan(2);
-            expect((await authenticationService.checkSecret(strong)).strength).toBeGreaterThanOrEqual(2);
-            expect((await authenticationService.testSecret(weak)).success).toBe(false);
-            expect((await authenticationService.testSecret(strong)).success).toBe(true);
-            await expect(authenticationService.validateSecret(weak)).rejects.toThrow();
-            await expect(authenticationService.validateSecret(strong)).resolves.not.toThrow();
-        });
+        const weak = 'abc';
+        const strong = 'Very-Strong-Password-2026-!@#$';
+        expect((await authenticationService.checkSecret(weak)).strength).toBeLessThan(2);
+        expect((await authenticationService.checkSecret(strong)).strength).toBeGreaterThanOrEqual(2);
+        expect((await authenticationService.testSecret(weak)).success).toBe(false);
+        expect((await authenticationService.testSecret(strong)).success).toBe(true);
+        await expect(authenticationService.validateSecret(weak)).rejects.toThrow();
+        await expect(authenticationService.validateSecret(strong)).resolves.not.toThrow();
     });
     test('tryResolveSubject and resolveSubject', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'resolve@example.com', firstName: 'R', lastName: 'S' });
-            const resolved = await authenticationService.tryResolveSubject({ tenantId, subject: user.id });
-            expect(resolved?.id).toBe(user.id);
-            const resolvedByEmail = await authenticationService.resolveSubject({ tenantId, subject: 'resolve@example.com' });
-            expect(resolvedByEmail.id).toBe(user.id);
-            await expect(authenticationService.resolveSubject({ tenantId, subject: 'missing' })).rejects.toThrow();
-        });
+        const user = await subjectService.createUser({ tenantId, email: 'resolve@example.com', firstName: 'R', lastName: 'S' });
+        const resolved = await authenticationService.tryResolveSubject({ tenantId, subject: user.id });
+        expect(resolved?.id).toBe(user.id);
+        const resolvedByEmail = await authenticationService.resolveSubject({ tenantId, subject: 'resolve@example.com' });
+        expect(resolvedByEmail.id).toBe(user.id);
+        await expect(authenticationService.resolveSubject({ tenantId, subject: 'missing' })).rejects.toThrow();
     });
     test('impersonation and unimpersonation', async () => {
-        await runInInjectionContext(injector, async () => {
-            const admin = await subjectService.createUser({ tenantId, email: 'admin@example.com', firstName: 'A', lastName: 'D' });
-            const user = await subjectService.createUser({ tenantId, email: 'user@example.com', firstName: 'U', lastName: 'S' });
-            const adminAuditor = auditor.with({ actor: admin.id, actorType: ActorType.Subject });
-            const adminToken = await authenticationService.getToken(admin, undefined);
-            const impersonated = await authenticationService.impersonate(adminToken.token, adminToken.refreshToken, user.id, undefined, adminAuditor);
-            expect(impersonated.jsonToken.payload.subject).toBe(user.id);
-            expect(impersonated.jsonToken.payload.impersonator).toBe(admin.id);
-            const unimpersonated = await authenticationService.unimpersonate(impersonated.impersonatorRefreshToken, undefined, adminAuditor);
-            expect(unimpersonated.jsonToken.payload.subject).toBe(admin.id);
-            expect(unimpersonated.jsonToken.payload.impersonator).toBeUndefined();
-        });
+        const admin = await subjectService.createUser({ tenantId, email: 'admin@example.com', firstName: 'A', lastName: 'D' });
+        const user = await subjectService.createUser({ tenantId, email: 'user@example.com', firstName: 'U', lastName: 'S' });
+        const adminAuditor = auditor.with({ actor: admin.id, actorType: ActorType.Subject });
+        const adminToken = await authenticationService.getToken(admin, undefined);
+        const impersonated = await authenticationService.impersonate(adminToken.token, adminToken.refreshToken, user.id, undefined, adminAuditor);
+        expect(impersonated.jsonToken.payload.subject).toBe(user.id);
+        expect(impersonated.jsonToken.payload.impersonator).toBe(admin.id);
+        const unimpersonated = await authenticationService.unimpersonate(impersonated.impersonatorRefreshToken, undefined, adminAuditor);
+        expect(unimpersonated.jsonToken.payload.subject).toBe(admin.id);
+        expect(unimpersonated.jsonToken.payload.impersonator).toBeUndefined();
     });
     test('refresh should throw on invalid token', async () => {
-        await runInInjectionContext(injector, async () => {
-            await expect(authenticationService.refresh('invalid', undefined, {}, auditor)).rejects.toThrow();
-        });
+        await expect(authenticationService.refresh('invalid', undefined, {}, auditor)).rejects.toThrow();
     });
     test('login should throw on invalid credentials', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'fail@example.com', firstName: 'F', lastName: 'L' });
-            await authenticationService.setCredentials(user, 'Very-Strong-Password-2026!');
-            await expect(authenticationService.login({ tenantId, subject: user.id }, 'wrong', undefined, auditor)).rejects.toThrow();
-        });
+        const user = await subjectService.createUser({ tenantId, email: 'fail@example.com', firstName: 'F', lastName: 'L' });
+        await authenticationService.setCredentials(user, 'Very-Strong-Password-2026!');
+        await expect(authenticationService.login({ tenantId, subject: user.id }, 'wrong', undefined, auditor)).rejects.toThrow();
     });
     test('endSession should handle non-existent session gracefully', async () => {
-        await runInInjectionContext(injector, async () => {
-            await expect(authenticationService.endSession(NIL_UUID, auditor)).resolves.not.toThrow();
-        });
+        await expect(authenticationService.endSession(NIL_UUID, auditor)).resolves.not.toThrow();
     });
     test('resolveSubject should throw if not found', async () => {
-        await runInInjectionContext(injector, async () => {
-            await expect(authenticationService.resolveSubject({ tenantId, subject: 'missing' })).rejects.toThrow();
-        });
+        await expect(authenticationService.resolveSubject({ tenantId, subject: 'missing' })).rejects.toThrow();
     });
     test('secret reset flow', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'reset@example.com', firstName: 'R', lastName: 'E' });
-            const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-            await authenticationService.initSecretReset({ tenantId, subject: user.id }, undefined, userAuditor);
-            expect(ancillaryService.lastResetData).toBeDefined();
-            await authenticationService.resetSecret(ancillaryService.lastResetData.token, 'New-Password-Reset-2026!', userAuditor);
-            const authResult = await authenticationService.authenticate({ tenantId, subject: user.id }, 'New-Password-Reset-2026!');
-            expect(authResult.success).toBe(true);
-        });
+        const user = await subjectService.createUser({ tenantId, email: 'reset@example.com', firstName: 'R', lastName: 'E' });
+        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
+        await authenticationService.initSecretReset({ tenantId, subject: user.id }, undefined, userAuditor);
+        expect(ancillaryService.lastResetData).toBeDefined();
+        await authenticationService.resetSecret(ancillaryService.lastResetData.token, 'New-Password-Reset-2026!', userAuditor);
+        const authResult = await authenticationService.authenticate({ tenantId, subject: user.id }, 'New-Password-Reset-2026!');
+        expect(authResult.success).toBe(true);
     });
     test('deriveSigningSecrets should work', async () => {
         // This is mostly covered by initialize, but we can test it implicitly by ensuring service works after init

package/notification/tests/notification-client.test.js

@@ -1,9 +1,10 @@
 import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
 import { AuthenticationClientService } from '../../authentication/client/authentication.service.js';
-import { Injector, runInInjectionContext } from '../../injector/index.js';
+import { Injector } from '../../injector/index.js';
 import { NotificationApiClient } from '../../notification/api/index.js';
 import { NotificationClient } from '../../notification/client/notification-client.js';
 import { configureDefaultSignalsImplementation } from '../../signals/implementation/configure.js';
+import { timeout } from '../../utils/timing.js';
 import { BehaviorSubject, of, Subject } from 'rxjs';
 describe('NotificationClient', () => {
     let injector;
@@ -33,11 +34,9 @@ describe('NotificationClient', () => {
         sessionId$.next(undefined);
     });
     test('should initialize with empty state', () => {
-        runInInjectionContext(injector, () => {
-            expect(notificationClient.notifications()).toEqual([]);
-            expect(notificationClient.unreadCount()).toBe(0);
-            expect(notificationClient.types()).toEqual({});
-        });
+        expect(notificationClient.notifications()).toEqual([]);
+        expect(notificationClient.unreadCount()).toBe(0);
+        expect(notificationClient.types()).toEqual({});
     });
     test('should load notifications on session start', async () => {
         const notifications = [{ id: '1', type: 'test' }];
@@ -46,52 +45,44 @@ describe('NotificationClient', () => {
         notificationApiClientMock.listInApp.mockResolvedValue(notifications);
         notificationApiClientMock.unreadCount.mockResolvedValue(unreadCount);
         notificationApiClientMock.types.mockResolvedValue(types);
-        await runInInjectionContext(injector, async () => {
-            sessionId$.next('session-1');
-            // Wait for async operations (microtasks)
-            await new Promise(resolve => setTimeout(resolve, 0));
-            expect(notificationClient.notifications()).toEqual(notifications);
-            expect(notificationClient.unreadCount()).toBe(unreadCount);
-            expect(notificationClient.types()).toEqual(types);
-            expect(notificationApiClientMock.listInApp).toHaveBeenCalledWith({ limit: 20 });
-            expect(notificationApiClientMock.unreadCount).toHaveBeenCalled();
-            expect(notificationApiClientMock.types).toHaveBeenCalled();
-            expect(notificationApiClientMock.stream).toHaveBeenCalled();
-        });
+        sessionId$.next('session-1');
+        // Wait for async operations (microtasks)
+        await timeout(0);
+        expect(notificationClient.notifications()).toEqual(notifications);
+        expect(notificationClient.unreadCount()).toBe(unreadCount);
+        expect(notificationClient.types()).toEqual(types);
+        expect(notificationApiClientMock.listInApp).toHaveBeenCalledWith({ limit: 20 });
+        expect(notificationApiClientMock.unreadCount).toHaveBeenCalled();
+        expect(notificationApiClientMock.types).toHaveBeenCalled();
+        expect(notificationApiClientMock.stream).toHaveBeenCalled();
     });
     test('should clear notifications on session end', async () => {
         const notifications = [{ id: '1', type: 'test' }];
         notificationApiClientMock.listInApp.mockResolvedValue(notifications);
-        await runInInjectionContext(injector, async () => {
-            sessionId$.next('session-1');
-            await new Promise(resolve => setTimeout(resolve, 0));
-            expect(notificationClient.notifications()).toHaveLength(1);
-            sessionId$.next(undefined);
-            await new Promise(resolve => setTimeout(resolve, 0));
-            expect(notificationClient.notifications()).toEqual([]);
-            expect(notificationClient.unreadCount()).toBe(0);
-        });
+        sessionId$.next('session-1');
+        await timeout(0);
+        expect(notificationClient.notifications()).toHaveLength(1);
+        sessionId$.next(undefined);
+        await timeout(0);
+        expect(notificationClient.notifications()).toEqual([]);
+        expect(notificationClient.unreadCount()).toBe(0);
     });
     test('should handle new notification from stream', async () => {
         const initialNotifications = [{ id: '1', type: 'test' }];
         notificationApiClientMock.listInApp.mockResolvedValue(initialNotifications);
-        await runInInjectionContext(injector, async () => {
-            sessionId$.next('session-1');
-            await new Promise(resolve => setTimeout(resolve, 0));
-            const newNotification = { id: '2', type: 'test' };
-            stream$.next({ notification: newNotification, unreadCount: 1 });
-            expect(notificationClient.notifications()).toEqual([newNotification, ...initialNotifications]);
-            expect(notificationClient.unreadCount()).toBe(1);
-        });
+        sessionId$.next('session-1');
+        await timeout(0);
+        const newNotification = { id: '2', type: 'test' };
+        stream$.next({ notification: newNotification, unreadCount: 1 });
+        expect(notificationClient.notifications()).toEqual([newNotification, ...initialNotifications]);
+        expect(notificationClient.unreadCount()).toBe(1);
     });
     test('should handle unread count update from stream', async () => {
         notificationApiClientMock.listInApp.mockResolvedValue([]);
-        await runInInjectionContext(injector, async () => {
-            sessionId$.next('session-1');
-            await new Promise(resolve => setTimeout(resolve, 0));
-            stream$.next({ unreadCount: 10 });
-            expect(notificationClient.unreadCount()).toBe(10);
-        });
+        sessionId$.next('session-1');
+        await timeout(0);
+        stream$.next({ unreadCount: 10 });
+        expect(notificationClient.unreadCount()).toBe(10);
     });
     test('should load next page of notifications', async () => {
         const page1 = [{ id: '2', type: 'test' }];
@@ -99,14 +90,12 @@ describe('NotificationClient', () => {
         notificationApiClientMock.listInApp
             .mockResolvedValueOnce(page1) // Initial load
             .mockResolvedValueOnce(page2); // Pagination
-        await runInInjectionContext(injector, async () => {
-            sessionId$.next('session-1');
-            await new Promise(resolve => setTimeout(resolve, 0));
-            expect(notificationClient.notifications()).toEqual(page1);
-            notificationClient.loadNext(10);
-            await new Promise(resolve => setTimeout(resolve, 0));
-            expect(notificationClient.notifications()).toEqual([...page1, ...page2]);
-            expect(notificationApiClientMock.listInApp).toHaveBeenCalledWith({ limit: 10, after: '2' });
-        });
+        sessionId$.next('session-1');
+        await timeout(0);
+        expect(notificationClient.notifications()).toEqual(page1);
+        notificationClient.loadNext(10);
+        await timeout(0);
+        expect(notificationClient.notifications()).toEqual([...page1, ...page2]);
+        expect(notificationApiClientMock.listInApp).toHaveBeenCalledWith({ limit: 10, after: '2' });
     });
 });