acrylblends 0.6.3 → 0.6.4

package/plugins/acryl-router/src/core/middleware/jwk/index.test.ts

@@ -1,1135 +0,0 @@
-import { HttpResponse, http } from 'msw'
-import { setupServer } from 'msw/node'
-import { jwk } from './index.ts'
-import { setSignedCookie } from '../../helper/cookie/index.ts'
-import { Acryl } from '../../app.ts'
-import { HTTPException } from '../../http-exception.ts'
-import { encodeBase64Url } from '../../utils/encode.ts'
-import { Jwt } from '../../utils/jwt/index.ts'
-import type { AcrylJsonWebKey } from '../../utils/jwt/jws.ts'
-import { signing } from '../../utils/jwt/jws.ts'
-import { verifyWithJwks } from '../../utils/jwt/jwt.ts'
-import type { JWTPayload } from '../../utils/jwt/types.ts'
-import { utf8Encoder } from '../../utils/jwt/utf8.ts'
-import test_keys from './keys.test.json' with { type: 'json' }
-
-const verify_keys = test_keys.public_keys
-
-describe('JWK', () => {
-  const server = setupServer(
-    http.get('http://localhost/.well-known/jwks.json', () => {
-      return HttpResponse.json({ keys: verify_keys })
-    }),
-    http.get('http://localhost/.well-known/missing-jwks.json', () => {
-      return HttpResponse.json({})
-    }),
-    http.get('http://localhost/.well-known/bad-jwks.json', () => {
-      return HttpResponse.json({ keys: 'bad-keys' })
-    }),
-    http.get('http://localhost/.well-known/404-jwks.json', () => {
-      return HttpResponse.text('Not Found', { status: 404 })
-    })
-  )
-  beforeAll(() => server.listen())
-  afterEach(() => server.resetHandlers())
-  afterAll(() => server.close())
-
-  describe('verifyWithJwks', () => {
-    it('Should throw error on missing keys/jwks_uri options', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      await expect(verifyWithJwks(credential, { allowedAlgorithms: ['RS256'] })).rejects.toThrow(
-        'verifyWithJwks requires options for either "keys" or "jwks_uri" or both'
-      )
-    })
-  })
-
-  describe('options.allow_anon = true', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use('/backend-auth-or-anon/*', jwk({ keys: verify_keys, allow_anon: true, alg: ['RS256'] }))
-
-    app.get('/backend-auth-or-anon/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload ?? { message: 'hello anon' })
-    })
-
-    it('Should skip JWK if no token is present', async () => {
-      const req = new Request('http://localhost/backend-auth-or-anon/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello anon' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize if token is present', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/backend-auth-or-anon/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should not authorize if a non-Bearer scheme is present', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const url = 'http://localhost/backend-auth-or-anon/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Basic ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_request",error_description="invalid credentials structure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize if an invalid Bearer token is present', async () => {
-      const invalidToken =
-        'ssyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-      const url = 'http://localhost/backend-auth-or-anon/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Bearer ${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_token",error_description="token verification failure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-  })
-
-  describe('Credentials in header', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use('/auth-with-keys/*', jwk({ keys: verify_keys, alg: ['RS256'] }))
-    app.use('/auth-with-keys-unicode/*', jwk({ keys: verify_keys, alg: ['RS256'] }))
-    app.use('/auth-with-keys-nested/*', async (c, next) => {
-      const auth = jwk({ keys: verify_keys, alg: ['RS256'] })
-      return auth(c, next)
-    })
-    app.use(
-      '/auth-with-keys-fn/*',
-      jwk({
-        keys: async () => {
-          const response = await fetch('http://localhost/.well-known/jwks.json')
-          const data = await response.json()
-          return data.keys
-        },
-        alg: ['RS256'],
-      })
-    )
-    app.use(
-      '/auth-with-jwks_uri/*',
-      jwk({
-        jwks_uri: 'http://localhost/.well-known/jwks.json',
-        alg: ['RS256'],
-      })
-    )
-    app.use(
-      '/auth-with-keys-and-jwks_uri/*',
-      jwk({
-        keys: verify_keys,
-        jwks_uri: () => 'http://localhost/.well-known/jwks.json',
-        alg: ['RS256'],
-      })
-    )
-    app.use(
-      '/auth-with-missing-jwks_uri/*',
-      jwk({
-        jwks_uri: 'http://localhost/.well-known/missing-jwks.json',
-        alg: ['RS256'],
-      })
-    )
-    app.use(
-      '/auth-with-404-jwks_uri/*',
-      jwk({
-        jwks_uri: 'http://localhost/.well-known/404-jwks.json',
-        alg: ['RS256'],
-      })
-    )
-    app.use(
-      '/auth-with-bad-jwks_uri/*',
-      jwk({
-        jwks_uri: 'http://localhost/.well-known/bad-jwks.json',
-        alg: ['RS256'],
-      })
-    )
-
-    app.get('/auth-with-keys/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-keys-unicode/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-keys-nested/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-keys-fn/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-jwks_uri/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-keys-and-jwks_uri/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-missing-jwks_uri/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-404-jwks_uri/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-bad-jwks_uri/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should throw an error if the middleware is missing both keys and jwks_uri (empty)', async () => {
-      // @ts-expect-error - Testing runtime error with missing required alg option
-      expect(() => app.use('/auth-with-empty-middleware/*', jwk({}))).toThrow(
-        'JWK auth middleware requires options for either "keys" or "jwks_uri"'
-      )
-    })
-
-    it('Should throw an error when crypto.subtle is missing', async () => {
-      const subtleSpy = vi.spyOn(global.crypto, 'subtle', 'get').mockReturnValue({
-        importKey: undefined,
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      } as any)
-      expect(() =>
-        app.use('/auth-with-bad-env/*', jwk({ keys: verify_keys, alg: ['RS256'] }))
-      ).toThrow()
-      subtleSpy.mockRestore()
-    })
-
-    it('Should return a server error if options.jwks_uri returns a 404', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-404-jwks_uri/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(500)
-    })
-
-    it('Should return a server error if the remotely fetched keys from options.jwks_uri are missing', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-missing-jwks_uri/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(500)
-    })
-
-    it('Should return a server error if the remotely fetched keys from options.jwks_uri are malformed', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-bad-jwks_uri/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(500)
-    })
-
-    it('Should not authorize requests with missing access token', async () => {
-      const req = new Request('http://localhost/auth-with-keys/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize from a static array passed to options.keys (key 1)', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize from a static array passed to options.keys (key 2)', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[1])
-      const req = new Request('http://localhost/auth-with-keys/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-      expect(res.status).toBe(200)
-    })
-
-    it('Should not authorize a token without header', async () => {
-      const encodeJwtPart = (part: unknown): string =>
-        encodeBase64Url(utf8Encoder.encode(JSON.stringify(part)).buffer).replace(/=/g, '')
-      const encodeSignaturePart = (buf: ArrayBufferLike): string =>
-        encodeBase64Url(buf).replace(/=/g, '')
-      const jwtSignWithoutHeader = async (payload: JWTPayload, privateKey: AcrylJsonWebKey) => {
-        const encodedPayload = encodeJwtPart(payload)
-        const signaturePart = await signing(
-          privateKey,
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          privateKey.alg as any,
-          utf8Encoder.encode(encodedPayload)
-        )
-        const signature = encodeSignaturePart(signaturePart)
-        return `${encodedPayload}.${signature}`
-      }
-      const credential = await jwtSignWithoutHeader(
-        { message: 'hello world' },
-        test_keys.private_keys[1]
-      )
-      const req = new Request('http://localhost/auth-with-keys/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-    })
-
-    it('Should not authorize a token with missing "kid" in header', async () => {
-      const encodeJwtPart = (part: unknown): string =>
-        encodeBase64Url(utf8Encoder.encode(JSON.stringify(part)).buffer).replace(/=/g, '')
-      const encodeSignaturePart = (buf: ArrayBufferLike): string =>
-        encodeBase64Url(buf).replace(/=/g, '')
-      const jwtSignWithoutKid = async (payload: JWTPayload, privateKey: AcrylJsonWebKey) => {
-        const encodedPayload = encodeJwtPart(payload)
-        const encodedHeader = encodeJwtPart({ alg: privateKey.alg, typ: 'JWT' })
-        const partialToken = `${encodedHeader}.${encodedPayload}`
-        const signaturePart = await signing(
-          privateKey,
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          privateKey.alg as any,
-          utf8Encoder.encode(partialToken)
-        )
-        const signature = encodeSignaturePart(signaturePart)
-        return `${partialToken}.${signature}`
-      }
-      const credential = await jwtSignWithoutKid(
-        { message: 'hello world' },
-        test_keys.private_keys[1]
-      )
-      const req = new Request('http://localhost/auth-with-keys/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-    })
-
-    it('Should not authorize a token with invalid "kid" in header', async () => {
-      const copy = structuredClone(test_keys.private_keys[1])
-      copy.kid = 'invalid-kid'
-      const credential = await Jwt.sign({ message: 'hello world' }, copy)
-      const req = new Request('http://localhost/auth-with-keys/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-    })
-
-    it('Should authorize with Unicode payload from a static array passed to options.keys', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-unicode/a')
-      req.headers.set('Authorization', `bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize with mixed-case Bearer scheme', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-unicode/a')
-      req.headers.set('Authorization', `bEaReR ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize from a function passed to options.keys', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-fn/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize from keys remotely fetched from options.jwks_uri', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-jwks_uri/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize from keys and hard-coded and remotely fetched from options.jwks_uri', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-and-jwks_uri/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should not authorize requests with non-Bearer scheme in header', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const url = 'http://localhost/auth-with-keys-unicode/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Basic ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_request",error_description="invalid credentials structure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize requests with invalid token in Bearer header', async () => {
-      const invalidToken =
-        'ssyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const url = 'http://localhost/auth-with-keys-unicode/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Bearer ${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_token",error_description="token verification failure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize requests with malformed token structure in header', async () => {
-      const invalid_token = 'invalid token'
-      const url = 'http://localhost/auth-with-keys/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Bearer ${invalid_token}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_request",error_description="invalid credentials structure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize requests without authorization in nested JWK middleware', async () => {
-      const req = new Request('http://localhost/auth-with-keys-nested/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize requests with authorization in nested JWK middleware', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-nested/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-  })
-
-  describe('Credentials in custom header', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use(
-      '/auth-with-keys/*',
-      jwk({ keys: verify_keys, headerName: 'x-custom-auth-header', alg: ['RS256'] })
-    )
-
-    app.get('/auth-with-keys/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should not authorize', async () => {
-      const req = new Request('http://localhost/auth-with-keys/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize even if default authorization header present', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-
-      const req = new Request('http://localhost/auth-with-keys/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[1])
-
-      const req = new Request('http://localhost/auth-with-keys/a')
-      req.headers.set('x-custom-auth-header', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize with mixed-case Bearer scheme in custom header', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[1])
-
-      const req = new Request('http://localhost/auth-with-keys/a')
-      req.headers.set('x-custom-auth-header', `bEaReR ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should not authorize with non-Bearer scheme in custom header', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[1])
-      const url = 'http://localhost/auth-with-keys/a'
-
-      const req = new Request(url)
-      req.headers.set('x-custom-auth-header', `Basic ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_request",error_description="invalid credentials structure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize invalid token with Bearer scheme in custom header', async () => {
-      const invalidToken =
-        'ssyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-      const url = 'http://localhost/auth-with-keys/a'
-
-      const req = new Request(url)
-      req.headers.set('x-custom-auth-header', `Bearer ${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_token",error_description="token verification failure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-  })
-
-  describe('Credentials in cookie', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use('/auth-with-keys/*', jwk({ keys: verify_keys, cookie: 'access_token', alg: ['RS256'] }))
-    app.use(
-      '/auth-with-keys-unicode/*',
-      jwk({ keys: verify_keys, cookie: 'access_token', alg: ['RS256'] })
-    )
-    app.use(
-      '/auth-with-keys-prefixed/*',
-      jwk({
-        keys: verify_keys,
-        cookie: { key: 'access_token', prefixOptions: 'host' },
-        alg: ['RS256'],
-      })
-    )
-    app.use(
-      '/auth-with-keys-unprefixed/*',
-      jwk({ keys: verify_keys, cookie: { key: 'access_token' }, alg: ['RS256'] })
-    )
-
-    app.get('/auth-with-keys/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-keys-prefixed/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-keys-unprefixed/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-keys-unicode/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should not authorize requests with missing access token', async () => {
-      const req = new Request('http://localhost/auth-with-keys/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize cookie from a static array passed to options.keys', async () => {
-      const url = 'http://localhost/auth-with-keys/a'
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request(url, {
-        headers: new Headers({
-          Cookie: `access_token=${credential}`,
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(res.status).toBe(200)
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize prefixed cookie from a static array passed to options.keys', async () => {
-      const url = 'http://localhost/auth-with-keys-prefixed/a'
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request(url, {
-        headers: new Headers({
-          Cookie: `__Host-access_token=${credential}`,
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(res.status).toBe(200)
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize unprefixed cookie from a static array passed to options.keys', async () => {
-      const url = 'http://localhost/auth-with-keys-unprefixed/a'
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request(url, {
-        headers: new Headers({
-          Cookie: `access_token=${credential}`,
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(res.status).toBe(200)
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize with Unicode payload from a static array passed to options.keys', async () => {
-      const credential = await Jwt.sign({ message: 'hello world' }, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-unicode/a', {
-        headers: new Headers({
-          Cookie: `access_token=${credential}`,
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should not authorize requests with invalid Unicode payload in cookie', async () => {
-      const invalidToken =
-        'ssyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const url = 'http://localhost/auth-with-keys-unicode/a'
-      const req = new Request(url)
-      req.headers.set('Cookie', `access_token=${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_token",error_description="token verification failure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize requests with malformed token structure in cookie', async () => {
-      const invalidToken = 'invalid token'
-      const url = 'http://localhost/auth-with-keys/a'
-      const req = new Request(url)
-      req.headers.set('Cookie', `access_token=${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_token",error_description="token verification failure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-  })
-
-  describe('Credentials in a signed cookie', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-    const test_secret = 'Shhh'
-
-    app.use(
-      '/auth-with-signed-cookie/*',
-      jwk({
-        keys: verify_keys,
-        cookie: { key: 'access_token', secret: test_secret },
-        alg: ['RS256'],
-      })
-    )
-    app.use(
-      '/auth-with-signed-with-prefix-options-cookie/*',
-      jwk({
-        keys: verify_keys,
-        cookie: { key: 'access_token', secret: test_secret, prefixOptions: 'host' },
-        alg: ['RS256'],
-      })
-    )
-
-    app.get('/sign-cookie', async (c) => {
-      const credential = await Jwt.sign(
-        { message: 'signed hello world' },
-        test_keys.private_keys[0]
-      )
-      await setSignedCookie(c, 'access_token', credential, test_secret)
-      return c.text('OK')
-    })
-    app.get('/sign-cookie-with-prefix', async (c) => {
-      const credential = await Jwt.sign(
-        { message: 'signed hello world' },
-        test_keys.private_keys[0]
-      )
-      await setSignedCookie(c, 'access_token', credential, test_secret, { prefix: 'host' })
-      return c.text('OK')
-    })
-    app.get('/auth-with-signed-cookie/*', async (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-signed-with-prefix-options-cookie/*', async (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should authorize signed cookie', async () => {
-      const url = 'http://localhost/auth-with-signed-cookie/a'
-      const sign_res = await app.request('http://localhost/sign-cookie')
-      const cookieHeader = sign_res.headers.get('Set-Cookie') as string
-      expect(cookieHeader).not.toBeNull()
-      const req = new Request(url)
-      req.headers.set('Cookie', cookieHeader)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'signed hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize prefixed signed cookie', async () => {
-      const url = 'http://localhost/auth-with-signed-with-prefix-options-cookie/a'
-      const sign_res = await app.request('http://localhost/sign-cookie-with-prefix')
-      const cookieHeader = sign_res.headers.get('Set-Cookie') as string
-      expect(cookieHeader).not.toBeNull()
-      const req = new Request(url)
-      req.headers.set('Cookie', cookieHeader)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'signed hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should not authorize an unsigned cookie', async () => {
-      const url = 'http://localhost/auth-with-signed-cookie/a'
-      const credential = await Jwt.sign(
-        { message: 'unsigned hello world' },
-        test_keys.private_keys[0]
-      )
-      const unsignedCookie = `access_token=${credential}`
-      const req = new Request(url)
-      req.headers.set('Cookie', unsignedCookie)
-      const res = await app.request(req)
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-  })
-
-  describe('Error handling with `cause`', () => {
-    const app = new Acryl()
-
-    app.use('/auth-with-keys/*', jwk({ keys: verify_keys, alg: ['RS256'] }))
-    app.get('/auth-with-keys/*', (c) => c.text('Authorized'))
-
-    app.onError((e, c) => {
-      if (e instanceof HTTPException && e.cause instanceof Error) {
-        return c.json({ name: e.cause.name, message: e.cause.message }, 401)
-      }
-      return c.text(e.message, 401)
-    })
-
-    it('Should not authorize', async () => {
-      const credential = 'abc.def.ghi'
-      const req = new Request('http://localhost/auth-with-keys')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res.status).toBe(401)
-      expect(await res.json()).toEqual({
-        name: 'JwtTokenInvalid',
-        message: `invalid JWT token: ${credential}`,
-      })
-    })
-  })
-
-  describe('Verification of token attributes', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    function inFuture() {
-      return Date.now() / 1000 + 100
-    }
-
-    function inPast() {
-      return Date.now() / 1000 - 100
-    }
-
-    const app = new Acryl()
-
-    app.use('/auth-with-keys-default/*', jwk({ keys: verify_keys, alg: ['RS256'] }))
-    app.use(
-      '/auth-with-keys-and-issuer/*',
-      jwk({ keys: verify_keys, verification: { iss: 'http://issuer.test' }, alg: ['RS256'] })
-    )
-
-    app.get('/auth-with-keys-default/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-with-keys-and-issuer/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should validate exp/nbf/iat and pass when good by default', async () => {
-      const payload = {
-        exp: inFuture(),
-        nbf: inPast(),
-        iat: inPast(),
-        iss: 'http://not-checked.test',
-      }
-      const credential = await Jwt.sign(payload, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-default/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual(payload)
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should validate exp and fail when bad', async () => {
-      const payload = {
-        exp: inPast(),
-      }
-      const credential = await Jwt.sign(payload, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-default/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should validate nbf and fail when bad', async () => {
-      const payload = {
-        nbf: inFuture(),
-      }
-      const credential = await Jwt.sign(payload, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-default/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should validate iat and fail when bad', async () => {
-      const payload = {
-        iat: inFuture(),
-      }
-      const credential = await Jwt.sign(payload, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-default/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should validate iss when supplied', async () => {
-      const payload = {
-        iss: 'http://issuer.test',
-      }
-      const credential = await Jwt.sign(payload, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-and-issuer/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual(payload)
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should reject missing iss when required', async () => {
-      const payload = {
-        // Nothing
-      }
-      const credential = await Jwt.sign(payload, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-and-issuer/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should reject iss when different', async () => {
-      const payload = {
-        iss: 'http://bad-issuer.test',
-      }
-      const credential = await Jwt.sign(payload, test_keys.private_keys[0])
-      const req = new Request('http://localhost/auth-with-keys-and-issuer/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(handlerExecuted).toBeFalsy()
-    })
-  })
-
-  describe('Algorithm whitelist (options.alg)', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    // Only allow RS256
-    app.use('/auth-whitelist-rs256/*', jwk({ keys: verify_keys, alg: ['RS256'] }))
-    app.get('/auth-whitelist-rs256/*', (c) => {
-      handlerExecuted = true
-      return c.json(c.get('jwtPayload'))
-    })
-
-    // Allow multiple algorithms
-    app.use('/auth-whitelist-multi/*', jwk({ keys: verify_keys, alg: ['RS256', 'ES256'] }))
-    app.get('/auth-whitelist-multi/*', (c) => {
-      handlerExecuted = true
-      return c.json(c.get('jwtPayload'))
-    })
-
-    // Note: Test for "no whitelist" was removed because alg is now required.
-    // This is a breaking change that enforces explicit algorithm specification for security.
-
-    it('Should authorize RS256 token when RS256 is in whitelist', async () => {
-      const payload = { message: 'hello world' }
-      const credential = await Jwt.sign(payload, test_keys.private_keys[0]) // RS256 key
-      const req = new Request('http://localhost/auth-whitelist-rs256/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual(payload)
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should reject token when algorithm is not in whitelist', async () => {
-      // Create a token with ES256 algorithm manually
-      const kid = 'acryl-test-kid-1' // Use existing kid but header will have different alg
-      const payload = { message: 'hello world' }
-
-      // Generate ES256 key pair for signing
-      const keyPair = await crypto.subtle.generateKey(
-        {
-          name: 'ECDSA',
-          namedCurve: 'P-256',
-        },
-        true,
-        ['sign', 'verify']
-      )
-
-      // Create JWT with ES256
-      const header = { alg: 'ES256', typ: 'JWT', kid }
-      const encode = (obj: object) =>
-        encodeBase64Url(utf8Encoder.encode(JSON.stringify(obj)).buffer)
-      const encodedHeader = encode(header)
-      const encodedPayload = encode(payload)
-      const signingInput = `${encodedHeader}.${encodedPayload}`
-
-      const signatureBuffer = await signing(
-        keyPair.privateKey,
-        'ES256',
-        utf8Encoder.encode(signingInput)
-      )
-      const signature = encodeBase64Url(signatureBuffer)
-
-      const token = `${encodedHeader}.${encodedPayload}.${signature}`
-
-      const url = 'http://localhost/auth-whitelist-rs256/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Bearer ${token}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toMatch(/token verification failure/)
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize RS256 token when multiple algorithms are in whitelist', async () => {
-      const payload = { message: 'hello world' }
-      const credential = await Jwt.sign(payload, test_keys.private_keys[0]) // RS256 key
-      const req = new Request('http://localhost/auth-whitelist-multi/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual(payload)
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    // Note: Test for "no whitelist" was removed because alg is now required.
-    // This is a breaking change that enforces explicit algorithm specification for security.
-  })
-  describe('WWW-Authenticate realm', () => {
-    it('Should default to the request URL', async () => {
-      const app = new Acryl()
-      app.use('/auth/*', jwk({ keys: verify_keys, alg: ['RS256'] }))
-      app.get('/auth/*', (c) => c.text('ok'))
-
-      const res = await app.request('http://localhost/auth/page?a=1')
-
-      expect(res.status).toBe(401)
-      expect(res.headers.get('WWW-Authenticate')).toBe(
-        'Bearer realm="http://localhost/auth/page?a=1",error="invalid_request",error_description="no authorization included in request"'
-      )
-    })
-
-    it('Should use the configured realm', async () => {
-      const app = new Acryl()
-      app.use('/auth/*', jwk({ keys: verify_keys, alg: ['RS256'], realm: 'my-api' }))
-      app.get('/auth/*', (c) => c.text('ok'))
-
-      const res = await app.request('http://localhost/auth/page?a=1')
-
-      expect(res.status).toBe(401)
-      expect(res.headers.get('WWW-Authenticate')).toBe(
-        'Bearer realm="my-api",error="invalid_request",error_description="no authorization included in request"'
-      )
-    })
-
-    it('Should use the configured realm for an invalid token', async () => {
-      const app = new Acryl()
-      app.use('/auth/*', jwk({ keys: verify_keys, alg: ['RS256'], realm: 'my-api' }))
-      app.get('/auth/*', (c) => c.text('ok'))
-
-      const req = new Request('http://localhost/auth/page')
-      req.headers.set('Authorization', 'Bearer invalid-token')
-      const res = await app.request(req)
-
-      expect(res.status).toBe(401)
-      expect(res.headers.get('WWW-Authenticate')).toBe(
-        'Bearer realm="my-api",error="invalid_token",error_description="token verification failure"'
-      )
-    })
-
-    it('Should escape double quotes in the realm', async () => {
-      const app = new Acryl()
-      app.use('/auth/*', jwk({ keys: verify_keys, alg: ['RS256'], realm: 'my "quoted" api' }))
-      app.get('/auth/*', (c) => c.text('ok'))
-
-      const res = await app.request('http://localhost/auth/page')
-
-      expect(res.status).toBe(401)
-      expect(res.headers.get('WWW-Authenticate')).toBe(
-        'Bearer realm="my \\"quoted\\" api",error="invalid_request",error_description="no authorization included in request"'
-      )
-    })
-  })
-})