acrylblends 0.6.3 → 0.6.4

package/plugins/acryl-router/src/core/middleware/jwt/index.test.ts

@@ -1,802 +0,0 @@
-import { describe, expectTypeOf } from 'vitest'
-import { jwt } from './index.ts'
-import type { JwtVariables } from './index.ts'
-import { Acryl } from '../../app.ts'
-import { HTTPException } from '../../http-exception.ts'
-
-describe('JWT', () => {
-  describe('Credentials in header', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use('/auth/*', jwt({ secret: 'a-secret', alg: 'HS256' }))
-    app.use('/auth-unicode/*', jwt({ secret: 'a-secret', alg: 'HS256' }))
-    app.use('/nested/*', async (c, next) => {
-      const auth = jwt({ secret: 'a-secret', alg: 'HS256' })
-      return auth(c, next)
-    })
-
-    app.get('/auth/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-unicode/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/nested/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should not authorize', async () => {
-      const req = new Request('http://localhost/auth/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-      const req = new Request('http://localhost/auth/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize with lowercase bearer scheme', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const req = new Request('http://localhost/auth-unicode/a')
-      req.headers.set('Authorization', `bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize with mixed-case Bearer scheme', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const req = new Request('http://localhost/auth-unicode/a')
-      req.headers.set('Authorization', `bEaReR ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should not authorize with non-Bearer scheme', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const url = 'http://localhost/auth-unicode/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Basic ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_request",error_description="invalid credentials structure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize invalid token with Bearer scheme', async () => {
-      const invalidToken =
-        'ssyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const url = 'http://localhost/auth-unicode/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Bearer ${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_token",error_description="token verification failure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize', async () => {
-      const invalid_token = 'invalid token'
-      const url = 'http://localhost/auth/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Bearer ${invalid_token}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_request",error_description="invalid credentials structure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize - nested', async () => {
-      const req = new Request('http://localhost/nested/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize - nested', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-      const req = new Request('http://localhost/nested/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-  })
-
-  describe('Credentials in custom header', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use(
-      '/auth/*',
-      jwt({ secret: 'a-secret', alg: 'HS256', headerName: 'x-custom-auth-header' })
-    )
-    app.use(
-      '/auth-unicode/*',
-      jwt({ secret: 'a-secret', alg: 'HS256', headerName: 'x-custom-auth-header' })
-    )
-    app.use('/nested/*', async (c, next) => {
-      const auth = jwt({ secret: 'a-secret', alg: 'HS256', headerName: 'x-custom-auth-header' })
-      return auth(c, next)
-    })
-
-    app.get('/auth/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-unicode/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/nested/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should not authorize', async () => {
-      const req = new Request('http://localhost/auth/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize even if default authorization header present', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-      const req = new Request('http://localhost/auth/a')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-      const req = new Request('http://localhost/auth/a')
-      req.headers.set('x-custom-auth-header', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize with lowercase bearer scheme', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const req = new Request('http://localhost/auth-unicode/a')
-      req.headers.set('x-custom-auth-header', `bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize with mixed-case Bearer scheme in custom header', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const req = new Request('http://localhost/auth-unicode/a')
-      req.headers.set('x-custom-auth-header', `bEaReR ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should not authorize with non-Bearer scheme in custom header', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const url = 'http://localhost/auth-unicode/a'
-      const req = new Request(url)
-      req.headers.set('x-custom-auth-header', `Basic ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_request",error_description="invalid credentials structure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize invalid token with Bearer scheme in custom header', async () => {
-      const invalidToken =
-        'ssyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const url = 'http://localhost/auth-unicode/a'
-      const req = new Request(url)
-      req.headers.set('x-custom-auth-header', `Bearer ${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_token",error_description="token verification failure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize Unicode even if default authorization header present', async () => {
-      const invalidToken =
-        'ssyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const url = 'http://localhost/auth-unicode/a'
-      const req = new Request(url)
-      req.headers.set('Authorization', `Basic ${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_request",error_description="no authorization included in request"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize', async () => {
-      const invalid_token = 'invalid token'
-      const url = 'http://localhost/auth/a'
-      const req = new Request(url)
-      req.headers.set('x-custom-auth-header', `Bearer ${invalid_token}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_request",error_description="invalid credentials structure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize - nested', async () => {
-      const req = new Request('http://localhost/nested/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize - nested even if default authorization header present', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-      const req = new Request('http://localhost/nested/a')
-      const res = await app.request(req)
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize - nested', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-      const req = new Request('http://localhost/nested/a')
-      req.headers.set('x-custom-auth-header', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-  })
-
-  describe('Credentials in cookie', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use('/auth/*', jwt({ secret: 'a-secret', alg: 'HS256', cookie: 'access_token' }))
-    app.use('/auth-unicode/*', jwt({ secret: 'a-secret', alg: 'HS256', cookie: 'access_token' }))
-
-    app.get('/auth/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-    app.get('/auth-unicode/*', (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should not authorize', async () => {
-      const req = new Request('http://localhost/auth/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize', async () => {
-      const url = 'http://localhost/auth/a'
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-      const req = new Request(url, {
-        headers: new Headers({
-          Cookie: `access_token=${credential}`,
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(res.status).toBe(200)
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should authorize Unicode', async () => {
-      const credential =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const req = new Request('http://localhost/auth-unicode/a', {
-        headers: new Headers({
-          Cookie: `access_token=${credential}`,
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-
-    it('Should not authorize Unicode', async () => {
-      const invalidToken =
-        'ssyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const url = 'http://localhost/auth-unicode/a'
-      const req = new Request(url)
-      req.headers.set('Cookie', `access_token=${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_token",error_description="token verification failure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should not authorize', async () => {
-      const invalidToken = 'invalid token'
-      const url = 'http://localhost/auth/a'
-      const req = new Request(url)
-      req.headers.set('Cookie', `access_token=${invalidToken}`)
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(res.headers.get('www-authenticate')).toEqual(
-        `Bearer realm="${url}",error="invalid_token",error_description="token verification failure"`
-      )
-      expect(handlerExecuted).toBeFalsy()
-    })
-  })
-
-  describe('Error handling with `cause`', () => {
-    const app = new Acryl()
-
-    app.use('/auth/*', jwt({ secret: 'a-secret', alg: 'HS256' }))
-    app.get('/auth/*', (c) => c.text('Authorized'))
-
-    app.onError((e, c) => {
-      if (e instanceof HTTPException && e.cause instanceof Error) {
-        return c.json({ name: e.cause.name, message: e.cause.message }, 401)
-      }
-      return c.text(e.message, 401)
-    })
-
-    it('Should not authorize', async () => {
-      const credential = 'abc.def.ghi'
-      const req = new Request('http://localhost/auth')
-      req.headers.set('Authorization', `Bearer ${credential}`)
-      const res = await app.request(req)
-      expect(res.status).toBe(401)
-      expect(await res.json()).toEqual({
-        name: 'JwtTokenInvalid',
-        message: `invalid JWT token: ${credential}`,
-      })
-    })
-  })
-
-  describe('Credentials in signed cookie with prefix Options', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use(
-      '/auth/*',
-      jwt({
-        secret: 'a-secret',
-        alg: 'HS256',
-        cookie: {
-          key: 'cookie_name',
-          secret: 'cookie_secret',
-          prefixOptions: 'host',
-        },
-      })
-    )
-
-    app.get('/auth/*', async (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should not authorize', async () => {
-      const req = new Request('http://localhost/auth/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize', async () => {
-      const url = 'http://localhost/auth/a'
-      const req = new Request(url, {
-        headers: new Headers({
-          Cookie:
-            '__Host-cookie_name=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE.i2NSvtJOXOPS9NDL1u8dqTYmMrzcD4mNSws6P6qmeV0%3D; Path=/',
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-  })
-
-  describe('Credentials in signed cookie without prefix Options', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use(
-      '/auth/*',
-      jwt({
-        secret: 'a-secret',
-        alg: 'HS256',
-        cookie: {
-          key: 'cookie_name',
-          secret: 'cookie_secret',
-        },
-      })
-    )
-
-    app.get('/auth/*', async (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should not authorize', async () => {
-      const req = new Request('http://localhost/auth/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize', async () => {
-      const url = 'http://localhost/auth/a'
-      const req = new Request(url, {
-        headers: new Headers({
-          Cookie:
-            'cookie_name=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE.i2NSvtJOXOPS9NDL1u8dqTYmMrzcD4mNSws6P6qmeV0%3D; Path=/',
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-  })
-
-  describe('Credentials in cookie object with prefix Options', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use(
-      '/auth/*',
-      jwt({
-        secret: 'a-secret',
-        alg: 'HS256',
-        cookie: {
-          key: 'cookie_name',
-          prefixOptions: 'host',
-        },
-      })
-    )
-
-    app.get('/auth/*', async (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should not authorize', async () => {
-      const req = new Request('http://localhost/auth/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize', async () => {
-      const url = 'http://localhost/auth/a'
-      const req = new Request(url, {
-        headers: new Headers({
-          Cookie:
-            '__Host-cookie_name=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE',
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-  })
-
-  describe('Credentials in cookie object without prefix Options', () => {
-    let handlerExecuted: boolean
-
-    beforeEach(() => {
-      handlerExecuted = false
-    })
-
-    const app = new Acryl()
-
-    app.use(
-      '/auth/*',
-      jwt({
-        secret: 'a-secret',
-        alg: 'HS256',
-        cookie: {
-          key: 'cookie_name',
-        },
-      })
-    )
-
-    app.get('/auth/*', async (c) => {
-      handlerExecuted = true
-      const payload = c.get('jwtPayload')
-      return c.json(payload)
-    })
-
-    it('Should not authorize', async () => {
-      const req = new Request('http://localhost/auth/a')
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(401)
-      expect(await res.text()).toBe('Unauthorized')
-      expect(handlerExecuted).toBeFalsy()
-    })
-
-    it('Should authorize', async () => {
-      const url = 'http://localhost/auth/a'
-      const req = new Request(url, {
-        headers: new Headers({
-          Cookie:
-            'cookie_name=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE',
-        }),
-      })
-      const res = await app.request(req)
-      expect(res).not.toBeNull()
-      expect(res.status).toBe(200)
-      expect(await res.json()).toEqual({ message: 'hello world' })
-      expect(handlerExecuted).toBeTruthy()
-    })
-  })
-
-  describe('Security: Algorithm Confusion Attack Prevention', () => {
-    it('Should throw error when alg option is not provided', () => {
-      expect(() => {
-        // @ts-expect-error - intentionally testing without alg option
-        jwt({ secret: 'a-secret' })
-      }).toThrow('JWT auth middleware requires options for "alg"')
-    })
-
-    it('Should reject tokens with mismatched algorithm', async () => {
-      const app = new Acryl()
-
-      // Configure middleware to expect RS256
-      app.use('/auth/*', jwt({ secret: 'a-secret', alg: 'RS256' }))
-      app.get('/auth/*', (c) => {
-        return c.json(c.get('jwtPayload'))
-      })
-
-      // Try to use a HS256 token (algorithm confusion attempt)
-      const hs256Token =
-        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXNzYWdlIjoiaGVsbG8gd29ybGQifQ.B54pAqIiLbu170tGQ1rY06Twv__0qSHTA0ioQPIOvFE'
-
-      const req = new Request('http://localhost/auth/a')
-      req.headers.set('Authorization', `Bearer ${hs256Token}`)
-      const res = await app.request(req)
-
-      // Should fail because the token algorithm doesn't match expected algorithm
-      expect(res.status).toBe(401)
-    })
-
-    it('Should require explicit alg specification in middleware options', () => {
-      // This should work - explicit alg specified
-      expect(() => {
-        jwt({ secret: 'a-secret', alg: 'HS256' })
-      }).not.toThrow()
-
-      // This should throw - alg not specified
-      expect(() => {
-        // @ts-expect-error - intentionally testing without alg option
-        jwt({ secret: 'a-secret' })
-      }).toThrow('JWT auth middleware requires options for "alg"')
-    })
-  })
-
-  describe('Type tests', () => {
-    it('Should infer correct payload type when JwtVariables<T> is specified', () => {
-      type User = {
-        id: string
-        email: string
-        isAdmin: boolean
-      }
-
-      const app = new Acryl<{ Variables: JwtVariables<User> }>()
-
-      app.get('/', (c) => {
-        const payload = c.var.jwtPayload
-        expectTypeOf(payload).toEqualTypeOf<User>()
-        return c.json(payload)
-      })
-    })
-
-    it('Should infer unknown when JwtVariables is used without type parameter in Variables', () => {
-      const app = new Acryl<{ Variables: JwtVariables }>()
-
-      app.get('/', (c) => {
-        const payload = c.var.jwtPayload
-        expectTypeOf(payload).toEqualTypeOf<any>()
-        return c.json(payload)
-      })
-    })
-  })
-  describe('WWW-Authenticate realm', () => {
-    it('Should default to the request URL', async () => {
-      const app = new Acryl()
-      app.use('/auth/*', jwt({ secret: 'a-secret', alg: 'HS256' }))
-      app.get('/auth/*', (c) => c.text('ok'))
-
-      const res = await app.request('http://localhost/auth/page?a=1')
-
-      expect(res.status).toBe(401)
-      expect(res.headers.get('WWW-Authenticate')).toBe(
-        'Bearer realm="http://localhost/auth/page?a=1",error="invalid_request",error_description="no authorization included in request"'
-      )
-    })
-
-    it('Should use the configured realm', async () => {
-      const app = new Acryl()
-      app.use('/auth/*', jwt({ secret: 'a-secret', alg: 'HS256', realm: 'my-api' }))
-      app.get('/auth/*', (c) => c.text('ok'))
-
-      const res = await app.request('http://localhost/auth/page?a=1')
-
-      expect(res.status).toBe(401)
-      expect(res.headers.get('WWW-Authenticate')).toBe(
-        'Bearer realm="my-api",error="invalid_request",error_description="no authorization included in request"'
-      )
-    })
-
-    it('Should use the configured realm for an invalid token', async () => {
-      const app = new Acryl()
-      app.use('/auth/*', jwt({ secret: 'a-secret', alg: 'HS256', realm: 'my-api' }))
-      app.get('/auth/*', (c) => c.text('ok'))
-
-      const req = new Request('http://localhost/auth/page')
-      req.headers.set('Authorization', 'Bearer invalid-token')
-      const res = await app.request(req)
-
-      expect(res.status).toBe(401)
-      expect(res.headers.get('WWW-Authenticate')).toBe(
-        'Bearer realm="my-api",error="invalid_token",error_description="token verification failure"'
-      )
-    })
-
-    it('Should escape double quotes in the realm', async () => {
-      const app = new Acryl()
-      app.use('/auth/*', jwt({ secret: 'a-secret', alg: 'HS256', realm: 'my "quoted" api' }))
-      app.get('/auth/*', (c) => c.text('ok'))
-
-      const res = await app.request('http://localhost/auth/page')
-
-      expect(res.status).toBe(401)
-      expect(res.headers.get('WWW-Authenticate')).toBe(
-        'Bearer realm="my \\"quoted\\" api",error="invalid_request",error_description="no authorization included in request"'
-      )
-    })
-  })
-})