alepha 0.14.2 → 0.14.4

package/src/api/verifications/__tests__/CodeVerification.spec.ts

@@ -0,0 +1,318 @@
+import { Alepha } from "alepha";
+import { DateTimeProvider } from "alepha/datetime";
+import { describe, it } from "vitest";
+import {
+  AlephaApiVerification,
+  VerificationController,
+  VerificationParameters,
+} from "../index.ts";
+
+const createTest = async () => {
+  const alepha = Alepha.create().with(AlephaApiVerification);
+  const parameters = alepha.inject(VerificationParameters).get("code");
+  const controller = alepha.inject(VerificationController);
+  const dateTimeProvider = alepha.inject(DateTimeProvider);
+  const target = "+33633115544";
+
+  await alepha.start();
+
+  return {
+    alepha,
+    parameters,
+    controller,
+    dateTimeProvider,
+    target,
+  };
+};
+
+describe("Code Verification", () => {
+  it("should verify phone with 6-digit code correctly", async ({ expect }) => {
+    const { parameters, controller, target } = await createTest();
+
+    const request = await controller.requestVerificationCode({
+      params: {
+        type: "code",
+      },
+      body: {
+        target,
+      },
+    });
+
+    expect(request.codeExpiration).toEqual(parameters.codeExpiration);
+    expect(request.verificationCooldown).toEqual(
+      parameters.verificationCooldown,
+    );
+    expect(request.maxVerificationAttempts).toEqual(parameters.maxAttempts);
+    expect(request.token).toBeTruthy();
+
+    const code = request.token;
+
+    // 6-digit code validation
+    expect(code).toMatch(/^\d{6}$/);
+    expect(code.length).toBe(parameters.codeLength);
+
+    expect(
+      await controller.validateVerificationCode({
+        params: {
+          type: "code",
+        },
+        body: {
+          target,
+          token: code,
+        },
+      }),
+    ).toEqual({
+      ok: true,
+    });
+
+    expect(
+      await controller.validateVerificationCode({
+        params: {
+          type: "code",
+        },
+        body: {
+          target,
+          token: code,
+        },
+      }),
+    ).toEqual({
+      ok: true,
+      alreadyVerified: true,
+    });
+  });
+
+  it("should handle invalid code", async ({ expect }) => {
+    const { controller, target } = await createTest();
+
+    await controller.requestVerificationCode({
+      params: {
+        type: "code",
+      },
+      body: {
+        target,
+      },
+    });
+
+    await expect(() =>
+      controller.validateVerificationCode({
+        params: {
+          type: "code",
+        },
+        body: {
+          target,
+          token: "999999",
+        },
+      }),
+    ).rejects.toThrowError("Invalid verification code");
+  });
+
+  it("should handle max attempts", async ({ expect }) => {
+    const { parameters, controller, target } = await createTest();
+
+    await controller.requestVerificationCode({
+      params: {
+        type: "code",
+      },
+      body: {
+        target,
+      },
+    });
+
+    for (let i = 0; i < parameters.maxAttempts; i++) {
+      await controller
+        .validateVerificationCode({
+          params: {
+            type: "code",
+          },
+          body: {
+            target,
+            token: "999999",
+          },
+        })
+        .catch(() => null);
+    }
+
+    await expect(() =>
+      controller.validateVerificationCode({
+        params: {
+          type: "code",
+        },
+        body: {
+          target,
+          token: "999999",
+        },
+      }),
+    ).rejects.toThrowError("Maximum number of attempts reached");
+  });
+
+  it("should handle cooldown", async ({ expect }) => {
+    const { dateTimeProvider, parameters, controller, target } =
+      await createTest();
+
+    await controller.requestVerificationCode({
+      params: {
+        type: "code",
+      },
+      body: {
+        target,
+      },
+    });
+
+    await expect(() =>
+      controller.requestVerificationCode({
+        params: {
+          type: "code",
+        },
+        body: {
+          target,
+        },
+      }),
+    ).rejects.toThrowError("Verification is on cooldown for ");
+
+    await dateTimeProvider.travel(
+      parameters.verificationCooldown + 1,
+      "seconds",
+    );
+
+    const response = await controller.requestVerificationCode({
+      params: {
+        type: "code",
+      },
+      body: {
+        target,
+      },
+    });
+
+    expect(response.codeExpiration).toEqual(parameters.codeExpiration);
+    expect(response.verificationCooldown).toEqual(
+      parameters.verificationCooldown,
+    );
+    expect(response.maxVerificationAttempts).toEqual(parameters.maxAttempts);
+    expect(response.token).toBeTruthy();
+  });
+
+  it("should respect rate limit per day", async ({ expect }) => {
+    const { parameters, controller, dateTimeProvider, target } =
+      await createTest();
+
+    for (let i = 0; i < parameters.limitPerDay; i++) {
+      await controller.requestVerificationCode({
+        params: {
+          type: "code",
+        },
+        body: {
+          target,
+        },
+      });
+      await dateTimeProvider.travel(
+        parameters.verificationCooldown + 1,
+        "seconds",
+      );
+    }
+
+    await expect(() =>
+      controller.requestVerificationCode({
+        params: {
+          type: "code",
+        },
+        body: {
+          target,
+        },
+      }),
+    ).rejects.toThrowError(
+      `Maximum number of verification requests per day reached (${parameters.limitPerDay})`,
+    );
+  });
+
+  it("should handle code expiration", async ({ expect }) => {
+    const { parameters, controller, dateTimeProvider, target } =
+      await createTest();
+
+    const response = await controller.requestVerificationCode({
+      params: {
+        type: "code",
+      },
+      body: {
+        target,
+      },
+    });
+
+    const code = response.token;
+
+    // Travel past expiration
+    await dateTimeProvider.travel(parameters.codeExpiration + 1, "seconds");
+
+    await expect(() =>
+      controller.validateVerificationCode({
+        params: {
+          type: "code",
+        },
+        body: {
+          target,
+          token: code,
+        },
+      }),
+    ).rejects.toThrowError("Verification code has expired");
+  });
+
+  it("should generate different codes for each request", async ({ expect }) => {
+    const { controller, dateTimeProvider, parameters, target } =
+      await createTest();
+
+    const response1 = await controller.requestVerificationCode({
+      params: {
+        type: "code",
+      },
+      body: {
+        target,
+      },
+    });
+
+    const code1 = response1.token;
+
+    await dateTimeProvider.travel(
+      parameters.verificationCooldown + 1,
+      "seconds",
+    );
+
+    const response2 = await controller.requestVerificationCode({
+      params: {
+        type: "code",
+      },
+      body: {
+        target,
+      },
+    });
+
+    const code2 = response2.token;
+
+    // Codes should be different (though technically they could be the same by chance)
+    // This tests that we're generating new codes, not reusing
+    expect(code1).toMatch(/^\d{6}$/);
+    expect(code2).toMatch(/^\d{6}$/);
+  });
+
+  it("should pad codes with leading zeros", async ({ expect }) => {
+    const { controller, target } = await createTest();
+
+    // Request multiple codes to increase chance of getting one with leading zeros
+    const codes: string[] = [];
+    for (let i = 0; i < 5; i++) {
+      const response = await controller.requestVerificationCode({
+        params: {
+          type: "code",
+        },
+        body: {
+          target: `${target}${i}`,
+        },
+      });
+      codes.push(response.token);
+    }
+
+    // All codes should be exactly 6 digits
+    for (const code of codes) {
+      expect(code).toMatch(/^\d{6}$/);
+      expect(code.length).toBe(6);
+    }
+  });
+});

package/src/api/verifications/__tests__/LinkVerification.spec.ts

@@ -0,0 +1,279 @@
+import { Alepha } from "alepha";
+import { DateTimeProvider } from "alepha/datetime";
+import { describe, it } from "vitest";
+import {
+  AlephaApiVerification,
+  VerificationController,
+  VerificationParameters,
+} from "../index.ts";
+
+const createTest = async () => {
+  const alepha = Alepha.create().with(AlephaApiVerification);
+  const parameters = alepha.inject(VerificationParameters).get("link");
+  const controller = alepha.inject(VerificationController);
+  const dateTimeProvider = alepha.inject(DateTimeProvider);
+  const target = "test@example.com";
+
+  await alepha.start();
+
+  return {
+    alepha,
+    parameters,
+    controller,
+    dateTimeProvider,
+    target,
+  };
+};
+
+describe("Link Verification", () => {
+  it("should verify link with UUID token correctly", async ({ expect }) => {
+    const { parameters, controller, target } = await createTest();
+
+    const request = await controller.requestVerificationCode({
+      params: {
+        type: "link",
+      },
+      body: {
+        target,
+      },
+    });
+
+    expect(request.codeExpiration).toEqual(parameters.codeExpiration);
+    expect(request.verificationCooldown).toEqual(
+      parameters.verificationCooldown,
+    );
+    expect(request.maxVerificationAttempts).toEqual(parameters.maxAttempts);
+    expect(request.token).toBeTruthy();
+
+    // UUID format validation
+    const token = request.token;
+    expect(token).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,
+    );
+
+    expect(
+      await controller.validateVerificationCode({
+        params: {
+          type: "link",
+        },
+        body: {
+          target,
+          token,
+        },
+      }),
+    ).toEqual({
+      ok: true,
+    });
+
+    expect(
+      await controller.validateVerificationCode({
+        params: {
+          type: "link",
+        },
+        body: {
+          target,
+          token,
+        },
+      }),
+    ).toEqual({
+      ok: true,
+      alreadyVerified: true,
+    });
+  });
+
+  it("should handle invalid token", async ({ expect }) => {
+    const { controller, target } = await createTest();
+
+    await controller.requestVerificationCode({
+      params: {
+        type: "link",
+      },
+      body: {
+        target,
+      },
+    });
+
+    await expect(() =>
+      controller.validateVerificationCode({
+        params: {
+          type: "link",
+        },
+        body: {
+          target,
+          token: "550e8400-e29b-41d4-a716-446655440000",
+        },
+      }),
+    ).rejects.toThrowError("Invalid verification code");
+  });
+
+  it("should handle max attempts", async ({ expect }) => {
+    const { parameters, controller, target } = await createTest();
+
+    await controller.requestVerificationCode({
+      params: {
+        type: "link",
+      },
+      body: {
+        target,
+      },
+    });
+
+    for (let i = 0; i < parameters.maxAttempts; i++) {
+      await controller
+        .validateVerificationCode({
+          params: {
+            type: "link",
+          },
+          body: {
+            target,
+            token: "550e8400-e29b-41d4-a716-446655440000",
+          },
+        })
+        .catch(() => null);
+    }
+
+    await expect(() =>
+      controller.validateVerificationCode({
+        params: {
+          type: "link",
+        },
+        body: {
+          target,
+          token: "550e8400-e29b-41d4-a716-446655440000",
+        },
+      }),
+    ).rejects.toThrowError("Maximum number of attempts reached");
+  });
+
+  it("should handle cooldown", async ({ expect }) => {
+    const { dateTimeProvider, parameters, controller, target } =
+      await createTest();
+
+    await controller.requestVerificationCode({
+      params: {
+        type: "link",
+      },
+      body: {
+        target,
+      },
+    });
+
+    await expect(() =>
+      controller.requestVerificationCode({
+        params: {
+          type: "link",
+        },
+        body: {
+          target,
+        },
+      }),
+    ).rejects.toThrowError("Verification is on cooldown for ");
+
+    await dateTimeProvider.travel(
+      parameters.verificationCooldown + 1,
+      "seconds",
+    );
+
+    const response = await controller.requestVerificationCode({
+      params: {
+        type: "link",
+      },
+      body: {
+        target,
+      },
+    });
+
+    expect(response.codeExpiration).toEqual(parameters.codeExpiration);
+    expect(response.verificationCooldown).toEqual(
+      parameters.verificationCooldown,
+    );
+    expect(response.maxVerificationAttempts).toEqual(parameters.maxAttempts);
+    expect(response.token).toBeTruthy();
+  });
+
+  it("should respect rate limit per day", async ({ expect }) => {
+    const { parameters, controller, dateTimeProvider, target } =
+      await createTest();
+
+    for (let i = 0; i < parameters.limitPerDay; i++) {
+      await controller.requestVerificationCode({
+        params: {
+          type: "link",
+        },
+        body: {
+          target,
+        },
+      });
+      await dateTimeProvider.travel(
+        parameters.verificationCooldown + 1,
+        "seconds",
+      );
+    }
+
+    await expect(() =>
+      controller.requestVerificationCode({
+        params: {
+          type: "link",
+        },
+        body: {
+          target,
+        },
+      }),
+    ).rejects.toThrowError(
+      `Maximum number of verification requests per day reached (${parameters.limitPerDay})`,
+    );
+  });
+
+  it("should handle token expiration", async ({ expect }) => {
+    const { parameters, controller, dateTimeProvider, target } =
+      await createTest();
+
+    const response = await controller.requestVerificationCode({
+      params: {
+        type: "link",
+      },
+      body: {
+        target,
+      },
+    });
+
+    const token = response.token;
+
+    // Travel past expiration
+    await dateTimeProvider.travel(parameters.codeExpiration + 1, "seconds");
+
+    await expect(() =>
+      controller.validateVerificationCode({
+        params: {
+          type: "link",
+        },
+        body: {
+          target,
+          token,
+        },
+      }),
+    ).rejects.toThrowError("Verification code has expired");
+  });
+
+  it("should return token in response", async ({ expect }) => {
+    const { parameters, controller, target } = await createTest();
+
+    const expectedMinutes = Math.floor(parameters.codeExpiration / 60);
+
+    const response = await controller.requestVerificationCode({
+      params: {
+        type: "link",
+      },
+      body: {
+        target,
+      },
+    });
+
+    expect(response.token).toBeTruthy();
+    expect(response.codeExpiration).toBe(parameters.codeExpiration);
+    // Verify token is a UUID
+    expect(response.token).toMatch(
+      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,
+    );
+  });
+});

package/src/api/verifications/entities/verifications.ts

@@ -1,18 +1,18 @@
 import type { Static } from "alepha";
 import { t } from "alepha";
-import { $entity, pg } from "alepha/orm";
+import { $entity, db } from "alepha/orm";
 import { verificationTypeEnumSchema } from "../schemas/verificationTypeEnumSchema.ts";
 
 export const verifications = $entity({
   name: "verification",
   schema: t.object({
-    id: pg.primaryKey(t.bigint()),
+    id: db.primaryKey(t.bigint()),
 
-    createdAt: pg.createdAt(),
+    createdAt: db.createdAt(),
 
-    updatedAt: pg.updatedAt(),
+    updatedAt: db.updatedAt(),
 
-    version: pg.version(),
+    version: db.version(),
 
     type: verificationTypeEnumSchema,
 
@@ -30,7 +30,7 @@ export const verifications = $entity({
       }),
     ),
 
-    attempts: pg.default(
+    attempts: db.default(
       t.integer({
         description: "Number of failed attempts (to prevent brute-force)",
       }),

package/src/api/verifications/jobs/VerificationJobs.spec.ts

@@ -0,0 +1,50 @@
+import { Alepha } from "alepha";
+import { DateTimeProvider } from "alepha/datetime";
+import { $repository } from "alepha/orm";
+import { describe, it } from "vitest";
+import {
+  AlephaApiVerification,
+  VerificationJobs,
+  verifications,
+} from "../index.ts";
+
+class Db {
+  verifications = $repository(verifications);
+}
+
+const alepha = Alepha.create().with(AlephaApiVerification);
+const db = alepha.inject(Db);
+
+describe("VerificationJobs", () => {
+  it("it should clear old verifications", async ({ expect }) => {
+    const time = alepha.inject(DateTimeProvider);
+    const jobs = alepha.inject(VerificationJobs);
+
+    const entry = {
+      type: "link",
+      target: "hello@mail.com",
+      code: "123456",
+    } as const;
+
+    await db.verifications.create({
+      ...entry,
+      createdAt: time.nowISOString(),
+    });
+
+    await db.verifications.create({
+      ...entry,
+      createdAt: time.now().subtract(1, "days").toISOString(),
+    });
+
+    await db.verifications.create({
+      ...entry,
+      createdAt: time.now().subtract(2, "days").toISOString(),
+    });
+
+    expect(await db.verifications.count()).toBe(3);
+
+    await jobs.cleanExpired.trigger();
+
+    expect(await db.verifications.count()).toBe(1);
+  });
+});