create-easy-stack 1.0.3

package/templates/nest-ddd/files/src/core/http/dtos/paginated-response.dto.ts

@@ -0,0 +1,29 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { PaginatedResult } from '../../domain/types/pagination.js';
+
+export class PaginatedMetaDto {
+  @ApiProperty()
+  hasMore: boolean;
+
+  @ApiProperty({ nullable: true })
+  nextCursor: string | null;
+}
+
+export class PaginatedResponseDto<T> {
+  // @ApiProperty for data is usually defined dynamically per controller using @ApiExtraModels
+  // or a custom decorator. We'll leave the basic structure here.
+  data: T[];
+
+  @ApiProperty()
+  meta: PaginatedMetaDto;
+
+  static map<T, U>(
+    result: PaginatedResult<T>,
+    mapperFn: (item: T) => U,
+  ): PaginatedResponseDto<U> {
+    const response = new PaginatedResponseDto<U>();
+    response.data = result.data.map(mapperFn);
+    response.meta = result.meta;
+    return response;
+  }
+}

package/templates/nest-ddd/files/src/core/http/dtos/pagination-query.dto.ts

@@ -0,0 +1,17 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { Type } from 'class-transformer';
+import { IsInt, IsOptional, IsString, Min } from 'class-validator';
+
+export class PaginationQueryDto {
+  @ApiPropertyOptional({ default: 20, description: 'Number of items per page' })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  limit?: number = 20;
+
+  @ApiPropertyOptional({ description: 'Cursor for pagination' })
+  @IsOptional()
+  @IsString()
+  cursor?: string;
+}

package/templates/nest-ddd/files/src/core/http/filters/all-exceptions.filter.spec.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import {
+  ArgumentsHost,
+  BadRequestException,
+  HttpStatus,
+  NotFoundException,
+} from '@nestjs/common';
+import type { ClsService } from 'nestjs-cls';
+import { AllExceptionsFilter } from './all-exceptions.filter.js';
+import { DomainException } from '../../domain/exceptions/domain.exception.js';
+import {
+  AuthErrorCodes,
+  CoreErrorCodes,
+} from '../../domain/exceptions/error-codes.js';
+
+describe('AllExceptionsFilter', () => {
+  let filter: AllExceptionsFilter;
+  let json: ReturnType<typeof vi.fn>;
+  let status: ReturnType<typeof vi.fn>;
+  let setHeader: ReturnType<typeof vi.fn>;
+  let host: ArgumentsHost;
+
+  const respond = (exception: unknown) => {
+    filter.catch(exception, host);
+    return {
+      status: status.mock.calls[0][0] as number,
+      body: json.mock.calls[0][0],
+    };
+  };
+
+  beforeEach(() => {
+    json = vi.fn();
+    status = vi.fn().mockReturnValue({ json });
+    setHeader = vi.fn();
+    host = {
+      switchToHttp: () => ({
+        getResponse: () => ({ status, setHeader }),
+        getRequest: () => ({ method: 'POST', url: '/api/v1/auth/register' }),
+      }),
+    } as unknown as ArgumentsHost;
+    filter = new AllExceptionsFilter({
+      getId: () => 'trace-1',
+    } as unknown as ClsService);
+  });
+
+  it('keeps the message and code of a DomainException', () => {
+    const { status: s, body } = respond(
+      new DomainException(
+        AuthErrorCodes.INVALID_CREDENTIALS,
+        'Invalid email or password',
+      ),
+    );
+
+    expect(s).toBe(HttpStatus.UNAUTHORIZED);
+    expect(body).toMatchObject({
+      code: AuthErrorCodes.INVALID_CREDENTIALS.code,
+      message: 'Invalid email or password',
+      traceId: 'trace-1',
+    });
+  });
+
+  it('tells the client how long to wait: in the body and in the Retry-After header', () => {
+    const { status: s, body } = respond(
+      new DomainException(AuthErrorCodes.RATE_LIMIT_EXCEEDED, {
+        retryAfterSeconds: 217.2,
+      }),
+    );
+
+    expect(s).toBe(HttpStatus.TOO_MANY_REQUESTS);
+    expect(body.errors).toEqual({ retryAfterSeconds: 217.2 });
+    expect(setHeader).toHaveBeenCalledWith('Retry-After', '218');
+  });
+
+  it('sets no Retry-After header when the error carries no wait time', () => {
+    respond(new DomainException(AuthErrorCodes.INVALID_CREDENTIALS, 'nope'));
+
+    expect(setHeader).not.toHaveBeenCalled();
+  });
+
+  it('keeps the message of an HttpException', () => {
+    const { status: s, body } = respond(
+      new NotFoundException('Product not found'),
+    );
+
+    expect(s).toBe(HttpStatus.NOT_FOUND);
+    expect(body).toMatchObject({
+      code: 'HTTP_404',
+      message: 'Product not found',
+    });
+  });
+
+  it('turns class-validator failures into a VALIDATION_ERROR with the field errors', () => {
+    const { status: s, body } = respond(
+      new BadRequestException({ message: ['email must be an email'] }),
+    );
+
+    expect(s).toBe(HttpStatus.BAD_REQUEST);
+    expect(body).toMatchObject({
+      code: CoreErrorCodes.VALIDATION_ERROR.code,
+      errors: ['email must be an email'],
+    });
+  });
+
+  describe('unexpected errors', () => {
+    it('never puts the raw error message in the response (it can carry SQL / schema details)', () => {
+      const prismaLike = new Error(
+        'Unique constraint failed on the fields: (`provider`,`identifier`)',
+      );
+
+      const { status: s, body } = respond(prismaLike);
+
+      expect(s).toBe(HttpStatus.INTERNAL_SERVER_ERROR);
+      expect(body.message).toBe(CoreErrorCodes.SYSTEM_ERROR.message);
+      expect(body.code).toBe(CoreErrorCodes.SYSTEM_ERROR.code);
+      expect(JSON.stringify(body)).not.toContain('provider');
+      expect(JSON.stringify(body)).not.toContain('identifier');
+    });
+
+    it('never puts the stack trace in the response', () => {
+      const { body } = respond(new Error('boom'));
+
+      expect(body).not.toHaveProperty('stack');
+    });
+
+    it('handles a thrown non-Error value', () => {
+      const { status: s, body } = respond('just a string');
+
+      expect(s).toBe(HttpStatus.INTERNAL_SERVER_ERROR);
+      expect(body.message).toBe(CoreErrorCodes.SYSTEM_ERROR.message);
+    });
+  });
+
+  describe('upload errors from multer', () => {
+    const multerError = (code: string, message: string) =>
+      Object.assign(new Error(message), { name: 'MulterError', code });
+
+    it('answers 413 for a file that is too large', () => {
+      const { status: s, body } = respond(
+        multerError('LIMIT_FILE_SIZE', 'File too large'),
+      );
+
+      expect(s).toBe(HttpStatus.PAYLOAD_TOO_LARGE);
+      expect(body.message).toBe('File too large');
+    });
+
+    it.each([
+      ['LIMIT_UNEXPECTED_FILE', 'Unexpected file field'],
+      ['LIMIT_FILE_COUNT', 'Too many files'],
+      ['INVALID_FIELD_NAME', 'Invalid field name'],
+    ])('answers 400, not 500, for %s', (code, message) => {
+      const { status: s, body } = respond(multerError(code, message));
+
+      expect(s).toBe(HttpStatus.BAD_REQUEST);
+      expect(body).toMatchObject({ code: 'HTTP_400', message });
+    });
+
+    it('does not mistake an ordinary error for an upload error', () => {
+      const { status: s } = respond(new Error('MulterError'));
+
+      expect(s).toBe(HttpStatus.INTERNAL_SERVER_ERROR);
+    });
+  });
+});

package/templates/nest-ddd/files/src/core/http/filters/all-exceptions.filter.ts

@@ -0,0 +1,97 @@
+import {
+  ExceptionFilter,
+  Catch,
+  ArgumentsHost,
+  HttpException,
+  HttpStatus,
+  Logger,
+} from '@nestjs/common';
+import { Response, Request } from 'express';
+import { ClsService } from 'nestjs-cls';
+import { DomainException } from '../../domain/exceptions/domain.exception.js';
+import { CoreErrorCodes } from '../../domain/exceptions/error-codes.js';
+import { randomUUID } from 'crypto';
+
+@Catch()
+export class AllExceptionsFilter implements ExceptionFilter {
+  private readonly logger = new Logger(AllExceptionsFilter.name);
+
+  constructor(private readonly cls: ClsService) {}
+
+  catch(exception: unknown, host: ArgumentsHost) {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<Response>();
+    const request = ctx.getRequest<Request>();
+    const traceId = this.cls.getId() || randomUUID();
+
+    let status = HttpStatus.INTERNAL_SERVER_ERROR;
+    let message = CoreErrorCodes.SYSTEM_ERROR.message;
+    let code = CoreErrorCodes.SYSTEM_ERROR.code;
+    let errors: any = null;
+
+    if (exception instanceof HttpException) {
+      status = exception.getStatus();
+      const res = exception.getResponse() as any;
+
+      if (status === HttpStatus.BAD_REQUEST && Array.isArray(res.message)) {
+        message = CoreErrorCodes.VALIDATION_ERROR.message;
+        code = CoreErrorCodes.VALIDATION_ERROR.code;
+        errors = res.message;
+      } else {
+        message = res.message || exception.message;
+        code = `HTTP_${status}`;
+      }
+    } else if (exception instanceof DomainException) {
+      status = exception.status;
+      message = exception.message;
+      code = exception.code;
+      errors = exception.details || null;
+      // A refusal that says when to come back also says so in the standard header
+      const retryAfter = (exception.details as { retryAfterSeconds?: unknown })
+        ?.retryAfterSeconds;
+      if (typeof retryAfter === 'number' && retryAfter > 0) {
+        response.setHeader('Retry-After', String(Math.ceil(retryAfter)));
+      }
+    } else if (isMulterError(exception)) {
+      // A bad upload (wrong field name, too many files, too big). Nest maps only some of
+      // multer's messages, so the rest would surface as a 500; they are all the sender's doing.
+      status =
+        exception.code === 'LIMIT_FILE_SIZE'
+          ? HttpStatus.PAYLOAD_TOO_LARGE
+          : HttpStatus.BAD_REQUEST;
+      message = exception.message;
+      code = `HTTP_${status}`;
+    }
+    // Anything else is an unexpected failure (Prisma, Redis, a bug...). Its message
+    // can carry SQL, table/column names or connection details, so the client only
+    // gets the generic 500 message; the real error is logged below.
+
+    // Ghi log lỗi, AppLogger sẽ tự động thêm [TraceId-...] ở đầu nên không cần thêm thủ công ở đây
+    this.logger.error(
+      `${request.method} ${request.url} - ${status} - ${message}`,
+      exception instanceof Error ? exception.stack : '',
+    );
+
+    response.status(status).json({
+      statusCode: status,
+      code,
+      message,
+      ...(errors && { errors }),
+      traceId,
+      timestamp: new Date().toISOString(),
+    });
+  }
+}
+
+interface MulterErrorLike extends Error {
+  code: string;
+}
+
+/** multer's own error, recognised by name so this file does not depend on the multer package. */
+function isMulterError(exception: unknown): exception is MulterErrorLike {
+  return (
+    exception instanceof Error &&
+    exception.name === 'MulterError' &&
+    typeof (exception as { code?: unknown }).code === 'string'
+  );
+}

package/templates/nest-ddd/files/src/core/http/guards/max-body-size.guard.spec.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect } from 'vitest';
+import { ExecutionContext, PayloadTooLargeException } from '@nestjs/common';
+import { MaxBodySizeGuard } from './max-body-size.guard.js';
+
+const contextWith = (headers: Record<string, string>) =>
+  ({
+    switchToHttp: () => ({ getRequest: () => ({ headers }) }),
+  }) as unknown as ExecutionContext;
+
+describe('MaxBodySizeGuard', () => {
+  const guard = new (MaxBodySizeGuard(1000))();
+
+  it('lets a request through that announces a size within the limit, exactly at it included', () => {
+    expect(guard.canActivate(contextWith({ 'content-length': '10' }))).toBe(
+      true,
+    );
+    expect(guard.canActivate(contextWith({ 'content-length': '1000' }))).toBe(
+      true,
+    );
+  });
+
+  it('refuses with 413, before anything is read, a request that announces more', () => {
+    expect(() =>
+      guard.canActivate(contextWith({ 'content-length': '1001' })),
+    ).toThrow(PayloadTooLargeException);
+  });
+
+  it('lets a request through that announces no size (the upload limits still apply to it)', () => {
+    expect(guard.canActivate(contextWith({}))).toBe(true);
+  });
+
+  it('lets a request through whose size is not a number (it is the upload limits that handle it)', () => {
+    expect(guard.canActivate(contextWith({ 'content-length': 'abc' }))).toBe(
+      true,
+    );
+  });
+
+  it('each limit is its own: two guards do not share their number', () => {
+    const small = new (MaxBodySizeGuard(5))();
+    expect(() =>
+      small.canActivate(contextWith({ 'content-length': '6' })),
+    ).toThrow();
+    expect(guard.canActivate(contextWith({ 'content-length': '6' }))).toBe(
+      true,
+    );
+  });
+});

package/templates/nest-ddd/files/src/core/http/guards/max-body-size.guard.ts

@@ -0,0 +1,31 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  PayloadTooLargeException,
+  Type,
+  mixin,
+} from '@nestjs/common';
+import type { Request } from 'express';
+
+/**
+ * Refuses a request whose announced size (the Content-Length header) is over the limit, before
+ * the body is read at all. An upload endpoint needs this: the upload library only stops a file
+ * after it started reading it, and on an error it still reads the rest of the body to the end.
+ * A request that does not announce its size is still bounded by the upload library's own limits.
+ *
+ * Usage: `@UseGuards(MaxBodySizeGuard(2 * 1024 * 1024 + 8 * 1024))`, a little above the largest
+ * file to leave room for the multipart framing.
+ */
+export function MaxBodySizeGuard(maxBytes: number): Type<CanActivate> {
+  class MaxBodySizeGuardMixin implements CanActivate {
+    canActivate(context: ExecutionContext): boolean {
+      const request = context.switchToHttp().getRequest<Request>();
+      const announced = Number(request.headers['content-length']);
+      if (Number.isFinite(announced) && announced > maxBytes) {
+        throw new PayloadTooLargeException('Request body too large');
+      }
+      return true;
+    }
+  }
+  return mixin(MaxBodySizeGuardMixin);
+}

package/templates/nest-ddd/files/src/core/http/interceptors/logging.interceptor.ts

@@ -0,0 +1,37 @@
+import {
+  Injectable,
+  NestInterceptor,
+  ExecutionContext,
+  CallHandler,
+  Logger,
+} from '@nestjs/common';
+import { Observable } from 'rxjs';
+import { tap } from 'rxjs/operators';
+import { Request, Response } from 'express';
+
+@Injectable()
+export class LoggingInterceptor implements NestInterceptor {
+  private readonly logger = new Logger(LoggingInterceptor.name);
+
+  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
+    const ctx = context.switchToHttp();
+    const request = ctx.getRequest<Request>();
+    const response = ctx.getResponse<Response>();
+
+    const method = request.method;
+    const url = request.url;
+    const now = Date.now();
+
+    this.logger.log(`Incoming Request ${method} ${url}`);
+
+    return next.handle().pipe(
+      tap(() => {
+        const statusCode = response.statusCode;
+        const delay = Date.now() - now;
+        this.logger.log(
+          `Outgoing Response ${method} ${url} - ${statusCode} - ${delay}ms`,
+        );
+      }),
+    );
+  }
+}

package/templates/nest-ddd/files/src/core/http/interceptors/response.interceptor.ts

@@ -0,0 +1,53 @@
+import {
+  CallHandler,
+  ExecutionContext,
+  Injectable,
+  NestInterceptor,
+} from '@nestjs/common';
+import { Observable } from 'rxjs';
+import { map } from 'rxjs/operators';
+
+export interface StandardResponse<T> {
+  statusCode: number;
+  message: string;
+  data: T;
+  meta?: any;
+}
+
+@Injectable()
+export class ResponseInterceptor<T> implements NestInterceptor<
+  T,
+  StandardResponse<T>
+> {
+  intercept(
+    context: ExecutionContext,
+    next: CallHandler,
+  ): Observable<StandardResponse<T>> {
+    return next.handle().pipe(
+      map((result) => {
+        const statusCode = context.switchToHttp().getResponse().statusCode;
+
+        if (
+          result &&
+          typeof result === 'object' &&
+          'data' in result &&
+          'meta' in result
+        ) {
+          const paginatedResult = result as any;
+          return {
+            statusCode,
+            message: 'Success',
+            data: paginatedResult.data,
+            meta: paginatedResult.meta,
+          } as StandardResponse<T>;
+        }
+
+        return {
+          statusCode,
+          message: 'Success',
+          data: result,
+        } as StandardResponse<T>;
+      }),
+    );
+  }
+}

package/templates/nest-ddd/files/src/core/http/logging/app.logger.ts

@@ -0,0 +1,34 @@
+import { ConsoleLogger, Injectable, LogLevel } from '@nestjs/common';
+import { ClsServiceManager } from 'nestjs-cls';
+
+@Injectable()
+export class AppLogger extends ConsoleLogger {
+  protected formatMessage(
+    logLevel: LogLevel,
+    message: unknown,
+    pidMessage: string,
+    formattedLogLevel: string,
+    contextMessage: string,
+    timestampDiff: string,
+  ): string {
+    const cls = ClsServiceManager.getClsService();
+    let tracePrefix = '';
+
+    // cls.getId() might be undefined during application bootstrap
+    // or when the logger is called outside of an HTTP request context.
+    if (cls && cls.isActive() && cls.getId()) {
+      tracePrefix = this.colorize(`[TraceId-${cls.getId()}]`, logLevel) + ' ';
+    }
+
+    const originalMessage = super.formatMessage(
+      logLevel,
+      message,
+      pidMessage,
+      formattedLogLevel,
+      contextMessage,
+      timestampDiff,
+    );
+
+    return `${tracePrefix}${originalMessage}`;
+  }
+}

package/templates/nest-ddd/files/src/core/index.ts

@@ -0,0 +1,33 @@
+// Domain — pure business primitives, no framework dependencies
+export * from './domain/base/entity.base.js';
+export * from './domain/base/aggregate-root.base.js';
+export * from './domain/base/domain-event.base.js';
+export * from './domain/base/value-object.base.js';
+export * from './domain/exceptions/domain.exception.js';
+export * from './domain/exceptions/error-codes.js';
+export * from './domain/types/pagination.js';
+
+// HTTP — web-layer framework glue (filters, interceptors, shared DTOs, logging)
+export * from './http/filters/all-exceptions.filter.js';
+export * from './http/interceptors/logging.interceptor.js';
+export * from './http/interceptors/response.interceptor.js';
+export * from './http/dtos/paginated-response.dto.js';
+export * from './http/dtos/pagination-query.dto.js';
+export * from './http/logging/app.logger.js';
+export * from './http/guards/max-body-size.guard.js';
+export * from './http/decorators/client-info.decorator.js';
+export * from './http/decorators/current-user.decorator.js';
+
+// Config — settings read from the environment
+export * from './config/app.config.js';
+
+// Utils — stateless pure functions
+export * from './utils/snowflake.util.js';
+export * from './utils/hash.util.js';
+export * from './utils/time.util.js';
+export * from './utils/string.util.js';
+export * from './utils/correlation-id.util.js';
+export * from './utils/ttl.util.js';
+
+// Infrastructure — external systems; lines are added by `create-my-stack add <infra>`
+// @infra:barrel

package/templates/nest-ddd/files/src/core/utils/correlation-id.util.spec.ts

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest';
+import type { Request } from 'express';
+import { resolveCorrelationId } from './correlation-id.util.js';
+
+function reqWith(header: string | string[] | undefined): Request {
+  return { headers: { 'x-correlation-id': header } } as unknown as Request;
+}
+
+describe('resolveCorrelationId', () => {
+  it('reuses a well-formed correlation id from the request header', () => {
+    const id = resolveCorrelationId(reqWith('abc-123-XYZ'));
+    expect(id).toBe('abc-123-XYZ');
+  });
+
+  it('generates a fresh id when the header is missing', () => {
+    const id = resolveCorrelationId(reqWith(undefined));
+    expect(id).toMatch(/^[0-9a-f-]{36}$/);
+  });
+
+  it('generates a fresh id when the header contains unsafe characters', () => {
+    const id = resolveCorrelationId(reqWith('bad\nvalue'));
+    expect(id).toMatch(/^[0-9a-f-]{36}$/);
+  });
+
+  it('generates a fresh id when the header is unreasonably long', () => {
+    const id = resolveCorrelationId(reqWith('a'.repeat(100)));
+    expect(id).toMatch(/^[0-9a-f-]{36}$/);
+  });
+});

package/templates/nest-ddd/files/src/core/utils/correlation-id.util.ts

@@ -0,0 +1,15 @@
+import { randomUUID } from 'crypto';
+import type { Request } from 'express';
+
+// Correlation ids are trusted to appear verbatim in logs and error
+// responses, so an incoming x-correlation-id is only reused when it looks
+// like a genuine id (letters/digits/hyphen, bounded length) — anything
+// else (control characters, absurd lengths) falls back to a fresh UUID
+// instead of being logged as-is.
+const CORRELATION_ID_PATTERN = /^[a-zA-Z0-9-]{1,64}$/;
+
+export function resolveCorrelationId(req: Request): string {
+  const header = req.headers['x-correlation-id'];
+  const value = Array.isArray(header) ? header[0] : header;
+  return value && CORRELATION_ID_PATTERN.test(value) ? value : randomUUID();
+}

package/templates/nest-ddd/files/src/core/utils/hash.util.spec.ts

@@ -0,0 +1,61 @@
+import { describe, it, expect, vi } from 'vitest';
+import { HashUtil } from './hash.util.js';
+
+describe('HashUtil', () => {
+  it('should hash and compare passwords correctly', async () => {
+    const plainText = 'my-super-secret-password';
+    const hash = await HashUtil.hashPassword(plainText);
+
+    expect(hash).not.toBe(plainText);
+
+    const isMatch = await HashUtil.comparePassword(plainText, hash);
+    expect(isMatch).toBe(true);
+
+    const isFalseMatch = await HashUtil.comparePassword('wrong-password', hash);
+    expect(isFalseMatch).toBe(false);
+  });
+
+  it('should hash with sha256 deterministically', () => {
+    // Well-known digest of "abc"
+    expect(HashUtil.sha256('abc')).toBe(
+      'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad',
+    );
+    expect(HashUtil.sha256('abc')).toBe(HashUtil.sha256('abc'));
+    expect(HashUtil.sha256('abd')).not.toBe(HashUtil.sha256('abc'));
+  });
+
+  it('should generate random token of given length', () => {
+    const token = HashUtil.generateRandomToken(16);
+    // 16 bytes = 32 hex characters
+    expect(token.length).toBe(32);
+  });
+
+  it('should generate OTP with correct length, digits only', () => {
+    for (let i = 0; i < 200; i++) {
+      expect(HashUtil.generateOTP(6)).toMatch(/^\d{6}$/);
+    }
+  });
+
+  it('should use the whole 10^6 space, leading zeros included', () => {
+    // P(no code starts with 0 in 5000 draws) = 0.9^5000, i.e. never
+    const codes = Array.from({ length: 5000 }, () => HashUtil.generateOTP(6));
+    expect(codes.some((code) => code.startsWith('0'))).toBe(true);
+  });
+
+  it('should draw OTPs from the CSPRNG, never from Math.random', () => {
+    const math = vi.spyOn(Math, 'random');
+    HashUtil.generateOTP(6);
+    expect(math).not.toHaveBeenCalled();
+    math.mockRestore();
+  });
+
+  it('should compute a keyed HMAC-SHA256 digest', () => {
+    // RFC 4231 test case 2
+    expect(HashUtil.hmacSha256('Jefe', 'what do ya want for nothing?')).toBe(
+      '5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843',
+    );
+    expect(HashUtil.hmacSha256('key-a', 'value')).not.toBe(
+      HashUtil.hmacSha256('key-b', 'value'),
+    );
+  });
+});