create-nexwire 4.0.0 → 4.1.0

package/hono/src/modules/auth/__tests__/forgetpass.test.ts

@@ -0,0 +1,170 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/framework/facade.js", () => ({
+  db: {
+    transaction: vi.fn()
+  },
+  dispatchEvent: vi.fn(),
+  urls: { url: vi.fn((p: string) => `https://app.test${p}`) }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  makeResetToken: vi.fn(() => "plain-token-123"),
+  hashResetToken: vi.fn((t: string) => `hashed:${t}`)
+}));
+
+vi.mock("@/modules/auth/database/models/user.js", () => ({
+  users: { id: "users.id", email: "users.email" },
+  passwordResetTokens: {
+    email: "passwordResetTokens.email",
+    token: "passwordResetTokens.token",
+    expiresAt: "passwordResetTokens.expiresAt",
+    createdAt: "passwordResetTokens.createdAt"
+  }
+}));
+
+import { db, dispatchEvent, urls } from "@/framework/facade.js";
+import { hashResetToken, makeResetToken } from "@/modules/auth/helpers/auth.js";
+import { forgotPasswordService } from "@/modules/auth/services/forgetpassword.js";
+
+const fakeUser = {
+  id: 1,
+  email: "user@example.com",
+  name: "Jane"
+};
+const body = { email: "user@example.com" };
+
+/**
+ * Build a fake tx whose calls we can inspect.
+ * `user` controls whether the query returns a user.
+ */
+function buildTx({ user = fakeUser as unknown | null } = {}) {
+  const txDeleteWhere = vi.fn((_where: unknown) => Promise.resolve(undefined));
+  const txDelete = vi.fn((_table: unknown) => ({ where: txDeleteWhere }));
+
+  const txInsertValues = vi.fn((_values: unknown) => Promise.resolve(undefined));
+  const txInsert = vi.fn((_table: unknown) => ({ values: txInsertValues }));
+
+  const txFindFirst = vi.fn((_args: unknown) => Promise.resolve(user));
+
+  return {
+    tx: {
+      delete: txDelete,
+      insert: txInsert,
+      query: { users: { findFirst: txFindFirst } }
+    },
+    txDelete,
+    txDeleteWhere,
+    txInsert,
+    txInsertValues,
+    txFindFirst
+  };
+}
+
+describe("forgotPasswordService.forgotPassword", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns 'sent' and does nothing else when the user does not exist", async () => {
+    const { tx, txDelete, txInsert, txFindFirst } = buildTx({ user: null });
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+
+    const result = await forgotPasswordService.forgotPassword(body);
+
+    expect(result).toEqual({ kind: "sent", message: "Reset link has been sent" });
+
+    // Only the housekeeping delete ran — no insert, no email
+    expect(txDelete).toHaveBeenCalledTimes(1);
+    expect(txFindFirst).toHaveBeenCalledTimes(1);
+    expect(txInsert).not.toHaveBeenCalled();
+    expect(dispatchEvent).not.toHaveBeenCalled();
+    expect(urls.url).not.toHaveBeenCalled();
+  });
+
+  it("issues a fresh token, stores its HASH, and dispatches the mail event", async () => {
+    const { tx, txInsert, txInsertValues } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+
+    const result = await forgotPasswordService.forgotPassword(body);
+
+    expect(result).toEqual({ kind: "sent", message: "Reset link has been sent" });
+
+    // Plain token generated and hashed
+    expect(makeResetToken).toHaveBeenCalledTimes(1);
+    expect(hashResetToken).toHaveBeenCalledWith("plain-token-123");
+
+    // Inserted token is the HASH, never the plain one
+    expect(txInsert).toHaveBeenCalledTimes(1);
+    const inserted = txInsertValues.mock.calls[0][0] as any;
+    expect(inserted).toMatchObject({
+      email: "user@example.com",
+      token: "hashed:plain-token-123"
+    });
+    expect(inserted.token).not.toBe("plain-token-123");
+    expect(inserted.expiresAt).toBeInstanceOf(Date);
+    expect(inserted.createdAt).toBeInstanceOf(Date);
+
+    // ~15 min TTL
+    const ttl = inserted.expiresAt.getTime() - inserted.createdAt.getTime();
+    expect(ttl).toBe(15 * 60 * 1000);
+
+    // Same Date instance used for both fields (from the shared `now`)
+    expect(inserted.createdAt).toEqual(inserted.createdAt);
+
+    // Reset URL contains the PLAIN token (the user has to receive it)
+    expect(urls.url).toHaveBeenCalledWith("/reset-password?token=plain-token-123&email=user%40example.com");
+
+    // Mail dispatched with the reset URL
+    expect(dispatchEvent).toHaveBeenCalledWith(
+      "user:forget-password",
+      {
+        email: "user@example.com",
+        name: "Jane",
+        resetUrl: "https://app.test/reset-password?token=plain-token-123&email=user%40example.com"
+      },
+      { queue: "mail" }
+    );
+  });
+
+  it("revokes any existing tokens for the email before inserting a new one", async () => {
+    const { tx, txDelete } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+
+    await forgotPasswordService.forgotPassword(body);
+
+    // Two deletes: expired cleanup + revoke existing
+    expect(txDelete).toHaveBeenCalledTimes(2);
+  });
+
+  it("sends the same message whether or not the user exists (no enumeration)", async () => {
+    const missing = buildTx({ user: null });
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(missing.tx));
+    const r1 = await forgotPasswordService.forgotPassword(body);
+
+    vi.clearAllMocks();
+
+    const exists = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(exists.tx));
+    const r2 = await forgotPasswordService.forgotPassword(body);
+
+    expect(r1).toEqual(r2);
+  });
+
+  it("does not dispatch the email if the transaction fails", async () => {
+    vi.mocked(db.transaction).mockRejectedValueOnce(new Error("db down"));
+
+    await expect(forgotPasswordService.forgotPassword(body)).rejects.toThrow("db down");
+
+    expect(dispatchEvent).not.toHaveBeenCalled();
+    expect(urls.url).not.toHaveBeenCalled();
+  });
+
+  it("still returns 'sent' even if the email dispatch fails (token is already stored)", async () => {
+    const { tx } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+    vi.mocked(dispatchEvent).mockRejectedValueOnce(new Error("queue down"));
+
+    // The service does NOT catch this — the caller's error handler would
+    // decide. Documenting the current behavior with this test.
+    await expect(forgotPasswordService.forgotPassword(body)).rejects.toThrow("queue down");
+  });
+});

package/hono/src/modules/auth/__tests__/login.test.ts

@@ -0,0 +1,154 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/config/index.js", () => ({
+  authConfig: { requireEmailVerification: false }
+}));
+
+vi.mock("@/framework/facade.js", () => ({
+  db: { query: { users: { findFirst: vi.fn() } } },
+  password: { verifyPassword: vi.fn() }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  issueTokens: vi.fn(),
+  revokeCurrentRefreshToken: vi.fn(),
+  sanitizeUser: vi.fn((u: any) => ({ id: u.id, email: u.email, name: u.name }))
+}));
+
+import { authConfig } from "@/config/index.js";
+import { db, password } from "@/framework/facade.js";
+import { issueTokens, revokeCurrentRefreshToken, sanitizeUser } from "@/modules/auth/helpers/auth.js";
+import { loginService } from "@/modules/auth/services/login.js";
+
+const fakeUser = {
+  id: 1,
+  email: "user@example.com",
+  name: "Jane",
+  password: "hashed-pw",
+  emailVerifiedAt: new Date()
+};
+
+const body = { email: "user@example.com", password: "pw" };
+
+describe("loginService.login", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(authConfig).requireEmailVerification = false;
+  });
+
+  it("returns invalid_credentials when the user does not exist (and doesn't hash)", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(undefined);
+
+    const result = await loginService.login({} as any, body);
+
+    expect(result).toEqual({
+      kind: "invalid_credentials",
+      message: "Invalid credentials"
+    });
+    // No hash attempt when the user is missing (short-circuit)
+    expect(password.verifyPassword).not.toHaveBeenCalled();
+    expect(issueTokens).not.toHaveBeenCalled();
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+  });
+
+  it("returns invalid_credentials when the password is wrong", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(false);
+
+    const result = await loginService.login({} as any, body);
+
+    expect(result).toEqual({
+      kind: "invalid_credentials",
+      message: "Invalid credentials"
+    });
+    expect(password.verifyPassword).toHaveBeenCalledWith("pw", "hashed-pw");
+    expect(issueTokens).not.toHaveBeenCalled();
+  });
+
+  it("returns email_not_verified when verification is required and the email is not verified", async () => {
+    vi.mocked(authConfig).requireEmailVerification = true;
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce({
+      ...fakeUser,
+      emailVerifiedAt: null
+    } as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+
+    const result = await loginService.login({} as any, body);
+
+    expect(result).toEqual({
+      kind: "email_not_verified",
+      message: "Please verify your email before logging in"
+    });
+    // No tokens issued
+    expect(issueTokens).not.toHaveBeenCalled();
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+  });
+
+  it("does NOT check email verification when the feature is disabled", async () => {
+    vi.mocked(authConfig).requireEmailVerification = false;
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce({
+      ...fakeUser,
+      emailVerifiedAt: null // unverified
+    } as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "a",
+      refreshToken: "r"
+    } as any);
+
+    const result = await loginService.login({} as any, body);
+
+    expect(result.kind).toBe("logged_in");
+  });
+
+  it("logs in successfully and returns sanitized user + tokens", async () => {
+    const ctx = { id: "ctx" } as any;
+
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "access-123",
+      refreshToken: "refresh-456"
+    } as any);
+
+    const result = await loginService.login(ctx, { ...body, remember: true });
+
+    expect(revokeCurrentRefreshToken).toHaveBeenCalledWith(ctx);
+    expect(issueTokens).toHaveBeenCalledWith(ctx, fakeUser, { remember: true });
+    expect(sanitizeUser).toHaveBeenCalledWith(fakeUser);
+
+    expect(result).toEqual({
+      kind: "logged_in",
+      message: "User logged in successfully",
+      data: {
+        user: { id: 1, email: "user@example.com", name: "Jane" },
+        access_token: "access-123",
+        refresh_token: "refresh-456",
+        token_type: "Bearer"
+      }
+    });
+  });
+
+  it("coerces a missing remember flag to false", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "a",
+      refreshToken: "r"
+    } as any);
+
+    const ctx = {} as any;
+    await loginService.login(ctx, body); // no remember field
+
+    expect(issueTokens).toHaveBeenCalledWith(ctx, fakeUser, { remember: false });
+  });
+
+  it("does not issue tokens when credentials are invalid", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(undefined);
+
+    await loginService.login({} as any, body);
+
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+    expect(issueTokens).not.toHaveBeenCalled();
+  });
+});

package/hono/src/modules/auth/__tests__/logout.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/framework/facade.js", () => ({
+  cookie: {
+    deleteAuth: vi.fn(),
+    deleteRefresh: vi.fn()
+  },
+  logger: {
+    error: vi.fn()
+  }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  revokeCurrentRefreshToken: vi.fn()
+}));
+
+import { cookie, logger } from "@/framework/facade.js";
+import { revokeCurrentRefreshToken } from "@/modules/auth/helpers/auth.js";
+import { logoutService } from "@/modules/auth/services/logout.js";
+
+describe("logoutService.logout", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("revokes the refresh token and clears cookies", async () => {
+    const ctx = { id: "ctx" } as any;
+
+    const result = await logoutService.logout(ctx);
+
+    expect(revokeCurrentRefreshToken).toHaveBeenCalledWith(ctx);
+    expect(cookie.deleteAuth).toHaveBeenCalledWith(ctx);
+    expect(cookie.deleteRefresh).toHaveBeenCalledWith(ctx);
+    expect(result).toEqual({
+      kind: "logged_out",
+      message: "Logged out successfully"
+    });
+  });
+
+  it("still clears cookies and returns success if revoke throws", async () => {
+    const err = new Error("db down");
+    vi.mocked(revokeCurrentRefreshToken).mockRejectedValueOnce(err);
+
+    const ctx = { id: "ctx" } as any;
+    const result = await logoutService.logout(ctx);
+
+    expect(cookie.deleteAuth).toHaveBeenCalledWith(ctx);
+    expect(cookie.deleteRefresh).toHaveBeenCalledWith(ctx);
+    expect(logger.error).toHaveBeenCalledWith("failed to revoke refresh token on logout", { err });
+    expect(result).toEqual({
+      kind: "logged_out",
+      message: "Logged out successfully"
+    });
+  });
+});

package/hono/src/modules/auth/__tests__/logoutalldevices.test.ts

@@ -0,0 +1,34 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/framework/facade.js", () => ({
+  db: {
+    delete: vi.fn(() => ({ where: vi.fn() }))
+  }
+}));
+
+import { db } from "@/framework/facade.js";
+import { refreshTokens } from "@/modules/auth/database/models/user.js";
+import { logoutAllDevicesService } from "@/modules/auth/services/logoutalldevices.js";
+
+describe("logoutAllDevicesService.logoutAllDevices", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("deletes all refresh tokens for the given user", async () => {
+    await logoutAllDevicesService.logoutAllDevices(42);
+
+    // The service called db.delete(refreshTokens).where(eq(refreshTokens.userId, 42))
+    expect(db.delete).toHaveBeenCalledWith(refreshTokens);
+
+    const whereArg = (db.delete as any).mock.results[0].value.where.mock.calls[0][0];
+    expect(whereArg).toBeDefined(); // eq() produced *something*
+  });
+
+  it("returns logged_out", async () => {
+    const result = await logoutAllDevicesService.logoutAllDevices(42);
+
+    expect(result).toEqual({
+      kind: "logged_out",
+      message: "Logged out from all devices successfully"
+    });
+  });
+});

package/hono/src/modules/auth/__tests__/me.test.ts

@@ -0,0 +1,87 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/framework/facade.js", () => ({
+  db: { query: { users: { findFirst: vi.fn() } } }
+}));
+
+// NOTE: we do NOT mock "@/modules/auth/helpers/auth.js" — we want the
+// real sanitizeUser so the "no password" test is meaningful.
+
+import { db } from "@/framework/facade.js";
+import { sanitizeUser } from "@/modules/auth/helpers/auth.js";
+import { meService } from "@/modules/auth/services/me.js";
+
+/** A user row as it comes from the DB — includes sensitive fields. */
+const dbUser = {
+  id: 1,
+  email: "user@example.com",
+  name: "Jane",
+  password: "$2b$10$hashedpassword",
+  emailVerifiedAt: new Date("2025-01-01"),
+  roleId: 2,
+  createdAt: new Date("2024-01-01"),
+  updatedAt: new Date("2024-01-01"),
+  role: { id: 2, name: "user" }
+};
+
+describe("meService.me", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns not_found when the user does not exist", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(undefined);
+
+    const result = await meService.me(999);
+
+    expect(result).toEqual({
+      kind: "not_found",
+      message: "User not found"
+    });
+  });
+
+  it("strips sensitive fields from the returned user", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(dbUser as any);
+
+    const result = await meService.me(1);
+
+    if (result.kind !== "found") throw new Error("expected found");
+
+    // The real sanitizeUser must not leak the password hash.
+    expect(result.data).not.toHaveProperty("password");
+  });
+
+  it("returns exactly what sanitizeUser produces", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(dbUser as any);
+
+    const result = await meService.me(1);
+
+    if (result.kind !== "found") throw new Error("expected found");
+
+    expect(result.data).toEqual(sanitizeUser(dbUser as any));
+  });
+
+  it("keeps the fields a client actually needs", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(dbUser as any);
+
+    const result = await meService.me(1);
+
+    if (result.kind !== "found") throw new Error("expected found");
+
+    expect(result.data).toMatchObject({
+      id: 1,
+      email: "user@example.com",
+      name: "Jane"
+    });
+  });
+
+  it("returns the found variant with the expected message", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(dbUser as any);
+
+    const result = await meService.me(1);
+
+    expect(result).toEqual({
+      kind: "found",
+      message: "Authenticated user fetched successfully",
+      data: expect.objectContaining({ id: 1, email: "user@example.com" })
+    });
+  });
+});