create-nexwire 4.0.0 → 4.1.0

package/express/src/modules/auth/__tests__/forgetpass.test.ts

@@ -0,0 +1,200 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/framework/facade.js", () => ({
+  db: {
+    transaction: vi.fn()
+  },
+  dispatchEvent: vi.fn(),
+  urls: { url: vi.fn((p: string) => `https://app.test${p}`) }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  makeResetToken: vi.fn(() => "plain-token-123"),
+  hashResetToken: vi.fn((t: string) => `hashed:${t}`)
+}));
+
+vi.mock("@/modules/auth/database/models/user.js", () => ({
+  users: { __table: "users", id: "users.id", email: "users.email" },
+  passwordResetTokens: {
+    __table: "passwordResetTokens",
+    email: "passwordResetTokens.email",
+    token: "passwordResetTokens.token",
+    expiresAt: "passwordResetTokens.expiresAt",
+    createdAt: "passwordResetTokens.createdAt"
+  }
+}));
+
+import { db, dispatchEvent, urls } from "@/framework/facade.js";
+import { hashResetToken, makeResetToken } from "@/modules/auth/helpers/auth.js";
+import { forgotPasswordService } from "@/modules/auth/services/forgetpassword.js";
+
+const fakeUser = {
+  id: 1,
+  email: "user@example.com",
+  name: "Jane"
+};
+
+const body = { email: "user@example.com" };
+
+/**
+ * Build a fake tx whose calls we can inspect.
+ *   - user: what query.users.findFirst returns (null = no user)
+ */
+function buildTx({ user = fakeUser as unknown | null } = {}) {
+  const deleteCalls: { table: unknown; where: unknown }[] = [];
+  let currentDeleteTable: unknown;
+
+  const txDeleteWhere = vi.fn((where: unknown) => {
+    deleteCalls.push({ table: currentDeleteTable, where });
+    return Promise.resolve(undefined);
+  });
+  const txDelete = vi.fn((table: unknown) => {
+    currentDeleteTable = table;
+    return { where: txDeleteWhere };
+  });
+
+  const insertCalls: { table: unknown; values: unknown }[] = [];
+  let currentInsertTable: unknown;
+
+  const txInsertValues = vi.fn((values: unknown) => {
+    insertCalls.push({ table: currentInsertTable, values });
+    return Promise.resolve(undefined);
+  });
+  const txInsert = vi.fn((table: unknown) => {
+    currentInsertTable = table;
+    return { values: txInsertValues };
+  });
+
+  const txFindFirst = vi.fn((_args: unknown) => Promise.resolve(user));
+
+  return {
+    tx: {
+      delete: txDelete,
+      insert: txInsert,
+      query: { users: { findFirst: txFindFirst } }
+    },
+    txDelete,
+    txDeleteWhere,
+    txInsert,
+    txInsertValues,
+    txFindFirst,
+    deleteCalls,
+    insertCalls
+  };
+}
+
+describe("forgotPasswordService.forgotPassword", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns 'sent' and does nothing else when the user does not exist", async () => {
+    const { tx, txDelete, txInsert, txFindFirst } = buildTx({ user: null });
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+
+    const result = await forgotPasswordService.forgotPassword(body);
+
+    expect(result).toEqual({
+      kind: "sent",
+      message: "Reset link has been sent"
+    });
+
+    // Only the housekeeping delete ran — no insert, no email
+    expect(txDelete).toHaveBeenCalledTimes(1);
+    expect(txFindFirst).toHaveBeenCalledTimes(1);
+    expect(txInsert).not.toHaveBeenCalled();
+    expect(dispatchEvent).not.toHaveBeenCalled();
+    expect(urls.url).not.toHaveBeenCalled();
+  });
+
+  it("issues a fresh token, stores its HASH, and dispatches the mail event", async () => {
+    const { tx, txInsertValues } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+
+    const result = await forgotPasswordService.forgotPassword(body);
+
+    expect(result).toEqual({
+      kind: "sent",
+      message: "Reset link has been sent"
+    });
+
+    // Plain token generated and hashed
+    expect(makeResetToken).toHaveBeenCalledTimes(1);
+    expect(hashResetToken).toHaveBeenCalledWith("plain-token-123");
+
+    // Inserted token is the HASH, never the plain one
+    expect(txInsertValues).toHaveBeenCalledTimes(1);
+    const inserted = txInsertValues.mock.calls[0][0] as any;
+    expect(inserted).toMatchObject({
+      email: "user@example.com",
+      token: "hashed:plain-token-123"
+    });
+    expect(inserted.token).not.toBe("plain-token-123");
+    expect(inserted.expiresAt).toBeInstanceOf(Date);
+    expect(inserted.createdAt).toBeInstanceOf(Date);
+
+    // ~15 min TTL between createdAt and expiresAt
+    const ttl = inserted.expiresAt.getTime() - inserted.createdAt.getTime();
+    expect(ttl).toBe(15 * 60 * 1000);
+
+    // Reset URL contains the PLAIN token (the user has to receive it)
+    expect(urls.url).toHaveBeenCalledWith("/reset-password?token=plain-token-123&email=user%40example.com");
+
+    // Mail dispatched with the reset URL
+    expect(dispatchEvent).toHaveBeenCalledWith(
+      "user:forget-password",
+      {
+        email: "user@example.com",
+        name: "Jane",
+        resetUrl: "https://app.test/reset-password?token=plain-token-123&email=user%40example.com"
+      },
+      { queue: "mail" }
+    );
+  });
+
+  it("revokes any existing tokens for the email before inserting a new one", async () => {
+    const { tx, txDelete, deleteCalls } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+
+    await forgotPasswordService.forgotPassword(body);
+
+    // Two deletes: expired cleanup + revoke existing
+    expect(txDelete).toHaveBeenCalledTimes(2);
+    expect(deleteCalls).toHaveLength(2);
+
+    // Both target passwordResetTokens
+    expect((deleteCalls[0].table as any).__table).toBe("passwordResetTokens");
+    expect((deleteCalls[1].table as any).__table).toBe("passwordResetTokens");
+  });
+
+  it("sends the same message whether or not the user exists (no enumeration)", async () => {
+    const missing = buildTx({ user: null });
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(missing.tx));
+    const r1 = await forgotPasswordService.forgotPassword(body);
+
+    vi.clearAllMocks();
+
+    const exists = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(exists.tx));
+    const r2 = await forgotPasswordService.forgotPassword(body);
+
+    expect(r1).toEqual(r2);
+  });
+
+  it("does not dispatch the email if the transaction fails", async () => {
+    vi.mocked(db.transaction).mockRejectedValueOnce(new Error("db down"));
+
+    await expect(forgotPasswordService.forgotPassword(body)).rejects.toThrow("db down");
+
+    expect(dispatchEvent).not.toHaveBeenCalled();
+    expect(urls.url).not.toHaveBeenCalled();
+  });
+
+  it("propagates a dispatch failure (token is already stored)", async () => {
+    const { tx } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+    vi.mocked(dispatchEvent).mockRejectedValueOnce(new Error("queue down"));
+
+    // Current behavior: dispatch failure aborts the request.
+    // The token IS in the DB — the user can retry "forgot password".
+    await expect(forgotPasswordService.forgotPassword(body)).rejects.toThrow("queue down");
+  });
+});

package/express/src/modules/auth/__tests__/login.test.ts

@@ -0,0 +1,171 @@
+import type { Request, Response } from "express";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/config/index.js", () => ({
+  authConfig: { requireEmailVerification: false }
+}));
+
+vi.mock("@/framework/facade.js", () => ({
+  db: { query: { users: { findFirst: vi.fn() } } },
+  password: { verifyPassword: vi.fn() }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  issueTokens: vi.fn(),
+  revokeCurrentRefreshToken: vi.fn(),
+  sanitizeUser: vi.fn((u: any) => ({ id: u.id, email: u.email, name: u.name }))
+}));
+
+import { authConfig } from "@/config/index.js";
+import { db, password } from "@/framework/facade.js";
+import { issueTokens, revokeCurrentRefreshToken } from "@/modules/auth/helpers/auth.js";
+import { loginService } from "@/modules/auth/services/login.js";
+
+const fakeUser = {
+  id: 1,
+  email: "user@example.com",
+  name: "Jane",
+  password: "hashed-pw",
+  emailVerifiedAt: new Date()
+};
+
+const body = { email: "user@example.com", password: "pw" };
+
+/** Minimal fake req/res. The service just passes them through. */
+function makeReqRes() {
+  const req = {} as Request;
+  const res = {} as Response;
+  return { req, res };
+}
+
+describe("loginService.login (express)", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(authConfig).requireEmailVerification = false;
+  });
+
+  it("returns invalid_credentials when the user does not exist (no hash attempt)", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(undefined);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, body);
+
+    expect(result).toEqual({
+      kind: "invalid_credentials",
+      message: "Invalid credentials"
+    });
+    expect(password.verifyPassword).not.toHaveBeenCalled();
+    expect(issueTokens).not.toHaveBeenCalled();
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+  });
+
+  it("returns invalid_credentials when the password is wrong", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(false);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, body);
+
+    expect(result).toEqual({
+      kind: "invalid_credentials",
+      message: "Invalid credentials"
+    });
+    expect(password.verifyPassword).toHaveBeenCalledWith("pw", "hashed-pw");
+    expect(issueTokens).not.toHaveBeenCalled();
+  });
+
+  it("returns email_not_verified when verification is required and the email is not verified", async () => {
+    vi.mocked(authConfig).requireEmailVerification = true;
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce({
+      ...fakeUser,
+      emailVerifiedAt: null
+    } as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, body);
+
+    expect(result).toEqual({
+      kind: "email_not_verified",
+      message: "Please verify your email before logging in"
+    });
+    expect(issueTokens).not.toHaveBeenCalled();
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+  });
+
+  it("does NOT check email verification when the feature is disabled", async () => {
+    vi.mocked(authConfig).requireEmailVerification = false;
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce({
+      ...fakeUser,
+      emailVerifiedAt: null
+    } as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "a",
+      refreshToken: "r"
+    } as any);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, body);
+
+    expect(result.kind).toBe("logged_in");
+  });
+
+  it("logs in successfully and passes req/res through to the helpers", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "access-123",
+      refreshToken: "refresh-456"
+    } as any);
+    const { req, res } = makeReqRes();
+
+    const result = await loginService.login(req, res, {
+      ...body,
+      remember: true
+    });
+
+    // The Express-specific contract: req and res are forwarded as-is.
+    expect(revokeCurrentRefreshToken).toHaveBeenCalledWith(req, res);
+    expect(issueTokens).toHaveBeenCalledWith(req, res, fakeUser, {
+      remember: true
+    });
+
+    expect(result).toEqual({
+      kind: "logged_in",
+      message: "User logged in successfully",
+      data: {
+        user: { id: 1, email: "user@example.com", name: "Jane" },
+        access_token: "access-123",
+        refresh_token: "refresh-456",
+        token_type: "Bearer"
+      }
+    });
+  });
+
+  it("coerces a missing remember flag to false", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    vi.mocked(password.verifyPassword).mockResolvedValueOnce(true);
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "a",
+      refreshToken: "r"
+    } as any);
+    const { req, res } = makeReqRes();
+
+    await loginService.login(req, res, body);
+
+    expect(issueTokens).toHaveBeenCalledWith(req, res, fakeUser, {
+      remember: false
+    });
+  });
+
+  it("does not issue tokens when credentials are invalid", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(undefined);
+    const { req, res } = makeReqRes();
+
+    await loginService.login(req, res, body);
+
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+    expect(issueTokens).not.toHaveBeenCalled();
+  });
+});

package/express/src/modules/auth/__tests__/logout.test.ts

@@ -0,0 +1,60 @@
+import type { Request, Response } from "express";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/framework/facade.js", () => ({
+  cookie: {
+    deleteAuth: vi.fn(),
+    deleteRefresh: vi.fn()
+  },
+  logger: {
+    error: vi.fn()
+  }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  revokeCurrentRefreshToken: vi.fn()
+}));
+
+import { cookie, logger } from "@/framework/facade.js";
+import { revokeCurrentRefreshToken } from "@/modules/auth/helpers/auth.js";
+import { logoutService } from "@/modules/auth/services/logout.js";
+
+function makeReqRes() {
+  const req = {} as Request;
+  const res = {} as Response;
+  return { req, res };
+}
+
+describe("logoutService.logout (express)", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("revokes the refresh token and clears cookies", async () => {
+    const { req, res } = makeReqRes();
+
+    const result = await logoutService.logout(req, res);
+
+    expect(revokeCurrentRefreshToken).toHaveBeenCalledWith(req, res);
+    expect(cookie.deleteAuth).toHaveBeenCalledWith(res);
+    expect(cookie.deleteRefresh).toHaveBeenCalledWith(res);
+    expect(result).toEqual({
+      kind: "logged_out",
+      message: "Logged out successfully"
+    });
+  });
+
+  it("still clears cookies and returns success if revoke throws", async () => {
+    const err = new Error("db down");
+    vi.mocked(revokeCurrentRefreshToken).mockRejectedValueOnce(err);
+
+    const { req, res } = makeReqRes();
+    const result = await logoutService.logout(req, res);
+
+    expect(cookie.deleteAuth).toHaveBeenCalledWith(res);
+    expect(cookie.deleteRefresh).toHaveBeenCalledWith(res);
+    expect(logger.error).toHaveBeenCalledWith("failed to revoke refresh token on logout", { err });
+    expect(result).toEqual({
+      kind: "logged_out",
+      message: "Logged out successfully"
+    });
+  });
+});

package/express/src/modules/auth/__tests__/logoutalldevices.test.ts

@@ -0,0 +1,49 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("drizzle-orm", () => ({
+  eq: vi.fn((col: unknown, val: unknown) => ({ op: "eq", col, val }))
+}));
+
+vi.mock("@/framework/facade.js", () => ({
+  db: {
+    delete: vi.fn(() => ({ where: vi.fn() }))
+  }
+}));
+
+vi.mock("@/modules/auth/database/models/user.js", () => ({
+  refreshTokens: { __table: "refreshTokens", userId: "refreshTokens.userId" }
+}));
+
+import { eq } from "drizzle-orm";
+import { db } from "@/framework/facade.js";
+import { refreshTokens } from "@/modules/auth/database/models/user.js";
+import { logoutAllDevicesService } from "@/modules/auth/services/logoutalldevices.js";
+
+describe("logoutAllDevicesService.logoutAllDevices", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("deletes refresh tokens for the given user", async () => {
+    await logoutAllDevicesService.logoutAllDevices(42);
+
+    expect(db.delete).toHaveBeenCalledWith(refreshTokens);
+
+    // The where-clause targets refreshTokens.userId with the userId value
+    expect(eq).toHaveBeenCalledWith(refreshTokens.userId, 42);
+
+    const whereArg = (db.delete as any).mock.results[0].value.where.mock.calls[0][0] as any;
+    expect(whereArg).toEqual({
+      op: "eq",
+      col: "refreshTokens.userId",
+      val: 42
+    });
+  });
+
+  it("returns logged_out", async () => {
+    const result = await logoutAllDevicesService.logoutAllDevices(42);
+
+    expect(result).toEqual({
+      kind: "logged_out",
+      message: "Logged out from all devices successfully"
+    });
+  });
+});

package/express/src/modules/auth/__tests__/me.test.ts

@@ -0,0 +1,91 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/framework/facade.js", () => ({
+  db: { query: { users: { findFirst: vi.fn() } } }
+}));
+
+// NOTE: we do NOT mock "@/modules/auth/helpers/auth.js" — we want the
+// real sanitizeUser so the "no password" test is meaningful.
+
+vi.mock("@/modules/auth/database/models/user.js", () => ({
+  users: { __table: "users", id: "users.id", email: "users.email" }
+}));
+
+import { db } from "@/framework/facade.js";
+import { sanitizeUser } from "@/modules/auth/helpers/auth.js";
+import { meService } from "@/modules/auth/services/me.js";
+
+/** A user row as it comes from the DB — includes sensitive fields. */
+const dbUser = {
+  id: 1,
+  email: "user@example.com",
+  name: "Jane",
+  password: "$2b$10$hashedpassword",
+  emailVerifiedAt: new Date("2025-01-01"),
+  roleId: 2,
+  createdAt: new Date("2024-01-01"),
+  updatedAt: new Date("2024-01-01"),
+  role: { id: 2, name: "user" }
+};
+
+describe("meService.me", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns not_found when the user does not exist", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(undefined);
+
+    const result = await meService.me(999);
+
+    expect(result).toEqual({
+      kind: "not_found",
+      message: "User not found"
+    });
+  });
+
+  it("strips sensitive fields from the returned user", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(dbUser as any);
+
+    const result = await meService.me(1);
+
+    if (result.kind !== "found") throw new Error("expected found");
+
+    // The real sanitizeUser must not leak the password hash.
+    expect(result.data).not.toHaveProperty("password");
+  });
+
+  it("returns exactly what sanitizeUser produces", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(dbUser as any);
+
+    const result = await meService.me(1);
+
+    if (result.kind !== "found") throw new Error("expected found");
+
+    expect(result.data).toEqual(sanitizeUser(dbUser as any));
+  });
+
+  it("keeps the fields a client actually needs", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(dbUser as any);
+
+    const result = await meService.me(1);
+
+    if (result.kind !== "found") throw new Error("expected found");
+
+    expect(result.data).toMatchObject({
+      id: 1,
+      email: "user@example.com",
+      name: "Jane"
+    });
+  });
+
+  it("returns the found variant with the expected message", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(dbUser as any);
+
+    const result = await meService.me(1);
+
+    expect(result).toEqual({
+      kind: "found",
+      message: "Authenticated user fetched successfully",
+      data: expect.objectContaining({ id: 1, email: "user@example.com" })
+    });
+  });
+});