create-nexwire 4.0.0 → 4.1.1

package/express/src/modules/auth/__tests__/refreshtoken.test.ts

@@ -0,0 +1,305 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/config/index.js", () => ({
+  jwtConfig: { refreshRememberExpirySeconds: 60 * 60 * 24 * 30 }
+}));
+
+vi.mock("drizzle-orm", () => ({
+  eq: vi.fn((col: unknown, val: unknown) => ({ op: "eq", col, val })),
+  and: vi.fn((...args: unknown[]) => ({ op: "and", args }))
+}));
+
+vi.mock("@/framework/facade.js", () => ({
+  db: {
+    query: {
+      refreshTokens: { findFirst: vi.fn() },
+      users: { findFirst: vi.fn() }
+    },
+    delete: vi.fn((_table: unknown) => ({
+      where: vi.fn((_where: unknown) => Promise.resolve(undefined))
+    })),
+    update: vi.fn((_table: unknown) => ({
+      set: vi.fn((_values: unknown) => ({
+        where: vi.fn((_where: unknown) => ({
+          returning: vi.fn((_args?: unknown) => Promise.resolve([]))
+        }))
+      }))
+    }))
+  },
+  jwt: {
+    verifyToken: vi.fn(),
+    generateToken: vi.fn()
+  }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  sanitizeUser: vi.fn((u: any) => ({ id: u.id, email: u.email, name: u.name }))
+}));
+
+vi.mock("@/modules/auth/database/models/user.js", () => ({
+  users: { __table: "users", id: "users.id", email: "users.email" },
+  refreshTokens: {
+    __table: "refreshTokens",
+    id: "refreshTokens.id",
+    jti: "refreshTokens.jti",
+    userId: "refreshTokens.userId",
+    revoked: "refreshTokens.revoked",
+    expiresAt: "refreshTokens.expiresAt"
+  }
+}));
+
+import { db, jwt } from "@/framework/facade.js";
+import { refreshTokenService } from "@/modules/auth/services/refreshtoken.js";
+
+const futureDate = new Date(Date.now() + 60_000);
+const pastDate = new Date(Date.now() - 60_000);
+
+const storedToken = {
+  id: 10,
+  jti: "jti-old",
+  revoked: 0,
+  expiresAt: futureDate
+};
+
+const fakeUser = {
+  id: 1,
+  email: "user@example.com",
+  name: "Jane",
+  role: { id: 2, name: "user" }
+};
+
+/**
+ * Wire db.update so its returning() resolves with `rows`.
+ * Returns handles to inspect the set/where calls.
+ */
+function mockRotate(rows: unknown[]) {
+  const returning = vi.fn((_args?: unknown) => Promise.resolve(rows));
+  const where = vi.fn((_where: unknown) => ({ returning }));
+  const set = vi.fn((_values: unknown) => ({ where }));
+  const update = vi.fn((_table: unknown) => ({ set }));
+
+  vi.mocked(db.update).mockImplementationOnce(update as any);
+
+  return { update, set, where, returning };
+}
+
+/** Wire jwt.generateToken to succeed twice (access then refresh). */
+function mockTokenGeneration() {
+  vi.mocked(jwt.generateToken)
+    .mockResolvedValueOnce({
+      token: "new-access",
+      exp: 111,
+      jti: "access-jti"
+    } as any)
+    .mockResolvedValueOnce({
+      token: "new-refresh",
+      exp: 222,
+      jti: "refresh-jti"
+    } as any);
+}
+
+describe("refreshTokenService.refreshToken", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("returns invalid_token when jti is missing from the payload", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({ id: 1 } as any);
+
+    const result = await refreshTokenService.refreshToken({ refresh_token: "x" });
+
+    expect(result).toEqual({
+      kind: "invalid_token",
+      message: "Invalid refresh token"
+    });
+    expect(db.query.refreshTokens.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("returns invalid_token when jti is not a string", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({
+      jti: 12345,
+      id: 1
+    } as any);
+
+    const result = await refreshTokenService.refreshToken({ refresh_token: "x" });
+
+    expect(result.kind).toBe("invalid_token");
+    expect(db.query.refreshTokens.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("returns invalid_token when id is not a positive integer", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({
+      jti: "jti-old",
+      id: "not-a-number"
+    } as any);
+
+    const result = await refreshTokenService.refreshToken({ refresh_token: "x" });
+
+    expect(result.kind).toBe("invalid_token");
+    expect(db.query.refreshTokens.findFirst).not.toHaveBeenCalled();
+  });
+
+  it("returns revoked when no stored token matches the jti", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({
+      jti: "jti-old",
+      id: 1
+    } as any);
+    vi.mocked(db.query.refreshTokens.findFirst).mockResolvedValueOnce(undefined);
+
+    const result = await refreshTokenService.refreshToken({ refresh_token: "x" });
+
+    expect(result).toEqual({ kind: "revoked", message: "Refresh token revoked" });
+  });
+
+  it("returns revoked when the stored token is revoked", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({
+      jti: "jti-old",
+      id: 1
+    } as any);
+    vi.mocked(db.query.refreshTokens.findFirst).mockResolvedValueOnce({
+      ...storedToken,
+      revoked: 1
+    } as any);
+
+    const result = await refreshTokenService.refreshToken({ refresh_token: "x" });
+
+    expect(result.kind).toBe("revoked");
+  });
+
+  it("returns expired and deletes the row when the token has expired", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({
+      jti: "jti-old",
+      id: 1
+    } as any);
+    vi.mocked(db.query.refreshTokens.findFirst).mockResolvedValueOnce({
+      ...storedToken,
+      expiresAt: pastDate
+    } as any);
+
+    const result = await refreshTokenService.refreshToken({ refresh_token: "x" });
+
+    expect(result).toEqual({ kind: "expired", message: "Refresh token expired" });
+    expect(db.delete).toHaveBeenCalledTimes(1);
+    expect(db.update).not.toHaveBeenCalled();
+  });
+
+  it("returns user_not_found when the user has been deleted", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({
+      jti: "jti-old",
+      id: 1
+    } as any);
+    vi.mocked(db.query.refreshTokens.findFirst).mockResolvedValueOnce(storedToken as any);
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(undefined);
+
+    const result = await refreshTokenService.refreshToken({ refresh_token: "x" });
+
+    expect(result).toEqual({
+      kind: "user_not_found",
+      message: "User not found"
+    });
+    expect(db.update).not.toHaveBeenCalled();
+  });
+
+  it("rotates the token and returns new cookies on the happy path", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({
+      jti: "jti-old",
+      id: 1,
+      remember: false
+    } as any);
+    vi.mocked(db.query.refreshTokens.findFirst).mockResolvedValueOnce(storedToken as any);
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    mockTokenGeneration();
+
+    const { update, set, where } = mockRotate([{ id: 10 }]);
+
+    const result = await refreshTokenService.refreshToken({
+      refresh_token: "old-token"
+    });
+
+    expect(result).toEqual({
+      kind: "refreshed",
+      message: "Token refreshed successfully",
+      data: {
+        user: { id: 1, email: "user@example.com", name: "Jane" },
+        access_token: "new-access",
+        refresh_token: "new-refresh",
+        token_type: "Bearer"
+      },
+      cookies: {
+        accessToken: "new-access",
+        refreshToken: "new-refresh",
+        refreshExpiry: undefined
+      }
+    });
+
+    // Rotation wrote the new jti + expiry, and cleared revoked
+    expect(set).toHaveBeenCalledWith({
+      jti: "refresh-jti",
+      expiresAt: new Date(222 * 1000),
+      revoked: 0
+    });
+
+    // The CAS where-clause targets both the row id AND the old jti.
+    const whereArg = where.mock.calls[0][0] as any;
+    expect(whereArg.op).toBe("and");
+
+    const eqArgs = whereArg.args.filter((a: any) => a?.op === "eq");
+    const idEq = eqArgs.find((c: any) => c.col === "refreshTokens.id");
+    const jtiEq = eqArgs.find((c: any) => c.col === "refreshTokens.jti");
+
+    expect(idEq).toBeDefined();
+    expect(idEq.val).toBe(10);
+    expect(jtiEq).toBeDefined();
+    expect(jtiEq.val).toBe("jti-old");
+
+    expect(update).toHaveBeenCalledTimes(1);
+  });
+
+  it("uses remember-me expiry when the payload has remember=true", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({
+      jti: "jti-old",
+      id: 1,
+      remember: true
+    } as any);
+    vi.mocked(db.query.refreshTokens.findFirst).mockResolvedValueOnce(storedToken as any);
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    mockTokenGeneration();
+    mockRotate([{ id: 10 }]);
+
+    const result = await refreshTokenService.refreshToken({
+      refresh_token: "old-token"
+    });
+
+    expect(jwt.generateToken).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({ id: 1, email: "user@example.com", remember: true }),
+      "refresh",
+      60 * 60 * 24 * 30
+    );
+
+    if (result.kind === "refreshed") {
+      expect(result.cookies.refreshExpiry).toBe(60 * 60 * 24 * 30);
+    }
+  });
+
+  it("returns revoked when the CAS loses (token already rotated by another request)", async () => {
+    vi.mocked(jwt.verifyToken).mockResolvedValueOnce({
+      jti: "jti-old",
+      id: 1,
+      remember: false
+    } as any);
+    vi.mocked(db.query.refreshTokens.findFirst).mockResolvedValueOnce(storedToken as any);
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    mockTokenGeneration();
+
+    // Simulate a losing CAS: the conditional UPDATE matches no rows
+    mockRotate([]);
+
+    const result = await refreshTokenService.refreshToken({
+      refresh_token: "old-token"
+    });
+
+    expect(result).toEqual({
+      kind: "revoked",
+      message: "Refresh token revoked"
+    });
+  });
+});

package/express/src/modules/auth/__tests__/register.test.ts

@@ -0,0 +1,291 @@
+import type { Request, Response } from "express";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/config/index.js", () => ({
+  authConfig: { requireEmailVerification: false }
+}));
+
+vi.mock("@/framework/facade.js", () => ({
+  db: {
+    query: {
+      roles: { findFirst: vi.fn() },
+      users: { findFirst: vi.fn() }
+    },
+    transaction: vi.fn()
+  },
+  dispatchEvent: vi.fn(),
+  password: { hashPassword: vi.fn() },
+  urls: { url: vi.fn((p: string) => `https://app.test${p}`) }
+}));
+
+vi.mock("@/modules/auth/database/models/role.js", () => ({
+  roles: { __table: "roles", name: "roles.name" }
+}));
+
+vi.mock("@/modules/auth/database/models/user.js", () => ({
+  users: { __table: "users", id: "users.id", email: "users.email" },
+  emailVerificationTokens: {
+    __table: "emailVerificationTokens",
+    email: "emailVerificationTokens.email",
+    token: "emailVerificationTokens.token",
+    expiresAt: "emailVerificationTokens.expiresAt",
+    createdAt: "emailVerificationTokens.createdAt"
+  }
+}));
+
+vi.mock("@/modules/auth/helpers/auth.js", () => ({
+  hashEmailVerificationToken: vi.fn((t: string) => `hashed:${t}`),
+  makeEmailVerificationToken: vi.fn(() => "plain-verify-token"),
+  issueTokens: vi.fn(),
+  revokeCurrentRefreshToken: vi.fn(),
+  sanitizeUser: vi.fn((u: any) => ({ id: u.id, email: u.email, name: u.name }))
+}));
+
+import { authConfig } from "@/config/index.js";
+import { db, dispatchEvent, password, urls } from "@/framework/facade.js";
+import { issueTokens, revokeCurrentRefreshToken } from "@/modules/auth/helpers/auth.js";
+import { registerService } from "@/modules/auth/services/register.js";
+
+const body = { name: "Jane", email: "jane@example.com", password: "secret123" };
+
+const fakeUser = {
+  id: 1,
+  name: "Jane",
+  email: "jane@example.com",
+  role: { id: 2, name: "user" }
+};
+
+function makeReqRes() {
+  const req = {} as Request;
+  const res = {} as Response;
+  return { req, res };
+}
+
+/**
+ * Build a fake tx.
+ *   - insertedRow: what insert().returning() resolves to
+ *   - refetchedUser: what query.users.findFirst returns inside the tx
+ */
+function buildTx({ insertedRow = { id: 1 } as unknown, refetchedUser = fakeUser as unknown | null } = {}) {
+  const insertCalls: { table: unknown; values: unknown }[] = [];
+  let currentInsertTable: unknown;
+
+  const txInsertReturning = vi.fn((_args?: unknown) => Promise.resolve(insertedRow ? [insertedRow] : []));
+  const txInsertValues = vi.fn((values: unknown) => {
+    insertCalls.push({ table: currentInsertTable, values });
+    return { returning: txInsertReturning };
+  });
+  const txInsert = vi.fn((table: unknown) => {
+    currentInsertTable = table;
+    return { values: txInsertValues };
+  });
+
+  const txDeleteWhere = vi.fn((_where: unknown) => Promise.resolve(undefined));
+  const txDelete = vi.fn((_table: unknown) => ({ where: txDeleteWhere }));
+
+  const txFindFirst = vi.fn((_args: unknown) => Promise.resolve(refetchedUser));
+
+  return {
+    tx: {
+      insert: txInsert,
+      delete: txDelete,
+      query: { users: { findFirst: txFindFirst } }
+    },
+    txInsert,
+    txInsertValues,
+    txInsertReturning,
+    txDelete,
+    txDeleteWhere,
+    txFindFirst,
+    insertCalls
+  };
+}
+
+describe("registerService.register (express)", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(authConfig).requireEmailVerification = false;
+    vi.mocked(password.hashPassword).mockResolvedValue("hashed-secret" as any);
+    vi.mocked(db.query.roles.findFirst).mockResolvedValue({
+      id: 2,
+      name: "user"
+    } as any);
+    vi.mocked(db.query.users.findFirst).mockResolvedValue(undefined as any);
+  });
+
+  it("returns email_exists when the email is already taken (no hashing, no tx)", async () => {
+    vi.mocked(db.query.users.findFirst).mockResolvedValueOnce(fakeUser as any);
+    const { req, res } = makeReqRes();
+
+    const result = await registerService.register(req, res, body);
+
+    expect(result).toEqual({
+      kind: "email_exists",
+      message: "Email already exists"
+    });
+    expect(password.hashPassword).not.toHaveBeenCalled();
+    expect(db.transaction).not.toHaveBeenCalled();
+  });
+
+  it("throws if the default 'user' role is missing", async () => {
+    vi.mocked(db.query.roles.findFirst).mockResolvedValueOnce(undefined);
+    const { req, res } = makeReqRes();
+
+    await expect(registerService.register(req, res, body)).rejects.toThrow('Default role "user" not found');
+
+    expect(db.transaction).not.toHaveBeenCalled();
+  });
+
+  it("hashes the password BEFORE opening the transaction", async () => {
+    const order: string[] = [];
+    vi.mocked(password.hashPassword).mockImplementationOnce(async () => {
+      order.push("hash");
+      return "hashed-secret" as any;
+    });
+
+    const { tx } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => {
+      order.push("tx");
+      return fn(tx);
+    });
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "a",
+      refreshToken: "r"
+    } as any);
+
+    const { req, res } = makeReqRes();
+    await registerService.register(req, res, body);
+
+    expect(order).toEqual(["hash", "tx"]);
+  });
+
+  it("inserts the user with the hashed password and the default role id", async () => {
+    const { tx, insertCalls } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "a",
+      refreshToken: "r"
+    } as any);
+    const { req, res } = makeReqRes();
+
+    await registerService.register(req, res, body);
+
+    const inserted = insertCalls[0].values as any;
+    expect(inserted).toMatchObject({
+      name: "Jane",
+      email: "jane@example.com",
+      password: "hashed-secret",
+      roleId: 2
+    });
+    expect(inserted.password).not.toBe("secret123");
+  });
+
+  it("registers, issues tokens, and dispatches user:signup WITHOUT the password", async () => {
+    const { tx } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+    vi.mocked(issueTokens).mockResolvedValueOnce({
+      accessToken: "access-123",
+      refreshToken: "refresh-456"
+    } as any);
+    const { req, res } = makeReqRes();
+
+    const result = await registerService.register(req, res, {
+      ...body,
+      remember: true
+    });
+
+    expect(revokeCurrentRefreshToken).toHaveBeenCalledWith(req, res);
+    expect(issueTokens).toHaveBeenCalledWith(req, res, fakeUser, {
+      remember: true
+    });
+
+    // The critical assertion: password must NOT be in the event payload
+    expect(dispatchEvent).toHaveBeenCalledWith(
+      "user:signup",
+      {
+        userId: 1,
+        email: "jane@example.com",
+        name: "Jane"
+      },
+      { queue: "mail" }
+    );
+
+    const [, eventPayload] = vi.mocked(dispatchEvent).mock.calls[0];
+    expect(eventPayload).not.toHaveProperty("password");
+
+    expect(result).toEqual({
+      kind: "registered",
+      message: "User registered successfully",
+      data: {
+        user: { id: 1, email: "jane@example.com", name: "Jane" },
+        access_token: "access-123",
+        refresh_token: "refresh-456",
+        token_type: "Bearer"
+      }
+    });
+  });
+
+  it("returns verification_required and dispatches user:verify-email when verification is on", async () => {
+    vi.mocked(authConfig).requireEmailVerification = true;
+
+    const { tx, insertCalls } = buildTx();
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+    const { req, res } = makeReqRes();
+
+    const result = await registerService.register(req, res, body);
+
+    expect(result).toEqual({
+      kind: "verification_required",
+      message: "User registered successfully. Please verify your email before logging in."
+    });
+
+    expect(dispatchEvent).toHaveBeenCalledWith(
+      "user:verify-email",
+      {
+        email: "jane@example.com",
+        name: "Jane",
+        verifyUrl: "https://app.test/verify-email?token=plain-verify-token&email=jane%40example.com"
+      },
+      { queue: "mail" }
+    );
+
+    // No signup event, no tokens
+    expect(issueTokens).not.toHaveBeenCalled();
+    expect(revokeCurrentRefreshToken).not.toHaveBeenCalled();
+
+    // Second insert (the token) stored the HASH, not the plain token
+    const tokenInsert = insertCalls[1].values as any;
+    expect(tokenInsert.token).toBe("hashed:plain-verify-token");
+    expect(tokenInsert.token).not.toBe("plain-verify-token");
+    expect(tokenInsert.email).toBe("jane@example.com");
+  });
+
+  it("does not dispatch any email if the transaction fails", async () => {
+    vi.mocked(db.transaction).mockRejectedValueOnce(new Error("db down"));
+    const { req, res } = makeReqRes();
+
+    await expect(registerService.register(req, res, body)).rejects.toThrow("db down");
+
+    expect(dispatchEvent).not.toHaveBeenCalled();
+  });
+
+  it("throws when the insert returns no row", async () => {
+    const { tx } = buildTx({ insertedRow: null });
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+    const { req, res } = makeReqRes();
+
+    await expect(registerService.register(req, res, body)).rejects.toThrow("Failed to insert user");
+
+    expect(dispatchEvent).not.toHaveBeenCalled();
+  });
+
+  it("throws when the inserted user cannot be re-fetched", async () => {
+    const { tx } = buildTx({ refetchedUser: null });
+    vi.mocked(db.transaction).mockImplementationOnce(async (fn: any) => fn(tx));
+    const { req, res } = makeReqRes();
+
+    await expect(registerService.register(req, res, body)).rejects.toThrow("Inserted user not found");
+
+    expect(dispatchEvent).not.toHaveBeenCalled();
+  });
+});