create-restack-pattern 0.1.0

package/template/backend/src/domains/auth/auth.service.test.ts

@@ -0,0 +1,143 @@
+import { describe, it, expect, vi, beforeEach } from "vitest"
+import bcrypt from "bcryptjs"
+import { authService } from "./auth.service.js"
+import { authRepo } from "./auth.repo.js"
+import { userRepo } from "../user/user.repo.js"
+
+vi.mock("./auth.repo.js", () => ({
+  authRepo: {
+    findByEmail: vi.fn(),
+    create: vi.fn(),
+    createSession: vi.fn(),
+    consumeSessionByHash: vi.fn(),
+    deleteSessionByHash: vi.fn(),
+  },
+}))
+
+vi.mock("../user/user.repo.js", () => ({
+  userRepo: {
+    findById: vi.fn(),
+    updateProfile: vi.fn(),
+  },
+}))
+
+const mockedAuthRepo = vi.mocked(authRepo, true)
+const mockedUserRepo = vi.mocked(userRepo, true)
+
+const dbUser = (overrides: Partial<{ id: number; name: string; email: string; password: string }> = {}) => ({
+  id: 1,
+  name: "X",
+  email: "a@b.com",
+  password: "hash",
+  createdAt: new Date(),
+  ...overrides,
+})
+
+const dbSession = (overrides: Partial<{ id: number; userId: number; refreshTokenHash: string; expiresAt: Date }> = {}) => ({
+  id: 1,
+  userId: 1,
+  refreshTokenHash: "hash",
+  expiresAt: new Date(Date.now() + 60_000),
+  createdAt: new Date(),
+  ...overrides,
+})
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+describe("authService.register", () => {
+  it("throws if the email is already in use", async () => {
+    mockedAuthRepo.findByEmail.mockResolvedValue(dbUser())
+    await expect(
+      authService.register({ name: "X", email: "a@b.com", password: "password123" })
+    ).rejects.toThrow("Email already in use")
+  })
+
+  it("creates the user with a hashed password and a normalized email", async () => {
+    mockedAuthRepo.findByEmail.mockResolvedValue(null)
+    mockedAuthRepo.create.mockImplementation(async (data) => dbUser(data))
+
+    const user = await authService.register({ name: "X", email: "  A@B.com  ", password: "password123" })
+
+    expect(user).toEqual({ id: 1, name: "X", email: "a@b.com" })
+    const createdArg = mockedAuthRepo.create.mock.calls[0][0]
+    expect(createdArg.email).toBe("a@b.com")
+    expect(createdArg.password).not.toBe("password123")
+  })
+})
+
+describe("authService.login", () => {
+  it("throws on an unknown email", async () => {
+    mockedAuthRepo.findByEmail.mockResolvedValue(null)
+    await expect(authService.login({ email: "nope@example.com", password: "whatever1" })).rejects.toThrow(
+      "Invalid credentials"
+    )
+  })
+
+  it("throws on a wrong password", async () => {
+    const passwordHash = await bcrypt.hash("correct-password", 4)
+    mockedAuthRepo.findByEmail.mockResolvedValue(dbUser({ password: passwordHash }))
+    await expect(authService.login({ email: "a@b.com", password: "wrong-password" })).rejects.toThrow(
+      "Invalid credentials"
+    )
+  })
+
+  it("returns the public user shape on correct credentials", async () => {
+    const passwordHash = await bcrypt.hash("correct-password", 4)
+    mockedAuthRepo.findByEmail.mockResolvedValue(dbUser({ password: passwordHash }))
+    const user = await authService.login({ email: "a@b.com", password: "correct-password" })
+    expect(user).toEqual({ id: 1, name: "X", email: "a@b.com" })
+  })
+})
+
+describe("authService.refresh", () => {
+  it("throws when no session matches the hashed token (invalid/expired/already-consumed)", async () => {
+    mockedAuthRepo.consumeSessionByHash.mockResolvedValue(null)
+    await expect(authService.refresh("some-token")).rejects.toThrow("Invalid refresh token")
+  })
+
+  it("rotates: the old session is consumed and a fresh pair is issued", async () => {
+    mockedAuthRepo.consumeSessionByHash.mockResolvedValue(dbSession())
+    mockedUserRepo.findById.mockResolvedValue(dbUser())
+    mockedAuthRepo.createSession.mockResolvedValue(dbSession({ id: 2 }))
+
+    const result = await authService.refresh("old-token")
+
+    expect(result.user).toEqual({ id: 1, name: "X", email: "a@b.com" })
+    expect(typeof result.accessToken).toBe("string")
+    expect(typeof result.refreshToken).toBe("string")
+    expect(mockedAuthRepo.createSession).toHaveBeenCalledTimes(1)
+  })
+
+  it("throws if the session's user no longer exists", async () => {
+    mockedAuthRepo.consumeSessionByHash.mockResolvedValue(dbSession({ userId: 999 }))
+    mockedUserRepo.findById.mockResolvedValue(null)
+    await expect(authService.refresh("old-token")).rejects.toThrow("Invalid refresh token")
+  })
+})
+
+describe("authService.revokeSession", () => {
+  it("deletes the session matching the hashed token", async () => {
+    await authService.revokeSession("some-token")
+    expect(mockedAuthRepo.deleteSessionByHash).toHaveBeenCalledWith(expect.any(String))
+  })
+})
+
+describe("authService.verifyAccessToken", () => {
+  it("round-trips a token issued by issueTokenPair", async () => {
+    mockedAuthRepo.createSession.mockResolvedValue(dbSession())
+    const { accessToken } = await authService.issueTokenPair({ id: 1, name: "X", email: "a@b.com" })
+    const payload = await authService.verifyAccessToken(accessToken)
+    expect(payload.sub).toBe("1")
+    expect(payload.email).toBe("a@b.com")
+  })
+
+  it("rejects a tampered token", async () => {
+    mockedAuthRepo.createSession.mockResolvedValue(dbSession())
+    const { accessToken } = await authService.issueTokenPair({ id: 1, name: "X", email: "a@b.com" })
+    const i = accessToken.indexOf(".") + 5
+    const tampered = accessToken.slice(0, i) + (accessToken[i] === "a" ? "b" : "a") + accessToken.slice(i + 1)
+    await expect(authService.verifyAccessToken(tampered)).rejects.toThrow()
+  })
+})

package/template/backend/src/domains/auth/auth.service.ts

@@ -0,0 +1,97 @@
+import bcrypt from "bcryptjs"
+import { SignJWT, jwtVerify } from "jose"
+import { randomBytes, createHash } from "node:crypto"
+import type { AuthUser, LoginInput, RegisterInput } from "@restack/shared"
+import { env } from "../../config/env.js"
+import { authRepo } from "./auth.repo.js"
+import { userRepo } from "../user/user.repo.js"
+import type { AuthTokenPayload } from "./auth.types.js"
+
+/**
+ * Service layer for the Auth domain.
+ * Houses core validation and cryptographic flows (JWT token signing, refresh token generation, hashing).
+ * 
+ * Semi-DDD rules:
+ * - `.service.ts` files encapsulate business rules and complex workflows (e.g. session issuance & rotation).
+ * - They must never call Drizzle ORM directly; always interact through the repo layer.
+ */
+const secret = new TextEncoder().encode(env.JWT_SECRET)
+const BCRYPT_COST = 12
+// Dummy hash so failed logins on unknown emails still pay the bcrypt cost (timing-attack mitigation).
+const DUMMY_HASH = bcrypt.hashSync("dummy-password-for-timing-safety", BCRYPT_COST)
+const normalizeEmail = (email: string) => email.trim().toLowerCase()
+
+export const ACCESS_TOKEN_TTL_SECONDS = 60 * 15 // 15 minutes
+export const REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30 // 30 days
+
+const buildTokenPayload = (user: { id: number; email: string }): AuthTokenPayload => ({
+  sub: String(user.id),
+  email: user.email,
+})
+
+const signAccessToken = (user: { id: number; email: string }) =>
+  new SignJWT(buildTokenPayload(user))
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime(`${ACCESS_TOKEN_TTL_SECONDS}s`)
+    .sign(secret)
+
+// Opaque, high-entropy refresh token — not a JWT, so it carries no forgeable claims.
+// Only its sha256 hash is ever persisted (see auth.model.ts), so a DB leak alone can't be replayed.
+const generateRefreshToken = () => randomBytes(32).toString("hex")
+const hashRefreshToken = (token: string) => createHash("sha256").update(token).digest("hex")
+
+const issueTokenPair = async (user: AuthUser) => {
+  const accessToken = await signAccessToken(user)
+  const refreshToken = generateRefreshToken()
+  await authRepo.createSession({
+    userId: user.id,
+    refreshTokenHash: hashRefreshToken(refreshToken),
+    expiresAt: new Date(Date.now() + REFRESH_TOKEN_TTL_SECONDS * 1000),
+  })
+  return { accessToken, refreshToken, user }
+}
+
+export const authService = {
+  register: async (data: RegisterInput): Promise<AuthUser> => {
+    const email = normalizeEmail(data.email)
+    const existing = await authRepo.findByEmail(email)
+    if (existing) throw new Error("Email already in use")
+
+    const password = await bcrypt.hash(data.password, BCRYPT_COST)
+    const user = await authRepo.create({ ...data, email, password })
+    return { id: user.id, name: user.name, email: user.email }
+  },
+
+  login: async (data: LoginInput): Promise<AuthUser> => {
+    const user = await authRepo.findByEmail(normalizeEmail(data.email))
+    const valid = await bcrypt.compare(data.password, user ? user.password : DUMMY_HASH)
+    if (!user || !valid) throw new Error("Invalid credentials")
+
+    return { id: user.id, name: user.name, email: user.email }
+  },
+
+  issueTokenPair,
+
+  // Rotates the refresh token on every use: consuming it (atomic delete) and issuing
+  // a brand new pair means a stolen-but-already-used token becomes worthless, and
+  // concurrent requests racing on the same token can only ever have one winner.
+  refresh: async (refreshToken: string) => {
+    const session = await authRepo.consumeSessionByHash(hashRefreshToken(refreshToken))
+    if (!session) throw new Error("Invalid refresh token")
+
+    const user = await userRepo.findById(session.userId)
+    if (!user) throw new Error("Invalid refresh token")
+
+    return issueTokenPair({ id: user.id, name: user.name, email: user.email })
+  },
+
+  revokeSession: async (refreshToken: string) => {
+    await authRepo.deleteSessionByHash(hashRefreshToken(refreshToken))
+  },
+
+  verifyAccessToken: async (token: string): Promise<AuthTokenPayload> => {
+    const { payload } = await jwtVerify(token, secret)
+    return payload as AuthTokenPayload
+  },
+}

package/template/backend/src/domains/auth/auth.types.ts

@@ -0,0 +1,7 @@
+import type { JWTPayload } from "jose"
+
+export interface AuthTokenPayload extends JWTPayload {
+  sub: string
+  email: string
+  // Add fields here when the user model supports them, e.g. role, permissions.
+}

package/template/backend/src/domains/user/user.model.ts

@@ -0,0 +1,14 @@
+import { pgTable, text, timestamp, serial } from "drizzle-orm/pg-core"
+
+/**
+ * Users Table Schema.
+ * Defines the core database table layout for registered users.
+ * Fields: id (sequential serial integer), name (raw string), email (unique), password (bcrypt hash), and createdAt.
+ */
+export const usersTable = pgTable("users", {
+  id: serial("id").primaryKey(),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  password: text("password").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+})

package/template/backend/src/domains/user/user.repo.ts

@@ -0,0 +1,29 @@
+import { eq } from "drizzle-orm"
+import { db } from "../../shared/db/index.js"
+import { usersTable } from "./user.model.js"
+
+export type UserRow = typeof usersTable.$inferSelect
+
+/**
+ * Repository layer for the User domain.
+ * Encapsulates all direct database queries for users.
+ * 
+ * Semi-DDD rules:
+ * - Direct database interactions (Drizzle client) must live only inside `.repo.ts` files.
+ * - Under cross-domain rules, the Auth domain can import from this repo (e.g. user lookup by ID/email),
+ *   but the User domain must never depend on the Auth domain (one-way dependency flow).
+ */
+export const userRepo = {
+  // Explicit return type matters: without noUncheckedIndexedAccess, TS infers array
+  // destructuring as always-defined, so `user ?? null` silently loses the null branch
+  // and callers' `if (!user)` checks type-check as always-false without this annotation.
+  findById: async (id: number): Promise<UserRow | null> => {
+    const [user] = await db.select().from(usersTable).where(eq(usersTable.id, id))
+    return user ?? null
+  },
+
+  updateProfile: async (id: number, data: { name?: string }): Promise<UserRow | null> => {
+    const [user] = await db.update(usersTable).set(data).where(eq(usersTable.id, id)).returning()
+    return user ?? null
+  },
+}

package/template/backend/src/domains/user/user.routes.test.ts

@@ -0,0 +1,82 @@
+import { describe, it, expect, beforeAll, afterAll } from "vitest"
+import { eq } from "drizzle-orm"
+import { userRoutes } from "./user.routes.js"
+import { authService } from "../auth/auth.service.js"
+import { db } from "../../shared/db/index.js"
+import { usersTable } from "./user.model.js"
+
+const TEST_EMAIL = `user-routes-test-${Date.now()}@example.com`
+let accessToken: string
+let userId: number
+
+beforeAll(async () => {
+  const user = await authService.register({ name: "Route Test", email: TEST_EMAIL, password: "password123" })
+  userId = user.id
+  const tokens = await authService.issueTokenPair(user)
+  accessToken = tokens.accessToken
+})
+
+afterAll(async () => {
+  await db.delete(usersTable).where(eq(usersTable.id, userId))
+})
+
+const authHeaders = (token?: string) => ({
+  "Content-Type": "application/json",
+  ...(token ? { Cookie: `access_token=${token}` } : {}),
+})
+
+describe("GET /me", () => {
+  it("returns 401 without a token", async () => {
+    const res = await userRoutes.request("/me")
+    expect(res.status).toBe(401)
+  })
+
+  it("returns the profile with a valid token", async () => {
+    const res = await userRoutes.request("/me", { headers: authHeaders(accessToken) })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.user.email).toBe(TEST_EMAIL)
+  })
+})
+
+describe("PUT /profile", () => {
+  it("returns 401 without a token", async () => {
+    const res = await userRoutes.request("/profile", {
+      method: "PUT",
+      headers: authHeaders(),
+      body: JSON.stringify({ name: "x" }),
+    })
+    expect(res.status).toBe(401)
+  })
+
+  it("updates the name with a valid token and body", async () => {
+    const res = await userRoutes.request("/profile", {
+      method: "PUT",
+      headers: authHeaders(accessToken),
+      body: JSON.stringify({ name: "Updated Name" }),
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.user.name).toBe("Updated Name")
+  })
+
+  it("rejects an invalid body (empty name)", async () => {
+    const res = await userRoutes.request("/profile", {
+      method: "PUT",
+      headers: authHeaders(accessToken),
+      body: JSON.stringify({ name: "" }),
+    })
+    expect(res.status).toBe(400)
+  })
+
+  it("treats an empty body as a no-op instead of erroring", async () => {
+    const res = await userRoutes.request("/profile", {
+      method: "PUT",
+      headers: authHeaders(accessToken),
+      body: JSON.stringify({}),
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.user.email).toBe(TEST_EMAIL)
+  })
+})

package/template/backend/src/domains/user/user.routes.ts

@@ -0,0 +1,48 @@
+import { Hono } from "hono"
+import type { Context } from "hono"
+import { zValidator } from "@hono/zod-validator"
+import { UpdateProfileSchema } from "@restack/shared"
+import type { AuthVariables } from "../../shared/middlewares/require-auth.js"
+import { requireAuth } from "../../shared/middlewares/require-auth.js"
+import { userService, UserNotFoundError } from "./user.service.js"
+import { rateLimit } from "../../shared/middlewares/rate-limit.js"
+import { logger } from "../../shared/logger/logger.js"
+
+/**
+ * Routing layer for the User domain.
+ * Configures the router and defines endpoints with appropriate middlewares.
+ * 
+ * Semi-DDD rules:
+ * - `.routes.ts` files define HTTP endpoints, parse inputs using schema validators (zValidator),
+ *   apply guards (requireAuth, rateLimit), and serialize JSON responses.
+ * - Routing code should never implement business logic directly; it must delegate to the service layer.
+ */
+export const userRoutes = new Hono<{ Variables: AuthVariables }>()
+
+// Only UserNotFoundError is an expected, safe-to-expose outcome. Anything else (DB/driver
+// errors, etc.) gets logged with detail but returned to the caller as a generic 500 —
+// leaking raw error messages/mislabeling unexpected failures as 404 would be misleading.
+const handleProfileError = (c: Context, e: unknown, action: string) => {
+  if (e instanceof UserNotFoundError) return c.json({ error: e.message }, 404)
+  logger.error({ err: e instanceof Error ? e.message : String(e) }, action)
+  return c.json({ error: "Internal server error" }, 500)
+}
+
+userRoutes.get("/me", requireAuth, async (c) => {
+  try {
+    const profile = await userService.getProfile(Number(c.get("user").sub))
+    return c.json({ user: profile })
+  } catch (e) {
+    return handleProfileError(c, e, "Get profile failed")
+  }
+})
+
+userRoutes.put("/profile", requireAuth, rateLimit, zValidator("json", UpdateProfileSchema), async (c) => {
+  try {
+    const body = c.req.valid("json")
+    const profile = await userService.updateProfile(Number(c.get("user").sub), body)
+    return c.json({ user: profile })
+  } catch (e) {
+    return handleProfileError(c, e, "Update profile failed")
+  }
+})

package/template/backend/src/domains/user/user.service.ts

@@ -0,0 +1,40 @@
+import type { AuthUser, UpdateProfileInput } from "@restack/shared"
+import { userRepo } from "./user.repo.js"
+
+export class UserNotFoundError extends Error {}
+
+/**
+ * Maps database user object into the public, safe schema shape.
+ * Always filters out sensitive columns like password hashes.
+ */
+const toPublicUser = (user: { id: number; name: string; email: string }): AuthUser => ({
+  id: user.id,
+  name: user.name,
+  email: user.email,
+})
+
+/**
+ * Service layer for the User domain.
+ * Contains core business logic and validations.
+ * 
+ * Semi-DDD rules:
+ * - `.service.ts` encapsulates business logic, mappings, and validations.
+ * - It must never interact with the database client directly; always query through the `.repo.ts` layer.
+ */
+export const userService = {
+  getProfile: async (id: number): Promise<AuthUser> => {
+    const user = await userRepo.findById(id)
+    if (!user) throw new UserNotFoundError("User not found")
+    return toPublicUser(user)
+  },
+
+  updateProfile: async (id: number, data: UpdateProfileInput): Promise<AuthUser> => {
+    // An empty body validates against UpdateProfileSchema (all fields optional) but would
+    // reach db.update(...).set({}), which Drizzle/postgres reject — short-circuit to a no-op.
+    if (Object.keys(data).length === 0) return userService.getProfile(id)
+
+    const user = await userRepo.updateProfile(id, data)
+    if (!user) throw new UserNotFoundError("User not found")
+    return toPublicUser(user)
+  },
+}

package/template/backend/src/hono-app.ts

@@ -0,0 +1,42 @@
+import { Hono } from "hono"
+import { cors } from "hono/cors"
+import { csrf } from "hono/csrf"
+import { logger as honoLogger } from "hono/logger"
+import { env } from "./config/env.js"
+import { logger } from "./shared/logger/logger.js"
+import { authRoutes } from "./domains/auth/auth.routes.js"
+import { userRoutes } from "./domains/user/user.routes.js"
+
+/**
+ * Hono application instance — routes, middleware, everything except the transport.
+ * Kept separate from index.ts so this same app can run under a persistent Node
+ * server (local dev, Railway/Render/VPS) or as a Vercel serverless function
+ * (backend/api/index.ts), which cannot call @hono/node-server's serve().
+ */
+export const app = new Hono()
+
+const allowedOrigins = env.FRONTEND_URL
+  .split(",")
+  .map((url) => url.trim())
+
+app.use(honoLogger((...args) => logger.info(args.join(" "))))
+
+app.use(
+  "/api/*",
+  cors({
+    origin: allowedOrigins,
+    credentials: true,
+  })
+)
+
+app.use(
+  "/api/*",
+  csrf({
+    origin: allowedOrigins,
+  })
+)
+
+app.route("/api/auth", authRoutes)
+app.route("/api/user", userRoutes)
+
+app.get("/", (c) => c.json({ status: "ok" }))

package/template/backend/src/index.ts

@@ -0,0 +1,13 @@
+import { serve } from "@hono/node-server"
+import { env } from "./config/env.js"
+import { logger } from "./shared/logger/logger.js"
+import { app } from "./hono-app.js"
+
+/**
+ * Local dev / persistent-server entry point (tsx watch, Railway, Render, any VPS).
+ * Not used on Vercel — backend/api/index.ts hands the same `app` to the platform
+ * as a serverless function instead of binding a port.
+ */
+serve({ fetch: app.fetch, port: env.PORT }, (info) => {
+  logger.info(`Server running on http://localhost:${info.port}`)
+})

package/template/backend/src/shared/db/index.ts

@@ -0,0 +1,11 @@
+import { drizzle } from "drizzle-orm/postgres-js"
+import postgres from "postgres"
+import { env } from "../../config/env.js"
+
+/**
+ * Database client initialization.
+ * Starts the `postgres-js` connection pool using the validated DATABASE_URL environment setting
+ * and wraps it with the Drizzle ORM client wrapper.
+ */
+const client = postgres(env.DATABASE_URL)
+export const db = drizzle(client)

package/template/backend/src/shared/logger/logger.ts

@@ -0,0 +1,15 @@
+import pino from "pino"
+import { env } from "../../config/env.js"
+
+/**
+ * Global logger client.
+ * Configured using `pino`. Automatically toggles logging verbosity (info vs debug)
+ * and formats stdout output using `pino-pretty` during local development.
+ */
+export const logger = pino({
+  level: env.NODE_ENV === "production" ? "info" : "debug",
+  transport:
+    env.NODE_ENV === "production"
+      ? undefined
+      : { target: "pino-pretty", options: { colorize: true } },
+})

package/template/backend/src/shared/middlewares/rate-limit.ts

@@ -0,0 +1,43 @@
+import type { Context, MiddlewareHandler } from "hono"
+import { getConnInfo } from "@hono/node-server/conninfo"
+
+/**
+ * In-Memory Fixed-Window Rate Limiting Middleware.
+ * 
+ * Performance/Topology Note:
+ * - This implementation stores counts in a local `Map` memory segment.
+ * - This works perfectly for single-process deployments (like a standalone Railway node).
+ * - If horizontal scaling (multiple instances) is introduced, this must be swapped
+ *   for a shared datastore (e.g. Redis) to ensure limits are synchronized globally.
+ */
+const WINDOW_MS = 60_000
+const MAX_REQUESTS = 10
+
+const hits = new Map<string, { count: number; resetAt: number }>()
+
+// getConnInfo reaches into the raw Node socket, which only exists when served via a real
+// @hono/node-server connection — it throws in in-memory test harnesses (Hono's `.request()`)
+// and some serverless runtimes. Fall back to a shared bucket rather than crashing the request.
+const clientIp = (c: Context) => {
+  try {
+    return getConnInfo(c).remote.address ?? "unknown"
+  } catch {
+    return "unknown"
+  }
+}
+
+export const rateLimit: MiddlewareHandler = async (c, next) => {
+  const key = `${c.req.path}:${clientIp(c)}`
+  const now = Date.now()
+  const entry = hits.get(key)
+
+  if (!entry || entry.resetAt < now) {
+    hits.set(key, { count: 1, resetAt: now + WINDOW_MS })
+  } else if (entry.count >= MAX_REQUESTS) {
+    return c.json({ error: "Too many requests, try again later" }, 429)
+  } else {
+    entry.count++
+  }
+
+  await next()
+}

package/template/backend/src/shared/middlewares/require-auth.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from "vitest"
+import { Hono } from "hono"
+import { SignJWT } from "jose"
+import { requireAuth } from "./require-auth.js"
+import type { AuthVariables } from "./require-auth.js"
+import { env } from "../../config/env.js"
+
+const secret = new TextEncoder().encode(env.JWT_SECRET)
+
+const signTestToken = (payload: Record<string, unknown>, expiresIn = "15m") =>
+  new SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setExpirationTime(expiresIn).sign(secret)
+
+function buildApp() {
+  const app = new Hono<{ Variables: AuthVariables }>()
+  app.use("/protected", requireAuth)
+  app.get("/protected", (c) => c.json({ user: c.get("user") }))
+  return app
+}
+
+describe("requireAuth", () => {
+  it("returns 401 when no access_token cookie is present", async () => {
+    const res = await buildApp().request("/protected")
+    expect(res.status).toBe(401)
+  })
+
+  it("returns 401 when the token is garbage", async () => {
+    const res = await buildApp().request("/protected", {
+      headers: { Cookie: "access_token=not-a-real-token" },
+    })
+    expect(res.status).toBe(401)
+  })
+
+  it("returns 401 when the token is expired", async () => {
+    const expired = await signTestToken({ sub: "user-1", email: "a@b.com" }, "-1s")
+    const res = await buildApp().request("/protected", {
+      headers: { Cookie: `access_token=${expired}` },
+    })
+    expect(res.status).toBe(401)
+  })
+
+  it("calls next() and exposes the payload when the token is valid", async () => {
+    const token = await signTestToken({ sub: "user-1", email: "a@b.com" })
+    const res = await buildApp().request("/protected", {
+      headers: { Cookie: `access_token=${token}` },
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.user.sub).toBe("user-1")
+    expect(body.user.email).toBe("a@b.com")
+  })
+})