create-tigra 3.0.2 → 3.0.5

package/template/server/src/modules/auth/__tests__/auth.integration.test.ts

@@ -0,0 +1,138 @@
+/**
+ * Money-path integration test — auth flow against REAL containers.
+ *
+ * No payments module exists in the scaffold, so the auth flow (register → login →
+ * authenticated read) is the money-adjacent critical path. This drives the REAL
+ * Fastify app via `app.inject()` against a real MySQL 8 + Redis booted by
+ * `src/test/integration.setup.ts`.
+ *
+ * Env-before-import: `@/app` (which pulls `env.ts` + prisma) is imported LAZILY
+ * inside `beforeAll`, AFTER the setup file has populated process.env with the
+ * container URLs. See integration.setup.ts for the full rationale.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import type { FastifyInstance } from 'fastify';
+
+let app: FastifyInstance;
+
+/**
+ * Pull the `access_token` cookie value out of a set-cookie header array.
+ * The login/register controllers set `access_token`, `refresh_token`, and a
+ * non-httpOnly `auth_session` indicator (see src/libs/cookies.ts).
+ */
+function extractCookie(setCookie: string[] | string | undefined, name: string): string | undefined {
+  const headers = Array.isArray(setCookie) ? setCookie : setCookie ? [setCookie] : [];
+  for (const header of headers) {
+    const first = header.split(';')[0];
+    const eq = first.indexOf('=');
+    if (eq === -1) continue;
+    if (first.slice(0, eq).trim() === name) {
+      return first.slice(eq + 1).trim();
+    }
+  }
+  return undefined;
+}
+
+const validUser = {
+  email: 'moneypath@example.com',
+  password: 'Password123!',
+  firstName: 'Money',
+  lastName: 'Path',
+};
+
+beforeAll(async () => {
+  // LAZY import — env is now populated by integration.setup.ts.
+  const { buildApp } = await import('@/app.js');
+  app = await buildApp();
+  await app.ready();
+});
+
+afterAll(async () => {
+  await app?.close();
+});
+
+describe('auth money-path (real containers)', () => {
+  let accessCookie: string | undefined;
+
+  it('POST /api/v1/auth/register with a valid body succeeds (201) and returns the user', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/register',
+      payload: validUser,
+    });
+
+    expect(res.statusCode).toBe(201);
+    const body = res.json();
+    expect(body.success).toBe(true);
+    expect(body.data.user.email).toBe(validUser.email);
+    expect(body.data.user.role).toBe('USER');
+    // Password must never be echoed back.
+    expect(body.data.user.password).toBeUndefined();
+  });
+
+  it('POST /api/v1/auth/register with an INVALID body is rejected (400, Zod validation)', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/register',
+      payload: { email: 'not-an-email', password: 'short', firstName: 'A', lastName: '' },
+    });
+
+    // fastify-type-provider-zod surfaces body validation as a Fastify
+    // validation error → the app's error handler maps it to 400 BAD_REQUEST.
+    expect(res.statusCode).toBe(400);
+  });
+
+  it('POST /api/v1/auth/login with valid credentials succeeds and sets an access_token cookie', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/login',
+      payload: { email: validUser.email, password: validUser.password },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.success).toBe(true);
+    expect(body.data.user.email).toBe(validUser.email);
+
+    const setCookie = res.headers['set-cookie'];
+    accessCookie = extractCookie(setCookie, 'access_token');
+    expect(accessCookie, 'login must set an access_token cookie').toBeTruthy();
+    // The refresh cookie is also set (path-scoped to /api/v1/auth).
+    expect(extractCookie(setCookie, 'refresh_token')).toBeTruthy();
+  });
+
+  it('POST /api/v1/auth/login with a wrong password fails (401)', async () => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/login',
+      payload: { email: validUser.email, password: 'WrongPassword123!' },
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('GET /api/v1/auth/me WITHOUT the cookie is rejected (401)', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: '/api/v1/auth/me',
+    });
+
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('GET /api/v1/auth/me WITH the access_token cookie returns 200 and the right user', async () => {
+    expect(accessCookie, 'login test must have captured the cookie first').toBeTruthy();
+
+    const res = await app.inject({
+      method: 'GET',
+      url: '/api/v1/auth/me',
+      cookies: { access_token: accessCookie! },
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.success).toBe(true);
+    expect(body.data.email).toBe(validUser.email);
+    expect(body.data.role).toBe('USER');
+  });
+});

package/template/server/src/modules/auth/__tests__/auth.service.test.ts

@@ -137,6 +137,9 @@ describe('Auth Service', () => {
 
       // Act & Assert
       await expect(authService.register(validRegisterInput)).rejects.toThrow(ConflictError);
+      await expect(authService.register(validRegisterInput)).rejects.toThrow(
+        'An account with this email was recently deleted and cannot be registered yet.',
+      );
       expect(authRepo.createUser).not.toHaveBeenCalled();
     });
   });
@@ -193,12 +196,33 @@ describe('Auth Service', () => {
     it('should throw UnauthorizedError if user not found', async () => {
       // Arrange
       vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
-      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue(null);
 
       // Act & Assert
       await expect(authService.login(validLoginInput)).rejects.toThrow(UnauthorizedError);
       await expect(authService.login(validLoginInput)).rejects.toThrow('Invalid email or password');
+      expect(authRepo.findDeletedUserByEmail).not.toHaveBeenCalled();
+      expect(verifyPassword).not.toHaveBeenCalled();
+    });
+
+    it('should not restore or authenticate a soft-deleted account with correct credentials', async () => {
+      // findUserByEmail excludes soft-deleted records, so login must stop before
+      // password verification, token creation, or session creation.
+      vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
+      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue({
+        ...testUsers.validUser,
+        deletedAt: new Date('2024-02-01T00:00:00Z'),
+        isActive: false,
+      });
+      vi.mocked(verifyPassword).mockResolvedValue(true);
+
+      await expect(authService.login(validLoginInput)).rejects.toThrow(UnauthorizedError);
+      await expect(authService.login(validLoginInput)).rejects.toThrow('Invalid email or password');
+      expect(authRepo.findDeletedUserByEmail).not.toHaveBeenCalled();
       expect(verifyPassword).not.toHaveBeenCalled();
+      expect(authLib.signAccessToken).not.toHaveBeenCalled();
+      expect(authLib.generateRefreshToken).not.toHaveBeenCalled();
+      expect(sessionRepository.createSession).not.toHaveBeenCalled();
+      expect(authRepo.createRefreshToken).not.toHaveBeenCalled();
     });
 
     it('should throw ForbiddenError if account is not activated', async () => {
@@ -325,46 +349,6 @@ describe('Auth Service', () => {
     });
   });
 
-  describe('login — soft-deleted account restore path (lockout)', () => {
-    const loginInput = { email: 'test@example.com', password: 'WrongPassword!' };
-    const attackerIp = '203.0.113.7';
-    const softDeletedUser = {
-      ...testUsers.validUser,
-      deletedAt: new Date('2024-02-01T00:00:00Z'),
-      isActive: false,
-    };
-
-    it('should record a failed attempt against the email+IP pair on wrong password for a soft-deleted account', async () => {
-      // Arrange
-      vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
-      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue(softDeletedUser);
-      vi.mocked(verifyPassword).mockResolvedValue(false);
-      mockRedis.incr.mockResolvedValue(3); // below the first lockout threshold
-
-      // Act & Assert
-      await expect(authService.login(loginInput, 'test-agent', attackerIp)).rejects.toThrow(
-        'Invalid email or password',
-      );
-      expect(mockRedis.incr).toHaveBeenCalledWith(`login-fail:test@example.com:${attackerIp}`);
-      expect(authRepo.restoreUser).not.toHaveBeenCalled();
-    });
-
-    it('should reject a locked email+IP pair on the soft-delete path before verifying the password', async () => {
-      // Arrange
-      vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
-      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue(softDeletedUser);
-      mockRedis.exists.mockResolvedValue(1); // lock key present for this pair
-
-      // Act & Assert
-      await expect(authService.login(loginInput, 'test-agent', attackerIp)).rejects.toThrow(
-        'Invalid email or password',
-      );
-      expect(mockRedis.exists).toHaveBeenCalledWith(`login-lock:test@example.com:${attackerIp}`);
-      expect(verifyPassword).not.toHaveBeenCalled();
-      expect(authRepo.restoreUser).not.toHaveBeenCalled();
-    });
-  });
-
   describe('refresh', () => {
     const validRefreshToken = 'valid-refresh-token';
 

package/template/server/src/modules/auth/auth.repo.ts

@@ -13,18 +13,6 @@ export async function findDeletedUserByEmail(email: string): Promise<User | null
   });
 }
 
-export async function restoreUser(userId: string): Promise<void> {
-  await prisma.user.update({
-    where: { id: userId },
-    data: {
-      deletedAt: null,
-      isActive: true,
-      failedLoginAttempts: 0,
-      lockedUntil: null,
-    },
-  });
-}
-
 export async function findUserById(id: string): Promise<User | null> {
   return prisma.user.findUnique({
     where: { id, deletedAt: null },

package/template/server/src/modules/auth/auth.service.ts

@@ -157,11 +157,11 @@ export async function register(
     throw new ConflictError('Email already registered', 'EMAIL_ALREADY_EXISTS');
   }
 
-  // Check if a soft-deleted account exists with this email — direct them to login to restore
+  // Keep the email reserved while the soft-deleted account is retained.
   const deletedUser = await authRepo.findDeletedUserByEmail(input.email);
   if (deletedUser) {
     throw new ConflictError(
-      'An account with this email was recently deleted. Log in to restore it.',
+      'An account with this email was recently deleted and cannot be registered yet.',
       'EMAIL_ALREADY_EXISTS',
     );
   }
@@ -219,68 +219,40 @@ export async function login(
   deviceInfo?: string,
   ipAddress?: string,
 ): Promise<AuthResult> {
-  let user = await authRepo.findUserByEmail(input.email);
-
-  // If no active user found, check for a soft-deleted account that can be restored
+  const user = await authRepo.findUserByEmail(input.email);
   if (!user) {
-    const deletedUser = await authRepo.findDeletedUserByEmail(input.email);
-    if (!deletedUser) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
-
-    // Same email+IP lockout as the normal path — the restore flow must not be
-    // a brute-force side door around the lockout.
-    if (await isLoginLocked(input.email, ipAddress)) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
-
-    // Verify password before restoring — don't restore on wrong password
-    const validPassword = await verifyPassword(input.password, deletedUser.password);
-    if (!validPassword) {
-      await recordFailedLogin(input.email, ipAddress);
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
-
-    // Successful restore-login — clear the email+IP failure counter, same as
-    // the normal path.
-    await clearFailedLogins(input.email, ipAddress);
-
-    // Restore account: clears deletedAt, sets isActive = true, resets lockout
-    await authRepo.restoreUser(deletedUser.id);
-    user = { ...deletedUser, deletedAt: null, isActive: true, failedLoginAttempts: 0, lockedUntil: null };
-  } else {
-    // Normal login flow for active accounts
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    // Distinct error for inactive accounts so the client can show proper messaging
-    if (!user.isActive) {
-      throw new ForbiddenError('Account is not activated. Please verify your account.', 'ACCOUNT_NOT_ACTIVE');
-    }
+  // Distinct error for inactive accounts so the client can show proper messaging
+  if (!user.isActive) {
+    throw new ForbiddenError('Account is not activated. Please verify your account.', 'ACCOUNT_NOT_ACTIVE');
+  }
 
-    // Check account lockout — scoped to this email+IP pair (Redis), so an
-    // attacker spamming bad passwords only locks out their OWN address and
-    // cannot remotely lock the real user out (lockout DoS).
-    if (await isLoginLocked(input.email, ipAddress)) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
+  // Check account lockout — scoped to this email+IP pair (Redis), so an
+  // attacker spamming bad passwords only locks out their OWN address and
+  // cannot remotely lock the real user out (lockout DoS).
+  if (await isLoginLocked(input.email, ipAddress)) {
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    // DB-level lock (legacy data or manual admin lock) is still honored.
-    if (user.lockedUntil && user.lockedUntil > new Date()) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
+  // DB-level lock (legacy data or manual admin lock) is still honored.
+  if (user.lockedUntil && user.lockedUntil > new Date()) {
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    const valid = await verifyPassword(input.password, user.password);
+  const valid = await verifyPassword(input.password, user.password);
 
-    if (!valid) {
-      await recordFailedLogin(input.email, ipAddress);
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
+  if (!valid) {
+    await recordFailedLogin(input.email, ipAddress);
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    // Successful login — clear the email+IP failure counter and any stale
-    // DB-level lockout state from before lockout moved to Redis.
-    await clearFailedLogins(input.email, ipAddress);
-    if (user.failedLoginAttempts > 0 || user.lockedUntil) {
-      await authRepo.resetFailedAttempts(user.id);
-    }
+  // Successful login — clear the email+IP failure counter and any stale
+  // DB-level lockout state from before lockout moved to Redis.
+  await clearFailedLogins(input.email, ipAddress);
+  if (user.failedLoginAttempts > 0 || user.lockedUntil) {
+    await authRepo.resetFailedAttempts(user.id);
   }
 
   const accessToken = signAccessToken({

package/template/server/src/modules/files/__tests__/files.integration.test.ts

@@ -0,0 +1,157 @@
+/**
+ * Files-route integration test — the load-bearing proof that the two-tier
+ * upload split (P0-2) closes the @fastify/static over-exposure.
+ *
+ * Drives the REAL Fastify app via `app.inject()` against the MySQL 8 + Redis
+ * booted by `src/test/integration.setup.ts`. The setup file points
+ * UPLOAD_PUBLIC_DIR / UPLOAD_PRIVATE_DIR at isolated temp dirs (exported via
+ * `containerInfo`) BEFORE env.ts is evaluated, so this test controls the files
+ * on disk and asserts exactly what is and isn't reachable.
+ *
+ * What this proves:
+ *   1. PUBLIC static still works WITHOUT auth (avatar URL shape unchanged).
+ *   2. EXPOSURE CLOSED — a file in the PRIVATE tier is NOT reachable via the
+ *      static /uploads/... path (404).
+ *   3. The auth-gated route: 401 without a cookie, 200 + bytes with one, 206 +
+ *      Content-Range for a Range request, 404 for a traversal attempt.
+ *
+ * Env-before-import: `@/app` is imported LAZILY inside `beforeAll`, after the
+ * setup file has populated process.env. See integration.setup.ts.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import type { FastifyInstance } from 'fastify';
+import { containerInfo } from '@/test/integration.setup.js';
+
+let app: FastifyInstance;
+
+/** Pull a named cookie value out of a set-cookie header array. */
+function extractCookie(setCookie: string[] | string | undefined, name: string): string | undefined {
+  const headers = Array.isArray(setCookie) ? setCookie : setCookie ? [setCookie] : [];
+  for (const header of headers) {
+    const first = header.split(';')[0];
+    const eq = first.indexOf('=');
+    if (eq === -1) continue;
+    if (first.slice(0, eq).trim() === name) {
+      return first.slice(eq + 1).trim();
+    }
+  }
+  return undefined;
+}
+
+const filesUser = {
+  email: 'files-route@example.com',
+  password: 'Password123!',
+  firstName: 'Files',
+  lastName: 'Route',
+};
+
+let accessCookie: string;
+let userId: string;
+
+const PRIVATE_BODY = 'the-quick-brown-fox-private-bytes';
+
+beforeAll(async () => {
+  const { buildApp } = await import('@/app.js');
+  app = await buildApp();
+  await app.ready();
+
+  // Register + login to mint an authed cookie and learn the user id.
+  const reg = await app.inject({ method: 'POST', url: '/api/v1/auth/register', payload: filesUser });
+  expect(reg.statusCode).toBe(201);
+  userId = reg.json().data.user.id as string;
+  expect(userId).toBeTruthy();
+
+  const login = await app.inject({
+    method: 'POST',
+    url: '/api/v1/auth/login',
+    payload: { email: filesUser.email, password: filesUser.password },
+  });
+  expect(login.statusCode).toBe(200);
+  const cookie = extractCookie(login.headers['set-cookie'], 'access_token');
+  expect(cookie, 'login must set an access_token cookie').toBeTruthy();
+  accessCookie = cookie!;
+
+  // --- Seed fixtures directly on disk, in the temp tiers the app reads. ---
+  // PUBLIC avatar (served statically, no auth).
+  const publicAvatarDir = path.join(containerInfo.uploadPublicDir, 'users', userId, 'avatar');
+  await fs.mkdir(publicAvatarDir, { recursive: true });
+  await fs.writeFile(path.join(publicAvatarDir, 'x.webp'), Buffer.from('PUBLIC-AVATAR-BYTES'));
+
+  // PRIVATE file (auth-gated route only).
+  const privateUserDir = path.join(containerInfo.uploadPrivateDir, 'users', userId);
+  await fs.mkdir(privateUserDir, { recursive: true });
+  await fs.writeFile(path.join(privateUserDir, 'doc.txt'), Buffer.from(PRIVATE_BODY));
+
+  // A SECRET file in the private tier, addressable only via traversal from the
+  // static root — used to prove the static mount cannot reach the private tier.
+  await fs.writeFile(path.join(containerInfo.uploadPrivateDir, 'secret.txt'), Buffer.from('TOP-SECRET'));
+});
+
+afterAll(async () => {
+  await app?.close();
+});
+
+describe('files two-tier uploads (real containers)', () => {
+  it('PUBLIC: GET /uploads/users/{id}/avatar/x.webp WITHOUT auth → 200 (static still served)', async () => {
+    const res = await app.inject({ method: 'GET', url: `/uploads/users/${userId}/avatar/x.webp` });
+    expect(res.statusCode).toBe(200);
+    expect(res.body).toContain('PUBLIC-AVATAR-BYTES');
+  });
+
+  it('EXPOSURE CLOSED: a PRIVATE-tier file is NOT reachable via /uploads/... (404)', async () => {
+    // Direct static path into the private tier does not exist under the public
+    // root, and traversal out of the public root is blocked by @fastify/static.
+    const direct = await app.inject({ method: 'GET', url: '/uploads/secret.txt' });
+    expect(direct.statusCode).toBe(404);
+
+    const traversal = await app.inject({
+      method: 'GET',
+      url: '/uploads/..%2f..%2fprivate%2fsecret.txt',
+    });
+    // @fastify/static rejects traversal (404/403); the one thing that must
+    // never happen is a 200 leaking the private bytes.
+    expect(traversal.statusCode).not.toBe(200);
+  });
+
+  it('PRIVATE route WITHOUT auth → 401', async () => {
+    const res = await app.inject({ method: 'GET', url: '/api/v1/files/doc.txt' });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('PRIVATE route WITH auth → 200 and the file bytes', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: '/api/v1/files/doc.txt',
+      cookies: { access_token: accessCookie },
+    });
+    expect(res.statusCode).toBe(200);
+    expect(res.body).toBe(PRIVATE_BODY);
+    expect(res.headers['accept-ranges']).toBe('bytes');
+    expect(res.headers['cache-control']).toBe('private');
+    expect(res.headers['content-type']).toContain('text/plain');
+  });
+
+  it('PRIVATE route with a Range header → 206 + correct Content-Range', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: '/api/v1/files/doc.txt',
+      cookies: { access_token: accessCookie },
+      headers: { range: 'bytes=0-3' },
+    });
+    expect(res.statusCode).toBe(206);
+    expect(res.headers['content-range']).toBe(`bytes 0-3/${PRIVATE_BODY.length}`);
+    expect(res.headers['content-length']).toBe('4');
+    expect(res.body).toBe(PRIVATE_BODY.slice(0, 4));
+  });
+
+  it('PRIVATE route traversal attempt → 404 (no existence leak, not 403)', async () => {
+    const res = await app.inject({
+      method: 'GET',
+      url: '/api/v1/files/..%2f..%2fsecret',
+      cookies: { access_token: accessCookie },
+    });
+    expect(res.statusCode).toBe(404);
+  });
+});