Тестування автентифікації

export interface AuthenticatedUser {
  id: string;
  email: string;
}

export interface AuthTokens {
  accessToken: string;
  refreshToken: string;
}

export interface UsersService {
  findByEmail(email: string): Promise<{
    id: string;
    email: string;
    passwordHash: string;
  } | null>;

  findById(id: string): Promise<AuthenticatedUser | null>;
}

export interface AuthServiceContract {
  validateUser(
    email: string,
    password: string,
  ): Promise<AuthenticatedUser>;

  login(user: AuthenticatedUser): Promise<AuthTokens>;

  refresh(refreshToken: string): Promise<AuthTokens>;
}

POST /auth/login
    └── перевірка email і пароля
        └── створення access token і refresh token

GET /users/me
    └── JwtAuthGuard
        └── перевірка access token
            └── передавання user у request

POST /auth/refresh
    └── перевірка refresh token
        └── створення нових токенів

import { UnauthorizedException } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';
import { Test, TestingModule } from '@nestjs/testing';
import * as bcrypt from 'bcrypt';

import { AuthService } from './auth.service';
import { UsersService } from '../users/users.service';

describe('AuthService', () => {
  let authService: AuthService;

  const usersService = {
    findByEmail: jest.fn(),
    findById: jest.fn(),
  };

  const jwtService = {
    signAsync: jest.fn(),
    verifyAsync: jest.fn(),
  };

  beforeEach(async () => {
    jest.clearAllMocks();

    const module: TestingModule = await Test.createTestingModule({
      providers: [
        AuthService,
        {
          provide: UsersService,
          useValue: usersService,
        },
        {
          provide: JwtService,
          useValue: jwtService,
        },
      ],
    }).compile();

    authService = module.get(AuthService);
  });

  describe('validateUser', () => {
    it('повертає користувача для правильного пароля', async () => {
      usersService.findByEmail.mockResolvedValue({
        id: 'user-1',
        email: 'anna@example.com',
        passwordHash: 'hashed-password',
      });

      jest.spyOn(bcrypt, 'compare').mockResolvedValue(true as never);

      await expect(
        authService.validateUser('anna@example.com', 'correct-password'),
      ).resolves.toEqual({
        id: 'user-1',
        email: 'anna@example.com',
      });

      expect(usersService.findByEmail).toHaveBeenCalledWith(
        'anna@example.com',
      );
      expect(bcrypt.compare).toHaveBeenCalledWith(
        'correct-password',
        'hashed-password',
      );
    });

    it('викидає 401 для невідомого користувача', async () => {
      usersService.findByEmail.mockResolvedValue(null);

      await expect(
        authService.validateUser('unknown@example.com', 'password'),
      ).rejects.toBeInstanceOf(UnauthorizedException);

      expect(bcrypt.compare).not.toHaveBeenCalled();
    });

    it('викидає 401 для неправильного пароля', async () => {
      usersService.findByEmail.mockResolvedValue({
        id: 'user-1',
        email: 'anna@example.com',
        passwordHash: 'hashed-password',
      });

      jest.spyOn(bcrypt, 'compare').mockResolvedValue(false as never);

      await expect(
        authService.validateUser('anna@example.com', 'wrong-password'),
      ).rejects.toBeInstanceOf(UnauthorizedException);
    });
  });

  describe('login', () => {
    it('створює access і refresh токени', async () => {
      jwtService.signAsync
        .mockResolvedValueOnce('access-token')
        .mockResolvedValueOnce('refresh-token');

      const user = {
        id: 'user-1',
        email: 'anna@example.com',
      };

      await expect(authService.login(user)).resolves.toEqual({
        accessToken: 'access-token',
        refreshToken: 'refresh-token',
      });

      expect(jwtService.signAsync).toHaveBeenNthCalledWith(
        1,
        {
          sub: 'user-1',
          email: 'anna@example.com',
          type: 'access',
        },
        expect.any(Object),
      );

      expect(jwtService.signAsync).toHaveBeenNthCalledWith(
        2,
        {
          sub: 'user-1',
          type: 'refresh',
        },
        expect.any(Object),
      );
    });
  });

  describe('refresh', () => {
    it('видає нові токени для дійсного refresh token', async () => {
      jwtService.verifyAsync.mockResolvedValue({
        sub: 'user-1',
        type: 'refresh',
      });

      usersService.findById.mockResolvedValue({
        id: 'user-1',
        email: 'anna@example.com',
      });

      jwtService.signAsync
        .mockResolvedValueOnce('new-access-token')
        .mockResolvedValueOnce('new-refresh-token');

      await expect(
        authService.refresh('valid-refresh-token'),
      ).resolves.toEqual({
        accessToken: 'new-access-token',
        refreshToken: 'new-refresh-token',
      });

      expect(jwtService.verifyAsync).toHaveBeenCalledWith(
        'valid-refresh-token',
        expect.any(Object),
      );
    });

    it('відхиляє access token, переданий замість refresh token', async () => {
      jwtService.verifyAsync.mockResolvedValue({
        sub: 'user-1',
        type: 'access',
      });

      await expect(
        authService.refresh('access-token'),
      ).rejects.toBeInstanceOf(UnauthorizedException);

      expect(jwtService.signAsync).not.toHaveBeenCalled();
    });

    it('відхиляє пошкоджений або прострочений refresh token', async () => {
      jwtService.verifyAsync.mockRejectedValue(new Error('invalid token'));

      await expect(
        authService.refresh('broken-token'),
      ).rejects.toBeInstanceOf(UnauthorizedException);

      expect(usersService.findById).not.toHaveBeenCalled();
    });

    it('відхиляє refresh token для видаленого користувача', async () => {
      jwtService.verifyAsync.mockResolvedValue({
        sub: 'deleted-user',
        type: 'refresh',
      });

      usersService.findById.mockResolvedValue(null);

      await expect(
        authService.refresh('valid-but-orphaned-token'),
      ).rejects.toBeInstanceOf(UnauthorizedException);
    });
  });
});

expect(jwtService.signAsync).toHaveBeenCalledWith(
  expect.objectContaining({
    sub: 'user-1',
    type: 'access',
  }),
  expect.objectContaining({
    expiresIn: '15m',
  }),
);

expect(result.accessToken).toBe(
  'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
);

const payload = await jwtService.verifyAsync(result.accessToken);

expect(payload).toEqual(
  expect.objectContaining({
    sub: 'user-1',
    type: 'access',
  }),
);

import {
  Body,
  Controller,
  Post,
  Req,
  UseGuards,
} from '@nestjs/common';
import { Request } from 'express';

import { AuthService } from './auth.service';
import { JwtAuthGuard } from './jwt-auth.guard';

@Controller('auth')
export class AuthController {
  constructor(private readonly authService: AuthService) {}

  @Post('login')
  async login(@Body() body: { email: string; password: string }) {
    const user = await this.authService.validateUser(
      body.email,
      body.password,
    );

    return this.authService.login(user);
  }

  @Post('refresh')
  async refresh(@Body() body: { refreshToken: string }) {
    return this.authService.refresh(body.refreshToken);
  }

  @Post('check')
  @UseGuards(JwtAuthGuard)
  check(@Req() request: Request) {
    return {
      user: request.user,
    };
  }
}

import { INestApplication } from '@nestjs/common';
import { Test, TestingModule } from '@nestjs/testing';
import * as request from 'supertest';

import { AppModule } from '../src/app.module';

describe('Authentication (e2e)', () => {
  let app: INestApplication;

  beforeAll(async () => {
    const moduleFixture: TestingModule = await Test.createTestingModule({
      imports: [AppModule],
    }).compile();

    app = moduleFixture.createNestApplication();
    await app.init();
  });

  afterAll(async () => {
    await app.close();
  });

  it('логін повертає access і refresh токени', async () => {
    const response = await request(app.getHttpServer())
      .post('/auth/login')
      .send({
        email: 'anna@example.com',
        password: 'correct-password',
      })
      .expect(201);

    expect(response.body).toEqual({
      accessToken: expect.any(String),
      refreshToken: expect.any(String),
    });

    expect(response.body.accessToken.length).toBeGreaterThan(20);
    expect(response.body.refreshToken.length).toBeGreaterThan(20);
  });

  it('логін повертає 401 для неправильного пароля', async () => {
    const response = await request(app.getHttpServer())
      .post('/auth/login')
      .send({
        email: 'anna@example.com',
        password: 'wrong-password',
      })
      .expect(401);

    expect(response.body).toEqual(
      expect.objectContaining({
        statusCode: 401,
      }),
    );
  });

  it('логін повертає 401 для невідомого email', async () => {
    await request(app.getHttpServer())
      .post('/auth/login')
      .send({
        email: 'missing@example.com',
        password: 'correct-password',
      })
      .expect(401);
  });

  it('refresh повертає нову пару токенів', async () => {
    const loginResponse = await request(app.getHttpServer())
      .post('/auth/login')
      .send({
        email: 'anna@example.com',
        password: 'correct-password',
      })
      .expect(201);

    const oldRefreshToken = loginResponse.body.refreshToken;

    const refreshResponse = await request(app.getHttpServer())
      .post('/auth/refresh')
      .send({
        refreshToken: oldRefreshToken,
      })
      .expect(201);

    expect(refreshResponse.body).toEqual({
      accessToken: expect.any(String),
      refreshToken: expect.any(String),
    });

    expect(refreshResponse.body.accessToken).not.toBe(
      loginResponse.body.accessToken,
    );
  });

  it('refresh повертає 401 для пошкодженого токена', async () => {
    await request(app.getHttpServer())
      .post('/auth/refresh')
      .send({
        refreshToken: 'not-a-jwt',
      })
      .expect(401);
  });
});

describe('protected route', () => {
  it('повертає 401 без access token', async () => {
    await request(app.getHttpServer())
      .post('/auth/check')
      .expect(401);
  });

  it('повертає 401 для пошкодженого access token', async () => {
    await request(app.getHttpServer())
      .post('/auth/check')
      .set('Authorization', 'Bearer broken-token')
      .expect(401);
  });

  it('дозволяє доступ із дійсним access token', async () => {
    const loginResponse = await request(app.getHttpServer())
      .post('/auth/login')
      .send({
        email: 'anna@example.com',
        password: 'correct-password',
      })
      .expect(201);

    const accessToken = loginResponse.body.accessToken;

    const response = await request(app.getHttpServer())
      .post('/auth/check')
      .set('Authorization', `Bearer ${accessToken}`)
      .expect(201);

    expect(response.body.user).toEqual(
      expect.objectContaining({
        id: 'user-1',
        email: 'anna@example.com',
      }),
    );
  });

  it('не приймає refresh token для захищеного маршруту', async () => {
    const loginResponse = await request(app.getHttpServer())
      .post('/auth/login')
      .send({
        email: 'anna@example.com',
        password: 'correct-password',
      })
      .expect(201);

    await request(app.getHttpServer())
      .post('/auth/check')
      .set(
        'Authorization',
        `Bearer ${loginResponse.body.refreshToken}`,
      )
      .expect(401);
  });
});

it('відхиляє повторне використання старого refresh token', async () => {
  const loginResponse = await request(app.getHttpServer())
    .post('/auth/login')
    .send({
      email: 'anna@example.com',
      password: 'correct-password',
    })
    .expect(201);

  const oldRefreshToken = loginResponse.body.refreshToken;

  await request(app.getHttpServer())
    .post('/auth/refresh')
    .send({
      refreshToken: oldRefreshToken,
    })
    .expect(201);

  await request(app.getHttpServer())
    .post('/auth/refresh')
    .send({
      refreshToken: oldRefreshToken,
    })
    .expect(401);
});

{
  "statusCode": 401,
  "message": "Unauthorized"
}

it('повертає стандартизовану помилку для неправильних даних', async () => {
  const response = await request(app.getHttpServer())
    .post('/auth/login')
    .send({
      email: 'anna@example.com',
      password: 'wrong-password',
    })
    .expect(401);

  expect(response.body.statusCode).toBe(401);
  expect(response.body.message).toBeDefined();
});

beforeAll(async () => {
  await usersRepository.deleteAll();

  await usersRepository.create({
    id: 'user-1',
    email: 'anna@example.com',
    passwordHash: await bcrypt.hash('correct-password', 10),
  });
});

import { JwtService } from '@nestjs/jwt';

describe('JWT expiration', () => {
  let jwtService: JwtService;

  beforeEach(() => {
    jest.useFakeTimers();
    jest.setSystemTime(new Date('2026-01-01T12:00:00.000Z'));

    jwtService = new JwtService({
      secret: 'test-secret',
    });
  });

  afterEach(() => {
    jest.useRealTimers();
  });

  it('відхиляє токен після завершення терміну дії', async () => {
    const token = await jwtService.signAsync(
      {
        sub: 'user-1',
        type: 'access',
      },
      {
        expiresIn: '1s',
      },
    );

    jest.setSystemTime(new Date('2026-01-01T12:00:02.000Z'));

    await expect(jwtService.verifyAsync(token)).rejects.toThrow();
  });
});

it('відхиляє login без email', async () => {
  await request(app.getHttpServer())
    .post('/auth/login')
    .send({
      password: 'correct-password',
    })
    .expect(400);
});

it('відхиляє login із некоректним email', async () => {
  await request(app.getHttpServer())
    .post('/auth/login')
    .send({
      email: 'not-an-email',
      password: 'correct-password',
    })
    .expect(400);
});

it('відхиляє refresh без refresh token', async () => {
  await request(app.getHttpServer())
    .post('/auth/refresh')
    .send({})
    .expect(400);
});