chore: import DH V2 D5.6.4 production baseline

api-v3/test/unit/token.service.test.ts

@@ -0,0 +1,53 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { JwtService } from '@nestjs/jwt';
+import { AuthConfigService } from '../../src/common/config/auth-config.service';
+import { TokenService } from '../../src/auth/services/token.service';
+
+function config(): AuthConfigService {
+  return {
+    accessTokenSecret: 'a'.repeat(64),
+    refreshTokenPepper: 'b'.repeat(64),
+    accessTokenTtlSeconds: 900,
+    refreshTokenTtlSeconds: 604800,
+    maxLoginAttempts: 5,
+    lockoutSeconds: 900,
+    webOrigin: 'https://dhv2.korexlabs.com',
+    accessCookieName: 'dhv2_access',
+    refreshCookieName: 'dhv2_refresh',
+    csrfCookieName: 'dhv2_csrf',
+  } as AuthConfigService;
+}
+
+test('TokenService issues and verifies access tokens', async () => {
+  const service = new TokenService(new JwtService(), config());
+  const token = await service.issueAccessToken({
+    userId: 'b6f6b10e-434a-4d72-9ec9-3520212dd290',
+    sessionId: '1bab61ac-65d1-40e6-816b-63d90131a795',
+    username: 'admin',
+  });
+  const payload = await service.verifyAccessToken(token);
+
+  assert.equal(payload.sub, 'b6f6b10e-434a-4d72-9ec9-3520212dd290');
+  assert.equal(payload.sid, '1bab61ac-65d1-40e6-816b-63d90131a795');
+  assert.equal(payload.typ, 'access');
+});
+
+test('TokenService rotates opaque refresh credentials without storing plaintext', () => {
+  const service = new TokenService(new JwtService(), config());
+  const issued = service.issueRefreshToken();
+
+  assert.deepEqual(service.parseRefreshToken(issued.token), {
+    sessionId: issued.sessionId,
+  });
+  assert.equal(service.verifyRefreshToken(issued.token, issued.tokenHash), true);
+  const replacement = issued.token.endsWith('x') ? 'y' : 'x';
+  assert.equal(
+    service.verifyRefreshToken(
+      `${issued.token.slice(0, -1)}${replacement}`,
+      issued.tokenHash,
+    ),
+    false,
+  );
+  assert.equal(issued.tokenHash.includes(issued.token), false);
+});