Initial import of verae-middleware from zapier monorepo

test/unit/tokens.test.js

@@ -0,0 +1,55 @@
+/**
+ * GATE 4 — Token tests
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  issueSessionToken,
+  parseSessionToken,
+  generateApiKey,
+  isApiKey,
+  extractBearerToken,
+} from '../../src/lib/tokens.js';
+import { config } from '../../src/config.js';
+
+describe('tokens', () => {
+  it('issues and parses session tokens', () => {
+    const token = issueSessionToken({
+      tenantId: 't1',
+      veraeToken: 'mock-jwt-user',
+      expiresAt: '2099-01-01T00:00:00Z',
+    });
+    assert.ok(token.startsWith('zmt_'));
+    const parsed = parseSessionToken(token);
+    assert.equal(parsed.tenantId, 't1');
+    assert.equal(parsed.veraeToken, 'mock-jwt-user');
+  });
+
+  it('rejects forged session tokens', () => {
+    const token = issueSessionToken({
+      tenantId: 't1',
+      veraeToken: 'secret',
+    });
+    const forged = token.slice(0, -4) + 'xxxx';
+    assert.equal(parseSessionToken(forged), null);
+  });
+
+  it('rejects tokens signed with wrong secret', () => {
+    const token = issueSessionToken({
+      tenantId: 't1',
+      veraeToken: 'secret',
+    });
+    const original = config.tokenSecret;
+    config.tokenSecret = 'other-secret';
+    assert.equal(parseSessionToken(token), null);
+    config.tokenSecret = original;
+  });
+
+  it('generates api keys and extracts bearer', () => {
+    const key = generateApiKey();
+    assert.ok(isApiKey(key));
+    assert.equal(extractBearerToken(`Bearer ${key}`), key);
+    assert.equal(extractBearerToken(undefined), null);
+  });
+});