release: WRNexusJS 0.5.0

packages/captcha/test/middleware.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { createContext, type Context } from "@wrnexus/core";
-import { captchaPageGate } from "../src/middleware.ts";
+import { captchaGuard, captchaPageGate } from "../src/middleware.ts";
 import type { CaptchaEngine } from "../src/types.ts";
 
 function fakeEngine(): CaptchaEngine {
@@ -54,6 +54,61 @@ function sessionFixture() {
   };
 }
 
+describe("CAPTCHA request guard", () => {
+  test("reuses an action-bound verified session grant for retryable requests", async () => {
+    const session = sessionFixture();
+    const guard = captchaGuard({
+      action: "auth-login",
+      engine: fakeEngine(),
+      verifiedForMs: 5 * 60_000,
+    });
+    const firstRequest = new Request("https://example.test/api/auth/login", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ "wrn-captcha-response": "verified-token" }),
+    });
+    const firstContext: Context = {
+      ...createContext(firstRequest, new URL(firstRequest.url)),
+      session,
+      ip: "127.0.0.1",
+    };
+    const first = await guard(
+      firstContext,
+      () => new Response("credentials-invalid", { status: 401 }),
+    );
+    expect(first.status).toBe(401);
+
+    const retryRequest = new Request("https://example.test/api/auth/login", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({}),
+    });
+    const retryContext: Context = {
+      ...createContext(retryRequest, new URL(retryRequest.url)),
+      session,
+      ip: "127.0.0.1",
+    };
+    const retry = await guard(retryContext, () => new Response("retry-allowed"));
+
+    expect(await retry.text()).toBe("retry-allowed");
+    expect(retryContext.locals.captcha).toMatchObject({
+      success: true,
+      action: "auth-login",
+    });
+    expect(retryContext.locals.captchaVerified).toBe(true);
+  });
+
+  test("rejects invalid verified-session durations", () => {
+    expect(() =>
+      captchaGuard({
+        action: "auth-login",
+        engine: fakeEngine(),
+        verifiedForMs: Number.NaN,
+      }),
+    ).toThrow("verifiedForMs");
+  });
+});
+
 describe("CAPTCHA page gate", () => {
   test("accepts a verified form token and grants the protected route", async () => {
     const session = sessionFixture();