Squashed 'cms/core/' changes from f709b5d..ac7538f

ac7538f chore: gitignore admin/dist build output
86f9f57 core: stage 7 — auth provider (config.auth: supabase | local), DB-less core

git-subtree-dir: cms/core
git-subtree-split: ac7538fa0c2c883e29fe67c8d8c15c5f40fa2230

api/test/auth-local.test.js

@@ -0,0 +1,67 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { rm, readFile } from 'node:fs/promises';
+
+// Isolated users file + a known secret BEFORE importing the module (it reads env
+// at import time). No Supabase needed — this is the DB-less path.
+const USERS = join(tmpdir(), `cms-users-${process.pid}.json`);
+process.env.USERS_FILE = USERS;
+process.env.JWT_SECRET ||= 'test-secret-xyz';
+
+const local = await import('../src/auth-local.js');
+const { verify } = await import('hono/jwt');
+
+test.after(async () => { await rm(USERS, { force: true }); });
+
+test('create → list → login mints a GoTrue-shaped, verifiable token', async () => {
+  const id = await local.createUser({ email: 'Karim@Example.com', password: 'hunter2', role: 'admin' });
+  assert.ok(id);
+  const list = await local.listUsers(['someone@else.com']);
+  assert.equal(list.length, 1);
+  assert.equal(list[0].email, 'Karim@Example.com');
+  assert.equal(list[0].role, 'admin');
+
+  // wrong password rejected, right password accepted (case-insensitive email)
+  assert.equal(await local.login('karim@example.com', 'nope'), null);
+  const res = await local.login('karim@example.com', 'hunter2');
+  assert.ok(res?.access_token);
+  assert.equal(res.user.email, 'Karim@Example.com');
+
+  const claims = await verify(res.access_token, process.env.JWT_SECRET, 'HS256');
+  assert.equal(claims.sub, id);
+  assert.equal(claims.email, 'Karim@Example.com');
+  assert.equal(claims.app_metadata.role, 'admin'); // same shape auth.js/roleOf read
+  assert.ok(claims.exp > Math.floor(Date.now() / 1000));
+});
+
+test('passwords are bcrypt-hashed at rest (never plaintext)', async () => {
+  const raw = JSON.parse(await readFile(USERS, 'utf8'));
+  assert.match(raw[0].password, /^\$2[aby]\$/); // bcrypt hash prefix
+  assert.notEqual(raw[0].password, 'hunter2');
+});
+
+test('countByRole reflects roles; fixed-admin email forced to admin', async () => {
+  await local.createUser({ email: 'red@x.com', password: 'pw', role: 'editor' });
+  const counts = await local.countByRole([]);
+  assert.equal(counts.total, 2);
+  assert.equal(counts.admin, 1);
+  assert.equal(counts.editor, 1);
+  // an env-admin email overrides the stored role in the listing
+  const forced = await local.listUsers(['red@x.com']);
+  assert.equal(forced.find((u) => u.email === 'red@x.com').role, 'admin');
+});
+
+test('update + delete', async () => {
+  const id = await local.createUser({ email: 'tmp@x.com', password: 'pw' });
+  await local.updateUser(id, { role: 'editor' });
+  assert.equal((await local.listUsers([])).find((u) => u.id === id).role, 'editor');
+  await local.deleteUser(id);
+  assert.equal((await local.listUsers([])).some((u) => u.id === id), false);
+  await assert.rejects(() => local.deleteUser('nope'), /nicht gefunden/);
+});
+
+test('duplicate email rejected', async () => {
+  await assert.rejects(() => local.createUser({ email: 'red@x.com', password: 'pw' }), /existiert bereits/);
+});