Add regression tests for the password utility

apps/api/jest.config.js

@@ -0,0 +1,7 @@
+/** @type {import('jest').Config} */
+module.exports = {
+  preset: "ts-jest",
+  testEnvironment: "node",
+  rootDir: "src",
+  testRegex: ".*\\.spec\\.ts$",
+};

apps/api/package.json

@@ -7,6 +7,7 @@
     "build": "nest build",
     "lint": "eslint \"src/**/*.ts\"",
     "typecheck": "tsc --noEmit",
+    "test": "jest",
     "prisma:generate": "prisma generate",
     "prisma:validate": "prisma validate",
     "prisma:db-push": "prisma db push",
@@ -32,11 +33,14 @@
     "@nestjs/schematics": "^10.2.3",
     "@nestjs/testing": "^10.4.15",
     "@types/express": "^5.0.0",
+    "@types/jest": "^29.5.14",
     "@types/node": "^22.10.2",
     "@typescript-eslint/eslint-plugin": "^8.18.2",
     "@typescript-eslint/parser": "^8.18.2",
     "eslint": "^9.17.0",
+    "jest": "^29.7.0",
     "prisma": "^6.19.3",
+    "ts-jest": "^29.2.5",
     "typescript": "^5.7.2"
   }
 }

apps/api/src/auth/password.util.spec.ts

@@ -0,0 +1,43 @@
+import { hashPassword, verifyPassword } from "./password.util";
+
+describe("password.util", () => {
+  describe("hashPassword", () => {
+    it("produces a scrypt-tagged hash distinct from the raw password", async () => {
+      const hash = await hashPassword("correct horse battery staple");
+
+      expect(hash.startsWith("scrypt:")).toBe(true);
+      expect(hash).not.toContain("correct horse battery staple");
+    });
+
+    it("salts each hash independently, so the same password never hashes the same way twice", async () => {
+      const [first, second] = await Promise.all([
+        hashPassword("correct horse battery staple"),
+        hashPassword("correct horse battery staple"),
+      ]);
+
+      expect(first).not.toBe(second);
+    });
+  });
+
+  describe("verifyPassword", () => {
+    it("accepts the correct password against its own hash", async () => {
+      const hash = await hashPassword("correct horse battery staple");
+
+      await expect(verifyPassword("correct horse battery staple", hash)).resolves.toBe(true);
+    });
+
+    it("rejects an incorrect password", async () => {
+      const hash = await hashPassword("correct horse battery staple");
+
+      await expect(verifyPassword("wrong password", hash)).resolves.toBe(false);
+    });
+
+    it("rejects a hash in an unrecognised format instead of throwing", async () => {
+      await expect(verifyPassword("anything", "not-a-real-hash")).resolves.toBe(false);
+    });
+
+    it("rejects a hash tagged with an algorithm other than scrypt", async () => {
+      await expect(verifyPassword("anything", "md5:salt:deadbeef")).resolves.toBe(false);
+    });
+  });
+});