Update dependency vue-tsc to v3.3.6

2026-07-01 03:07:25 +00:00
25 changed files with 189 additions and 4641 deletions
@@ -1,42 +0,0 @@
-name: Build Test
-
-on:
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Retrieve Server Install Action
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: Nodarx/action-server-install
-          ref: main
-          path: action-server-install
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install Server
-        uses: ./action-server-install
-        with:
-          install-php: 'false'
-          install-node: 'true'
-          php-version: '8.5'
-          node-version: '24'
-          server-path: './server'
-
-      - name: Checkout Pull Request
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: ${{ github.repository }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: server/modules/authentication_provider_password
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install dependencies
-        run: npm ci
-        working-directory: server/modules/authentication_provider_password
-
-      - name: Build
-        run: npm run build
-        working-directory: server/modules/authentication_provider_password
@@ -1,42 +0,0 @@
-name: JS Unit Tests
-
-on:
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Retrieve Server Install Action
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: Nodarx/action-server-install
-          ref: main
-          path: action-server-install
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install Server
-        uses: ./action-server-install
-        with:
-          install-php: 'false'
-          install-node: 'true'
-          php-version: '8.5'
-          node-version: '24'
-          server-path: './server'
-
-      - name: Checkout Pull Request
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: ${{ github.repository }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: server/modules/authentication_provider_password
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install dependencies
-        run: npm ci
-        working-directory: server/modules/authentication_provider_password
-
-      - name: Run tests
-        run: npm run test:unit
-        working-directory: server/modules/authentication_provider_password
@@ -1,59 +0,0 @@
-name: PHP Integration Tests
-
-on:
-  pull_request:
-  workflow_dispatch:
-
-jobs:
-  test:
-    name: Integration Tests
-    runs-on: ubuntu-latest
-    services:
-      mongo:
-        image: mongo:8
-        options: >-
-          --health-cmd "mongosh --quiet --eval \"db.adminCommand('ping')\""
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 12
-
-    steps:
-      - name: Retrieve Server Install Action
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: Nodarx/action-server-install
-          ref: main
-          path: action-server-install
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install server
-        uses: ./action-server-install
-        with:
-          install-php: 'true'
-          php-version: '8.5'
-          server-path: './server'
-          database-uri: 'mongodb://mongo:27017/?tls=false'
-          database-name: 'ktrix_ci'
-          app-environment: 'test'
-
-      - name: Checkout module under test
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: ${{ github.repository }}
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-          path: server/modules/authentication_provider_password
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install module dependencies
-        run: composer install --prefer-dist --no-progress
-        working-directory: server/modules/authentication_provider_password
-
-      - name: Install and enable module
-        working-directory: server
-        run: |
-          php bin/console module:install authentication_provider_password
-          php bin/console module:enable authentication_provider_password
-
-      - name: Run integration tests
-        working-directory: server/modules/authentication_provider_password
-        run: composer test:integration
@@ -1,42 +0,0 @@
-name: PHP Unit Tests
-
-on:
-  pull_request:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Retrieve Server Install Action
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: Nodarx/action-server-install
-          ref: main
-          path: action-server-install
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install Server
-        uses: ./action-server-install
-        with:
-          install-php: 'true'
-          install-node: 'false'
-          php-version: '8.5'
-          node-version: '24'
-          server-path: './server'
-
-      - name: Checkout Pull Request
-        uses: actions/checkout@v6.0.2
-        with:
-          repository: ${{ github.repository }}
-          ref: ${{ github.event.pull_request.head.sha }}
-          path: server/modules/authentication_provider_password
-          github-server-url: https://git.ktrix.dev
-
-      - name: Install dependencies
-        run: composer install --prefer-dist --no-progress
-        working-directory: server/modules/authentication_provider_password
-
-      - name: Run tests
-        run: composer test:unit
-        working-directory: server/modules/authentication_provider_password
@@ -25,17 +25,11 @@ jobs:
          tools: composer:v2

      - name: Install Renovate
-        run: |
-          npm install --global --no-audit --fund=false \
-            --prefix "${{ runner.temp }}/renovate-npm" \
-            --cache "${{ runner.temp }}/renovate-npm-cache" \
-            renovate
-          "${{ runner.temp }}/renovate-npm/bin/renovate" --version
+        run: npm install -g renovate

      - name: Run Renovate
        env:
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          RENOVATE_PLATFORM: gitea
          RENOVATE_ENDPOINT: https://git.ktrix.dev/api/v1
-        run: |
-          "${{ runner.temp }}/renovate-npm/bin/renovate" ${{ gitea.repository }}
+        run: renovate ${{ gitea.repository }}
@@ -12,10 +12,12 @@ node_modules/
 /static/

 # Backend development
-/vendor/
 /lib/vendor/
 coverage/
-*.cache
+phpunit.xml.cache
+.phpunit.result.cache
+.php-cs-fixer.cache
+.phpstan.cache
 .phpactor/

 # Editors
@@ -8,18 +8,6 @@
    }
  },
  "require": {
-    "php": ">=8.3"
-  },
-  "require-dev": {
-    "phpunit/phpunit": "^12.0"
-  },
-  "autoload-dev": {
-    "psr-4": {
-      "KTXT\\AuthenticationProviderPassword\\Tests\\": "tests/php/"
-    }
-  },
-  "scripts": {
-    "test:unit": "phpunit --configuration tests/php/phpunit.xml --testsuite \"Unit Tests\" --colors=always --testdox",
-    "test:integration": "phpunit --configuration tests/php/phpunit.xml --testsuite \"Integration Tests\" --colors=always --testdox"
+    "php": ">=8.2"
  }
 }
@@ -1,102 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXM\AuthenticationProviderPassword\Console;
-
-use KTXC\Service\TenantService;
-use KTXC\Stores\UserAccountsStore;
-use KTXM\AuthenticationProviderPassword\Provider;
-use Psr\Log\LoggerInterface;
-use Symfony\Component\Console\Attribute\AsCommand;
-use Symfony\Component\Console\Command\Command;
-use Symfony\Component\Console\Input\InputArgument;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Output\OutputInterface;
-use Symfony\Component\Console\Style\SymfonyStyle;
-
-/**
- * User Password Command
- *
- * Sets or updates the password credential for a user account.
- */
-#[AsCommand(
-    name: 'user:password',
-    description: 'Set or update the password credential for a user',
-)]
-class UserPasswordCommand extends Command
-{
-    public function __construct(
-        private readonly Provider $provider,
-        private readonly TenantService $tenantService,
-        private readonly UserAccountsStore $userStore,
-        private readonly LoggerInterface $logger
-    ) {
-        parent::__construct();
-    }
-
-    protected function configure(): void
-    {
-        $this
-            ->addArgument('tenant', InputArgument::REQUIRED, 'Tenant identifier')
-            ->addArgument('identity', InputArgument::REQUIRED, 'User identity (email/username)')
-            ->addArgument('password', InputArgument::OPTIONAL, 'Password (prompted for interactively when omitted)')
-            ->setHelp('This command sets or updates the password credential for a user account. Omit the password argument to be prompted securely.')
-        ;
-    }
-
-    protected function execute(InputInterface $input, OutputInterface $output): int
-    {
-        $io = new SymfonyStyle($input, $output);
-        $tenant = $input->getArgument('tenant');
-        $identity = $input->getArgument('identity');
-        $password = $input->getArgument('password');
-
-        $io->title('Set User Password');
-
-        try {
-            if (!$this->tenantService->fetchById($tenant)) {
-                $io->error("Tenant '{$tenant}' not found.");
-                return Command::FAILURE;
-            }
-
-            if (!$this->userStore->fetchByIdentity($tenant, $identity)) {
-                $io->error("User '{$identity}' not found in tenant '{$tenant}'.");
-                return Command::FAILURE;
-            }
-
-            if ($password === null) {
-                $password = $io->askHidden('Password');
-            }
-
-            if (empty($password)) {
-                $io->error('Password cannot be empty.');
-                return Command::FAILURE;
-            }
-
-            if (!$this->provider->setCredential($tenant, $identity, $password)) {
-                $io->error("Failed to store password credential for '{$identity}'.");
-                return Command::FAILURE;
-            }
-
-            $this->logger->info('User password credential set via console', [
-                'tenant' => $tenant,
-                'identity' => $identity,
-                'command' => $this->getName(),
-            ]);
-
-            $io->success("Password credential for '{$identity}' stored successfully!");
-
-            return Command::SUCCESS;
-
-        } catch (\Throwable $e) {
-            $io->error('Failed to set password: ' . $e->getMessage());
-            $this->logger->error('User password set failed', [
-                'tenant' => $tenant,
-                'identity' => $identity,
-                'error' => $e->getMessage(),
-            ]);
-            return Command::FAILURE;
-        }
-    }
-}
@@ -3,9 +3,8 @@
 namespace KTXM\AuthenticationProviderPassword\Controllers;

 use KTXC\Http\Response\JsonResponse;
-use KTXC\Service\UserAccountsService;
-use KTXC\Context\IdentityContextInterface;
-use KTXC\Context\TenantContextInterface;
+use KTXC\SessionIdentity;
+use KTXC\SessionTenant;
 use KTXF\Controller\ControllerAbstract;
 use KTXF\Routing\Attributes\AuthenticatedRoute;
 use KTXF\Security\Crypto;
@@ -15,20 +14,19 @@ use KTXM\AuthenticationProviderPassword\Stores\CredentialStore;
 class PasswordController extends ControllerAbstract
 {
    public function __construct(
-        private readonly IdentityContextInterface $identityContext,
-        private readonly TenantContextInterface $tenantContext,
+        private readonly SessionIdentity $sessionIdentity,
+        private readonly SessionTenant $sessionTenant,
        private readonly CredentialStore $credentialStore,
        private readonly Provider $provider,
-        private readonly Crypto $crypto,
-        private readonly UserAccountsService $userAccountsService
+        private readonly Crypto $crypto
    ) {
    }

    #[AuthenticatedRoute('/password/update', name: 'password.update', methods: ['POST'])]
    public function update(string $current_password, string $new_password): JsonResponse
    {
-        $tenantId = $this->tenantContext->identifier();
-        $identifier = $this->identityContext->mailAddress();
+        $tenantId = $this->sessionTenant->identifier();
+        $identifier = $this->sessionIdentity->mailAddress();

        if ($tenantId === null || $identifier === null) {
            return new JsonResponse(['error' => 'Invalid session state'], 400);
@@ -53,22 +51,18 @@ class PasswordController extends ControllerAbstract
    /**
     * Admin endpoint: Get credential status for a user
     */
-    #[AuthenticatedRoute('/status', name: 'password.admin.status', methods: ['POST'], permissions: ['authentication_provider_password.admin.view', 'authentication_provider_password.admin.manage'])]
+    #[AuthenticatedRoute('/admin/status/{uid}', name: 'password.admin.status', methods: ['GET'])]
    public function getStatus(string $uid): JsonResponse
    {
-        $tenantId = $this->tenantContext->identifier();
+        $tenantId = $this->sessionTenant->identifier();

        if ($tenantId === null) {
            return new JsonResponse(['error' => 'Invalid session state'], 400);
        }

-        $user = $this->userAccountsService->fetchByIdentifier($uid);
-        if (!$user) {
-            return new JsonResponse(['error' => 'User not found'], 404);
-        }
+        // TODO: Add permission check for admin operations

-        // Credentials are keyed by identity (email/username), not uid
-        $hasCredentials = $this->provider->hasCredentials($tenantId, $user['identity']);
+        $hasCredentials = $this->provider->hasCredentials($tenantId, $uid);

        return new JsonResponse([
            'enrolled' => $hasCredentials,
@@ -79,26 +73,22 @@ class PasswordController extends ControllerAbstract
    /**
     * Admin endpoint: Set/reset user password
     */
-    #[AuthenticatedRoute('/reset', name: 'password.admin.reset', methods: ['POST'], permissions: ['authentication_provider_password.admin.manage'])]
+    #[AuthenticatedRoute('/admin/reset', name: 'password.admin.reset', methods: ['POST'])]
    public function adminReset(string $uid, string $password): JsonResponse
    {
-        $tenantId = $this->tenantContext->identifier();
+        $tenantId = $this->sessionTenant->identifier();

        if ($tenantId === null) {
            return new JsonResponse(['error' => 'Invalid session state'], 400);
        }

+        // TODO: Add permission check for admin operations
+
        if (strlen($password) < 8) {
            return new JsonResponse(['error' => 'Password must be at least 8 characters'], 400);
        }

-        $user = $this->userAccountsService->fetchByIdentifier($uid);
-        if (!$user) {
-            return new JsonResponse(['error' => 'User not found'], 404);
-        }
-
-        // Credentials are keyed by identity (email/username), not uid
-        $success = $this->provider->setCredential($tenantId, $user['identity'], $password);
+        $success = $this->provider->setCredential($tenantId, $uid, $password);

        if (!$success) {
            return new JsonResponse(['error' => 'Failed to set password'], 500);
@@ -110,22 +100,18 @@ class PasswordController extends ControllerAbstract
    /**
     * Admin endpoint: Remove user password
     */
-    #[AuthenticatedRoute('/remove', name: 'password.admin.remove', methods: ['POST'], permissions: ['authentication_provider_password.admin.manage'])]
+    #[AuthenticatedRoute('/admin/remove/{uid}', name: 'password.admin.remove', methods: ['DELETE'])]
    public function adminRemove(string $uid): JsonResponse
    {
-        $tenantId = $this->tenantContext->identifier();
+        $tenantId = $this->sessionTenant->identifier();

        if ($tenantId === null) {
            return new JsonResponse(['error' => 'Invalid session state'], 400);
        }

-        $user = $this->userAccountsService->fetchByIdentifier($uid);
-        if (!$user) {
-            return new JsonResponse(['error' => 'User not found'], 404);
-        }
+        // TODO: Add permission check for admin operations

-        // Credentials are keyed by identity (email/username), not uid
-        $this->credentialStore->delete($tenantId, $user['identity']);
+        $this->credentialStore->delete($tenantId, $uid);

        return new JsonResponse(['success' => true]);
    }
@@ -5,16 +5,13 @@ declare(strict_types=1);
 namespace KTXM\AuthenticationProviderPassword;

 use KTXC\Resource\ProviderManager;
-use KTXF\Module\ModuleBrowserInterface;
-use KTXF\Module\ModuleConsoleInterface;
 use KTXF\Module\ModuleInstanceAbstract;
-use KTXM\AuthenticationProviderPassword\Console\UserPasswordCommand;

 /**
 * Default Identity Provider Module
 * Provides local database authentication
 */
-class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, ModuleBrowserInterface
+class Module extends ModuleInstanceAbstract
 {
    public function __construct(
        private readonly ProviderManager $providerManager,
@@ -53,16 +50,6 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
                'description' => 'View and access the password authentication provider module',
                'group' => 'Authentication Providers'
            ],
-            'authentication_provider_password.admin.view' => [
-                'label' => 'View Password Status',
-                'description' => 'View whether another user has a password credential configured',
-                'group' => 'Authentication Providers'
-            ],
-            'authentication_provider_password.admin.manage' => [
-                'label' => 'Manage User Passwords',
-                'description' => 'Set, reset, or remove password credentials for other users',
-                'group' => 'Authentication Providers'
-            ],
        ];
    }
    
@@ -71,13 +58,6 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
        $this->providerManager->register('authentication', 'password', Provider::class);
    }
    
-    public function registerCI(): array
-    {
-        return [
-            UserPasswordCommand::class,
-        ];
-    }
-
    public function registerBI(): array
    {
        return [
@@ -11,11 +11,7 @@
    "dev": "vite build --mode development --config vite.config.ts",
    "watch": "vite build --mode development --watch --config vite.config.ts",
    "typecheck": "vue-tsc --noEmit",
-    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore",
-    "test": "vitest run --config tests/js/vitest.config.ts",
-    "test:unit": "vitest run --config tests/js/vitest.config.ts",
-    "test:watch": "vitest watch --config tests/js/vitest.config.ts",
-    "test:coverage": "vitest run --coverage --config tests/js/vitest.config.ts"
+    "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore"
  },
  "dependencies": {
    "vue": "^3.5.13"
@@ -24,10 +20,6 @@
    "@vitejs/plugin-vue": "^6.0.0",
    "typescript": "~6.0.0",
    "vite": "^8.0.0",
-    "vue-tsc": "^3.0.0",
-    "@vitest/coverage-v8": "^4.1.6",
-    "@vue/test-utils": "^2.4.10",
-    "jsdom": "^29.1.1",
-    "vitest": "^4.1.6"
+    "vue-tsc": "^3.0.0"
  }
 }
@@ -30,15 +30,8 @@ const confirmPassword = ref('');
 const loadStatus = async () => {
  statusLoading.value = true;
  try {
-    const response = await fetch('/m/authentication_provider_password/status', {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
+    const response = await fetch(`/m/authentication_provider_password/admin/status/${props.user.uid}`, {
      credentials: 'include',
-      body: JSON.stringify({
-        uid: props.user.uid,
-      }),
    });
    
    if (response.ok) {
@@ -67,7 +60,7 @@ const resetPassword = async () => {
  error.value = null;

  try {
-    const response = await fetch('/m/authentication_provider_password/reset', {
+    const response = await fetch('/m/authentication_provider_password/admin/reset', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
@@ -102,15 +95,9 @@ const removePassword = async () => {
  error.value = null;

  try {
-    const response = await fetch('/m/authentication_provider_password/remove', {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
+    const response = await fetch(`/m/authentication_provider_password/admin/remove/${props.user.uid}`, {
+      method: 'DELETE',
      credentials: 'include',
-      body: JSON.stringify({
-        uid: props.user.uid,
-      }),
    });

    if (response.ok) {
@@ -215,23 +202,19 @@ onMounted(() => {
          <VForm @submit.prevent="resetPassword">
            <VTextField
              v-model="newPassword"
-              name="new-password"
              label="New Password"
              type="password"
              variant="outlined"
              class="mb-4"
              required
              hint="Minimum 8 characters"
-              autocomplete="suppress"
            />
            <VTextField
              v-model="confirmPassword"
-              name="confirm-password"
              label="Confirm Password"
              type="password"
              variant="outlined"
              required
-              autocomplete="suppress"
              :error="confirmPassword.length > 0 && confirmPassword !== newPassword"
              :error-messages="confirmPassword.length > 0 && confirmPassword !== newPassword ? ['Passwords do not match'] : []"
            />
@@ -34,7 +34,7 @@ const setPassword = async () => {
  error.value = null;

  try {
-    const response = await fetch('/m/authentication_provider_password/reset', {
+    const response = await fetch('/m/authentication_provider_password/admin/reset', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
@@ -110,7 +110,6 @@ const setPassword = async () => {
        <VForm @submit.prevent="setPassword">
          <VTextField
            v-model="password"
-            name="new-password"
            label="Password"
            type="password"
            variant="outlined"
@@ -118,16 +117,13 @@ const setPassword = async () => {
            required
            hint="Minimum 8 characters"
            persistent-hint
-            autocomplete="suppress"
          />
          <VTextField
            v-model="confirmPassword"
-            name="confirm-password"
            label="Confirm Password"
            type="password"
            variant="outlined"
            required
-            autocomplete="suppress"
            :error="confirmPassword.length > 0 && confirmPassword !== password"
            :error-messages="confirmPassword.length > 0 && confirmPassword !== password ? ['Passwords do not match'] : []"
          />
@@ -144,13 +144,12 @@ const saveChanges = async () => {
          <VCol cols="12">
            <VTextField
              v-model="newPassword"
-              name="new-password"
              :type="isNewPasswordVisible ? 'text' : 'password'"
              :append-inner-icon="isNewPasswordVisible ? 'mdi-eye-off' : 'mdi-eye'"
              label="New Password"
              placeholder="············"
              variant="outlined"
-              autocomplete="suppress"
+              autocomplete="new-password"
              @click:append-inner="isNewPasswordVisible = !isNewPasswordVisible"
            />
          </VCol>
@@ -158,13 +157,12 @@ const saveChanges = async () => {
          <VCol cols="12">
            <VTextField
              v-model="confirmPassword"
-              name="confirm-password"
              :type="isConfirmPasswordVisible ? 'text' : 'password'"
              :append-inner-icon="isConfirmPasswordVisible ? 'mdi-eye-off' : 'mdi-eye'"
              label="Confirm New Password"
              placeholder="············"
              variant="outlined"
-              autocomplete="suppress"
+              autocomplete="new-password"
              :error="confirmPassword.length > 0 && confirmPassword !== newPassword"
              :error-messages="confirmPassword.length > 0 && confirmPassword !== newPassword ? ['Passwords do not match'] : []"
              @click:append-inner="isConfirmPasswordVisible = !isConfirmPasswordVisible"
@@ -1,30 +0,0 @@
-import { describe, it, expect } from 'vitest'
-
-describe('Basic Tests', () => {
-  it('should perform basic assertion', () => {
-    expect(true).toBe(true)
-  })
-
-  it('should test array operations', () => {
-    const array = ['foo', 'bar', 'baz']
-
-    expect(array).toHaveLength(3)
-    expect(array).toContain('bar')
-    expect(array[0]).toBe('foo')
-  })
-
-  it('should test string operations', () => {
-    const string = 'Hello, World!'
-
-    expect(string).toContain('World')
-    expect(string.length).toBe(13)
-  })
-
-  it('should test object operations', () => {
-    const obj = { foo: 'bar', count: 42 }
-
-    expect(obj).toHaveProperty('foo')
-    expect(obj.foo).toBe('bar')
-    expect(obj.count).toBeGreaterThan(40)
-  })
-})
@@ -1,33 +0,0 @@
-import { fileURLToPath } from 'node:url'
-import { defineConfig, configDefaults } from 'vitest/config'
-import vue from '@vitejs/plugin-vue'
-import path from 'path'
-
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = path.dirname(__filename)
-
-export default defineConfig({
-  plugins: [vue()],
-  resolve: {
-    alias: {
-      '@': path.resolve(__dirname, '../../src'),
-      '@KTXC': path.resolve(__dirname, '../../../../core/src'),
-    },
-  },
-  test: {
-    environment: 'jsdom',
-    exclude: [...configDefaults.exclude, 'e2e/**'],
-    root: fileURLToPath(new URL('../../', import.meta.url)),
-    coverage: {
-      provider: 'v8',
-      reporter: ['text', 'json', 'html'],
-      exclude: [
-        'node_modules/',
-        'tests/',
-        '**/*.d.ts',
-        '**/*.config.*',
-        '**/dist/**',
-      ],
-    },
-  },
-})
@@ -1,244 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\AuthenticationProviderPassword\Tests\Integration;
-
-use KTXC\Http\Request\Request;
-use KTXC\Http\Response\Response;
-use KTXC\Application;
-use KTXC\Stores\UserRolesStore;
-use PHPUnit\Framework\TestCase;
-
-/**
- * Base class for the password provider's integration tests.
- *
- * Boots the real application (Kernel, DI container, live database) and
- * drives it exactly like a deployed server would be driven: tenants and
- * users are provisioned through `bin/console`, and requests are dispatched
- * through the real HTTP kernel (routing, tenant resolution, auth middleware,
- * controller), not by calling controllers directly.
- *
- * A fresh Application (and DI container) is built for every request() call,
- * mirroring the one-process-per-request model this app is actually
- * deployed under. Session identity is a container-lifetime singleton that
- * AuthenticationMiddleware only ever sets, never clears, so reusing one
- * Application across requests would leak an authenticated identity from one
- * "request" into the next — a problem that can't occur in production,
- * where each request gets its own process, but very much can here.
- *
- * Each test class gets its own tenant, created in setUpBeforeClass() and
- * torn down in tearDownAfterClass(), so test classes never share state.
- */
-abstract class IntegrationTestCase extends TestCase
-{
-    protected static string $tenantIdentifier;
-    protected static string $tenantDomain;
-
-    public static function setUpBeforeClass(): void
-    {
-        if (static::buildApplication()->environment() === 'prod') {
-            self::fail('Refusing to run integration tests against a server configured for the "prod" environment.');
-        }
-
-        static::$tenantDomain = 'ci-' . bin2hex(random_bytes(4)) . '.test';
-        static::$tenantIdentifier = 'ci_' . bin2hex(random_bytes(4));
-
-        static::runConsole([
-            'tenant:create', static::$tenantDomain,
-            '--identifier', static::$tenantIdentifier,
-        ]);
-        static::runConsole(['tenant:auth:enable', static::$tenantIdentifier, 'password']);
-    }
-
-    public static function tearDownAfterClass(): void
-    {
-        if (isset(static::$tenantIdentifier)) {
-            static::runConsole(['tenant:delete', static::$tenantIdentifier, '--force']);
-        }
-    }
-
-    protected static function buildApplication(): Application
-    {
-        return Application::create(SERVER_ROOT);
-    }
-
-    // =========================================================================
-    // Provisioning helpers (run through bin/console, same as CI/ops would)
-    // =========================================================================
-
-    /**
-     * Provision a user (optionally with a password credential and roles) and
-     * return its uid, so tests can exercise admin endpoints that operate by uid.
-     *
-     * @param string[] $roles Role IDs to assign (see createRoleWithPermissions())
-     */
-    protected static function createUser(string $identity, ?string $password = null, array $roles = []): string
-    {
-        $uid = bin2hex(random_bytes(8));
-
-        $args = ['user:create', static::$tenantIdentifier, $identity, '--uid', $uid];
-        foreach ($roles as $role) {
-            $args[] = '--role';
-            $args[] = $role;
-        }
-        static::runConsole($args);
-
-        if ($password !== null) {
-            static::runConsole(['user:password', static::$tenantIdentifier, $identity, $password]);
-        }
-
-        return $uid;
-    }
-
-    /**
-     * Create a role granting the given permissions and return its role id.
-     *
-     * There's no `bin/console` command for role management, so this goes
-     * straight through the DI container to UserRolesStore — the same store
-     * the real UserRolesController uses — rather than calling controllers
-     * directly.
-     *
-     * @param string[] $permissions
-     */
-    protected static function createRoleWithPermissions(array $permissions, string $label = 'Test Role'): string
-    {
-        $application = static::buildApplication();
-        try {
-            $application->kernel()->boot();
-            $store = $application->container()->get(UserRolesStore::class);
-            $role = $store->createRole(static::$tenantIdentifier, [
-                'label' => $label,
-                'permissions' => $permissions,
-            ]);
-        } finally {
-            $application->shutdown();
-        }
-
-        return $role['rid'];
-    }
-
-    /**
-     * Run a bin/console command as a real subprocess and fail the test on
-     * a non-zero exit code.
-     *
-     * @param string[] $args Command name followed by its arguments/options
-     */
-    protected static function runConsole(array $args): string
-    {
-        $command = escapeshellcmd(PHP_BINARY) . ' ' . escapeshellarg(SERVER_ROOT . '/bin/console');
-        foreach ($args as $arg) {
-            $command .= ' ' . escapeshellarg((string) $arg);
-        }
-        $command .= ' --no-interaction 2>&1';
-
-        exec($command, $outputLines, $exitCode);
-        $output = implode("\n", $outputLines);
-
-        if ($exitCode !== 0) {
-            static::fail("Console command failed (exit {$exitCode}): {$command}\n{$output}");
-        }
-
-        return $output;
-    }
-
-    // =========================================================================
-    // HTTP helpers (dispatched in-process through the real kernel)
-    // =========================================================================
-
-    /**
-     * Dispatch a request through the real application and return the
-     * decoded JSON body alongside the status code.
-     *
-     * @return array{status: int, body: mixed, response: Response}
-     */
-    protected static function request(string $method, string $path, array $data = [], array $headers = []): array
-    {
-        $server = [
-            'HTTP_HOST' => static::$tenantDomain,
-            'SERVER_NAME' => static::$tenantDomain,
-            'REMOTE_ADDR' => '127.0.0.1',
-        ];
-
-        foreach ($headers as $name => $value) {
-            $server['HTTP_' . strtoupper(str_replace('-', '_', $name))] = $value;
-        }
-
-        $content = null;
-        if (!empty($data) && $method !== 'GET') {
-            $content = json_encode($data, JSON_THROW_ON_ERROR);
-            $server['CONTENT_TYPE'] = 'application/json';
-        }
-
-        $uri = 'http://' . static::$tenantDomain . $path;
-        $request = Request::create($uri, $method, [], [], [], $server, $content);
-
-        // A fresh application mirrors production while shutdown restores its
-        // process-level error handler after the in-process request.
-        $application = static::buildApplication();
-        try {
-            $response = $application->handleHttp($request);
-        } finally {
-            $application->shutdown();
-        }
-
-        $body = $response->getContent();
-        $decoded = null;
-        if (is_string($body) && $body !== '') {
-            $decoded = json_decode($body, true);
-        }
-
-        return ['status' => $response->getStatusCode(), 'body' => $decoded, 'response' => $response];
-    }
-
-    protected static function authorizedRequest(string $token, string $method, string $path, array $data = []): array
-    {
-        return static::request($method, $path, $data, ['Authorization' => 'Bearer ' . $token]);
-    }
-
-    /**
-     * Read a cookie's value off a Response. Authentication issues its
-     * access/refresh JWTs exclusively as Set-Cookie headers (accessToken,
-     * refreshToken) — AuthenticationResponse::toArray() never puts them in
-     * the JSON body — so tests read the token straight off the Response
-     * object we already have in-process, the equivalent of a browser
-     * reading Set-Cookie.
-     */
-    protected static function cookieValue(Response $response, string $name): ?string
-    {
-        foreach ($response->headers->getCookies() as $cookie) {
-            if ($cookie->getName() === $name) {
-                return $cookie->getValue();
-            }
-        }
-
-        return null;
-    }
-
-    /**
-     * Drive the real /auth/start -> /auth/identify -> /auth/verify flow for
-     * the password method.
-     *
-     * @return array{status: int, body: mixed, response: Response, accessToken: ?string, refreshToken: ?string}
-     *         The /auth/verify response, with tokens (if any) pulled from Set-Cookie.
-     */
-    protected static function loginWithPassword(string $identity, string $password): array
-    {
-        $start = static::request('GET', '/auth/start');
-        $session = $start['body']['session'] ?? null;
-        static::assertNotNull($session, 'auth/start did not return a session id: ' . json_encode($start));
-
-        static::request('POST', '/auth/identify', ['session' => $session, 'identity' => $identity]);
-
-        $verify = static::request('POST', '/auth/verify', [
-            'session' => $session,
-            'method' => 'password',
-            'response' => $password,
-        ]);
-
-        $verify['accessToken'] = static::cookieValue($verify['response'], 'accessToken');
-        $verify['refreshToken'] = static::cookieValue($verify['response'], 'refreshToken');
-
-        return $verify;
-    }
-}
@@ -1,80 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\AuthenticationProviderPassword\Tests\Integration;
-
-/**
- * Exercises the real /auth/start -> /auth/identify -> /auth/verify flow for
- * the password provider, through the HTTP kernel end to end.
- */
-class PasswordAuthenticationTest extends IntegrationTestCase
-{
-    public function testAuthStartOffersPasswordMethod(): void
-    {
-        $start = static::request('GET', '/auth/start');
-
-        $this->assertSame(200, $start['status']);
-        $methodIds = array_column($start['body']['methods'] ?? [], 'id');
-        $this->assertContains('password', $methodIds);
-    }
-
-    public function testSuccessfulLoginReturnsTokens(): void
-    {
-        static::createUser('alice@example.test', 'Correct-Horse-1!');
-
-        $result = static::loginWithPassword('alice@example.test', 'Correct-Horse-1!');
-
-        $this->assertSame('success', $result['body']['status'] ?? null, json_encode($result['body']));
-        $this->assertNotNull($result['accessToken']);
-        $this->assertNotNull($result['refreshToken']);
-        $this->assertSame('alice@example.test', $result['body']['user']['identity'] ?? null);
-    }
-
-    public function testAccessTokenAuthorizesSubsequentRequests(): void
-    {
-        static::createUser('bob@example.test', 'Correct-Horse-2!');
-        $login = static::loginWithPassword('bob@example.test', 'Correct-Horse-2!');
-
-        $ping = static::authorizedRequest($login['accessToken'], 'GET', '/auth/ping');
-
-        $this->assertSame(200, $ping['status']);
-        $this->assertSame('ok', $ping['body']['status'] ?? null);
-    }
-
-    public function testWrongPasswordIsRejected(): void
-    {
-        static::createUser('carol@example.test', 'Correct-Horse-3!');
-
-        $result = static::loginWithPassword('carol@example.test', 'wrong-password');
-
-        $this->assertSame('failed', $result['body']['status'] ?? null);
-        $this->assertSame(401, $result['status']);
-        $this->assertNull($result['accessToken']);
-    }
-
-    public function testLoginFailsForUserWithoutAPasswordSet(): void
-    {
-        static::createUser('dave@example.test');
-
-        $result = static::loginWithPassword('dave@example.test', 'anything');
-
-        $this->assertSame('failed', $result['body']['status'] ?? null);
-        $this->assertSame(401, $result['status']);
-    }
-
-    public function testLoginFailsForUnknownIdentity(): void
-    {
-        $result = static::loginWithPassword('nobody@example.test', 'anything');
-
-        $this->assertSame('failed', $result['body']['status'] ?? null);
-        $this->assertSame(401, $result['status']);
-    }
-
-    public function testUnauthenticatedRequestToProtectedRouteIsRejected(): void
-    {
-        $ping = static::request('GET', '/auth/ping');
-
-        $this->assertSame(401, $ping['status']);
-    }
-}
@@ -1,153 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXT\AuthenticationProviderPassword\Tests\Integration;
-
-/**
- * Exercises PasswordController's own routes, dispatched through the real
- * HTTP kernel. Module routes are served under the "/m/{module_handle}"
- * prefix applied by the router for every controller a module registers.
- */
-class PasswordControllerTest extends IntegrationTestCase
-{
-    private const BASE = '/m/authentication_provider_password';
-
-    public function testUpdateOwnPassword(): void
-    {
-        static::createUser('erin@example.test', 'Original-Pass-1!');
-        $accessToken = static::loginWithPassword('erin@example.test', 'Original-Pass-1!')['accessToken'];
-
-        $update = static::authorizedRequest($accessToken, 'POST', self::BASE . '/password/update', [
-            'current_password' => 'Original-Pass-1!',
-            'new_password' => 'Updated-Pass-1!',
-        ]);
-
-        $this->assertSame(200, $update['status'], json_encode($update['body']));
-        $this->assertTrue($update['body']['success'] ?? false);
-
-        // Old password no longer works, new one does
-        $oldLogin = static::loginWithPassword('erin@example.test', 'Original-Pass-1!');
-        $this->assertSame('failed', $oldLogin['body']['status'] ?? null);
-
-        $newLogin = static::loginWithPassword('erin@example.test', 'Updated-Pass-1!');
-        $this->assertSame('success', $newLogin['body']['status'] ?? null);
-    }
-
-    public function testUpdatePasswordRejectsWrongCurrentPassword(): void
-    {
-        static::createUser('frank@example.test', 'Original-Pass-2!');
-        $accessToken = static::loginWithPassword('frank@example.test', 'Original-Pass-2!')['accessToken'];
-
-        $update = static::authorizedRequest($accessToken, 'POST', self::BASE . '/password/update', [
-            'current_password' => 'not-the-current-password',
-            'new_password' => 'Updated-Pass-2!',
-        ]);
-
-        $this->assertSame(400, $update['status']);
-
-        // Original password still works
-        $login = static::loginWithPassword('frank@example.test', 'Original-Pass-2!');
-        $this->assertSame('success', $login['body']['status'] ?? null);
-    }
-
-    public function testUpdatePasswordRequiresAuthentication(): void
-    {
-        $update = static::request('POST', self::BASE . '/password/update', [
-            'current_password' => 'irrelevant',
-            'new_password' => 'irrelevant',
-        ]);
-
-        $this->assertSame(401, $update['status']);
-    }
-
-    public function testAdminStatusReflectsEnrollment(): void
-    {
-        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.view']);
-        $enrolledUid = static::createUser('grace@example.test', 'Grace-Pass-1!', [$roleId]);
-        $unenrolledUid = static::createUser('heidi@example.test');
-        $accessToken = static::loginWithPassword('grace@example.test', 'Grace-Pass-1!')['accessToken'];
-
-        $enrolledStatus = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $enrolledUid]);
-        $unenrolledStatus = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $unenrolledUid]);
-
-        $this->assertTrue($enrolledStatus['body']['enrolled'] ?? null);
-        $this->assertFalse($unenrolledStatus['body']['enrolled'] ?? null);
-    }
-
-    public function testAdminResetSetsAPasswordThatCanLogIn(): void
-    {
-        $uid = static::createUser('ivan@example.test');
-        // Bootstrap an authenticated actor with permission to call the admin endpoint
-        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
-        static::createUser('actor1@example.test', 'Actor-Pass-1!', [$roleId]);
-        $accessToken = static::loginWithPassword('actor1@example.test', 'Actor-Pass-1!')['accessToken'];
-
-        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
-            'uid' => $uid,
-            'password' => 'Reset-By-Admin-1!',
-        ]);
-
-        $this->assertSame(200, $reset['status'], json_encode($reset['body']));
-        $this->assertTrue($reset['body']['success'] ?? false);
-
-        $login = static::loginWithPassword('ivan@example.test', 'Reset-By-Admin-1!');
-        $this->assertSame('success', $login['body']['status'] ?? null);
-    }
-
-    public function testAdminResetRejectsShortPasswords(): void
-    {
-        $uid = static::createUser('judy@example.test');
-        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
-        static::createUser('actor2@example.test', 'Actor-Pass-2!', [$roleId]);
-        $accessToken = static::loginWithPassword('actor2@example.test', 'Actor-Pass-2!')['accessToken'];
-
-        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
-            'uid' => $uid,
-            'password' => 'short',
-        ]);
-
-        $this->assertSame(400, $reset['status']);
-    }
-
-    public function testAdminRemoveRevokesLogin(): void
-    {
-        $uid = static::createUser('kevin@example.test', 'Kevin-Pass-1!');
-        $roleId = static::createRoleWithPermissions(['authentication_provider_password.admin.manage']);
-        static::createUser('actor3@example.test', 'Actor-Pass-3!', [$roleId]);
-        $accessToken = static::loginWithPassword('actor3@example.test', 'Actor-Pass-3!')['accessToken'];
-
-        $remove = static::authorizedRequest($accessToken, 'POST', self::BASE . '/remove', ['uid' => $uid]);
-        $this->assertSame(200, $remove['status']);
-        $this->assertTrue($remove['body']['success'] ?? false);
-
-        $status = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $uid]);
-        $this->assertFalse($status['body']['enrolled'] ?? null);
-
-        $login = static::loginWithPassword('kevin@example.test', 'Kevin-Pass-1!');
-        $this->assertSame('failed', $login['body']['status'] ?? null);
-    }
-
-    public function testAdminEndpointsRejectActorsWithoutPermission(): void
-    {
-        $targetUid = static::createUser('mallory-target@example.test', 'Mallory-Target-1!');
-        static::createUser('mallory@example.test', 'Mallory-Pass-1!');
-        $accessToken = static::loginWithPassword('mallory@example.test', 'Mallory-Pass-1!')['accessToken'];
-
-        $status = static::authorizedRequest($accessToken, 'POST', self::BASE . '/status', ['uid' => $targetUid]);
-        $this->assertSame(403, $status['status']);
-
-        $reset = static::authorizedRequest($accessToken, 'POST', self::BASE . '/reset', [
-            'uid' => $targetUid,
-            'password' => 'Should-Not-Apply-1!',
-        ]);
-        $this->assertSame(403, $reset['status']);
-
-        $remove = static::authorizedRequest($accessToken, 'POST', self::BASE . '/remove', ['uid' => $targetUid]);
-        $this->assertSame(403, $remove['status']);
-
-        // None of the rejected calls should have taken effect
-        $login = static::loginWithPassword('mallory-target@example.test', 'Mallory-Target-1!');
-        $this->assertSame('success', $login['body']['status'] ?? null);
-    }
-}
@@ -1,29 +0,0 @@
-<?php
-
-namespace KTXT\AuthenticationProviderPassword\Tests\Unit;
-
-use PHPUnit\Framework\TestCase;
-
-class BaseTest extends TestCase
-{
-    public function testBasicAssertion(): void
-    {
-        $this->assertTrue(true);
-    }
-
-    public function testArrayOperations(): void
-    {
-        $array = ['foo' => 'bar'];
-
-        $this->assertArrayHasKey('foo', $array);
-        $this->assertEquals('bar', $array['foo']);
-    }
-
-    public function testStringOperations(): void
-    {
-        $string = 'Hello, World!';
-
-        $this->assertStringContainsString('World', $string);
-        $this->assertEquals(13, strlen($string));
-    }
-}
@@ -1,16 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-// This module is always deployed at <server-root>/modules/<handle>, so the
-// server's own vendor/autoload.php (core + shared + framework deps) is a
-// fixed number of levels above this file. Every other test file resolves
-// the server root through this constant rather than repeating the math.
-define('SERVER_ROOT', dirname(__DIR__, 4));
-
-require SERVER_ROOT . '/vendor/autoload.php';
-require __DIR__ . '/Integration/IntegrationTestCase.php';
-
-if (isset($_SERVER['APP_DEBUG']) && $_SERVER['APP_DEBUG']) {
-    umask(0000);
-}
@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<!-- https://phpunit.readthedocs.io/en/latest/configuration.html -->
-<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:noNamespaceSchemaLocation="../../vendor/phpunit/phpunit/phpunit.xsd"
-         colors="true"
-         failOnDeprecation="true"
-         failOnNotice="true"
-         failOnWarning="true"
-         bootstrap="bootstrap.php"
-         cacheDirectory="../../.phpunit.cache"
->
-    <php>
-        <ini name="display_errors" value="1" />
-        <ini name="error_reporting" value="-1" />
-        <server name="SHELL_VERBOSITY" value="-1" />
-    </php>
-
-    <testsuites>
-        <testsuite name="Unit Tests">
-            <directory>Unit</directory>
-        </testsuite>
-        <testsuite name="Integration Tests">
-            <directory>Integration</directory>
-        </testsuite>
-    </testsuites>
-
-    <extensions>
-    </extensions>
-</phpunit>
@@ -6,6 +6,7 @@
    "composite": true,
    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",

+    "baseUrl": ".",
    "paths": {
      "@/*": ["./src/*"],
      "@KTXC/*": ["../../core/src/*"]