feat(backend): Auth/Users/Audit-Modul (Modul 1)

AuthModule: Login/Refresh/Logout mit JWT-Access-Token + rotierendem,
gehashtem Refresh-Token (RefreshToken-Tabelle). JwtAuthGuard + RolesGuard
global via APP_GUARD registriert (gilt fuer jeden kuenftigen Endpunkt),
@Public()-Decorator als Ausnahme (Auth-Endpunkte, /health).

UsersModule: CRUD + Deactivate, nur ADMIN-Rolle, Passwoerter mit bcrypt
gehasht, nie im Response enthalten.

AuditModule: AuditLogService (Grundstruktur), wird von UsersService bei
create/update/deactivate injiziert und geschrieben.

Geteilte App-Konfiguration (Prefix/Versioning/Pipes/Helmet) aus main.ts
in src/app.config.ts extrahiert; e2e-Tests nutzten das vorher nicht und
bekamen dadurch 404 auf jede /api/v1/... Route - jetzt ueber
test/utils/create-test-app.ts geteilt, betrifft alle kuenftigen
e2e-Tests gleichermassen.

prisma/seed.ts legt einen Admin-User fuer lokale Entwicklung an.

26 Unit-Tests + 11 e2e-Tests (gegen echte Postgres-Testdatenbank) gruen,
Lint/Typecheck/Build gruen, Login/Refresh/Logout/Rollenpruefung manuell
gegen laufenden Server verifiziert.

ApiCore-Backend/src/auth/auth.service.spec.ts

@@ -0,0 +1,150 @@
+import { UnauthorizedException } from '@nestjs/common';
+import * as bcrypt from 'bcryptjs';
+import { AuthService } from './auth.service';
+import { PrismaService } from '../prisma/prisma.service';
+import { UsersService } from '../users/users.service';
+
+describe('AuthService', () => {
+  let authService: AuthService;
+  let usersService: { findByEmail: jest.Mock; findById: jest.Mock };
+  let prisma: {
+    refreshToken: {
+      create: jest.Mock;
+      findUnique: jest.Mock;
+      update: jest.Mock;
+      updateMany: jest.Mock;
+    };
+  };
+  let jwtService: { sign: jest.Mock };
+
+  const activeUser = {
+    id: 'user-1',
+    email: '[email protected]',
+    role: 'STAFF',
+    isActive: true,
+    passwordHash: '',
+  };
+
+  beforeEach(async () => {
+    activeUser.passwordHash = await bcrypt.hash('correct-password', 4);
+    usersService = { findByEmail: jest.fn(), findById: jest.fn() };
+    prisma = {
+      refreshToken: {
+        create: jest.fn(),
+        findUnique: jest.fn(),
+        update: jest.fn(),
+        updateMany: jest.fn(),
+      },
+    };
+    jwtService = { sign: jest.fn().mockReturnValue('signed.jwt.token') };
+
+    authService = new AuthService(
+      usersService as unknown as UsersService,
+      prisma as unknown as PrismaService,
+      jwtService as never,
+    );
+  });
+
+  describe('login', () => {
+    it('throws when the user does not exist', async () => {
+      usersService.findByEmail.mockResolvedValue(null);
+      await expect(
+        authService.login('[email protected]', 'x'),
+      ).rejects.toBeInstanceOf(UnauthorizedException);
+    });
+
+    it('throws when the user is deactivated', async () => {
+      usersService.findByEmail.mockResolvedValue({
+        ...activeUser,
+        isActive: false,
+      });
+      await expect(
+        authService.login(activeUser.email, 'correct-password'),
+      ).rejects.toBeInstanceOf(UnauthorizedException);
+    });
+
+    it('throws when the password does not match', async () => {
+      usersService.findByEmail.mockResolvedValue(activeUser);
+      await expect(
+        authService.login(activeUser.email, 'wrong-password'),
+      ).rejects.toBeInstanceOf(UnauthorizedException);
+    });
+
+    it('returns tokens and stores a hashed refresh token on success', async () => {
+      usersService.findByEmail.mockResolvedValue(activeUser);
+      prisma.refreshToken.create.mockResolvedValue({});
+
+      const result = await authService.login(
+        activeUser.email,
+        'correct-password',
+      );
+
+      expect(result.accessToken).toBe('signed.jwt.token');
+      expect(result.refreshToken).toEqual(expect.any(String));
+      const [[createArg]] = prisma.refreshToken.create.mock.calls as [
+        [{ data: { userId: string } }],
+      ];
+      expect(createArg.data.userId).toBe(activeUser.id);
+    });
+  });
+
+  describe('refresh', () => {
+    it('throws when the refresh token is unknown', async () => {
+      prisma.refreshToken.findUnique.mockResolvedValue(null);
+      await expect(authService.refresh('unknown-token')).rejects.toBeInstanceOf(
+        UnauthorizedException,
+      );
+    });
+
+    it('throws when the refresh token is revoked', async () => {
+      prisma.refreshToken.findUnique.mockResolvedValue({
+        id: 'rt-1',
+        userId: activeUser.id,
+        revokedAt: new Date(),
+        expiresAt: new Date(Date.now() + 1000),
+      });
+      await expect(authService.refresh('revoked-token')).rejects.toBeInstanceOf(
+        UnauthorizedException,
+      );
+    });
+
+    it('throws when the refresh token is expired', async () => {
+      prisma.refreshToken.findUnique.mockResolvedValue({
+        id: 'rt-1',
+        userId: activeUser.id,
+        revokedAt: null,
+        expiresAt: new Date(Date.now() - 1000),
+      });
+      await expect(authService.refresh('expired-token')).rejects.toBeInstanceOf(
+        UnauthorizedException,
+      );
+    });
+
+    it('rotates the refresh token on success', async () => {
+      prisma.refreshToken.findUnique.mockResolvedValue({
+        id: 'rt-1',
+        userId: activeUser.id,
+        revokedAt: null,
+        expiresAt: new Date(Date.now() + 1000),
+      });
+      usersService.findById.mockResolvedValue(activeUser);
+      prisma.refreshToken.update.mockResolvedValue({});
+      prisma.refreshToken.create.mockResolvedValue({});
+
+      const result = await authService.refresh('valid-token');
+
+      expect(result.accessToken).toBe('signed.jwt.token');
+      expect(prisma.refreshToken.update).toHaveBeenCalledWith(
+        expect.objectContaining({ where: { id: 'rt-1' } }),
+      );
+    });
+  });
+
+  describe('logout', () => {
+    it('revokes the matching refresh token', async () => {
+      prisma.refreshToken.updateMany.mockResolvedValue({ count: 1 });
+      await authService.logout('some-token');
+      expect(prisma.refreshToken.updateMany).toHaveBeenCalled();
+    });
+  });
+});