homeio

1import { NextResponse } from "next/server";
2import { beforeEach, describe, expect, it, vi } from "vitest";
3
4vi.mock("@/lib/server/modules/auth/totp-service", () => ({
5  TotpServiceError: class TotpServiceError extends Error {
6    code: string;
7    statusCode: number;
8    publicMessage: string;
9
10    constructor(
11      message: string,
12      options: {
13        code: string;
14        statusCode: number;
15        publicMessage?: string;
16      },
17    ) {
18      super(message);
19      this.name = "TotpServiceError";
20      this.code = options.code;
21      this.statusCode = options.statusCode;
22      this.publicMessage = options.publicMessage ?? message;
23    }
24  },
25  disableTotp: vi.fn(),
26}));
27
28import { POST } from "@/app/api/v1/auth/2fa/disable/route";
29import { requireApiSession } from "@/lib/server/modules/auth/api";
30import {
31  TotpServiceError,
32  disableTotp,
33} from "@/lib/server/modules/auth/totp-service";
34
35const buildRequest = (body: unknown) =>
36  new Request("http://localhost/api/v1/auth/2fa/disable", {
37    method: "POST",
38    headers: { "content-type": "application/json" },
39    body: typeof body === "string" ? body : JSON.stringify(body),
40  });
41
42const VALID_BODY = { code: "123456" };
43
44beforeEach(() => {
45  vi.mocked(disableTotp).mockReset();
46  vi.mocked(requireApiSession).mockImplementation(async () => ({
47    session: {
48      sessionId: "test-session",
49      userId: "test-user",
50      username: "admin",
51      passwordHash: "test-password-hash",
52      expiresAt: new Date(Date.now() + 3600_000),
53    },
54    response: null,
55  }));
56});
57
58describe("POST /api/v1/auth/2fa/disable", () => {
59  it("returns 401 when the session cannot be authenticated", async () => {
60    vi.mocked(requireApiSession).mockResolvedValueOnce({
61      session: null,
62      response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }),
63    });
64
65    const response = await POST(buildRequest(VALID_BODY));
66    expect(response.status).toBe(401);
67    expect(vi.mocked(disableTotp)).not.toHaveBeenCalled();
68  });
69
70  it("returns 400 for a malformed JSON body", async () => {
71    const response = await POST(buildRequest("{not json"));
72    expect(response.status).toBe(400);
73    expect(vi.mocked(disableTotp)).not.toHaveBeenCalled();
74  });
75
76  it("returns 400 when the body is missing 'code'", async () => {
77    const response = await POST(buildRequest({}));
78    expect(response.status).toBe(400);
79    expect(vi.mocked(disableTotp)).not.toHaveBeenCalled();
80  });
81
82  it("returns 200 with { enabled: false } on a successful TOTP disable", async () => {
83    vi.mocked(disableTotp).mockResolvedValueOnce({ enabled: false });
84
85    const response = await POST(buildRequest(VALID_BODY));
86    expect(response.status).toBe(200);
87
88    const json = (await response.json()) as { data: { enabled: boolean } };
89    expect(json.data).toEqual({ enabled: false });
90
91    expect(vi.mocked(disableTotp)).toHaveBeenCalledWith({
92      userId: "test-user",
93      code: "123456",
94    });
95  });
96
97  it("clears the session cookie on success so the caller cannot ride the disable", async () => {
98    vi.mocked(disableTotp).mockResolvedValueOnce({ enabled: false });
99
100    const response = await POST(buildRequest(VALID_BODY));
101    expect(response.status).toBe(200);
102
103    // The service revoked every session row for the user; the route must
104    // also strip the caller's cookie so the browser stops presenting a token
105    // the server no longer recognises.
106    const setCookie = response.headers.get("set-cookie") ?? "";
107    expect(setCookie).toMatch(/Expires=Thu, 01 Jan 1970/);
108    expect(setCookie).toMatch(/^[^=]+=;/);
109  });
110
111  it("passes a backup-code style payload straight through to the service", async () => {
112    vi.mocked(disableTotp).mockResolvedValueOnce({ enabled: false });
113
114    const response = await POST(
115      buildRequest({ code: "AAAA-AAAA-AA" }),
116    );
117    expect(response.status).toBe(200);
118    expect(vi.mocked(disableTotp)).toHaveBeenCalledWith({
119      userId: "test-user",
120      code: "AAAA-AAAA-AA",
121    });
122  });
123
124  it("maps invalid_totp to 400 with the code in the body", async () => {
125    vi.mocked(disableTotp).mockRejectedValueOnce(
126      new TotpServiceError("Invalid verification code", {
127        code: "invalid_totp",
128        statusCode: 400,
129      }),
130    );
131
132    const response = await POST(buildRequest(VALID_BODY));
133    expect(response.status).toBe(400);
134
135    const json = (await response.json()) as { error: string; code: string };
136    expect(json.code).toBe("invalid_totp");
137  });
138
139  it("maps not_enabled to 409", async () => {
140    vi.mocked(disableTotp).mockRejectedValueOnce(
141      new TotpServiceError("Not enabled", {
142        code: "not_enabled",
143        statusCode: 409,
144      }),
145    );
146
147    const response = await POST(buildRequest(VALID_BODY));
148    expect(response.status).toBe(409);
149
150    const json = (await response.json()) as { code: string };
151    expect(json.code).toBe("not_enabled");
152  });
153
154  it("maps not_enrolled (ghost user) to 401", async () => {
155    vi.mocked(disableTotp).mockRejectedValueOnce(
156      new TotpServiceError("User not found", {
157        code: "not_enrolled",
158        statusCode: 401,
159      }),
160    );
161
162    const response = await POST(buildRequest(VALID_BODY));
163    expect(response.status).toBe(401);
164
165    const json = (await response.json()) as { code: string };
166    expect(json.code).toBe("not_enrolled");
167  });
168
169  it("returns 500 with a generic message for unexpected errors", async () => {
170    vi.mocked(disableTotp).mockRejectedValueOnce(
171      new Error("database is down"),
172    );
173
174    const response = await POST(buildRequest(VALID_BODY));
175    expect(response.status).toBe(500);
176
177    const json = (await response.json()) as { error: string; code?: string };
178    expect(json.error).not.toContain("database is down");
179    expect(json.code).toBeUndefined();
180  });
181});
182