homeio

1import { NextResponse } from "next/server";
2import { beforeEach, describe, expect, it, vi } from "vitest";
3
4vi.mock("@/lib/server/modules/auth/totp-service", () => ({
5  // Mirror the real TotpServiceError shape including publicMessage — the
6  // route returns publicMessage to the client, not message, so the test
7  // class must expose both.
8  TotpServiceError: class TotpServiceError extends Error {
9    code: string;
10    statusCode: number;
11    publicMessage: string;
12
13    constructor(
14      message: string,
15      options: {
16        code: string;
17        statusCode: number;
18        publicMessage?: string;
19      },
20    ) {
21      super(message);
22      this.name = "TotpServiceError";
23      this.code = options.code;
24      this.statusCode = options.statusCode;
25      this.publicMessage = options.publicMessage ?? message;
26    }
27  },
28  beginTotpEnrollment: vi.fn(),
29}));
30
31import { POST } from "@/app/api/v1/auth/2fa/setup/route";
32import { requireApiSession } from "@/lib/server/modules/auth/api";
33import {
34  TotpServiceError,
35  beginTotpEnrollment,
36} from "@/lib/server/modules/auth/totp-service";
37
38const buildRequest = () =>
39  new Request("http://localhost/api/v1/auth/2fa/setup", { method: "POST" });
40
41beforeEach(() => {
42  vi.mocked(beginTotpEnrollment).mockReset();
43  // Default to the authenticated-session shape from test/setup.ts so
44  // individual tests only need to override when explicitly testing 401s.
45  vi.mocked(requireApiSession).mockImplementation(async () => ({
46    session: {
47      sessionId: "test-session",
48      userId: "test-user",
49      username: "admin",
50      passwordHash: "test-password-hash",
51      expiresAt: new Date(Date.now() + 3600_000),
52    },
53    response: null,
54  }));
55});
56
57describe("POST /api/v1/auth/2fa/setup", () => {
58  it("returns 401 when the session cannot be authenticated", async () => {
59    vi.mocked(requireApiSession).mockResolvedValueOnce({
60      session: null,
61      response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }),
62    });
63
64    const response = await POST(buildRequest());
65    expect(response.status).toBe(401);
66    expect(vi.mocked(beginTotpEnrollment)).not.toHaveBeenCalled();
67  });
68
69  it("returns 200 with secret + otpauth URL + inline SVG on fresh enrolment", async () => {
70    vi.mocked(beginTotpEnrollment).mockResolvedValueOnce({
71      secret: "JBSWY3DPEHPK3PXP",
72      otpAuthUrl: "otpauth://totp/Homeio%3Aadmin?secret=JBSWY3DPEHPK3PXP",
73      qrCodeSvg: '<svg xmlns="http://www.w3.org/2000/svg">…</svg>',
74    });
75
76    const response = await POST(buildRequest());
77    expect(response.status).toBe(200);
78
79    const json = (await response.json()) as {
80      data: { secret: string; otpAuthUrl: string; qrCodeSvg: string };
81    };
82    expect(json.data.secret).toBe("JBSWY3DPEHPK3PXP");
83    expect(json.data.otpAuthUrl).toContain("otpauth://totp/");
84    expect(json.data.qrCodeSvg.startsWith("<svg")).toBe(true);
85
86    expect(vi.mocked(beginTotpEnrollment)).toHaveBeenCalledWith("test-user");
87  });
88
89  it("maps 'already_enabled' to HTTP 409 with the error code in the body", async () => {
90    vi.mocked(beginTotpEnrollment).mockRejectedValueOnce(
91      new TotpServiceError("Two-factor is already enabled", {
92        code: "already_enabled",
93        statusCode: 409,
94      }),
95    );
96
97    const response = await POST(buildRequest());
98    expect(response.status).toBe(409);
99
100    const json = (await response.json()) as { error: string; code: string };
101    expect(json.code).toBe("already_enabled");
102    expect(json.error).toMatch(/already enabled/i);
103  });
104
105  it("returns 500 with a generic message for unexpected errors", async () => {
106    vi.mocked(beginTotpEnrollment).mockRejectedValueOnce(
107      new Error("database is down"),
108    );
109
110    const response = await POST(buildRequest());
111    expect(response.status).toBe(500);
112
113    const json = (await response.json()) as { error: string; code?: string };
114    // Internal details must not leak through to the client.
115    expect(json.error).not.toContain("database is down");
116    expect(json.code).toBeUndefined();
117  });
118});
119