homeio

1import { NextResponse } from "next/server";
2import { beforeEach, describe, expect, it, vi } from "vitest";
3
4vi.mock("@/lib/server/modules/auth/totp-service", () => ({
5  TotpServiceError: class TotpServiceError extends Error {
6    code: string;
7    statusCode: number;
8    publicMessage: string;
9
10    constructor(
11      message: string,
12      options: {
13        code: string;
14        statusCode: number;
15        publicMessage?: string;
16      },
17    ) {
18      super(message);
19      this.name = "TotpServiceError";
20      this.code = options.code;
21      this.statusCode = options.statusCode;
22      this.publicMessage = options.publicMessage ?? message;
23    }
24  },
25  completeTotpEnrollment: vi.fn(),
26}));
27
28import { POST } from "@/app/api/v1/auth/2fa/verify/route";
29import { requireApiSession } from "@/lib/server/modules/auth/api";
30import {
31  TotpServiceError,
32  completeTotpEnrollment,
33} from "@/lib/server/modules/auth/totp-service";
34
35const buildRequest = (body: unknown) =>
36  new Request("http://localhost/api/v1/auth/2fa/verify", {
37    method: "POST",
38    headers: { "content-type": "application/json" },
39    body: typeof body === "string" ? body : JSON.stringify(body),
40  });
41
42const VALID_BODY = { code: "123456" };
43
44beforeEach(() => {
45  vi.mocked(completeTotpEnrollment).mockReset();
46  vi.mocked(requireApiSession).mockImplementation(async () => ({
47    session: {
48      sessionId: "test-session",
49      userId: "test-user",
50      username: "admin",
51      passwordHash: "test-password-hash",
52      expiresAt: new Date(Date.now() + 3600_000),
53    },
54    response: null,
55  }));
56});
57
58describe("POST /api/v1/auth/2fa/verify", () => {
59  it("returns 401 when the session cannot be authenticated", async () => {
60    vi.mocked(requireApiSession).mockResolvedValueOnce({
61      session: null,
62      response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }),
63    });
64
65    const response = await POST(buildRequest(VALID_BODY));
66    expect(response.status).toBe(401);
67    expect(vi.mocked(completeTotpEnrollment)).not.toHaveBeenCalled();
68  });
69
70  it("returns 400 for a malformed JSON body", async () => {
71    const response = await POST(buildRequest("{not json"));
72    expect(response.status).toBe(400);
73    expect(vi.mocked(completeTotpEnrollment)).not.toHaveBeenCalled();
74  });
75
76  it("returns 400 when the body is missing 'code'", async () => {
77    const response = await POST(buildRequest({}));
78    expect(response.status).toBe(400);
79    expect(vi.mocked(completeTotpEnrollment)).not.toHaveBeenCalled();
80  });
81
82  it("returns 200 with the backup codes on success", async () => {
83    vi.mocked(completeTotpEnrollment).mockResolvedValueOnce({
84      enabled: true,
85      enrolledAt: "2026-05-23T13:00:00.000Z",
86      backupCodes: ["AAAAA11111", "BBBBB22222"],
87    });
88
89    const response = await POST(buildRequest(VALID_BODY));
90    expect(response.status).toBe(200);
91
92    const json = (await response.json()) as {
93      data: {
94        enabled: boolean;
95        enrolledAt: string;
96        backupCodes: string[];
97      };
98    };
99    expect(json.data.enabled).toBe(true);
100    expect(json.data.backupCodes).toEqual(["AAAAA11111", "BBBBB22222"]);
101
102    expect(vi.mocked(completeTotpEnrollment)).toHaveBeenCalledWith({
103      userId: "test-user",
104      code: "123456",
105    });
106  });
107
108  it("maps invalid_totp to 400 with the code in the body", async () => {
109    vi.mocked(completeTotpEnrollment).mockRejectedValueOnce(
110      new TotpServiceError("Invalid verification code", {
111        code: "invalid_totp",
112        statusCode: 400,
113      }),
114    );
115
116    const response = await POST(buildRequest(VALID_BODY));
117    expect(response.status).toBe(400);
118
119    const json = (await response.json()) as { error: string; code: string };
120    expect(json.code).toBe("invalid_totp");
121  });
122
123  it("maps already_enabled to 409", async () => {
124    vi.mocked(completeTotpEnrollment).mockRejectedValueOnce(
125      new TotpServiceError("Already enabled", {
126        code: "already_enabled",
127        statusCode: 409,
128      }),
129    );
130
131    const response = await POST(buildRequest(VALID_BODY));
132    expect(response.status).toBe(409);
133
134    const json = (await response.json()) as { code: string };
135    expect(json.code).toBe("already_enabled");
136  });
137
138  it("maps no_pending_enrollment to 409", async () => {
139    vi.mocked(completeTotpEnrollment).mockRejectedValueOnce(
140      new TotpServiceError("No pending enrolment", {
141        code: "no_pending_enrollment",
142        statusCode: 409,
143      }),
144    );
145
146    const response = await POST(buildRequest(VALID_BODY));
147    expect(response.status).toBe(409);
148
149    const json = (await response.json()) as { code: string };
150    expect(json.code).toBe("no_pending_enrollment");
151  });
152
153  it("returns 500 with a generic message for unexpected errors", async () => {
154    vi.mocked(completeTotpEnrollment).mockRejectedValueOnce(
155      new Error("database is down"),
156    );
157
158    const response = await POST(buildRequest(VALID_BODY));
159    expect(response.status).toBe(500);
160
161    const json = (await response.json()) as { error: string; code?: string };
162    expect(json.error).not.toContain("database is down");
163    expect(json.code).toBeUndefined();
164  });
165});
166