homeio

1import { beforeEach, describe, expect, it, vi } from "vitest";
2
3vi.mock("@/lib/server/modules/auth/repository", () => ({
4  createSession: vi.fn(),
5  createUser: vi.fn(),
6  deleteSessionById: vi.fn(),
7  findSessionWithUser: vi.fn(),
8  findUserByUsername: vi.fn(),
9  findUserWithTotpByUsername: vi.fn(),
10}));
11
12vi.mock("@/lib/server/modules/auth/password", () => ({
13  // Default to an async resolution so the service module's load-time
14  // DUMMY_PASSWORD_HASH_PROMISE.hashPassword() call (equal-time defence on
15  // the user-missing path) doesn't crash before any test runs.
16  hashPassword: vi.fn(async () => "dummy-salt:dummy-hash"),
17  verifyPassword: vi.fn(),
18}));
19
20vi.mock("@/lib/server/modules/auth/session-token", () => ({
21  createSessionToken: vi.fn(),
22  verifySessionToken: vi.fn(),
23}));
24
25vi.mock("@/lib/server/modules/auth/partial-auth-token", () => ({
26  createPartialAuthToken: vi.fn(),
27}));
28
29vi.mock("@/lib/server/env", () => ({
30  serverEnv: {
31    AUTH_PRIMARY_USERNAME: "admin",
32    AUTH_SESSION_HOURS: 168,
33  },
34}));
35
36import {
37  createSession,
38  createUser,
39  deleteSessionById,
40  findSessionWithUser,
41  findUserByUsername,
42  findUserWithTotpByUsername,
43} from "@/lib/server/modules/auth/repository";
44import { hashPassword, verifyPassword } from "@/lib/server/modules/auth/password";
45import { createPartialAuthToken } from "@/lib/server/modules/auth/partial-auth-token";
46import {
47  createSessionToken,
48  verifySessionToken,
49} from "@/lib/server/modules/auth/session-token";
50import {
51  AuthError,
52  authenticateSession,
53  loginUser,
54  logoutSession,
55  registerUser,
56  verifyUnlockPassword,
57} from "@/lib/server/modules/auth/service";
58
59describe("auth service", () => {
60  beforeEach(() => {
61    vi.clearAllMocks();
62  });
63
64  it("registers a user", async () => {
65    vi.mocked(findUserByUsername).mockResolvedValueOnce(null);
66    vi.mocked(hashPassword).mockResolvedValueOnce("salt:hash");
67
68    const result = await registerUser({
69      username: "admin",
70      password: "StrongPass123",
71      confirmPassword: "StrongPass123",
72    });
73
74    expect(result.username).toBe("admin");
75    expect(createUser).toHaveBeenCalledTimes(1);
76  });
77
78  it("fails registration when passwords mismatch", async () => {
79    await expect(
80      registerUser({
81        username: "admin",
82        password: "StrongPass123",
83        confirmPassword: "WrongPass123",
84      }),
85    ).rejects.toBeInstanceOf(AuthError);
86  });
87
88  it("logs in user and creates session token when TOTP is off", async () => {
89    vi.mocked(findUserWithTotpByUsername).mockResolvedValueOnce({
90      id: "u1",
91      username: "admin",
92      passwordHash: "salt:hash",
93      totpSecret: null,
94      totpEnabled: false,
95      totpBackupCodes: null,
96      totpEnrolledAt: null,
97    });
98    vi.mocked(verifyPassword).mockResolvedValueOnce(true);
99    vi.mocked(createSessionToken).mockReturnValueOnce("token-123");
100
101    const result = await loginUser({
102      username: "admin",
103      password: "StrongPass123",
104    });
105
106    expect(result.kind).toBe("session");
107    if (result.kind !== "session") throw new Error("expected session branch");
108    expect(result.token).toBe("token-123");
109    expect(createSession).toHaveBeenCalledTimes(1);
110    expect(createPartialAuthToken).not.toHaveBeenCalled();
111  });
112
113  it("returns a partial-auth token (no session) when TOTP is enabled", async () => {
114    vi.mocked(findUserWithTotpByUsername).mockResolvedValueOnce({
115      id: "u1",
116      username: "admin",
117      passwordHash: "salt:hash",
118      totpSecret: "enc:secret",
119      totpEnabled: true,
120      totpBackupCodes: "enc:codes",
121      totpEnrolledAt: new Date("2026-05-20T00:00:00.000Z"),
122    });
123    vi.mocked(verifyPassword).mockResolvedValueOnce(true);
124    vi.mocked(createPartialAuthToken).mockReturnValueOnce({
125      token: "partial.u1.99999999.deadbeef",
126      expiresAtEpochSeconds: 99999999,
127    });
128
129    const result = await loginUser({
130      username: "admin",
131      password: "StrongPass123",
132    });
133
134    expect(result.kind).toBe("partial");
135    if (result.kind !== "partial") throw new Error("expected partial branch");
136    expect(result.partialAuthToken).toBe("partial.u1.99999999.deadbeef");
137    expect(result.partialAuthExpiresAt.getTime()).toBe(99999999 * 1000);
138    expect(result.user).toEqual({ id: "u1", username: "admin" });
139
140    // No real session must be created on the TOTP branch.
141    expect(createSession).not.toHaveBeenCalled();
142    expect(createSessionToken).not.toHaveBeenCalled();
143    expect(createPartialAuthToken).toHaveBeenCalledWith("u1");
144  });
145
146  it("rejects with 401 and still runs verifyPassword on an unknown username (equal-time)", async () => {
147    // Equal-time defence: without the dummy-hash branch, the user-missing
148    // path skips scrypt entirely and finishes in ~0 ms, while the user-
149    // exists path runs a full verifyPassword (~tens of ms). An attacker
150    // could enumerate usernames by timing alone. The service must call
151    // verifyPassword against a fixed dummy hash on the miss path so the
152    // wall-clock cost is comparable.
153    vi.mocked(findUserWithTotpByUsername).mockResolvedValueOnce(null);
154    vi.mocked(verifyPassword).mockResolvedValueOnce(false);
155
156    await expect(
157      loginUser({ username: "no-such-user", password: "anything" }),
158    ).rejects.toBeInstanceOf(AuthError);
159
160    expect(verifyPassword).toHaveBeenCalledTimes(1);
161    // The dummy hash is what was generated at module load; we don't pin its
162    // exact value, but it must NOT be undefined / empty / the supplied
163    // password's hash (since no user row was found).
164    const [pwArg, hashArg] = vi.mocked(verifyPassword).mock.calls[0];
165    expect(pwArg).toBe("anything");
166    expect(typeof hashArg).toBe("string");
167    expect(hashArg.length).toBeGreaterThan(0);
168  });
169
170  it("rejects invalid login", async () => {
171    vi.mocked(findUserWithTotpByUsername).mockResolvedValueOnce({
172      id: "u1",
173      username: "admin",
174      passwordHash: "salt:hash",
175      totpSecret: null,
176      totpEnabled: false,
177      totpBackupCodes: null,
178      totpEnrolledAt: null,
179    });
180    vi.mocked(verifyPassword).mockResolvedValueOnce(false);
181
182    await expect(
183      loginUser({ username: "admin", password: "bad-pass" }),
184    ).rejects.toBeInstanceOf(AuthError);
185    expect(createPartialAuthToken).not.toHaveBeenCalled();
186  });
187
188  it("does not leak a partial token when the password is wrong on a TOTP user", async () => {
189    vi.mocked(findUserWithTotpByUsername).mockResolvedValueOnce({
190      id: "u1",
191      username: "admin",
192      passwordHash: "salt:hash",
193      totpSecret: "enc:secret",
194      totpEnabled: true,
195      totpBackupCodes: "enc:codes",
196      totpEnrolledAt: new Date(),
197    });
198    vi.mocked(verifyPassword).mockResolvedValueOnce(false);
199
200    await expect(
201      loginUser({ username: "admin", password: "bad-pass" }),
202    ).rejects.toBeInstanceOf(AuthError);
203    expect(createPartialAuthToken).not.toHaveBeenCalled();
204  });
205
206  it("authenticates a valid session token", async () => {
207    vi.mocked(verifySessionToken).mockReturnValueOnce({
208      sessionId: "s1",
209      expiresAtEpochSeconds: Math.floor(Date.now() / 1000) + 3600,
210    });
211    vi.mocked(findSessionWithUser).mockResolvedValueOnce({
212      sessionId: "s1",
213      userId: "u1",
214      username: "admin",
215      passwordHash: "salt:hash",
216      expiresAt: new Date(Date.now() + 3600_000),
217    });
218
219    const session = await authenticateSession("token-123");
220
221    expect(session?.username).toBe("admin");
222  });
223
224  it("logs out by deleting session", async () => {
225    vi.mocked(verifySessionToken).mockReturnValueOnce({
226      sessionId: "s1",
227      expiresAtEpochSeconds: Math.floor(Date.now() / 1000) + 3600,
228    });
229
230    await logoutSession("token-123");
231
232    expect(deleteSessionById).toHaveBeenCalledWith("s1");
233  });
234
235  it("verifies unlock password", async () => {
236    vi.mocked(verifySessionToken).mockReturnValueOnce({
237      sessionId: "s1",
238      expiresAtEpochSeconds: Math.floor(Date.now() / 1000) + 3600,
239    });
240    vi.mocked(findSessionWithUser).mockResolvedValueOnce({
241      sessionId: "s1",
242      userId: "u1",
243      username: "admin",
244      passwordHash: "salt:hash",
245      expiresAt: new Date(Date.now() + 3600_000),
246    });
247    vi.mocked(verifyPassword).mockResolvedValueOnce(true);
248
249    const unlocked = await verifyUnlockPassword({
250      sessionToken: "token-123",
251      password: "StrongPass123",
252    });
253
254    expect(unlocked.username).toBe("admin");
255  });
256});
257