HiveGrid-Wireframes/03 Quellen und Referenzen/hivegrid-cloud/apps/web/app/services/auth/admin-fallback.server.test.ts

import { describe, expect, it } from "vitest";
import {
  AdminFallbackLoginRejected,
  assertAdminFallbackLoginAllowed,
  assertAdminFallbackLoginAllowedForIdentity,
  evaluateAdminFallbackLogin,
  isCompletedAdminFallbackLoginResponse,
  isAdminFallbackUiVisible,
  readAdminFallbackPolicy,
} from "./admin-fallback.server";

const localFallbackEnv = {
  NODE_ENV: "development",
  LOCAL_DEV_CREDENTIALS: "1",
  ADMIN_APP_HOST: "admin.localhost:3000",
  DATABASE_URL: "postgresql://postgres:postgres@127.0.0.1:5432/hivegrid",
};

describe("readAdminFallbackPolicy", () => {
  it("returns disabled+empty by default", () => {
    expect(readAdminFallbackPolicy({})).toEqual({ enabled: false, allowlist: [] });
  });

  it("parses ADMIN_FALLBACK_LOGIN_EMAILS comma-separated, lowercased", () => {
    expect(
      readAdminFallbackPolicy({
        ...localFallbackEnv,
        ADMIN_FALLBACK_LOGIN_ENABLED: "true",
        ADMIN_FALLBACK_LOGIN_EMAILS: " Bootstrap@example.test , ops@example.test , ",
      })
    ).toEqual({
      enabled: true,
      allowlist: ["bootstrap@example.test", "ops@example.test"],
    });
  });

  it("accepts common truthy values", () => {
    for (const value of ["1", "true", "yes", "on", "TRUE"]) {
      expect(readAdminFallbackPolicy({ ...localFallbackEnv, ADMIN_FALLBACK_LOGIN_ENABLED: value }).enabled).toBe(true);
    }
  });

  it("fails closed outside the disposable local development contract", () => {
    expect(
      readAdminFallbackPolicy({
        ...localFallbackEnv,
        NODE_ENV: "production",
        ADMIN_FALLBACK_LOGIN_ENABLED: "true",
      }).enabled
    ).toBe(false);
  });

  it("rejects non-truthy values", () => {
    for (const value of ["0", "false", "no", "", "off", "maybe"]) {
      expect(readAdminFallbackPolicy({ ADMIN_FALLBACK_LOGIN_ENABLED: value }).enabled).toBe(false);
    }
  });
});

describe("evaluateAdminFallbackLogin", () => {
  it("rejects when disabled even if allowlist matches", () => {
    const result = evaluateAdminFallbackLogin("bootstrap@example.test", {
      enabled: false,
      allowlist: ["bootstrap@example.test"],
    });
    expect(result.ok).toBe(false);
    if (!result.ok) expect(result.reason).toBe("disabled");
  });

  it("rejects when email not in allowlist", () => {
    const result = evaluateAdminFallbackLogin("intruder@example.test", {
      enabled: true,
      allowlist: ["bootstrap@example.test"],
    });
    expect(result.ok).toBe(false);
    if (!result.ok) expect(result.reason).toBe("email-not-allowlisted");
  });

  it("accepts when enabled AND email in allowlist (case-insensitive)", () => {
    const result = evaluateAdminFallbackLogin("Bootstrap@Example.test", {
      enabled: true,
      allowlist: ["bootstrap@example.test"],
    });
    expect(result.ok).toBe(true);
  });
});

describe("assertAdminFallbackLoginAllowed", () => {
  it("throws AdminFallbackLoginRejected when disabled", () => {
    expect(() => assertAdminFallbackLoginAllowed("anyone@example.test", { enabled: false, allowlist: [] })).toThrowError(AdminFallbackLoginRejected);
  });

  it("throws AdminFallbackLoginRejected when not in allowlist", () => {
    expect(() => assertAdminFallbackLoginAllowed("nobody@example.test", { enabled: true, allowlist: ["other@example.test"] })).toThrowError(
      AdminFallbackLoginRejected
    );
  });

  it("passes silently when both conditions are met", () => {
    expect(() => assertAdminFallbackLoginAllowed("ok@example.test", { enabled: true, allowlist: ["ok@example.test"] })).not.toThrow();
  });
});

describe("assertAdminFallbackLoginAllowedForIdentity", () => {
  it("does not apply the emergency admin policy to tenant identities", () => {
    expect(() => assertAdminFallbackLoginAllowedForIdentity({ email: "tenant@example.test", admin: null }, { enabled: false, allowlist: [] })).not.toThrow();
  });

  it("requires both emergency gates for an AdminUser on every host", () => {
    expect(() =>
      assertAdminFallbackLoginAllowedForIdentity(
        { email: "admin@example.test", admin: { userId: "admin_1" } },
        { enabled: false, allowlist: ["admin@example.test"] }
      )
    ).toThrowError(AdminFallbackLoginRejected);
    expect(() =>
      assertAdminFallbackLoginAllowedForIdentity(
        { email: "admin@example.test", admin: { userId: "admin_1" } },
        { enabled: true, allowlist: ["admin@example.test"] }
      )
    ).not.toThrow();
  });
});

describe("isAdminFallbackUiVisible", () => {
  it("reflects enabled flag only (allowlist intentionally ignored at UI layer)", () => {
    expect(isAdminFallbackUiVisible({ ...localFallbackEnv, ADMIN_FALLBACK_LOGIN_ENABLED: "true" })).toBe(true);
    expect(isAdminFallbackUiVisible({ ...localFallbackEnv, ADMIN_FALLBACK_LOGIN_ENABLED: "false" })).toBe(false);
    expect(isAdminFallbackUiVisible({})).toBe(false);
  });
});

describe("isCompletedAdminFallbackLoginResponse", () => {
  it("accepts only a redirect carrying the completed login session cookie", () => {
    expect(
      isCompletedAdminFallbackLoginResponse(
        new Response(null, {
          status: 302,
          headers: { Location: "/dashboard", "Set-Cookie": "__Host-hivegrid_admin_session=signed; Path=/; HttpOnly; Secure" },
        })
      )
    ).toBe(true);
  });

  it("rejects credential errors, MFA-pending responses, and redirects without a session", () => {
    expect(isCompletedAdminFallbackLoginResponse(Response.json({ error: "invalid" }, { status: 400 }))).toBe(false);
    expect(
      isCompletedAdminFallbackLoginResponse(
        Response.json({ requiresMfa: true }, { status: 200, headers: { "Set-Cookie": "hivegrid_session=pending; Path=/; HttpOnly" } })
      )
    ).toBe(false);
    expect(isCompletedAdminFallbackLoginResponse(new Response(null, { status: 302, headers: { Location: "/login" } }))).toBe(false);
    expect(
      isCompletedAdminFallbackLoginResponse(
        new Response(null, { status: 302, headers: { "Set-Cookie": "__Host-hivegrid_app_session=signed; Path=/; Secure" } })
      )
    ).toBe(false);
    expect(
      isCompletedAdminFallbackLoginResponse(new Response(null, { status: 302, headers: { "Set-Cookie": "hivegrid_session=legacy-parent-domain; Path=/" } }))
    ).toBe(false);
  });
});