101 lines
4.1 KiB
TypeScript
101 lines
4.1 KiB
TypeScript
/**
|
|
* Phase 10 Task #68 — DSGVO login guard unit test.
|
|
*
|
|
* Asserts that the login flow rejects users whose `pendingDeletion`
|
|
* flag is set (HTTP 423) or whose `pseudonymized` flag is set (HTTP 410)
|
|
* so the worker job and the UI converge on the same gate.
|
|
*/
|
|
import { beforeEach, describe, expect, it, vi } from "vitest";
|
|
|
|
vi.mock("~/locale/i18next.server", () => ({ getTranslations: vi.fn().mockResolvedValue({ t: (k: string) => k }) }));
|
|
vi.mock("~/utils/app/UserValidationUtils", () => ({ default: { validateEmail: () => true, validatePassword: () => true } }));
|
|
vi.mock("~/utils/db/logs.db.server", () => ({ createLogLogin: vi.fn() }));
|
|
vi.mock("~/utils/db/users.db.server", () => ({
|
|
getUserByEmail: vi.fn(),
|
|
updateUserPassword: vi.fn(),
|
|
getUser: vi.fn(),
|
|
getUserTotpStatus: vi.fn(),
|
|
getActiveTotpSecretEncrypted: vi.fn(),
|
|
consumeUserMfaRecoveryCode: vi.fn(),
|
|
}));
|
|
vi.mock("~/utils/session.server", () => ({
|
|
createUserSession: vi.fn(),
|
|
getUserInfo: vi.fn().mockResolvedValue({ lng: "en" }),
|
|
setLoggedUser: vi.fn().mockResolvedValue({ defaultTenantId: "t1" }),
|
|
validateCSRFToken: vi.fn(),
|
|
}));
|
|
vi.mock("~/utils/db/tenants.db.server", () => ({ getTenant: vi.fn().mockResolvedValue({ id: "t1", slug: "t1" }) }));
|
|
vi.mock("~/utils/db/appConfiguration.db.server", () => ({ getAppConfiguration: vi.fn() }));
|
|
vi.mock("~/utils/auth/passwordHasher.server", () => ({ verifyPassword: vi.fn().mockResolvedValue({ valid: true, rehashedHash: null }) }));
|
|
vi.mock("~/modules/ipAddress/services/IpAddressService.server", () => ({ default: { log: vi.fn().mockResolvedValue(null) } }));
|
|
vi.mock("~/services/auth/admin-fallback.server", () => ({ assertAdminFallbackLoginAllowed: vi.fn(), AdminFallbackLoginRejected: class extends Error {} }));
|
|
vi.mock("~/modules/admin-sso/audit.server", () => ({ writeAdminSsoAuditEvent: vi.fn() }));
|
|
vi.mock("@toolctrl/config", async () => {
|
|
const actual = await vi.importActual<typeof import("@toolctrl/config")>("@toolctrl/config");
|
|
return {
|
|
...actual,
|
|
loadRequiredWebConfig: () => ({
|
|
nodeEnv: "test",
|
|
routing: { appBaseDomain: "example.com", webAppHost: "app.example.com", adminAppHost: "admin.example.com", apiHost: "api.example.com", protocol: "https" },
|
|
}),
|
|
};
|
|
});
|
|
vi.mock("~/utils/auth/auth-rate-limit.server", () => ({ checkAuthRateLimit: () => ({ allowed: true }) }));
|
|
|
|
import { getUserByEmail } from "~/utils/db/users.db.server";
|
|
import AuthService from "./AuthService";
|
|
|
|
const getUserByEmailMock = vi.mocked(getUserByEmail);
|
|
|
|
function buildForm(): FormData {
|
|
const f = new FormData();
|
|
f.append("email", "alice@example.com");
|
|
f.append("password", "correct-horse-battery-staple");
|
|
f.append("redirectTo", "/");
|
|
f.append("csrf", "");
|
|
return f;
|
|
}
|
|
|
|
describe("AuthService DSGVO login guard", () => {
|
|
beforeEach(() => {
|
|
vi.clearAllMocks();
|
|
});
|
|
|
|
it("blocks login (423 Locked) when the user is pendingDeletion=true", async () => {
|
|
getUserByEmailMock.mockResolvedValue({
|
|
id: "u1",
|
|
email: "alice@example.com",
|
|
passwordHash: "$argon2id$v=19$x",
|
|
firstName: "Alice",
|
|
lastName: "Anderson",
|
|
pendingDeletion: true,
|
|
pseudonymized: false,
|
|
admin: null,
|
|
locale: null,
|
|
} as unknown as Awaited<ReturnType<typeof getUserByEmail>>);
|
|
|
|
const req = new Request("https://app.example.com/login", { method: "POST" });
|
|
const result = (await AuthService.loginFromRequest(req, buildForm())) as Response;
|
|
expect(result).toBeInstanceOf(Response);
|
|
expect(result.status).toBe(423);
|
|
});
|
|
|
|
it("blocks login (410 Gone) when the user is pseudonymized=true", async () => {
|
|
getUserByEmailMock.mockResolvedValue({
|
|
id: "u1",
|
|
email: "alice@example.com",
|
|
passwordHash: "$argon2id$v=19$x",
|
|
firstName: "Anonymized",
|
|
lastName: "User-abcd1234",
|
|
pendingDeletion: false,
|
|
pseudonymized: true,
|
|
admin: null,
|
|
locale: null,
|
|
} as unknown as Awaited<ReturnType<typeof getUserByEmail>>);
|
|
|
|
const req = new Request("https://app.example.com/login", { method: "POST" });
|
|
const result = (await AuthService.loginFromRequest(req, buildForm())) as Response;
|
|
expect(result.status).toBe(410);
|
|
});
|
|
});
|