@ackplus/nest-auth 0.1.50 → 1.1.0

package/test/mfa.service.spec.ts

@@ -0,0 +1,359 @@
+import { DataSource, Repository } from 'typeorm';
+import { MfaService } from '../src/lib/auth/services/mfa.service';
+import { NestAuthMFASecret } from '../src/lib/auth/entities/mfa-secret.entity';
+import { NestAuthUser } from '../src/lib/user/entities/user.entity';
+import { NestAuthOTP } from '../src/lib/auth/entities/otp.entity';
+import { getRepositoryToken } from '@nestjs/typeorm';
+import speakeasy from 'speakeasy';
+import { MFAMethodEnum } from '../src/lib/core/interfaces/mfa-options.interface';
+import { OTPTypeEnum } from '../src/lib/core/interfaces/otp.interface';
+import { createTestApp, createTestModule } from './test.setup';
+
+describe('MfaService', () => {
+    let service: MfaService;
+    let mfaSecretRepository: Repository<NestAuthMFASecret>;
+    let userRepository: Repository<NestAuthUser>;
+    let otpRepository: Repository<NestAuthOTP>;
+    let dataSource: DataSource;
+
+    beforeEach(async () => {
+        const app = await createTestApp({
+            mfa: {
+                enabled: true,
+                required: false,
+                methods: [MFAMethodEnum.EMAIL, MFAMethodEnum.SMS, MFAMethodEnum.TOTP]
+            }
+        });
+        service = app.get<MfaService>(MfaService);
+        dataSource = app.get<DataSource>(DataSource);
+        mfaSecretRepository = dataSource.getRepository(NestAuthMFASecret);
+        userRepository = dataSource.getRepository(NestAuthUser);
+        otpRepository = dataSource.getRepository(NestAuthOTP);
+    });
+
+    afterEach(async () => {
+        // Clean up database after each test
+        await dataSource.synchronize(true);
+    });
+
+    afterAll(async () => {
+        // Close the connection after all tests
+        await dataSource.destroy();
+    });
+
+    describe('getEnabledMethods', () => {
+        it('should return empty array when MFA is not enabled', async () => {
+            // Create test user
+            const user = new NestAuthUser();
+            user.email = 'test@example.com';
+            await userRepository.save(user);
+
+            const methods = await service.getEnabledMethods(user.id);
+            expect(methods).toEqual([]);
+        });
+
+        it('should return enabled methods based on configuration', async () => {
+            const user = await userRepository.save({
+                email: 'test@example.com',
+                isMfaEnabled: true,
+            });
+
+            await mfaSecretRepository.save({
+                userId: user.id,
+                secret: 'test-secret',
+                verified: true,
+            });
+
+            const result = await service.getEnabledMethods(user.id);
+            expect(result).toContain(MFAMethodEnum.EMAIL);
+            expect(result).toContain(MFAMethodEnum.SMS);
+            expect(result).toContain(MFAMethodEnum.TOTP);
+        });
+    });
+
+    describe('sendMfaCode', () => {
+        it('should generate and save OTP for email method', async () => {
+            const user = await userRepository.save({
+                email: 'test@example.com',
+            });
+
+            const result = await service.sendMfaCode(user.id, MFAMethodEnum.EMAIL);
+            expect(result).toBe(true);
+
+            const otp = await otpRepository.findOne({
+                where: { userId: user.id, type: OTPTypeEnum.MFA },
+            });
+            expect(otp).toBeDefined();
+            expect(otp?.code).toHaveLength(6);
+        });
+    });
+
+    describe('verifyMfa', () => {
+        it('should verify TOTP token correctly', async () => {
+            const user = await userRepository.save({
+                email: 'test@example.com',
+            });
+
+            const secret = speakeasy.generateSecret();
+            await mfaSecretRepository.save({
+                userId: user.id,
+                secret: secret.base32,
+                verified: true,
+            });
+
+            const token = speakeasy.totp({
+                secret: secret.base32,
+                encoding: 'base32',
+            });
+
+            const result = await service.verifyMfa(user.id, token, MFAMethodEnum.TOTP);
+            expect(result).toBe(true);
+        });
+
+        it('should verify email OTP correctly', async () => {
+            const user = await userRepository.save({
+                email: 'test@example.com',
+            });
+
+            const otp = await otpRepository.save({
+                userId: user.id,
+                type: OTPTypeEnum.MFA,
+                code: '123456',
+                expiresAt: new Date(Date.now() + 1000 * 60 * 5),
+            });
+
+            const result = await service.verifyMfa(user.id, otp.code, MFAMethodEnum.EMAIL);
+            expect(result).toBe(true);
+        });
+
+        it('should return false for invalid token', async () => {
+            const user = await userRepository.save({
+                email: 'test@example.com',
+            });
+
+            await otpRepository.save({
+                userId: user.id,
+                type: OTPTypeEnum.MFA,
+                code: '123456',
+                expiresAt: new Date(Date.now() + 1000 * 60 * 5),
+            });
+
+            const result = await service.verifyMfa(user.id, '654321', MFAMethodEnum.EMAIL);
+            expect(result).toBe(false);
+        });
+    });
+
+    describe('setupTotpDevice', () => {
+        it('should generate TOTP secret and QR code', async () => {
+            const user = await userRepository.save({
+                email: 'test@example.com',
+            });
+
+            const result = await service.setupTotpDevice(user.id, 'device1');
+            expect(result.secret).toBeDefined();
+            expect(result.qrCode).toBeDefined();
+
+            const mfaSecret = await mfaSecretRepository.findOne({
+                where: { userId: user.id, deviceName: 'device1' },
+            });
+            expect(mfaSecret).toBeDefined();
+            expect(mfaSecret?.secret).toBe(result.secret);
+        });
+    });
+
+    describe('getTotpDevices', () => {
+        it('should return all TOTP devices for a user', async () => {
+            const user = await userRepository.save({
+                email: 'test@example.com',
+            });
+
+            await mfaSecretRepository.save([
+                {
+                    userId: user.id,
+                    deviceName: 'device1',
+                    secret: 'secret1',
+                    verified: true,
+                },
+                {
+                    userId: user.id,
+                    deviceName: 'device2',
+                    secret: 'secret2',
+                    verified: false,
+                },
+            ]);
+
+            const result = await service.getTotpDevices(user.id);
+            expect(result).toHaveLength(2);
+            expect(result[0].deviceName).toBe('device1');
+            expect(result[1].deviceName).toBe('device2');
+        });
+    });
+
+    describe('removeDevice', () => {
+        it('should remove a device by ID', async () => {
+            const user = await userRepository.save({
+                email: 'test@example.com',
+            });
+
+            const mfaSecret = await mfaSecretRepository.save({
+                userId: user.id,
+                deviceName: 'device1',
+                secret: 'secret1',
+                verified: true,
+            });
+
+            await service.removeDevice(mfaSecret.id);
+
+            const deletedSecret = await mfaSecretRepository.findOne({
+                where: { id: mfaSecret.id },
+            });
+            expect(deletedSecret).toBeNull();
+        });
+    });
+
+    describe('removeTotpDevice', () => {
+        it('should remove a TOTP device by user ID and device ID', async () => {
+            const user = await userRepository.save({
+                email: 'test@example.com',
+            });
+
+            const device = await mfaSecretRepository.save({
+                userId: user.id,
+                deviceName: 'device1',
+                secret: 'secret1',
+                verified: true,
+            });
+
+            await service.removeTotpDevice(device.id);
+
+            const deletedSecret = await mfaSecretRepository.findOne({
+                where: { userId: user.id, deviceName: 'device1' },
+            });
+            expect(deletedSecret).toBeNull();
+        });
+    });
+
+    describe('Multiple TOTP Devices', () => {
+        let user: NestAuthUser;
+        let device1Id: string;
+        let device2Id: string;
+        let device1Secret: string;
+        let device2Secret: string;
+
+        beforeEach(async () => {
+            user = await userRepository.save({
+                email: 'test@example.com',
+                mfaEnabled: true,
+            });
+
+            // Setup first device
+            const device1 = await service.setupTotpDevice(user.id, 'device1');
+            device1Secret = device1.secret;
+            const devices1 = await service.getTotpDevices(user.id);
+            device1Id = devices1[0].id;
+
+            // Setup second device
+            const device2 = await service.setupTotpDevice(user.id, 'device2');
+            device2Secret = device2.secret;
+            const devices2 = await service.getTotpDevices(user.id);
+            device2Id = devices2.find(d => d.deviceName === 'device2')?.id!;
+        });
+
+        it('should verify TOTP setup correctly', async () => {
+            // Generate token for first device
+            const token1 = speakeasy.totp({
+                secret: device1Secret,
+                encoding: 'base32',
+            });
+
+            // Verify first device setup
+            const isVerified1 = await service.verifyTotpSetup(user.id, device1Secret, token1);
+            expect(isVerified1).toBe(true);
+
+            // Check device is marked as verified
+            const devices = await service.getTotpDevices(user.id);
+            const device1 = devices.find(d => d.deviceName === 'device1');
+            expect(device1?.verified).toBe(true);
+        });
+
+        it('should allow verification with any registered device', async () => {
+            // First verify both devices
+            const token1 = speakeasy.totp({
+                secret: device1Secret,
+                encoding: 'base32',
+            });
+            const token2 = speakeasy.totp({
+                secret: device2Secret,
+                encoding: 'base32',
+            });
+
+            await service.verifyTotpSetup(user.id, device1Secret, token1);
+            await service.verifyTotpSetup(user.id, device2Secret, token2);
+
+            // Generate new tokens for verification
+            const newToken1 = speakeasy.totp({
+                secret: device1Secret,
+                encoding: 'base32',
+            });
+            const newToken2 = speakeasy.totp({
+                secret: device2Secret,
+                encoding: 'base32',
+            });
+
+            // Both tokens should be valid
+            const result1 = await service.verifyMfa(user.id, newToken1, MFAMethodEnum.TOTP);
+            const result2 = await service.verifyMfa(user.id, newToken2, MFAMethodEnum.TOTP);
+
+            expect(result1).toBe(true);
+            expect(result2).toBe(true);
+        });
+
+        it('should allow removing specific device while keeping others active', async () => {
+            // First verify both devices
+            const token1 = speakeasy.totp({
+                secret: device1Secret,
+                encoding: 'base32',
+            });
+            const token2 = speakeasy.totp({
+                secret: device2Secret,
+                encoding: 'base32',
+            });
+
+            await service.verifyTotpSetup(user.id, device1Secret, token1);
+            await service.verifyTotpSetup(user.id, device2Secret, token2);
+
+            // Remove first device
+            await service.removeTotpDevice(device1Id);
+
+            // Verify second device still works
+            const newToken2 = speakeasy.totp({
+                secret: device2Secret,
+                encoding: 'base32',
+            });
+            const result = await service.verifyMfa(user.id, newToken2, MFAMethodEnum.TOTP);
+            expect(result).toBe(true);
+
+            // Verify first device is removed
+            const remainingDevices = await service.getTotpDevices(user.id);
+            expect(remainingDevices).toHaveLength(1);
+            expect(remainingDevices[0].deviceName).toBe('device2');
+        });
+
+        it('should not allow MFA verification with unverified devices', async () => {
+            // Generate token for unverified device
+            const token = speakeasy.totp({
+                secret: device1Secret,
+                encoding: 'base32',
+            });
+
+            // Try to verify with unverified device
+            const result = await service.verifyMfa(user.id, token, MFAMethodEnum.TOTP);
+            expect(result).toBe(false);
+
+            // Verify device is still not verified
+            const devices = await service.getTotpDevices(user.id);
+            const device = devices.find(d => d.deviceName === 'device1');
+            expect(device?.verified).toBe(false);
+        });
+    });
+});