@ackplus/nest-auth 1.1.0 → 1.1.2

package/test/mfa.service.spec.ts

@@ -1,359 +0,0 @@
-import { DataSource, Repository } from 'typeorm';
-import { MfaService } from '../src/lib/auth/services/mfa.service';
-import { NestAuthMFASecret } from '../src/lib/auth/entities/mfa-secret.entity';
-import { NestAuthUser } from '../src/lib/user/entities/user.entity';
-import { NestAuthOTP } from '../src/lib/auth/entities/otp.entity';
-import { getRepositoryToken } from '@nestjs/typeorm';
-import speakeasy from 'speakeasy';
-import { MFAMethodEnum } from '../src/lib/core/interfaces/mfa-options.interface';
-import { OTPTypeEnum } from '../src/lib/core/interfaces/otp.interface';
-import { createTestApp, createTestModule } from './test.setup';
-
-describe('MfaService', () => {
-    let service: MfaService;
-    let mfaSecretRepository: Repository<NestAuthMFASecret>;
-    let userRepository: Repository<NestAuthUser>;
-    let otpRepository: Repository<NestAuthOTP>;
-    let dataSource: DataSource;
-
-    beforeEach(async () => {
-        const app = await createTestApp({
-            mfa: {
-                enabled: true,
-                required: false,
-                methods: [MFAMethodEnum.EMAIL, MFAMethodEnum.SMS, MFAMethodEnum.TOTP]
-            }
-        });
-        service = app.get<MfaService>(MfaService);
-        dataSource = app.get<DataSource>(DataSource);
-        mfaSecretRepository = dataSource.getRepository(NestAuthMFASecret);
-        userRepository = dataSource.getRepository(NestAuthUser);
-        otpRepository = dataSource.getRepository(NestAuthOTP);
-    });
-
-    afterEach(async () => {
-        // Clean up database after each test
-        await dataSource.synchronize(true);
-    });
-
-    afterAll(async () => {
-        // Close the connection after all tests
-        await dataSource.destroy();
-    });
-
-    describe('getEnabledMethods', () => {
-        it('should return empty array when MFA is not enabled', async () => {
-            // Create test user
-            const user = new NestAuthUser();
-            user.email = 'test@example.com';
-            await userRepository.save(user);
-
-            const methods = await service.getEnabledMethods(user.id);
-            expect(methods).toEqual([]);
-        });
-
-        it('should return enabled methods based on configuration', async () => {
-            const user = await userRepository.save({
-                email: 'test@example.com',
-                isMfaEnabled: true,
-            });
-
-            await mfaSecretRepository.save({
-                userId: user.id,
-                secret: 'test-secret',
-                verified: true,
-            });
-
-            const result = await service.getEnabledMethods(user.id);
-            expect(result).toContain(MFAMethodEnum.EMAIL);
-            expect(result).toContain(MFAMethodEnum.SMS);
-            expect(result).toContain(MFAMethodEnum.TOTP);
-        });
-    });
-
-    describe('sendMfaCode', () => {
-        it('should generate and save OTP for email method', async () => {
-            const user = await userRepository.save({
-                email: 'test@example.com',
-            });
-
-            const result = await service.sendMfaCode(user.id, MFAMethodEnum.EMAIL);
-            expect(result).toBe(true);
-
-            const otp = await otpRepository.findOne({
-                where: { userId: user.id, type: OTPTypeEnum.MFA },
-            });
-            expect(otp).toBeDefined();
-            expect(otp?.code).toHaveLength(6);
-        });
-    });
-
-    describe('verifyMfa', () => {
-        it('should verify TOTP token correctly', async () => {
-            const user = await userRepository.save({
-                email: 'test@example.com',
-            });
-
-            const secret = speakeasy.generateSecret();
-            await mfaSecretRepository.save({
-                userId: user.id,
-                secret: secret.base32,
-                verified: true,
-            });
-
-            const token = speakeasy.totp({
-                secret: secret.base32,
-                encoding: 'base32',
-            });
-
-            const result = await service.verifyMfa(user.id, token, MFAMethodEnum.TOTP);
-            expect(result).toBe(true);
-        });
-
-        it('should verify email OTP correctly', async () => {
-            const user = await userRepository.save({
-                email: 'test@example.com',
-            });
-
-            const otp = await otpRepository.save({
-                userId: user.id,
-                type: OTPTypeEnum.MFA,
-                code: '123456',
-                expiresAt: new Date(Date.now() + 1000 * 60 * 5),
-            });
-
-            const result = await service.verifyMfa(user.id, otp.code, MFAMethodEnum.EMAIL);
-            expect(result).toBe(true);
-        });
-
-        it('should return false for invalid token', async () => {
-            const user = await userRepository.save({
-                email: 'test@example.com',
-            });
-
-            await otpRepository.save({
-                userId: user.id,
-                type: OTPTypeEnum.MFA,
-                code: '123456',
-                expiresAt: new Date(Date.now() + 1000 * 60 * 5),
-            });
-
-            const result = await service.verifyMfa(user.id, '654321', MFAMethodEnum.EMAIL);
-            expect(result).toBe(false);
-        });
-    });
-
-    describe('setupTotpDevice', () => {
-        it('should generate TOTP secret and QR code', async () => {
-            const user = await userRepository.save({
-                email: 'test@example.com',
-            });
-
-            const result = await service.setupTotpDevice(user.id, 'device1');
-            expect(result.secret).toBeDefined();
-            expect(result.qrCode).toBeDefined();
-
-            const mfaSecret = await mfaSecretRepository.findOne({
-                where: { userId: user.id, deviceName: 'device1' },
-            });
-            expect(mfaSecret).toBeDefined();
-            expect(mfaSecret?.secret).toBe(result.secret);
-        });
-    });
-
-    describe('getTotpDevices', () => {
-        it('should return all TOTP devices for a user', async () => {
-            const user = await userRepository.save({
-                email: 'test@example.com',
-            });
-
-            await mfaSecretRepository.save([
-                {
-                    userId: user.id,
-                    deviceName: 'device1',
-                    secret: 'secret1',
-                    verified: true,
-                },
-                {
-                    userId: user.id,
-                    deviceName: 'device2',
-                    secret: 'secret2',
-                    verified: false,
-                },
-            ]);
-
-            const result = await service.getTotpDevices(user.id);
-            expect(result).toHaveLength(2);
-            expect(result[0].deviceName).toBe('device1');
-            expect(result[1].deviceName).toBe('device2');
-        });
-    });
-
-    describe('removeDevice', () => {
-        it('should remove a device by ID', async () => {
-            const user = await userRepository.save({
-                email: 'test@example.com',
-            });
-
-            const mfaSecret = await mfaSecretRepository.save({
-                userId: user.id,
-                deviceName: 'device1',
-                secret: 'secret1',
-                verified: true,
-            });
-
-            await service.removeDevice(mfaSecret.id);
-
-            const deletedSecret = await mfaSecretRepository.findOne({
-                where: { id: mfaSecret.id },
-            });
-            expect(deletedSecret).toBeNull();
-        });
-    });
-
-    describe('removeTotpDevice', () => {
-        it('should remove a TOTP device by user ID and device ID', async () => {
-            const user = await userRepository.save({
-                email: 'test@example.com',
-            });
-
-            const device = await mfaSecretRepository.save({
-                userId: user.id,
-                deviceName: 'device1',
-                secret: 'secret1',
-                verified: true,
-            });
-
-            await service.removeTotpDevice(device.id);
-
-            const deletedSecret = await mfaSecretRepository.findOne({
-                where: { userId: user.id, deviceName: 'device1' },
-            });
-            expect(deletedSecret).toBeNull();
-        });
-    });
-
-    describe('Multiple TOTP Devices', () => {
-        let user: NestAuthUser;
-        let device1Id: string;
-        let device2Id: string;
-        let device1Secret: string;
-        let device2Secret: string;
-
-        beforeEach(async () => {
-            user = await userRepository.save({
-                email: 'test@example.com',
-                mfaEnabled: true,
-            });
-
-            // Setup first device
-            const device1 = await service.setupTotpDevice(user.id, 'device1');
-            device1Secret = device1.secret;
-            const devices1 = await service.getTotpDevices(user.id);
-            device1Id = devices1[0].id;
-
-            // Setup second device
-            const device2 = await service.setupTotpDevice(user.id, 'device2');
-            device2Secret = device2.secret;
-            const devices2 = await service.getTotpDevices(user.id);
-            device2Id = devices2.find(d => d.deviceName === 'device2')?.id!;
-        });
-
-        it('should verify TOTP setup correctly', async () => {
-            // Generate token for first device
-            const token1 = speakeasy.totp({
-                secret: device1Secret,
-                encoding: 'base32',
-            });
-
-            // Verify first device setup
-            const isVerified1 = await service.verifyTotpSetup(user.id, device1Secret, token1);
-            expect(isVerified1).toBe(true);
-
-            // Check device is marked as verified
-            const devices = await service.getTotpDevices(user.id);
-            const device1 = devices.find(d => d.deviceName === 'device1');
-            expect(device1?.verified).toBe(true);
-        });
-
-        it('should allow verification with any registered device', async () => {
-            // First verify both devices
-            const token1 = speakeasy.totp({
-                secret: device1Secret,
-                encoding: 'base32',
-            });
-            const token2 = speakeasy.totp({
-                secret: device2Secret,
-                encoding: 'base32',
-            });
-
-            await service.verifyTotpSetup(user.id, device1Secret, token1);
-            await service.verifyTotpSetup(user.id, device2Secret, token2);
-
-            // Generate new tokens for verification
-            const newToken1 = speakeasy.totp({
-                secret: device1Secret,
-                encoding: 'base32',
-            });
-            const newToken2 = speakeasy.totp({
-                secret: device2Secret,
-                encoding: 'base32',
-            });
-
-            // Both tokens should be valid
-            const result1 = await service.verifyMfa(user.id, newToken1, MFAMethodEnum.TOTP);
-            const result2 = await service.verifyMfa(user.id, newToken2, MFAMethodEnum.TOTP);
-
-            expect(result1).toBe(true);
-            expect(result2).toBe(true);
-        });
-
-        it('should allow removing specific device while keeping others active', async () => {
-            // First verify both devices
-            const token1 = speakeasy.totp({
-                secret: device1Secret,
-                encoding: 'base32',
-            });
-            const token2 = speakeasy.totp({
-                secret: device2Secret,
-                encoding: 'base32',
-            });
-
-            await service.verifyTotpSetup(user.id, device1Secret, token1);
-            await service.verifyTotpSetup(user.id, device2Secret, token2);
-
-            // Remove first device
-            await service.removeTotpDevice(device1Id);
-
-            // Verify second device still works
-            const newToken2 = speakeasy.totp({
-                secret: device2Secret,
-                encoding: 'base32',
-            });
-            const result = await service.verifyMfa(user.id, newToken2, MFAMethodEnum.TOTP);
-            expect(result).toBe(true);
-
-            // Verify first device is removed
-            const remainingDevices = await service.getTotpDevices(user.id);
-            expect(remainingDevices).toHaveLength(1);
-            expect(remainingDevices[0].deviceName).toBe('device2');
-        });
-
-        it('should not allow MFA verification with unverified devices', async () => {
-            // Generate token for unverified device
-            const token = speakeasy.totp({
-                secret: device1Secret,
-                encoding: 'base32',
-            });
-
-            // Try to verify with unverified device
-            const result = await service.verifyMfa(user.id, token, MFAMethodEnum.TOTP);
-            expect(result).toBe(false);
-
-            // Verify device is still not verified
-            const devices = await service.getTotpDevices(user.id);
-            const device = devices.find(d => d.deviceName === 'device1');
-            expect(device?.verified).toBe(false);
-        });
-    });
-});