@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/tests/cases/integration/mocked/signInIdpMutation.test.ts

@@ -1,16 +1,20 @@
-import { executeTenantTest } from '../../../src/testTenant'
-import { testUuid } from '../../../src/testUuid'
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { testUuid } from '../../../src/testUuid.js'
 import { expect, test } from 'bun:test'
-import { signInIDP } from './gql/signInIdp'
-import { sqlTransaction } from './sql/sqlTransaction'
-import { getIdpBySlugSql } from './sql/getIdpBySlugSql'
-import { getPersonByIdpSql } from './sql/getPersonByIdpSql'
-import { createSessionKeySql } from './sql/createSessionKeySql'
-import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql'
-import { selectMembershipsSql } from './sql/selectMembershipsSql'
-import { createIdentitySql } from './sql/createIdentitySql'
-import { createPersonSql } from './sql/createPersonSql'
-import { getConfigSql } from './sql/getConfigSql'
+import { signInIDP } from './gql/signInIdp.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
+import { getIdpBySlugSql } from './sql/getIdpBySlugSql.js'
+import { getPersonByIdpSql } from './sql/getPersonByIdpSql.js'
+import { createSessionKeySql } from './sql/createSessionKeySql.js'
+import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
+import { createIdentitySql } from './sql/createIdentitySql.js'
+import { createPersonSql } from './sql/createPersonSql.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
+import { getAuthPoliciesSql } from './sql/authPolicySql.js'
+import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { AuthLogService } from '../../../../src/model/service/AuthLogService.js'
 
 test('signs in idp with existing identity', async () => {
 	const externalIdentifier = 'abcd'
@@ -43,6 +47,8 @@ test('signs in idp with existing identity', async () => {
 						},
 						disabledAt: null,
 						initReturnsConfig: false,
+						requireVerifiedEmail: false,
+						assumeEmailVerified: false,
 						slug: 'mock',
 						type: 'mock',
 					},
@@ -59,6 +65,8 @@ test('signs in idp with existing identity', async () => {
 					},
 				}),
 				getConfigSql(),
+				getIdentityByIdSql({ identityId }),
+				getAuthPoliciesSql(),
 				createSessionKeySql({
 					apiKeyId,
 					identityId,
@@ -91,6 +99,257 @@ test('signs in idp with existing identity', async () => {
 	})
 })
 
+test('does NOT link by e-mail when provider requires a verified e-mail and the claim is unverified', async () => {
+	const externalIdentifier = 'abcd'
+	const email = 'john@doe.com'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const idpId = testUuid(20)
+	await executeTenantTest({
+		query: signInIDP({
+			identityProvider: 'mock',
+			idpResponse: {
+				url: 'test',
+			},
+			redirectUrl: 'test',
+			sessionData: {},
+		}),
+		executes: [
+			...sqlTransaction(
+				getIdpBySlugSql({
+					slug: 'mock',
+					response: {
+						id: idpId,
+						autoSignUp: false,
+						exclusive: false,
+						initReturnsConfig: false,
+						requireVerifiedEmail: true,
+						assumeEmailVerified: false,
+						configuration: {
+							externalIdentifier,
+							email,
+							emailVerified: false,
+						},
+						disabledAt: null,
+						slug: 'mock',
+						type: 'mock',
+					},
+				}),
+				// No IdP identity yet, and the matched-by-email account must NOT be
+				// linked because the provider asserts an unverified e-mail.
+				getPersonByIdpSql({
+					externalIdentifier,
+					identityProviderId: idpId,
+					response: null,
+				}),
+				getPersonByEmailSql({
+					email,
+					response: { personId, identityId, password: '123', roles: [] },
+				}),
+			),
+		],
+		return: {
+			data: {
+				signInIDP: {
+					ok: false,
+					errors: [{ code: 'PERSON_NOT_FOUND' }],
+					result: null,
+				},
+			},
+		},
+		// The gate block is takeover-grade, so the audit entry must stay
+		// distinguishable from an ordinary not-found: it records the blocked
+		// account's id and a reason, even though the external error is generic.
+		expectedAuthLog: {
+			type: 'idp_login',
+			response: expect.objectContaining({
+				ok: false,
+				metadata: expect.objectContaining({
+					[AuthLogService.Key]: expect.objectContaining({
+						data: expect.objectContaining({
+							personId,
+							eventData: { reason: 'idp_email_unverified' },
+						}),
+					}),
+				}),
+			}),
+		},
+	})
+})
+
+test('links by e-mail when provider requires a verified e-mail and the claim is verified', async () => {
+	const externalIdentifier = 'abcd'
+	const email = 'john@doe.com'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const projectId = testUuid(10)
+	const idpId = testUuid(20)
+	await executeTenantTest({
+		query: signInIDP({
+			identityProvider: 'mock',
+			idpResponse: {
+				url: 'test',
+			},
+			redirectUrl: 'test',
+			sessionData: {},
+		}),
+		executes: [
+			...sqlTransaction(
+				getIdpBySlugSql({
+					slug: 'mock',
+					response: {
+						id: idpId,
+						autoSignUp: false,
+						exclusive: false,
+						initReturnsConfig: false,
+						requireVerifiedEmail: true,
+						assumeEmailVerified: false,
+						configuration: {
+							externalIdentifier,
+							email,
+							emailVerified: true,
+						},
+						disabledAt: null,
+						slug: 'mock',
+						type: 'mock',
+					},
+				}),
+				getPersonByIdpSql({
+					externalIdentifier,
+					identityProviderId: idpId,
+					response: null,
+				}),
+				getPersonByEmailSql({
+					email,
+					response: { personId, identityId, password: '123', roles: [] },
+				}),
+				{
+					sql: `insert into  "tenant"."person_identity_provider" ("id", "identity_provider_id", "person_id", "external_identifier") values  (?, ?, ?, ?)`,
+					parameters: [testUuid(1), idpId, personId, externalIdentifier],
+					response: { rowCount: 1 },
+				},
+				getConfigSql(),
+				getIdentityByIdSql({ identityId }),
+				getAuthPoliciesSql(),
+				createSessionKeySql({
+					apiKeyId: testUuid(2),
+					identityId,
+				}),
+			),
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({
+				identityId,
+				projectId,
+				membershipsResponse: [{ role: 'editor', variables: [{ name: 'locale', values: ['cs'] }] }],
+			}),
+		],
+		return: {
+			data: {
+				signInIDP: {
+					ok: true,
+					errors: [],
+					result: {
+						token: '0000000000000000000000000000000000000000',
+					},
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'idp_login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
+	})
+})
+
+test('links by e-mail when require + assumeEmailVerified are set, even though the claim is unverified', async () => {
+	const externalIdentifier = 'abcd'
+	const email = 'john@doe.com'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const projectId = testUuid(10)
+	const idpId = testUuid(20)
+	await executeTenantTest({
+		query: signInIDP({
+			identityProvider: 'mock',
+			idpResponse: {
+				url: 'test',
+			},
+			redirectUrl: 'test',
+			sessionData: {},
+		}),
+		executes: [
+			...sqlTransaction(
+				getIdpBySlugSql({
+					slug: 'mock',
+					response: {
+						id: idpId,
+						autoSignUp: false,
+						exclusive: false,
+						initReturnsConfig: false,
+						requireVerifiedEmail: true,
+						// trusted IdP: e-mails are treated as verified even though the claim says false
+						assumeEmailVerified: true,
+						configuration: {
+							externalIdentifier,
+							email,
+							emailVerified: false,
+						},
+						disabledAt: null,
+						slug: 'mock',
+						type: 'mock',
+					},
+				}),
+				getPersonByIdpSql({
+					externalIdentifier,
+					identityProviderId: idpId,
+					response: null,
+				}),
+				getPersonByEmailSql({
+					email,
+					response: { personId, identityId, password: '123', roles: [] },
+				}),
+				{
+					sql: `insert into  "tenant"."person_identity_provider" ("id", "identity_provider_id", "person_id", "external_identifier") values  (?, ?, ?, ?)`,
+					parameters: [testUuid(1), idpId, personId, externalIdentifier],
+					response: { rowCount: 1 },
+				},
+				getConfigSql(),
+				getIdentityByIdSql({ identityId }),
+				getAuthPoliciesSql(),
+				createSessionKeySql({
+					apiKeyId: testUuid(2),
+					identityId,
+				}),
+			),
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({
+				identityId,
+				projectId,
+				membershipsResponse: [{ role: 'editor', variables: [{ name: 'locale', values: ['cs'] }] }],
+			}),
+		],
+		return: {
+			data: {
+				signInIDP: {
+					ok: true,
+					errors: [],
+					result: {
+						token: '0000000000000000000000000000000000000000',
+					},
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'idp_login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
+	})
+})
+
 test('signs in exclusive idp', async () => {
 	const externalIdentifier = 'abcd'
 	const email = 'john@doe.com'
@@ -117,6 +376,8 @@ test('signs in exclusive idp', async () => {
 						autoSignUp: true,
 						exclusive: true,
 						initReturnsConfig: false,
+						requireVerifiedEmail: false,
+						assumeEmailVerified: false,
 						configuration: {
 							externalIdentifier: externalIdentifier,
 							email,
@@ -139,6 +400,8 @@ test('signs in exclusive idp', async () => {
 					response: { rowCount: 1 },
 				},
 				getConfigSql(),
+				getIdentityByIdSql({ identityId }),
+				getAuthPoliciesSql(),
 				createSessionKeySql({
 					apiKeyId,
 					identityId,

package/tests/cases/integration/mocked/signInMfaEnforcement.test.ts

@@ -0,0 +1,323 @@
+import { executeTenantTest, now } from '../../../src/testTenant.js'
+import { SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { signInMutation } from './gql/signIn.js'
+import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql.js'
+import { createSessionKeySql } from './sql/createSessionKeySql.js'
+import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
+import { getAllProjectRolesByIdentitySql, getAuthPoliciesSql } from './sql/authPolicySql.js'
+import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
+import { generateBackupCodesSql } from './sql/generateBackupCodesSql.js'
+import { expect, test } from 'bun:test'
+import { Buffer } from 'buffer'
+import PostgresInterval from 'postgres-interval'
+import { OtpAuthenticator } from '../../../../src/index.js'
+import { GQL } from '../../../src/tags.js'
+
+const encryptProvider = {
+	encrypt: (value: Buffer) => Promise.resolve({ value: Buffer.concat([Buffer.from('ENC:'), value]), version: 1 }),
+	encryptionEnabled: true,
+}
+
+// signIn query that also reads the additive mfaEnrollment payload + backupCodes.
+const signInWithMfa = (variables: { email: string; password: string; otpToken?: string }) => ({
+	query: GQL`mutation($email: String!, $password: String!, $otpToken: String) {
+		signIn(email: $email, password: $password, otpToken: $otpToken) {
+			ok
+			error { code mfaEnrollment { otpUri otpSecret } }
+			result { token backupCodes }
+		}
+	}`,
+	variables,
+})
+
+const requiringPolicy = () => getAuthPoliciesSql([{ id: testUuid(900), scope: 'global', roles: ['editor'], mfaRequired: true }])
+
+test('MFA required + no factor + no code → MFA_ENROLLMENT_REQUIRED with pending secret + audit', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	await executeTenantTest({
+		providers: encryptProvider,
+		query: signInWithMfa({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'] } }),
+			requiringPolicy(),
+			getAllProjectRolesByIdentitySql({ identityId }),
+			// Enforcement resolves the grace duration: the matched policy has no
+			// grace override, so the global config default (0 = immediate) is read.
+			getConfigSql(),
+			{
+				// prepareOtp writes the pending slot.
+				sql: `insert into "tenant"."person_mfa" ("person_id", "totp_pending_secret", "totp_pending_version", "totp_pending_created_at")
+					values (?, ?, ?, ?)
+					on conflict ("person_id")
+					do update set "totp_pending_secret" = ?, "totp_pending_version" = ?, "totp_pending_created_at" = ?`,
+				parameters: [
+					personId,
+					(value: Buffer) => Buffer.isBuffer(value) && value.toString('utf8').startsWith('ENC:'),
+					1,
+					now,
+					(value: Buffer) => Buffer.isBuffer(value) && value.toString('utf8').startsWith('ENC:'),
+					1,
+					now,
+				],
+				response: { rowCount: 1 },
+			},
+		],
+		return: (response: any) => {
+			expect(response.data.signIn.ok).toBe(false)
+			expect(response.data.signIn.error.code).toBe('MFA_ENROLLMENT_REQUIRED')
+			expect(response.data.signIn.error.mfaEnrollment.otpUri).toMatch(/otpauth:.+/)
+			expect(typeof response.data.signIn.error.mfaEnrollment.otpSecret).toBe('string')
+			expect(response.data.signIn.result).toBeNull()
+		},
+		expectedAuthLog: [
+			{
+				type: 'login',
+				response: expect.objectContaining({ ok: false }),
+			},
+			expect.objectContaining({
+				type: 'mfa_enrollment_required',
+				response: expect.objectContaining({ ok: false }),
+			}),
+		],
+	})
+})
+
+test('MFA required + valid pending code → enrolls (pending→active), returns backup codes, signs in', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	// Backup-code generation consumes uuids 1..10, so the session api key gets uuid 11.
+	const apiKeyId = testUuid(11)
+	const projectId = testUuid(20)
+
+	// The person already has a pending TOTP secret (from a prior enrollment-required step).
+	const otpAuth = new OtpAuthenticator({
+		now: () => now,
+		randomBytes: () => Promise.resolve(Buffer.alloc(20)),
+	})
+	const otp = await otpAuth.create('john', 'contember')
+
+	await executeTenantTest({
+		query: signInWithMfa({ email, password, otpToken: otpAuth.generate(otp) }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'], otpPendingUri: otp.uri } }),
+			requiringPolicy(),
+			getAllProjectRolesByIdentitySql({ identityId }),
+			// Enforcement resolves the grace duration from the global config default.
+			getConfigSql(),
+			{
+				// confirmOtp promotes pending → active (only while a pending secret is present).
+				sql: `update "tenant"."person_mfa"
+					set "totp_secret" = "totp_pending_secret", "totp_secret_version" = "totp_pending_version", "totp_activated_at" = ?, "totp_pending_secret" = ?, "totp_pending_version" = ?, "totp_pending_created_at" = ?
+					where "person_id" = ? and "totp_pending_secret" is not null`,
+				parameters: [now, null, null, null, personId],
+				response: { rowCount: 1 },
+			},
+			...generateBackupCodesSql({ personId, firstUuidIndex: 1 }),
+			getConfigSql(),
+			getIdentityByIdSql({ identityId, roles: ['editor'] }),
+			requiringPolicy(),
+			getAllProjectRolesByIdentitySql({ identityId }),
+			createSessionKeySql({ apiKeyId, identityId }),
+			{
+				// A19: the requiring (mfaRequired) policy is non-inert, so
+				// createSessionApiKey emits a session_policy_applied audit entry.
+				// No personId is passed → the person_id column is omitted by the InsertBuilder.
+				sql: `insert into  "tenant"."person_auth_log" ("id", "invoked_by_id", "type", "success", "metadata", "event_data") values  (?, ?, ?, ?, ?, ?)`,
+				parameters: [
+					() => true,
+					identityId,
+					'session_policy_applied',
+					true,
+					() => true,
+					() => true,
+				],
+				response: { rowCount: 1 },
+			},
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
+		],
+		return: (response: any) => {
+			expect(response.data.signIn.ok).toBe(true)
+			expect(response.data.signIn.result.token).toBe('0000000000000000000000000000000000000000')
+			expect(response.data.signIn.result.backupCodes).toHaveLength(10)
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('MFA required + invalid pending code → INVALID_OTP_TOKEN', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const pendingUri = 'otpauth://totp/contember:john?secret=ABDEF&period=30&digits=6&algorithm=SHA1&issuer=contember'
+	await executeTenantTest({
+		query: signInMutation({ email, password, otpToken: '111111' }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'], otpPendingUri: pendingUri } }),
+			requiringPolicy(),
+			getAllProjectRolesByIdentitySql({ identityId }),
+			// Enforcement resolves the grace duration from the global config default.
+			getConfigSql(),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'INVALID_OTP_TOKEN' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('active TOTP + requiring policy → existing OTP_REQUIRED path (policy not consulted)', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const otpUri = 'otpauth://totp/contember:john?secret=ABCDEFG&period=30&digits=6&algorithm=SHA1&issuer=contember'
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'], otpUri } }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'OTP_REQUIRED' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+// A policy whose grace_duration is set opens a grace window: the person is let in
+// on the first hit, `mfa_grace_until` is anchored, and no enrollment is forced.
+const gracePolicy = () =>
+	getAuthPoliciesSql([{ id: testUuid(900), scope: 'global', roles: ['editor'], mfaRequired: true, graceDuration: '01:00:00' }])
+
+test('MFA required + per-policy grace → opens grace window, sets mfa_grace_until, signs in', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const apiKeyId = testUuid(1)
+	const projectId = testUuid(20)
+	await executeTenantTest({
+		query: signInWithMfa({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'] } }),
+			gracePolicy(),
+			getAllProjectRolesByIdentitySql({ identityId }),
+			// Per-policy grace override is present → the global config is NOT read here.
+			{
+				// Grace window opened: now (12:00) + 1h.
+				sql: SQL`update "tenant"."person" set "mfa_grace_until" = ? where "id" = ?`,
+				parameters: [new Date('2019-09-04 13:00'), personId],
+				response: { rowCount: 1 },
+			},
+			getConfigSql(),
+			getIdentityByIdSql({ identityId, roles: ['editor'] }),
+			gracePolicy(),
+			getAllProjectRolesByIdentitySql({ identityId }),
+			createSessionKeySql({ apiKeyId, identityId }),
+			{
+				// A19: the requiring policy is non-inert → session_policy_applied audit.
+				sql: `insert into  "tenant"."person_auth_log" ("id", "invoked_by_id", "type", "success", "metadata", "event_data") values  (?, ?, ?, ?, ?, ?)`,
+				parameters: [() => true, identityId, 'session_policy_applied', true, () => true, () => true],
+				response: { rowCount: 1 },
+			},
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
+		],
+		return: (response: any) => {
+			expect(response.data.signIn.ok).toBe(true)
+			expect(response.data.signIn.result.token).toBe('0000000000000000000000000000000000000000')
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('MFA required + no policy grace override → global config default opens the grace window', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const apiKeyId = testUuid(1)
+	const projectId = testUuid(20)
+	await executeTenantTest({
+		query: signInWithMfa({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'] } }),
+			requiringPolicy(),
+			getAllProjectRolesByIdentitySql({ identityId }),
+			// No per-policy override → the global config default is read; here it is
+			// non-zero (2h), so a grace window opens instead of forcing enrollment.
+			getConfigSql({ login_mfa_grace_duration: PostgresInterval('02:00:00') }),
+			{
+				sql: SQL`update "tenant"."person" set "mfa_grace_until" = ? where "id" = ?`,
+				parameters: [new Date('2019-09-04 14:00'), personId],
+				response: { rowCount: 1 },
+			},
+			getConfigSql(),
+			getIdentityByIdSql({ identityId, roles: ['editor'] }),
+			requiringPolicy(),
+			getAllProjectRolesByIdentitySql({ identityId }),
+			createSessionKeySql({ apiKeyId, identityId }),
+			{
+				sql: `insert into  "tenant"."person_auth_log" ("id", "invoked_by_id", "type", "success", "metadata", "event_data") values  (?, ?, ?, ?, ?, ?)`,
+				parameters: [() => true, identityId, 'session_policy_applied', true, () => true, () => true],
+				response: { rowCount: 1 },
+			},
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
+		],
+		return: (response: any) => {
+			expect(response.data.signIn.ok).toBe(true)
+			expect(response.data.signIn.result.token).toBe('0000000000000000000000000000000000000000')
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})