@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/tests/cases/unit/idp/oidcResponse.test.ts

@@ -0,0 +1,144 @@
+import { describe, expect, test } from 'bun:test'
+import { handleOIDCResponse } from '../../../../src/model/service/idp/providers/OIDCHelpers.js'
+import { IDPValidationError } from '../../../../src/model/service/idp/IDPValidationError.js'
+
+/** A stub openid-client whose `callback` yields the given id-token claims and `userinfo` the given object. */
+const stubClient = (idTokenClaims: Record<string, unknown>, userInfo?: Record<string, unknown>) =>
+	({
+		callback: async () => ({
+			access_token: 'access-token',
+			claims: () => idTokenClaims,
+		}),
+		userinfo: async () => userInfo ?? {},
+	}) as any
+
+const responseData = { parameters: {}, redirectUrl: 'https://app.example.com/cb' }
+
+describe('handleOIDCResponse — claim mapping', () => {
+	test('defaults: subject from `sub`, e-mail from `email`', async () => {
+		const client = stubClient({ sub: 'jan.pokusny@npi.cz', email: 'jan.pokusny@npi.cz', given_name: 'Jan' })
+		const result = await handleOIDCResponse(client, responseData)
+		expect(result.externalIdentifier).toBe('jan.pokusny@npi.cz')
+		expect(result.email).toBe('jan.pokusny@npi.cz')
+	})
+
+	test('maps the external identifier to a stable claim (oid) from a flat id_token', async () => {
+		const client = stubClient({ sub: 'jan.pokusny@npi.cz', email: 'jan.pokusny@npi.cz', oid: 'cf0f5802-4afa-42bf' })
+		const result = await handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'oid' } })
+		expect(result.externalIdentifier).toBe('cf0f5802-4afa-42bf')
+		expect(result.email).toBe('jan.pokusny@npi.cz')
+	})
+
+	test('unwraps userinfo claims nested under `attributes` (Apereo CAS shape)', async () => {
+		const client = stubClient(
+			{ sub: 'jan.pokusny@npi.cz' },
+			{
+				sub: 'jan.pokusny@npi.cz',
+				attributes: { oid: 'cf0f5802-4afa-42bf', email: 'jan.pokusny@npi.cz', given_name: 'Jan', family_name: 'Pokusný' },
+			},
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { externalIdentifier: 'oid', attributesKey: 'attributes' },
+		})
+		expect(result.externalIdentifier).toBe('cf0f5802-4afa-42bf')
+		expect(result.email).toBe('jan.pokusny@npi.cz')
+		expect(result.given_name).toBe('Jan')
+	})
+
+	test('dot-path mapping reaches into a nested claim without unwrapping', async () => {
+		const client = stubClient({ sub: 's', user: { id: 'nested-id' } })
+		const result = await handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'user.id' } })
+		expect(result.externalIdentifier).toBe('nested-id')
+	})
+
+	test('falls back to `sub` when the mapped subject claim is absent', async () => {
+		const client = stubClient({ sub: 'fallback-sub' })
+		const result = await handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'oid' } })
+		expect(result.externalIdentifier).toBe('fallback-sub')
+	})
+
+	test('email_verified is read from unwrapped attributes (string "true" accepted)', async () => {
+		const client = stubClient(
+			{ sub: 's' },
+			{ sub: 's', attributes: { email: 'a@b.cz', email_verified: 'true' } },
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { attributesKey: 'attributes' },
+		})
+		expect(result.emailVerified).toBe(true)
+	})
+})
+
+describe('handleOIDCResponse — externalIdentifier scalar guard', () => {
+	// The federation key is persisted and matched on the next sign-in; a non-scalar coerced via
+	// String() would collapse every user of the provider onto one key, so we fail closed.
+	test('rejects a mapped subject that is an object', async () => {
+		const client = stubClient({ sub: 's', obj: { a: 1 } })
+		await expect(handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'obj' } }))
+			.rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects a mapped subject that is an array', async () => {
+		const client = stubClient({ sub: 's', list: ['a', 'b'] })
+		await expect(handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'list' } }))
+			.rejects.toThrow(IDPValidationError)
+	})
+
+	test('accepts a numeric mapped subject, coercing it to its string form', async () => {
+		const client = stubClient({ sub: 's', uid: 12345 })
+		const result = await handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'uid' } })
+		expect(result.externalIdentifier).toBe('12345')
+	})
+
+	test('rejects a mapped subject that resolves to an empty string', async () => {
+		const client = stubClient({ sub: 's', oid: '' })
+		await expect(handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'oid' } }))
+			.rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects an empty `sub` on the default path', async () => {
+		const client = stubClient({ sub: '' })
+		await expect(handleOIDCResponse(client, responseData))
+			.rejects.toThrow(IDPValidationError)
+	})
+})
+
+describe('handleOIDCResponse — signed claims win over unwrapped attributes', () => {
+	// `attributes` come from the unsigned userinfo response; they must not override a claim already
+	// present in the signature-verified ID-token / userInfo merge.
+	test('a signed id_token `sub` is not overridden by an attributes-level `sub`', async () => {
+		const client = stubClient(
+			{ sub: 'signed-subject' },
+			{ sub: 'signed-subject', attributes: { sub: 'spoofed-subject', email: 'a@b.cz' } },
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { attributesKey: 'attributes' },
+		})
+		expect(result.externalIdentifier).toBe('signed-subject')
+	})
+
+	test('a top-level email_verified is not overridden by an attributes-level one', async () => {
+		const client = stubClient(
+			{ sub: 's' },
+			{ sub: 's', email_verified: false, attributes: { email: 'a@b.cz', email_verified: 'true' } },
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { attributesKey: 'attributes' },
+		})
+		expect(result.emailVerified).toBe(false)
+	})
+})
+
+describe('handleOIDCResponse — non-string email/name do not leak', () => {
+	// A non-string `email` claim must be dropped, not passed through `...source` — it would
+	// otherwise reach the by-e-mail lookup and crash normalizeEmail (TypeError -> 500).
+	test('a non-string e-mail claim is dropped to undefined, not leaked', async () => {
+		const client = stubClient({ sub: 's', email: ['a@b.cz', 'c@d.cz'] })
+		const result = await handleOIDCResponse(client, responseData)
+		expect(result.email).toBeUndefined()
+	})
+})

package/tests/cases/unit/idp/oidcRevalidate.test.ts

@@ -0,0 +1,177 @@
+import { describe, expect, test } from 'bun:test'
+import { errors } from 'openid-client'
+import { revalidateOIDC, tokenSetToSessionState } from '../../../../src/model/service/idp/providers/OIDCHelpers.js'
+import { IDPSessionState } from '../../../../src/model/service/idp/index.js'
+
+const session = (tokens: Record<string, unknown>, sessionId = 'sid-1'): IDPSessionState => ({ sessionId, tokens })
+
+describe('revalidateOIDC — refresh', () => {
+	test('valid: rotates the refresh token and returns fresh claims', async () => {
+		const client = {
+			refresh: async (token: string) => {
+				expect(token).toBe('refresh-old')
+				return {
+					refresh_token: 'refresh-new',
+					access_token: 'access-new',
+					id_token: 'id-new',
+					expires_at: 1_900_000_000,
+					claims: () => ({ sub: 'user-1', email: 'a@b.cz' }),
+				}
+			},
+		} as any
+
+		const result = await revalidateOIDC(client, 'refresh', session({ refresh_token: 'refresh-old' }))
+
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			expect(result.claims).toEqual({ sub: 'user-1', email: 'a@b.cz' })
+			expect(result.idpSession?.tokens?.refresh_token).toBe('refresh-new')
+			expect(result.idpSession?.sessionId).toBe('sid-1')
+			expect(result.idpSession?.expiresAt).toEqual(new Date(1_900_000_000 * 1000))
+		}
+	})
+
+	test('non-rotating IdP: refresh omits the refresh token → keep the stored one (no spurious revoke)', async () => {
+		// RFC 6749 §6 — a refresh response MAY omit refresh_token; the client keeps the old one.
+		const client = {
+			refresh: async (token: string) => {
+				expect(token).toBe('refresh-old')
+				return {
+					access_token: 'access-new',
+					expires_at: 1_900_000_000,
+					claims: () => ({ sub: 'user-1' }),
+				}
+			},
+		} as any
+
+		const result = await revalidateOIDC(client, 'refresh', session({ refresh_token: 'refresh-old', id_token: 'id-old' }))
+
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			// preserved from the stored session, not lost
+			expect(result.idpSession?.tokens?.refresh_token).toBe('refresh-old')
+			expect(result.idpSession?.tokens?.id_token).toBe('id-old')
+			expect(result.idpSession?.tokens?.access_token).toBe('access-new')
+		}
+	})
+
+	test('revoked: no refresh token stored', async () => {
+		const result = await revalidateOIDC({} as any, 'refresh', session({}))
+		expect(result).toEqual({ status: 'revoked', reason: 'no_refresh_token' })
+	})
+
+	test('revoked: IdP rejects the grant (invalid_grant)', async () => {
+		const client = {
+			refresh: async () => {
+				throw new errors.OPError({ error: 'invalid_grant' })
+			},
+		} as any
+		const result = await revalidateOIDC(client, 'refresh', session({ refresh_token: 'x' }))
+		expect(result).toEqual({ status: 'revoked', reason: 'invalid_grant' })
+	})
+
+	test('transient failure propagates (does NOT revoke)', async () => {
+		const client = {
+			refresh: async () => {
+				throw new Error('ECONNREFUSED')
+			},
+		} as any
+		await expect(revalidateOIDC(client, 'refresh', session({ refresh_token: 'x' }))).rejects.toThrow('ECONNREFUSED')
+	})
+})
+
+describe('revalidateOIDC — userinfo', () => {
+	test('valid: returns userinfo claims', async () => {
+		const client = {
+			userinfo: async (token: string) => {
+				expect(token).toBe('access-1')
+				return { sub: 'user-1', groups: ['admins'] }
+			},
+		} as any
+		const result = await revalidateOIDC(client, 'userinfo', session({ access_token: 'access-1' }))
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			expect(result.claims).toEqual({ sub: 'user-1', groups: ['admins'] })
+		}
+	})
+
+	test('revoked: no access token', async () => {
+		const result = await revalidateOIDC({} as any, 'userinfo', session({}))
+		expect(result).toEqual({ status: 'revoked', reason: 'no_access_token' })
+	})
+
+	test('revoked: bare 401 with no parseable error code', async () => {
+		// RFC 6750 allows a 401 without a `WWW-Authenticate` error param; openid-client then
+		// surfaces a non-standard `error` string. A 401 is still definitive → revoked.
+		const client = {
+			userinfo: async () => {
+				throw new errors.OPError({ error: 'expected 200 OK, got: 401 Unauthorized' }, { statusCode: 401 } as any)
+			},
+		} as any
+		const result = await revalidateOIDC(client, 'userinfo', session({ access_token: 'a' }))
+		expect(result).toEqual({ status: 'revoked', reason: 'userinfo_unauthorized' })
+	})
+
+	test('transient: a 503 from userinfo propagates (does NOT revoke)', async () => {
+		const client = {
+			userinfo: async () => {
+				throw new errors.OPError({ error: 'expected 200 OK, got: 503 Service Unavailable' }, { statusCode: 503 } as any)
+			},
+		} as any
+		await expect(revalidateOIDC(client, 'userinfo', session({ access_token: 'a' }))).rejects.toThrow()
+	})
+})
+
+describe('revalidateOIDC — introspection', () => {
+	test('valid when active', async () => {
+		const client = { introspect: async () => ({ active: true }) } as any
+		const result = await revalidateOIDC(client, 'introspection', session({ access_token: 'a' }))
+		expect(result.status).toBe('valid')
+	})
+
+	test('revoked when inactive', async () => {
+		const client = { introspect: async () => ({ active: false }) } as any
+		const result = await revalidateOIDC(client, 'introspection', session({ access_token: 'a' }))
+		expect(result).toEqual({ status: 'revoked', reason: 'inactive' })
+	})
+
+	test('a 401 from introspection is transient (client-auth/config), NOT a revoked token', async () => {
+		// Introspection reports revoked tokens with 200 `{active:false}`; a 401 means the
+		// client failed to authenticate to the introspection endpoint → must not log users out.
+		const client = {
+			introspect: async () => {
+				throw new errors.OPError({ error: 'expected 200 OK, got: 401 Unauthorized' }, { statusCode: 401 } as any)
+			},
+		} as any
+		await expect(revalidateOIDC(client, 'introspection', session({ access_token: 'a' }))).rejects.toThrow()
+	})
+})
+
+describe('tokenSetToSessionState', () => {
+	test('captures only present tokens and converts expiry to a Date', () => {
+		const state = tokenSetToSessionState({ refresh_token: 'r', expires_at: 1000 } as any, 'sid-2')
+		expect(state).toEqual({
+			sessionId: 'sid-2',
+			tokens: { refresh_token: 'r' },
+			expiresAt: new Date(1000 * 1000),
+		})
+	})
+
+	test('falls back to previous refresh/id tokens when the new token set omits them', () => {
+		const state = tokenSetToSessionState(
+			{ access_token: 'a-new', expires_at: 1000 } as any,
+			'sid-3',
+			{ refresh_token: 'r-old', id_token: 'i-old', access_token: 'a-old' },
+		)
+		expect(state.tokens).toEqual({ refresh_token: 'r-old', id_token: 'i-old', access_token: 'a-new' })
+	})
+
+	test('prefers the new tokens over the previous ones when both are present', () => {
+		const state = tokenSetToSessionState(
+			{ refresh_token: 'r-new', access_token: 'a-new' } as any,
+			'sid-4',
+			{ refresh_token: 'r-old' },
+		)
+		expect(state.tokens?.refresh_token).toBe('r-new')
+	})
+})

package/tests/cases/unit/loginRiskAnalyzer.test.ts

@@ -0,0 +1,206 @@
+import { describe, expect, test } from 'bun:test'
+import crypto from 'node:crypto'
+import { ipPrefix, LoginRiskAnalyzer, PriorLogin, RiskWeight } from '../../../src/index.js'
+
+const hash = (value: crypto.BinaryLike, algo: string) => crypto.createHash(algo).update(value).digest()
+const analyzer = new LoginRiskAnalyzer(hash)
+
+const policy = (overrides: Partial<{ enabled: boolean; historySize: number; emailThreshold: number; stepUpThreshold: number }> = {}) => ({
+	enabled: true,
+	historySize: 10,
+	emailThreshold: 1,
+	stepUpThreshold: 3,
+	...overrides,
+})
+
+const prior = (overrides: Partial<PriorLogin> = {}): PriorLogin => ({
+	geoCountry: 'CZ',
+	deviceFingerprint: 'fp-known',
+	ip: '10.0.0.5',
+	...overrides,
+})
+
+describe('LoginRiskAnalyzer.fingerprint', () => {
+	test('hashes the user-agent deterministically', () => {
+		const ua = 'Mozilla/5.0 (X11; Linux x86_64)'
+		expect(analyzer.fingerprint(ua)).toBe(crypto.createHash('sha256').update(ua).digest('hex'))
+	})
+
+	test('returns null for absent/empty UA', () => {
+		expect(analyzer.fingerprint(undefined)).toBeNull()
+		expect(analyzer.fingerprint(null)).toBeNull()
+		expect(analyzer.fingerprint('')).toBeNull()
+	})
+})
+
+describe('ipPrefix', () => {
+	test('coarsens IPv4 to /24', () => {
+		expect(ipPrefix('203.0.113.42')).toBe('203.0.113.0/24')
+		// same /24, different host → same prefix → treated as known
+		expect(ipPrefix('203.0.113.1')).toBe(ipPrefix('203.0.113.200'))
+	})
+
+	test('different /24 yields a different prefix', () => {
+		expect(ipPrefix('203.0.113.1')).not.toBe(ipPrefix('203.0.99.1'))
+	})
+
+	test('coarsens IPv6 to /48', () => {
+		expect(ipPrefix('2001:db8:abcd:1234::1')).toBe('2001:db8:abcd::/48')
+	})
+
+	test('IPv6 is canonicalized: case and leading zeros do not change the prefix', () => {
+		// Same /48 written upper-case / with leading zeros must map to one key, or the
+		// IP signal would falsely fire `new_ip_prefix` for a known network.
+		expect(ipPrefix('2001:DB8:ABCD::1')).toBe('2001:db8:abcd::/48')
+		expect(ipPrefix('2001:0db8:00ab::1')).toBe('2001:db8:ab::/48')
+		expect(ipPrefix('2001:0db8:00ab::1')).toBe(ipPrefix('2001:db8:ab:0:0:0:0:5'))
+	})
+
+	test('IPv6 :: compression is expanded consistently', () => {
+		// `2001:db8::1` and `2001:db8:0:0::5` are the same /48 → same key.
+		expect(ipPrefix('2001:db8::1')).toBe('2001:db8:0::/48')
+		expect(ipPrefix('2001:db8::1')).toBe(ipPrefix('2001:db8:0:0::5'))
+		// ...but a different third hextet is a different /48 → not collapsed.
+		expect(ipPrefix('2001:db8::1')).not.toBe(ipPrefix('2001:db8:1::1'))
+	})
+
+	test('unwraps IPv4-mapped IPv6', () => {
+		expect(ipPrefix('::ffff:203.0.113.42')).toBe('203.0.113.0/24')
+		// also the fully/partly expanded mapped form, not just the `::ffff:` shorthand.
+		expect(ipPrefix('0:0:0:0:0:ffff:203.0.113.42')).toBe('203.0.113.0/24')
+	})
+
+	test('a non-mapped IPv6 ending in :ffff:<dotted-quad> stays a /48, not a bogus /24', () => {
+		// The IPv4-mapped form requires the leading 80 bits to be zero. An address with
+		// a non-zero prefix that merely ends in `:ffff:1.2.3.4` (or NAT64 `64:ff9b::`)
+		// is a normal IPv6 address — it must coarsen to its /48, never collapse to the
+		// embedded dotted-quad's /24 (which would both miss real network changes and
+		// false-fire when the same /48 is written two ways).
+		expect(ipPrefix('2001:db8::ffff:1.2.3.4')).toBe('2001:db8:0::/48')
+		expect(ipPrefix('64:ff9b::ffff:1.2.3.4')).toBe('64:ff9b:0::/48')
+		expect(ipPrefix('64:ff9b::1.2.3.4')).toBe('64:ff9b:0::/48')
+		// ...and they must not collide with the genuine IPv4-mapped /24.
+		expect(ipPrefix('2001:db8::ffff:1.2.3.4')).not.toBe(ipPrefix('::ffff:1.2.3.4'))
+		// two different non-mapped /48s sharing a trailing dotted-quad stay distinct.
+		expect(ipPrefix('2001:db8::ffff:1.2.3.4')).not.toBe(ipPrefix('2001:dba::ffff:1.2.3.4'))
+	})
+
+	test('falls back to the raw value for an unparseable IPv6', () => {
+		// expandIpv6 rejects malformed input → ipPrefix returns a stable, lower-cased raw
+		// string (never throws, never mints a bogus prefix), and two distinct junk values
+		// do not collapse to one key.
+		expect(ipPrefix('1::2::3')).toBe('1::2::3')
+		expect(ipPrefix('2001:db8::g')).toBe('2001:db8::g')
+		expect(ipPrefix('1::2::3')).not.toBe(ipPrefix('4::5::6'))
+	})
+
+	test('returns null for empty/null', () => {
+		expect(ipPrefix(null)).toBeNull()
+		expect(ipPrefix('')).toBeNull()
+		expect(ipPrefix('   ')).toBeNull()
+	})
+})
+
+describe('LoginRiskAnalyzer.score', () => {
+	test('no history → no signals, allow (first login is trusted)', () => {
+		const result = analyzer.score({ geoCountry: 'US', deviceFingerprint: 'fp-new', ip: '198.51.100.7' }, [], policy())
+		expect(result).toEqual({ score: 0, action: 'allow', reasons: [] })
+	})
+
+	test('all signals match a prior login → score 0, allow', () => {
+		const history = [prior()]
+		const result = analyzer.score({ geoCountry: 'CZ', deviceFingerprint: 'fp-known', ip: '10.0.0.99' }, history, policy())
+		expect(result.score).toBe(0)
+		expect(result.action).toBe('allow')
+		expect(result.reasons).toEqual([])
+	})
+
+	test('new country alone is high → step-up at default thresholds', () => {
+		const history = [prior()]
+		const result = analyzer.score({ geoCountry: 'US', deviceFingerprint: 'fp-known', ip: '10.0.0.5' }, history, policy())
+		expect(result.score).toBe(RiskWeight.newCountry)
+		expect(result.reasons).toEqual(['new_country'])
+		expect(result.action).toBe('stepUp')
+	})
+
+	test('new device alone is medium → email (below step-up threshold)', () => {
+		const history = [prior()]
+		const result = analyzer.score({ geoCountry: 'CZ', deviceFingerprint: 'fp-new', ip: '10.0.0.5' }, history, policy())
+		expect(result.score).toBe(RiskWeight.newDevice)
+		expect(result.reasons).toEqual(['new_device'])
+		expect(result.action).toBe('email')
+	})
+
+	test('new IP prefix alone is low → email', () => {
+		const history = [prior({ ip: '10.0.0.5' })]
+		const result = analyzer.score({ geoCountry: 'CZ', deviceFingerprint: 'fp-known', ip: '203.0.113.9' }, history, policy())
+		expect(result.score).toBe(RiskWeight.newIpPrefix)
+		expect(result.reasons).toEqual(['new_ip_prefix'])
+		expect(result.action).toBe('email')
+	})
+
+	test('signals are cumulative across signals', () => {
+		const history = [prior()]
+		const result = analyzer.score({ geoCountry: 'US', deviceFingerprint: 'fp-new', ip: '203.0.113.9' }, history, policy())
+		expect(result.score).toBe(RiskWeight.newCountry + RiskWeight.newDevice + RiskWeight.newIpPrefix)
+		expect(result.reasons).toEqual(['new_country', 'new_device', 'new_ip_prefix'])
+		expect(result.action).toBe('stepUp')
+	})
+
+	test('a signal with no baseline in history does not fire (cold start)', () => {
+		// History exists, but no prior login ever recorded a country or a device
+		// fingerprint (those columns were null before the feature/geo header was
+		// turned on). With nothing to deviate from, neither signal may fire —
+		// otherwise enabling the feature would step-up every returning user's first
+		// login. Only the IP signal has a baseline here, and it matches → allow.
+		const history: PriorLogin[] = [
+			{ geoCountry: null, deviceFingerprint: null, ip: '10.0.0.5' },
+			{ geoCountry: null, deviceFingerprint: null, ip: '10.0.0.6' },
+		]
+		const result = analyzer.score({ geoCountry: 'US', deviceFingerprint: 'fp-new', ip: '10.0.0.9' }, history, policy())
+		expect(result.reasons).toEqual([])
+		expect(result.score).toBe(0)
+		expect(result.action).toBe('allow')
+	})
+
+	test('a signal fires once a baseline for it exists, even when other rows are null', () => {
+		// One prior login carries a country; the rest are null. A different current
+		// country is now genuinely new because there is a baseline to deviate from.
+		const history: PriorLogin[] = [
+			{ geoCountry: null, deviceFingerprint: 'fp-known', ip: '10.0.0.5' },
+			{ geoCountry: 'CZ', deviceFingerprint: null, ip: '10.0.0.6' },
+		]
+		const result = analyzer.score({ geoCountry: 'US', deviceFingerprint: 'fp-known', ip: '10.0.0.5' }, history, policy())
+		expect(result.reasons).toEqual(['new_country'])
+		expect(result.score).toBe(RiskWeight.newCountry)
+	})
+
+	test('a value known from ANY prior login does not fire', () => {
+		// country only ever seen on login A, device only on login B → both known.
+		const history = [
+			prior({ geoCountry: 'DE', deviceFingerprint: 'fp-a', ip: '10.1.0.1' }),
+			prior({ geoCountry: 'CZ', deviceFingerprint: 'fp-b', ip: '10.2.0.1' }),
+		]
+		const result = analyzer.score({ geoCountry: 'CZ', deviceFingerprint: 'fp-a', ip: '10.3.0.1' }, history, policy())
+		expect(result.reasons).toEqual(['new_ip_prefix'])
+	})
+
+	test('absent current country never fires the country signal', () => {
+		const history = [prior({ geoCountry: 'CZ' })]
+		const result = analyzer.score({ geoCountry: null, deviceFingerprint: 'fp-known', ip: '10.0.0.5' }, history, policy())
+		expect(result.reasons).not.toContain('new_country')
+		expect(result.score).toBe(0)
+	})
+
+	test('thresholds are honored: a higher email threshold suppresses the email action', () => {
+		const history = [prior()]
+		// new device = 2; with emailThreshold 3, that is below → allow.
+		const result = analyzer.score(
+			{ geoCountry: 'CZ', deviceFingerprint: 'fp-new', ip: '10.0.0.5' },
+			history,
+			policy({ emailThreshold: 3, stepUpThreshold: 5 }),
+		)
+		expect(result.score).toBe(2)
+		expect(result.action).toBe('allow')
+	})
+})