@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/tests/cases/integration/mocked/signInMutation.test.ts

@@ -1,17 +1,22 @@
-import { executeTenantTest, now } from '../../../src/testTenant'
-import { SQL } from '../../../src/tags'
-import { testUuid } from '../../../src/testUuid'
-import { selectMembershipsSql } from './sql/selectMembershipsSql'
-import { signInMutation } from './gql/signIn'
-import { getPersonByEmailSql } from './sql/getPersonByEmailSql'
-import { SignInErrorCode } from '../../../../src/schema'
+import { executeTenantTest, now } from '../../../src/testTenant.js'
+import { SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
+import { signInMutation } from './gql/signIn.js'
+import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { SignInErrorCode } from '../../../../src/schema/index.js'
 import { expect, test } from 'bun:test'
-import { OtpAuthenticator } from '../../../../src'
+import { OtpAuthenticator } from '../../../../src/index.js'
 import { Buffer } from 'buffer'
-import { createSessionKeySql } from './sql/createSessionKeySql'
-import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql'
-import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql'
-import { getConfigSql } from './sql/getConfigSql'
+import { createSessionKeySql } from './sql/createSessionKeySql.js'
+import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { consumeBackupCodeSql, countUnusedBackupCodesSql } from './sql/consumeBackupCodeSql.js'
+import { claimEmailOtpAttemptSql, consumeEmailOtpTokenSql, EMAIL_OTP_CODE, getLatestEmailOtpTokenSql, sendEmailOtpSql } from './sql/emailOtpSql.js'
+import { getMailTemplateSql } from './sql/getMailTemplateSql.js'
+import { getAuthPoliciesSql } from './sql/authPolicySql.js'
+import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
 
 test('signs in', async () => {
 	const email = 'john@doe.com'
@@ -23,9 +28,13 @@ test('signs in', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password }, { withData: true }),
 		executes: [
+			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			getAuthPoliciesSql(),
 			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
 			createSessionKeySql({ apiKeyId: apiKeyId, identityId: identityId }),
 			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
 			selectMembershipsSql({
@@ -81,10 +90,14 @@ test('signs in - normalize email', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password }),
 		executes: [
+			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: null }),
 			getPersonByEmailSql({ email: 'john@doe.com', response: { personId, identityId, password, roles: [] } }),
+			getAuthPoliciesSql(),
 			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
 			createSessionKeySql({ apiKeyId: apiKeyId, identityId: identityId }),
 			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
 			selectMembershipsSql({
@@ -121,9 +134,9 @@ test('sign in - invalid password', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password: 'abcd' }),
 		executes: [
+			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
-			getConfigSql(),
 		],
 		return: {
 			data: {
@@ -143,6 +156,83 @@ test('sign in - invalid password', async () => {
 	})
 })
 
+test('sign in - email not verified', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({
+				email,
+				response: { personId, identityId, password, roles: [], emailVerificationRequired: true, emailVerifiedAt: null },
+			}),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'EMAIL_NOT_VERIFIED' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		},
+	})
+})
+
+test('sign in - email verification required but already verified', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const projectId = testUuid(10)
+	const apiKeyId = testUuid(1)
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({
+				email,
+				response: { personId, identityId, password, roles: [], emailVerificationRequired: true, emailVerifiedAt: now },
+			}),
+			getAuthPoliciesSql(),
+			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
+			createSessionKeySql({ apiKeyId, identityId }),
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: true,
+					errors: [],
+					result: {
+						token: '0000000000000000000000000000000000000000',
+					},
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
+	})
+})
+
 test('otp token not provided', async () => {
 	const email = 'john@doe.com'
 	const password = '123'
@@ -151,6 +241,7 @@ test('otp token not provided', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password }),
 		executes: [
+			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({
 				email,
@@ -162,7 +253,6 @@ test('otp token not provided', async () => {
 					otpUri: 'otpauth://totp/contember:john?secret=ABCDEFG&period=30&digits=6&algorithm=SHA1&issuer=contember',
 				},
 			}),
-			getConfigSql(),
 		],
 		return: {
 			data: {
@@ -197,9 +287,9 @@ test('sign in - invalid otp token', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password, otpToken: '123456' }),
 		executes: [
+			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
-			getConfigSql(),
 		],
 		return: {
 			data: {
@@ -234,9 +324,12 @@ test('sign in - valid otp token', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password, otpToken: otpAuth.generate(otp) }),
 		executes: [
+			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
 			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
 			createSessionKeySql({ apiKeyId, identityId }),
 			getIdentityProjectsSql({ identityId, projectId }),
 			selectMembershipsSql({
@@ -264,3 +357,215 @@ test('sign in - valid otp token', async () => {
 		},
 	})
 })
+
+// Normalized 'abcdefghij' (formatted 'abcde-fghij'), hashed with sha256.
+const BACKUP_CODE = 'abcde-fghij'
+const BACKUP_CODE_HASH = '72399361da6a7754fec986dca5b7cbaf1c810a28ded4abaf56b2106d06cb78b0'
+
+test('sign in - valid backup code (when OTP is required)', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const otpAuth = new OtpAuthenticator({
+		now: () => now,
+		randomBytes: () => Promise.resolve(Buffer.alloc(20)),
+	})
+	const otp = await otpAuth.create('john', 'contember')
+	const apiKeyId = testUuid(1)
+	const projectId = testUuid(10)
+	await executeTenantTest({
+		query: signInMutation({ email, password, backupCode: BACKUP_CODE }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			consumeBackupCodeSql({ personId, codeHash: BACKUP_CODE_HASH, consumed: true }),
+			countUnusedBackupCodesSql({ personId, count: 4 }),
+			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
+			createSessionKeySql({ apiKeyId, identityId }),
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({
+				identityId,
+				projectId,
+				membershipsResponse: [],
+			}),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: true,
+					errors: [],
+					result: {
+						token: '0000000000000000000000000000000000000000',
+					},
+				},
+			},
+		},
+		expectedAuthLog: [
+			{
+				type: 'login',
+				response: expect.objectContaining({
+					ok: true,
+				}),
+			},
+			expect.objectContaining({
+				type: 'backup_code_used',
+				response: expect.objectContaining({
+					ok: true,
+				}),
+			}),
+		],
+	})
+})
+
+test('sign in - email OTP enabled, no code provided: dispatches a code and returns OTP_REQUIRED', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			// signIn lazily re-fetches the config to resolve the email-OTP send rate limit.
+			getConfigSql(),
+			...sendEmailOtpSql({ personId, rateLimitEventId: testUuid(1), tokenId: testUuid(2) }),
+			getMailTemplateSql({ type: 'emailOtp', projectId: null }),
+			getMailTemplateSql({ type: 'emailOtp', projectId: null }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'OTP_REQUIRED' }],
+					result: null,
+				},
+			},
+		},
+		sentMails: [{ subject: 'Your verification code' }],
+		expectedAuthLog: [
+			{
+				type: 'login',
+				response: expect.objectContaining({ ok: false }),
+			},
+			expect.objectContaining({
+				type: 'email_otp_sent',
+				response: expect.objectContaining({ ok: false }),
+			}),
+		],
+	})
+})
+
+test('sign in - email OTP enabled, valid code: signs in', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const tokenId = testUuid(50)
+	const apiKeyId = testUuid(1)
+	const projectId = testUuid(10)
+	await executeTenantTest({
+		query: signInMutation({ email, password, otpToken: EMAIL_OTP_CODE }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			getLatestEmailOtpTokenSql({ personId, tokenId }),
+			claimEmailOtpAttemptSql({ tokenId }),
+			consumeEmailOtpTokenSql({ tokenId }),
+			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
+			createSessionKeySql({ apiKeyId, identityId }),
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: true,
+					errors: [],
+					result: {
+						token: '0000000000000000000000000000000000000000',
+					},
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('sign in - email OTP enabled, invalid code: INVALID_OTP_TOKEN', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const tokenId = testUuid(50)
+	await executeTenantTest({
+		query: signInMutation({ email, password, otpToken: '111111' }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			getLatestEmailOtpTokenSql({ personId, tokenId }),
+			claimEmailOtpAttemptSql({ tokenId }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'INVALID_OTP_TOKEN' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('sign in - already-used backup code is rejected', async () => {
+	const email = 'john@doe.com'
+	const password = '123'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const otpAuth = new OtpAuthenticator({
+		now: () => now,
+		randomBytes: () => Promise.resolve(Buffer.alloc(20)),
+	})
+	const otp = await otpAuth.create('john', 'contember')
+	await executeTenantTest({
+		query: signInMutation({ email, password, backupCode: BACKUP_CODE }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			consumeBackupCodeSql({ personId, codeHash: BACKUP_CODE_HASH, consumed: false }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'INVALID_OTP_TOKEN' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		},
+	})
+})

package/tests/cases/integration/mocked/signInPasswordlessMutation.test.ts

@@ -0,0 +1,146 @@
+import { executeTenantTest, now } from '../../../src/testTenant.js'
+import { SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { expect, test } from 'bun:test'
+import { signInPasswordlessMutation } from './gql/passwordless.js'
+import { computeTokenHash } from '../../../../src/index.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
+import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { createSessionKeySql } from './sql/createSessionKeySql.js'
+import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
+import { getAuthPoliciesSql } from './sql/authPolicySql.js'
+
+const isDate = (val: unknown) => val instanceof Date
+
+const personTokenByIdSql = (args: {
+	requestId: string
+	personId: string
+	token: string
+}) => ({
+	sql: SQL`SELECT * FROM "tenant"."person_token" WHERE "id" = ? AND "type" = ?`,
+	parameters: [args.requestId, 'passwordless'],
+	response: {
+		rows: [
+			{
+				id: args.requestId,
+				token_hash: computeTokenHash(args.token),
+				person_id: args.personId,
+				created_at: now,
+				expires_at: new Date(now.getTime() + 60 * 60 * 1000),
+				used_at: null,
+				otp_hash: null,
+				otp_attempts: 0,
+				meta: null,
+			},
+		],
+	},
+})
+
+test('signInPasswordless - marks an unverified email verified before issuing the session', async () => {
+	const requestId = testUuid(1)
+	const personId = testUuid(2)
+	const identityId = testUuid(3)
+	const apiKeyId = testUuid(1)
+	const projectId = testUuid(10)
+	const token = 'passwordless-token'
+	await executeTenantTest({
+		query: signInPasswordlessMutation({ requestId, token, validationType: 'token' }),
+		executes: [
+			...sqlTransaction(
+				personTokenByIdSql({ requestId, personId, token }),
+				getPersonByIdSql({
+					personId,
+					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: null },
+				}),
+				{
+					sql: SQL`UPDATE "tenant"."person_token" SET "used_at" = ? WHERE "id" = ? AND "used_at" IS NULL`,
+					parameters: [isDate, requestId],
+					response: { rowCount: 1 },
+				},
+				{
+					sql: SQL`UPDATE "tenant"."person" SET "email_verified_at" = ? WHERE "id" = ?`,
+					parameters: [isDate, personId],
+					response: { rowCount: 1 },
+				},
+				getConfigSql(),
+				getIdentityByIdSql({ identityId }),
+				getAuthPoliciesSql(),
+				createSessionKeySql({ apiKeyId, identityId }),
+			),
+			// SignInResponseFactory resolves the signed-in identity's projects when
+			// building the response (no memberships follow because none are returned).
+			{
+				...getIdentityProjectsSql({ identityId, projectId }),
+				response: { rows: [] },
+			},
+		],
+		return: {
+			data: {
+				signInPasswordless: {
+					ok: true,
+					error: null,
+					result: {
+						token: expect.stringMatching(/\w+/),
+					},
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'passwordless_login',
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('signInPasswordless - skips the email-verified update when already verified', async () => {
+	const requestId = testUuid(1)
+	const personId = testUuid(2)
+	const identityId = testUuid(3)
+	const apiKeyId = testUuid(1)
+	const projectId = testUuid(10)
+	const token = 'passwordless-token'
+	await executeTenantTest({
+		query: signInPasswordlessMutation({ requestId, token, validationType: 'token' }),
+		executes: [
+			...sqlTransaction(
+				personTokenByIdSql({ requestId, personId, token }),
+				getPersonByIdSql({
+					personId,
+					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: now },
+				}),
+				{
+					sql: SQL`UPDATE "tenant"."person_token" SET "used_at" = ? WHERE "id" = ? AND "used_at" IS NULL`,
+					parameters: [isDate, requestId],
+					response: { rowCount: 1 },
+				},
+				getConfigSql(),
+				getIdentityByIdSql({ identityId }),
+				getAuthPoliciesSql(),
+				createSessionKeySql({ apiKeyId, identityId }),
+			),
+			// SignInResponseFactory resolves the signed-in identity's projects when
+			// building the response (no memberships follow because none are returned).
+			{
+				...getIdentityProjectsSql({ identityId, projectId }),
+				response: { rows: [] },
+			},
+		],
+		return: {
+			data: {
+				signInPasswordless: {
+					ok: true,
+					error: null,
+					result: {
+						token: expect.stringMatching(/\w+/),
+					},
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'passwordless_login',
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})