@nauth-toolkit/core 0.1.0 → 0.1.3

package/src/services/trusted-device.service.spec.ts

@@ -1,505 +0,0 @@
-import { Repository } from 'typeorm';
-import { TrustedDeviceService } from './trusted-device.service';
-import { BaseTrustedDevice } from '../entities/trusted-device.entity';
-import { NAuthConfig } from '../interfaces/config.interface';
-import { NAuthLogger } from '../utils/nauth-logger';
-
-/**
- * Trusted Device Service Unit Tests
- *
- * Tests device trust management for "remember device" feature.
- * Covers device creation, validation, revocation, and expiration handling.
- *
- * Platform-agnostic: Uses direct instantiation, no NestJS dependencies.
- */
-describe('TrustedDeviceService', () => {
-  let service: TrustedDeviceService;
-  let mockRepository: jest.Mocked<Repository<BaseTrustedDevice>>;
-  let mockLogger: jest.Mocked<NAuthLogger>;
-
-  const mockConfig: Partial<NAuthConfig> = {
-    mfa: {
-      enabled: true,
-      rememberDevices: 'user_opt_in',
-      rememberDeviceDays: 30,
-    },
-  };
-
-  const mockTrustedDevice: Partial<BaseTrustedDevice> = {
-    id: 1,
-    userId: 1,
-    deviceTokenHash: 'hashed-token-123',
-    deviceName: 'My Device',
-    deviceType: 'desktop',
-    ipAddress: '1.2.3.4',
-    userAgent: 'test-user-agent',
-    platform: 'Windows',
-    browser: 'Chrome',
-    trustedUntil: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000), // 30 days from now
-    lastUsedAt: new Date(),
-    createdAt: new Date(),
-  };
-
-  beforeEach(() => {
-    // Create mock repository
-    mockRepository = {
-      findOne: jest.fn(),
-      create: jest.fn(),
-      save: jest.fn(),
-      update: jest.fn(),
-      delete: jest.fn(),
-      find: jest.fn(),
-    } as any;
-
-    // Create mock logger
-    mockLogger = {
-      log: jest.fn(),
-      error: jest.fn(),
-      warn: jest.fn(),
-      debug: jest.fn(),
-    } as any;
-
-    // Instantiate service directly
-    service = new TrustedDeviceService(mockConfig as NAuthConfig, mockLogger, mockRepository);
-  });
-
-  afterEach(() => {
-    jest.clearAllMocks();
-    // Restore crypto.randomUUID if it was mocked
-    jest.restoreAllMocks();
-  });
-
-  // ============================================================================
-  // Service Initialization
-  // ============================================================================
-
-  it('should be defined', () => {
-    expect(service).toBeDefined();
-  });
-
-  // ============================================================================
-  // createTrustedDevice() Method
-  // ============================================================================
-
-  describe('createTrustedDevice', () => {
-    it('should create trusted device successfully', async () => {
-      mockRepository.findOne.mockResolvedValue(null);
-      mockRepository.create.mockReturnValue(mockTrustedDevice as any);
-      mockRepository.save.mockResolvedValue(mockTrustedDevice as any);
-
-      const result = await service.createTrustedDevice(
-        1,
-        'My Device',
-        'desktop',
-        '1.2.3.4',
-        'test-user-agent',
-        'Windows',
-        'Chrome',
-      );
-
-      // Verify result is a valid UUID format
-      expect(result).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
-      expect(mockRepository.create).toHaveBeenCalled();
-      expect(mockRepository.save).toHaveBeenCalled();
-    });
-
-    it('should throw error when rememberDevices is not enabled', async () => {
-      const configDisabled: Partial<NAuthConfig> = {
-        mfa: {
-          enabled: true,
-          rememberDevices: 'never',
-        },
-      };
-
-      const serviceDisabled = new TrustedDeviceService(configDisabled as NAuthConfig, mockLogger, mockRepository);
-
-      try {
-        await serviceDisabled.createTrustedDevice(1);
-        fail('Should have thrown Error');
-      } catch (error: any) {
-        expect(error.message).toContain('rememberDevices is not enabled');
-      }
-    });
-
-    it('should throw error when repository not available', async () => {
-      const serviceWithoutRepo = new TrustedDeviceService(mockConfig as NAuthConfig, mockLogger, undefined);
-
-      try {
-        await serviceWithoutRepo.createTrustedDevice(1);
-        fail('Should have thrown Error');
-      } catch (error: any) {
-        expect(error.message).toContain('TrustedDeviceRepository not available');
-      }
-    });
-
-    it('should update existing device if already trusted', async () => {
-      const existingDevice = { ...mockTrustedDevice };
-      // Calculate hash for the device token that will be generated
-      const createHash = (await import('crypto')).createHash;
-      // We'll verify the hash was calculated correctly by checking the update was called
-
-      mockRepository.findOne.mockResolvedValue(existingDevice as any);
-      mockRepository.update.mockResolvedValue({ affected: 1 } as any);
-
-      const result = await service.createTrustedDevice(1, 'Updated Device Name');
-
-      // Verify result is a valid UUID format
-      expect(result).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
-      expect(mockRepository.update).toHaveBeenCalled();
-      expect(mockRepository.create).not.toHaveBeenCalled();
-    });
-
-    it('should calculate expiry based on rememberDeviceDays', async () => {
-      const configWithDays: Partial<NAuthConfig> = {
-        mfa: {
-          enabled: true,
-          rememberDevices: 'user_opt_in',
-          rememberDeviceDays: 60,
-        },
-      };
-
-      const serviceWithDays = new TrustedDeviceService(configWithDays as NAuthConfig, mockLogger, mockRepository);
-
-      mockRepository.findOne.mockResolvedValue(null);
-      mockRepository.create.mockReturnValue(mockTrustedDevice as any);
-      mockRepository.save.mockResolvedValue(mockTrustedDevice as any);
-
-      await serviceWithDays.createTrustedDevice(1);
-
-      // Verify trustedUntil is set correctly (60 days from now)
-      const createCall = mockRepository.create.mock.calls[0][0] as any;
-      const expectedDate = new Date();
-      expectedDate.setDate(expectedDate.getDate() + 60);
-      expect(new Date(createCall.trustedUntil).getTime()).toBeCloseTo(expectedDate.getTime(), -3); // Within 1 second
-    });
-
-    it('should store all device information', async () => {
-      mockRepository.findOne.mockResolvedValue(null);
-      mockRepository.create.mockReturnValue(mockTrustedDevice as any);
-      mockRepository.save.mockResolvedValue(mockTrustedDevice as any);
-
-      await service.createTrustedDevice(1, 'My Device', 'desktop', '1.2.3.4', 'test-user-agent', 'Windows', 'Chrome');
-
-      expect(mockRepository.create).toHaveBeenCalledWith(
-        (expect as any).objectContaining({
-          userId: 1,
-          deviceName: 'My Device',
-          deviceType: 'desktop',
-          ipAddress: '1.2.3.4',
-          userAgent: 'test-user-agent',
-          platform: 'Windows',
-          browser: 'Chrome',
-        }),
-      );
-    });
-
-    it('should handle null/undefined device information', async () => {
-      mockRepository.findOne.mockResolvedValue(null);
-      mockRepository.create.mockReturnValue(mockTrustedDevice as any);
-      mockRepository.save.mockResolvedValue(mockTrustedDevice as any);
-
-      await service.createTrustedDevice(1, null, null, null, null, null, null);
-
-      expect(mockRepository.create).toHaveBeenCalledWith(
-        (expect as any).objectContaining({
-          deviceName: null,
-          deviceType: null,
-          ipAddress: null,
-          userAgent: null,
-          platform: null,
-          browser: null,
-        }),
-      );
-    });
-  });
-
-  // ============================================================================
-  // isDeviceTrusted() Method
-  // ============================================================================
-
-  describe('isDeviceTrusted', () => {
-    it('should return false when deviceToken is null', async () => {
-      const result = await service.isDeviceTrusted(null, 1);
-
-      expect(result).toBe(false);
-    });
-
-    it('should return false when deviceToken is undefined', async () => {
-      const result = await service.isDeviceTrusted(undefined, 1);
-
-      expect(result).toBe(false);
-    });
-
-    it('should return false when repository not available', async () => {
-      const serviceWithoutRepo = new TrustedDeviceService(mockConfig as NAuthConfig, mockLogger, undefined);
-
-      const result = await serviceWithoutRepo.isDeviceTrusted('token', 1);
-
-      expect(result).toBe(false);
-    });
-
-    it('should return false when rememberDevices is not enabled', async () => {
-      const configDisabled: Partial<NAuthConfig> = {
-        mfa: {
-          enabled: true,
-          rememberDevices: 'never',
-        },
-      };
-
-      const serviceDisabled = new TrustedDeviceService(configDisabled as NAuthConfig, mockLogger, mockRepository);
-
-      const result = await serviceDisabled.isDeviceTrusted('token', 1);
-
-      expect(result).toBe(false);
-    });
-
-    it('should return true when device is trusted and not expired', async () => {
-      const deviceToken = 'device-token-uuid-123';
-      const trustedDevice = {
-        ...mockTrustedDevice,
-        trustedUntil: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000), // Future date
-      };
-
-      mockRepository.findOne.mockResolvedValue(trustedDevice as any);
-
-      const result = await service.isDeviceTrusted(deviceToken, 1);
-
-      expect(result).toBe(true);
-    });
-
-    it('should return false when device not found', async () => {
-      const deviceToken = 'device-token-uuid-123';
-
-      mockRepository.findOne.mockResolvedValue(null);
-
-      const result = await service.isDeviceTrusted(deviceToken, 1);
-
-      expect(result).toBe(false);
-    });
-
-    it('should return false and delete when device expired', async () => {
-      const deviceToken = 'device-token-uuid-123';
-      const expiredDevice = {
-        ...mockTrustedDevice,
-        trustedUntil: new Date(Date.now() - 1000), // Past date
-      };
-
-      mockRepository.findOne.mockResolvedValue(expiredDevice as any);
-      mockRepository.delete.mockResolvedValue({ affected: 1 } as any);
-
-      const result = await service.isDeviceTrusted(deviceToken, 1);
-
-      expect(result).toBe(false);
-      expect(mockRepository.delete).toHaveBeenCalled();
-      expect(mockLogger.debug).toHaveBeenCalledWith((expect as any).stringContaining('Trusted device expired'));
-    });
-
-    it('should update lastUsedAt when device is trusted', async () => {
-      const deviceToken = 'device-token-uuid-123';
-      const trustedDevice = {
-        ...mockTrustedDevice,
-        trustedUntil: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
-        lastUsedAt: new Date(Date.now() - 20 * 60 * 1000), // 20 minutes ago
-      };
-
-      mockRepository.findOne.mockResolvedValue(trustedDevice as any);
-      mockRepository.update.mockResolvedValue({ affected: 1 } as any);
-
-      await service.isDeviceTrusted(deviceToken, 1);
-
-      expect(mockRepository.update).toHaveBeenCalled();
-    });
-
-    it('should throttle lastUsedAt updates to once per 15 minutes', async () => {
-      const deviceToken = 'device-token-uuid-123';
-      const trustedDevice = {
-        ...mockTrustedDevice,
-        trustedUntil: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
-        lastUsedAt: new Date(), // Just now
-      };
-
-      mockRepository.findOne.mockResolvedValue(trustedDevice as any);
-
-      await service.isDeviceTrusted(deviceToken, 1);
-
-      // Should not update if lastUsedAt is recent
-      expect(mockRepository.update).not.toHaveBeenCalled();
-    });
-  });
-
-  // ============================================================================
-  // validateDeviceToken() Method
-  // ============================================================================
-
-  describe('validateDeviceToken', () => {
-    it('should return not suspicious when token is null', async () => {
-      const result = await service.validateDeviceToken(null, 1);
-
-      expect(result).toEqual({ isValid: false, isSuspicious: false });
-    });
-
-    it('should return not suspicious when token is undefined', async () => {
-      const result = await service.validateDeviceToken(undefined, 1);
-
-      expect(result).toEqual({ isValid: false, isSuspicious: false });
-    });
-
-    it('should return valid and not suspicious when device is trusted', async () => {
-      const deviceToken = 'device-token-uuid-123';
-      const trustedDevice = {
-        ...mockTrustedDevice,
-        trustedUntil: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
-      };
-
-      mockRepository.findOne.mockResolvedValue(trustedDevice as any);
-
-      const result = await service.validateDeviceToken(deviceToken, 1);
-
-      expect(result).toEqual({ isValid: true, isSuspicious: false });
-    });
-
-    it('should return suspicious when token provided but not trusted', async () => {
-      const deviceToken = 'device-token-uuid-123';
-
-      mockRepository.findOne.mockResolvedValue(null);
-
-      const result = await service.validateDeviceToken(deviceToken, 1);
-
-      expect(result).toEqual({ isValid: false, isSuspicious: true });
-    });
-
-    it('should return suspicious when token provided but expired', async () => {
-      const deviceToken = 'device-token-uuid-123';
-      const expiredDevice = {
-        ...mockTrustedDevice,
-        trustedUntil: new Date(Date.now() - 1000),
-      };
-
-      mockRepository.findOne.mockResolvedValue(expiredDevice as any);
-      mockRepository.delete.mockResolvedValue({ affected: 1 } as any);
-
-      const result = await service.validateDeviceToken(deviceToken, 1);
-
-      expect(result).toEqual({ isValid: false, isSuspicious: true });
-    });
-  });
-
-  // ============================================================================
-  // revokeTrustedDevice() Method
-  // ============================================================================
-
-  describe('revokeTrustedDevice', () => {
-    it('should revoke trusted device successfully', async () => {
-      const deviceToken = 'device-token-uuid-123';
-
-      mockRepository.delete.mockResolvedValue({ affected: 1 } as any);
-
-      await service.revokeTrustedDevice(deviceToken, 1);
-
-      expect(mockRepository.delete).toHaveBeenCalled();
-      expect(mockLogger.debug).toHaveBeenCalledWith((expect as any).stringContaining('Revoked trusted device'));
-    });
-
-    it('should return early when repository not available', async () => {
-      const serviceWithoutRepo = new TrustedDeviceService(mockConfig as NAuthConfig, mockLogger, undefined);
-
-      await serviceWithoutRepo.revokeTrustedDevice('token', 1);
-
-      // Should not throw, just return early
-      expect(mockLogger.debug).not.toHaveBeenCalled();
-    });
-
-    it('should delete device by hash', async () => {
-      const deviceToken = 'device-token-uuid-123';
-      const createHash = (await import('crypto')).createHash;
-      const hash = createHash('sha256').update(deviceToken).digest('hex');
-
-      mockRepository.delete.mockResolvedValue({ affected: 1 } as any);
-
-      await service.revokeTrustedDevice(deviceToken, 1);
-
-      expect(mockRepository.delete).toHaveBeenCalledWith({
-        userId: 1,
-        deviceTokenHash: hash,
-      });
-    });
-  });
-
-  // ============================================================================
-  // getUserTrustedDevices() Method
-  // ============================================================================
-
-  describe('getUserTrustedDevices', () => {
-    it('should return user trusted devices', async () => {
-      const devices = [
-        { ...mockTrustedDevice, id: 1 },
-        { ...mockTrustedDevice, id: 2 },
-      ];
-
-      mockRepository.find.mockResolvedValue(devices as any);
-
-      const result = await service.getUserTrustedDevices(1);
-
-      expect(result.length).toBe(2);
-      expect('deviceTokenHash' in result[0]).toBe(false);
-      expect('deviceTokenHash' in result[1]).toBe(false);
-    });
-
-    it('should return empty array when repository not available', async () => {
-      const serviceWithoutRepo = new TrustedDeviceService(mockConfig as NAuthConfig, mockLogger, undefined);
-
-      const result = await serviceWithoutRepo.getUserTrustedDevices(1);
-
-      expect(result).toEqual([]);
-    });
-
-    it('should filter out expired devices', async () => {
-      const devices = [
-        { ...mockTrustedDevice, id: 1, trustedUntil: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000) },
-        { ...mockTrustedDevice, id: 2, trustedUntil: new Date(Date.now() - 1000) }, // Expired
-      ];
-
-      mockRepository.find.mockResolvedValue(devices as any);
-
-      const result = await service.getUserTrustedDevices(1);
-
-      expect(result.length).toBe(1);
-      expect(result[0].id).toBe(1);
-    });
-
-    it('should order devices by lastUsedAt DESC', async () => {
-      const devices = [
-        { ...mockTrustedDevice, id: 1, lastUsedAt: new Date('2025-01-01') },
-        { ...mockTrustedDevice, id: 2, lastUsedAt: new Date('2025-01-02') },
-      ];
-
-      mockRepository.find.mockResolvedValue(devices as any);
-
-      await service.getUserTrustedDevices(1);
-
-      expect(mockRepository.find).toHaveBeenCalledWith({
-        where: { userId: 1 },
-        order: { lastUsedAt: 'DESC' },
-      });
-    });
-
-    it('should exclude deviceTokenHash from results', async () => {
-      const devices = [
-        {
-          ...mockTrustedDevice,
-          id: 1,
-          deviceTokenHash: 'hash-123',
-          trustedUntil: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
-        },
-      ];
-
-      mockRepository.find.mockResolvedValue(devices as any);
-
-      const result = await service.getUserTrustedDevices(1);
-
-      expect('deviceTokenHash' in result[0]).toBe(false);
-      expect('id' in result[0]).toBe(true);
-      expect('userId' in result[0]).toBe(true);
-    });
-  });
-});