@oneuptime/common 12.0.21 → 12.0.23

package/Tests/Server/Services/UserAuthenticationService.test.ts

@@ -5,6 +5,7 @@ import UserService from "../../../Server/Services/UserService";
 import UserSessionService from "../../../Server/Services/UserSessionService";
 import UserTotpAuthService from "../../../Server/Services/UserTotpAuthService";
 import UserWebAuthnService from "../../../Server/Services/UserWebAuthnService";
+import UserTwoFactorBackupCodeService from "../../../Server/Services/UserTwoFactorBackupCodeService";
 import logger from "../../../Server/Utils/Logger";
 import User from "../../../Models/DatabaseModels/User";
 import Hostname from "../../../Types/API/Hostname";
@@ -191,6 +192,25 @@ describe("UserService -- master-admin authentication management", () => {
       return new PositiveNumber(0);
     });
 
+    /*
+     * getAuthenticationStatus also reads the user's remaining two factor
+     * BACKUP codes, which is a third table and therefore a third stub. Without
+     * it the real service reaches a repository that is not connected in this
+     * suite, and every test here fails with "Database not connected" rather
+     * than anything to do with what it was checking.
+     *
+     * Deliberately NOT folded into the two counts above -- backup codes are a
+     * way back in to an account whose factor is unreachable, not a factor.
+     * Common/Tests/Server/Services/UserTwoFactorBackupCodeAdminSurface.test.ts
+     * is what pins that distinction; here it only has to be stubbed.
+     */
+    getJestSpyOn(
+      UserTwoFactorBackupCodeService,
+      "countUnusedForUser",
+    ).mockImplementation(async (): Promise<number> => {
+      return 0;
+    });
+
     getJestSpyOn(DatabaseConfig, "getHost").mockImplementation(
       async (): Promise<Hostname> => {
         return new Hostname(TEST_HOSTNAME);
@@ -402,7 +422,7 @@ describe("UserService -- master-admin authentication management", () => {
       expect(status.hasPendingPasswordResetLink).toBe(true);
     });
 
-    test("returns only the four booleans -- never the password digest itself", async () => {
+    test("returns exactly the vetted fields -- never the password digest itself", async () => {
       /*
        * The whole reason this is a DTO rather than a selected row: the caller
        * is a master admin, whose props bypass column read permissions, so
@@ -433,6 +453,7 @@ describe("UserService -- master-admin authentication management", () => {
         "isEmailVerified",
         "isTwoFactorAuthEnabled",
         "twoFactorAuthStatus",
+        "unusedTwoFactorBackupCodeCount",
         "verifiedTwoFactorAuthMethodCount",
       ]);
 
@@ -452,6 +473,7 @@ describe("UserService -- master-admin authentication management", () => {
       expect(typeof status.hasPendingPasswordResetLink).toBe("boolean");
       expect(typeof status.twoFactorAuthStatus).toBe("string");
       expect(typeof status.verifiedTwoFactorAuthMethodCount).toBe("number");
+      expect(typeof status.unusedTwoFactorBackupCodeCount).toBe("number");
     });
 
     test("selects exactly the columns the row-derived fields come from", async () => {

package/Tests/Server/Services/UserTwoFactorAuthAdmin.test.ts

@@ -3,6 +3,7 @@ import UserService from "../../../Server/Services/UserService";
 import UserSessionService from "../../../Server/Services/UserSessionService";
 import UserTotpAuthService from "../../../Server/Services/UserTotpAuthService";
 import UserWebAuthnService from "../../../Server/Services/UserWebAuthnService";
+import UserTwoFactorBackupCodeService from "../../../Server/Services/UserTwoFactorBackupCodeService";
 import logger from "../../../Server/Utils/Logger";
 import User from "../../../Models/DatabaseModels/User";
 import ColumnLength from "../../../Types/Database/ColumnLength";
@@ -201,6 +202,26 @@ describe("UserService -- admin-controlled two factor auth", () => {
       return 0;
     });
 
+    /*
+     * resetTwoFactorAuth clears the user's two factor BACKUP codes as well as
+     * their authenticators -- a reset that left a printed list of recovery
+     * codes alive would not have revoked the second-factor material it exists
+     * to revoke. Un-stubbed, the real service reaches a repository this suite
+     * does not connect and every resetTwoFactorAuth test below fails with
+     * "Database not connected" rather than anything it was checking.
+     *
+     * That the delete HAPPENS, for the right user, and before the session
+     * revocation, is asserted in
+     * Common/Tests/Server/Services/UserTwoFactorBackupCodeAdminSurface.test.ts
+     * -- this file only has to let the method run.
+     */
+    getJestSpyOn(
+      UserTwoFactorBackupCodeService,
+      "deleteAllForUser",
+    ).mockImplementation(async (): Promise<void> => {
+      return undefined;
+    });
+
     /*
      * The two probes the DELETED guards used to make. They are stubbed rather
      * than left real so that "was this consulted at all?" is answerable, which