@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/open-redirect-db.test.ts

@@ -1,143 +0,0 @@
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-import { sameOriginRedirectPath } from '../server/utils/same-origin-redirect'
-
-const { Privilege } = loadCompiled('service/privilege/privilege')
-const { Role } = loadCompiled('service/role/role')
-const { User, UserStatus } = loadCompiled('service/user/user')
-const { authCheckinRouter } = loadCompiled('router/auth-checkin-router')
-
-/**
- * `/auth/checkin?redirect_to=` must not send the browser to another host.
- *
- * Every sign-in ends there: the 401 redirect, the sign-in form and the WebAuthn sign-in all hand
- * their `redirect_to` to the check-in page, and the check-in page is where `context.redirect` runs.
- * So a link like `https://our-host/auth/checkin?redirect_to=https://elsewhere` used to show our
- * login page and then land on `elsewhere` — the open redirect this file closes.
- *
- * The first half drives the real route with the value an attacker would write, because a test of
- * the helper alone would stay green if the route stopped calling it. The second half pins the
- * helper's reading of the shapes a browser treats as "another host".
- *
- * ⚠ Fixed-domain mode (`config.subdomain`) is read once when shell loads, so this suite runs the
- * path-domain branch only. The helper runs before either branch, so both see the same value.
- */
-
-const OUR_HOST = 'ex.test'
-
-let acme: any
-let person: any
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  acme = await getRepository(Domain).save({ name: 'acme', subdomain: 'acme' })
-  const seeing = await getRepository(Privilege).save({ name: 'query', category: 'board' })
-  const role = await getRepository(Role).save({ name: 'viewer', domain: { id: acme.id }, privileges: [seeing] })
-
-  const saved = await getRepository(User).save({
-    username: 'kim@acme.z',
-    email: 'kim@acme.z',
-    name: 'kim',
-    status: UserStatus.ACTIVATED,
-    domains: [{ id: acme.id }],
-    roles: [role]
-  })
-  person = await getRepository(User).findOne({ where: { id: saved.id }, relations: ['domains', 'roles'] })
-})
-
-/** Runs `GET /auth/checkin` the way a browser following a link would, and returns where it sent it. */
-async function checkinRedirectsTo(redirectTo: string): Promise<string> {
-  const layer = authCheckinRouter.stack.find((layer: any) => layer.path === '/auth/checkin/:subdomain?')
-  const redirect = jest.fn()
-  const render = jest.fn()
-
-  const context: any = {
-    method: 'GET',
-    host: OUR_HOST,
-    href: `http://${OUR_HOST}/auth/checkin`,
-    header: {},
-    headers: {},
-    request: { header: { accept: 'text/html' } },
-    req: { headers: {}, connection: { remoteAddress: '127.0.0.1' } },
-    t: (key: string) => key,
-    state: { user: person },
-    params: {},
-    query: { redirect_to: redirectTo },
-    redirect,
-    render
-  }
-
-  await layer.stack[layer.stack.length - 1](context, async () => {})
-
-  expect(render).not.toHaveBeenCalled()
-  expect(redirect).toHaveBeenCalledTimes(1)
-  return redirect.mock.calls[0][0]
-}
-
-describe('GET /auth/checkin with a single domain', () => {
-  it('still goes where it was asked, on this host', async () => {
-    const target = new URL(await checkinRedirectsTo('/domain/acme/board-list?x=1'))
-
-    expect(target.host).toBe(OUR_HOST)
-    expect(target.pathname + target.search).toBe('/domain/acme/board-list?x=1')
-  })
-
-  it.each([
-    'https://evil.example/steal',
-    '//evil.example/steal',
-    '/\\evil.example/steal',
-    'https:evil.example',
-    '\t//evil.example'
-  ])('does not leave this host for %j', async redirectTo => {
-    const target = new URL(await checkinRedirectsTo(redirectTo))
-
-    expect(target.host).toBe(OUR_HOST)
-  })
-})
-
-describe('sameOriginRedirectPath', () => {
-  const context = { host: OUR_HOST, headers: {} }
-
-  it.each([
-    ['/domain/acme/x?y=1#z', '/domain/acme/x?y=1#z'],
-    [`http://${OUR_HOST}/domain/acme/x`, '/domain/acme/x'],
-    ['board-list', '/board-list']
-  ])('keeps %j on this site as %j', (value, path) => {
-    expect(sameOriginRedirectPath(value, context)).toBe(path)
-  })
-
-  it('keeps an absolute URL on the host the proxy says we are', () => {
-    expect(sameOriginRedirectPath('https://public.example/x', { host: 'internal:3000', headers: { 'x-forwarded-host': 'public.example' } })).toBe('/x')
-  })
-
-  it.each([
-    'https://evil.example/x',
-    '//evil.example/x',
-    '/\\evil.example/x',
-    'https:evil.example/x',
-    '\t//evil.example/x',
-    '/\t/evil.example/x',
-    'javascript:alert(1)',
-    `ftp://${OUR_HOST}/x`
-  ])('sends %j home', value => {
-    expect(sameOriginRedirectPath(value, context)).toBe('/')
-  })
-
-  it('does not return a path a browser reads as a host', () => {
-    /* `/.//evil.example` resolves on our origin to the path `//evil.example`. */
-    expect(sameOriginRedirectPath('/.//evil.example', context)).toBe('/evil.example')
-  })
-
-  it.each([undefined, '', '   ', ['/a', '/b']])('sends %j home', value => {
-    expect(sameOriginRedirectPath(value, context)).toBe('/')
-  })
-})

package/tests/passkey-authenticator.ts

@@ -1,104 +0,0 @@
-/**
- * A passkey authenticator in software, for the tests.
- *
- * It answers registration and sign-in the way a browser hands them to the server - the same JSON
- * `@simplewebauthn/browser` produces - with an ES256 key held here. `userVerified` sets the UV flag:
- * the authenticator saying it checked a fingerprint, face or PIN. Nothing here verifies anything;
- * that is the server's part, and the tests watch the server.
- */
-
-import { createHash, generateKeyPairSync, randomBytes, sign as signData, type KeyObject } from 'crypto'
-
-const { isoCBOR } = require('@simplewebauthn/server/helpers')
-
-const FLAG_UP = 0x01
-const FLAG_UV = 0x04
-const FLAG_AT = 0x40
-
-const b64url = (bytes: Uint8Array | Buffer) => Buffer.from(bytes).toString('base64url')
-const sha256 = (data: Buffer | string) => createHash('sha256').update(data).digest()
-
-export type Site = { rpID: string; origin: string }
-
-export class SoftwareAuthenticator {
-  readonly credentialId = randomBytes(16)
-  private readonly privateKey: KeyObject
-  private readonly publicJwk: { x: string; y: string }
-  private counter = 0
-
-  constructor() {
-    const { privateKey, publicKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' })
-    this.privateKey = privateKey
-    this.publicJwk = publicKey.export({ format: 'jwk' }) as any
-  }
-
-  get id(): string {
-    return b64url(this.credentialId)
-  }
-
-  private authenticatorData(site: Site, flags: number, attested?: Buffer): Buffer {
-    const count = Buffer.alloc(4)
-    count.writeUInt32BE(this.counter)
-    return Buffer.concat([sha256(site.rpID), Buffer.from([flags]), count, ...(attested ? [attested] : [])])
-  }
-
-  private clientData(type: string, challenge: string, site: Site): Buffer {
-    return Buffer.from(JSON.stringify({ type, challenge, origin: site.origin, crossOrigin: false }))
-  }
-
-  /** The browser's answer to `navigator.credentials.create`. */
-  register(challenge: string, site: Site, { userVerified = true } = {}) {
-    const cose = new Map<number, number | Uint8Array>([
-      [1, 2],
-      [3, -7],
-      [-1, 1],
-      [-2, new Uint8Array(Buffer.from(this.publicJwk.x, 'base64url'))],
-      [-3, new Uint8Array(Buffer.from(this.publicJwk.y, 'base64url'))]
-    ])
-    const idLength = Buffer.alloc(2)
-    idLength.writeUInt16BE(this.credentialId.length)
-    const attested = Buffer.concat([Buffer.alloc(16), idLength, this.credentialId, Buffer.from(isoCBOR.encode(cose))])
-
-    const authData = this.authenticatorData(site, FLAG_UP | FLAG_AT | (userVerified ? FLAG_UV : 0), attested)
-    const attestationObject = isoCBOR.encode(
-      new Map<string, unknown>([
-        ['fmt', 'none'],
-        ['attStmt', new Map()],
-        ['authData', new Uint8Array(authData)]
-      ])
-    )
-
-    return {
-      id: this.id,
-      rawId: this.id,
-      type: 'public-key',
-      clientExtensionResults: {},
-      response: {
-        clientDataJSON: b64url(this.clientData('webauthn.create', challenge, site)),
-        attestationObject: b64url(attestationObject),
-        transports: ['internal', 'hybrid']
-      }
-    }
-  }
-
-  /** The browser's answer to `navigator.credentials.get`. */
-  assert(challenge: string, site: Site, { userVerified = true } = {}) {
-    this.counter++
-    const authData = this.authenticatorData(site, FLAG_UP | (userVerified ? FLAG_UV : 0))
-    const clientDataJSON = this.clientData('webauthn.get', challenge, site)
-    const signature = signData('sha256', Buffer.concat([authData, sha256(clientDataJSON)]), this.privateKey)
-
-    return {
-      id: this.id,
-      rawId: this.id,
-      type: 'public-key',
-      clientExtensionResults: {},
-      response: {
-        authenticatorData: b64url(authData),
-        clientDataJSON: b64url(clientDataJSON),
-        signature: b64url(signature),
-        userHandle: null
-      }
-    }
-  }
-}

package/tests/passkey-db.test.ts

@@ -1,295 +0,0 @@
-/**
- * Passkeys (ADR-0156) - registration, sign-in, confirmation and the caller's own list, through the
- * real controllers and resolvers on the sqlite harness. The authenticator is software
- * (`passkey-authenticator.ts`); what is watched is what the server accepts and what it writes.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase, authDataSource } from './db'
-import { loadCompiled } from './compiled'
-import { SoftwareAuthenticator } from './passkey-authenticator'
-
-const { User } = loadCompiled('service/user/user')
-const { WebAuthCredential } = loadCompiled('service/web-auth-credential/web-auth-credential')
-const { WebAuthCredentialQuery } = loadCompiled('service/web-auth-credential/web-auth-credential-query')
-const { WebAuthCredentialMutation } = loadCompiled('service/web-auth-credential/web-auth-credential-mutation')
-const { AuditAction } = loadCompiled('service/audit/audit-action')
-const { flushAudit } = loadCompiled('service/audit/audit-recorder')
-const passkey = loadCompiled('controllers/passkey')
-
-const SITE = { rpID: 'localhost', origin: 'http://localhost:3000' }
-const PASSWORD = 'Passw0rd!'
-
-let domain: any
-let kim: any
-let lee: any
-
-async function seedUser(username: string, overrides: any = {}) {
-  const salt = User.generateSalt()
-  return await getRepository(User).save({
-    username,
-    email: `${username}@example.com`,
-    name: username,
-    salt,
-    password: User.encode(PASSWORD, salt),
-    status: 'activated',
-    domains: [domain],
-    ...overrides
-  })
-}
-
-/** A challenge the way the router makes one: from the options, into the session, taken back out. */
-async function signinChallenge(): Promise<string> {
-  const context: any = { session: {} }
-  passkey.rememberChallenge(context, (await passkey.signinOptions(SITE)).challenge)
-  return passkey.takeChallenge(context)
-}
-
-async function registered(user: any, name = 'macOS · Chrome') {
-  const authenticator = new SoftwareAuthenticator()
-  const { challenge } = await passkey.registrationOptions(user, 'Operato', SITE)
-  await passkey.registerPasskey(user, authenticator.register(challenge, SITE), name, challenge, SITE)
-  return authenticator
-}
-
-async function signinWith(authenticator: SoftwareAuthenticator, options: { userVerified?: boolean } = {}) {
-  const challenge = await signinChallenge()
-  return await passkey.signinWithPasskey(authenticator.assert(challenge, SITE, options), challenge, SITE)
-}
-
-const credentialOf = (authenticator: SoftwareAuthenticator) =>
-  getRepository(WebAuthCredential).findOne({ where: { credentialId: authenticator.id }, withDeleted: true })
-
-async function signinAudits() {
-  await flushAudit()
-  const rows = await getRepository(AuditAction).find({ where: { kind: 'auth.signin' }, relations: ['actor'], order: { createdAt: 'ASC' } })
-  return rows.map(row => [row.outcome, row.code, row.actor?.id ?? null, row.detail?.method])
-}
-
-function context(user: any) {
-  return { state: { user, tx: authDataSource().manager } } as any
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  domain = await getRepository(Domain).save({ name: 'factory', subdomain: 'factory' })
-  kim = await seedUser('kim')
-  lee = await seedUser('lee')
-})
-
-describe('what the browser is asked (decision 2)', () => {
-  it('registration needs a discoverable passkey and a verified person, and leaves the authenticator to the browser', async () => {
-    const options = await passkey.registrationOptions(kim, 'Operato', SITE)
-
-    expect(options.authenticatorSelection).toEqual({ residentKey: 'required', requireResidentKey: true, userVerification: 'required' })
-    expect(options.authenticatorSelection.authenticatorAttachment).toBeUndefined()
-  })
-
-  it('sign-in names no passkey and needs a verified person', async () => {
-    const options = await passkey.signinOptions(SITE)
-
-    expect(options.userVerification).toBe('required')
-    expect(options.allowCredentials ?? []).toEqual([])
-  })
-
-  it('registration lists what this person already has, so the browser can say so', async () => {
-    const authenticator = await registered(kim)
-    const options = await passkey.registrationOptions(kim, 'Operato', SITE)
-
-    expect(options.excludeCredentials.map(c => c.id)).toEqual([authenticator.id])
-  })
-})
-
-describe('a challenge answers once', () => {
-  it('is gone from the session after it is taken', () => {
-    const context: any = { session: {} }
-    passkey.rememberChallenge(context, 'abc')
-
-    expect(passkey.takeChallenge(context)).toBe('abc')
-    expect(() => passkey.takeChallenge(context)).toThrow('authn verification failed')
-  })
-
-  it('an answer to another challenge is refused', async () => {
-    const authenticator = await registered(kim)
-    const challenge = await signinChallenge()
-    const answer = authenticator.assert(challenge, SITE)
-
-    await expect(passkey.signinWithPasskey(answer, await signinChallenge(), SITE)).rejects.toThrow('authn verification failed')
-  })
-})
-
-describe('registration', () => {
-  it('keeps the passkey with its name and how it can be reached', async () => {
-    const authenticator = await registered(kim, '  macOS · Chrome  ')
-    const credential = await credentialOf(authenticator)
-
-    expect(credential.userId).toBe(kim.id)
-    expect(credential.name).toBe('macOS · Chrome')
-    expect(credential.transports).toEqual(['internal', 'hybrid'])
-  })
-
-  it('refuses a passkey made without verifying the person', async () => {
-    const authenticator = new SoftwareAuthenticator()
-    const { challenge } = await passkey.registrationOptions(kim, 'Operato', SITE)
-
-    await expect(
-      passkey.registerPasskey(kim, authenticator.register(challenge, SITE, { userVerified: false }), 'x', challenge, SITE)
-    ).rejects.toThrow('authn verification failed')
-    expect(await credentialOf(authenticator)).toBeNull()
-  })
-})
-
-describe('signing in (decisions 2 and 4)', () => {
-  it('signs the owner in, moves the counter on and notes when it was used', async () => {
-    const authenticator = await registered(kim)
-
-    const answer = await signinWith(authenticator)
-    const credential = await credentialOf(authenticator)
-
-    expect(answer.user.id).toBe(kim.id)
-    expect(answer.token).toEqual(expect.any(String))
-    expect(credential.counter).toBe(1)
-    expect(credential.lastUsedAt).toBeInstanceOf(Date)
-    expect(await signinAudits()).toEqual([['ok', null, kim.id, 'passkey']])
-  })
-
-  it('refuses an answer without a verified person, and the audit names the owner', async () => {
-    const authenticator = await registered(kim)
-
-    await expect(signinWith(authenticator, { userVerified: false })).rejects.toThrow('authn verification failed')
-    expect((await credentialOf(authenticator)).lastUsedAt).toBeNull()
-    expect(await signinAudits()).toEqual([['error', 'authn verification failed', kim.id, 'passkey']])
-  })
-
-  it('refuses a passkey nobody registered, and the audit names nobody', async () => {
-    await expect(signinWith(new SoftwareAuthenticator())).rejects.toThrow('authn verification failed')
-    expect(await signinAudits()).toEqual([['error', 'authn verification failed', null, 'passkey']])
-  })
-
-  it('refuses a removed passkey', async () => {
-    const authenticator = await registered(kim)
-    await getRepository(WebAuthCredential).softDelete({ credentialId: authenticator.id })
-
-    await expect(signinWith(authenticator)).rejects.toThrow('authn verification failed')
-  })
-
-  it('a locked account stays locked - the passkey neither lifts the lock nor counts as a failure', async () => {
-    const authenticator = await registered(kim)
-    await getRepository(User).update({ id: kim.id }, { status: 'locked', lockedAt: new Date(), failCount: 5 })
-
-    await expect(signinWith(authenticator)).rejects.toThrow('user-locked')
-
-    const after = await getRepository(User).findOneBy({ id: kim.id })
-    expect([after.status, after.failCount]).toEqual(['locked', 5])
-    expect((await credentialOf(authenticator)).lastUsedAt).toBeNull()
-  })
-
-  it('a lock that has run out lifts, the same as for a password', async () => {
-    const authenticator = await registered(kim)
-    await getRepository(User).update({ id: kim.id }, { status: 'locked', lockedAt: new Date(Date.now() - 24 * 60 * 60 * 1000), failCount: 5 })
-
-    await signinWith(authenticator)
-
-    const after = await getRepository(User).findOneBy({ id: kim.id })
-    expect([after.status, after.failCount]).toEqual(['activated', 0])
-  })
-
-  it('a deleted or inactive account is refused', async () => {
-    const authenticator = await registered(kim)
-
-    await getRepository(User).update({ id: kim.id }, { status: 'deleted' })
-    await expect(signinWith(authenticator)).rejects.toThrow('user-deleted')
-
-    await getRepository(User).update({ id: kim.id }, { status: 'inactive' })
-    await expect(signinWith(authenticator)).rejects.toThrow('user not activated')
-  })
-})
-
-describe('confirming it is the signed-in person', () => {
-  async function reverify(user: any, authenticator: SoftwareAuthenticator) {
-    const options = await passkey.reverifyOptions(user, SITE)
-    return await passkey.reverifyWithPasskey(user, authenticator.assert(options.challenge, SITE), options.challenge, SITE)
-  }
-
-  it("answers with the person's own passkey", async () => {
-    const authenticator = await registered(kim)
-
-    await expect(reverify(kim, authenticator)).resolves.toBeUndefined()
-  })
-
-  it("refuses somebody else's passkey", async () => {
-    await registered(kim)
-    const lees = await registered(lee)
-
-    await expect(reverify(kim, lees)).rejects.toThrow('authn verification failed')
-  })
-
-  it('has nothing to ask of a person without a passkey', async () => {
-    expect(await passkey.reverifyOptions(kim, SITE)).toBeNull()
-  })
-})
-
-describe("the caller's own passkeys (decision 6)", () => {
-  const query = new WebAuthCredentialQuery()
-  const mutation = new WebAuthCredentialMutation()
-
-  it('lists only the caller’s own', async () => {
-    const mine = await registered(kim)
-    await registered(lee)
-
-    const list = await query.myWebAuthCredentials(context(kim))
-
-    expect(list.map(c => c.credentialId)).toEqual([mine.id])
-  })
-
-  it('renames the caller’s own, and answers another person’s id as not found', async () => {
-    const credential = await credentialOf(await registered(kim))
-
-    const renamed = await mutation.updateMyWebAuthCredential(credential.id, ' Phone ', context(kim))
-    expect(renamed.name).toBe('Phone')
-
-    await expect(mutation.updateMyWebAuthCredential(credential.id, 'Mine now', context(lee))).rejects.toThrow('There is no passkey of yours')
-    expect((await credentialOf({ id: credential.credentialId } as any)).name).toBe('Phone')
-  })
-
-  it('★ a name over the bound is refused with the bound, not cut', async () => {
-    const credential = await credentialOf(await registered(kim))
-    await mutation.updateMyWebAuthCredential(credential.id, 'Phone', context(kim))
-
-    await expect(mutation.updateMyWebAuthCredential(credential.id, '가'.repeat(65), context(kim))).rejects.toMatchObject({ code: 'passkey-name-too-long', params: { max: 64, length: 65 } })
-    expect((await credentialOf({ id: credential.credentialId } as any)).name).toBe('Phone')
-    expect((await mutation.updateMyWebAuthCredential(credential.id, '가'.repeat(64), context(kim))).name).toBe('가'.repeat(64))
-  })
-
-  it('removes the caller’s own - it signs nobody in afterwards and the removal is audited', async () => {
-    const authenticator = await registered(kim)
-    const credential = await credentialOf(authenticator)
-
-    await expect(mutation.deleteMyWebAuthCredential(credential.id, context(lee))).rejects.toThrow('There is no passkey of yours')
-    expect((await credentialOf(authenticator)).deletedAt).toBeNull()
-
-    expect(await mutation.deleteMyWebAuthCredential(credential.id, context(kim))).toBe(true)
-    expect((await credentialOf(authenticator)).deletedAt).toBeInstanceOf(Date)
-    expect(await query.myWebAuthCredentials(context(kim))).toEqual([])
-    await expect(signinWith(authenticator)).rejects.toThrow('authn verification failed')
-
-    await flushAudit()
-    const removals = await getRepository(AuditAction).find({ where: { kind: 'webauthn.remove' }, relations: ['actor'] })
-    expect(removals.map(row => row.actor?.id)).toEqual([kim.id])
-  })
-
-  it('the same authenticator can be registered again after its passkey was removed', async () => {
-    const authenticator = await registered(kim)
-    await getRepository(WebAuthCredential).softDelete({ credentialId: authenticator.id })
-
-    const { challenge } = await passkey.registrationOptions(kim, 'Operato', SITE)
-    await expect(passkey.registerPasskey(kim, authenticator.register(challenge, SITE), 'again', challenge, SITE)).resolves.toBeTruthy()
-  })
-})

package/tests/passkey-signin-route-db.test.ts

@@ -1,139 +0,0 @@
-/**
- * The passkey sign-in route, through `authenticate401Middleware`, the way the sign-in screen reaches it.
- *
- * The screen used to fetch it. A fetch says `Accept: *\/*`, the middleware takes that for a page request,
- * so a locked account got the whole `auth-activate` page back as the body - and the screen put that body
- * in a toast. Now the screen posts a form, as the password does, and every refusal is answered with the
- * page its code leads to: the activate page for a locked or unconfirmed account, the sign-in page with
- * its one line for the rest.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-import { SoftwareAuthenticator } from './passkey-authenticator'
-
-const { User } = loadCompiled('service/user/user')
-const { authenticate401Middleware } = loadCompiled('middlewares/authenticate-401-middleware')
-const { webAuthnGlobalPublicRouter } = loadCompiled('router/webauthn-router')
-const CODES = loadCompiled('constants/error-code')
-const passkey = loadCompiled('controllers/passkey')
-
-const SITE = { rpID: 'localhost', origin: 'http://localhost:3000' }
-const NAVIGATION = 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
-
-let domain: any
-let kim: any
-
-const signinRoute = webAuthnGlobalPublicRouter.stack.find(
-  (layer: any) => layer.path === '/auth/signin-webauthn' && layer.methods.includes('POST')
-)
-
-/** What the browser gets back for the form the screen posts. */
-async function post(body: (challenge: string) => any) {
-  const { challenge } = await passkey.signinOptions(SITE)
-  const answer: any = { status: 200, cookies: {} }
-
-  const context: any = {
-    t: (key: string) => key,
-    method: 'POST',
-    path: '/auth/signin-webauthn',
-    originalUrl: '/auth/signin-webauthn',
-    header: { accept: NAVIGATION },
-    hostname: SITE.rpID,
-    origin: SITE.origin,
-    secure: false,
-    query: {},
-    session: { challenge },
-    state: { domain },
-    request: { body: body(challenge) },
-    cookies: { set: (key: string, value: string) => (answer.cookies[key] = value) },
-    render: async (view: string, options: any) => (answer.page = { view, ...options }),
-    redirect: (url: string) => (answer.redirect = url)
-  }
-
-  await authenticate401Middleware(context, () => signinRoute.stack[0](context, async () => {}))
-
-  return { ...answer, status: context.status, body: context.body }
-}
-
-async function registered(user: any) {
-  const authenticator = new SoftwareAuthenticator()
-  const { challenge } = await passkey.registrationOptions(user, 'Operato', SITE)
-  await passkey.registerPasskey(user, authenticator.register(challenge, SITE), 'macOS · Chrome', challenge, SITE)
-  return authenticator
-}
-
-const formWith = (authenticator: SoftwareAuthenticator) => (challenge: string) => ({
-  response: JSON.stringify(authenticator.assert(challenge, SITE)),
-  redirectTo: '/office'
-})
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  domain = await getRepository(Domain).save({ name: 'factory', subdomain: 'factory' })
-
-  const salt = User.generateSalt()
-  kim = await getRepository(User).save({
-    username: 'kim',
-    email: 'kim@example.com',
-    name: 'kim',
-    salt,
-    password: User.encode('Passw0rd!', salt),
-    status: 'activated',
-    domains: [domain]
-  })
-})
-
-it('signs in and goes on to check-in, with the token in the cookie', async () => {
-  const answer = await post(formWith(await registered(kim)))
-
-  expect(answer.redirect).toBe('/auth/checkin/factory?redirect_to=%2Foffice')
-  expect(Object.values(answer.cookies)).toHaveLength(1)
-})
-
-describe.each([
-  ['locked', CODES.USER_LOCKED],
-  ['inactive', CODES.USER_NOT_ACTIVATED]
-])('a %s account', (status, errorCode) => {
-  it('lands on the activate page with its code and its line, the way a password does', async () => {
-    const authenticator = await registered(kim)
-    await getRepository(User).update({ id: kim.id }, { status, lockedAt: new Date() })
-
-    const answer = await post(formWith(authenticator))
-
-    expect(answer.status).toBe(401)
-    expect(answer.page.pageElement).toBe('auth-activate')
-    expect(answer.page.data).toMatchObject({ errorCode, message: `error.${errorCode}`, username: 'kim', redirectTo: '/office' })
-    expect(answer.cookies).toEqual({})
-  })
-})
-
-describe.each([
-  ['deleted', CODES.USER_DELETED],
-  ['password_reset_required', CODES.PASSWORD_SETUP_PENDING]
-])('a %s account', (status, errorCode) => {
-  it('stays on the sign-in page with its one line', async () => {
-    const authenticator = await registered(kim)
-    await getRepository(User).update({ id: kim.id }, { status })
-
-    const answer = await post(formWith(authenticator))
-
-    expect(answer.page.pageElement).toBe('auth-signin')
-    expect(answer.page.data.message).toBe(`error.${errorCode}`)
-  })
-})
-
-it('an answer that is not JSON is a failed verification, said in one line on the sign-in page', async () => {
-  const answer = await post(() => ({ response: '<not json>', redirectTo: '/office' }))
-
-  expect(answer.page.pageElement).toBe('auth-signin')
-  expect(answer.page.data.message).toBe(`error.${CODES.AUTHN_VERIFICATION_FAILED}`)
-})