@things-factory/auth-base 10.1.278 → 10.1.280

package/tests/password-hashing.test.ts

@@ -1,131 +0,0 @@
-/**
- * 비밀번호 저장 방식 시험.
- *
- * `signin` 은 `User.verify(user.password, 입력, user.salt)` 하나로 사람을 들여보낸다
- * (`controllers/signin.ts:53`). 저장소의 시험 316개 중 이 함수를 부르는 것이 없었다.
- *
- * 아래는 **지금 그렇다**를 고정하는 시험이고, 그중 셋은 고쳐야 할 사실이다
- * (`docs/design/auth-rebuild.md` §5-1):
- *
- *  ① 해시가 **KDF 가 아니다** — HMAC-SHA256 **1회**다. 대입 저항이 사실상 없다
- *  ② `verify` 가 **SHA-1 도 받는다** — 옛 형식 하위호환
- *  ③ salt 가 없으면 **`SECRET` 을 salt 로** 쓴다 — 그 경우 전 사용자가 같은 salt 다
- *
- * KDF 로 옮길 때는 이 시험을 먼저 바꾼다. ①의 「1회 HMAC 과 바이트가 같다」가 깨지는 것이
- * 곧 옮겨졌다는 증거다.
- *
- * (여기서 다루지 않는 것: 비교가 `==` 문자열 비교라 상수 시간이 아니다. 타이밍은 시험으로
- *  붙잡을 수 있는 성질이 아니므로 문서에만 남긴다.)
- */
-
-import crypto from 'crypto'
-
-import { validatePasswordByRule } from '../server/controllers/utils/password-rule.js'
-import { loadCompiled } from './compiled'
-
-const { User } = loadCompiled('service/user/user')
-const { SECRET } = loadCompiled('utils/get-secret')
-
-const PASSWORD = 'Passw0rd!'
-const SALT = 'a1b2c3d4e5f6'
-
-describe('해시 만들기 (User.encode)', () => {
-  it('HMAC-SHA256 을 한 번 돌린 값과 바이트가 같다 — KDF 가 아니다', () => {
-    const oneRound = crypto.createHmac('sha256', SALT).update(PASSWORD).digest('base64')
-
-    expect(User.encode(PASSWORD, SALT)).toBe(oneRound)
-  })
-
-  it('같은 입력에 같은 값을 준다 — 호출마다 무작위가 섞이지 않는다', () => {
-    expect(User.encode(PASSWORD, SALT)).toBe(User.encode(PASSWORD, SALT))
-  })
-
-  it('salt 가 다르면 값이 다르다', () => {
-    expect(User.encode(PASSWORD, SALT)).not.toBe(User.encode(PASSWORD, 'other-salt'))
-  })
-
-  it('salt 가 없으면 `SECRET` 을 salt 로 쓴다 — 그 사용자들은 salt 를 공유한다', () => {
-    const withSecretAsSalt = crypto.createHmac('sha256', SECRET).update(PASSWORD).digest('base64')
-
-    expect(User.encode(PASSWORD, undefined)).toBe(withSecretAsSalt)
-    expect(User.encode(PASSWORD, null)).toBe(withSecretAsSalt)
-    expect(User.encode(PASSWORD, '')).toBe(withSecretAsSalt)
-  })
-
-  it('salt 는 16바이트 hex 다', () => {
-    const salt = User.generateSalt()
-
-    expect(salt).toMatch(/^[0-9a-f]{32}$/)
-    expect(salt).not.toBe(User.generateSalt())
-  })
-})
-
-describe('해시 맞추기 (User.verify)', () => {
-  it('SHA-256 으로 저장된 값을 맞춘다', () => {
-    expect(User.verify(User.encode(PASSWORD, SALT), PASSWORD, SALT)).toBe(true)
-  })
-
-  it('틀린 비밀번호를 거절한다', () => {
-    expect(User.verify(User.encode(PASSWORD, SALT), 'Passw0rd?', SALT)).toBe(false)
-  })
-
-  it('salt 가 다르면 거절한다', () => {
-    expect(User.verify(User.encode(PASSWORD, SALT), PASSWORD, 'other-salt')).toBe(false)
-  })
-
-  it('SHA-1 으로 저장된 값도 받는다 — 옛 형식 하위호환', () => {
-    const sha1 = crypto.createHmac('sha1', SALT).update(PASSWORD).digest('base64')
-
-    expect(User.verify(sha1, PASSWORD, SALT)).toBe(true)
-  })
-
-  it('저장된 해시가 없으면 거절한다', () => {
-    /* 기계 주체의 그림자 사용자는 `password` 칸에 **토큰 원문**이 들어간다
-       (appliance-mutation.ts:64 · oauth2-server.ts:152). 그 값은 해시가 아니므로
-       비밀번호 로그인으로는 통하지 않는다 — 노출 문제는 저장 쪽이고, 로그인 쪽은 막혀 있다. */
-    expect(User.verify(undefined, PASSWORD, SALT)).toBe(false)
-    expect(User.verify(null, PASSWORD, SALT)).toBe(false)
-    expect(User.verify('some-jwt-looking-string', PASSWORD, SALT)).toBe(false)
-  })
-})
-
-describe('서명 키 (SECRET)', () => {
-  it('설정이 없으면 저장소에 박힌 상수를 쓴다', () => {
-    /* production 에서는 던진다(get-secret.ts:7). 그 밖의 환경 — staging 포함 — 은
-       **공개된 상수**로 토큰을 서명한다. 이 값이 바뀌면 이 시험이 깨진다. */
-    expect(SECRET).toBe('0xD58F835B69D207A76CC5F84a70a1D0d4C79dAC95')
-  })
-})
-
-describe('비밀번호 규칙 (기본 설정)', () => {
-  /** 기본 규칙: 8자 이상 · 소문자 · 대문자 · 숫자 · 특수문자 · 같은 문자 3연속 금지. */
-  const rejects = (password: string) => expect(() => validatePasswordByRule(password, 'en-US')).toThrow()
-  const accepts = (password: string) => expect(() => validatePasswordByRule(password, 'en-US')).not.toThrow()
-
-  it('규칙을 모두 만족하면 통과한다', () => {
-    accepts('Passw0rd!')
-  })
-
-  it('짧으면 거절한다', () => {
-    rejects('Pw0rd!')
-  })
-
-  it('종류가 빠지면 거절한다', () => {
-    rejects('passw0rd!') // 대문자 없음
-    rejects('PASSW0RD!') // 소문자 없음
-    rejects('Password!') // 숫자 없음
-    rejects('Passw0rdd') // 특수문자 없음
-  })
-
-  it('같은 문자 3연속을 거절한다', () => {
-    rejects('Paaassw0rd!')
-  })
-
-  it('특수문자는 `!@#$%^&*()` 안에서만 인정한다', () => {
-    /* 규칙 정규식이 그 열 자만 본다(password-rule.ts:36). 그 밖의 기호(`-`·`_`·`~` 등)만
-       쓴 비밀번호는 특수문자가 없는 것으로 취급되어 거절된다 — 사용자에게는
-       「특수문자를 넣었는데 거절당했다」로 보인다. */
-    rejects('Passw0rd-')
-    accepts('Passw0rd#')
-  })
-})

package/tests/password-persistence.test.ts

@@ -1,147 +0,0 @@
-/**
- * 비밀번호 변경이 **DB 에 무엇을 남기나** — 실 엔티티로 저장하고 읽어서 확인한다.
- *
- * ── 왜 이것이 첫 DB 시험인가 ────────────────────────────────────────────────
- * 「비밀번호를 바꾸면 다른 기기의 세션이 끊겨야 한다」를 세우려면 그 판단의 근거가 필요하고,
- * 후보는 `User.passwordUpdatedAt` 이다. 그런데 그 칸을 쓰는 코드가 이 모양이다:
- *
- *     await repository.save({ ...user, passwordUpdatedAt: new Date() })   // change-pwd.ts:79
- *
- * 이 저장소는 **읽어 온 엔티티를 펼쳐 `save` 하면 칸이 조용히 안 써지는** 함정을 이미 한 번
- * 겪었다(도메인 시각대 — 로그는 「두었습니다」, `select` 는 `None`). 그러니 그 칸을 근거로
- * 삼기 전에 **읽어서 확인해야 한다.** 코드도 로그도 근거가 아니다.
- *
- * 여기서는 실제 컨트롤러(`changePwd`)를 그대로 태운다 — 칸을 직접 써 보는 것이 아니라,
- * 화면이 부르는 그 경로가 무엇을 남기는지를 본다.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { User } = loadCompiled('service/user/user')
-const { changePwd } = loadCompiled('controllers/change-pwd')
-
-const CURRENT = 'Passw0rd!'
-const NEXT = 'N3xtPass!'
-
-/** `changePwd` 가 컨텍스트에서 실제로 읽는 것만 담는다 — 도메인과 언어뿐이다. */
-function contextFor(domain: any) {
-  return { state: { domain }, lng: 'en-US' }
-}
-
-async function seedUser(domain: any) {
-  const salt = User.generateSalt()
-
-  return await getRepository(User).save({
-    username: 'kim',
-    email: 'kim@example.com',
-    name: 'Kim',
-    salt,
-    password: User.encode(CURRENT, salt),
-    status: 'activated',
-    domains: [domain]
-  })
-}
-
-let domain: any
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  domain = await getRepository(Domain).save({ name: 'plant-a', subdomain: 'plant-a' })
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-describe('changePwd 가 DB 에 남기는 것', () => {
-  it('새 비밀번호로 로그인할 수 있게 된다', async () => {
-    const user = await seedUser(domain)
-
-    await changePwd({ id: user.id }, CURRENT, NEXT, NEXT, contextFor(domain))
-
-    const stored = await getRepository(User).findOneBy({ id: user.id })
-    expect(User.verify(stored.password, NEXT, stored.salt)).toBe(true)
-    expect(User.verify(stored.password, CURRENT, stored.salt)).toBe(false)
-  })
-
-  it('`passwordUpdatedAt` 이 실제로 써진다 — 펼쳐 넣은 칸이 살아남는가', async () => {
-    /*
-     * 이 시험이 이 파일의 이유다. 세션 무효화가 이 칸을 근거로 삼을 수 있는지가 여기서 갈린다.
-     * 반환값이나 로그가 아니라 **다시 읽은 행**을 본다.
-     */
-    const user = await seedUser(domain)
-    expect(user.passwordUpdatedAt).toBeFalsy() /* 새로 만든 행은 `null` 이다 */
-
-    const before = Date.now()
-    await changePwd({ id: user.id }, CURRENT, NEXT, NEXT, contextFor(domain))
-    const after = Date.now()
-
-    const stored = await getRepository(User).findOneBy({ id: user.id })
-
-    expect(stored.passwordUpdatedAt).toBeTruthy()
-
-    const written = new Date(stored.passwordUpdatedAt).getTime()
-    expect(written).toBeGreaterThanOrEqual(before - 1000)
-    expect(written).toBeLessThanOrEqual(after + 1000)
-  })
-
-  it('토큰을 돌려준다 — 그리고 그 토큰의 `iat` 이 칸보다 앞선다', async () => {
-    /*
-     * `token-issuance.test.ts` 가 초 절삭을 단위로 보였고, 여기서는 **실제 경로**에서 같은 일이
-     * 일어나는 것을 본다: `changePwd` 는 칸을 쓴 뒤(:79) 토큰을 발급한다(:99). 그래서
-     * `iat * 1000 < passwordUpdatedAt` 로 옛 세션을 끊으면 **방금 받은 이 토큰도 끊긴다.**
-     */
-    const jwt = require('jsonwebtoken')
-    const user = await seedUser(domain)
-
-    const token = await changePwd({ id: user.id }, CURRENT, NEXT, NEXT, contextFor(domain))
-    const stored = await getRepository(User).findOneBy({ id: user.id })
-
-    const { iat } = jwt.decode(token) as any
-    expect(iat * 1000).toBeLessThan(new Date(stored.passwordUpdatedAt).getTime())
-  })
-
-  it('현재 비밀번호가 틀리면 아무것도 바꾸지 않는다', async () => {
-    const user = await seedUser(domain)
-
-    await expect(changePwd({ id: user.id }, 'WrongPass!', NEXT, NEXT, contextFor(domain))).rejects.toThrow()
-
-    const stored = await getRepository(User).findOneBy({ id: user.id })
-    expect(User.verify(stored.password, CURRENT, stored.salt)).toBe(true)
-    expect(stored.passwordUpdatedAt).toBeFalsy()
-  })
-
-  it('확인 비밀번호가 다르면 거절한다', async () => {
-    const user = await seedUser(domain)
-
-    await expect(changePwd({ id: user.id }, CURRENT, NEXT, 'Different1!', contextFor(domain))).rejects.toThrow()
-
-    const stored = await getRepository(User).findOneBy({ id: user.id })
-    expect(User.verify(stored.password, CURRENT, stored.salt)).toBe(true)
-  })
-
-  it('새 비밀번호가 규칙에 안 맞으면 거절한다', async () => {
-    const user = await seedUser(domain)
-
-    await expect(changePwd({ id: user.id }, CURRENT, 'short', 'short', contextFor(domain))).rejects.toThrow()
-
-    const stored = await getRepository(User).findOneBy({ id: user.id })
-    expect(User.verify(stored.password, CURRENT, stored.salt)).toBe(true)
-  })
-
-  it('salt 는 그대로 두고 해시만 바꾼다', async () => {
-    /* salt 를 함께 갈면 비밀번호 이력 대조(`User.verify(h.password, …, h.salt)`)가 옛 salt 를
-       들고 있어야 성립한다. 지금 어느 쪽인지를 고정해 둔다. */
-    const user = await seedUser(domain)
-
-    await changePwd({ id: user.id }, CURRENT, NEXT, NEXT, contextFor(domain))
-
-    const stored = await getRepository(User).findOneBy({ id: user.id })
-    expect(stored.salt).toBe(user.salt)
-  })
-})

package/tests/password-reset-rule-db.test.ts

@@ -1,159 +0,0 @@
-/**
- * Whose password a domain may take back - by issuing a password setup link (ADR-0161).
- *
- * The reset asked only that the person belong to the asking domain. A person has one password for every domain, so a
- * user manager of any domain could take the password of someone who also works elsewhere, of another domain's owner,
- * and of the super user (the system domain's owner) the moment that person was a member here. It was the default
- * password then; it is a setup link now, and the same people are refused.
- */
-
-import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-
-const { User } = loadCompiled('service/user/user')
-const { UserMutation } = loadCompiled('service/user/user-mutation')
-const { UserQuery } = loadCompiled('service/user/user-query')
-const { DomainOwner } = loadCompiled('service/domain-owner/domain-owner')
-
-const OWN_PASSWORD = 'Mine!5678'
-
-let here: any
-let other: any
-let system: any
-
-async function makeUser(domains: any[], extra: any = {}) {
-  const tag = Math.random().toString(36).slice(2, 8)
-  const salt = User.generateSalt()
-  return await getRepository(User).save({
-    username: `u-${tag}`,
-    email: `u-${tag}@example.com`,
-    name: 'Kim',
-    salt,
-    password: User.encode(OWN_PASSWORD, salt),
-    status: 'activated',
-    domains,
-    ...extra
-  })
-}
-
-function context(domain: any) {
-  return {
-    state: { domain, tx: undefined },
-    t: (key: string) => key,
-    headers: {},
-    request: { protocol: 'https', host: 'acme.example.com' }
-  } as any
-}
-
-function reset(user: any, domain: any) {
-  return new UserMutation().issuePasswordSetupLink(user.username, false, context(domain))
-}
-
-function mayReset(user: any, domain: any) {
-  return new UserQuery().mayIssuePasswordSetupLink(user.id, context(domain))
-}
-
-async function stillHasOwnPassword(user: any) {
-  const read = await getRepository(User).findOneBy({ id: user.id })
-  return User.verify(read.password, OWN_PASSWORD, read.salt)
-}
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-
-  const domainRepository = getRepository(Domain)
-  here = await domainRepository.save({ name: 'Plant A', subdomain: 'plant-a' })
-  other = await domainRepository.save({ name: 'Plant B', subdomain: 'plant-b' })
-  system = await domainRepository.save({ name: 'System', subdomain: 'system' })
-})
-
-describe('a person wholly of this domain', () => {
-  it('is issued a link and waits for a password, and the screen offers it', async () => {
-    const user = await makeUser([here])
-
-    expect(await mayReset(user, here)).toBe(true)
-    await expect(reset(user, here)).resolves.toMatchObject({ link: expect.stringContaining('/auth/reset-password#') })
-
-    const read = await getRepository(User).findOneBy({ id: user.id })
-    expect(read.status).toBe('password_reset_required')
-    expect(await stillHasOwnPassword(user)).toBe(false)
-  })
-})
-
-describe('refused, and the password stays', () => {
-  it('★ someone who also works in another domain', async () => {
-    const user = await makeUser([here, other])
-
-    expect(await mayReset(user, here)).toBe(false)
-    await expect(reset(user, here)).rejects.toMatchObject({
-      code: 'password-reset-reaches-other-domains',
-      params: { domains: 'Plant B' }
-    })
-    expect(await stillHasOwnPassword(user)).toBe(true)
-  })
-
-  it("★ another domain's owner, through the owner table, though a member only here", async () => {
-    const user = await makeUser([here])
-    await getRepository(DomainOwner).save({ domain: other, user })
-
-    expect(await mayReset(user, here)).toBe(false)
-    await expect(reset(user, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
-    expect(await stillHasOwnPassword(user)).toBe(true)
-  })
-
-  it("★ another domain's primary owner (the column only)", async () => {
-    const user = await makeUser([here])
-    await getRepository(Domain).update({ id: other.id }, { owner: user.id })
-
-    expect(await mayReset(user, here)).toBe(false)
-    await expect(reset(user, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
-    expect(await stillHasOwnPassword(user)).toBe(true)
-  })
-
-  it('★ the super user - asked from the system domain itself', async () => {
-    const superUser = await makeUser([system])
-    await getRepository(Domain).update({ id: system.id }, { owner: superUser.id })
-
-    expect(await mayReset(superUser, system)).toBe(false)
-    await expect(reset(superUser, system)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
-    expect(await stillHasOwnPassword(superUser)).toBe(true)
-  })
-
-  it('★ the super user - asked from a domain they are also a member of', async () => {
-    const superUser = await makeUser([system, here])
-    await getRepository(Domain).update({ id: system.id }, { owner: superUser.id })
-
-    expect(await mayReset(superUser, here)).toBe(false)
-    await expect(reset(superUser, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
-    expect(await stillHasOwnPassword(superUser)).toBe(true)
-  })
-
-  it("this domain's own owner", async () => {
-    const owner = await makeUser([here])
-    await getRepository(DomainOwner).save({ domain: here, user: owner })
-
-    expect(await mayReset(owner, here)).toBe(false)
-    await expect(reset(owner, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
-  })
-
-  it('an admin account, as inactivateUser refuses it', async () => {
-    const admin = await makeUser([here], { userType: 'admin' })
-
-    expect(await mayReset(admin, here)).toBe(false)
-    await expect(reset(admin, here)).rejects.toMatchObject({ code: 'password-reset-owner-account' })
-  })
-
-  it('the screen is told no for someone who is not a member here', async () => {
-    const stranger = await makeUser([other])
-
-    expect(await mayReset(stranger, here)).toBe(false)
-  })
-})

package/tests/password-setup-db.test.ts

@@ -1,215 +0,0 @@
-/**
- * An administrator never sets anybody's password (ADR-0161).
- *
- * It used to be the installation's default password - one value everyone handed one knew, with no end, for every
- * account an administrator made or reset. Now such an account waits for its password, and the person sets it through
- * a one-time link that is mailed or handed over: 48 hours, hashed at rest, asking for the address it was for, and the
- * only live one. Issuing it ends the sessions opened before.
- */
-
-import { authDataSource, closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
-import { loadCompiled } from './compiled'
-import { i18next } from '@things-factory/i18n-base/translator'
-
-const jwt = require('jsonwebtoken')
-
-const { User } = loadCompiled('service/user/user')
-const { UserMutation } = loadCompiled('service/user/user-mutation')
-const { VerificationToken } = loadCompiled('service/verification-token/verification-token')
-const { signin } = loadCompiled('controllers/signin')
-const { resetPassword } = loadCompiled('controllers/reset-password')
-const { hashVerificationToken } = loadCompiled('utils/verification-token-rule')
-
-const OWN_PASSWORD = 'Mine!5678'
-const NEW_PASSWORD = 'N3w!Passw0rd'
-const HOUR = 60 * 60 * 1000
-
-let here: any
-
-function context(tx?: any) {
-  return {
-    state: { domain: here, tx },
-    t: (key: string) => key,
-    i18next,
-    headers: {},
-    request: { protocol: 'https', host: 'acme.example.com' }
-  } as any
-}
-
-async function makeActive(email = 'kim@example.com') {
-  const salt = User.generateSalt()
-  return await getRepository(User).save({
-    username: email,
-    email,
-    name: 'Kim',
-    salt,
-    password: User.encode(OWN_PASSWORD, salt),
-    status: 'activated',
-    domains: [here]
-  })
-}
-
-function create(email = 'lee@example.com') {
-  return new UserMutation().createUser({ username: email, email, name: 'Lee', userType: 'user' }, context())
-}
-
-function issue(user: any, mail = false, tx?: any) {
-  return new UserMutation().issuePasswordSetupLink(user.username, mail, context(tx))
-}
-
-const tokenOf = (link: string) => link.split('#')[1]
-const reload = (id: string) => getRepository(User).findOneBy({ id })
-const setPassword = (token: string, email: string, password = NEW_PASSWORD) =>
-  resetPassword(token, password, email, { t: (key: string) => key })
-
-beforeAll(async () => {
-  await openAuthDatabase()
-})
-
-afterAll(async () => {
-  await closeAuthDatabase()
-})
-
-beforeEach(async () => {
-  await resetAuthDatabase()
-  here = await getRepository(Domain).save({ name: 'Plant A', subdomain: 'plant-a' })
-})
-
-describe('an account an administrator makes', () => {
-  it('★ waits for its password, which nobody was given', async () => {
-    const made = await create()
-    const read = await reload(made.id)
-
-    expect(read.status).toBe('password_reset_required')
-    expect(read.password).toBeTruthy()
-  })
-
-  it('★ does not sign in, and a guess against it is not counted', async () => {
-    const made = await create()
-
-    await expect(signin({ username: made.username, password: 'anything' })).rejects.toMatchObject({
-      errorCode: 'password-setup-pending'
-    })
-    expect((await reload(made.id)).failCount ?? 0).toBe(0)
-  })
-
-  it('★ is refused on every request too', async () => {
-    const made = await create()
-
-    await expect(User.checkAuth({ username: made.username, email: made.email })).rejects.toMatchObject({
-      errorCode: 'password-setup-pending'
-    })
-  })
-
-  it('is not opened by activating it', async () => {
-    const made = await create()
-
-    await expect(new UserMutation().activateUser(made.username, context())).rejects.toMatchObject({
-      code: 'password-setup-pending'
-    })
-  })
-})
-
-describe('the setup link', () => {
-  it('★ is handed back once, kept only as a hash, and lives 48 hours', async () => {
-    const made = await create()
-    const before = Date.now()
-
-    const issued = await issue(made)
-
-    expect(issued.link).toMatch(/^https?:\/\/acme\.example\.com\/auth\/reset-password#[0-9a-f]{32}$/)
-    const stored = await getRepository(VerificationToken).findOneBy({ userId: made.id })
-    expect(stored.type).toBe('password-setup')
-    expect(stored.token).toBe(hashVerificationToken(tokenOf(issued.link)))
-    expect(stored.token).not.toBe(tokenOf(issued.link))
-    expect(new Date(stored.expiresAt).getTime() - before).toBeGreaterThanOrEqual(48 * HOUR - 1000)
-    expect(new Date(stored.expiresAt).getTime() - before).toBeLessThanOrEqual(48 * HOUR + 5000)
-  })
-
-  it('★ opens the account with the address it was for, and then signs in', async () => {
-    const made = await create()
-    const { link } = await issue(made)
-
-    await setPassword(tokenOf(link), 'LEE@example.com ')
-
-    expect((await reload(made.id)).status).toBe('activated')
-    await expect(signin({ username: made.username, password: NEW_PASSWORD })).resolves.toMatchObject({
-      token: expect.any(String)
-    })
-  })
-
-  it('★ is not enough without the address it was for', async () => {
-    const made = await create()
-    const { link } = await issue(made)
-
-    await expect(setPassword(tokenOf(link), 'someone@else.example')).rejects.toThrow()
-    await expect(setPassword(tokenOf(link), '')).rejects.toThrow()
-    expect((await reload(made.id)).status).toBe('password_reset_required')
-  })
-
-  it('works once', async () => {
-    const made = await create()
-    const { link } = await issue(made)
-
-    await setPassword(tokenOf(link), made.email)
-    await expect(setPassword(tokenOf(link), made.email, 'An0ther!Pass')).rejects.toThrow()
-  })
-
-  it('★ issued again, retires the last one', async () => {
-    const made = await create()
-    const first = await issue(made)
-    const second = await issue(made)
-
-    await expect(setPassword(tokenOf(first.link), made.email)).rejects.toThrow()
-    await setPassword(tokenOf(second.link), made.email)
-    expect((await reload(made.id)).status).toBe('activated')
-  })
-})
-
-describe('taking back the password of an account in use', () => {
-  it('★ stops the old password and ends the sessions opened before', async () => {
-    const kim = await makeActive()
-    const { token: before } = await signin({ username: kim.username, password: OWN_PASSWORD })
-    await expect(User.checkAuth(jwt.decode(before))).resolves.toBeTruthy()
-
-    const { link } = await issue(kim)
-
-    await expect(signin({ username: kim.username, password: OWN_PASSWORD })).rejects.toMatchObject({
-      errorCode: 'password-setup-pending'
-    })
-
-    await setPassword(tokenOf(link), kim.email)
-
-    /* Open again - but the session from before stays ended: its generation has passed. */
-    await expect(User.checkAuth(jwt.decode(before))).rejects.toThrow()
-    const { token: after } = await signin({ username: kim.username, password: NEW_PASSWORD })
-    await expect(User.checkAuth(jwt.decode(after))).resolves.toBeTruthy()
-  })
-
-  it('★ by mail - a mail that does not go out changes nothing', async () => {
-    const kim = await makeActive()
-
-    await expect(
-      authDataSource().transaction(async (tx: any) => await issue(kim, true, tx))
-    ).rejects.toMatchObject({ code: 'password-setup-mail-not-sent' })
-
-    const read = await reload(kim.id)
-    expect(read.status).toBe('activated')
-    expect(User.verify(read.password, OWN_PASSWORD, read.salt)).toBe(true)
-    expect(await getRepository(VerificationToken).findOneBy({ userId: kim.id })).toBeNull()
-  })
-})
-
-describe('a forgotten password', () => {
-  it('asks for the address as well, through the same page', async () => {
-    const kim = await makeActive()
-    const { makeVerificationToken } = loadCompiled('controllers/utils/make-verification-token')
-    const { saveVerificationToken } = loadCompiled('controllers/utils/save-verification-token')
-    const token = makeVerificationToken()
-    await saveVerificationToken(kim.id, token, 'password-reset')
-
-    await expect(setPassword(token, 'someone@else.example')).rejects.toThrow()
-    await setPassword(token, kim.email)
-    await expect(signin({ username: kim.username, password: NEW_PASSWORD })).resolves.toBeTruthy()
-  })
-})