@things-factory/auth-base 10.1.40 → 10.1.44

package/tests/verification-token-db.test.ts

@@ -0,0 +1,277 @@
+const sentMail: any[] = []
+
+jest.mock('@things-factory/email-base', () => ({
+  sendEmail: async (mail: any) => {
+    sentMail.push(mail)
+  }
+}))
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+import {
+  hashVerificationToken,
+  isVerificationTokenLive,
+  verificationTokenExpiresAt,
+  VERIFICATION_TOKEN_LIFETIME_MS
+} from '../server/utils/verification-token-rule'
+
+const { User } = loadCompiled('service/user/user')
+const { VerificationToken, VerificationTokenType } = loadCompiled('service/verification-token/verification-token')
+const { resetPassword, sendPasswordResetEmail, RESET_PASSWORD_PATH } = loadCompiled('controllers/reset-password')
+const { unlockUser, sendUnlockUserEmail, UNLOCK_USER_PATH } = loadCompiled('controllers/unlock-user')
+const { verify, sendVerificationEmail, VERIFY_EMAIL_PATH } = loadCompiled('controllers/verification')
+const { saveVerificationToken } = loadCompiled('controllers/utils/save-verification-token')
+
+/**
+ * The links in the reset, unlock and sign-up confirmation mails.
+ *
+ * Before 2026-09-24 each token lived forever, sat in the table as written and was found by that
+ * value, and rode in the link's query string or path. So a reset mail from last year still changed a
+ * password, any copy of the table was a set of live reset links, and every access log on the way
+ * held one too. Q4 (architect, 2026-09-24) made them work like the invitation link:
+ *
+ *   stored        sha256 of the token, with an `expiresAt` written once
+ *   lifetime      reset 1h · unlock 1h · activation 48h
+ *   no expiresAt  refused — rows from before this, and how links already sent stop working
+ *   the link      `<path>#<token>` built with `buildAuthURL`, so the browser never sends the token
+ *
+ * The controllers are driven with the token the mail carries, and the row is read back to see what
+ * the table holds. ⚠ sqlite (`tests/db.ts`).
+ */
+
+const OLD = 'Passw0rd!'
+const NEW = 'N3wPassw0rd!'
+const HOUR = 60 * 60 * 1000
+
+const context: any = {
+  t: (key: string) => key,
+  lng: 'en-US',
+  headers: {},
+  request: { protocol: 'https', host: 'acme.example.com' }
+}
+
+let domain: any
+
+async function person(status = 'activated') {
+  const salt = User.generateSalt()
+
+  return await getRepository(User).save({
+    username: 'kim',
+    email: 'kim@example.com',
+    name: 'Kim',
+    salt,
+    password: User.encode(OLD, salt),
+    status,
+    failCount: status === 'locked' ? 5 : 0,
+    domains: [domain]
+  })
+}
+
+async function row(userId: string) {
+  return await getRepository(VerificationToken).findOneBy({ userId })
+}
+
+/** Moves a stored token's expiry — the clock is the row's, not the test's. */
+async function expireAt(userId: string, at: Date | null) {
+  await getRepository(VerificationToken).update({ userId }, { expiresAt: at })
+}
+
+/** The token as the mail carries it: after `#` in the one link the mail holds. */
+function tokenInLastMail(path: string): string {
+  const mail = sentMail[sentMail.length - 1]
+  const hrefs = [...String(mail.content).matchAll(/href="([^"]+)"/g)].map(m => m[1]).filter(h => h.includes(path))
+
+  expect(hrefs).toHaveLength(1)
+  const link = new URL(hrefs[0])
+
+  expect(link.host).toBe('acme.example.com')
+  expect(link.pathname).toBe(path)
+  expect(link.search).toBe('')
+
+  return link.hash.slice(1)
+}
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  sentMail.length = 0
+  domain = await getRepository(Domain).save({ name: 'plant-a', subdomain: 'plant-a' })
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+describe('the rule', () => {
+  const now = new Date('2026-09-24T12:00:00Z')
+
+  it('gives each mailed link its lifetime', () => {
+    expect(VERIFICATION_TOKEN_LIFETIME_MS).toEqual({ 'password-reset': HOUR, unlock: HOUR, activation: 48 * HOUR })
+    expect(verificationTokenExpiresAt('password-reset', now).getTime()).toBe(now.getTime() + HOUR)
+  })
+
+  it('refuses to make up a lifetime for a type it does not know', () => {
+    expect(() => verificationTokenExpiresAt('access-token', now)).toThrow(/no lifetime/)
+  })
+
+  it('works until the last millisecond and stops at the expiry', () => {
+    const expiresAt = new Date(now.getTime() + HOUR)
+
+    expect(isVerificationTokenLive({ expiresAt }, new Date(expiresAt.getTime() - 1))).toBe(true)
+    expect(isVerificationTokenLive({ expiresAt }, expiresAt)).toBe(false)
+  })
+
+  it('reads a row without an expiry as expired', () => {
+    expect(isVerificationTokenLive({ expiresAt: null }, now)).toBe(false)
+    expect(isVerificationTokenLive({}, now)).toBe(false)
+    expect(isVerificationTokenLive(null, now)).toBe(false)
+    expect(isVerificationTokenLive({ expiresAt: 'not a date' }, now)).toBe(false)
+  })
+})
+
+describe('what the table keeps', () => {
+  it('the hash of the token, and when it stops working — not the token', async () => {
+    const user = await person()
+    const before = Date.now()
+
+    await saveVerificationToken(user.id, 'a'.repeat(32), VerificationTokenType.PASSWORD_RESET)
+
+    const saved = await row(user.id)
+    expect(saved.token).toBe(hashVerificationToken('a'.repeat(32)))
+    expect(saved.token).not.toContain('a'.repeat(32))
+    expect(new Date(saved.expiresAt).getTime()).toBeGreaterThanOrEqual(before + HOUR)
+    expect(new Date(saved.expiresAt).getTime()).toBeLessThanOrEqual(Date.now() + HOUR)
+  })
+})
+
+describe('password reset', () => {
+  it('the mailed link resets the password, once', async () => {
+    const user = await person()
+    await sendPasswordResetEmail({ user, context })
+    const token = tokenInLastMail(RESET_PASSWORD_PATH)
+
+    await resetPassword(token, NEW, context)
+
+    const after = await getRepository(User).findOneBy({ id: user.id })
+    expect(User.verify(after.password, NEW, after.salt)).toBe(true)
+    await expect(resetPassword(token, OLD, context)).rejects.toThrow('text.invalid verification token')
+  })
+
+  it('refuses the link after it expires', async () => {
+    const user = await person()
+    await sendPasswordResetEmail({ user, context })
+    const token = tokenInLastMail(RESET_PASSWORD_PATH)
+
+    await expireAt(user.id, new Date(Date.now() - 1))
+
+    await expect(resetPassword(token, NEW, context)).rejects.toThrow('text.invalid verification token')
+    const after = await getRepository(User).findOneBy({ id: user.id })
+    expect(User.verify(after.password, OLD, after.salt)).toBe(true)
+  })
+
+  it('refuses a row from before — the token as written, and no expiry', async () => {
+    const user = await person()
+    await getRepository(VerificationToken).save({
+      userId: user.id,
+      token: 'b'.repeat(32),
+      type: VerificationTokenType.PASSWORD_RESET
+    })
+
+    await expect(resetPassword('b'.repeat(32), NEW, context)).rejects.toThrow('text.invalid verification token')
+  })
+
+  it('refuses a row whose expiry is missing, even when the hash matches', async () => {
+    /*
+     * The case above is refused twice over — the raw value does not hash to itself — so it cannot
+     * tell whether "no expiry" refuses. This one leaves only the expiry to decide.
+     */
+    const user = await person()
+    await sendPasswordResetEmail({ user, context })
+    const token = tokenInLastMail(RESET_PASSWORD_PATH)
+
+    await expireAt(user.id, null)
+
+    await expect(resetPassword(token, NEW, context)).rejects.toThrow('text.invalid verification token')
+  })
+
+  it('does not find a token by the value stored in the table', async () => {
+    /* ⚠ A copy of the table is not a set of reset links: what it holds is not what the link carries. */
+    const user = await person()
+    await sendPasswordResetEmail({ user, context })
+    const stored = (await row(user.id)).token
+
+    await expect(resetPassword(stored, NEW, context)).rejects.toThrow('text.invalid verification token')
+  })
+})
+
+describe('unlock', () => {
+  it('the mailed link unlocks the account', async () => {
+    const user = await person('locked')
+    await sendUnlockUserEmail({ user, context })
+
+    expect(await unlockUser(tokenInLastMail(UNLOCK_USER_PATH), NEW)).toBe(true)
+    expect((await getRepository(User).findOneBy({ id: user.id })).status).toBe('activated')
+  })
+
+  it('refuses the link after it expires', async () => {
+    const user = await person('locked')
+    await sendUnlockUserEmail({ user, context })
+    const token = tokenInLastMail(UNLOCK_USER_PATH)
+
+    await expireAt(user.id, new Date(Date.now() - 1))
+
+    expect(await unlockUser(token, NEW)).toBe(false)
+    expect((await getRepository(User).findOneBy({ id: user.id })).status).toBe('locked')
+  })
+})
+
+describe('sign-up confirmation', () => {
+  it('the mailed link activates the account', async () => {
+    const user = await person('inactive')
+    await sendVerificationEmail({ user, context })
+
+    await verify(tokenInLastMail(VERIFY_EMAIL_PATH))
+
+    expect((await getRepository(User).findOneBy({ id: user.id })).status).toBe('activated')
+  })
+
+  it('refuses the link after it expires', async () => {
+    const user = await person('inactive')
+    await sendVerificationEmail({ user, context })
+    const token = tokenInLastMail(VERIFY_EMAIL_PATH)
+
+    await expireAt(user.id, new Date(Date.now() - 1))
+
+    await expect(verify(token)).rejects.toThrow()
+    expect((await getRepository(User).findOneBy({ id: user.id })).status).toBe('inactive')
+  })
+
+  it('does not take a reset link for a confirmation', async () => {
+    /* It read the token alone, so any live token of any type activated the account. */
+    const user = await person('inactive')
+    await sendPasswordResetEmail({ user, context })
+
+    await expect(verify(tokenInLastMail(RESET_PASSWORD_PATH))).rejects.toThrow()
+    expect((await getRepository(User).findOneBy({ id: user.id })).status).toBe('inactive')
+  })
+})
+
+describe('⚠ one token per person, of any type', () => {
+  it('a reset request replaces a pending sign-up confirmation', async () => {
+    /*
+     * The primary key is `userId`. Pinned as it is today — the architect asked for it to be written
+     * down, and whether to change it is ranked in `docs/design/auth-rebuild.md` §8-7. When the key
+     * grows a type, this flips.
+     */
+    const user = await person('inactive')
+    await sendVerificationEmail({ user, context })
+    const confirmation = tokenInLastMail(VERIFY_EMAIL_PATH)
+
+    await sendPasswordResetEmail({ user, context })
+
+    await expect(verify(confirmation)).rejects.toThrow()
+  })
+})