@tstdl/base 0.93.178 → 0.93.180

package/authentication/tests/authentication.client-service-refresh.test.js

@@ -8,6 +8,7 @@ import { Lock } from '../../lock/index.js';
 import { Logger } from '../../logger/index.js';
 import { MessageBus } from '../../message-bus/index.js';
 import { configureDefaultSignalsImplementation } from '../../signals/implementation/configure.js';
+import { currentTimestampSeconds } from '../../utils/date-time.js';
 import { timeout } from '../../utils/timing.js';
 describe('AuthenticationClientService Refresh Loop Reproduction', () => {
     let injector;
@@ -30,7 +31,7 @@ describe('AuthenticationClientService Refresh Loop Reproduction', () => {
         mockApiClient = {
             login: vi.fn(),
             refresh: vi.fn(),
-            timestamp: vi.fn().mockResolvedValue(Math.floor(Date.now() / 1000)),
+            timestamp: vi.fn().mockResolvedValue(currentTimestampSeconds()),
             endSession: vi.fn().mockResolvedValue(undefined),
         };
         mockLock = {
@@ -66,7 +67,7 @@ describe('AuthenticationClientService Refresh Loop Reproduction', () => {
     });
     test('Zombie Timer: loop should wake up immediately when token changes', async () => {
         // 1. Mock a long expiration
-        const now = Math.floor(Date.now() / 1000);
+        const now = currentTimestampSeconds();
         const initialToken = { iat: now - 3600, exp: now + 3600, jti: 'initial' };
         // Set in storage so initialize() (called by resolve) loads it
         globalThis.localStorage.setItem('AuthenticationService:token', JSON.stringify(initialToken));
@@ -82,7 +83,7 @@ describe('AuthenticationClientService Refresh Loop Reproduction', () => {
         expect(mockApiClient.refresh).toHaveBeenCalled();
     });
     test('Forced Refresh Loss: forceRefreshToken should not be cleared on failure', async () => {
-        const now = Math.floor(Date.now() / 1000);
+        const now = currentTimestampSeconds();
         const initialToken = { iat: now - 3600, exp: now + 3600, jti: 'initial' };
         globalThis.localStorage.setItem('AuthenticationService:token', JSON.stringify(initialToken));
         service = injector.resolve(AuthenticationClientService);
@@ -96,7 +97,7 @@ describe('AuthenticationClientService Refresh Loop Reproduction', () => {
         expect(service.forceRefreshRequested()).toBe(true); // Should STILL be set
     });
     test('Lock Contention Backoff: should wait 5 seconds and not busy-loop', async () => {
-        const now = Math.floor(Date.now() / 1000);
+        const now = currentTimestampSeconds();
         const initialToken = { iat: now - 3600, exp: now + 5, jti: 'initial' }; // Expiring soon
         globalThis.localStorage.setItem('AuthenticationService:token', JSON.stringify(initialToken));
         // 1. Mock lock already held
@@ -111,7 +112,7 @@ describe('AuthenticationClientService Refresh Loop Reproduction', () => {
         expect(duration).toBeLessThan(500);
     });
     test('Busy Loop: should not busy loop when forceRefreshToken is set and lock is held', async () => {
-        const now = Math.floor(Date.now() / 1000);
+        const now = currentTimestampSeconds();
         const initialToken = { iat: now - 3600, exp: now + 3600, jti: 'initial' };
         globalThis.localStorage.setItem('AuthenticationService:token', JSON.stringify(initialToken));
         // Mock lock already held
@@ -131,7 +132,7 @@ describe('AuthenticationClientService Refresh Loop Reproduction', () => {
         expect(mockApiClient.timestamp).toHaveBeenCalled();
     });
     test('Cross-tab Sync: should not refresh if another tab already did (simulated via localStorage update)', async () => {
-        const now = Math.floor(Date.now() / 1000);
+        const now = currentTimestampSeconds();
         const initialToken = { iat: now - 3600, exp: now + 5, jti: 'initial' }; // Expiring soon
         globalThis.localStorage.setItem('AuthenticationService:token', JSON.stringify(initialToken));
         // 1. Mock lock behavior to simulate another tab refreshing while we wait for the lock

package/authentication/tests/authentication.client-service.test.js

@@ -25,8 +25,10 @@ describe('AuthenticationClientService Integration', () => {
             clear: vi.fn(() => storage.clear()),
         };
         ({ injector, database } = await setupIntegrationTest({
-            modules: { authentication: true, audit: true, keyValueStore: true, signals: true, api: true, webServer: true },
-            authenticationAncillaryService: DefaultAuthenticationAncillaryService,
+            modules: { authentication: true, audit: true, keyValueStore: true, signals: true, api: true },
+            authentication: {
+                ancillaryService: DefaultAuthenticationAncillaryService,
+            },
         }));
         await runInInjectionContext(injector, async () => {
             server = injector.resolve(HttpServer);
@@ -44,11 +46,11 @@ describe('AuthenticationClientService Integration', () => {
     });
     beforeEach(async () => {
         globalThis.localStorage?.clear();
-        await clearTenantData(database, schema, ['credentials', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
+        await clearTenantData(database, schema, ['password', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
     });
     test('login and logout should work', async () => {
         const user = await subjectService.createUser({ tenantId, email: 'client-test@example.com', firstName: 'C', lastName: 'T' });
-        await serverService.setCredentials(user, 'Strong-Pass-2026!');
+        await serverService.setPassword(user, 'Strong-Pass-2026!');
         expect(service.isLoggedIn()).toBe(false);
         await service.login({ tenantId, subject: user.id }, 'Strong-Pass-2026!');
         expect(service.isLoggedIn()).toBe(true);
@@ -58,17 +60,17 @@ describe('AuthenticationClientService Integration', () => {
     });
     test('refresh should work', async () => {
         const user = await subjectService.createUser({ tenantId, email: 'refresh-test@example.com', firstName: 'R', lastName: 'T' });
-        await serverService.setCredentials(user, 'Strong-Pass-2026!');
+        await serverService.setPassword(user, 'Strong-Pass-2026!');
         await service.login({ tenantId, subject: user.id }, 'Strong-Pass-2026!');
         const initialToken = service.token()?.jti;
         await service.refresh();
         expect(service.token()?.jti).not.toBe(initialToken);
         expect(service.isLoggedIn()).toBe(true);
     });
-    test('checkSecret should work', async () => {
-        const result = await service.checkSecret('123');
+    test('checkPassword should work', async () => {
+        const result = await service.checkPassword('123');
         expect(result.strength).toBeLessThan(2);
-        const strongResult = await service.checkSecret('Very-Strong-Password-2026-!@#$');
+        const strongResult = await service.checkPassword('Very-Strong-Password-2026-!@#$');
         expect(strongResult.strength).toBeGreaterThanOrEqual(2);
     });
 });

package/authentication/tests/authentication.service.test.js

@@ -18,7 +18,9 @@ describe('AuthenticationService', () => {
     beforeAll(async () => {
         ({ injector, database } = await setupIntegrationTest({
             modules: { authentication: true },
-            authenticationAncillaryService: DefaultAuthenticationAncillaryService,
+            authentication: {
+                ancillaryService: DefaultAuthenticationAncillaryService,
+            },
         }));
         authenticationService = await injector.resolveAsync(AuthenticationService);
         subjectService = await injector.resolveAsync(SubjectService);
@@ -29,7 +31,7 @@ describe('AuthenticationService', () => {
         await injector?.dispose();
     });
     beforeEach(async () => {
-        await clearTenantData(database, schema, ['credentials', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
+        await clearTenantData(database, schema, ['password', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
     });
     test('login should create a session and listSessions should return it', async () => {
         const user = await subjectService.createUser({
@@ -38,8 +40,10 @@ describe('AuthenticationService', () => {
             firstName: 'John',
             lastName: 'Doe',
         });
-        await authenticationService.setCredentials(user, 'Strong-Password-2026!');
-        const tokenResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, auditor.with({ actor: user.id, actorType: ActorType.Subject }));
+        await authenticationService.setPassword(user, 'Strong-Password-2026!');
+        const loginResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, auditor.with({ actor: user.id, actorType: ActorType.Subject }));
+        expect(loginResult.type).toBe('success');
+        const tokenResult = loginResult.result;
         expect(tokenResult.token).toBeDefined();
         const sessions = await authenticationService.listSessions(tenantId, user.id);
         expect(sessions).toHaveLength(1);
@@ -52,7 +56,7 @@ describe('AuthenticationService', () => {
             firstName: 'John',
             lastName: 'Doe',
         });
-        await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+        await authenticationService.setPassword(user, 'Strong-Password-2026!');
         const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
         await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
         await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
@@ -62,7 +66,7 @@ describe('AuthenticationService', () => {
         expect(sessions.every((s) => s.end > now)).toBe(true);
         await authenticationService.invalidateAllSessions(tenantId, user.id, userAuditor);
         sessions = await authenticationService.listSessions(tenantId, user.id);
-        expect(sessions.every((s) => s.end <= now + 1000)).toBe(true); // small buffer for test execution time
+        expect(sessions).toHaveLength(0);
     });
     test('getSession and tryGetSession', async () => {
         const user = await subjectService.createUser({
@@ -71,9 +75,11 @@ describe('AuthenticationService', () => {
             firstName: 'John',
             lastName: 'Doe',
         });
-        await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+        await authenticationService.setPassword(user, 'Strong-Password-2026!');
         const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        const tokenResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+        const loginResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
+        expect(loginResult.type).toBe('success');
+        const tokenResult = loginResult.result;
         const sessionId = tokenResult.jsonToken.payload.session;
         const session = await authenticationService.getSession(sessionId);
         expect(session.id).toBe(sessionId);
@@ -84,30 +90,32 @@ describe('AuthenticationService', () => {
     });
     test('refresh should issue new token and session', async () => {
         const user = await subjectService.createUser({ tenantId, email: 'refresh@example.com', firstName: 'R', lastName: 'F' });
-        await authenticationService.setCredentials(user, 'Strong-Password-2026!');
+        await authenticationService.setPassword(user, 'Strong-Password-2026!');
         const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
         const loginResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
-        const refreshResult = await authenticationService.refresh(loginResult.refreshToken, undefined, {}, userAuditor);
+        expect(loginResult.type).toBe('success');
+        const loginSuccessResult = loginResult.result;
+        const refreshResult = await authenticationService.refresh(loginSuccessResult.refreshToken, undefined, {}, userAuditor);
         expect(refreshResult.token).toBeDefined();
-        expect(refreshResult.refreshToken).not.toBe(loginResult.refreshToken);
+        expect(refreshResult.refreshToken).not.toBe(loginSuccessResult.refreshToken);
     });
-    test('changeSecret should update credentials', async () => {
+    test('changePassword should update password', async () => {
         const user = await subjectService.createUser({ tenantId, email: 'change@example.com', firstName: 'C', lastName: 'S' });
-        await authenticationService.setCredentials(user, 'Old-Password-2026!');
+        await authenticationService.setPassword(user, 'Old-Password-2026!');
         const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        await authenticationService.changeSecret({ tenantId, subject: user.id }, 'Old-Password-2026!', 'New-Password-2026!', userAuditor);
-        const authResult = await authenticationService.authenticate({ tenantId, subject: user.id }, 'New-Password-2026!');
+        await authenticationService.changePassword({ tenantId, subject: user.id }, 'Old-Password-2026!', 'New-Password-2026!', userAuditor);
+        const authResult = await authenticationService.authenticateWithPassword({ tenantId, subject: user.id }, 'New-Password-2026!');
         expect(authResult.success).toBe(true);
     });
-    test('checkSecret, testSecret, and validateSecret', async () => {
+    test('checkPassword, testPassword, and validatePassword', async () => {
         const weak = 'abc';
         const strong = 'Very-Strong-Password-2026-!@#$';
-        expect((await authenticationService.checkSecret(weak)).strength).toBeLessThan(2);
-        expect((await authenticationService.checkSecret(strong)).strength).toBeGreaterThanOrEqual(2);
-        expect((await authenticationService.testSecret(weak)).success).toBe(false);
-        expect((await authenticationService.testSecret(strong)).success).toBe(true);
-        await expect(authenticationService.validateSecret(weak)).rejects.toThrow();
-        await expect(authenticationService.validateSecret(strong)).resolves.not.toThrow();
+        expect((await authenticationService.checkPassword(weak)).strength).toBeLessThan(2);
+        expect((await authenticationService.checkPassword(strong)).strength).toBeGreaterThanOrEqual(2);
+        expect((await authenticationService.testPassword(weak)).success).toBe(false);
+        expect((await authenticationService.testPassword(strong)).success).toBe(true);
+        await expect(authenticationService.validatePassword(weak)).rejects.toThrow();
+        await expect(authenticationService.validatePassword(strong)).resolves.not.toThrow();
     });
     test('tryResolveSubject and resolveSubject', async () => {
         const user = await subjectService.createUser({ tenantId, email: 'resolve@example.com', firstName: 'R', lastName: 'S' });
@@ -125,16 +133,16 @@ describe('AuthenticationService', () => {
         const impersonated = await authenticationService.impersonate(adminToken.token, adminToken.refreshToken, user.id, undefined, adminAuditor);
         expect(impersonated.jsonToken.payload.subject).toBe(user.id);
         expect(impersonated.jsonToken.payload.impersonator).toBe(admin.id);
-        const unimpersonated = await authenticationService.unimpersonate(impersonated.impersonatorRefreshToken, undefined, adminAuditor);
+        const unimpersonated = await authenticationService.unimpersonate(impersonated.impersonatorRefreshToken, impersonated.token, undefined, adminAuditor);
         expect(unimpersonated.jsonToken.payload.subject).toBe(admin.id);
         expect(unimpersonated.jsonToken.payload.impersonator).toBeUndefined();
     });
     test('refresh should throw on invalid token', async () => {
         await expect(authenticationService.refresh('invalid', undefined, {}, auditor)).rejects.toThrow();
     });
-    test('login should throw on invalid credentials', async () => {
+    test('login should throw on invalid password', async () => {
         const user = await subjectService.createUser({ tenantId, email: 'fail@example.com', firstName: 'F', lastName: 'L' });
-        await authenticationService.setCredentials(user, 'Very-Strong-Password-2026!');
+        await authenticationService.setPassword(user, 'Very-Strong-Password-2026!');
         await expect(authenticationService.login({ tenantId, subject: user.id }, 'wrong', undefined, auditor)).rejects.toThrow();
     });
     test('endSession should handle non-existent session gracefully', async () => {
@@ -143,13 +151,13 @@ describe('AuthenticationService', () => {
     test('resolveSubject should throw if not found', async () => {
         await expect(authenticationService.resolveSubject({ tenantId, subject: 'missing' })).rejects.toThrow();
     });
-    test('secret reset flow', async () => {
+    test('password reset flow', async () => {
         const user = await subjectService.createUser({ tenantId, email: 'reset@example.com', firstName: 'R', lastName: 'E' });
         const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        await authenticationService.initSecretReset({ tenantId, subject: user.id }, undefined, userAuditor);
+        await authenticationService.initPasswordReset({ tenantId, subject: user.id }, undefined, userAuditor);
         expect(ancillaryService.lastResetData).toBeDefined();
-        await authenticationService.resetSecret(ancillaryService.lastResetData.token, 'New-Password-Reset-2026!', userAuditor);
-        const authResult = await authenticationService.authenticate({ tenantId, subject: user.id }, 'New-Password-Reset-2026!');
+        await authenticationService.resetPassword(ancillaryService.lastResetData.token, 'New-Password-Reset-2026!', userAuditor);
+        const authResult = await authenticationService.authenticateWithPassword({ tenantId, subject: user.id }, 'New-Password-Reset-2026!');
         expect(authResult.success).toBe(true);
     });
     test('deriveSigningSecrets should work', async () => {

package/authentication/tests/authentication.test-ancillary-service.d.ts

@@ -3,7 +3,7 @@ export declare class DefaultAuthenticationAncillaryService extends Authenticatio
     #private;
     lastResetData: any;
     getTokenPayload(): Promise<{}>;
-    handleInitSecretReset(data: any): Promise<void>;
+    handleInitPasswordReset(data: any): Promise<void>;
     canImpersonate(_token: any, _subject: any, _data: any): Promise<boolean>;
     resolveSubjects(data: any): Promise<import("../index.js").Subject[]>;
 }

package/authentication/tests/authentication.test-ancillary-service.js

@@ -12,7 +12,7 @@ let DefaultAuthenticationAncillaryService = class DefaultAuthenticationAncillary
     #authenticationService;
     lastResetData;
     async getTokenPayload() { return {}; }
-    async handleInitSecretReset(data) { this.lastResetData = data; }
+    async handleInitPasswordReset(data) { this.lastResetData = data; }
     async canImpersonate(_token, _subject, _data) { return true; }
     async resolveSubjects(data) {
         if (isUndefined(this.#authenticationService)) {

package/authentication/tests/brute-force-protection.test.js

@@ -0,0 +1,211 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'vitest';
+import { ApiGateway } from '../../api/server/gateway.js';
+import { Auditor } from '../../audit/index.js';
+import { importKey } from '../../cryptography/index.js';
+import { generateTotpToken } from '../../cryptography/totp.js';
+import { HttpBody } from '../../http/http-body.js';
+import { HttpHeaders } from '../../http/http-headers.js';
+import { HttpQuery } from '../../http/http-query.js';
+import { HttpServerRequest } from '../../http/server/http-server-request.js';
+import { clearTenantData, setupIntegrationTest } from '../../testing/index.js';
+import { currentTimestampSeconds } from '../../utils/date-time.js';
+import { assert } from '../../utils/type-guards.js';
+import { AuthenticationService } from '../server/authentication.service.js';
+import { SubjectService } from '../server/subject.service.js';
+import { DefaultAuthenticationAncillaryService } from './authentication.test-ancillary-service.js';
+describe('Authentication Brute Force Protection (API Level)', () => {
+    let injector;
+    let database;
+    let gateway;
+    let subjectService;
+    let authenticationService;
+    let auditor;
+    const schema = 'authentication';
+    const tenantId = crypto.randomUUID();
+    beforeAll(async () => {
+        ({ injector, database } = await setupIntegrationTest({
+            modules: { authentication: true, rateLimiter: true, api: true },
+            authentication: {
+                ancillaryService: DefaultAuthenticationAncillaryService,
+                options: {
+                    bruteForceProtection: {
+                        subjectBurstCapacity: 2,
+                        subjectRefillInterval: 10000,
+                        ipBurstCapacity: 2,
+                        ipRefillInterval: 10000,
+                    },
+                },
+            },
+        }));
+        gateway = injector.resolve(ApiGateway);
+        subjectService = await injector.resolveAsync(SubjectService);
+        authenticationService = await injector.resolveAsync(AuthenticationService);
+        auditor = injector.resolve(Auditor);
+    });
+    afterAll(async () => {
+        await injector?.dispose();
+    });
+    beforeEach(async () => {
+        await clearTenantData(database, schema, ['used_totp_tokens', 'totp_recovery_code', 'totp', 'password', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
+    });
+    async function callLogin(ip, body) {
+        const headers = new HttpHeaders({ 'Content-Type': 'application/json' });
+        const encodedBody = new TextEncoder().encode(JSON.stringify(body));
+        const request = new HttpServerRequest({
+            url: new URL('http://localhost/api/v1/auth/token'),
+            method: 'POST',
+            headers,
+            query: new HttpQuery(),
+            ip,
+            body: HttpBody.from(encodedBody, headers),
+        });
+        let capturedResponse;
+        const respond = async (response) => { capturedResponse = response; };
+        const close = async () => { };
+        const abortSignal = new AbortController().signal;
+        await gateway.handleHttpServerRequestContext({ request, respond, close, abortSignal, context: {} });
+        return capturedResponse;
+    }
+    async function callDisableTotp(ip, token, body) {
+        const headers = new HttpHeaders({
+            'Content-Type': 'application/json',
+            'Authorization': `Bearer ${token}`
+        });
+        const encodedBody = new TextEncoder().encode(JSON.stringify(body));
+        const request = new HttpServerRequest({
+            url: new URL('http://localhost/api/v1/auth/totp/disable'),
+            method: 'POST',
+            headers,
+            query: new HttpQuery(),
+            ip,
+            body: HttpBody.from(encodedBody, headers),
+        });
+        let capturedResponse;
+        const respond = async (response) => { capturedResponse = response; };
+        const close = async () => { };
+        const abortSignal = new AbortController().signal;
+        await gateway.handleHttpServerRequestContext({ request, respond, close, abortSignal, context: {} });
+        return capturedResponse;
+    }
+    test('should limit login attempts by user', async () => {
+        const user = await subjectService.createUser({ tenantId, email: 'user-limit@example.com', firstName: 'John', lastName: 'Doe' });
+        await authenticationService.setPassword(user, 'Strong-Password-2026!');
+        const body = { tenantId, subject: user.id, password: 'wrong' };
+        // 1st attempt - Fail (InvalidCredentials)
+        let res = await callLogin('1.1.1.1', body);
+        expect(res.statusCode).toBe(401);
+        // 2nd attempt - Fail (InvalidCredentials)
+        res = await callLogin('1.1.1.2', body);
+        expect(res.statusCode).toBe(401);
+        // 3rd attempt - Should be throttled (429)
+        res = await callLogin('1.1.1.3', body);
+        expect(res.statusCode).toBe(429);
+        expect(res.body.json.error.name).toBe('TooManyRequestsError');
+    });
+    test('should limit login attempts by IP', async () => {
+        const ip = '2.2.2.2';
+        const user1 = await subjectService.createUser({ tenantId, email: 'ip-limit-1@example.com', firstName: 'A', lastName: 'B' });
+        const user2 = await subjectService.createUser({ tenantId, email: 'ip-limit-2@example.com', firstName: 'C', lastName: 'D' });
+        await authenticationService.setPassword(user1, 'Strong-Password-2026!');
+        await authenticationService.setPassword(user2, 'Strong-Password-2026!');
+        // Fail for user1
+        let res = await callLogin(ip, { tenantId, subject: user1.id, password: 'wrong' });
+        expect(res.statusCode).toBe(401);
+        // Fail for user2
+        res = await callLogin(ip, { tenantId, subject: user2.id, password: 'wrong' });
+        expect(res.statusCode).toBe(401);
+        // 3rd attempt from same IP - Should be throttled (429)
+        res = await callLogin(ip, { tenantId, subject: 'any', password: 'any' });
+        expect(res.statusCode).toBe(429);
+    });
+    test('should work for multiple successful logins', async () => {
+        const user1 = await subjectService.createUser({ tenantId, email: 'success1@example.com', firstName: 'E', lastName: 'F' });
+        const user2 = await subjectService.createUser({ tenantId, email: 'success2@example.com', firstName: 'E', lastName: 'F' });
+        const user3 = await subjectService.createUser({ tenantId, email: 'success3@example.com', firstName: 'E', lastName: 'F' });
+        await authenticationService.setPassword(user1, 'Strong-Password-2026!');
+        await authenticationService.setPassword(user2, 'Strong-Password-2026!');
+        await authenticationService.setPassword(user3, 'Strong-Password-2026!');
+        // 1st attempt
+        let res = await callLogin('4.4.4.1', { tenantId, subject: user1.id, password: 'Strong-Password-2026!' });
+        expect(res.statusCode).toBe(200);
+        // 2nd attempt
+        res = await callLogin('4.4.4.2', { tenantId, subject: user2.id, password: 'Strong-Password-2026!' });
+        expect(res.statusCode).toBe(200);
+        // 3rd attempt
+        res = await callLogin('4.4.4.3', { tenantId, subject: user3.id, password: 'Strong-Password-2026!' });
+        expect(res.statusCode).toBe(200);
+    });
+    test('should limit disableTotp attempts by user', async () => {
+        const password = 'Strong-Password-2026!';
+        const user = await subjectService.createUser({ tenantId, email: 'totp-limit@example.com', firstName: 'John', lastName: 'Doe' });
+        await authenticationService.setPassword(user, password);
+        // Enable TOTP for the user
+        await authenticationService.initEnrollTotp(tenantId, user.id, auditor);
+        const totpEntry = await authenticationService.tryGetTotp(tenantId, user.id);
+        const secret = await importKey('raw-secret', totpEntry.secret, { name: 'HMAC', hash: authenticationService.getTotpOptions().codeHashAlgorithm }, false, ['sign']);
+        const setupToken = await generateTotpToken(secret, { ...authenticationService.getTotpOptions(), timestamp: currentTimestampSeconds() - 30 });
+        await authenticationService.completeEnrollTotp(tenantId, user.id, setupToken, auditor);
+        // Login to get a session token
+        const loginResult = await authenticationService.login({ tenantId, subject: user.id }, password, undefined, auditor);
+        expect(loginResult.type).toBe('totp');
+        assert(loginResult.type == 'totp', 'Login should have triggered TOTP');
+        const verifyToken = await generateTotpToken(secret, authenticationService.getTotpOptions());
+        const verifyResult = await authenticationService.loginVerifyTotp(loginResult.challengeToken, verifyToken, auditor);
+        expect(verifyResult.type).toBe('success');
+        assert(verifyResult.type == 'success', 'TOTP verification failed');
+        const sessionToken = verifyResult.result.token;
+        // 1st attempt - Fail (Invalid TOTP token)
+        let res = await callDisableTotp('1.1.1.1', sessionToken, { token: '000000' });
+        expect(res.statusCode).toBe(403);
+        // 2nd attempt - Fail (Invalid TOTP token)
+        res = await callDisableTotp('1.1.1.2', sessionToken, { token: '000001' });
+        expect(res.statusCode).toBe(403);
+        // 3rd attempt - Should be throttled (429)
+        res = await callDisableTotp('1.1.1.3', sessionToken, { token: '000002' });
+        expect(res.statusCode).toBe(429);
+        expect(res.body.json.error.name).toBe('TooManyRequestsError');
+    });
+    test('should limit disableTotp attempts by IP', async () => {
+        const password = 'Strong-Password-2026!';
+        const ip = '3.3.3.3';
+        // Create two users with TOTP enabled
+        const user1 = await subjectService.createUser({ tenantId, email: 'totp-ip-1@example.com', firstName: 'A', lastName: 'B' });
+        await authenticationService.setPassword(user1, password);
+        await authenticationService.initEnrollTotp(tenantId, user1.id, auditor);
+        const totpEntry1 = await authenticationService.tryGetTotp(tenantId, user1.id);
+        const secret1 = await importKey('raw-secret', totpEntry1.secret, { name: 'HMAC', hash: authenticationService.getTotpOptions().codeHashAlgorithm }, false, ['sign']);
+        const setupToken1 = await generateTotpToken(secret1, { ...authenticationService.getTotpOptions(), timestamp: currentTimestampSeconds() - 30 });
+        await authenticationService.completeEnrollTotp(tenantId, user1.id, setupToken1, auditor);
+        const user2 = await subjectService.createUser({ tenantId, email: 'totp-ip-2@example.com', firstName: 'C', lastName: 'D' });
+        await authenticationService.setPassword(user2, password);
+        await authenticationService.initEnrollTotp(tenantId, user2.id, auditor);
+        const totpEntry2 = await authenticationService.tryGetTotp(tenantId, user2.id);
+        const secret2 = await importKey('raw-secret', totpEntry2.secret, { name: 'HMAC', hash: authenticationService.getTotpOptions().codeHashAlgorithm }, false, ['sign']);
+        const setupToken2 = await generateTotpToken(secret2, { ...authenticationService.getTotpOptions(), timestamp: currentTimestampSeconds() - 30 });
+        await authenticationService.completeEnrollTotp(tenantId, user2.id, setupToken2, auditor);
+        // Login both users
+        const loginResult1 = await authenticationService.login({ tenantId, subject: user1.id }, password, undefined, auditor);
+        const loginResult2 = await authenticationService.login({ tenantId, subject: user2.id }, password, undefined, auditor);
+        expect(loginResult1.type).toBe('totp');
+        expect(loginResult2.type).toBe('totp');
+        assert(loginResult1.type == 'totp' && loginResult2.type == 'totp', 'Login should have triggered TOTP');
+        const verifyToken1 = await generateTotpToken(secret1, authenticationService.getTotpOptions());
+        const verifyToken2 = await generateTotpToken(secret2, authenticationService.getTotpOptions());
+        const verifyResult1 = await authenticationService.loginVerifyTotp(loginResult1.challengeToken, verifyToken1, auditor);
+        const verifyResult2 = await authenticationService.loginVerifyTotp(loginResult2.challengeToken, verifyToken2, auditor);
+        expect(verifyResult1.type).toBe('success');
+        expect(verifyResult2.type).toBe('success');
+        assert(verifyResult1.type == 'success' && verifyResult2.type == 'success', 'TOTP verification failed');
+        const sessionToken1 = verifyResult1.result.token;
+        const sessionToken2 = verifyResult2.result.token;
+        // Fail for user1 from IP
+        let res = await callDisableTotp(ip, sessionToken1, { token: '000000' });
+        expect(res.statusCode).toBe(403);
+        // Fail for user2 from same IP
+        res = await callDisableTotp(ip, sessionToken2, { token: '000000' });
+        expect(res.statusCode).toBe(403);
+        // 3rd attempt from same IP - Should be throttled (429)
+        res = await callDisableTotp(ip, sessionToken1, { token: 'any' });
+        expect(res.statusCode).toBe(429);
+    });
+});

package/authentication/tests/helper.test.js

@@ -1,11 +1,15 @@
-import { describe, expect, test } from 'vitest';
+import { beforeAll, describe, expect, test } from 'vitest';
+import { createJwtTokenString, importKmacKey } from '../../cryptography/index.js';
 import { BadRequestError } from '../../errors/bad-request.error.js';
 import { InvalidTokenError } from '../../errors/invalid-token.error.js';
 import { currentTimestampSeconds } from '../../utils/date-time.js';
-import { createJwtTokenString } from '../../utils/jwt.js';
-import { getRefreshTokenFromString, getSecretResetTokenFromString, getTokenFromRequest, getTokenFromString, tryGetAuthorizationTokenStringFromRequest, tryGetTokenFromRequest } from '../server/helper.js';
+import { encodeUtf8 } from '../../utils/encoding.js';
+import { getPasswordResetTokenFromString, getRefreshTokenFromString, getTokenFromRequest, getTokenFromString, tryGetAuthorizationTokenStringFromRequest, tryGetTokenFromRequest } from '../server/helper.js';
 describe('authentication helper', () => {
-    const secret = 'test-secret';
+    let signingKey;
+    beforeAll(async () => {
+        signingKey = await importKmacKey('raw-secret', 'KMAC256', encodeUtf8('test-secret-with-enough-length-32'));
+    });
     test('tryGetAuthorizationTokenStringFromRequest should extract bearer token from header', () => {
         const request = {
             headers: {
@@ -17,7 +21,7 @@ describe('authentication helper', () => {
         };
         expect(tryGetAuthorizationTokenStringFromRequest(request)).toBe('my-token');
     });
-    test('tryGetAuthorizationTokenStringFromRequest should extract token without scheme from header', () => {
+    test('tryGetAuthorizationTokenStringFromRequest should throw if token without scheme from header', () => {
         const request = {
             headers: {
                 tryGet: (name) => name == 'Authorization' ? 'my-token' : undefined,
@@ -26,7 +30,7 @@ describe('authentication helper', () => {
                 tryGet: () => undefined,
             },
         };
-        expect(tryGetAuthorizationTokenStringFromRequest(request)).toBe('my-token');
+        expect(() => tryGetAuthorizationTokenStringFromRequest(request)).toThrow(BadRequestError);
     });
     test('tryGetAuthorizationTokenStringFromRequest should extract bearer token from cookie', () => {
         const request = {
@@ -34,7 +38,7 @@ describe('authentication helper', () => {
                 tryGet: () => undefined,
             },
             cookies: {
-                tryGet: (name) => name == 'authorization' ? 'Bearer my-token' : undefined,
+                tryGet: (name) => name == 'token' ? 'my-token' : undefined,
             },
         };
         expect(tryGetAuthorizationTokenStringFromRequest(request)).toBe('my-token');
@@ -63,35 +67,35 @@ describe('authentication helper', () => {
     });
     test('getTokenFromString should validate token', async () => {
         const payload = { exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's', jti: 'j' };
-        const token = await createJwtTokenString({ header: { v: 1, alg: 'HS256', typ: 'JWT' }, payload }, secret);
-        const validated = await getTokenFromString(token, 1, secret);
+        const token = await createJwtTokenString({ header: { v: 1, alg: 'KMAC256', typ: 'JWT' }, payload }, signingKey);
+        const validated = await getTokenFromString(token, 1, signingKey);
         expect(validated.payload).toEqual(payload);
     });
     test('getTokenFromString should throw on version mismatch', async () => {
         const payload = { exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's', jti: 'j' };
-        const token = await createJwtTokenString({ header: { v: 2, alg: 'HS256', typ: 'JWT' }, payload }, secret);
-        await expect(getTokenFromString(token, 1, secret)).rejects.toThrow(InvalidTokenError);
+        const token = await createJwtTokenString({ header: { v: 2, alg: 'KMAC256', typ: 'JWT' }, payload }, signingKey);
+        await expect(getTokenFromString(token, 1, signingKey)).rejects.toThrow(InvalidTokenError);
     });
     test('getTokenFromString should throw on expired token', async () => {
         const payload = { exp: currentTimestampSeconds() - 60, tenant: 't', subject: 's', jti: 'j' };
-        const token = await createJwtTokenString({ header: { v: 1, alg: 'HS256', typ: 'JWT' }, payload }, secret);
-        await expect(getTokenFromString(token, 1, secret)).rejects.toThrow('Token expired');
+        const token = await createJwtTokenString({ header: { v: 1, alg: 'KMAC256', typ: 'JWT' }, payload }, signingKey);
+        await expect(getTokenFromString(token, 1, signingKey)).rejects.toThrow('Token expired');
     });
     test('getRefreshTokenFromString should validate refresh token', async () => {
         const payload = { exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's', session: 'sess', secret: 'sec' };
-        const token = await createJwtTokenString({ header: { alg: 'HS256', typ: 'JWT' }, payload }, secret);
-        const validated = await getRefreshTokenFromString(token, secret);
+        const token = await createJwtTokenString({ header: { alg: 'KMAC256', typ: 'JWT' }, payload }, signingKey);
+        const validated = await getRefreshTokenFromString(token, signingKey);
         expect(validated.payload).toEqual(payload);
     });
-    test('getSecretResetTokenFromString should validate secret reset token', async () => {
+    test('getPasswordResetTokenFromString should validate password reset token', async () => {
         const payload = { iat: currentTimestampSeconds(), exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's' };
-        const token = await createJwtTokenString({ header: { alg: 'HS256', typ: 'JWT' }, payload }, secret);
-        const validated = await getSecretResetTokenFromString(token, secret);
+        const token = await createJwtTokenString({ header: { alg: 'KMAC256', typ: 'JWT' }, payload }, signingKey);
+        const validated = await getPasswordResetTokenFromString(token, signingKey);
         expect(validated.payload).toEqual(payload);
     });
     test('getTokenFromRequest should extract and validate token', async () => {
         const payload = { exp: currentTimestampSeconds() + 60, tenant: 't', subject: 's', jti: 'j' };
-        const token = await createJwtTokenString({ header: { v: 1, alg: 'HS256', typ: 'JWT' }, payload }, secret);
+        const token = await createJwtTokenString({ header: { v: 1, alg: 'KMAC256', typ: 'JWT' }, payload }, signingKey);
         const request = {
             headers: {
                 tryGet: (name) => name == 'Authorization' ? `Bearer ${token}` : undefined,
@@ -100,7 +104,7 @@ describe('authentication helper', () => {
                 tryGet: () => undefined,
             },
         };
-        const validated = await getTokenFromRequest(request, 1, secret);
+        const validated = await getTokenFromRequest(request, 1, signingKey);
         expect(validated.payload).toEqual(payload);
     });
     test('tryGetTokenFromRequest should return undefined if no token in request', async () => {
@@ -112,7 +116,7 @@ describe('authentication helper', () => {
                 tryGet: () => undefined,
             },
         };
-        const validated = await tryGetTokenFromRequest(request, 1, secret);
+        const validated = await tryGetTokenFromRequest(request, 1, signingKey);
         expect(validated).toBeUndefined();
     });
 });

package/authentication/tests/password-requirements.error.test.js

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest';
+import { PasswordRequirementsError } from '../errors/password-requirements.error.js';
+describe('PasswordRequirementsError', () => {
+    it('should create an error with the given message', () => {
+        const message = 'Password is too weak.';
+        const error = new PasswordRequirementsError(message);
+        expect(error.message).toBe(message);
+        expect(error.name).toBe('PasswordRequirementsError');
+    });
+    it('should have the correct name', () => {
+        const error = new PasswordRequirementsError('any message');
+        expect(error.name).toBe('PasswordRequirementsError');
+    });
+});