@tstdl/base 0.93.182 → 0.93.184

package/authentication/tests/remember.api.test.js

@@ -1,117 +0,0 @@
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'vitest';
-import { Auditor } from '../../audit/index.js';
-import { HttpHeaders } from '../../http/index.js';
-import { HttpServerResponse } from '../../http/server/index.js';
-import { clearTenantData, setupIntegrationTest } from '../../testing/index.js';
-import { toArray } from '../../utils/array/array.js';
-import { AuthenticationApiController } from '../server/authentication.api-controller.js';
-import { AuthenticationService } from '../server/authentication.service.js';
-import { SubjectService } from '../server/subject.service.js';
-import { DefaultAuthenticationAncillaryService } from './authentication.test-ancillary-service.js';
-describe('AuthenticationApiController Remember Functionality', () => {
-    let injector;
-    let database;
-    let controller;
-    let authenticationService;
-    let subjectService;
-    let auditor;
-    const schema = 'authentication';
-    const tenantId = crypto.randomUUID();
-    beforeAll(async () => {
-        ({ injector, database } = await setupIntegrationTest({
-            modules: { authentication: true, audit: true, keyValueStore: true, signals: true, api: true },
-            authentication: {
-                ancillaryService: DefaultAuthenticationAncillaryService,
-            },
-        }));
-        authenticationService = await injector.resolveAsync(AuthenticationService);
-        subjectService = await injector.resolveAsync(SubjectService);
-        auditor = injector.resolve(Auditor);
-        controller = injector.resolve(AuthenticationApiController);
-    });
-    afterAll(async () => {
-        await injector?.dispose();
-    });
-    beforeEach(async () => {
-        await clearTenantData(database, schema, ['used_totp_tokens', 'totp_recovery_code', 'totp', 'password', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
-    });
-    test('login with remember: true should have Expires in cookies', async () => {
-        const user = await subjectService.createUser({ tenantId, email: 'api-rem@example.com', firstName: 'A', lastName: 'L' });
-        await authenticationService.setPassword(user, 'Pass-R3m3mb3r-2026!');
-        const context = {
-            request: { ip: '127.0.0.1' },
-            parameters: { tenantId, subject: user.id, password: 'Pass-R3m3mb3r-2026!', remember: true, data: undefined },
-            getAuditor: async () => auditor,
-        };
-        const response = await controller.login(context);
-        expect(response).toBeInstanceOf(HttpServerResponse);
-        const setCookieHeaders = toArray(response.headers.tryGet('Set-Cookie') ?? []);
-        expect(setCookieHeaders).toHaveLength(2); // authorization and refreshToken
-        for (const cookie of setCookieHeaders) {
-            expect(cookie).toMatch(/Expires=/);
-        }
-    });
-    test('login with remember: false should NOT have Expires in cookies', async () => {
-        const user = await subjectService.createUser({ tenantId, email: 'api-no-rem@example.com', firstName: 'A', lastName: 'L' });
-        await authenticationService.setPassword(user, 'Pass-R3m3mb3r-2026!');
-        const context = {
-            request: { ip: '127.0.0.1' },
-            parameters: { tenantId, subject: user.id, password: 'Pass-R3m3mb3r-2026!', remember: false, data: undefined },
-            getAuditor: async () => auditor,
-        };
-        const response = await controller.login(context);
-        const setCookieHeaders = toArray(response.headers.tryGet('Set-Cookie') ?? []);
-        for (const cookie of setCookieHeaders) {
-            expect(cookie).not.toMatch(/Expires=/);
-            expect(cookie).not.toMatch(/Max-Age=/);
-        }
-    });
-    test('refresh should propagate remember status to cookies', async () => {
-        const user = await subjectService.createUser({ tenantId, email: 'api-refresh-rem@example.com', firstName: 'A', lastName: 'L' });
-        await authenticationService.setPassword(user, 'Pass-R3m3mb3r-2026!');
-        // 1. Login with remember: true
-        const loginResult = await authenticationService.login({ tenantId, subject: user.id }, 'Pass-R3m3mb3r-2026!', undefined, auditor, true);
-        expect(loginResult.type).toBe('success');
-        // 2. Refresh
-        const context = {
-            request: {
-                ip: '127.0.0.1',
-                headers: new HttpHeaders({
-                    'X-Refresh-Token': `Bearer ${loginResult.result.refreshToken}`,
-                }),
-                cookies: {
-                    tryGet: () => undefined,
-                },
-            },
-            parameters: { data: undefined },
-            getAuditor: async () => auditor,
-        };
-        const response = await controller.refresh(context);
-        const setCookieHeaders = toArray(response.headers.tryGet('Set-Cookie') ?? []);
-        for (const cookie of setCookieHeaders) {
-            expect(cookie).toMatch(/Expires=/);
-        }
-        // 3. Login with remember: false
-        const loginResultNoRem = await authenticationService.login({ tenantId, subject: user.id }, 'Pass-R3m3mb3r-2026!', undefined, auditor, false);
-        expect(loginResultNoRem.type).toBe('success');
-        // 4. Refresh
-        const contextNoRem = {
-            request: {
-                ip: '127.0.0.1',
-                headers: new HttpHeaders({
-                    'X-Refresh-Token': `Bearer ${loginResultNoRem.result.refreshToken}`,
-                }),
-                cookies: {
-                    tryGet: () => undefined,
-                },
-            },
-            parameters: { data: undefined },
-            getAuditor: async () => auditor,
-        };
-        const responseNoRem = await controller.refresh(contextNoRem);
-        const setCookieHeadersNoRem = toArray(responseNoRem.headers.tryGet('Set-Cookie') ?? []);
-        for (const cookie of setCookieHeadersNoRem) {
-            expect(cookie).not.toMatch(/Expires=/);
-        }
-    });
-});

package/authentication/tests/remember.service.test.d.ts

@@ -1 +0,0 @@
-export {};

package/authentication/tests/remember.service.test.js

@@ -1,83 +0,0 @@
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'vitest';
-import { Auditor } from '../../audit/index.js';
-import { clearTenantData, setupIntegrationTest } from '../../testing/index.js';
-import { AuthenticationService } from '../server/authentication.service.js';
-import { SubjectService } from '../server/subject.service.js';
-import { DefaultAuthenticationAncillaryService } from './authentication.test-ancillary-service.js';
-describe('AuthenticationService Remember Functionality', () => {
-    let injector;
-    let database;
-    let authenticationService;
-    let subjectService;
-    let auditor;
-    const schema = 'authentication';
-    const tenantId = crypto.randomUUID();
-    beforeAll(async () => {
-        ({ injector, database } = await setupIntegrationTest({
-            modules: { authentication: true },
-            authentication: {
-                ancillaryService: DefaultAuthenticationAncillaryService,
-            },
-        }));
-        authenticationService = await injector.resolveAsync(AuthenticationService);
-        subjectService = await injector.resolveAsync(SubjectService);
-        auditor = injector.resolve(Auditor);
-    });
-    afterAll(async () => {
-        await injector?.dispose();
-    });
-    beforeEach(async () => {
-        await clearTenantData(database, schema, ['password', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
-    });
-    test('RefreshToken should contain remember flag', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'remember@example.com',
-            firstName: 'Rem',
-            lastName: 'Ember',
-        });
-        const tokenResult = await authenticationService.getToken(user, undefined, { remember: true });
-        const refreshToken = await authenticationService.validateRefreshToken(tokenResult.refreshToken);
-        expect(refreshToken.payload).toHaveProperty('remember', true);
-        expect(tokenResult.remember).toBe(true);
-    });
-    test('RefreshToken should respect remember flag for expiration', async () => {
-        const user = await subjectService.createUser({ tenantId, email: 'ttl@example.com', firstName: 'T', lastName: 'L' });
-        const normalResult = await authenticationService.getToken(user, undefined, { remember: false });
-        const rememberResult = await authenticationService.getToken(user, undefined, { remember: true });
-        const normalToken = await authenticationService.validateRefreshToken(normalResult.refreshToken);
-        const rememberToken = await authenticationService.validateRefreshToken(rememberResult.refreshToken);
-        expect(rememberToken.payload.exp).toBeGreaterThan(normalToken.payload.exp);
-    });
-    test('login should pass remember flag to getToken', async () => {
-        const user = await subjectService.createUser({ tenantId, email: 'login-rem@example.com', firstName: 'L', lastName: 'R' });
-        await authenticationService.setPassword(user, 'Strong-Password-2026!');
-        const result = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, auditor, true);
-        expect(result.type).toBe('success');
-        const tokenResult = result.result;
-        expect(tokenResult.remember).toBe(true);
-        const refreshToken = await authenticationService.validateRefreshToken(tokenResult.refreshToken);
-        expect(refreshToken.payload.remember).toBe(true);
-    });
-    test('refresh should propagate remember flag', async () => {
-        const user = await subjectService.createUser({ tenantId, email: 'refresh-rem@example.com', firstName: 'R', lastName: 'R' });
-        await authenticationService.setPassword(user, 'Strong-Password-2026!');
-        const loginResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, auditor, true);
-        expect(loginResult.type).toBe('success');
-        const loginSuccessResult = loginResult.result;
-        expect(loginSuccessResult.remember).toBe(true);
-        const refreshResult = await authenticationService.refresh(loginSuccessResult.refreshToken, undefined, {}, auditor);
-        expect(refreshResult.remember).toBe(true);
-        const newRefreshToken = await authenticationService.validateRefreshToken(refreshResult.refreshToken);
-        expect(newRefreshToken.payload.remember).toBe(true);
-        // Verify it also works when not remembered
-        const loginResultNoRem = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, auditor, false);
-        expect(loginResultNoRem.type).toBe('success');
-        const loginSuccessResultNoRem = loginResultNoRem.result;
-        expect(loginSuccessResultNoRem.remember).toBe(false);
-        const refreshResultNoRem = await authenticationService.refresh(loginSuccessResultNoRem.refreshToken, undefined, {}, auditor);
-        expect(refreshResultNoRem.remember).toBe(false);
-        const newRefreshTokenNoRem = await authenticationService.validateRefreshToken(refreshResultNoRem.refreshToken);
-        expect(newRefreshTokenNoRem.payload.remember).toBe(false);
-    });
-});

package/authentication/tests/subject.service.test.d.ts

@@ -1 +0,0 @@
-export {};

package/authentication/tests/subject.service.test.js

@@ -1,140 +0,0 @@
-import { beforeAll, beforeEach, describe, expect, test } from 'vitest';
-import { NIL_UUID } from '../../constants.js';
-import { runInInjectionContext } from '../../injector/index.js';
-import { clearTenantData, setupIntegrationTest } from '../../testing/index.js';
-import { SubjectStatus } from '../models/index.js';
-import { SubjectService } from '../server/subject.service.js';
-describe('SubjectService', () => {
-    let injector;
-    let database;
-    let subjectService;
-    const schema = 'authentication';
-    const tenantId = crypto.randomUUID();
-    beforeAll(async () => {
-        ({ injector, database } = await setupIntegrationTest({ modules: { authentication: true } }));
-        subjectService = injector.resolve(SubjectService);
-    });
-    beforeEach(async () => {
-        await clearTenantData(database, schema, ['user', 'service_account', 'system_account', 'subject'], tenantId);
-    });
-    test('createUser should create a user', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({
-                tenantId,
-                email: 'test@example.com',
-                firstName: 'John',
-                lastName: 'Doe',
-            });
-            expect(user.id).toBeDefined();
-            expect(user.email).toBe('test@example.com');
-            expect(user.status).toBe(SubjectStatus.Active);
-        });
-    });
-    test('exists should return true if subject exists', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({
-                tenantId,
-                email: 'test@example.com',
-                firstName: 'John',
-                lastName: 'Doe',
-            });
-            expect(await subjectService.exists(tenantId, user.id)).toBe(true);
-            expect(await subjectService.exists(tenantId, NIL_UUID)).toBe(false);
-            const found = await subjectService.hasUserByEmail(tenantId, 'test@example.com');
-            const notFound = await subjectService.hasUserByEmail(tenantId, 'missing@example.com');
-            expect(found).toBe(true);
-            expect(notFound).toBe(false);
-        });
-    });
-    test('deleteUser should soft delete a user', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({
-                tenantId,
-                email: 'test@example.com',
-                firstName: 'John',
-                lastName: 'Doe',
-            });
-            expect(await subjectService.exists(tenantId, user.id)).toBe(true);
-            await subjectService.deleteUser(tenantId, user.id);
-            const deletedUser = await subjectService.getSubject(user.id, { withDeleted: true });
-            expect(deletedUser.metadata.deleteTimestamp).not.toBeNull();
-        });
-    });
-    test('listUsers should list all non-deleted users in a tenant', async () => {
-        await runInInjectionContext(injector, async () => {
-            await subjectService.createUser({
-                tenantId,
-                email: 'user1@example.com',
-                firstName: 'User',
-                lastName: 'One',
-            });
-            const user2 = await subjectService.createUser({
-                tenantId,
-                email: 'user2@example.com',
-                firstName: 'User',
-                lastName: 'Two',
-            });
-            await subjectService.deleteUser(tenantId, user2.id);
-            const users = await subjectService.listUsers(tenantId);
-            expect(users).toHaveLength(1);
-            expect(users[0]?.email).toBe('user1@example.com');
-        });
-    });
-    test('getSystemAccountSubject should create or return system account', async () => {
-        await runInInjectionContext(injector, async () => {
-            const sa1 = await subjectService.getSystemAccount(tenantId, 'test-system');
-            expect(sa1.id).toBeDefined();
-            expect(sa1.identifier).toBe('test-system');
-            const sa2 = await subjectService.getSystemAccount(tenantId, 'test-system');
-            expect(sa2.id).toBe(sa1.id);
-        });
-    });
-    test('updateUser should update user details', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'update@example.com', firstName: 'Old', lastName: 'Name' });
-            await subjectService.updateUser(tenantId, user.id, { firstName: 'New', status: SubjectStatus.Suspended });
-            const updated = await subjectService.getUser(tenantId, user.id);
-            expect(updated.firstName).toBe('New');
-            expect(updated.lastName).toBe('Name');
-            expect(updated.status).toBe(SubjectStatus.Suspended);
-        });
-    });
-    test('updateUserEmail should update user email', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'email@example.com', firstName: 'E', lastName: 'M' });
-            await subjectService.updateUserEmail(tenantId, user.id, 'new-email@example.com');
-            const updated = await subjectService.getUserByEmail(tenantId, 'new-email@example.com');
-            expect(updated.id).toBe(user.id);
-            await expect(subjectService.updateUserEmail(tenantId, user.id, 'invalid-email')).rejects.toThrow();
-        });
-    });
-    test('service accounts should be manageable', async () => {
-        await runInInjectionContext(injector, async () => {
-            const sa = await subjectService.createServiceAccount({ tenantId, displayName: 'SA', description: 'Desc', parent: null });
-            expect(sa.displayName).toBe('SA');
-            await subjectService.updateServiceAccount(tenantId, sa.id, { displayName: 'New SA' });
-            const updated = await subjectService.getServiceAccount(tenantId, sa.id);
-            expect(updated.displayName).toBe('New SA');
-            const saBySubject = await subjectService.getServiceAccountBySubject(updated);
-            expect(saBySubject.id).toBe(sa.id);
-            const list = await subjectService.listServiceAccounts(tenantId);
-            expect(list).toHaveLength(1);
-            await subjectService.deleteServiceAccount(tenantId, sa.id);
-            expect(await subjectService.exists(tenantId, sa.id)).toBe(false);
-        });
-    });
-    test('deleteUser should remove user', async () => {
-        await runInInjectionContext(injector, async () => {
-            const user = await subjectService.createUser({ tenantId, email: 'delete@example.com', firstName: 'D', lastName: 'E' });
-            await subjectService.deleteUser(tenantId, user.id);
-            expect(await subjectService.exists(tenantId, user.id)).toBe(false);
-        });
-    });
-    test('getSystemAccountSubject should load or create system account', async () => {
-        await runInInjectionContext(injector, async () => {
-            const sa1 = await subjectService.getSystemAccount(tenantId, 'sys1');
-            const sa2 = await subjectService.getSystemAccount(tenantId, 'sys1');
-            expect(sa1.id).toBe(sa2.id);
-        });
-    });
-});

package/authentication/tests/suspended-subject.test.d.ts

@@ -1 +0,0 @@
-export {};

package/authentication/tests/suspended-subject.test.js

@@ -1,120 +0,0 @@
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'vitest';
-import { ActorType, Auditor } from '../../audit/index.js';
-import { clearTenantData, setupIntegrationTest } from '../../testing/index.js';
-import { SubjectStatus } from '../models/index.js';
-import { AuthenticationAncillaryService } from '../server/authentication-ancillary.service.js';
-import { AuthenticationService } from '../server/authentication.service.js';
-import { SubjectService } from '../server/subject.service.js';
-import { DefaultAuthenticationAncillaryService } from './authentication.test-ancillary-service.js';
-describe('Suspended Subject Authentication', () => {
-    let injector;
-    let database;
-    let authenticationService;
-    let subjectService;
-    let auditor;
-    const schema = 'authentication';
-    const tenantId = crypto.randomUUID();
-    beforeAll(async () => {
-        ({ injector, database } = await setupIntegrationTest({
-            modules: { authentication: true },
-            authentication: {
-                ancillaryService: DefaultAuthenticationAncillaryService,
-            },
-        }));
-        authenticationService = await injector.resolveAsync(AuthenticationService);
-        subjectService = await injector.resolveAsync(SubjectService);
-        auditor = injector.resolve(Auditor);
-    });
-    afterAll(async () => {
-        await injector?.dispose();
-    });
-    beforeEach(async () => {
-        await clearTenantData(database, schema, ['totp_recovery_code', 'totp', 'password', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
-    });
-    test('login should FAIL for suspended user', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'suspended@example.com',
-            firstName: 'Suspended',
-            lastName: 'User',
-            status: SubjectStatus.Suspended,
-        });
-        await authenticationService.setPassword(user, 'Strong-Password-2026!');
-        const loginPromise = authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, auditor.with({ actor: user.id, actorType: ActorType.Subject }));
-        await expect(loginPromise).rejects.toThrow('Invalid credentials.');
-    });
-    test('refresh should FAIL for suspended user', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'suspended-refresh@example.com',
-            firstName: 'Suspended',
-            lastName: 'Refresh',
-            status: SubjectStatus.Active, // Start active to get a token
-        });
-        await authenticationService.setPassword(user, 'Strong-Password-2026!');
-        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        const loginResult = await authenticationService.login({ tenantId, subject: user.id }, 'Strong-Password-2026!', undefined, userAuditor);
-        expect(loginResult.type).toBe('success');
-        // Now suspend the user
-        await subjectService.updateUser(tenantId, user.id, { status: SubjectStatus.Suspended });
-        const refreshPromise = authenticationService.refresh(loginResult.result.refreshToken, undefined, {}, userAuditor);
-        await expect(refreshPromise).rejects.toThrow('Subject is suspended.');
-    });
-    test('impersonate should FAIL if target is suspended', async () => {
-        const admin = await subjectService.createUser({ tenantId, email: 'admin@example.com', firstName: 'A', lastName: 'D' });
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'suspended-target@example.com',
-            firstName: 'S',
-            lastName: 'T',
-            status: SubjectStatus.Suspended,
-        });
-        const adminAuditor = auditor.with({ actor: admin.id, actorType: ActorType.Subject });
-        const adminToken = await authenticationService.getToken(admin, undefined);
-        const impersonatePromise = authenticationService.impersonate(adminToken.token, adminToken.refreshToken, user.id, undefined, adminAuditor);
-        await expect(impersonatePromise).rejects.toThrow('Subject is suspended.');
-    });
-    test('changePassword should FAIL for suspended user', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'suspended-change@example.com',
-            firstName: 'S',
-            lastName: 'C',
-            status: SubjectStatus.Suspended,
-        });
-        await authenticationService.setPassword(user, 'Old-Password-2026!');
-        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        const changePasswordPromise = authenticationService.changePassword({ tenantId, subject: user.id }, 'Old-Password-2026!', 'New-Password-2026!', userAuditor);
-        await expect(changePasswordPromise).rejects.toThrow('Invalid credentials.');
-    });
-    test('resetPassword should FAIL for suspended user', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'suspended-reset@example.com',
-            firstName: 'S',
-            lastName: 'R',
-            status: SubjectStatus.Active,
-        });
-        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        // @ts-ignore - access private for test or use public init
-        const passwordResetToken = await authenticationService.createPasswordResetToken(user, Date.now() + 100000);
-        // Suspend after token issue
-        await subjectService.updateUser(tenantId, user.id, { status: SubjectStatus.Suspended });
-        const resetPasswordPromise = authenticationService.resetPassword(passwordResetToken.token, 'New-Password-Reset-2026!', userAuditor);
-        await expect(resetPasswordPromise).rejects.toThrow('Subject is suspended.');
-    });
-    test('initPasswordReset should SILENTLY IGNORE suspended user', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'suspended-init-reset@example.com',
-            firstName: 'S',
-            lastName: 'IR',
-            status: SubjectStatus.Suspended,
-        });
-        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        const ancillaryService = await injector.resolveAsync(AuthenticationAncillaryService);
-        ancillaryService.lastResetData = undefined;
-        await authenticationService.initPasswordReset({ tenantId, subject: user.id }, undefined, userAuditor);
-        expect(ancillaryService.lastResetData).toBeUndefined();
-    });
-});

package/authentication/tests/totp.enrollment.test.d.ts

@@ -1 +0,0 @@
-export {};

package/authentication/tests/totp.enrollment.test.js

@@ -1,123 +0,0 @@
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'vitest';
-import { ActorType, Auditor } from '../../audit/index.js';
-import { importHmacKey, importKey } from '../../cryptography/index.js';
-import { generateTotpToken } from '../../cryptography/totp.js';
-import { clearTenantData, setupIntegrationTest } from '../../testing/index.js';
-import { currentTimestampSeconds } from '../../utils/date-time.js';
-import { TotpStatus } from '../models/authentication-totp.model.js';
-import { AuthenticationService } from '../server/authentication.service.js';
-import { SubjectService } from '../server/subject.service.js';
-import { DefaultAuthenticationAncillaryService } from './authentication.test-ancillary-service.js';
-describe('TOTP Enrollment', () => {
-    let injector;
-    let database;
-    let authenticationService;
-    let subjectService;
-    let auditor;
-    const schema = 'authentication';
-    const tenantId = crypto.randomUUID();
-    beforeAll(async () => {
-        ({ injector, database } = await setupIntegrationTest({
-            modules: { authentication: true },
-            authentication: {
-                ancillaryService: DefaultAuthenticationAncillaryService,
-            },
-        }));
-        authenticationService = await injector.resolveAsync(AuthenticationService);
-        subjectService = await injector.resolveAsync(SubjectService);
-        auditor = injector.resolve(Auditor);
-    });
-    afterAll(async () => {
-        await injector?.dispose();
-    });
-    beforeEach(async () => {
-        await clearTenantData(database, schema, ['used_totp_tokens', 'totp_recovery_code', 'totp', 'password', 'session', 'user', 'service_account', 'system_account', 'subject'], tenantId);
-    });
-    test('initEnrollTotp should initiate enrollment', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'totp-test@example.com',
-            firstName: 'Totp',
-            lastName: 'User',
-        });
-        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        const result = await authenticationService.initEnrollTotp(tenantId, user.id, userAuditor);
-        expect(result.secret).toBeDefined();
-        expect(result.uri).toContain('otpauth://totp/');
-        expect(result.uri).toContain('secret=' + result.secret);
-        const totpEntry = await authenticationService.tryGetTotp(tenantId, user.id);
-        expect(totpEntry).toBeDefined();
-        expect(totpEntry.status).toBe(TotpStatus.Pending);
-    });
-    test('completeEnrollTotp should activate TOTP after verification', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'totp-test-complete@example.com',
-            firstName: 'Totp',
-            lastName: 'Complete',
-        });
-        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        const { secret } = await authenticationService.initEnrollTotp(tenantId, user.id, userAuditor);
-        // We need to convert base32 secret back to Uint8Array for generateTotpToken if it's base32
-        // But the utility probably expects Uint8Array or we use the utility's own secret generation
-        // Actually initEnrollTotp returns base32 secret for the user to enter in app.
-        // For testing, let's assume we can get the raw secret from the DB or similar.
-        const totpEntry = await authenticationService.tryGetTotp(tenantId, user.id);
-        const secretKey = await importKey('raw-secret', totpEntry.secret, { name: 'HMAC', hash: authenticationService.getTotpOptions().codeHashAlgorithm }, false, ['sign']);
-        const token = await generateTotpToken(secretKey, authenticationService.getTotpOptions());
-        const completeResult = await authenticationService.completeEnrollTotp(tenantId, user.id, token, userAuditor);
-        expect(completeResult.recoveryCodes).toHaveLength(10);
-        const activeTotpEntry = await authenticationService.tryGetTotp(tenantId, user.id);
-        expect(activeTotpEntry.status).toBe(TotpStatus.Active);
-    });
-    test('disableTotp should deactivate TOTP', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'totp-test-disable@example.com',
-            firstName: 'Totp',
-            lastName: 'Disable',
-        });
-        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        await authenticationService.initEnrollTotp(tenantId, user.id, userAuditor);
-        const totpEntry = await authenticationService.tryGetTotp(tenantId, user.id);
-        const secretKey = await importKey('raw-secret', totpEntry.secret, { name: 'HMAC', hash: authenticationService.getTotpOptions().codeHashAlgorithm }, false, ['sign']);
-        const token = await generateTotpToken(secretKey, { ...authenticationService.getTotpOptions(), timestamp: currentTimestampSeconds() - 30 });
-        await authenticationService.completeEnrollTotp(tenantId, user.id, token, userAuditor);
-        const token2 = await generateTotpToken(secretKey, authenticationService.getTotpOptions());
-        await authenticationService.disableTotp(tenantId, user.id, token2, userAuditor);
-        const disabledTotpEntry = await authenticationService.tryGetTotp(tenantId, user.id);
-        expect(disabledTotpEntry).toBeUndefined();
-    });
-    test('disableTotp should fail with recovery code (decoupled)', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'totp-test-disable-fail@example.com',
-            firstName: 'Totp',
-            lastName: 'DisableFail',
-        });
-        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        await authenticationService.initEnrollTotp(tenantId, user.id, userAuditor);
-        const totpEntry = (await authenticationService.tryGetTotp(tenantId, user.id));
-        const secretKey = await importHmacKey('raw-secret', authenticationService.getTotpOptions().codeHashAlgorithm, totpEntry.secret, false);
-        const token = await generateTotpToken(secretKey, { ...authenticationService.getTotpOptions(), timestamp: currentTimestampSeconds() - 30 });
-        const { recoveryCodes } = await authenticationService.completeEnrollTotp(tenantId, user.id, token, userAuditor);
-        await expect(authenticationService.disableTotp(tenantId, user.id, recoveryCodes[0], userAuditor)).rejects.toThrow();
-    });
-    test('disableTotpWithRecoveryCode should deactivate TOTP', async () => {
-        const user = await subjectService.createUser({
-            tenantId,
-            email: 'totp-test-disable-recovery@example.com',
-            firstName: 'Totp',
-            lastName: 'DisableRecovery',
-        });
-        const userAuditor = auditor.with({ actor: user.id, actorType: ActorType.Subject });
-        await authenticationService.initEnrollTotp(tenantId, user.id, userAuditor);
-        const totpEntry = (await authenticationService.tryGetTotp(tenantId, user.id));
-        const secretKey = await importHmacKey('raw-secret', authenticationService.getTotpOptions().codeHashAlgorithm, totpEntry.secret, false);
-        const token = await generateTotpToken(secretKey, { ...authenticationService.getTotpOptions(), timestamp: currentTimestampSeconds() - 30 });
-        const { recoveryCodes } = await authenticationService.completeEnrollTotp(tenantId, user.id, token, userAuditor);
-        await authenticationService.disableTotpWithRecoveryCode(tenantId, user.id, recoveryCodes[0], userAuditor);
-        const disabledTotpEntry = await authenticationService.tryGetTotp(tenantId, user.id);
-        expect(disabledTotpEntry).toBeUndefined();
-    });
-});

package/authentication/tests/totp.login.test.d.ts

@@ -1 +0,0 @@
-export {};