cursedbelt 2.7.0 → 3.0.0

package/src/server/auth/password.spec.ts

@@ -1,48 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { pbkdf2Sync, randomBytes } from 'node:crypto';
-import { hashPassword, needsRehash, verifyPassword } from './password';
-
-// Reproduce the OLD app's legacy hash shape: PBKDF2-SHA512 @ 1000 iterations, the
-// salt + derived hex joined as "<salt>:<hex>" (what the ETL stores in the password
-// column for un-upgraded users).
-const legacyHash = (plain: string, salt = randomBytes(16).toString('hex')): string => {
-  const hex = pbkdf2Sync(plain, salt, 1000, 64, 'sha512').toString('hex');
-  return `${salt}:${hex}`;
-};
-
-describe('hashPassword / verifyPassword (argon2id)', () => {
-  test('mints a self-describing argon2id hash and verifies it', async () => {
-    const hash = await hashPassword('hunter2');
-    expect(hash.startsWith('$argon2id$')).toBe(true);
-    expect(await verifyPassword('hunter2', hash)).toBe(true);
-    expect(await verifyPassword('wrong', hash)).toBe(false);
-  });
-
-  test('two hashes of the same password differ (random salt) yet both verify', async () => {
-    const a = await hashPassword('same');
-    const b = await hashPassword('same');
-    expect(a).not.toBe(b);
-    expect(await verifyPassword('same', a)).toBe(true);
-    expect(await verifyPassword('same', b)).toBe(true);
-  });
-});
-
-describe('verifyPassword (legacy PBKDF2)', () => {
-  test('verifies a correct password against a legacy salt:hex digest', async () => {
-    const stored = legacyHash('password');
-    expect(await verifyPassword('password', stored)).toBe(true);
-    expect(await verifyPassword('nope', stored)).toBe(false);
-  });
-
-  test('a malformed (colon-less) legacy value is a non-match, not a throw', async () => {
-    expect(await verifyPassword('x', 'no-colon-here')).toBe(false);
-    expect(await verifyPassword('x', '')).toBe(false);
-  });
-});
-
-describe('needsRehash', () => {
-  test('true for legacy, false for argon2id', async () => {
-    expect(needsRehash(legacyHash('p'))).toBe(true);
-    expect(needsRehash(await hashPassword('p'))).toBe(false);
-  });
-});

package/src/server/auth/password.ts

@@ -1,71 +0,0 @@
-import { pbkdf2 as pbkdf2Cb, timingSafeEqual } from 'node:crypto';
-import { promisify } from 'node:util';
-
-/**
- * Password hashing on `Bun.password` (argon2id — memory-hard, thread-pooled, zero
- * deps, the current OWASP default). The argon2id hash is self-describing
- * (`$argon2id$v=19$m=…$<salt>$<hash>`) so there is NO separate salt column — the new
- * schema stores just the hash string.
- *
- * Legacy upgrade path: the old app used PBKDF2-SHA512 @ 1000 iterations with a
- * separate salt; the ETL (task 43) brings those forward as a combined `"<salt>:<hex>"`
- * string in the password column (it can't re-hash — it lacks the plaintext).
- * {@link verifyPassword} transparently verifies BOTH shapes; on a legacy match the
- * caller re-hashes with argon2id ({@link needsRehash}) — a silent per-login upgrade,
- * no forced reset.
- */
-
-// Legacy PBKDF2-SHA512 parameters — used ONLY to verify pre-argon2id hashes; never
-// to mint new ones. (1000 iterations is far below modern guidance — exactly why we
-// moved off it.)
-const LEGACY_ITERATIONS = 1000;
-const LEGACY_KEYLEN = 64;
-const LEGACY_DIGEST = 'sha512';
-
-const pbkdf2 = promisify(pbkdf2Cb);
-
-const isArgon2 = (hash: string): boolean => hash.startsWith('$argon2');
-
-/** Mint an argon2id password hash. Returns the self-describing PHC string. */
-export function hashPassword(plain: string): Promise<string> {
-  return Bun.password.hash(plain, { algorithm: 'argon2id' });
-}
-
-/**
- * Verify a candidate against a stored hash, handling BOTH formats: an argon2id PHC
- * string (new) via `Bun.password.verify`; a legacy `"<salt>:<pbkdf2-hex>"` digest by
- * re-deriving PBKDF2-SHA512 with the stored salt and comparing in constant time.
- */
-export async function verifyPassword(plain: string, stored: string): Promise<boolean> {
-  if (isArgon2(stored)) {
-    try {
-      return await Bun.password.verify(plain, stored);
-    } catch {
-      return false;
-    }
-  }
-  // Legacy: split on the FIRST colon — salt (hex) : derived (hex). A malformed value
-  // (no colon) is simply a non-match.
-  const sep = stored.indexOf(':');
-  if (sep === -1) return false;
-  const salt = stored.slice(0, sep);
-  const expectedHex = stored.slice(sep + 1);
-  if (!salt || !expectedHex) return false;
-
-  const derived = (
-    await pbkdf2(plain, salt, LEGACY_ITERATIONS, LEGACY_KEYLEN, LEGACY_DIGEST)
-  ).toString('hex');
-  // timingSafeEqual throws on length mismatch; a length diff is already a non-match
-  // and short-circuiting leaks nothing a compare wouldn't.
-  if (derived.length !== expectedHex.length) return false;
-  return timingSafeEqual(Buffer.from(derived), Buffer.from(expectedHex));
-}
-
-/**
- * True when a stored hash is a legacy (non-argon2id) digest and should be upgraded.
- * Call AFTER a successful {@link verifyPassword} to opportunistically re-hash with
- * argon2id — never block auth on the upgrade.
- */
-export function needsRehash(stored: string): boolean {
-  return !isArgon2(stored);
-}

package/src/server/auth/sessionStore.spec.ts

@@ -1,189 +0,0 @@
-import { Database } from 'bun:sqlite';
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { createKysely, type PlumbingDb } from '../db/kysely';
-import { createSessionStore } from './sessionStore';
-import type { SessionStore } from './types';
-
-const DDL = `CREATE TABLE auth_sessions (
-  session_id TEXT PRIMARY KEY,
-  user_id TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  last_seen_at TEXT NOT NULL,
-  refresh_expires_at TEXT NOT NULL,
-  access_expires_at TEXT,
-  get_only INTEGER NOT NULL DEFAULT 0,
-  disabled INTEGER NOT NULL DEFAULT 0,
-  disabled_at TEXT,
-  disabled_by TEXT,
-  user_agent TEXT,
-  ip TEXT
-)`;
-
-let db: Database;
-let ky: PlumbingDb;
-let store: SessionStore;
-
-beforeEach(() => {
-  db = new Database(':memory:');
-  db.run(DDL);
-  ky = createKysely(db);
-  store = createSessionStore(ky);
-});
-
-afterEach(() => {
-  store.stop();
-  db.close();
-});
-
-const rowCount = (): number =>
-  (db.query('SELECT COUNT(*) AS n FROM auth_sessions').get() as { n: number }).n;
-
-describe('createSessionStore', () => {
-  test('create caches in memory AND persists to the DB', async () => {
-    const s = await store.create({ sessionId: 's1', userId: 'u1', getOnly: true, ip: '1.2.3.4' });
-    expect(s.getOnly).toBe(true);
-    expect(s.disabled).toBe(false);
-    expect(store.get('s1')).toEqual(s);
-    expect(rowCount()).toBe(1);
-    const row = db
-      .query('SELECT get_only, ip FROM auth_sessions WHERE session_id = ?')
-      .get('s1') as {
-      get_only: number;
-      ip: string;
-    };
-    expect(row.get_only).toBe(1);
-    expect(row.ip).toBe('1.2.3.4');
-  });
-
-  test('isValid is true for a fresh session, false when disabled or expired', async () => {
-    await store.create({ sessionId: 's1', userId: 'u1' });
-    expect(store.isValid(store.get('s1'))).toBe(true);
-    expect(store.isValid(undefined)).toBe(false);
-
-    await store.create({
-      sessionId: 'sExpired',
-      userId: 'u1',
-      refreshExpiresAt: new Date(Date.now() - 1000).toISOString(),
-    });
-    expect(store.isValid(store.get('sExpired'))).toBe(false);
-  });
-
-  test('touch slides the refresh deadline and updates lastSeenAt', async () => {
-    const created = await store.create({
-      sessionId: 's1',
-      userId: 'u1',
-      refreshExpiresAt: new Date(Date.now() + 1000).toISOString(),
-    });
-    // `create`/`get` hand back the live map object, so capture the string by value
-    // before `touch` mutates it.
-    const beforeRefresh = created.refreshExpiresAt;
-    await new Promise((r) => setTimeout(r, 5));
-    await store.touch('s1', { accessExpiresAt: '2099-01-01T00:00:00.000Z' }); // forces a flush
-    const after = store.get('s1');
-    expect(after).toBeDefined();
-    expect(Date.parse(after?.refreshExpiresAt ?? '')).toBeGreaterThan(Date.parse(beforeRefresh));
-    expect(after?.accessExpiresAt).toBe('2099-01-01T00:00:00.000Z');
-    // forced flush persisted the access expiry
-    const row = db
-      .query('SELECT access_expires_at FROM auth_sessions WHERE session_id = ?')
-      .get('s1') as {
-      access_expires_at: string;
-    };
-    expect(row.access_expires_at).toBe('2099-01-01T00:00:00.000Z');
-  });
-
-  test('disable revokes in memory + DB (audit row kept)', async () => {
-    await store.create({ sessionId: 's1', userId: 'u1' });
-    expect(await store.disable('s1', 'admin-7')).toBe(true);
-    expect(store.get('s1')?.disabled).toBe(true);
-    expect(store.isValid(store.get('s1'))).toBe(false);
-    const row = db
-      .query('SELECT disabled, disabled_by FROM auth_sessions WHERE session_id = ?')
-      .get('s1') as {
-      disabled: number;
-      disabled_by: string;
-    };
-    expect(row.disabled).toBe(1);
-    expect(row.disabled_by).toBe('admin-7');
-  });
-
-  test('disableAllForUser returns affected ids and revokes them', async () => {
-    await store.create({ sessionId: 'a', userId: 'u1' });
-    await store.create({ sessionId: 'b', userId: 'u1' });
-    await store.create({ sessionId: 'c', userId: 'u2' });
-    const affected = await store.disableAllForUser('u1', 'admin');
-    expect(affected.sort()).toEqual(['a', 'b']);
-    expect(store.get('a')?.disabled).toBe(true);
-    expect(store.get('c')?.disabled).toBe(false);
-  });
-
-  test('remove forgets the session entirely (memory + DB)', async () => {
-    await store.create({ sessionId: 's1', userId: 'u1' });
-    await store.remove('s1');
-    expect(store.get('s1')).toBeUndefined();
-    expect(rowCount()).toBe(0);
-  });
-
-  test('deleteByUser hard-deletes all of a user’s sessions', async () => {
-    await store.create({ sessionId: 'a', userId: 'u1' });
-    await store.create({ sessionId: 'b', userId: 'u1' });
-    await store.create({ sessionId: 'c', userId: 'u2' });
-    await store.deleteByUser('u1');
-    expect(store.get('a')).toBeUndefined();
-    expect(store.get('c')).toBeDefined();
-    expect(rowCount()).toBe(1);
-  });
-
-  test('listByUser returns all rows (incl. disabled) newest-first from the DB', async () => {
-    await store.create({
-      sessionId: 'a',
-      userId: 'u1',
-      refreshExpiresAt: new Date(Date.now() + 1e6).toISOString(),
-    });
-    await new Promise((r) => setTimeout(r, 5));
-    await store.create({ sessionId: 'b', userId: 'u1' });
-    await store.disable('a');
-    const list = await store.listByUser('u1');
-    expect(list.map((s) => s.sessionId)).toEqual(['b', 'a']); // created_at desc
-    expect(list.find((s) => s.sessionId === 'a')?.disabled).toBe(true);
-  });
-
-  test('getLastSeenForUser tracks the most recent active session', async () => {
-    await store.create({ sessionId: 'a', userId: 'u1' });
-    await new Promise((r) => setTimeout(r, 5));
-    await store.touch('a', { accessExpiresAt: null });
-    const last = store.getLastSeenForUser('u1');
-    expect(last).toBe(store.get('a')?.lastSeenAt ?? null);
-    expect(store.getLastSeenForUser('nobody')).toBeNull();
-  });
-
-  test('rehydrate rebuilds the in-memory map with only currently-valid sessions', async () => {
-    await store.create({ sessionId: 'live', userId: 'u1' });
-    await store.create({
-      sessionId: 'expired',
-      userId: 'u1',
-      refreshExpiresAt: new Date(Date.now() - 1000).toISOString(),
-    });
-    await store.create({ sessionId: 'dead', userId: 'u1' });
-    await store.disable('dead');
-
-    // A fresh store over the SAME db simulates a restart.
-    const fresh = createSessionStore(ky);
-    await fresh.rehydrate();
-    expect(fresh.get('live')).toBeDefined();
-    expect(fresh.get('expired')).toBeUndefined();
-    expect(fresh.get('dead')).toBeUndefined();
-    fresh.stop();
-  });
-
-  test('prune drops rows past the retention window', async () => {
-    const shortStore = createSessionStore(ky, { retentionMs: 10 });
-    await shortStore.create({ sessionId: 's1', userId: 'u1' });
-    await new Promise((r) => setTimeout(r, 30));
-    const removed = await shortStore.prune();
-    expect(removed).toBe(1);
-    expect(shortStore.get('s1')).toBeUndefined();
-    expect(rowCount()).toBe(0);
-    shortStore.stop();
-  });
-});

package/src/server/auth/sessionStore.ts

@@ -1,261 +0,0 @@
-import type { PlumbingDb } from '../db/kysely';
-import type { AuthSessionRow } from '../db/plumbingTypes';
-import type { CreateSessionInput, Session, SessionStore } from './types';
-
-/**
- * Kysely-backed, revocable, restart-surviving session store (task 26).
- *
- * The in-memory map is the hot-path source of truth for token validity — the auth
- * middleware reads it synchronously, no per-request DB round-trip. The
- * `auth_sessions` table exists only so the map can be rebuilt after a restart
- * ({@link SessionStore.rehydrate}); DB writes for sliding `touch`es are throttled
- * (memory is always current). Single-server deployment, so there is no
- * cross-instance coherence to manage.
- */
-
-const HOUR_MS = 60 * 60 * 1000;
-const DAY_MS = 24 * HOUR_MS;
-
-export interface SessionStoreOptions {
-  /** Sliding refresh window — how long after the last activity a session stays
-   * valid. Default 7 days. */
-  refreshWindowMs?: number;
-  /** Retention before a stale (lapsed) row is pruned from memory + DB. Default 30
-   * days. Must be ≥ refreshWindowMs to keep recently-expired rows for the audit view. */
-  retentionMs?: number;
-  /** Throttle window for sliding-`touch` DB writes. Memory is always current; the
-   * row is flushed at most this often (unless a token re-issue forces it). Default 60s. */
-  flushIntervalMs?: number;
-  /** Start a background prune timer. Default false — wire pruning through the job
-   * runner (task 29), or call {@link SessionStore.prune} yourself. */
-  autoPrune?: boolean;
-  /** Auto-prune cadence when {@link autoPrune} is on. Default 1 hour. */
-  pruneIntervalMs?: number;
-}
-
-const rowToSession = (r: AuthSessionRow): Session => ({
-  sessionId: r.session_id,
-  userId: r.user_id,
-  getOnly: r.get_only === 1,
-  createdAt: r.created_at,
-  lastSeenAt: r.last_seen_at,
-  refreshExpiresAt: r.refresh_expires_at,
-  accessExpiresAt: r.access_expires_at,
-  disabled: r.disabled === 1,
-  disabledAt: r.disabled_at,
-  disabledBy: r.disabled_by,
-  userAgent: r.user_agent,
-  ip: r.ip,
-});
-
-export function createSessionStore(ky: PlumbingDb, opts: SessionStoreOptions = {}): SessionStore {
-  const refreshWindowMs = opts.refreshWindowMs ?? 7 * DAY_MS;
-  const retentionMs = opts.retentionMs ?? 30 * DAY_MS;
-  const flushIntervalMs = opts.flushIntervalMs ?? 60_000;
-  const pruneIntervalMs = opts.pruneIntervalMs ?? HOUR_MS;
-
-  const map = new Map<string, Session>();
-  const lastFlushAt = new Map<string, number>();
-  let pruneTimer: ReturnType<typeof setInterval> | undefined;
-
-  const isFresh = (s: Session | undefined, now = Date.now()): s is Session =>
-    !!s && !s.disabled && Date.parse(s.refreshExpiresAt) >= now;
-
-  const store: SessionStore = {
-    async rehydrate() {
-      // Drop ancient rows first so the map starts trim, then load only currently-valid
-      // sessions (disabled/expired rows stay in the DB for the audit view).
-      await store.prune();
-      const rows = await ky.selectFrom('auth_sessions').selectAll().execute();
-      const now = Date.now();
-      map.clear();
-      lastFlushAt.clear();
-      for (const r of rows) {
-        const s = rowToSession(r);
-        if (isFresh(s, now)) {
-          map.set(s.sessionId, s);
-          lastFlushAt.set(s.sessionId, now);
-        }
-      }
-    },
-
-    async create(input: CreateSessionInput) {
-      const now = Date.now();
-      const nowIso = new Date(now).toISOString();
-      const session: Session = {
-        sessionId: input.sessionId,
-        userId: input.userId,
-        getOnly: input.getOnly ?? false,
-        createdAt: nowIso,
-        lastSeenAt: nowIso,
-        refreshExpiresAt: input.refreshExpiresAt ?? new Date(now + refreshWindowMs).toISOString(),
-        accessExpiresAt: input.accessExpiresAt ?? null,
-        disabled: false,
-        disabledAt: null,
-        disabledBy: null,
-        userAgent: input.userAgent ?? null,
-        ip: input.ip ?? null,
-      };
-      map.set(session.sessionId, session);
-      lastFlushAt.set(session.sessionId, now);
-      await ky
-        .insertInto('auth_sessions')
-        .values({
-          session_id: session.sessionId,
-          user_id: session.userId,
-          get_only: session.getOnly ? 1 : 0,
-          created_at: session.createdAt,
-          last_seen_at: session.lastSeenAt,
-          refresh_expires_at: session.refreshExpiresAt,
-          access_expires_at: session.accessExpiresAt,
-          disabled: 0,
-          disabled_at: null,
-          disabled_by: null,
-          user_agent: session.userAgent,
-          ip: session.ip,
-        })
-        .execute();
-      return session;
-    },
-
-    get(sessionId) {
-      return map.get(sessionId);
-    },
-
-    isValid(session): session is Session {
-      return isFresh(session);
-    },
-
-    async touch(sessionId, opts2) {
-      const s = map.get(sessionId);
-      if (!s) return;
-      const now = Date.now();
-      s.lastSeenAt = new Date(now).toISOString();
-      s.refreshExpiresAt = new Date(now + refreshWindowMs).toISOString();
-      const reissued = opts2?.accessExpiresAt !== undefined;
-      if (reissued) s.accessExpiresAt = opts2?.accessExpiresAt ?? null;
-
-      const last = lastFlushAt.get(sessionId) ?? 0;
-      if (reissued || now - last > flushIntervalMs) {
-        await ky
-          .updateTable('auth_sessions')
-          .set({
-            last_seen_at: s.lastSeenAt,
-            refresh_expires_at: s.refreshExpiresAt,
-            access_expires_at: s.accessExpiresAt,
-          })
-          .where('session_id', '=', sessionId)
-          .execute();
-        lastFlushAt.set(sessionId, now);
-      }
-    },
-
-    async disable(sessionId, disabledBy = null) {
-      const s = map.get(sessionId);
-      const nowIso = new Date().toISOString();
-      if (s) {
-        s.disabled = true;
-        s.disabledAt = nowIso;
-        s.disabledBy = disabledBy;
-      }
-      const res = await ky
-        .updateTable('auth_sessions')
-        .set({ disabled: 1, disabled_at: nowIso, disabled_by: disabledBy })
-        .where('session_id', '=', sessionId)
-        .where('disabled', '=', 0)
-        .executeTakeFirst();
-      return s !== undefined || Number(res?.numUpdatedRows ?? 0) > 0;
-    },
-
-    async disableAllForUser(userId, disabledBy = null) {
-      const nowIso = new Date().toISOString();
-      const affected: string[] = [];
-      for (const s of map.values()) {
-        if (s.userId === userId && !s.disabled) {
-          s.disabled = true;
-          s.disabledAt = nowIso;
-          s.disabledBy = disabledBy;
-          affected.push(s.sessionId);
-        }
-      }
-      await ky
-        .updateTable('auth_sessions')
-        .set({ disabled: 1, disabled_at: nowIso, disabled_by: disabledBy })
-        .where('user_id', '=', userId)
-        .where('disabled', '=', 0)
-        .execute();
-      return affected;
-    },
-
-    async remove(sessionId) {
-      map.delete(sessionId);
-      lastFlushAt.delete(sessionId);
-      await ky.deleteFrom('auth_sessions').where('session_id', '=', sessionId).execute();
-    },
-
-    async deleteByUser(userId) {
-      for (const [id, s] of map) {
-        if (s.userId === userId) {
-          map.delete(id);
-          lastFlushAt.delete(id);
-        }
-      }
-      await ky.deleteFrom('auth_sessions').where('user_id', '=', userId).execute();
-    },
-
-    async listByUser(userId) {
-      const rows = await ky
-        .selectFrom('auth_sessions')
-        .selectAll()
-        .where('user_id', '=', userId)
-        .orderBy('created_at', 'desc')
-        .execute();
-      return rows.map(rowToSession);
-    },
-
-    listAll() {
-      return Array.from(map.values());
-    },
-
-    getLastSeenForUser(userId) {
-      let latest: string | null = null;
-      for (const s of map.values()) {
-        if (s.userId !== userId || s.disabled) continue;
-        if (!latest || s.lastSeenAt > latest) latest = s.lastSeenAt;
-      }
-      return latest;
-    },
-
-    async prune() {
-      const cutoff = Date.now() - retentionMs;
-      const cutoffIso = new Date(cutoff).toISOString();
-      let removed = 0;
-      for (const [id, s] of map) {
-        if (Date.parse(s.lastSeenAt) < cutoff) {
-          map.delete(id);
-          lastFlushAt.delete(id);
-          removed++;
-        }
-      }
-      await ky.deleteFrom('auth_sessions').where('last_seen_at', '<', cutoffIso).execute();
-      return removed;
-    },
-
-    stop() {
-      if (pruneTimer) {
-        clearInterval(pruneTimer);
-        pruneTimer = undefined;
-      }
-    },
-  };
-
-  if (opts.autoPrune) {
-    pruneTimer = setInterval(() => {
-      void store.prune();
-    }, pruneIntervalMs);
-    // Never keep the process alive for a prune tick.
-    pruneTimer.unref?.();
-  }
-
-  return store;
-}

package/src/server/auth/totp.spec.ts

@@ -1,73 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { generateSync } from 'otplib';
-import {
-  generateRecoveryCodes,
-  generateTotpSecret,
-  getTotpUri,
-  verifyRecoveryCode,
-  verifyTotpCode,
-} from './totp';
-
-describe('TOTP', () => {
-  test('generates a base32 secret', () => {
-    const secret = generateTotpSecret();
-    expect(secret).toMatch(/^[A-Z2-7]+$/);
-    expect(secret.length).toBeGreaterThanOrEqual(16);
-  });
-
-  test('builds an otpauth:// URI with issuer + label + secret', () => {
-    const secret = generateTotpSecret();
-    const uri = getTotpUri('user@example.com', secret, 'CursedAlchemy');
-    expect(uri.startsWith('otpauth://totp/')).toBe(true);
-    expect(uri).toContain('issuer=CursedAlchemy');
-    expect(uri).toContain(`secret=${secret}`);
-  });
-
-  test('verifies the current code, rejects a wrong one', () => {
-    const secret = generateTotpSecret();
-    const code = generateSync({ secret });
-    expect(verifyTotpCode(code, secret)).toBe(true);
-    expect(verifyTotpCode('000000', secret)).toBe(false);
-  });
-
-  test('tolerates whitespace and rejects non-6-digit input', () => {
-    const secret = generateTotpSecret();
-    const code = generateSync({ secret });
-    expect(verifyTotpCode(` ${code} `, secret)).toBe(true);
-    expect(verifyTotpCode('12345', secret)).toBe(false);
-    expect(verifyTotpCode('abcdef', secret)).toBe(false);
-    expect(verifyTotpCode('', secret)).toBe(false);
-  });
-
-  test('accepts a code from the previous 30s step (±1 drift)', () => {
-    const secret = generateTotpSecret();
-    const prev = generateSync({ secret, epoch: Math.floor(Date.now() / 1000) - 30 });
-    expect(verifyTotpCode(prev, secret)).toBe(true);
-  });
-});
-
-describe('recovery codes', () => {
-  test('generates N readable codes + argon2id hashes; never stores plaintext', async () => {
-    const { plaintext, hashed } = await generateRecoveryCodes(8);
-    expect(plaintext).toHaveLength(8);
-    expect(hashed).toHaveLength(8);
-    for (const h of hashed) expect(h.startsWith('$argon2id$')).toBe(true);
-    // a hash must not be the plaintext
-    expect(hashed[0]).not.toContain(plaintext[0]);
-  });
-
-  test('verifyRecoveryCode returns the matching index, tolerant of formatting', async () => {
-    const { plaintext, hashed } = await generateRecoveryCodes(5);
-    const idx = await verifyRecoveryCode(plaintext[2].toLowerCase().replace('-', ''), hashed);
-    expect(idx).toBe(2);
-  });
-
-  test('returns -1 for an unknown code, and after a code is consumed', async () => {
-    const { plaintext, hashed } = await generateRecoveryCodes(3);
-    expect(await verifyRecoveryCode('ZZZZZ-ZZZZZ', hashed)).toBe(-1);
-    // consume index 1 (the caller splices it out) → it no longer matches
-    const remaining = hashed.filter((_, i) => i !== 1);
-    expect(await verifyRecoveryCode(plaintext[1], remaining)).toBe(-1);
-    expect(await verifyRecoveryCode(plaintext[0], remaining)).toBe(0);
-  });
-});