homeio

1import { NextRequest, NextResponse } from "next/server";
2import { describe, expect, it, vi } from "vitest";
3
4vi.mock("@/lib/server/modules/system/security-service", () => ({
5  getSystemSecuritySettings: vi.fn(),
6  updateSystemSecuritySettings: vi.fn(),
7}));
8
9import { GET, PUT } from "@/app/api/v1/system/security/route";
10import { requireApiSession } from "@/lib/server/modules/auth/api";
11import {
12  getSystemSecuritySettings,
13  updateSystemSecuritySettings,
14} from "@/lib/server/modules/system/security-service";
15
16describe("/api/v1/system/security", () => {
17  it("returns current security settings for authenticated users", async () => {
18    vi.mocked(getSystemSecuritySettings).mockResolvedValueOnce({
19      firewallEnabled: true,
20      firewallIncomingPolicy: "deny",
21      firewallOutgoingPolicy: "allow",
22      fail2banEnabled: true,
23      fail2banMaxRetries: 5,
24      fail2banBanDurationSeconds: 3600,
25    });
26
27    const response = await GET(
28      new NextRequest("http://localhost/api/v1/system/security", {
29        headers: {
30          cookie: "homeio_session=session-token",
31        },
32      }),
33    );
34    const json = (await response.json()) as {
35      data: {
36        firewallEnabled: boolean;
37        firewallIncomingPolicy: string;
38        firewallOutgoingPolicy: string;
39        fail2banEnabled: boolean;
40        fail2banMaxRetries: number;
41        fail2banBanDurationSeconds: number;
42      };
43    };
44
45    expect(response.status).toBe(200);
46    expect(json.data.firewallEnabled).toBe(true);
47    expect(json.data.fail2banBanDurationSeconds).toBe(3600);
48  });
49
50  it("returns 401 for unauthenticated requests", async () => {
51    vi.mocked(requireApiSession).mockResolvedValueOnce({
52      session: null,
53      response: NextResponse.json({ error: "Unauthorized" }, { status: 401 }),
54    });
55
56    const response = await GET(new NextRequest("http://localhost/api/v1/system/security"));
57
58    expect(response.status).toBe(401);
59  });
60
61  it("updates security settings for authenticated users", async () => {
62    vi.mocked(updateSystemSecuritySettings).mockResolvedValueOnce({
63      firewallEnabled: true,
64      firewallIncomingPolicy: "reject",
65      firewallOutgoingPolicy: "deny",
66      fail2banEnabled: false,
67      fail2banMaxRetries: 7,
68      fail2banBanDurationSeconds: 7200,
69    });
70
71    const payload = {
72      firewallEnabled: true,
73      firewallIncomingPolicy: "reject",
74      firewallOutgoingPolicy: "deny",
75      fail2banEnabled: false,
76      fail2banMaxRetries: 7,
77      fail2banBanDurationSeconds: 7200,
78    };
79
80    const response = await PUT(
81      new NextRequest("http://localhost/api/v1/system/security", {
82        method: "PUT",
83        headers: {
84          cookie: "homeio_session=session-token",
85          "Content-Type": "application/json",
86        },
87        body: JSON.stringify(payload),
88      }),
89    );
90    const json = (await response.json()) as { data: typeof payload };
91
92    expect(response.status).toBe(200);
93    expect(updateSystemSecuritySettings).toHaveBeenCalledWith(payload);
94    expect(json.data.fail2banMaxRetries).toBe(7);
95  });
96
97  it("returns 400 for invalid payloads", async () => {
98
99    const response = await PUT(
100      new NextRequest("http://localhost/api/v1/system/security", {
101        method: "PUT",
102        headers: {
103          cookie: "homeio_session=session-token",
104          "Content-Type": "application/json",
105        },
106        body: JSON.stringify({ firewallEnabled: true }),
107      }),
108    );
109    const json = (await response.json()) as { error: string };
110
111    expect(response.status).toBe(400);
112    expect(json.error).toBe("Invalid system security payload");
113  });
114
115  it("returns 400 for invalid policy and numeric values", async () => {
116    vi.mocked(updateSystemSecuritySettings).mockRejectedValueOnce(
117      new Error("Invalid incoming policy. Choose allow, deny, or reject."),
118    );
119
120    const response = await PUT(
121      new NextRequest("http://localhost/api/v1/system/security", {
122        method: "PUT",
123        headers: {
124          cookie: "homeio_session=session-token",
125          "Content-Type": "application/json",
126        },
127        body: JSON.stringify({
128          firewallEnabled: true,
129          firewallIncomingPolicy: "drop",
130          firewallOutgoingPolicy: "allow",
131          fail2banEnabled: true,
132          fail2banMaxRetries: 5,
133          fail2banBanDurationSeconds: 3600,
134        }),
135      }),
136    );
137    const json = (await response.json()) as { error: string };
138
139    expect(response.status).toBe(400);
140    expect(json.error).toContain("Invalid incoming policy");
141  });
142
143  it("returns 500 when the service fails", async () => {
144    vi.mocked(updateSystemSecuritySettings).mockRejectedValueOnce(
145      new Error("ufw failed"),
146    );
147
148    const response = await PUT(
149      new NextRequest("http://localhost/api/v1/system/security", {
150        method: "PUT",
151        headers: {
152          cookie: "homeio_session=session-token",
153          "Content-Type": "application/json",
154        },
155        body: JSON.stringify({
156          firewallEnabled: true,
157          firewallIncomingPolicy: "deny",
158          firewallOutgoingPolicy: "allow",
159          fail2banEnabled: true,
160          fail2banMaxRetries: 5,
161          fail2banBanDurationSeconds: 3600,
162        }),
163      }),
164    );
165    const json = (await response.json()) as { error: string };
166
167    expect(response.status).toBe(500);
168    expect(json.error).toBe("Failed to update security settings");
169  });
170});
171