homeio

1import { beforeEach, describe, expect, it, vi } from "vitest";
2
3const TEST_SECRET = "a-very-long-secret-for-tests";
4
5async function loadModule() {
6  vi.resetModules();
7  vi.doMock("@/lib/server/env", () => ({
8    serverEnv: { AUTH_SESSION_SECRET: TEST_SECRET },
9  }));
10  return await import("@/lib/server/modules/auth/partial-auth-token");
11}
12
13describe("partial-auth token", () => {
14  beforeEach(() => {
15    vi.resetModules();
16    vi.useRealTimers();
17  });
18
19  it("creates and verifies a valid token", async () => {
20    const { createPartialAuthToken, verifyPartialAuthToken } =
21      await loadModule();
22
23    const { token, expiresAtEpochSeconds } =
24      createPartialAuthToken("user-1");
25
26    expect(token.startsWith("partial.user-1.")).toBe(true);
27    expect(token.split(".").length).toBe(4);
28
29    expect(verifyPartialAuthToken(token)).toEqual({
30      userId: "user-1",
31      expiresAtEpochSeconds,
32    });
33  });
34
35  it("expires after PARTIAL_AUTH_TOKEN_TTL_SECONDS", async () => {
36    vi.useFakeTimers();
37    vi.setSystemTime(new Date("2026-05-23T00:00:00.000Z"));
38
39    const { createPartialAuthToken, verifyPartialAuthToken } =
40      await loadModule();
41    const { token } = createPartialAuthToken("user-1");
42
43    expect(verifyPartialAuthToken(token)).not.toBeNull();
44
45    // 5 minutes + 1 second past issuance — token should be rejected.
46    vi.setSystemTime(new Date("2026-05-23T00:05:01.000Z"));
47    expect(verifyPartialAuthToken(token)).toBeNull();
48  });
49
50  it("rejects a tampered signature", async () => {
51    const { createPartialAuthToken, verifyPartialAuthToken } =
52      await loadModule();
53    const { token } = createPartialAuthToken("user-1");
54
55    const [prefix, userId, exp, sig] = token.split(".");
56    const flipped = sig.startsWith("a")
57      ? "b" + sig.slice(1)
58      : "a" + sig.slice(1);
59    const tampered = [prefix, userId, exp, flipped].join(".");
60
61    expect(verifyPartialAuthToken(tampered)).toBeNull();
62  });
63
64  it("rejects a token whose userId field was swapped after signing", async () => {
65    const { createPartialAuthToken, verifyPartialAuthToken } =
66      await loadModule();
67    const { token } = createPartialAuthToken("user-1");
68
69    const [, , exp, sig] = token.split(".");
70    const swapped = ["partial", "user-2", exp, sig].join(".");
71
72    expect(verifyPartialAuthToken(swapped)).toBeNull();
73  });
74
75  it("does not accept a session-token-shaped value as a partial-auth token", async () => {
76    // Build a token whose signed payload looks like a session token's signed
77    // payload. Even with the same secret, the verifier should fail because
78    // the `partial.` prefix isn't in the signed bytes.
79    const { createHmac } = await import("node:crypto");
80    const { verifyPartialAuthToken } = await loadModule();
81
82    const expiresAt = Math.floor(Date.now() / 1000) + 60;
83    const sessionPayload = `session-id.${expiresAt}`;
84    const sig = createHmac("sha256", TEST_SECRET)
85      .update(sessionPayload)
86      .digest("hex");
87
88    // Format the malicious token as 4 segments so the parser at least
89    // proceeds to the signature check.
90    expect(
91      verifyPartialAuthToken(`partial.session-id.${expiresAt}.${sig}`),
92    ).toBeNull();
93  });
94
95  it("returns null for malformed tokens without throwing", async () => {
96    const { verifyPartialAuthToken } = await loadModule();
97    expect(verifyPartialAuthToken("garbage")).toBeNull();
98    expect(verifyPartialAuthToken("a.b.c")).toBeNull();
99    expect(verifyPartialAuthToken("")).toBeNull();
100  });
101});
102