homeio

1import { afterEach, describe, expect, it } from "vitest";
2
3import {
4  _resetPartialAuthGuardsForTesting,
5  _resetTotpReplayGuardForTesting,
6  isPartialAuthTokenBlocked,
7  isPartialAuthTokenConsumed,
8  isTotpCodeReplayed,
9  markPartialAuthTokenConsumed,
10  markTotpCodeUsed,
11  recordPartialAuthFailure,
12} from "@/lib/server/modules/auth/rate-limit";
13
14afterEach(() => {
15  _resetTotpReplayGuardForTesting();
16  _resetPartialAuthGuardsForTesting();
17});
18
19describe("totp replay guard", () => {
20  it("returns false before any code has been marked used", () => {
21    expect(isTotpCodeReplayed("user-1", "123456")).toBe(false);
22  });
23
24  it("returns true when the exact same code is replayed within the window", () => {
25    markTotpCodeUsed("user-1", "123456", 1_000);
26    expect(isTotpCodeReplayed("user-1", "123456", 1_500)).toBe(true);
27  });
28
29  it("returns false for a different code from the same user", () => {
30    markTotpCodeUsed("user-1", "123456", 1_000);
31    expect(isTotpCodeReplayed("user-1", "654321", 1_500)).toBe(false);
32  });
33
34  it("isolates the guard per user", () => {
35    markTotpCodeUsed("user-1", "123456", 1_000);
36    expect(isTotpCodeReplayed("user-2", "123456", 1_500)).toBe(false);
37  });
38
39  it("expires the record after its TTL elapses", () => {
40    markTotpCodeUsed("user-1", "123456", 1_000);
41    // 120 s TTL → record valid through 121_000 but not at 1_000 + 120_001.
42    expect(isTotpCodeReplayed("user-1", "123456", 121_001)).toBe(false);
43    // Calling once with an expired record should also drop it from memory.
44    expect(isTotpCodeReplayed("user-1", "123456", 121_001)).toBe(false);
45  });
46
47  it("replacing the stored code with a newer one moves the window forward", () => {
48    markTotpCodeUsed("user-1", "111111", 1_000);
49    markTotpCodeUsed("user-1", "222222", 30_000);
50
51    // Old code is no longer the "last used" — replay check should miss.
52    expect(isTotpCodeReplayed("user-1", "111111", 30_500)).toBe(false);
53    expect(isTotpCodeReplayed("user-1", "222222", 30_500)).toBe(true);
54  });
55});
56
57describe("partial-auth brute-force guard", () => {
58  const TOKEN = "partial.user-1.future.sig";
59  // Pick an explicit `now` and a token expiry several minutes into its
60  // future so we exercise the failure-count threshold without the
61  // "record expired" path tripping.
62  const NOW_MS = 1_000_000_000_000;
63  const TOKEN_EXP_SECONDS = Math.floor(NOW_MS / 1000) + 5 * 60;
64
65  it("returns false before any failures are recorded", () => {
66    expect(isPartialAuthTokenBlocked(TOKEN, NOW_MS)).toBe(false);
67  });
68
69  it("trips at the 5th failure for the same token", () => {
70    for (let i = 0; i < 4; i++) {
71      recordPartialAuthFailure(TOKEN, TOKEN_EXP_SECONDS, NOW_MS);
72    }
73    expect(isPartialAuthTokenBlocked(TOKEN, NOW_MS)).toBe(false);
74
75    recordPartialAuthFailure(TOKEN, TOKEN_EXP_SECONDS, NOW_MS);
76    expect(isPartialAuthTokenBlocked(TOKEN, NOW_MS)).toBe(true);
77  });
78
79  it("isolates the guard per token (different raw tokens cannot pool)", () => {
80    for (let i = 0; i < 5; i++) {
81      recordPartialAuthFailure(TOKEN, TOKEN_EXP_SECONDS, NOW_MS);
82    }
83    expect(isPartialAuthTokenBlocked(TOKEN, NOW_MS)).toBe(true);
84    expect(
85      isPartialAuthTokenBlocked("partial.other.future.sig", NOW_MS),
86    ).toBe(false);
87  });
88
89  it("self-evicts once the token's own expiry has passed", () => {
90    for (let i = 0; i < 5; i++) {
91      recordPartialAuthFailure(TOKEN, TOKEN_EXP_SECONDS, NOW_MS);
92    }
93    expect(isPartialAuthTokenBlocked(TOKEN, NOW_MS)).toBe(true);
94
95    // After expiry + buffer: the read-path sweep drops the record and the
96    // block disappears. Real-world equivalent: token has expired anyway, so
97    // the caller would already see partial_auth_expired before this check.
98    const wellPastExpiry = TOKEN_EXP_SECONDS * 1000 + 60_000;
99    expect(isPartialAuthTokenBlocked(TOKEN, wellPastExpiry)).toBe(false);
100  });
101});
102
103describe("partial-auth single-use guard", () => {
104  const TOKEN = "partial.user-1.future.sig";
105  // Use a real "near-future" epoch for these tests since they don't pass an
106  // explicit `now` and the default Date.now() must not have already passed
107  // the token's expiry.
108  const TOKEN_EXP_SECONDS = Math.floor(Date.now() / 1000) + 60 * 60;
109
110  it("returns false before the token has been consumed", () => {
111    expect(isPartialAuthTokenConsumed(TOKEN)).toBe(false);
112  });
113
114  it("returns true after markPartialAuthTokenConsumed", () => {
115    markPartialAuthTokenConsumed(TOKEN, TOKEN_EXP_SECONDS);
116    expect(isPartialAuthTokenConsumed(TOKEN)).toBe(true);
117  });
118
119  it("isolates per token", () => {
120    markPartialAuthTokenConsumed(TOKEN, TOKEN_EXP_SECONDS);
121    expect(isPartialAuthTokenConsumed("partial.other.future.sig")).toBe(false);
122  });
123
124  it("clears once the token's own expiry has passed", () => {
125    markPartialAuthTokenConsumed(TOKEN, TOKEN_EXP_SECONDS);
126    expect(isPartialAuthTokenConsumed(TOKEN)).toBe(true);
127
128    const wellPastExpiry = TOKEN_EXP_SECONDS * 1000 + 60_000;
129    expect(isPartialAuthTokenConsumed(TOKEN, wellPastExpiry)).toBe(false);
130  });
131});
132