k1nq/TREK
1
0
Fork 0
mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-18 21:16:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(auth): read the disabled MFA state through the ORM, formatted

Browse Source
This commit is contained in:
Maurice
2026-10-18 12:11:41 +02:00
parent bfec874d04
commit c378722d63
1 changed files with 26 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/tests/integration/auth.test.ts
+24 -11
View File
@@ -521,31 +521,44 @@ describe('MFA', () => {
it('AUTH-019 — disable MFA with password and unused backup code', async () => {
const { hashBackupCodeBcrypt } = await import('../../src/nest/auth/auth.helpers');
const { user, password } = createUserWithMfa(testDb);
await updateRows(orm, Users, { id: user.id }, {
await updateRows(
orm,
Users,
{ id: user.id },
{
mfa_backup_codes: JSON.stringify([hashBackupCodeBcrypt('A1B2-C3D4')]),
});
const res = await request(app).post('/api/auth/mfa/disable')
},
);
const res = await request(app)
.post('/api/auth/mfa/disable')
.set('Cookie', authCookie(user.id))
.send({ password, code: 'a1b2-c3d4' });
expect(res.status).toBe(200);
expect(res.body.mfa_enabled).toBe(false);
const updated = testDb.prepare('SELECT mfa_enabled, mfa_secret, mfa_backup_codes FROM users WHERE id = ?').get(user.id) as any;
expect(updated.mfa_enabled).toBe(0);
expect(updated.mfa_secret).toBeNull();
expect(updated.mfa_backup_codes).toBeNull();
const updated = await rowOf(Users, { id: user.id });
expect(updated?.mfa_enabled).toBe(0);
expect(updated?.mfa_secret).toBeNull();
expect(updated?.mfa_backup_codes).toBeNull();
});
it('AUTH-019 — reject invalid recovery code and incorrect password', async () => {
const { hashBackupCodeBcrypt } = await import('../../src/nest/auth/auth.helpers');
const { user, password } = createUserWithMfa(testDb);
await updateRows(orm, Users, { id: user.id }, {
await updateRows(
orm,
Users,
{ id: user.id },
{
mfa_backup_codes: JSON.stringify([hashBackupCodeBcrypt('A1B2-C3D4')]),
});
const badCode = await request(app).post('/api/auth/mfa/disable')
},
);
const badCode = await request(app)
.post('/api/auth/mfa/disable')
.set('Cookie', authCookie(user.id))
.send({ password, code: 'FFFF-FFFF' });
expect(badCode.status).toBe(401);
const badPassword = await request(app).post('/api/auth/mfa/disable')
const badPassword = await request(app)
.post('/api/auth/mfa/disable')
.set('Cookie', authCookie(user.id))
.send({ password: 'invalid-password', code: 'A1B2-C3D4' });
expect(badPassword.status).toBe(401);