TREK/server/tests/unit/nest/webauthn-config.service.test.ts

/**
 * webauthn-config.service.test.ts
 *
 * The RP-ID / allowed-origin resolver is the single highest-risk piece of the
 * passkey feature: a wrong RP ID permanently bricks every enrolled credential.
 * These tests pin the security-relevant rules — config wins over APP_URL, bare
 * IPs are rejected, localhost dev uses the browser (Vite) origin, and the
 * resolver NEVER reads request headers.
 */

const { settingsStore, appUrlRef } = vi.hoisted(() => ({
  settingsStore: new Map<string, string>(),
  appUrlRef: { value: '' },
}));

vi.mock('../../../src/app-config', async (importOriginal) => {
  const actual = await importOriginal<typeof import('../../../src/app-config')>();
  return { ...actual, getAppUrl: () => appUrlRef.value };
});

import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
import { DatabaseService } from '../../../src/nest/database/database.service';
import { WebauthnConfigService } from '../../../src/nest/auth/webauthn-config.service';

// Injected instead of vi.mocking src/db/database: the service reads exactly one
// row shape (app_settings.value), so a stub connection keeps the suite free of
// a schema and states the only DB contact the resolver has.
const conn = {
  prepare: (_sql: string) => ({
    get: (key: string) => {
      const v = settingsStore.get(key);
      return v === undefined ? undefined : { value: v };
    },
  }),
} as unknown as ConstructorParameters<typeof DatabaseService>[0];

const svc = new WebauthnConfigService(new DatabaseService(conn));

beforeEach(() => {
  settingsStore.clear();
  appUrlRef.value = '';
});

afterEach(() => {
  vi.unstubAllEnvs();
});

describe('WebauthnConfigService.resolve', () => {
  it('WAC-001: derives the RP ID and single origin from a real APP_URL domain', () => {
    appUrlRef.value = 'https://trek.example.org';
    const cfg = svc.resolve();
    expect(cfg).not.toBeNull();
    expect(cfg!.rpID).toBe('trek.example.org');
    expect(cfg!.origins).toEqual(['https://trek.example.org']);
    expect(svc.isConfigured()).toBe(true);
  });

  it('WAC-002: returns null for a bare-IP host (IPs are not valid RP IDs)', () => {
    appUrlRef.value = 'http://192.168.1.50:3001';
    expect(svc.resolve()).toBeNull();
    expect(svc.isConfigured()).toBe(false);
  });

  it('WAC-003: returns null when nothing is configured', () => {
    expect(svc.resolve()).toBeNull();
    expect(svc.isConfigured()).toBe(false);
  });

  it('WAC-004: localhost dev uses the browser (Vite :5173) origin, not just the API port', () => {
    appUrlRef.value = 'http://localhost:3001';
    const cfg = svc.resolve();
    expect(cfg!.rpID).toBe('localhost');
    expect(cfg!.origins).toContain('http://localhost:5173');
    expect(cfg!.origins).toContain('http://localhost:3001');
  });

  it('WAC-005: an explicit webauthn_rp_id app-setting overrides APP_URL', () => {
    appUrlRef.value = 'https://internal.example.org';
    settingsStore.set('webauthn_rp_id', 'public.example.org');
    settingsStore.set('webauthn_origins', 'https://public.example.org');
    const cfg = svc.resolve();
    expect(cfg!.rpID).toBe('public.example.org');
    expect(cfg!.origins).toEqual(['https://public.example.org']);
  });

  it('WAC-006: webauthn_origins is parsed as a comma-separated, trimmed list', () => {
    settingsStore.set('webauthn_rp_id', 'example.org');
    settingsStore.set('webauthn_origins', 'https://a.example.org , https://b.example.org/');
    const cfg = svc.resolve();
    expect(cfg!.origins).toEqual(['https://a.example.org', 'https://b.example.org']);
  });

  it('WAC-007: the WEBAUTHN_RP_ID env var takes priority', () => {
    vi.stubEnv('WEBAUTHN_RP_ID', 'env.example.org');
    vi.stubEnv('WEBAUTHN_ORIGINS', 'https://env.example.org');
    appUrlRef.value = 'https://ignored.example.org';
    const cfg = svc.resolve();
    expect(cfg!.rpID).toBe('env.example.org');
    expect(cfg!.origins).toEqual(['https://env.example.org']);
  });

  it('WAC-008: a configured RP ID with no origins falls back to the APP_URL origin', () => {
    appUrlRef.value = 'https://trek.example.org';
    settingsStore.set('webauthn_rp_id', 'trek.example.org');
    const cfg = svc.resolve();
    expect(cfg!.origins).toEqual(['https://trek.example.org']);
  });

  it('WAC-009: an operator flipping the RP ID at runtime takes effect on the next resolve', () => {
    appUrlRef.value = 'https://trek.example.org';
    expect(svc.resolve()!.rpID).toBe('trek.example.org');

    settingsStore.set('webauthn_rp_id', 'moved.example.org');

    expect(svc.resolve()!.rpID).toBe('moved.example.org');
  });
});