SnowLuma v2.4.2 source snapshot

packages/core/tests/webui-login.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, it } from 'vitest';
+import { confirmTotpEnrollment } from '../src/webui/totp';
+import {
+    completeWebuiLogin,
+    invalidateOtherSessions,
+    type WebuiLoginAuth,
+} from '../src/webui/webui-login';
+
+const RFC_SECRET = 'GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ';
+const T59_MS = 59_000;
+const T59_CODE = '287082';
+const PASSWORD = 'Correct-Horse-1!';
+
+function authWithoutTotp(): WebuiLoginAuth {
+    return {
+        verify: (password) => password === PASSWORD,
+        totpEnabled: () => false,
+        totpState: () => undefined,
+        mustChangePassword: () => false,
+    };
+}
+
+describe('completeWebuiLogin', () => {
+    it('rejects a wrong password without mentioning TOTP', () => {
+        expect(completeWebuiLogin(authWithoutTotp(), { password: 'nope' }, T59_MS)).toEqual({
+            kind: 'bad-password',
+        });
+    });
+
+    it('logs in with only a password when 2FA is off', () => {
+        expect(completeWebuiLogin(authWithoutTotp(), { password: PASSWORD }, T59_MS)).toEqual({
+            kind: 'ok',
+            mustChangePassword: false,
+        });
+    });
+
+    it('asks for TOTP after a correct password when 2FA is on', () => {
+        const enabled = confirmTotpEnrollment({
+            password: PASSWORD,
+            secret: RFC_SECRET,
+            code: T59_CODE,
+            label: 'SnowLuma (testhost)',
+            atMs: T59_MS,
+        });
+        const auth: WebuiLoginAuth = {
+            verify: (password) => password === PASSWORD,
+            totpEnabled: () => true,
+            totpState: () => enabled.state,
+            mustChangePassword: () => false,
+        };
+        expect(completeWebuiLogin(auth, { password: PASSWORD }, T59_MS)).toEqual({
+            kind: 'needs-totp',
+        });
+    });
+
+    it('accepts password plus TOTP and returns the updated totp state', () => {
+        const enabled = confirmTotpEnrollment({
+            password: PASSWORD,
+            secret: RFC_SECRET,
+            code: T59_CODE,
+            label: 'SnowLuma (testhost)',
+            atMs: T59_MS,
+        });
+        const auth: WebuiLoginAuth = {
+            verify: (password) => password === PASSWORD,
+            totpEnabled: () => true,
+            totpState: () => enabled.state,
+            mustChangePassword: () => true,
+        };
+        const result = completeWebuiLogin(
+            auth,
+            { password: PASSWORD, totp: '081804' },
+            1_111_111_109_000,
+        );
+        expect(result.kind).toBe('ok');
+
+        if (result.kind !== 'ok') {
+            return;
+        }
+
+        expect(result.mustChangePassword).toBe(true);
+        expect(result.totpState?.lastUsedStep).toBeGreaterThan(enabled.state.lastUsedStep);
+    });
+});
+
+describe('invalidateOtherSessions', () => {
+    it('keeps the current session and drops the rest', () => {
+        const sessions = new Map([
+            ['keep', { n: 1 }],
+            ['drop-a', { n: 2 }],
+            ['drop-b', { n: 3 }],
+        ]);
+        invalidateOtherSessions(sessions, 'keep');
+        expect([...sessions.keys()]).toEqual(['keep']);
+    });
+});