feuerwerk/tests/core/auth.test.ts

import { afterEach, describe, expect, it, vi } from 'vitest';
import { TooManyAttemptsError, WrongCredentialsError } from '../../src/core/store/AuthStore';
import { HttpAuthStore } from '../../src/core/store/HttpAuthStore';
import {
  loginError,
  loginProblem,
  MIN_PASSWORD_LENGTH,
  passwordError,
  passwordProblem,
} from '../../src/editor/auth/loginRules';

/** What the firewall in front of the live site answers instead of any non-2xx (measured for #177). */
const FIREWALL_418 = '<html><head><title>Status Code 418</title></head><body></body></html>';

function stubFetch(body: BodyInit | null, init: ResponseInit) {
  const mock = vi.fn<typeof fetch>(() => Promise.resolve(new Response(body, init)));
  vi.stubGlobal('fetch', mock);
  return mock;
}

afterEach(() => {
  vi.unstubAllGlobals();
});

describe('HttpAuthStore', () => {
  it('reads who is signed in and their role, null included', async () => {
    stubFetch(JSON.stringify({ user: 'e2e', role: 'user' }), { status: 200 });
    await expect(new HttpAuthStore('/api').session()).resolves.toEqual({ user: 'e2e', role: 'user' });

    stubFetch(JSON.stringify({ user: 'admin', role: 'admin' }), { status: 200 });
    await expect(new HttpAuthStore('/api').session()).resolves.toEqual({ user: 'admin', role: 'admin' });

    stubFetch(JSON.stringify({ user: null, role: null }), { status: 200 });
    await expect(new HttpAuthStore('/api').session()).resolves.toBeNull();
  });

  // #180: the weaker reading is the safe one – a server from before roles, or a role this editor does
  // not know, must not make anyone an administrator.
  it('takes a missing or unknown role for user', async () => {
    stubFetch(JSON.stringify({ user: 'old' }), { status: 200 });
    await expect(new HttpAuthStore('/api').session()).resolves.toEqual({ user: 'old', role: 'user' });

    stubFetch(JSON.stringify({ user: 'odd', role: 'root' }), { status: 200 });
    await expect(new HttpAuthStore('/api').logIn('odd', 'secret')).resolves.toEqual({
      user: 'odd',
      role: 'user',
    });
  });

  it('sends the pair as JSON and answers with the name and role the server confirms', async () => {
    const mock = stubFetch(JSON.stringify({ user: 'user', role: 'user' }), { status: 200 });
    await expect(new HttpAuthStore('/api').logIn('user', 'secret')).resolves.toEqual({
      user: 'user',
      role: 'user',
    });
    const [url, init] = mock.mock.calls[0]!;
    expect(url as string).toContain('r=auth%2Flogin');
    expect(init?.method).toBe('POST');
    expect(JSON.parse(init?.body as string)).toEqual({ username: 'user', password: 'secret' });
  });

  it('tells a wrong pair apart from a server that is not there', async () => {
    stubFetch(JSON.stringify({ error: 'Wrong user name or password' }), { status: 401 });
    await expect(new HttpAuthStore('/api').logIn('user', 'nope')).rejects.toBeInstanceOf(
      WrongCredentialsError,
    );

    stubFetch(JSON.stringify({ error: 'boom' }), { status: 500 });
    const failure = new HttpAuthStore('/api').logIn('user', 'secret');
    await expect(failure).rejects.not.toBeInstanceOf(WrongCredentialsError);
    await expect(failure).rejects.toThrow(/boom \(500\)/);
  });

  // The firewall in front of nockal.com used to answer every non-2xx with this page; since
  // 2026-09-20 it hands the API's own status through. The rule stays: only a 401 from the API
  // means a wrong pair, anything a box in between makes up does not.
  it('does not mistake a proxy’s own page for a wrong password', async () => {
    stubFetch(FIREWALL_418, { status: 418 });
    const failure = new HttpAuthStore('/api').logIn('user', 'secret');
    await expect(failure).rejects.not.toBeInstanceOf(WrongCredentialsError);
    await expect(failure).rejects.toThrow(/418/);
  });

  // #427: five wrong passwords and the address waits. That is neither a wrong pair nor a breakdown,
  // and the server's sentence says how long.
  it('tells the brake after too many wrong passwords apart, with the server’s wording', async () => {
    const said = 'Too many failed sign-ins. Try again in 15 minutes';
    stubFetch(JSON.stringify({ error: said }), { status: 429, headers: { 'Retry-After': '900' } });
    const login = new HttpAuthStore('/api').logIn('user', 'secret');
    await expect(login).rejects.toBeInstanceOf(TooManyAttemptsError);
    await expect(login).rejects.toThrow(said);

    stubFetch(JSON.stringify({ error: said }), { status: 429 });
    await expect(new HttpAuthStore('/api').changePassword('old', 'a-new-one')).rejects.toBeInstanceOf(
      TooManyAttemptsError,
    );
  });

  it('signs out without a body', async () => {
    const mock = stubFetch(null, { status: 204 });
    await expect(new HttpAuthStore('/api').logOut()).resolves.toBeUndefined();
    expect(mock.mock.calls[0]?.[1]?.method).toBe('POST');
  });

  it('sends both passwords to change one and takes 204 for done', async () => {
    const mock = stubFetch(null, { status: 204 });
    await expect(new HttpAuthStore('/api').changePassword('old', 'a-new-one')).resolves.toBeUndefined();
    const [url, init] = mock.mock.calls[0]!;
    expect(url as string).toContain('r=auth%2Fpassword');
    expect(init?.method).toBe('POST');
    expect(JSON.parse(init?.body as string)).toEqual({
      currentPassword: 'old',
      newPassword: 'a-new-one',
    });
  });

  it('tells a wrong current password apart from a refused new one', async () => {
    stubFetch(JSON.stringify({ error: 'Wrong password' }), { status: 401 });
    await expect(new HttpAuthStore('/api').changePassword('nope', 'a-new-one')).rejects.toBeInstanceOf(
      WrongCredentialsError,
    );

    // 422 is the server turning the new password down, which is not a wrong pair and must not be
    // shown as one: its own wording travels instead.
    stubFetch(JSON.stringify({ error: 'The new password needs at least 8 characters' }), { status: 422 });
    const refused = new HttpAuthStore('/api').changePassword('old', 'short');
    await expect(refused).rejects.not.toBeInstanceOf(WrongCredentialsError);
    await expect(refused).rejects.toThrow(/at least 8 characters \(422\)/);
  });
});

describe('the rules of the sign-in form', () => {
  it('asks for what is missing, user name first', () => {
    expect(loginProblem('', '')).toBe('Enter your user name');
    expect(loginProblem('   ', 'secret')).toBe('Enter your user name');
    expect(loginProblem('user', '')).toBe('Enter your password');
    expect(loginProblem('user', 'secret')).toBeNull();
  });

  it('says a wrong pair plainly and names the cause of anything else', () => {
    expect(loginError(new WrongCredentialsError(), true)).toBe('Wrong user name or password');
    expect(loginError(new Error('Server unavailable (503)'), false)).toBe(
      'Could not sign in: Server unavailable (503)',
    );
  });

  it('passes on how long the brake lasts, without a prefix', () => {
    const said = 'Too many failed sign-ins. Try again in 15 minutes';
    expect(loginError(new TooManyAttemptsError(said), false)).toBe(said);
    expect(passwordError(new TooManyAttemptsError(said), false)).toBe(said);
  });
});

describe('the rules of the change-password form', () => {
  const long = 'a'.repeat(MIN_PASSWORD_LENGTH);

  it('asks for what is missing, the current password first', () => {
    expect(passwordProblem('', '', '')).toBe('Enter your current password');
    expect(passwordProblem('old', '', '')).toBe('Enter a new password');
    expect(passwordProblem('old', long, long)).toBeNull();
  });

  it('refuses a new password that is too short, before anything is sent', () => {
    expect(
      passwordProblem('old', 'a'.repeat(MIN_PASSWORD_LENGTH - 1), 'a'.repeat(MIN_PASSWORD_LENGTH - 1)),
    ).toBe(`The new password needs at least ${MIN_PASSWORD_LENGTH} characters`);
  });

  it('refuses the old password again and a repeat that differs', () => {
    expect(passwordProblem(long, long, long)).toBe('The new password is the old one');
    expect(passwordProblem('old', long, `${long}x`)).toBe('The two new passwords are different');
  });

  it('names the wrong current password and the cause of anything else', () => {
    expect(passwordError(new WrongCredentialsError('Wrong password'), true)).toBe('Wrong current password');
    expect(passwordError(new Error('Server error (500)'), false)).toBe(
      'Could not change the password: Server error (500)',
    );
  });
});