mirror of
https://github.com/fluxerapp/fluxer
synced 2026-10-19 05:55:34 +09:00
chore(repo): remove dead code and useless tests (#3375)
This commit is contained in:
Hampus authored and GitHub committed
1 parent
7e177a1c90
commit
1cd62eb661
1391 files changed
+783
-120415
No files matched your search
@@ -19,7 +19,6 @@ import {createUserID} from '@app/api/BrandedTypes';
|
||||
import {type ApiTestHarness, createApiTestHarness} from '@app/api/test/ApiTestHarness';
|
||||
import {createBuilder, createBuilderWithoutAuth} from '@app/api/test/TestRequestBuilder';
|
||||
import {UserRepository} from '@app/api/user/repositories/UserRepository';
|
||||
import type {AuthSessionResponse} from '@fluxer/schema/src/domains/auth/AuthSchemas';
|
||||
import {afterAll, beforeAll, beforeEach, describe, expect, test} from 'vitest';
|
||||
|
||||
interface BackupCodesResponse {
|
||||
@@ -171,187 +170,6 @@ describe('MFA Consistency Tests', () => {
|
||||
afterAll(async () => {
|
||||
await harness?.shutdown();
|
||||
});
|
||||
describe('WebAuthn sudo verification flow', () => {
|
||||
test('WebAuthn user with two-factor on can complete sudo verification with passkey', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const {account: webauthnAccount, device} = await setupWebAuthnOnlyUser(harness, account, true);
|
||||
const sudoOptions = await createBuilder<WebAuthnAuthenticationOptions>(harness, webauthnAccount.token)
|
||||
.post('/users/@me/sudo/webauthn/authentication-options')
|
||||
.body(null)
|
||||
.execute();
|
||||
const sudoAssertion = createAuthenticationResponse(device, sudoOptions);
|
||||
await createBuilder(harness, webauthnAccount.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
mfa_method: 'webauthn',
|
||||
webauthn_response: sudoAssertion,
|
||||
webauthn_challenge: sudoOptions.challenge,
|
||||
})
|
||||
.expect(204)
|
||||
.execute();
|
||||
});
|
||||
test('WebAuthn user with two-factor off can complete sudo verification with passkey', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const {account: webauthnAccount, device} = await setupWebAuthnOnlyUser(harness, account, false);
|
||||
const sudoOptions = await createBuilder<WebAuthnAuthenticationOptions>(harness, webauthnAccount.token)
|
||||
.post('/users/@me/sudo/webauthn/authentication-options')
|
||||
.body(null)
|
||||
.execute();
|
||||
const sudoAssertion = createAuthenticationResponse(device, sudoOptions);
|
||||
await createBuilder(harness, webauthnAccount.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
mfa_method: 'webauthn',
|
||||
webauthn_response: sudoAssertion,
|
||||
webauthn_challenge: sudoOptions.challenge,
|
||||
})
|
||||
.expect(204)
|
||||
.execute();
|
||||
});
|
||||
test('WebAuthn-only user with two-factor on cannot use password for sudo verification', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const {account: webauthnAccount} = await setupWebAuthnOnlyUser(harness, account, true);
|
||||
const errorResp = await createBuilder<{
|
||||
code: string;
|
||||
}>(harness, webauthnAccount.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
password: account.password,
|
||||
})
|
||||
.expect(403)
|
||||
.execute();
|
||||
expect(errorResp.code).toBe('SUDO_MODE_REQUIRED');
|
||||
});
|
||||
test('WebAuthn-only user with two-factor off can use password for sudo verification', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const {account: webauthnAccount} = await setupWebAuthnOnlyUser(harness, account, false);
|
||||
await createBuilder(harness, webauthnAccount.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
password: account.password,
|
||||
})
|
||||
.expect(204)
|
||||
.execute();
|
||||
});
|
||||
});
|
||||
describe('Password-only sudo flow for non-MFA users', () => {
|
||||
test('Non-MFA user can use password for sudo verification', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
await createBuilder(harness, account.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
password: account.password,
|
||||
})
|
||||
.expect(204)
|
||||
.execute();
|
||||
});
|
||||
test('Non-MFA user cannot perform sudo operation without password', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const errorResp = await createBuilder<{
|
||||
code: string;
|
||||
}>(harness, account.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({})
|
||||
.expect(403)
|
||||
.execute();
|
||||
expect(errorResp.code).toBe('SUDO_MODE_REQUIRED');
|
||||
});
|
||||
test('Non-MFA user rejected with wrong password', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
await createBuilder(harness, account.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
password: 'wrong-password-123!',
|
||||
})
|
||||
.expect(400)
|
||||
.execute();
|
||||
});
|
||||
});
|
||||
describe('TOTP sudo verification flow', () => {
|
||||
test('TOTP user can complete sudo verification with TOTP code', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const secret = createTotpSecret();
|
||||
await createBuilder(harness, account.token)
|
||||
.post('/users/@me/mfa/totp/enable')
|
||||
.body({
|
||||
secret,
|
||||
code: generateTotpCode(secret),
|
||||
password: account.password,
|
||||
})
|
||||
.execute();
|
||||
const loggedIn = await loginWithTotp(harness, account, secret);
|
||||
await createBuilder(harness, loggedIn.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
mfa_method: 'totp',
|
||||
mfa_code: generateTotpCode(secret),
|
||||
})
|
||||
.expect(204)
|
||||
.execute();
|
||||
});
|
||||
test('TOTP user can use backup code for sudo verification', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const secret = createTotpSecret();
|
||||
const backupCodes = await createBuilder<BackupCodesResponse>(harness, account.token)
|
||||
.post('/users/@me/mfa/totp/enable')
|
||||
.body({
|
||||
secret,
|
||||
code: generateTotpCode(secret),
|
||||
password: account.password,
|
||||
})
|
||||
.execute();
|
||||
const loggedIn = await loginWithTotp(harness, account, secret);
|
||||
await createBuilder(harness, loggedIn.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
mfa_method: 'totp',
|
||||
mfa_code: backupCodes.backup_codes[0]!.code,
|
||||
})
|
||||
.expect(204)
|
||||
.execute();
|
||||
});
|
||||
test('TOTP user cannot use password for sudo verification', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const secret = createTotpSecret();
|
||||
await createBuilder(harness, account.token)
|
||||
.post('/users/@me/mfa/totp/enable')
|
||||
.body({
|
||||
secret,
|
||||
code: generateTotpCode(secret),
|
||||
password: account.password,
|
||||
})
|
||||
.execute();
|
||||
const loggedIn = await loginWithTotp(harness, account, secret);
|
||||
await createBuilder(harness, loggedIn.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
password: account.password,
|
||||
})
|
||||
.expect(403)
|
||||
.execute();
|
||||
});
|
||||
test('TOTP user rejected with wrong TOTP code', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const secret = createTotpSecret();
|
||||
await createBuilder(harness, account.token)
|
||||
.post('/users/@me/mfa/totp/enable')
|
||||
.body({
|
||||
secret,
|
||||
code: generateTotpCode(secret),
|
||||
password: account.password,
|
||||
})
|
||||
.execute();
|
||||
const loggedIn = await loginWithTotp(harness, account, secret);
|
||||
await createBuilder(harness, loggedIn.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({
|
||||
mfa_method: 'totp',
|
||||
mfa_code: '000000',
|
||||
})
|
||||
.expect(400)
|
||||
.execute();
|
||||
});
|
||||
});
|
||||
describe('Sudo MFA method availability', () => {
|
||||
test('mfa-methods agrees with the SUDO_MODE_REQUIRED body for an orphaned TOTP secret', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
@@ -423,111 +241,4 @@ describe('MFA Consistency Tests', () => {
|
||||
});
|
||||
});
|
||||
});
|
||||
describe('MFA requirement propagates to sensitive operations', () => {
|
||||
test('Account disable requires sudo for all users', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const errorResp = await createBuilder<{
|
||||
code: string;
|
||||
}>(harness, account.token)
|
||||
.post('/users/@me/disable')
|
||||
.body({})
|
||||
.expect(403)
|
||||
.execute();
|
||||
expect(errorResp.code).toBe('SUDO_MODE_REQUIRED');
|
||||
});
|
||||
test('Account delete requires sudo for all users', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const errorResp = await createBuilder<{
|
||||
code: string;
|
||||
}>(harness, account.token)
|
||||
.post('/users/@me/delete')
|
||||
.body({})
|
||||
.expect(403)
|
||||
.execute();
|
||||
expect(errorResp.code).toBe('SUDO_MODE_REQUIRED');
|
||||
});
|
||||
test('Session logout requires sudo for non-MFA user', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const sessions = await createBuilder<Array<AuthSessionResponse>>(harness, account.token)
|
||||
.get('/auth/sessions')
|
||||
.execute();
|
||||
await createBuilder(harness, account.token)
|
||||
.post('/auth/sessions/logout')
|
||||
.body({
|
||||
session_id_hashes: [sessions[0]!.id_hash],
|
||||
})
|
||||
.expect(403)
|
||||
.execute();
|
||||
await createBuilder(harness, account.token)
|
||||
.post('/auth/sessions/logout')
|
||||
.body({
|
||||
session_id_hashes: [sessions[0]!.id_hash],
|
||||
password: account.password,
|
||||
})
|
||||
.expect(204)
|
||||
.execute();
|
||||
});
|
||||
test('Session logout requires MFA for TOTP user', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const secret = createTotpSecret();
|
||||
await createBuilder(harness, account.token)
|
||||
.post('/users/@me/mfa/totp/enable')
|
||||
.body({
|
||||
secret,
|
||||
code: generateTotpCode(secret),
|
||||
password: account.password,
|
||||
})
|
||||
.execute();
|
||||
const loggedIn = await loginWithTotp(harness, account, secret);
|
||||
const sessions = await createBuilder<Array<AuthSessionResponse>>(harness, loggedIn.token)
|
||||
.get('/auth/sessions')
|
||||
.execute();
|
||||
await createBuilder(harness, loggedIn.token)
|
||||
.post('/auth/sessions/logout')
|
||||
.body({
|
||||
session_id_hashes: [sessions[0]!.id_hash],
|
||||
password: account.password,
|
||||
})
|
||||
.expect(403)
|
||||
.execute();
|
||||
await createBuilder(harness, loggedIn.token)
|
||||
.post('/auth/sessions/logout')
|
||||
.body({
|
||||
session_id_hashes: [sessions[0]!.id_hash],
|
||||
mfa_method: 'totp',
|
||||
mfa_code: generateTotpCode(secret),
|
||||
})
|
||||
.expect(204)
|
||||
.execute();
|
||||
});
|
||||
test('TOTP disable requires MFA for sudo verification', async () => {
|
||||
const account = await createTestAccount(harness);
|
||||
const secret = createTotpSecret();
|
||||
const backupCodes = await createBuilder<BackupCodesResponse>(harness, account.token)
|
||||
.post('/users/@me/mfa/totp/enable')
|
||||
.body({
|
||||
secret,
|
||||
code: generateTotpCode(secret),
|
||||
password: account.password,
|
||||
})
|
||||
.execute();
|
||||
const loggedIn = await loginWithTotp(harness, account, secret);
|
||||
await createBuilder(harness, loggedIn.token)
|
||||
.post('/users/@me/mfa/totp/disable')
|
||||
.body({
|
||||
code: 'invalid-code',
|
||||
})
|
||||
.expect(400, 'INVALID_FORM_BODY')
|
||||
.execute();
|
||||
await createBuilder(harness, loggedIn.token)
|
||||
.post('/users/@me/mfa/totp/disable')
|
||||
.body({
|
||||
code: backupCodes.backup_codes[0]!.code,
|
||||
mfa_method: 'totp',
|
||||
mfa_code: generateTotpCode(secret),
|
||||
})
|
||||
.expect(204)
|
||||
.execute();
|
||||
});
|
||||
});
|
||||
});
|
||||
Reference in new issue
Block a user