auth.integration.test.ts

auth.integration.test.tstests/integration/auth.integration.test.tsraw ← integration14,056 B← Back to the app
1/**
2 * AI Software Factory — Integration: Auth (Phase 1)
3 *
4 * Full auth contract against the real API + Postgres + Redis:
5 * register, login, refresh rotation, reuse detection, rate limiting,
6 * session state, and audit events for security-sensitive operations.
7 *
8 * Env: real Testcontainers Postgres/Redis (helpers/containers.ts); random
9 * JWT/refresh/session secrets generated per run (helpers/api.ts).
10 */
11import { afterAll, beforeAll, describe, expect, it } from "vitest";
12import { createTestApp, type TestAppHandle } from "./helpers/api";
13import { authHeaders, createUser, randomPassword, uniqueEmail, countAuditEvents } from "./helpers/seed";
14// The refresh token is stored as its SHA-256 hash; the concurrency test needs
15// to hash the plaintext it received to look the rows up.
16import { sha256hex } from "@factory/api/src/lib/crypto";
17 
18let app: TestAppHandle;
19 
20beforeAll(async () => {
21  app = await createTestApp();
22}, 180_000);
23afterAll(async () => {
24  await app?.close();
25});
26 
27const json = async (res: Response): Promise<Record<string, unknown>> =>
28  (await res.json().catch(() => ({}))) as Record<string, unknown>;
29 
30describe("Auth integration", () => {
31  it("register: creates user, hashes password, marks email unverified", async () => {
32    const email = uniqueEmail("reg");
33    const password = randomPassword();
34    const res = await app.request("POST", "/api/v1/auth/register", {
35      body: { email, password, name: "Reg Test" },
36    });
37    expect(res.status).toBe(201);
38    const body = await json(res);
39    const user = body.user as { id: string; email: string } | undefined;
40    expect(user?.email).toBe(email);
41 
42    // DB: password is stored hashed (bcrypt — never plaintext).
43    const row = await app.prisma.user.findUnique({ where: { email } });
44    expect(row).not.toBeNull();
45    expect(row?.passwordHash).toBeTruthy();
46    expect(row?.passwordHash).not.toContain(password);
47    expect(row?.passwordHash).toMatch(/^\$2[aby]\$/); // bcrypt prefix
48    expect(row?.emailVerification).toBe("UNVERIFIED");
49  });
50 
51  it("register: duplicate email rejected", async () => {
52    const email = uniqueEmail("dup");
53    await app.request("POST", "/api/v1/auth/register", {
54      body: { email, password: randomPassword(), name: "Dup" },
55    });
56    const dup = await app.request("POST", "/api/v1/auth/register", {
57      body: { email, password: randomPassword(), name: "Dup 2" },
58    });
59    expect([400, 409]).toContain(dup.status);
60  });
61 
62  it("login: returns access + refresh tokens; wrong password → 401", async () => {
63    const { email, password } = await createUser(app.request, { name: "Login Test" });
64    const ok = await app.request("POST", "/api/v1/auth/login", {
65      body: { email, password },
66    });
67    expect(ok.status).toBe(200);
68    const body = await json(ok);
69    expect(body.accessToken).toBeTruthy();
70    expect(body.refreshToken).toBeTruthy();
71 
72    const bad = await app.request("POST", "/api/v1/auth/login", {
73      body: { email, password: "wrong-password-xyz" },
74    });
75    expect(bad.status).toBe(401);
76  });
77 
78  it("me: requires auth; returns the user when authenticated", async () => {
79    const anon = await app.request("GET", "/api/v1/auth/me");
80    expect(anon.status).toBe(401);
81 
82    const { accessToken } = await createUser(app.request, { name: "Me Test" });
83    expect(accessToken).toBeTruthy();
84    const me = await app.request("GET", "/api/v1/auth/me", {
85      headers: authHeaders(accessToken!),
86    });
87    expect(me.status).toBe(200);
88    const body = await json(me);
89    expect((body.user as { id: string }).id).toBeTruthy();
90  });
91 
92  it("refresh rotation: old token invalidated, new token works", async () => {
93    const user = await createUser(app.request, { name: "Rotation Test" });
94    const login = await app.request("POST", "/api/v1/auth/login", {
95      body: { email: user.email, password: user.password },
96    });
97    const first = (await json(login)).refreshToken as string;
98 
99    // Rotate.
100    const r1 = await app.request("POST", "/api/v1/auth/refresh", {
101      body: { refreshToken: first },
102    });
103    expect(r1.status).toBe(200);
104    const r1Body = await json(r1);
105    const second = r1Body.refreshToken as string;
106    expect(second).toBeTruthy();
107    expect(second).not.toBe(first);
108    // The rotated token still grants access (new access token issued).
109    expect(r1Body.accessToken).toBeTruthy();
110 
111    // DB: the first token row is revoked (or replaced).
112    const firstRow = await app.prisma.refreshToken.findFirst({
113      where: { userId: user.userId },
114      orderBy: { createdAt: "desc" },
115    });
116    expect(firstRow).not.toBeNull();
117    const anyRevoked = await app.prisma.refreshToken.count({
118      where: { userId: user.userId, revokedAt: { not: null } },
119    });
120    expect(anyRevoked).toBeGreaterThanOrEqual(1);
121  });
122 
123  it("refresh stale retry: rotated token with a LIVE successor → 401, no family kill", async () => {
124    const user = await createUser(app.request, { name: "Stale Retry Test" });
125    const login = await app.request("POST", "/api/v1/auth/login", {
126      body: { email: user.email, password: user.password },
127    });
128    const first = (await json(login)).refreshToken as string;
129 
130    // Rotate once (revokes `first`, issues `second`).
131    const r1 = await app.request("POST", "/api/v1/auth/refresh", {
132      body: { refreshToken: first },
133    });
134    expect(r1.status).toBe(200);
135    const second = (await json(r1)).refreshToken as string;
136 
137    const staleBefore = await countAuditEvents(app.prisma, { action: "auth.refresh_stale_retry" });
138 
139    // Re-present the already-rotated `first` while its successor `second` is
140    // still LIVE (security-architecture.md §1.2 step 3, case a): benign
141    // stale retry → plain 401 `refresh_token_stale`, NO session loss.
142    const stale = await app.request("POST", "/api/v1/auth/refresh", {
143      body: { refreshToken: first },
144    });
145    expect(stale.status).toBe(401);
146    const staleBody = await json(stale);
147    const staleReason = (staleBody.error as { details?: { reason?: string }[] } | undefined)?.details?.find(
148      (d) => d.reason
149    )?.reason;
150    expect(staleReason).toBe("refresh_token_stale");
151 
152    // The presented token is dead, so the httpOnly cookie that carried it
153    // must be cleared (max-age 0 / expired): the web middleware gates on
154    // cookie EXISTENCE only, and a dead-but-present cookie keeps bouncing
155    // /login → /w/default behind a gate that can never authenticate (the
156    // stuck-state livelock from the parallel E2E flake).
157    const setCookie = stale.headers.get("set-cookie") ?? "";
158    expect(setCookie, "stale 401 must clear the factory_refresh cookie").toMatch(/factory_refresh=;/);
159 
160    // The live successor is UNTOUCHED — the session survived.
161    const after = await app.request("POST", "/api/v1/auth/refresh", {
162      body: { refreshToken: second },
163    });
164    expect(after.status).toBe(200);
165 
166    // Audit: recorded as stale retry, NOT as a reuse attack.
167    const staleAfter = await countAuditEvents(app.prisma, { action: "auth.refresh_stale_retry" });
168    expect(staleAfter).toBe(staleBefore + 1);
169    const reuseCount = await countAuditEvents(app.prisma, { action: "auth.refresh_reuse_detected" });
170    expect(reuseCount).toBe(0);
171  });
172 
173  it("refresh reuse: rotated token with a DEAD successor → family kill (reuse attack)", async () => {
174    const user = await createUser(app.request, { name: "Reuse Attack Test" });
175    const login = await app.request("POST", "/api/v1/auth/login", {
176      body: { email: user.email, password: user.password },
177    });
178    const first = (await json(login)).refreshToken as string;
179 
180    // Rotate twice: first → second → third. Both `first` and `second` are
181    // now revoked; `third` is the only live token.
182    const r1 = await app.request("POST", "/api/v1/auth/refresh", {
183      body: { refreshToken: first },
184    });
185    expect(r1.status).toBe(200);
186    const second = (await json(r1)).refreshToken as string;
187    const r2 = await app.request("POST", "/api/v1/auth/refresh", {
188      body: { refreshToken: second },
189    });
190    expect(r2.status).toBe(200);
191    const third = (await json(r2)).refreshToken as string;
192 
193    const reuseBefore = await countAuditEvents(app.prisma, { action: "auth.refresh_reuse_detected" });
194 
195    // Re-present `first`: revoked, AND its successor `second` is dead too
196    // (§1.2 step 3, case b) — the chain moved on without this presentation,
197    // so the token must be treated as stolen → reuse attack → family kill.
198    const reuse = await app.request("POST", "/api/v1/auth/refresh", {
199      body: { refreshToken: first },
200    });
201    expect(reuse.status).toBe(401);
202    const reuseBody = await json(reuse);
203    const reuseReason = (reuseBody.error as { details?: { reason?: string }[] } | undefined)?.details?.find(
204      (d) => d.reason
205    )?.reason;
206    expect(reuseReason).toBe("refresh_token_reused");
207 
208    // The WHOLE family is dead: even the latest live token `third` no longer
209    // works (token theft ⇒ kill the chain), and the session is revoked.
210    const after = await app.request("POST", "/api/v1/auth/refresh", {
211      body: { refreshToken: third },
212    });
213    expect(after.status).toBe(401);
214 
215    // DB: every refresh token of the user is revoked.
216    const liveLeft = await app.prisma.refreshToken.count({
217      where: { userId: user.userId, revokedAt: null },
218    });
219    expect(liveLeft).toBe(0);
220    const session = await app.prisma.session.findFirst({
221      where: { userId: user.userId },
222      orderBy: { createdAt: "desc" },
223    });
224    expect(session?.status).toBe("REVOKED");
225 
226    // Audit: a reuse-attack event was recorded. (Presenting `third` above is
227    // itself a post-kill replay — `third` is now dead with no live successor —
228    // so it audits as a SECOND reuse; we only require that detection fired.)
229    const reuseAfter = await countAuditEvents(app.prisma, { action: "auth.refresh_reuse_detected" });
230    expect(reuseAfter).toBeGreaterThan(reuseBefore);
231  });
232 
233  it("refresh concurrency: two in-flight rotations of one token → one live successor, no orphan", async () => {
234    const user = await createUser(app.request, { name: "Rotation Race Test" });
235    const login = await app.request("POST", "/api/v1/auth/login", {
236      body: { email: user.email, password: user.password },
237    });
238    const first = (await json(login)).refreshToken as string;
239 
240    // Fire two rotations of the SAME token concurrently (the StrictMode
241    // double-bootstrap shape). Both read `first` as live; exactly one may
242    // win the conditional revocation — the loser must roll its new row back
243    // (stale-retry 401), never leave an orphaned live token behind.
244    const [rA, rB] = await Promise.all([
245      app.request("POST", "/api/v1/auth/refresh", { body: { refreshToken: first } }),
246      app.request("POST", "/api/v1/auth/refresh", { body: { refreshToken: first } }),
247    ]);
248    const statuses = [rA.status, rB.status].sort();
249    expect(statuses).toEqual([200, 401]);
250    const loserBody = await json(rA.status === 401 ? rA : rB);
251    const loserReason = (loserBody.error as { details?: { reason?: string }[] } | undefined)?.details?.find(
252      (d) => d.reason
253    )?.reason;
254    expect(loserReason).toBe("refresh_token_stale");
255 
256    // The winner's successor is the ONLY live token in `first`'s session
257    // chain — a leaked (non-rolled-back) loser rotation would leave a SECOND
258    // live row anchored at the same session (the orphaned-live-token defect).
259    // (The user's OTHER sessions — register + login — keep their own tokens.)
260    const winner = (await json(rA.status === 200 ? rA : rB)).refreshToken as string;
261    const winnerLive = await app.prisma.refreshToken.findUnique({
262      where: { tokenHash: sha256hex(winner) },
263      select: { id: true, revokedAt: true, sessionAgent: true, replacedBy: true },
264    });
265    expect(winnerLive).not.toBeNull();
266    expect(winnerLive?.revokedAt).toBeNull();
267    // `first`'s session must have exactly one live token (the winner's) — a
268    // leaked (non-rolled-back) loser rotation would leave a second.
269    const firstSessionLive = await app.prisma.refreshToken.count({
270      where: { userId: user.userId, revokedAt: null, sessionAgent: winnerLive!.sessionAgent ?? "" },
271    });
272    expect(firstSessionLive).toBe(1);
273 
274    // `first` is revoked and points at the winner (the rotation chain is
275    // intact — reuse detection can still distinguish stale vs attack).
276    const firstRow = await app.prisma.refreshToken.findUnique({
277      where: { tokenHash: sha256hex(first) },
278    });
279    expect(firstRow?.revokedAt).not.toBeNull();
280    expect(firstRow?.replacedBy).toBe(winnerLive!.id);
281 
282    // The winner's token still authenticates (rotates forward to a third).
283    const winnerNext = await app.request("POST", "/api/v1/auth/refresh", {
284      body: { refreshToken: winner },
285    });
286    expect(winnerNext.status).toBe(200);
287  });
288 
289  it("rate limit: sustained login failures from one client → 429", async () => {
290    const email = uniqueEmail("rl");
291    await app.request("POST", "/api/v1/auth/register", {
292      body: { email, password: randomPassword(), name: "RL" },
293    });
294 
295    let got429 = false;
296    for (let i = 0; i < 20; i++) {
297      const res = await app.request("POST", "/api/v1/auth/login", {
298        body: { email, password: `wrong-${i}` },
299      });
300      if (res.status === 429) {
301        got429 = true;
302        break;
303      }
304    }
305    expect(got429, "expected 429 after sustained login failures (RATE_LIMIT_* config)").toBe(true);
306  });
307 
308  it("audit: login is recorded as an audit event", async () => {
309    const user = await createUser(app.request, { name: "Audit Login Test" });
310    const before = await countAuditEvents(app.prisma, { action: "user.login" });
311 
312    await app.request("POST", "/api/v1/auth/login", {
313      body: { email: user.email, password: user.password },
314    });
315 
316    const after = await countAuditEvents(app.prisma, { action: "user.login" });
317    expect(after).toBe(before + 1);
318  });
319});
320