server auth

apps/server/internal/auth/service_test.go

@@ -0,0 +1,181 @@
+package auth
+
+import (
+	"context"
+	"database/sql"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/tim/cairnquire/apps/server/internal/database"
+)
+
+func setupAuthTestService(t *testing.T) *Service {
+	t.Helper()
+
+	db, err := sql.Open("libsql", "file:"+t.TempDir()+"/auth.db")
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	if err := database.ApplyMigrations(context.Background(), db); err != nil {
+		t.Fatalf("apply migrations: %v", err)
+	}
+	service, err := NewService(NewRepository(db), "http://localhost:8080")
+	if err != nil {
+		t.Fatalf("new auth service: %v", err)
+	}
+	return service
+}
+
+func TestPasswordLoginCreatesValidSession(t *testing.T) {
+	service := setupAuthTestService(t)
+	ctx := context.Background()
+
+	user, err := service.RegisterPasswordUser(ctx, "Dev@Example.com", "Dev User", "correct horse battery staple", "editor")
+	if err != nil {
+		t.Fatalf("RegisterPasswordUser() error = %v", err)
+	}
+	if user.Email != "dev@example.com" {
+		t.Fatalf("email = %q, want normalized", user.Email)
+	}
+
+	principal, token, err := service.LoginPassword(ctx, "dev@example.com", "correct horse battery staple", "127.0.0.1", "test")
+	if err != nil {
+		t.Fatalf("LoginPassword() error = %v", err)
+	}
+	if token == "" {
+		t.Fatal("expected session token")
+	}
+	if principal.Role != RoleAdmin {
+		t.Fatalf("role = %s, want first registered user to bootstrap as admin", principal.Role)
+	}
+
+	validated, err := service.ValidateSessionToken(ctx, token)
+	if err != nil {
+		t.Fatalf("ValidateSessionToken() error = %v", err)
+	}
+	if validated.UserID != principal.UserID {
+		t.Fatalf("validated user = %q, want %q", validated.UserID, principal.UserID)
+	}
+}
+
+func TestAPIKeyUsesShownOnceBearerToken(t *testing.T) {
+	service := setupAuthTestService(t)
+	ctx := context.Background()
+
+	user, err := service.RegisterPasswordUser(ctx, "admin@example.com", "Admin", "correct horse battery staple", "admin")
+	if err != nil {
+		t.Fatalf("RegisterPasswordUser() error = %v", err)
+	}
+	expires := time.Now().UTC().Add(time.Hour)
+	created, err := service.CreateAPIKey(ctx, user.ID, "CLI", []Scope{ScopeDocsRead, ScopeSyncWrite}, &expires)
+	if err != nil {
+		t.Fatalf("CreateAPIKey() error = %v", err)
+	}
+	if !strings.HasPrefix(created.Token, "cq_pat_") {
+		t.Fatalf("token prefix = %q, want cq_pat_", created.Token)
+	}
+	if created.Record.KeyHash != "" && strings.Contains(created.Record.KeyHash, created.Token) {
+		t.Fatal("record contains raw token")
+	}
+
+	principal, err := service.ValidateBearerToken(ctx, created.Token)
+	if err != nil {
+		t.Fatalf("ValidateBearerToken() error = %v", err)
+	}
+	if principal.APIKeyID != created.Record.ID {
+		t.Fatalf("api key id = %q, want %q", principal.APIKeyID, created.Record.ID)
+	}
+	if !Allows(principal, ScopeDocsRead) {
+		t.Fatal("expected docs:read to be allowed")
+	}
+	if Allows(principal, ScopeAdmin) {
+		t.Fatal("did not expect admin scope to be allowed")
+	}
+}
+
+func TestDeviceFlowMintsAPIKeyAfterApproval(t *testing.T) {
+	service := setupAuthTestService(t)
+	ctx := context.Background()
+
+	user, err := service.RegisterPasswordUser(ctx, "admin@example.com", "Admin", "correct horse battery staple", "admin")
+	if err != nil {
+		t.Fatalf("RegisterPasswordUser() error = %v", err)
+	}
+	start, err := service.StartDeviceFlow(ctx, "Laptop", []Scope{ScopeSyncRead})
+	if err != nil {
+		t.Fatalf("StartDeviceFlow() error = %v", err)
+	}
+
+	if _, code, err := service.PollDeviceFlow(ctx, start.DeviceCode); code != "authorization_pending" || err == nil {
+		t.Fatalf("PollDeviceFlow() before approval code=%q err=%v, want authorization_pending", code, err)
+	}
+
+	_, err = service.ApproveDeviceFlow(ctx, principalFromUser(user, "session", "sess:test", "", nil, time.Now().Add(time.Hour)), start.UserCode)
+	if err != nil {
+		t.Fatalf("ApproveDeviceFlow() error = %v", err)
+	}
+	created, code, err := service.PollDeviceFlow(ctx, start.DeviceCode)
+	if err != nil {
+		t.Fatalf("PollDeviceFlow() after approval code=%q err=%v", code, err)
+	}
+	if created.Token == "" {
+		t.Fatal("expected device flow to mint api token")
+	}
+	if _, code, err := service.PollDeviceFlow(ctx, start.DeviceCode); code != "expired" || err == nil {
+		t.Fatalf("PollDeviceFlow() after token issuance code=%q err=%v, want expired", code, err)
+	}
+}
+
+func TestPasswordChangeInvalidatesOldPassword(t *testing.T) {
+	service := setupAuthTestService(t)
+	ctx := context.Background()
+
+	user, err := service.RegisterPasswordUser(ctx, "admin@example.com", "Admin", "correct horse battery staple", "admin")
+	if err != nil {
+		t.Fatalf("RegisterPasswordUser() error = %v", err)
+	}
+	principal := principalFromUser(user, "session", "sess:test", "", nil, time.Now().Add(time.Hour))
+	if err := service.ChangePassword(ctx, principal, "correct horse battery staple", "new correct horse battery staple"); err != nil {
+		t.Fatalf("ChangePassword() error = %v", err)
+	}
+	if _, _, err := service.LoginPassword(ctx, "admin@example.com", "correct horse battery staple", "127.0.0.1", "test"); err == nil {
+		t.Fatal("old password still works")
+	}
+	if _, _, err := service.LoginPassword(ctx, "admin@example.com", "new correct horse battery staple", "127.0.0.1", "test"); err != nil {
+		t.Fatalf("new password login error = %v", err)
+	}
+}
+
+func TestCannotDemoteOrDeleteLastAdmin(t *testing.T) {
+	service := setupAuthTestService(t)
+	ctx := context.Background()
+
+	user, err := service.RegisterPasswordUser(ctx, "admin@example.com", "Admin", "correct horse battery staple", "admin")
+	if err != nil {
+		t.Fatalf("RegisterPasswordUser() error = %v", err)
+	}
+	principal := principalFromUser(user, "session", "sess:test", "", nil, time.Now().Add(time.Hour))
+	if _, err := service.UpdateUserRole(ctx, principal, user.ID, string(RoleEditor)); err == nil {
+		t.Fatal("expected demoting last admin to fail")
+	}
+	if err := service.DeleteAccount(ctx, principal, "correct horse battery staple"); err == nil {
+		t.Fatal("expected deleting last admin to fail")
+	}
+}
+
+func TestPublicRegistrationCannotAttachCredentialsToExistingUser(t *testing.T) {
+	service := setupAuthTestService(t)
+	ctx := context.Background()
+
+	if _, err := service.RegisterPasswordUser(ctx, "dev@example.com", "Dev", "correct horse battery staple", "admin"); err != nil {
+		t.Fatalf("RegisterPasswordUser() error = %v", err)
+	}
+	if _, err := service.RegisterPasswordUser(ctx, "dev@example.com", "Dev", "another correct horse", "viewer"); err == nil {
+		t.Fatal("expected duplicate password registration to fail")
+	}
+	if _, _, err := service.BeginPasskeyRegistration(ctx, "dev@example.com", "Dev", "viewer"); err == nil {
+		t.Fatal("expected public passkey registration for existing account to fail")
+	}
+}