menu/test/auth.test.ts

import { strict as assert } from 'node:assert';
import { describe, it } from 'node:test';
import {
  LoginThrottle,
  createSessionToken,
  hashPassword,
  verifyPassword,
  verifySessionToken,
} from '../src/auth.ts';

const NOW = new Date('2026-05-01T06:00:00.000Z');

describe('the admin password', () => {
  it('verifies a correct password and rejects a wrong one', async () => {
    const stored = await hashPassword('correct horse battery staple');
    assert.match(stored, /^scrypt\$32768\$8\$1\$/);
    assert.equal(await verifyPassword('correct horse battery staple', stored), true);
    assert.equal(await verifyPassword('Correct horse battery staple', stored), false);
    assert.equal(await verifyPassword('', stored), false);
  });

  it('salts every hash, so the same password never produces the same string', async () => {
    const first = await hashPassword('same password');
    const second = await hashPassword('same password');
    assert.notEqual(first, second);
    assert.equal(await verifyPassword('same password', first), true);
    assert.equal(await verifyPassword('same password', second), true);
  });

  it('rejects malformed stored values instead of throwing', async () => {
    for (const stored of [
      '',
      'plaintext',
      'scrypt$1$2$3',
      'bcrypt$1$2$3$4$5',
      'scrypt$x$8$1$aa$bb',
    ]) {
      assert.equal(await verifyPassword('anything', stored), false);
    }
  });
});

describe('the session token', () => {
  const secret = 'a-long-random-secret';

  it('accepts a fresh token', () => {
    const token = createSessionToken(secret, 60_000, NOW);
    assert.equal(verifySessionToken(token, secret, NOW), true);
    assert.equal(verifySessionToken(token, secret, new Date(NOW.getTime() + 59_000)), true);
  });

  it('rejects an expired token', () => {
    const token = createSessionToken(secret, 60_000, NOW);
    assert.equal(verifySessionToken(token, secret, new Date(NOW.getTime() + 61_000)), false);
  });

  it('rejects a token signed with another secret, a tampered expiry, and rubbish', () => {
    const token = createSessionToken(secret, 60_000, NOW);
    assert.equal(verifySessionToken(token, 'another-secret', NOW), false);
    const [, signature] = token.split('.');
    assert.equal(verifySessionToken(`${NOW.getTime() + 999_999}.${signature}`, secret, NOW), false);
    assert.equal(verifySessionToken(undefined, secret, NOW), false);
    assert.equal(verifySessionToken('', secret, NOW), false);
    assert.equal(verifySessionToken('no-dot', secret, NOW), false);
    assert.equal(verifySessionToken(`.${signature}`, secret, NOW), false);
  });
});

describe('the login throttle', () => {
  it('blocks the sixth failure inside the window and reports how long to wait', () => {
    let time = NOW.getTime();
    const throttle = new LoginThrottle({
      maxFailures: 5,
      windowMs: 60_000,
      now: () => new Date(time),
    });

    for (let attempt = 0; attempt < 5; attempt += 1) {
      assert.equal(throttle.check('1.2.3.4').allowed, true);
      throttle.recordFailure('1.2.3.4');
    }

    const blocked = throttle.check('1.2.3.4');
    assert.equal(blocked.allowed, false);
    assert.ok(blocked.retryAfterSeconds > 0);

    assert.equal(throttle.check('5.6.7.8').allowed, true);

    time += 61_000;
    assert.equal(throttle.check('1.2.3.4').allowed, true);
  });

  it('clears failures on a successful login', () => {
    const throttle = new LoginThrottle({ maxFailures: 2, windowMs: 60_000, now: () => NOW });
    throttle.recordFailure('ip');
    throttle.recordFailure('ip');
    assert.equal(throttle.check('ip').allowed, false);
    throttle.reset('ip');
    assert.equal(throttle.check('ip').allowed, true);
  });
});