buzz-sheet/lib/auth/server.test.ts

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";

const mocks = { session: vi.fn(), auth: vi.fn() };
const sudloh = { bind: vi.fn(), validate: vi.fn() };
vi.mock("server-only", () => ({}));
vi.mock("@/db", () => ({ getDb: () => ({}) }));
vi.mock("next/headers", () => ({ headers: async () => new Headers() }));
vi.mock("better-auth", () => ({ betterAuth: mocks.auth }));
vi.mock("better-auth/adapters/drizzle", () => ({ drizzleAdapter: () => ({}) }));
vi.mock("better-auth/next-js", () => ({ nextCookies: () => ({}) }));
vi.mock("better-auth/plugins", () => ({ admin: (options: unknown) => options, captcha: () => ({}),
  genericOAuth: (options: unknown) => ({ id: "generic-oauth", options }),
  emailOTP: (options: unknown) => ({ id: "email-otp", options }) }));
vi.mock("./sudloh", () => ({ bindSudlohSession: sudloh.bind, validateSudlohSession: sudloh.validate }));

const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "BUZZ_DEMO_MODE", "RESEND_API_KEY", "SUDLOH_OIDC_CLIENT_ID", "SUDLOH_OIDC_CLIENT_SECRET", "SUDLOH_OIDC_REDIRECT_URI", "SUDLOH_OIDC_ISSUER", "SUDLOH_OIDC_ONLY", "TRUSTED_CLIENT_IP_HEADER"] as const;
const testEnv = process.env as Record<string, string | undefined>;
const originalEnv = envNames.map((name) => testEnv[name]);

beforeEach(() => {
  vi.resetModules?.();
  testEnv.NODE_ENV = "development";
  testEnv.DATABASE_URL = "postgresql://test.invalid/test";
  testEnv.BETTER_AUTH_URL = "https://guide.example.test";
  testEnv.BETTER_AUTH_SECRET = "a-test-secret-with-more-than-32-characters";
  mocks.auth.mockReturnValue({ api: { getSession: mocks.session } });
  mocks.session.mockResolvedValue(null);
  sudloh.bind.mockReset();
  sudloh.validate.mockReset().mockResolvedValue(true);
  delete testEnv.SUDLOH_OIDC_CLIENT_ID;
  delete testEnv.SUDLOH_OIDC_CLIENT_SECRET;
  delete testEnv.SUDLOH_OIDC_REDIRECT_URI;
  delete testEnv.SUDLOH_OIDC_ISSUER;
  delete testEnv.SUDLOH_OIDC_ONLY;
  delete testEnv.TRUSTED_CLIENT_IP_HEADER;
});
afterEach(() => {
  envNames.forEach((name, index) => {
    const value = originalEnv[index];
    if (value === undefined) delete testEnv[name];
    else testEnv[name] = value;
  });
});

describe("actual administrator session boundary", () => {
  it("does not grant access when the old demo flag is enabled", async () => {
    testEnv.BUZZ_DEMO_MODE = "true";
    const { getAdminSession, requireAdmin } = await import("./server");
    expect(await getAdminSession()).toBeNull();
    await expect(requireAdmin()).rejects.toMatchObject({ status: 401 });
  });
  it("rejects unprivileged users and revoked sessions", async () => {
    const { requireAdmin } = await import("./server");
    const user = { id: "admin", email: "[email protected]", emailVerified: true, role: "admin" };
    mocks.session.mockResolvedValue({ user, session: { id: "session" } });
    await expect(requireAdmin()).resolves.toMatchObject({ user: { id: "admin" } });
    mocks.session.mockResolvedValue({ user: { ...user, role: "user" }, session: { id: "session" } });
    await expect(requireAdmin()).rejects.toMatchObject({ status: 401 });
    mocks.session.mockResolvedValue(null);
    await expect(requireAdmin()).rejects.toMatchObject({ status: 401 });
  });
  it("defaults accounts to user and requires six-character new passwords", async () => {
    (await import("./server")).getAuth();
    const options = mocks.auth.mock.calls.at(-1)![0];
    expect(options.emailAndPassword).toMatchObject({ disableSignUp: false, minPasswordLength: 6 });
    expect(options.plugins).toContainEqual({ defaultRole: "user" });
    expect(options.rateLimit.customStorage.consume).toBeTypeOf("function");
    expect(options.databaseHooks).toBeUndefined();
  });
  it("adds verified Sudloh sign-in while retaining email sign-in", async () => {
    testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
    testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
    const { getAuth, isSudlohOidcEnabled } = await import("./server");
    expect(isSudlohOidcEnabled()).toBe(true);
    getAuth();
    const options = mocks.auth.mock.calls.at(-1)![0];
    expect(options.emailAndPassword).toMatchObject({ enabled: true, disableSignUp: false });
    expect(options.account.accountLinking.disableImplicitLinking).toBe(true);
    expect(options.account.accountLinking.enabled).not.toBe(false);
    expect(options.plugins.some((plugin: { id?: string }) => plugin.id === "email-otp")).toBe(true);
    expect(options.plugins.find((plugin: { id?: string }) => plugin.id === "generic-oauth").options.config[0]).toMatchObject({
      providerId: "sudloh", authentication: "basic", requireIdTokenVerification: true,
      requireEmailVerification: true, disableProviderLogout: true,
      overrideUserInfo: true,
      scopes: ["openid", "profile", "email"],
      redirectURI: "https://guide.example.test/api/auth/callback/sudloh",
    });
  });
  it("disables local sign-in after the OIDC cutover flag is set", async () => {
    testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
    testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
    testEnv.SUDLOH_OIDC_ONLY = "true";
    testEnv.TRUSTED_CLIENT_IP_HEADER = "x-forwarded-for";
    (await import("./server")).getAuth();
    const options = mocks.auth.mock.calls.at(-1)![0];
    expect(options.advanced.ipAddress.ipAddressHeaders).toEqual(["x-forwarded-for"]);
    expect(options.emailAndPassword).toMatchObject({ enabled: false, disableSignUp: true });
    expect(options.plugins.some((plugin: { id?: string }) => plugin.id === "email-otp")).toBe(false);
    await options.databaseHooks.session.create.after({ id: "guide-session", userId: "user-1" },
      { path: "/callback/:id", params: { id: "sudloh" } });
    expect(sudloh.bind).toHaveBeenCalledWith("user-1", "guide-session");
    sudloh.bind.mockClear();
    await options.databaseHooks.session.create.after({ id: "other-session", userId: "user-1" },
      { path: "/callback/:id", params: { id: "other" } });
    expect(sudloh.bind).not.toHaveBeenCalled();
  });
  it("denies a revoked Sudloh session", async () => {
    testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
    testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
    testEnv.SUDLOH_OIDC_ONLY = "true";
    mocks.session.mockResolvedValue({ user: { id: "user-1", email: "[email protected]",
      emailVerified: true, role: "admin" }, session: { id: "guide-session" } });
    sudloh.validate.mockResolvedValue(false);
    const { getAdminSession, getCustomerSession } = await import("./server");
    expect(await getCustomerSession()).toBeNull();
    expect(await getAdminSession()).toBeNull();
  });
  it("rejects incomplete or mismatched Sudloh client configuration", async () => {
    const { getAuth, isSudlohOidcEnabled } = await import("./server");
    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
    expect(isSudlohOidcEnabled()).toBe(false);
    testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
    expect(isSudlohOidcEnabled).toThrow("client ID, client secret, and exact redirect URI");
    testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://wrong.example.test/api/auth/callback/sudloh";
    expect(getAuth).toThrow("SUDLOH_OIDC_REDIRECT_URI must be");
  });
  it("requires verification and sends auth links from the configured sender", async () => {
    testEnv.RESEND_API_KEY = "test-key";
    const fetchMock = vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(null, { status: 200 }));
    try {
      (await import("./server")).getAuth();
      const options = mocks.auth.mock.calls.at(-1)![0];
      expect(options.emailAndPassword.requireEmailVerification).toBe(true);
      expect(options.emailVerification).toMatchObject({
        sendOnSignUp: false, autoSignInAfterVerification: true,
      });
      expect(options.user.changeEmail.enabled).toBe(true);
      const otp = options.plugins.find((plugin: { id?: string }) => plugin.id === "email-otp");
      expect(otp.options).toMatchObject({ sendVerificationOnSignUp: true, storeOTP: "hashed" });
      const user = { email: "[email protected]" };
      await otp.options.sendVerificationOTP({ email: user.email, otp: "123456", type: "email-verification" });
      await options.emailVerification.sendVerificationEmail({ user, url: "https://guide.example.test/verify-email?token=abc" });
      await options.user.changeEmail.sendChangeEmailConfirmation({ user, newEmail: "[email protected]",
        url: "https://guide.example.test/verify-email?token=change" });
      await options.emailAndPassword.sendResetPassword({ user, url: "https://guide.example.test/reset-password/abc" });
      expect(fetchMock).toHaveBeenCalledTimes(4);
      for (const call of fetchMock.mock.calls) {
        expect(call[0]).toBe("https://api.resend.com/emails");
        expect(call[1]?.headers).toMatchObject({ Authorization: "Bearer test-key" });
        const body = JSON.parse(String(call[1]?.body));
        expect(body).toMatchObject({ from: "Buzz Guide <[email protected]>", to: [user.email] });
        expect(body.text).toMatch(/123456|https:\/\/guide\.example\.test\//);
      }
    } finally { fetchMock.mockRestore(); }
  });
  it("fails delivery when the provider rejects an auth email", async () => {
    testEnv.RESEND_API_KEY = "test-key";
    const fetchMock = vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(null, { status: 403 }));
    try {
      (await import("./server")).getAuth();
      const options = mocks.auth.mock.calls.at(-1)![0];
      await expect(options.emailVerification.sendVerificationEmail({
        user: { email: "[email protected]" }, url: "https://guide.example.test/verify-email",
      })).rejects.toThrow("delivery failed");
    } finally { fetchMock.mockRestore(); }
  });
});