76 lines
3.0 KiB
TypeScript
76 lines
3.0 KiB
TypeScript
import { UnauthorizedException } from '@nestjs/common';
|
|
import { AuthService } from './auth.service';
|
|
import { hashPassword } from '../users/users.service';
|
|
|
|
function createUsersMock(roleCode: string, overrides: Record<string, unknown> = {}) {
|
|
const user = {
|
|
id: 'user-1',
|
|
tenantId: roleCode === 'enterprise_admin' ? 'tenant-1' : null,
|
|
username: 'user',
|
|
email: 'user@example.com',
|
|
phone: '13800000000',
|
|
displayName: '用户',
|
|
passwordHash: hashPassword('secret1'),
|
|
status: 'active',
|
|
deletedAt: null,
|
|
lockedUntil: null,
|
|
tenant: { id: 'tenant-1', name: '企业A' },
|
|
roles: [{ role: { code: roleCode } }],
|
|
...overrides,
|
|
};
|
|
return {
|
|
findByLogin: jest.fn().mockResolvedValue(user),
|
|
recordLoginSuccess: jest.fn(),
|
|
recordLoginFailure: jest.fn(),
|
|
};
|
|
}
|
|
|
|
function createSessionsMock() {
|
|
const record = {
|
|
userId: 'user-1', portal: 'admin', sessionVersion: 0, createdAt: 1, lastActivityAt: 1,
|
|
lastAuthenticatedAt: 1, absoluteExpiresAt: Date.now() + 1000,
|
|
};
|
|
return {
|
|
create: jest.fn().mockResolvedValue({ token: 'opaque-session-token', record }),
|
|
publicSession: jest.fn().mockReturnValue({ idleTimeoutSeconds: 3600, absoluteExpiresAt: new Date(record.absoluteExpiresAt).toISOString() }),
|
|
};
|
|
}
|
|
|
|
async function loginWithCaptcha(service: AuthService, portal: 'admin' | 'client', password = 'secret1') {
|
|
const captcha = service.createCaptcha();
|
|
const answer = captcha.challenge.split('=')[0].split('+').map((part) => Number(part.trim())).reduce((sum, value) => sum + value, 0);
|
|
return service.login({
|
|
login: 'user@example.com',
|
|
password,
|
|
captchaId: captcha.captchaId,
|
|
captchaText: String(answer),
|
|
}, portal);
|
|
}
|
|
|
|
describe('AuthService', () => {
|
|
it('allows platform admins to login admin portal', async () => {
|
|
const users = createUsersMock('platform_admin');
|
|
const sessions = createSessionsMock();
|
|
const service = new AuthService(users as never, sessions as never);
|
|
await expect(loginWithCaptcha(service, 'admin')).resolves.toEqual(expect.objectContaining({ portal: 'admin', sessionToken: 'opaque-session-token' }));
|
|
expect(users.recordLoginSuccess).toHaveBeenCalledWith('user-1');
|
|
expect(sessions.create).toHaveBeenCalledWith('user-1', 'admin', 0);
|
|
});
|
|
|
|
it('rejects enterprise admins on admin portal', async () => {
|
|
const users = createUsersMock('enterprise_admin');
|
|
const service = new AuthService(users as never, createSessionsMock() as never);
|
|
await expect(loginWithCaptcha(service, 'admin')).rejects.toBeInstanceOf(UnauthorizedException);
|
|
expect(users.recordLoginFailure).toHaveBeenCalledWith('user-1');
|
|
});
|
|
|
|
it('locks user after five failed password attempts', async () => {
|
|
const users = createUsersMock('platform_admin');
|
|
const service = new AuthService(users as never, createSessionsMock() as never);
|
|
for (let index = 0; index < 5; index += 1) {
|
|
await expect(loginWithCaptcha(service, 'admin', 'bad-password')).rejects.toBeInstanceOf(UnauthorizedException);
|
|
}
|
|
expect(users.recordLoginFailure).toHaveBeenCalledTimes(5);
|
|
});
|
|
});
|