26 lines
1.4 KiB
Markdown
26 lines
1.4 KiB
Markdown
# TESTS — F-005 Identity: register, login, sessions
|
|
|
|
## Unit — src/modules/identity/tests/login-rate-limiter.test.ts
|
|
1. Allows attempts below threshold; records failures
|
|
2. Blocks with retryAfterMs after 10 consecutive failures (AC4 logic)
|
|
3. Success resets the counter
|
|
4. Cooldown expiry re-allows attempts
|
|
|
|
## Unit — src/modules/identity/tests/session-token.test.ts
|
|
1. Tokens are unique and URL-safe
|
|
2. hashSessionToken is deterministic sha256 hex and never equals the raw token
|
|
|
|
## Integration — src/app/tests/identity.itest.ts (real PostgreSQL, fresh DB per run)
|
|
1. register: 201 + body {id, email, createdAt}; DB row stores $argon2id$ hash; plaintext password appears nowhere in the row (AC3)
|
|
2. register duplicate email: 409 EMAIL_ALREADY_REGISTERED
|
|
3. register invalid payload: 400 VALIDATION_ERROR
|
|
4. login valid: 200 + mdv_session cookie with HttpOnly; SameSite=Lax; Secure; Max-Age (AC1, AC5)
|
|
5. login wrong password: 401 INVALID_CREDENTIALS; unknown email returns byte-identical error body (AC2)
|
|
6. rate limit: 10 failed logins then next attempt -> 429 TOO_MANY_ATTEMPTS + Retry-After header (AC4)
|
|
7. logout: 204 + cookie cleared; session row revoked; second logout still 204 (idempotent)
|
|
8. buildApp without pool: /auth/login is 404 (foundation-only app preserved)
|
|
|
|
## QA live
|
|
- register/login/logout over HTTP with curl; cookie flags visible in Set-Cookie
|
|
- verify.sh green (AC6)
|