75293f39bc
- Hexagonal identity module: domain ports, use cases, argon2id hasher, pg repos - Migration 002_identity: identity_users + identity_sessions (token hash only) - Opaque 512-bit session tokens; DB stores SHA-256 hash; 7-day TTL in SQL - Cookie HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax - LoginRateLimiter: 10 failures -> 429 + Retry-After, 15-min cooldown - Anti-enumeration: identical generic 401 + dummy-hash timing equalization - buildApp gains optional pool/cookieSecure; foundation-only app preserved - 47 unit + 14 integration tests; live smoke covers all acceptance criteria
26 lines
1.4 KiB
Markdown
26 lines
1.4 KiB
Markdown
# TESTS — F-005 Identity: register, login, sessions
|
|
|
|
## Unit — src/modules/identity/tests/login-rate-limiter.test.ts
|
|
1. Allows attempts below threshold; records failures
|
|
2. Blocks with retryAfterMs after 10 consecutive failures (AC4 logic)
|
|
3. Success resets the counter
|
|
4. Cooldown expiry re-allows attempts
|
|
|
|
## Unit — src/modules/identity/tests/session-token.test.ts
|
|
1. Tokens are unique and URL-safe
|
|
2. hashSessionToken is deterministic sha256 hex and never equals the raw token
|
|
|
|
## Integration — src/app/tests/identity.itest.ts (real PostgreSQL, fresh DB per run)
|
|
1. register: 201 + body {id, email, createdAt}; DB row stores $argon2id$ hash; plaintext password appears nowhere in the row (AC3)
|
|
2. register duplicate email: 409 EMAIL_ALREADY_REGISTERED
|
|
3. register invalid payload: 400 VALIDATION_ERROR
|
|
4. login valid: 200 + mdv_session cookie with HttpOnly; SameSite=Lax; Secure; Max-Age (AC1, AC5)
|
|
5. login wrong password: 401 INVALID_CREDENTIALS; unknown email returns byte-identical error body (AC2)
|
|
6. rate limit: 10 failed logins then next attempt -> 429 TOO_MANY_ATTEMPTS + Retry-After header (AC4)
|
|
7. logout: 204 + cookie cleared; session row revoked; second logout still 204 (idempotent)
|
|
8. buildApp without pool: /auth/login is 404 (foundation-only app preserved)
|
|
|
|
## QA live
|
|
- register/login/logout over HTTP with curl; cookie flags visible in Set-Cookie
|
|
- verify.sh green (AC6)
|