`src/lib/auth.test.ts`

42 lines
import { describe, expect, it, beforeAll } from "vitest";
import { hashPassword, verifyPassword } from "./password";
import { createSession, verifySession } from "./session";

beforeAll(() => {
  process.env.AUTH_SECRET = "test-secret-please-change";
});

describe("password hashing (scrypt)", () => {
  it("verifies a correct password and rejects a wrong one", () => {
    const hash = hashPassword("s3cret-pw");
    expect(hash.startsWith("scrypt$")).toBe(true);
    expect(verifyPassword("s3cret-pw", hash)).toBe(true);
    expect(verifyPassword("wrong", hash)).toBe(false);
  });

  it("salts so identical passwords hash differently", () => {
    expect(hashPassword("same")).not.toBe(hashPassword("same"));
  });

  it("rejects malformed stored hashes", () => {
    expect(verifyPassword("x", "$demo$changeme")).toBe(false);
    expect(verifyPassword("x", "garbage")).toBe(false);
  });
});

describe("session JWT", () => {
  it("round-trips a session payload", async () => {
    const token = await createSession({ sub: "u1", email: "a@b.com", role: "ADMIN" });
    const payload = await verifySession(token);
    expect(payload?.sub).toBe("u1");
    expect(payload?.email).toBe("a@b.com");
    expect(payload?.role).toBe("ADMIN");
  });

  it("rejects a tampered/garbage token", async () => {
    expect(await verifySession("not.a.jwt")).toBeNull();
    const token = await createSession({ sub: "u1", email: "a@b.com", role: "ADMIN" });
    expect(await verifySession(token + "x")).toBeNull();
  });
});