admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
79 lines
3.2 KiB
TypeScript
79 lines
3.2 KiB
TypeScript
import { describe, it, expect, vi, afterEach } from 'vitest'
|
|
import { isMfaExemptionActive, isMfaRequired, shouldEnforceMfa } from '../mfa'
|
|
|
|
describe('mfa helpers', () => {
|
|
afterEach(() => {
|
|
vi.unstubAllEnvs()
|
|
})
|
|
|
|
describe('isMfaRequired', () => {
|
|
it('returns false when self-hosted', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'true')
|
|
vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
|
|
expect(isMfaRequired()).toBe(false)
|
|
})
|
|
|
|
it('returns true when hosted and MFA required', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'false')
|
|
vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
|
|
expect(isMfaRequired()).toBe(true)
|
|
})
|
|
})
|
|
|
|
describe('shouldEnforceMfa', () => {
|
|
it('returns false when MFA is not required', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'true')
|
|
expect(shouldEnforceMfa({ app_metadata: {} })).toBe(false)
|
|
})
|
|
|
|
it('returns false when user has bankid_linked', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'false')
|
|
vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
|
|
expect(shouldEnforceMfa({ app_metadata: { bankid_linked: true } })).toBe(false)
|
|
})
|
|
|
|
it('returns true when MFA required and no bankid', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'false')
|
|
vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
|
|
expect(shouldEnforceMfa({ app_metadata: {} })).toBe(true)
|
|
})
|
|
|
|
it('skips MFA while a service-role exemption is still in the future', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'false')
|
|
vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
|
|
const future = new Date(Date.now() + 60 * 60 * 1000).toISOString()
|
|
expect(shouldEnforceMfa({ app_metadata: { mfa_exempt_until: future } })).toBe(false)
|
|
})
|
|
|
|
it('enforces MFA again once the exemption has expired', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'false')
|
|
vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
|
|
const past = new Date(Date.now() - 60 * 1000).toISOString()
|
|
expect(shouldEnforceMfa({ app_metadata: { mfa_exempt_until: past } })).toBe(true)
|
|
})
|
|
|
|
it('treats a malformed or non-string exemption as no exemption', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'false')
|
|
vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
|
|
expect(shouldEnforceMfa({ app_metadata: { mfa_exempt_until: 'soon' } })).toBe(true)
|
|
expect(shouldEnforceMfa({ app_metadata: { mfa_exempt_until: true } })).toBe(true)
|
|
expect(shouldEnforceMfa({ app_metadata: { mfa_exempt_until: 4102444800000 } })).toBe(true)
|
|
expect(shouldEnforceMfa({ app_metadata: { mfa_exempt: true } })).toBe(true)
|
|
})
|
|
|
|
it('returns true when app_metadata is undefined', () => {
|
|
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'false')
|
|
vi.stubEnv('NEXT_PUBLIC_REQUIRE_MFA', 'true')
|
|
expect(shouldEnforceMfa({})).toBe(true)
|
|
})
|
|
})
|
|
|
|
describe('isMfaExemptionActive', () => {
|
|
it('compares against the clock it is given', () => {
|
|
const user = { app_metadata: { mfa_exempt_until: '2026-10-01T00:00:00Z' } }
|
|
expect(isMfaExemptionActive(user, new Date('2026-09-30T23:59:59Z'))).toBe(true)
|
|
expect(isMfaExemptionActive(user, new Date('2026-10-01T00:00:00Z'))).toBe(false)
|
|
})
|
|
})
|
|
})
|