Crussell/backend/handlers/user/twofa_prod_test.go

//go:build !dev

package user

// Tests for the PRODUCTION 2FA issuance gate (twofa_prod.go).
//
// LIMITATION (documented — M17): twofa_prod.go is compiled only in a genuine
// production build (`!dev && !test`). Under BOTH required test runs — the
// "test,dev" run and the "test,!dev" prod-shape run — the dev/test variant
// (twofa_dev.go, build tag `dev || test`) is the compiled function and its
// fail-closed branches (no TWO_FACTOR_PEPPER → refuse; no delivery channel →
// 503) are unreachable. These tests compile in every `!dev` build and run
// their assertions ONLY when the prod variant marker reports the real prod
// functions are live; under the test tag they skip with the same documented
// rationale the payments package uses (twofa_delivery_prod_test.go).

import (
	"os"
	"testing"
)

// twoFAAllowLogDeliveryEnv is only defined in twofa_prod.go (!dev && !test);
// use the literal env name so this test also compiles under `test,!dev`.
const allowLogDeliveryEnv = "TWO_FACTOR_ALLOW_LOG_DELIVERY"

// TestTwoFAEnsureIssueAllowed_ProdPredicate pins the production issuance gate:
// it fails closed without TWO_FACTOR_PEPPER (an unsalted digest in the 1M code
// space would be offline-brute-forceable) or without a delivery channel, and
// allows issuance only when both are configured.
func TestTwoFAEnsureIssueAllowed_ProdPredicate(t *testing.T) {
	if !twofaProdVariant {
		t.Skip("twoFAEnsureIssueAllowed() is the dev/test build's always-allowed variant (twofa_dev.go, `dev || test`); the prod fail-closed branches are unreachable under the test tag — see the file header for the documented limitation")
	}

	os.Unsetenv(twoFAPepperEnv)
	os.Unsetenv(allowLogDeliveryEnv)
	if err := twoFAEnsureIssueAllowed(); err == nil {
		t.Error("expected issuance refused without TWO_FACTOR_PEPPER in a production build")
	} else if err.Error() != "TWO_FACTOR_PEPPER is not set; refusing to issue a 2FA code (an unsalted digest would be offline-brute-forceable)" {
		t.Errorf("expected the pepper-required error without the pepper, got %v", err)
	}

	os.Setenv(twoFAPepperEnv, "test-pepper")
	os.Unsetenv(allowLogDeliveryEnv)
	if err := twoFAEnsureIssueAllowed(); err == nil {
		t.Error("expected issuance refused without a delivery channel in a production build")
	} else if err != errTwoFADeliveryUnavailable {
		t.Errorf("expected errTwoFADeliveryUnavailable without a channel, got %v", err)
	}

	os.Setenv(allowLogDeliveryEnv, "true")
	if err := twoFAEnsureIssueAllowed(); err != nil {
		t.Errorf("expected issuance allowed with both the pepper and a delivery channel, got %v", err)
	}
}

// TestTwoFADeliveryAvailable_ProdPredicate pins the production delivery
// predicate: TWO_FACTOR_ALLOW_LOG_DELIVERY unset → no channel (false), exactly
// "true" → channel (true), any other value → no channel.
func TestTwoFADeliveryAvailable_ProdPredicate(t *testing.T) {
	if !twofaProdVariant {
		t.Skip("twoFADeliveryAvailable() is the dev/test build's trivially-true variant (twofa_dev.go, `dev || test`); the 503 delivery-unavailable branch is unreachable under the test tag — see the file header for the documented limitation")
	}

	os.Unsetenv(allowLogDeliveryEnv)
	if twoFADeliveryAvailable() {
		t.Error("production without the explicit opt-in must have NO 2FA delivery channel")
	}
	for _, v := range []string{"", "1", "yes", "on", "True", "TRUE", "false"} {
		os.Setenv(allowLogDeliveryEnv, v)
		if twoFADeliveryAvailable() {
			t.Errorf("value %q must NOT open the delivery channel (exact 'true' only)", v)
		}
	}
	os.Setenv(allowLogDeliveryEnv, "true")
	if !twoFADeliveryAvailable() {
		t.Error("the explicit insecure log-delivery opt-in must open the channel")
	}
}