Crussell/backend/internal/twofa/twofa_test.go

//go:build test

package twofa

// Tests for the shared 2FA verification core (the package the payments
// card-access gate — B6/B10 — imports for real-challenge verification).
// The pepper provider is never registered here (handlers/user's build-tagged
// files register it), so Hash falls back to the legacy plain SHA-256 digest —
// which is exactly what the seeded pending-code hashes use.

import (
	"context"
	"database/sql"
	"testing"
	"time"

	"crussell/clock"
	"crussell/db"
	"crussell/testutils"
	"crussell/testutils/fixtures"

	"github.com/stretchr/testify/require"
)

func seedPending(t *testing.T, ctx context.Context, tx db.Querier, userID, code string) {
	t.Helper()
	_, err := tx.Exec(ctx, `UPDATE users
		SET two_factor_method = 'email',
			two_factor_pending_code_hash = $2,
			two_factor_pending_code_expires = $3
		WHERE id = $1`, userID, Hash(code), clock.Now().Add(10*time.Minute))
	require.NoError(t, err)
}

func TestVerifyForUser_CorrectAndWrongCode(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)

	// consume=false (interactive setup/disable path): a success keeps the
	// pending code valid, so a wrong follow-up code reports ErrIncorrect.
	userID, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	seedPending(t, ctx, tx, userID, "123456")
	require.NoError(t, VerifyForUser(ctx, userID, "123456", false), "correct code must verify")
	require.ErrorIs(t, VerifyForUser(ctx, userID, "999999", false), ErrIncorrect)

	// consume=true (payments saved-card gate path): a success DESTROYS the
	// pending code, so re-verifying the same code reports ErrMissingOrExpired
	// — a verified code is single-use and cannot authorize a second charge.
	userID2, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	seedPending(t, ctx, tx, userID2, "123456")
	require.NoError(t, VerifyForUser(ctx, userID2, "123456", true), "correct code must verify")
	require.ErrorIs(t, VerifyForUser(ctx, userID2, "123456", true), ErrMissingOrExpired, "a consumed code must be single-use")
	var pendingHash sql.NullString
	require.NoError(t, tx.QueryRow(ctx, "SELECT two_factor_pending_code_hash FROM users WHERE id = $1", userID2).Scan(&pendingHash))
	require.False(t, pendingHash.Valid, "a consumed code must be NULLed in the DB")
}

func TestVerifyForUser_LockoutAndMissing(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	userID, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	seedPending(t, ctx, tx, userID, "123456")

	// Wrong code #1 → ErrIncorrect; four more reach the 5-attempt cap.
	require.ErrorIs(t, VerifyForUser(ctx, userID, "999999", true), ErrIncorrect)
	for i := 0; i < 4; i++ {
		_ = VerifyForUser(ctx, userID, "999999", true)
	}
	require.ErrorIs(t, VerifyForUser(ctx, userID, "999999", true), ErrLockedOut)

	// A fresh user with no pending code → ErrMissingOrExpired.
	userID2, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	require.ErrorIs(t, VerifyForUser(ctx, userID2, "123456", true), ErrMissingOrExpired)
}

// TestConsumePendingCode pins the MEDIUM-2 contract: ConsumePendingCode NULLs
// the stored pending-code digest and expiry (idempotently), and is the ONLY
// place a verified-but-unconsumed code dies on the saved-card charge path.
func TestConsumePendingCode(t *testing.T) {
	ctx, tx := testutils.SetupTestTx(t)
	userID, err := fixtures.CreateTestUser(tx)
	require.NoError(t, err)
	seedPending(t, ctx, tx, userID, "123456")

	// A code verified WITHOUT consuming stays valid (the saved-card charge gate
	// path, MEDIUM-2) — re-verification must keep working until consumption.
	require.NoError(t, VerifyForUser(ctx, userID, "123456", false), "verify-without-consume must pass")
	require.NoError(t, VerifyForUser(ctx, userID, "123456", false), "an unconsumed code must still verify on a same-key retry")

	require.NoError(t, ConsumePendingCode(ctx, tx, userID), "explicit consumption at charge success must succeed")
	require.ErrorIs(t, VerifyForUser(ctx, userID, "123456", false), ErrMissingOrExpired, "a consumed code must no longer verify")

	// Consumption is idempotent — a second call (e.g. a retried completed
	// charge) is a no-op, never an error.
	require.NoError(t, ConsumePendingCode(ctx, tx, userID), "consuming an already-consumed code must be a no-op")

	// An unknown user is a no-op too.
	require.NoError(t, ConsumePendingCode(ctx, tx, "000000000000"))
}

// TestVerifyForUser_AttemptStateMapPersists exercises the shared per-user
// attempt map directly (the state the payments gate shares with the interactive
// endpoints): the map is bounded and a locked-out record is never evicted.
func TestVerifyForUser_AttemptStateMapPersists(t *testing.T) {
	t.Cleanup(func() {
		MapMu.Lock()
		Map = make(map[string]*AttemptState)
		MaxTrackedAttempts = 10_000
		MapMu.Unlock()
	})

	MapMu.Lock()
	Map = make(map[string]*AttemptState)
	MaxTrackedAttempts = 2
	MapMu.Unlock()

	// Fill the map with locked-out records; a new key must NOT evict one.
	now := clock.Now()
	for _, id := range []string{"victim_a", "victim_b"} {
		st := &AttemptState{}
		st.SetLastActive(now)
		st.Count.Store(MaxAttempts)
		Map[id] = st
	}
	_ = StateFor("new_user") // transient, untracked (map full of lockouts)
	MapMu.Lock()
	defer MapMu.Unlock()
	require.Len(t, Map, 2, "locked-out records must survive the cap pressure")
}