feat: 30% test coverage

Author: Bccorb

src/controllers/jwks.ts

@@ -20,6 +20,10 @@ let jwkCache: JwkCache | null = null;
 
 const CACHE_TTL = 1000 * 60 * 5;
 
+export function __resetJwksCache() {
+  jwkCache = null;
+}
+
 async function loadJwksFromSecrets(): Promise<JWK[]> {
   logger.info('Loading JWKS from Secrets Manager');
 

src/routes/users.routes.ts

@@ -32,7 +32,7 @@ usersRouter.post(
     tags: ['Users'],
     summary: 'Update credential metadata',
 
-    middleware: [attachAuthMiddleware],
+    middleware: [attachAuthMiddleware('access')],
 
     schemas: {
       body: UpdateCredentialRequestSchema,
@@ -48,7 +48,7 @@ usersRouter.delete(
     tags: ['Users'],
     summary: 'Delete authenticated user',
 
-    middleware: [attachAuthMiddleware],
+    middleware: [attachAuthMiddleware('access')],
 
     schemas: {
       response: MessageSchema,
@@ -64,7 +64,7 @@ usersRouter.delete(
     tags: ['Users'],
     summary: 'Delete credential',
 
-    middleware: [attachAuthMiddleware],
+    middleware: [attachAuthMiddleware('access')],
 
     schemas: {
       body: DeleteCredentialRequestSchema,

tests/e2e/authFlow.spec.ts

@@ -0,0 +1,132 @@
+import request from 'supertest';
+import { describe, it, expect, beforeAll, beforeEach, vi } from 'vitest';
+import { createApp } from '../../src/app';
+import { Application } from 'express';
+
+vi.mock('../../src/config/getSystemConfig.js', () => ({
+  getSystemConfig: vi.fn(),
+}));
+
+vi.mock('bcrypt-ts', () => ({
+  compareSync: vi.fn(),
+}));
+
+vi.mock('../../../src/services/authEventService.js', () => ({
+  AuthEventService: {
+    log: vi.fn(),
+    notificationSent: vi.fn(),
+  },
+}));
+
+import { User } from '../../src/models/users.js';
+import { Session } from '../../src/models/sessions.js';
+
+import {
+  signEphemeralToken,
+  signAccessToken,
+  generateRefreshToken,
+  hashRefreshToken,
+} from '../../src/lib/token.js';
+
+import { generatePhoneOTP, verifyPhoneOTP } from '../../src/utils/otp.js';
+
+import { validateAccessToken } from '../../src/services/sessionService.js';
+
+import { getSystemConfig } from '../../src/config/getSystemConfig.js';
+
+import { compareSync } from 'bcrypt-ts';
+import { buildRegistrationRequest } from '../factories/requestFactory.js';
+import { buildUser } from '../factories/userFactory.js';
+import { buildSession } from '../factories/sessionFactory.js';
+
+let app: Application;
+
+beforeAll(async () => {
+  app = await createApp();
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+
+  (getSystemConfig as any).mockResolvedValue({
+    default_roles: ['user'],
+  });
+
+  (signEphemeralToken as any).mockResolvedValue('ephemeral-token');
+  (signAccessToken as any).mockResolvedValue('access-token');
+  (generateRefreshToken as any).mockReturnValue('refresh-token');
+  (hashRefreshToken as any).mockResolvedValue('hashed-refresh');
+  (Session.create as any).mockResolvedValue({ id: 'session-1' });
+
+  (compareSync as any).mockReturnValue(true);
+});
+
+describe('E2E Auth Flow', () => {
+  it('completes full auth lifecycle', async () => {
+    (User.findOne as any).mockResolvedValue(null);
+
+    (User.create as any).mockResolvedValue(buildUser());
+
+    const registerRes = await request(app)
+      .post('/registration/register')
+      .send(buildRegistrationRequest());
+
+    expect(registerRes.status).toBe(200);
+
+    const otpRes = await request(app)
+      .get('/otp/generate-phone-otp')
+      .set('Cookie', [`seamless_ephemeral=ephemeral-token`]);
+
+    expect(otpRes.status).toBe(200);
+    expect(generatePhoneOTP).toHaveBeenCalled();
+
+    (verifyPhoneOTP as any).mockResolvedValue({
+      user: {
+        id: 'user-1',
+        emailVerified: true,
+        phoneVerified: true,
+        verified: true,
+        roles: ['user'],
+      },
+      verified: true,
+    });
+
+    (Session.create as any).mockResolvedValue({
+      id: 'session-1',
+    });
+
+    const verifyRes = await request(app)
+      .post('/otp/verify-phone-otp')
+      .set('Cookie', [`seamless_ephemeral=ephemeral-token`])
+      .send({ verificationToken: '123456' });
+
+    expect(verifyRes.status).toBe(200);
+
+    (validateAccessToken as any).mockResolvedValue({
+      sessionId: 'session-1',
+    });
+
+    (Session.findAll as any).mockResolvedValue([buildSession()]);
+    const accessRes = await request(app)
+      .get('/sessions')
+      .set('Cookie', [`seamless_access=access-token`]);
+
+    expect(accessRes.status).toBe(200);
+
+    (validateAccessToken as any).mockResolvedValue(null);
+
+    (User.findByPk as any).mockResolvedValue({
+      id: 'user-1',
+    });
+
+    (Session.create as any).mockResolvedValue({
+      id: 'session-2',
+    });
+
+    const refreshRes = await request(app)
+      .get('/sessions')
+      .set('Cookie', [`seamless_refresh=refresh-token`]);
+
+    expect(refreshRes.status).toBe(200);
+  });
+});

tests/factories/sessionFactory.ts

@@ -0,0 +1,12 @@
+export function buildSession(overrides: any = {}) {
+  return {
+    id: 'session-1',
+    deviceName: 'MacBook',
+    ipAddress: '127.0.0.1',
+    userAgent: 'agent',
+    lastUsedAt: new Date(),
+    expiresAt: new Date(Date.now() + 100000),
+    revokedAt: null,
+    ...overrides,
+  };
+}