Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

2026-09-12 13:37:48 +02:00
1 parent 67dc5b5b1e
commit 7062672a87
@@ -0,0 +1,148 @@
+//go:build integration
+// +build integration
+
+package refreshtokens_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"git.sendico.io/tech/sxchnge/bff/pkg/model"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func TestRefreshTokenDB_TokenRotation(t *testing.T) {
+	db, cleanup := setupTestDB(t)
+	defer cleanup()
+
+	ctx := context.Background()
+
+	t.Run("Token_Rotation_On_Use", func(t *testing.T) {
+		userID := bson.NewObjectID()
+		clientID := "web-app"
+		deviceID := "user-browser"
+		initialToken := "initial_token_123"
+
+		// Create initial token
+		refreshToken := createTestRefreshToken(userID, clientID, deviceID, initialToken)
+		err := db.Create(ctx, refreshToken)
+		require.NoError(t, err)
+
+		// Simulate small delay
+		time.Sleep(10 * time.Millisecond)
+
+		// Use token - should update LastUsedAt
+		crt := &model.ClientRefreshToken{
+			SessionIdentifier: model.SessionIdentifier{
+				ClientID: clientID,
+				DeviceID: deviceID,
+			},
+			RefreshToken: initialToken,
+		}
+
+		retrievedToken, err := db.GetByCRT(ctx, crt)
+		require.NoError(t, err)
+		// Token lookup should preserve data and advance LastUsedAt.
+		assert.Equal(t, initialToken, retrievedToken.RefreshToken)
+
+		// Create new token with rotated value (simulating token rotation)
+		newToken := "rotated_token_456"
+		retrievedToken.RefreshToken = newToken
+		err = db.Update(ctx, retrievedToken)
+		require.NoError(t, err)
+
+		// Old token should no longer work
+		_, err = db.GetByCRT(ctx, crt)
+		assert.Error(t, err)
+
+		// New token should work
+		newCRT := &model.ClientRefreshToken{
+			SessionIdentifier: model.SessionIdentifier{
+				ClientID: clientID,
+				DeviceID: deviceID,
+			},
+			RefreshToken: newToken,
+		}
+		_, err = db.GetByCRT(ctx, newCRT)
+		require.NoError(t, err)
+	})
+
+	t.Run("Create_Defaults_LastUsedAt_When_Replacing_Active_Session", func(t *testing.T) {
+		userID := bson.NewObjectID()
+		clientID := "web-app"
+		deviceID := "replacement-browser"
+
+		initialLastUsedAt := time.Now().Add(-2 * time.Hour)
+		firstToken := createTestRefreshToken(userID, clientID, deviceID, "first_session_token")
+		firstToken.LastUsedAt = initialLastUsedAt
+		err := db.Create(ctx, firstToken)
+		require.NoError(t, err)
+		require.NotNil(t, firstToken.GetID())
+		firstTokenID := *firstToken.GetID()
+
+		time.Sleep(10 * time.Millisecond)
+
+		replacement := &model.RefreshToken{
+			ClientRefreshToken: model.ClientRefreshToken{
+				SessionIdentifier: model.SessionIdentifier{
+					ClientID: clientID,
+					DeviceID: deviceID,
+				},
+				RefreshToken: "replacement_session_token",
+			},
+			AccountRef: &userID,
+			ExpiresAt:  time.Now().Add(24 * time.Hour),
+			IsRevoked:  false,
+			UserAgent:  "TestUserAgent/2.0",
+			IPAddress:  "10.0.0.5",
+		}
+
+		err = db.Create(ctx, replacement)
+		require.NoError(t, err)
+		require.NotNil(t, replacement.GetID())
+		assert.Equal(t, firstTokenID, *replacement.GetID())
+
+		var stored model.RefreshToken
+		err = db.Get(ctx, firstTokenID, &stored)
+		require.NoError(t, err)
+		assert.False(t, stored.LastUsedAt.IsZero())
+		assert.True(t, stored.LastUsedAt.After(initialLastUsedAt))
+		assert.Equal(t, "replacement_session_token", stored.RefreshToken)
+	})
+
+	t.Run("GetByCRT_Updates_LastUsedAt", func(t *testing.T) {
+		userID := bson.NewObjectID()
+		clientID := "web-app"
+		deviceID := "refresh-browser"
+		token := "refresh_token_last_used"
+
+		initialLastUsedAt := time.Now().Add(-1 * time.Hour)
+		refreshToken := createTestRefreshToken(userID, clientID, deviceID, token)
+		refreshToken.LastUsedAt = initialLastUsedAt
+		err := db.Create(ctx, refreshToken)
+		require.NoError(t, err)
+		require.NotNil(t, refreshToken.GetID())
+
+		time.Sleep(10 * time.Millisecond)
+
+		crt := &model.ClientRefreshToken{
+			SessionIdentifier: model.SessionIdentifier{
+				ClientID: clientID,
+				DeviceID: deviceID,
+			},
+			RefreshToken: token,
+		}
+
+		retrievedToken, err := db.GetByCRT(ctx, crt)
+		require.NoError(t, err)
+		assert.True(t, retrievedToken.LastUsedAt.After(initialLastUsedAt))
+
+		var stored model.RefreshToken
+		err = db.Get(ctx, *refreshToken.GetID(), &stored)
+		require.NoError(t, err)
+		assert.True(t, stored.LastUsedAt.After(initialLastUsedAt))
+	})
+}