Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

2026-09-12 13:37:48 +02:00
1 parent 67dc5b5b1e
commit 7062672a87
@@ -0,0 +1,148 @@
+package verification
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"git.sendico.io/tech/sxchnge/bff/pkg/model"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func TestConsume_MaxRetriesExceeded(t *testing.T) {
+	db := newTestVerificationDB(t)
+	ctx := context.Background()
+	accountRef := bson.NewObjectID()
+
+	r := req(accountRef, model.PurposePasswordReset, "", time.Hour).WithMaxRetries(2)
+	raw, err := db.Create(ctx, r)
+	require.NoError(t, err)
+
+	repo := db.Repository.(*memoryTokenRepository)
+	repo.mu.Lock()
+	for _, tok := range repo.data {
+		tok.Attempts = 2
+	}
+	repo.mu.Unlock()
+
+	_, err = db.Consume(ctx, accountRef, model.PurposePasswordReset, "", raw)
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, ErrTokenAttemptsExceeded))
+}
+
+func TestConsume_UnderMaxRetriesSucceeds(t *testing.T) {
+	db := newTestVerificationDB(t)
+	ctx := context.Background()
+	accountRef := bson.NewObjectID()
+
+	r := req(accountRef, model.PurposePasswordReset, "", time.Hour).WithMaxRetries(3)
+	raw, err := db.Create(ctx, r)
+	require.NoError(t, err)
+
+	repo := db.Repository.(*memoryTokenRepository)
+	repo.mu.Lock()
+	for _, tok := range repo.data {
+		tok.Attempts = 2
+	}
+	repo.mu.Unlock()
+
+	tok, err := db.Consume(ctx, accountRef, model.PurposePasswordReset, "", raw)
+	require.NoError(t, err)
+	assert.Equal(t, accountRef, tok.AccountRef)
+}
+
+func TestConsume_NoMaxRetriesIgnoresAttempts(t *testing.T) {
+	db := newTestVerificationDB(t)
+	ctx := context.Background()
+	accountRef := bson.NewObjectID()
+
+	raw, err := db.Create(ctx, req(accountRef, model.PurposePasswordReset, "", time.Hour))
+	require.NoError(t, err)
+
+	repo := db.Repository.(*memoryTokenRepository)
+	repo.mu.Lock()
+	for _, tok := range repo.data {
+		tok.Attempts = 100
+	}
+	repo.mu.Unlock()
+
+	tok, err := db.Consume(ctx, accountRef, model.PurposePasswordReset, "", raw)
+	require.NoError(t, err)
+	assert.Equal(t, accountRef, tok.AccountRef)
+}
+
+func TestConsume_WrongHashReturnsNotFound(t *testing.T) {
+	db := newTestVerificationDB(t)
+	ctx := context.Background()
+	accountRef := bson.NewObjectID()
+
+	_, err := db.Create(ctx, req(accountRef, model.PurposePasswordReset, "", time.Hour))
+	require.NoError(t, err)
+
+	_, err = db.Consume(ctx, accountRef, model.PurposePasswordReset, "", "wrong-code")
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, ErrTokenNotFound))
+}
+
+func TestConsume_WrongOTPAttemptsPersistAfterTransactionRollback(t *testing.T) {
+	db := newRollbackTestVerificationDB(t)
+	ctx := context.Background()
+	accountRef := bson.NewObjectID()
+
+	raw, err := db.Create(
+		ctx,
+		NewOTPRequest(accountRef, model.PurposeEmailChange, "new@example.com").
+			WithTTL(time.Hour).
+			WithMaxRetries(2),
+	)
+	require.NoError(t, err)
+
+	wrongCode := differentOTP(raw)
+	for attempt := 1; attempt <= 2; attempt++ {
+		_, err = db.Consume(ctx, accountRef, model.PurposeEmailChange, "", wrongCode)
+		require.Error(t, err)
+		assert.True(t, errors.Is(err, ErrTokenNotFound))
+		assert.Equal(t, attempt, storedTokenAttempts(t, db))
+	}
+
+	_, err = db.Consume(ctx, accountRef, model.PurposeEmailChange, "", raw)
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, ErrTokenAttemptsExceeded))
+}
+
+func TestConsume_ContextMismatchReturnsNotFound(t *testing.T) {
+	db := newTestVerificationDB(t)
+	ctx := context.Background()
+	accountRef := bson.NewObjectID()
+	otherAccount := bson.NewObjectID()
+
+	raw, err := db.Create(ctx, req(accountRef, model.PurposePasswordReset, "", time.Hour))
+	require.NoError(t, err)
+
+	_, err = db.Consume(ctx, otherAccount, model.PurposePasswordReset, "", raw)
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, ErrTokenNotFound))
+}
+
+func differentOTP(raw string) string {
+	if raw == "000000" {
+		return "111111"
+	}
+	return "000000"
+}
+
+func storedTokenAttempts(t *testing.T, db *verificationDB) int {
+	t.Helper()
+	repo := db.Repository.(*memoryTokenRepository)
+	repo.mu.Lock()
+	defer repo.mu.Unlock()
+
+	require.Len(t, repo.data, 1)
+	for _, tok := range repo.data {
+		return tok.Attempts
+	}
+	return 0
+}