engine_issue_session_test.go

package authsome_test

import (
	"context"
	"errors"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"

	authsome "github.com/xraph/authsome"
	"github.com/xraph/authsome/account"
	"github.com/xraph/authsome/appclientconfig"
	"github.com/xraph/authsome/bridge"
	"github.com/xraph/authsome/id"
	"github.com/xraph/authsome/internal/secutil"
	"github.com/xraph/authsome/plugins/mfa"
	"github.com/xraph/authsome/user"
)

// issueSessionFixture spins up a test engine with the MFA plugin
// registered (using the in-memory MFA store) and returns the engine
// plus a freshly-created user. Tests can additionally call
// requireMFAOnApp(t, eng, appID) to flip the per-app MFARequired
// flag.
func issueSessionFixture(t *testing.T) (*authsome.Engine, *user.User, id.AppID) {
	t.Helper()

	mfaPlugin := mfa.New()
	mfaPlugin.SetStore(mfa.NewMemoryStore())

	eng := secutil.NewTestEngine(t, authsome.WithPlugin(mfaPlugin))
	secutil.RelaxAuthDefaults(t, eng)

	appID, err := id.ParseAppID("aapp_01jf0000000000000000000000")
	require.NoError(t, err)

	u, _, err := eng.SignUp(context.Background(), &account.SignUpRequest{
		AppID:     appID,
		Email:     "issuesession@example.com",
		Password:  "SecureP@ss123",
		FirstName: "Issue",
	})
	require.NoError(t, err)

	return eng, u, appID
}

func requireMFAOnApp(t *testing.T, eng *authsome.Engine, appID id.AppID) {
	t.Helper()
	tru := true
	require.NoError(t, eng.Store().SetAppClientConfig(context.Background(), &appclientconfig.Config{
		ID:          id.NewAppClientConfigID(),
		AppID:       appID,
		MFARequired: &tru,
	}))
}

// TestIssueSession_NoMFARequired_IssuesSession pins the happy path:
// when MFARequired is not set on the app config the gate is dormant
// and IssueSession returns a real session.
func TestIssueSession_NoMFARequired_IssuesSession(t *testing.T) {
	t.Parallel()
	eng, u, appID := issueSessionFixture(t)

	res, err := eng.IssueSession(context.Background(), &authsome.IssueSessionRequest{
		User:       u,
		AppID:      appID,
		AuthMethod: "password",
		IPAddress:  "127.0.0.1",
		UserAgent:  "go-test/1.0",
	})
	require.NoError(t, err)
	require.NotNil(t, res)
	require.NotNil(t, res.Session)
	assert.Equal(t, u.ID, res.Session.UserID)
	assert.NotEmpty(t, res.Session.Token, "session token must be issued")
}

// TestIssueSession_MFARequired_GateFiresEvenWhenUserVerified pins
// the modern MFA semantics: when MFARequired is true on the app
// config, EVERY login (without MFAJustVerified) must surface a
// challenge ticket — even for users who already have a verified
// enrollment. Anything weaker would let an attacker who has stolen
// the password skip the second factor on the basis that the legit
// owner enrolled MFA at some point in the past.
//
// The earlier semantics (skip the gate when user already has
// verified MFA) was what the inline check in service.go did before
// the centralization; replacing it with this stronger contract is
// the whole point of the consolidation.
func TestIssueSession_MFARequired_GateFiresEvenWhenUserVerified(t *testing.T) {
	t.Parallel()
	eng, u, appID := issueSessionFixture(t)
	requireMFAOnApp(t, eng, appID)

	// Plant a verified MFA enrollment via the plugin's store directly.
	plg, ok := eng.Plugins().Plugin("mfa").(*mfa.Plugin)
	require.True(t, ok, "mfa plugin must be registered")
	store := mfa.NewMemoryStore()
	plg.SetStore(store)
	require.NoError(t, store.CreateEnrollment(context.Background(), &mfa.Enrollment{
		ID:       id.NewMFAID(),
		UserID:   u.ID,
		Method:   "totp",
		Secret:   "JBSWY3DPEHPK3PXP",
		Verified: true,
	}))

	res, err := eng.IssueSession(context.Background(), &authsome.IssueSessionRequest{
		User:       u,
		AppID:      appID,
		AuthMethod: "password",
	})
	require.Error(t, err, "MFARequired=true must always surface a ticket; previous owner-of-enrolled-MFA shortcut is gone")
	require.Nil(t, res)

	var mfaErr *authsome.MFARequiredError
	require.True(t, errors.As(err, &mfaErr), "error must be *MFARequiredError, got %T", err)
	assert.NotEmpty(t, mfaErr.Ticket)
}

// TestIssueSession_MFARequiredAndUserUnenrolled_ReturnsTicket pins
// the gate firing path: the user lacks MFA, MFARequired is true, so
// the function returns *MFARequiredError carrying a non-empty ticket.
func TestIssueSession_MFARequiredAndUserUnenrolled_ReturnsTicket(t *testing.T) {
	t.Parallel()
	eng, u, appID := issueSessionFixture(t)
	requireMFAOnApp(t, eng, appID)

	res, err := eng.IssueSession(context.Background(), &authsome.IssueSessionRequest{
		User:       u,
		AppID:      appID,
		AuthMethod: "password",
	})
	require.Error(t, err)
	require.Nil(t, res)

	var mfaErr *authsome.MFARequiredError
	require.True(t, errors.As(err, &mfaErr), "error must be *MFARequiredError, got %T", err)
	assert.NotEmpty(t, mfaErr.Ticket, "ticket must be non-empty so client can complete the round-trip")
	assert.True(t, errors.Is(err, account.ErrMFARequired), "must wrap account.ErrMFARequired so existing callers keep working")
}

// TestIssueSession_TicketPersistedToCeremony pins that the ticket
// returned from the gate is loadable via Engine.LoadMFATicket.
func TestIssueSession_TicketPersistedToCeremony(t *testing.T) {
	t.Parallel()
	eng, u, appID := issueSessionFixture(t)
	requireMFAOnApp(t, eng, appID)

	_, err := eng.IssueSession(context.Background(), &authsome.IssueSessionRequest{
		User:       u,
		AppID:      appID,
		AuthMethod: "password",
		IPAddress:  "10.0.0.5",
		UserAgent:  "go-test/2.0",
	})
	var mfaErr *authsome.MFARequiredError
	require.True(t, errors.As(err, &mfaErr))

	loaded, err := eng.LoadMFATicket(context.Background(), mfaErr.Ticket)
	require.NoError(t, err)
	assert.Equal(t, u.ID, loaded.UserID)
	assert.Equal(t, "password", loaded.AuthMethod)
	assert.Equal(t, "10.0.0.5", loaded.IPAddress)
	assert.Equal(t, "go-test/2.0", loaded.UserAgent)
}

// TestIssueSession_MfaJustVerifiedBypassesGate pins that the
// post-MFA-verify path bypasses the gate; the challenge handler will
// pass MFAJustVerified=true after validating a code against a ticket.
func TestIssueSession_MfaJustVerifiedBypassesGate(t *testing.T) {
	t.Parallel()
	eng, u, appID := issueSessionFixture(t)
	requireMFAOnApp(t, eng, appID)

	res, err := eng.IssueSession(context.Background(), &authsome.IssueSessionRequest{
		User:            u,
		AppID:           appID,
		AuthMethod:      "password+mfa",
		MFAJustVerified: true,
	})
	require.NoError(t, err, "MFAJustVerified must bypass the gate")
	require.NotNil(t, res.Session)
}

// TestIssueSession_AuditMetadataIncludesAuthMethod pins that the
// audit log captures the auth_method dimension so operators can
// distinguish password vs social vs magiclink etc.
func TestIssueSession_AuditMetadataIncludesAuthMethod(t *testing.T) {
	t.Parallel()
	eng, u, appID := issueSessionFixture(t)

	ch := secutil.NewBufferedChronicle()
	secutil.AttachChronicle(t, eng, ch)

	_, err := eng.IssueSession(context.Background(), &authsome.IssueSessionRequest{
		User:       u,
		AppID:      appID,
		AuthMethod: "social:google",
	})
	require.NoError(t, err)

	// IssueSession is the one place a sign-in is recorded, under the
	// public action name, so every auth method shares one event shape.
	secutil.AssertAuditEvent(t, ch, "auth.signin", func(ev *bridge.AuditEvent) {
		require.NotNil(t, ev)
		assert.Equal(t, "social:google", ev.Metadata["auth_method"])
	})
}

// TestIssueSession_GateFiresForEveryAuthMethod pins the
// per-plugin contract: every AuthMethod string the four bypass
// plugins use (social/magiclink/sso/phone) — plus password — must
// surface the same MFARequiredError when MFARequired=true. The
// previous behavior (each plugin minted directly via store.CreateSession,
// skipping the gate) was the bug the consolidation closed; this
// table-driven test prevents anyone from re-introducing a bypass
// by adding a sixth plugin that forgets the type-assertion.
//
// We don't spin up each plugin's full scaffolding (OAuth handshake,
// SAML assertion, SMS challenge) — that's the e2e api_test layer's
// job and the round-trip is already covered there for the password
// path. What this test pins is "IssueSession is the chokepoint and
// it doesn't care which AuthMethod the caller stamped" so the
// guarantee is uniform.
func TestIssueSession_GateFiresForEveryAuthMethod(t *testing.T) {
	t.Parallel()

	// Mirrors the strings each refactored plugin passes:
	//   plugins/social/plugin.go:947     AuthMethod: "social:" + req.Provider
	//   plugins/magiclink/plugin.go:296  AuthMethod: "magiclink"
	//   plugins/sso/plugin.go:487        AuthMethod: "sso:" + connection.Name
	//   plugins/phone/plugin.go:340      AuthMethod: "phone"
	//   service.go:339 (SignIn)          AuthMethod: "password"
	//   plugins/mfa/plugin.go            AuthMethod: <prev>+"+mfa" (MFAJustVerified=true)
	cases := []string{
		"password",
		"social:google",
		"social:github",
		"magiclink",
		"sso:saml-okta",
		"sso:oidc-azure",
		"phone",
	}

	for _, method := range cases {
		t.Run(method, func(t *testing.T) {
			t.Parallel()
			eng, u, appID := issueSessionFixture(t)
			requireMFAOnApp(t, eng, appID)

			res, err := eng.IssueSession(context.Background(), &authsome.IssueSessionRequest{
				User:       u,
				AppID:      appID,
				AuthMethod: method,
			})
			require.Error(t, err, "MFARequired=true with AuthMethod=%q must surface a ticket; the gate must NOT inspect AuthMethod when deciding whether to fire", method)
			require.Nil(t, res)

			var mfaErr *authsome.MFARequiredError
			require.True(t, errors.As(err, &mfaErr),
				"AuthMethod=%q: error must be *MFARequiredError, got %T", method, err)
			assert.NotEmpty(t, mfaErr.Ticket,
				"AuthMethod=%q: ticket must be non-empty so any plugin's HTTP layer can render the 403 envelope", method)
		})
	}
}

// TestIssueSession_MFARequiredErrorRendersAs403 pins the forge-
// HTTP-error-interface contract: the error returned by IssueSession
// is itself rendered by forge as a 403 with the ticket envelope —
// no plugin needs to know about mapError or import the api package.
// This is what makes the per-plugin handlers "just return the
// error" pattern work end-to-end.
func TestIssueSession_MFARequiredErrorRendersAs403(t *testing.T) {
	t.Parallel()

	type httpErr interface {
		StatusCode() int
		ResponseBody() any
	}

	mfaErr := &authsome.MFARequiredError{
		Ticket:           "test-ticket-abc",
		AvailableMethods: []string{"totp"},
	}

	var he httpErr
	require.True(t, errors.As(mfaErr, &he),
		"*MFARequiredError must satisfy forge's StatusCode+ResponseBody interface so plugin handlers can just return it raw")

	assert.Equal(t, 403, he.StatusCode())

	body, ok := he.ResponseBody().(map[string]any)
	require.True(t, ok, "ResponseBody must be a JSON-shaped map; got %T", he.ResponseBody())
	assert.Equal(t, "mfa_required", body["type"])
	assert.Equal(t, "test-ticket-abc", body["mfa_ticket"])
	assert.Equal(t, []string{"totp"}, body["available_methods"])
}