spb/autoscholar

1import { describe, expect, it } from "vitest";2import {3  checkPasswordPolicy,4  csrfTokenFor,5  hashPassword,6  lockoutDurationMs,7  newSessionToken,8  RateLimiter,9  verifyCsrf,10  verifyPassword,11} from "./index.js";1213describe("auth primitives", () => {14  it("hashes with argon2id and verifies", async () => {15    const h = await hashPassword("admin123");16    expect(h.startsWith("$argon2id$")).toBe(true);17    expect(await verifyPassword(h, "admin123")).toBe(true);18    expect(await verifyPassword(h, "admin124")).toBe(false);19    expect(await verifyPassword("garbage", "admin123")).toBe(false);20  });2122  it("rejects weak passwords incl. the bootstrap one", () => {23    expect(checkPasswordPolicy("admin123").ok).toBe(false);24    expect(checkPasswordPolicy("Admin123456!x", "admin").ok).toBe(false);25    expect(checkPasswordPolicy("Correct-Horse-9-Battery").ok).toBe(true);26  });2728  it("csrf tokens bind to the session", () => {29    const { tokenHash } = newSessionToken();30    const t = csrfTokenFor("secret", tokenHash);31    expect(verifyCsrf("secret", tokenHash, t)).toBe(true);32    expect(verifyCsrf("secret", tokenHash, `${t}x`)).toBe(false);33    expect(verifyCsrf("other", tokenHash, t)).toBe(false);34  });3536  it("rate limiter and lockout", () => {37    const rl = new RateLimiter(2, 1000);38    expect(rl.check("a").allowed).toBe(true);39    expect(rl.check("a").allowed).toBe(true);40    expect(rl.check("a").allowed).toBe(false);41    expect(lockoutDurationMs(4)).toBe(0);42    expect(lockoutDurationMs(5)).toBe(60_000);43    expect(lockoutDurationMs(20)).toBe(3_600_000);44  });45});46