Portal-Login: Appwrite-Sitzung merken, MFA-Aufrufe im Namen der Sitzung

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/staffMfa.test.js

@@ -0,0 +1,36 @@
+import { test, after } from 'node:test'
+import assert from 'node:assert/strict'
+import { startAppwriteMock } from './support/appwriteMock.js'
+import { startFakeStripe } from './support/fakeStripe.js'
+import { useTestEnv } from './support/testEnv.js'
+
+// Mitarbeiter-2FA per E-Mail-Code: Appwrite-Sitzung aus dem Login und offene Code-Anmeldungen
+const aw = await startAppwriteMock()
+const st = await startFakeStripe()
+useTestEnv({ appwriteUrl: aw.url, stripeUrl: st.url })
+const { loginWithAppwrite, appwriteSessionFetch } = await import('../server/services/appwriteClient.js')
+after(() => Promise.all([aw.close(), st.close()]))
+
+aw.addUser({ $id: 'u_staff', email: 'kenso@webklar.com', password: 'geheim-geheim', mfa: true, emailVerification: true })
+
+test('loginWithAppwrite liefert die Appwrite-Sitzung', async () => {
+  const user = await loginWithAppwrite('kenso@webklar.com', 'geheim-geheim')
+  assert.equal(user.$id, 'u_staff')
+  assert.equal(user.sessionCookie, 'sess-u_staff')
+})
+
+test('appwriteSessionFetch schickt Sitzung und Sprache', async () => {
+  const before = aw.mailsSent('u_staff')
+  const challenge = await appwriteSessionFetch('/account/mfa/challenges', {
+    method: 'POST',
+    body: { factor: 'email' },
+    sessionCookie: 'sess-u_staff',
+  })
+  assert.match(challenge.$id, /^ch/)
+  assert.equal(aw.mailsSent('u_staff'), before + 1)
+  assert.equal(aw.lastLocale(), 'de')
+  await assert.rejects(
+    appwriteSessionFetch('/account/mfa/challenges', { method: 'PUT', body: { challengeId: challenge.$id, otp: '000000' }, sessionCookie: 'sess-u_staff' }),
+    (err) => err.status === 401 && err.type === 'user_invalid_token'
+  )
+})