Portal-Login: E-Mail-Code für Mitarbeiter mit 2FA

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/staffLogin.test.js

@@ -0,0 +1,103 @@
+import { test, after } from 'node:test'
+import assert from 'node:assert/strict'
+import { startAppwriteMock } from './support/appwriteMock.js'
+import { startFakeStripe } from './support/fakeStripe.js'
+import { useTestEnv } from './support/testEnv.js'
+
+// Portal-Login mit E-Mail-Code fuer Mitarbeiter mit Appwrite-2FA; Kunden und Mitarbeiter ohne 2FA wie bisher
+const aw = await startAppwriteMock()
+const st = await startFakeStripe()
+useTestEnv({ appwriteUrl: aw.url, stripeUrl: st.url })
+const { config } = await import('../server/config.js')
+const { startTestApp, post, rawGet } = await import('./support/testApp.js')
+const { default: authRoutes } = await import('../server/routes/auth.js')
+const app = await startTestApp({ '/api/auth': authRoutes })
+after(() => Promise.all([app.close(), aw.close(), st.close()]))
+
+aw.addUser({ $id: 'u_kunde', email: 'kunde@example.invalid', password: 'kunde-kunde' })
+aw.addUser({ $id: 'u_ohne', email: 'justin@webklar.com', password: 'ohne-ohne-ohne' })
+aw.addUser({ $id: 'u_mfa', email: 'kenso@webklar.com', password: 'mit-mit-mit', mfa: true, emailVerification: true, labels: ['admin'] })
+aw.seed('customers', { $id: 'c1', appwriteUserId: 'u_kunde', email: 'kunde@example.invalid', name: 'Kunde', customerStatus: 'active', portalAccessEnabled: true })
+aw.seed('customerPortalAccess', { $id: 'pa1', customerId: 'c1', enabled: true })
+aw.seed('employees', { $id: 'e1', userId: 'u_ohne', displayName: 'Justin', email: 'justin@webklar.com' })
+aw.seed('employees', { $id: 'e2', userId: 'u_mfa', displayName: 'Kenso', email: 'kenso@webklar.com' })
+
+const SESSION = config.cookieName
+const setCookies = (res) => res.headers.getSetCookie()
+const cookieNamed = (res, name) => setCookies(res).find((c) => c.startsWith(`${name}=`)) || null
+const jar = (res) => setCookies(res).map((c) => c.split(';')[0]).join('; ')
+const login = (email, password) => post('/api/auth/login', { email, password })
+
+test('Kunde ohne 2FA: Anmeldung wie bisher', async () => {
+  const res = await login('kunde@example.invalid', 'kunde-kunde')
+  assert.equal(res.status, 200)
+  assert.equal(res.body.mfaRequired, undefined)
+  assert.ok(cookieNamed(res, SESSION))
+})
+
+test('Mitarbeiter ohne 2FA: Admin-Anmeldung wie bisher', async () => {
+  const res = await login('justin@webklar.com', 'ohne-ohne-ohne')
+  assert.equal(res.status, 200)
+  assert.equal(res.body.role, 'admin')
+  assert.ok(cookieNamed(res, SESSION))
+})
+
+test('Mitarbeiter mit 2FA: vor dem Code keine Portal-Sitzung', async () => {
+  const res = await login('kenso@webklar.com', 'mit-mit-mit')
+  assert.equal(res.status, 200)
+  assert.deepEqual(res.body, { mfaRequired: true, email: 'k…@webklar.com' })
+  assert.ok(cookieNamed(res, 'webklar_portal_mfa'))
+  assert.equal(cookieNamed(res, SESSION), null)
+  assert.equal(setCookies(res).length, 1)
+  const me = await rawGet('/api/auth/me', { cookie: jar(res) })
+  assert.equal(me.body.authenticated, false)
+})
+
+test('Richtiger Code: Admin-Sitzung, Code-Cookie geloescht', async () => {
+  const first = await login('kenso@webklar.com', 'mit-mit-mit')
+  const res = await post('/api/auth/login/mfa', { otp: aw.lastOtp('u_mfa') }, { cookie: jar(first) })
+  assert.equal(res.status, 200)
+  assert.equal(res.body.role, 'admin')
+  assert.equal(res.body.admin.isAdmin, true)
+  assert.ok(cookieNamed(res, SESSION))
+  assert.match(cookieNamed(res, 'webklar_portal_mfa'), /Expires=Thu, 01 Jan 1970/)
+  const me = await rawGet('/api/auth/me', { cookie: jar(res) })
+  assert.equal(me.body.role, 'admin')
+})
+
+test('Falscher Code: Hinweis, nach 5 Fehlversuchen neu anmelden', async () => {
+  const first = await login('kenso@webklar.com', 'mit-mit-mit')
+  for (let i = 0; i < 5; i++) {
+    const res = await post('/api/auth/login/mfa', { otp: '000000' }, { cookie: jar(first) })
+    assert.equal(res.status, 401)
+    assert.equal(res.body.error, 'Code falsch oder abgelaufen.')
+    assert.equal(cookieNamed(res, SESSION), null)
+  }
+  const res = await post('/api/auth/login/mfa', { otp: aw.lastOtp('u_mfa') }, { cookie: jar(first) })
+  assert.equal(res.status, 410)
+  assert.equal(res.body.error, 'Bitte melde dich erneut an.')
+})
+
+test('Ohne Code-Cookie: neu anmelden', async () => {
+  const res = await post('/api/auth/login/mfa', { otp: '123456' })
+  assert.equal(res.status, 410)
+  const resend = await post('/api/auth/login/mfa/resend', {})
+  assert.equal(resend.status, 410)
+})
+
+test('Code erneut senden: zweite Mail', async () => {
+  const first = await login('kenso@webklar.com', 'mit-mit-mit')
+  const before = aw.mailsSent('u_mfa')
+  const res = await post('/api/auth/login/mfa/resend', {}, { cookie: jar(first) })
+  assert.equal(res.status, 200)
+  assert.equal(aw.mailsSent('u_mfa'), before + 1)
+})
+
+test('2FA an, E-Mail nicht bestaetigt: Hinweis statt Sitzung', async () => {
+  aw.addUser({ $id: 'u_unbest', email: 'andrej@webklar.com', password: 'unbest-unbest', mfa: true, emailVerification: false })
+  aw.seed('employees', { $id: 'e3', userId: 'u_unbest', displayName: 'Andrej', email: 'andrej@webklar.com' })
+  const res = await login('andrej@webklar.com', 'unbest-unbest')
+  assert.equal(res.status, 403)
+  assert.equal(res.body.error, '2FA ist für dein Konto noch nicht eingerichtet – bitte Kenso Bescheid geben.')
+  assert.equal(cookieNamed(res, SESSION), null)
+})