IAM-08: benutzerprofil-login-oberflaeche (login+2fa/passwort-reset/profil-backend-handler + web/account next.js-frontend auf shl-01)

2026-08-28 23:34:36 +02:00
parent f0139c889a
commit f627caaacb
19 changed files with 1407 additions and 0 deletions
@@ -0,0 +1,76 @@
+package auth
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"gitea.perlbach24.de/scripte/nexarch/internal/user"
+)
+
+// Akzeptanzkriterium 2: Passwortaenderung verlangt das aktuelle Passwort.
+func TestChangePassword_RequiresCurrentPassword(t *testing.T) {
+	pool := setupTenantDB(t, "changepw_test_wrong")
+	store := user.NewTenantUserStore(pool)
+	u := createUserWithPassword(t, store, "nutzer@example.com", "altes-passwort")
+
+	issuer := NewTokenIssuer("test-session-secret")
+	sessionToken, err := issuer.Issue(u.ID, "acme")
+	if err != nil {
+		t.Fatalf("session-token ausstellen: %v", err)
+	}
+
+	h := NewChangePasswordHandler(store)
+	body, _ := json.Marshal(map[string]string{"current_password": "falsches-altes-passwort", "new_password": "neues-passwort"})
+	req := httptest.NewRequest(http.MethodPost, "/account/change-password", bytes.NewReader(body))
+	req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionToken})
+	rec := httptest.NewRecorder()
+
+	RequireAuth(issuer, h.ChangePassword)(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400 (falsches aktuelles passwort)", rec.Code)
+	}
+
+	creds, err := store.GetByIDForAuth(req.Context(), u.ID)
+	if err != nil {
+		t.Fatalf("credentials laden: %v", err)
+	}
+	if !VerifyPassword(creds.PasswordHash, "altes-passwort") {
+		t.Fatal("passwort haette NICHT geaendert werden duerfen")
+	}
+}
+
+func TestChangePassword_SucceedsWithCorrectCurrentPassword(t *testing.T) {
+	pool := setupTenantDB(t, "changepw_test_ok")
+	store := user.NewTenantUserStore(pool)
+	u := createUserWithPassword(t, store, "nutzer2@example.com", "altes-passwort")
+
+	issuer := NewTokenIssuer("test-session-secret")
+	sessionToken, err := issuer.Issue(u.ID, "acme")
+	if err != nil {
+		t.Fatalf("session-token ausstellen: %v", err)
+	}
+
+	h := NewChangePasswordHandler(store)
+	body, _ := json.Marshal(map[string]string{"current_password": "altes-passwort", "new_password": "neues-sicheres-passwort"})
+	req := httptest.NewRequest(http.MethodPost, "/account/change-password", bytes.NewReader(body))
+	req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionToken})
+	rec := httptest.NewRecorder()
+
+	RequireAuth(issuer, h.ChangePassword)(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
+	}
+
+	creds, err := store.GetByIDForAuth(req.Context(), u.ID)
+	if err != nil {
+		t.Fatalf("credentials laden: %v", err)
+	}
+	if !VerifyPassword(creds.PasswordHash, "neues-sicheres-passwort") {
+		t.Fatal("neues passwort wurde nicht uebernommen")
+	}
+}