t5de-hub/apps/api/test/age.test.ts

// Age verification: the one rule, providers that check a person (here a fake document-check vendor with signed
// webhooks), and IMVU's answers changing.
import { afterAll, beforeAll, expect, test } from "bun:test";
import { openDatabase, schema, type Database } from "@t5de/db";
import { AgeService, type Provider } from "../src/age";
import { imvuAgeProvider } from "../src/age/imvu";
import { createApp } from "../src/app";
import { createAuth } from "../src/auth";
import { ImvuClient, type ImvuUser } from "../src/imvu";

const webURL = "http://web.test";
const accounts = new Map<number, ImvuUser>();
const fakeIMVU: typeof fetch = (async (input: RequestInfo | URL) => {
  const url = new URL(String(input));
  const u = [...accounts.values()].find(
    (u) => url.pathname === `/user/user-${u.id}` || url.searchParams.get("username")?.toLowerCase() === u.username.toLowerCase(),
  );
  return Response.json({
    denormalized: u
      ? { [`https://api.imvu.com/user/user-${u.id}`]: { data: { legacy_cid: u.id, username: u.username, tagline: u.tagline, is_ageverified: u.ageVerified, is_ap: u.accessPass } } }
      : {},
  });
}) as typeof fetch;

// A document-check vendor: sends the person to its page, then reports by a webhook signed with a shared secret.
const webhookSecret = "vendor-secret";
const fakeVendor: Provider = {
  id: "vendor",
  label: "ID document",
  scope: "person",
  start: async () => {
    const ref = `session-${crypto.randomUUID()}`;
    return { kind: "redirect", url: `https://vendor.test/check/${ref}`, ref };
  },
  webhook: async (request) => {
    if (request.headers.get("x-signature") !== webhookSecret) throw new Error("bad signature");
    const body = (await request.json()) as { session: string; approved: boolean; over18: boolean };
    return { ref: body.session, result: body.approved ? { overEighteen: body.over18, method: "id_document" } : "failed" };
  },
};

let db: Database;
let close: () => Promise<void>;
let base: string;
let age: AgeService;
let stop: () => void;

beforeAll(async () => {
  ({ db, close } = await openDatabase("memory"));
  const auth = createAuth(db, { apiURL: "http://api.test", webURL, secret: "test-secret-test-secret-test-secret-1234", rateLimit: false });
  const imvu = new ImvuClient("http://imvu.test", fakeIMVU);
  age = new AgeService(db, [imvuAgeProvider(imvu), fakeVendor]);
  const hub = createApp({ db, auth, imvu, age });
  hub.app.listen({ port: 0, hostname: "127.0.0.1" });
  const server = hub.app.server as unknown as { port: number; stop: () => void };
  stop = () => server.stop();
  base = `http://127.0.0.1:${server.port}`;
});

afterAll(async () => {
  stop();
  await close();
});

async function call(cookie: { v: string }, method: string, path: string, body?: unknown, headers: Record<string, string> = {}) {
  const res = await fetch(base + path, {
    method,
    headers: { Origin: webURL, ...(body !== undefined ? { "Content-Type": "application/json" } : {}), ...(cookie.v ? { Cookie: cookie.v } : {}), ...headers },
    body: body !== undefined ? JSON.stringify(body) : undefined,
  });
  const set = res.headers.getSetCookie();
  if (set.length) cookie.v = set.map((c) => c.split(";")[0]).join("; ");
  const text = await res.text();
  return { status: res.status, json: text ? JSON.parse(text) : undefined };
}

async function personWithAccounts(name: string, ids: { id: number; ageVerified?: boolean; accessPass?: boolean }[]) {
  const cookie = { v: "" };
  await call(cookie, "POST", "/api/auth/sign-up/email", { email: `${name}@example.test`, password: "a long password", name, username: name });
  for (const a of ids) {
    accounts.set(a.id, { id: a.id, username: `${name}${a.id}`, tagline: "", ageVerified: !!a.ageVerified, accessPass: !!a.accessPass });
    const started = await call(cookie, "POST", "/api/v1/account/links", { username: `${name}${a.id}` });
    accounts.get(a.id)!.tagline = started.json.challenge.code;
    expect((await call(cookie, "POST", `/api/v1/account/links/${a.id}/check`)).status).toBe(200);
  }
  return cookie;
}

const adultOf = async (cookie: { v: string }) =>
  Object.fromEntries(((await call(cookie, "GET", "/api/v1/account")).json.links as any[]).map((l) => [l.imvuId, l.adult]));

test("IMVU's answer is per account, and re-checked when it expires", async () => {
  const a = await personWithAccounts("ann", [{ id: 1, ageVerified: true }, { id: 2 }, { id: 3, accessPass: true }]);
  expect(await adultOf(a)).toEqual({ 1: true, 2: false, 3: true });

  // IMVU revokes account 1's verification; once its answer expires, the re-check sees it.
  accounts.get(1)!.ageVerified = false;
  await db.update(schema.ageCheck).set({ expiresAt: new Date(Date.now() - 1000) });
  expect(await age.recheckDue()).toBeGreaterThanOrEqual(3);
  expect(await adultOf(a)).toEqual({ 1: false, 2: false, 3: true });
});

test("a person's check covers all their accounts; webhooks must be signed", async () => {
  const b = await personWithAccounts("ben", [{ id: 10 }, { id: 11 }]);
  expect((await call(b, "GET", "/api/v1/age")).json.providers.map((p: any) => p.id)).toEqual(["imvu", "vendor"]);
  // IMVU checks accounts, not people: it can't be started this way.
  expect((await call(b, "POST", "/api/v1/age/imvu/start", { returnURL: `${webURL}/account` })).status).toBe(400);

  const started = (await call(b, "POST", "/api/v1/age/vendor/start", { returnURL: `${webURL}/account` })).json;
  expect(started.kind).toBe("redirect");
  expect((await call(b, "GET", "/api/v1/age")).json.checks[0]).toMatchObject({ provider: "vendor", status: "pending" });

  const hook = (signature: string, approved: boolean) =>
    call({ v: "" }, "POST", "/api/v1/age/webhook/vendor", { session: started.ref, approved, over18: true }, { "x-signature": signature });
  expect((await hook("forged", true)).status).toBe(401);
  expect(await adultOf(b)).toEqual({ 10: false, 11: false });
  expect((await hook(webhookSecret, true)).status).toBe(204);
  expect(await adultOf(b)).toEqual({ 10: true, 11: true });
  // A repeated webhook is harmless.
  expect((await hook(webhookSecret, true)).status).toBe(204);
});

test("a moved account takes nobody's age with it", async () => {
  const c = await personWithAccounts("cal", [{ id: 20, ageVerified: true }]);
  expect(await adultOf(c)).toEqual({ 20: true });
  // Dee proves the account is hers; IMVU now says it isn't verified (say, the verification was the old owner's).
  accounts.get(20)!.ageVerified = false;
  const d = { v: "" };
  await call(d, "POST", "/api/auth/sign-up/email", { email: "[email protected]", password: "a long password", name: "dee", username: "dee" });
  const started = await call(d, "POST", "/api/v1/account/links", { username: "cal20" });
  accounts.get(20)!.tagline = started.json.challenge.code;
  expect((await call(d, "POST", "/api/v1/account/links/20/check")).json.moved).toBe(true);
  expect(await adultOf(d)).toEqual({ 20: false });
  const leftovers = await db.select().from(schema.ageCheck);
  expect(leftovers.filter((c) => c.imvuId === 20)).toHaveLength(1);
});