Release v2.20.1: migrate authentication to Better Auth

test/web-middleware.test.js

@@ -4,6 +4,45 @@ const path = require('path');
 
 const registerMiddleware = require('../src/web/middleware');
 
+test('role-required two-factor enrollment gates pages and APIs while allowing setup and logout', () => {
+  const app = { middlewares: [], use(...args) { this.middlewares.push(args); } };
+  registerMiddleware(app, {
+    pool: {},
+    loadCurrentUser: async () => null,
+    requireAuth(_req, _res, next) { next(); },
+    MEDIA_DIR: path.join(process.cwd(), 'media'),
+    UPLOADS_DIR: path.join(process.cwd(), 'media', 'uploads-test'),
+    THUMBNAILS_DIR: path.join(process.cwd(), 'media', 'thumbnails-test'),
+    ASSET_DIR: path.join(process.cwd(), 'src', 'web', 'public')
+  });
+  const gate = app.middlewares[app.middlewares.length - 1][0];
+  const actor = { id: 7, requiresTwoFactor: true, twoFactorEnabled: false };
+  for (const requestPath of ['/dashboard', '/slides/12', '/account/profile', '/api/clients']) {
+    let passed = false;
+    const res = {
+      redirect(url) { this.redirectedTo = url; },
+      status(code) { this.statusCode = code; return this; },
+      json(body) { this.body = body; }
+    };
+    gate({ method: 'GET', path: requestPath, currentUser: actor, authenticatedUser: actor }, res, () => { passed = true; });
+    assert.equal(passed, false);
+    if (requestPath.startsWith('/api/')) {
+      assert.equal(res.statusCode, 403);
+      assert.equal(res.body.code, 'TWO_FACTOR_ENROLLMENT_REQUIRED');
+    } else assert.equal(res.redirectedTo, '/account');
+  }
+  for (const requestPath of ['/account', '/logout', '/account/password']) {
+    let passed = false;
+    gate({ method: 'GET', path: requestPath, currentUser: actor, authenticatedUser: actor }, {}, () => { passed = true; });
+    assert.equal(passed, true);
+  }
+  for (const actorUser of [{ ...actor, twoFactorEnabled: true }, { ...actor, requiresTwoFactor: false }]) {
+    let passed = false;
+    gate({ method: 'GET', path: '/dashboard', currentUser: { id: 19, requiresTwoFactor: true, twoFactorEnabled: false }, authenticatedUser: actorUser }, {}, () => { passed = true; });
+    assert.equal(passed, true);
+  }
+});
+
 test('web middleware bypasses auth for internal player sync routes', () => {
   const calls = [];
   const app = {