pangolin/server/internal/auth/device_register_test.go

package auth

import (
	"context"
	"testing"
)

// fakeRegistrar records RegisterDevice calls for assertion.
type fakeRegistrar struct {
	calls []struct {
		userID int64
		meta   DeviceMeta
	}
	deviceID int64
	err      error
	limit    *DeviceLimit // returned by CheckDeviceLimit (nil = within cap)
	limitErr error
}

func (f *fakeRegistrar) RegisterDevice(_ context.Context, userID int64, meta DeviceMeta) (int64, error) {
	f.calls = append(f.calls, struct {
		userID int64
		meta   DeviceMeta
	}{userID, meta})
	return f.deviceID, f.err
}

func (f *fakeRegistrar) CheckDeviceLimit(_ context.Context, _ int64) (*DeviceLimit, error) {
	return f.limit, f.limitErr
}

// Register/Login with a device should trigger RegisterDevice with the meta.
func TestService_RegisterDevice_OnRegisterAndLogin(t *testing.T) {
	svc, _, _ := newService(t, ServiceConfig{})
	reg := &fakeRegistrar{}
	svc.SetDeviceRegistrar(reg)
	ctx := context.Background()
	const email = "dev@example.com"
	const pw = "supersecret"
	meta := DeviceMeta{DeviceID: "dev-uuid-1", Name: "MacBook Pro", Platform: "macos", ClientVersion: "v1.0.10"}

	if _, err := svc.SendCode(ctx, email, "1.1.1.1"); err != nil {
		t.Fatalf("SendCode: %v", err)
	}
	code := codeInRedis(t, svc, email)
	if _, e := svc.Register(ctx, email, code, pw, "1.2.3.4", meta); e != nil {
		t.Fatalf("Register: %v", e)
	}
	if len(reg.calls) != 1 || reg.calls[0].meta.DeviceID != "dev-uuid-1" || reg.calls[0].meta.Platform != "macos" {
		t.Fatalf("register did not register device: %+v", reg.calls)
	}

	if _, _, e := svc.Login(ctx, email, pw, "", meta); e != nil {
		t.Fatalf("Login: %v", e)
	}
	if len(reg.calls) != 2 || reg.calls[1].meta.Name != "MacBook Pro" {
		t.Fatalf("login did not register device: %+v", reg.calls)
	}
	if reg.calls[0].userID == 0 || reg.calls[0].userID != reg.calls[1].userID {
		t.Fatalf("userID mismatch: %+v", reg.calls)
	}
}

// Login surfaces the registrar's over-limit signal (non-hard-reject: tokens still
// issued, DeviceLimit attached for the client to present "remove a device" UX).
func TestService_Login_SurfacesDeviceLimit(t *testing.T) {
	svc, _, _ := newService(t, ServiceConfig{})
	last := "2026-07-01T00:00:00Z"
	reg := &fakeRegistrar{limit: &DeviceLimit{
		MaxDevices: 1,
		Devices:    []DeviceBrief{{UUID: "old", Name: "Old Phone", Platform: "android", LastSeen: &last}},
	}}
	svc.SetDeviceRegistrar(reg)
	ctx := context.Background()
	const email = "lim@example.com"
	const pw = "supersecret"
	meta := DeviceMeta{DeviceID: "new-dev", Platform: "ios"}
	if _, err := svc.SendCode(ctx, email, "1.1.1.1"); err != nil {
		t.Fatalf("SendCode: %v", err)
	}
	code := codeInRedis(t, svc, email)
	if _, e := svc.Register(ctx, email, code, pw, "", meta); e != nil {
		t.Fatalf("Register: %v", e)
	}
	out, _, e := svc.Login(ctx, email, pw, "", meta)
	if e != nil {
		t.Fatalf("Login must succeed (non-hard-reject): %v", e)
	}
	if out.Tokens == nil {
		t.Fatalf("login should still issue tokens")
	}
	if out.DeviceLimit == nil || out.DeviceLimit.MaxDevices != 1 || len(out.DeviceLimit.Devices) != 1 {
		t.Fatalf("expected device_limit surfaced, got %+v", out.DeviceLimit)
	}
}

// A registrar error (e.g. device cap) must NOT fail login/register.
func TestService_RegisterDevice_BestEffort(t *testing.T) {
	svc, _, _ := newService(t, ServiceConfig{})
	svc.SetDeviceRegistrar(&fakeRegistrar{err: context.DeadlineExceeded})
	ctx := context.Background()
	const email = "be@example.com"
	if _, err := svc.SendCode(ctx, email, "1.1.1.1"); err != nil {
		t.Fatalf("SendCode: %v", err)
	}
	code := codeInRedis(t, svc, email)
	if _, e := svc.Register(ctx, email, code, "supersecret", "", DeviceMeta{DeviceID: "x", Platform: "windows"}); e != nil {
		t.Fatalf("Register must succeed despite registrar error: %v", e)
	}
}

// No device id / no registrar → no-op, login still works.
func TestService_RegisterDevice_NoMeta(t *testing.T) {
	svc, _, _ := newService(t, ServiceConfig{})
	reg := &fakeRegistrar{}
	svc.SetDeviceRegistrar(reg)
	ctx := context.Background()
	const email = "nm@example.com"
	if _, err := svc.SendCode(ctx, email, "1.1.1.1"); err != nil {
		t.Fatalf("SendCode: %v", err)
	}
	code := codeInRedis(t, svc, email)
	if _, e := svc.Register(ctx, email, code, "supersecret", "", DeviceMeta{}); e != nil {
		t.Fatalf("Register: %v", e)
	}
	if len(reg.calls) != 0 {
		t.Fatalf("empty device id should not register: %+v", reg.calls)
	}
}