feat: release authentication diagnostics 0.2.0

tests/otp/diagnostics.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it } from "vitest";
+import { utf8ToBytes } from "../../src/crypto/encoding";
+import {
+  credentialHealthReport,
+  findTotpDrift,
+  generateTotpTimeline,
+} from "../../src/otp/diagnostics";
+import type { OtpProfile } from "../../src/otp/profile";
+
+const profile: OtpProfile = {
+  kind: "totp",
+  secret: utf8ToBytes("12345678901234567890"),
+  issuer: "RFC",
+  account: "vector",
+  algorithm: "SHA-1",
+  digits: 8,
+  period: 30,
+  epoch: 0,
+  counter: 0n,
+  extensions: new Map(),
+};
+
+describe("OTP diagnostics", () => {
+  it("builds an ordered RFC timeline and finds clock drift", async () => {
+    const timeline = await generateTotpTimeline(profile, 59, 1, 2);
+    expect(timeline.map((item) => item.delta)).toEqual([-1, 0, 1, 2]);
+    expect(timeline[1]).toMatchObject({ code: "94287082", counter: 1n });
+    const drift = await findTotpDrift(timeline[2]!.code, profile, 59, 5);
+    expect(drift).toMatchObject({ delta: 1, driftSeconds: 30 });
+  });
+
+  it("honors a custom T0 and bounds diagnostic work", async () => {
+    const shifted = { ...profile, epoch: 30 };
+    expect((await generateTotpTimeline(shifted, 59, 0, 0))[0]!.counter).toBe(
+      0n,
+    );
+    await expect(
+      findTotpDrift("12345678", profile, 59, 10_001),
+    ).rejects.toThrow(/10000/u);
+  });
+
+  it("detects duplicate secrets without exposing their fingerprint", async () => {
+    const report = await credentialHealthReport([
+      profile,
+      { ...profile, issuer: "Other", account: "second" },
+    ]);
+    expect(report.findings).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ code: "reused-secret", severity: "danger" }),
+      ]),
+    );
+    expect(JSON.stringify(report)).not.toContain("31323334");
+  });
+});