feat: release authentication laboratories 0.3.0

tests/otp/collection.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, it } from "vitest";
+import { utf8ToBytes } from "../../src/crypto/encoding";
+import {
+  compareCollectionSnapshots,
+  createCollectionSnapshot,
+  parseCollectionSnapshot,
+} from "../../src/otp/collection";
+import type { OtpProfile } from "../../src/otp/profile";
+
+function profile(account: string, secret: string): OtpProfile {
+  return {
+    kind: "totp",
+    issuer: "Example",
+    account,
+    secret: utf8ToBytes(secret),
+    algorithm: "SHA-1",
+    digits: 6,
+    period: 30,
+    counter: 0n,
+    extensions: new Map(),
+  };
+}
+
+describe("OTP collection snapshots", () => {
+  it("exports fingerprints without secrets", async () => {
+    const snapshot = await createCollectionSnapshot([
+      profile("alice", "top-secret-value"),
+    ]);
+    const serialized = JSON.stringify(snapshot);
+    expect(serialized).not.toContain("top-secret-value");
+    expect(parseCollectionSnapshot(serialized)).toEqual(snapshot);
+  });
+
+  it("detects renames, parameter changes and secret reuse", async () => {
+    const before = await createCollectionSnapshot([
+      profile("alice", "secret-a"),
+      profile("bob", "secret-b"),
+    ]);
+    const bob = profile("bob", "secret-b");
+    bob.digits = 8;
+    const after = await createCollectionSnapshot([
+      profile("alice-renamed", "secret-a"),
+      bob,
+      profile("carol", "secret-b"),
+    ]);
+    const result = compareCollectionSnapshots(before, after);
+    expect(result.changes.map(({ kind }) => kind)).toEqual(
+      expect.arrayContaining([
+        "renamed",
+        "parameters-changed",
+        "added",
+        "secret-reused",
+      ]),
+    );
+    expect(result.rotationPlan[0]?.kind).toBe("secret-reused");
+  });
+});