feat: sync durable moderation and appeals

internal/app/authdiagnostics/service_test.go

@@ -0,0 +1,81 @@
+package authdiagnostics
+
+import (
+	"context"
+	"crypto/sha256"
+	"errors"
+	"testing"
+	"time"
+
+	"telesrv/internal/domain"
+	"telesrv/internal/store"
+	"telesrv/internal/store/memory"
+)
+
+func TestReportMissingCodeValidatesLiveDeliveryAndStoresOnlyHashes(t *testing.T) {
+	ctx := context.Background()
+	codes := memory.NewCodeStore()
+	reports := memory.NewAuthDeliveryReportStore()
+	const (
+		phone    = "15550001234"
+		codeHash = "login-code-hash"
+	)
+	if err := codes.Set(ctx, codeHash, store.PhoneCode{
+		Version: store.PhoneCodeVersionCurrent, Phone: phone, Code: "12345",
+		DeliveryID: "delivery-1", Channel: store.PhoneCodeChannelSMS,
+		IssuedUserID: 42,
+	}, time.Hour); err != nil {
+		t.Fatal(err)
+	}
+	service := NewService(codes, reports)
+	now := time.Now().UTC()
+	req := domain.AuthMissingCodeReportRequest{
+		AuthKeyID: [8]byte{1, 2, 3}, SessionID: 99, ClientType: "tdesktop",
+		Phone: "+1 (555) 000-1234", PhoneCodeHash: codeHash, MNC: "46000",
+		CreatedAt: now,
+	}
+	first, created, err := service.ReportMissingCode(ctx, req)
+	if err != nil || !created {
+		t.Fatalf("first report created=%v err=%v", created, err)
+	}
+	second, created, err := service.ReportMissingCode(ctx, req)
+	if err != nil || created || second.ID != first.ID {
+		t.Fatalf("retry report=%+v created=%v err=%v", second, created, err)
+	}
+	stored := reports.Reports()
+	if len(stored) != 1 {
+		t.Fatalf("stored reports=%d, want 1", len(stored))
+	}
+	if stored[0].PhoneHash != sha256.Sum256([]byte(phone)) ||
+		stored[0].CodeHash != sha256.Sum256([]byte(codeHash)) {
+		t.Fatalf("stored hashes do not match normalized delivery identity: %+v", stored[0])
+	}
+	if stored[0].DeliveryID != "delivery-1" || stored[0].IssuedUserID != 42 ||
+		stored[0].Channel != domain.AuthCodeDeliverySMS {
+		t.Fatalf("stored delivery metadata=%+v", stored[0])
+	}
+}
+
+func TestReportMissingCodeRejectsUnknownOrMismatchedLoginState(t *testing.T) {
+	ctx := context.Background()
+	codes := memory.NewCodeStore()
+	service := NewService(codes, memory.NewAuthDeliveryReportStore())
+	now := time.Now().UTC()
+	base := domain.AuthMissingCodeReportRequest{
+		AuthKeyID: [8]byte{1}, SessionID: 10, Phone: "15550002222",
+		PhoneCodeHash: "missing", CreatedAt: now,
+	}
+	if _, _, err := service.ReportMissingCode(ctx, base); !errors.Is(err, domain.ErrPhoneCodeExpired) {
+		t.Fatalf("missing hash err=%v, want phone-code expired", err)
+	}
+	if err := codes.Set(ctx, "current", store.PhoneCode{
+		Version: store.PhoneCodeVersionCurrent, Phone: "15550003333",
+		Channel: store.PhoneCodeChannelPhone,
+	}, time.Hour); err != nil {
+		t.Fatal(err)
+	}
+	base.PhoneCodeHash = "current"
+	if _, _, err := service.ReportMissingCode(ctx, base); !errors.Is(err, domain.ErrPhoneCodeInvalid) {
+		t.Fatalf("mismatched phone err=%v, want phone-code invalid", err)
+	}
+}