release: WRNexusJS 0.5.0

packages/auth/test/risk.test.ts

@@ -0,0 +1,35 @@
+import { expect, test } from "bun:test";
+import { evaluateAuthRisk } from "../src/risk.ts";
+
+test("risk scoring escalates CAPTCHA, MFA, and blocking", () => {
+  expect(evaluateAuthRisk({ failedAttempts: 2 })).toMatchObject({
+    level: "low",
+    requireCaptcha: false,
+  });
+  expect(evaluateAuthRisk({ failedAttempts: 3, unfamiliarDevice: true })).toMatchObject({
+    requireCaptcha: true,
+  });
+  expect(
+    evaluateAuthRisk({ unusualIp: true, impossibleTravel: true, unfamiliarDevice: true }),
+  ).toMatchObject({ requireMfa: true });
+  expect(evaluateAuthRisk({ accountLocked: true })).toMatchObject({
+    block: true,
+    level: "critical",
+  });
+});
+
+test("risk scoring remains finite for malformed numeric signals and policy", () => {
+  const result = evaluateAuthRisk(
+    { customScore: Number.NaN, failedAttempts: Number.POSITIVE_INFINITY },
+    {
+      captchaThreshold: Number.NaN,
+      mfaThreshold: Number.POSITIVE_INFINITY,
+      blockThreshold: -10,
+    },
+  );
+  expect(result.score).toBe(0);
+  expect(result.level).toBe("low");
+  expect(result.requireCaptcha).toBe(false);
+  expect(result.requireMfa).toBe(false);
+  expect(result.block).toBe(true);
+});