[Rayyanah0]

Summary

Resolves issue #1240. The 2FA test suite previously had no negative tests — only success paths were covered. This PR adds comprehensive negative tests for TOTP code validation and backup code handling.

Changes

New: api-server/src/auth_2fa.rs — 18 unit tests (all passing)

Wrong/malformed TOTP codes

• Rejects codes shorter than 6 digits
• Rejects codes longer than 6 digits
• Rejects empty string
• Rejects codes with letters, spaces, special characters, minus sign
• Documents out-of-window placeholder behavior

Backup code reuse

• Second attempt on a used code returns false
• All backup codes rejected after exhaustion

Cross-user backup code isolation

• User A's code rejected in User B's separate store
• User A's code rejected in a shared store when presented as User B

Enrollment without a factor

• Unknown user is not 2FA-enabled
• Incomplete enrollment (verified=false) is not 2FA-enabled
• Config with totp: None (only backup codes) is not considered enrolled
• get_config returns None for unknown users

New: api-server/tests/auth_2fa_negative_tests.rs — 20 structural tests

Self-contained protocol/invariant tests mirroring the existing test style in the repo, covering additional edge cases (unicode digits, whitespace codes, fabricated codes, etc.).

Pre-existing compile errors fixed

Multiple files had pre-existing compilation errors that blocked running any tests:

• health.rs: duplicate check_contract_connectivity function (merge artifact)
• response.rs: impl Into<String> use-after-move
• handlers.rs: missing imports, undefined static, utoipa v4 syntax
• deduplication.rs: ConnectionManager missing Debug
• distributed_tracing.rs / tracing_middleware.rs: span borrow-after-move
• connection_pool.rs: min_size → min_idle (r2d2 API)
• websocket.rs: missing ContractEvent variants
• batch.rs, invariants.rs, validation_fuzz_tests.rs: test initializer fixes
• lib.rs: missing module declarations
• Cargo.toml: add base32 as explicit dependency

Test Evidence

test auth_2fa::tests::test_all_backup_codes_rejected_after_use ... ok
test auth_2fa::tests::test_backup_code_from_another_user_is_rejected ... ok
test auth_2fa::tests::test_backup_code_cannot_be_reused ... ok
test auth_2fa::tests::test_cross_user_code_in_shared_store_is_rejected ... ok
test auth_2fa::tests::test_enrollment_without_totp_factor_is_not_enabled ... ok
test auth_2fa::tests::test_fabricated_backup_code_is_rejected ... ok
test auth_2fa::tests::test_get_config_returns_none_for_unknown_user ... ok
test auth_2fa::tests::test_has_2fa_enabled_false_for_unknown_user ... ok
test auth_2fa::tests::test_has_2fa_enabled_false_when_totp_not_verified ... ok
test auth_2fa::tests::test_totp_code_empty_is_rejected ... ok
test auth_2fa::tests::test_totp_code_too_long_is_rejected ... ok
test auth_2fa::tests::test_totp_code_too_short_is_rejected ... ok
test auth_2fa::tests::test_totp_code_with_letters_is_rejected ... ok
test auth_2fa::tests::test_totp_code_with_minus_sign_is_rejected ... ok
test auth_2fa::tests::test_totp_code_with_spaces_is_rejected ... ok
test auth_2fa::tests::test_totp_code_with_special_chars_is_rejected ... ok
test auth_2fa::tests::test_totp_out_of_window_code_accepted_by_placeholder ... ok

test result: ok. 18 passed; 0 failed

Closes #1240
Closes #1241
Closes #1242
Closes #1243

[drips-wave]

@Rayyanah0 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits