1 files changed, 99 insertions, 0 deletions
diff --git a/packages/meshbay-hub/tests/test_recovery_email.py b/packages/meshbay-hub/tests/test_recovery_email.py
new file mode 100644
index 0000000..e4288a1
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_recovery_email.py
@@ -0,0 +1,99 @@
+"""
+The recovery key in the registration e-mail (docs/auth-confirm.md §4.4).
+
+When the client sends `recovery_key`, the hub appends it to the verification
+e-mail and stores it nowhere. When it does not, the e-mail carries only the
+code. `recovery_key` is a pass-through — no column, no log line beyond a
+boolean.
+"""
+
+import base64
+import hashlib
+
+import pytest
+from meshbay_hub import mail
+from meshbay_hub.db.models import EmailVerification, User
+from sqlalchemy import select
+
+RECOVERY = "ABCD EFGH JKLM NPQR STUV WXYZ 2345 6789 ABCD EFGH JKLM NPQR STUV"
+
+
+def _auth_key(password: str, username: str) -> str:
+    salt = hashlib.sha256(f"meshbay:auth:v1:{username}".encode()).digest()
+    return base64.b64encode(
+        hashlib.pbkdf2_hmac("sha512", password.encode(), salt, 600_000, 32)).decode()
+
+
+@pytest.fixture(autouse=True)
+def _skip_email_verification(monkeypatch):
+    """
+    Override conftest's skip: this module needs the real verification path to
+    run so the e-mail is actually built. Capture it instead of sending.
+    """
+    sent = []
+    monkeypatch.setattr("meshbay_hub.mail._send", lambda msg: sent.append(msg) or True)
+    return sent
+
+
+@pytest.mark.asyncio
+async def test_register_appends_the_recovery_key_to_the_email(
+        client, _skip_email_verification):
+    r = await client.post("/v1/users/register", json={
+        "username": "rk1", "email": "rk1@example.com",
+        "auth_key": _auth_key("a-long-enough-passphrase", "rk1"),
+        "recovery_key": RECOVERY,
+    })
+    assert r.status_code in (200, 201), r.text
+    assert len(_skip_email_verification) == 1
+    body = _skip_email_verification[0].get_content()
+    assert RECOVERY in body
+    assert "recovery key" in body.lower()
+
+
+@pytest.mark.asyncio
+async def test_register_without_recovery_key_sends_only_the_code(
+        client, _skip_email_verification):
+    r = await client.post("/v1/users/register", json={
+        "username": "rk2", "email": "rk2@example.com",
+        "auth_key": _auth_key("a-long-enough-passphrase", "rk2"),
+    })
+    assert r.status_code in (200, 201), r.text
+    body = _skip_email_verification[0].get_content()
+    assert "recovery key" not in body.lower()
+    assert "verification code is" in body.lower()
+
+
+@pytest.mark.asyncio
+async def test_the_recovery_key_is_not_persisted(
+        client, db_session, _skip_email_verification):
+    await client.post("/v1/users/register", json={
+        "username": "rk3", "email": "rk3@example.com",
+        "auth_key": _auth_key("a-long-enough-passphrase", "rk3"),
+        "recovery_key": RECOVERY,
+    })
+    rows = (await db_session.execute(select(EmailVerification))).scalars().all()
+    assert rows
+    for row in rows:
+        assert RECOVERY not in (row.code or "")
+        assert RECOVERY not in (row.email_encrypted or "")
+    user = (await db_session.execute(
+        select(User).where(User.username == "rk3"))).scalar_one()
+    assert RECOVERY not in repr(vars(user))
+
+
+def test_mail_body_with_and_without_the_key(monkeypatch):
+    captured = []
+    monkeypatch.setattr("meshbay_hub.mail._send",
+                        lambda msg: captured.append(msg) or True)
+
+    mail.send_verification_code("x@example.com", "123456",
+                                recovery_key="MY-RECOVERY-KEY")
+    body = captured[-1].get_content()
+    assert "123456" in body
+    assert "MY-RECOVERY-KEY" in body
+    assert "recovery key" in body.lower()
+
+    mail.send_verification_code("x@example.com", "123456")
+    body = captured[-1].get_content()
+    assert "123456" in body
+    assert "recovery key" not in body.lower()