File size: 27,672 Bytes
cc036ff
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
"""
Coverage-driven tests for auth_2fa_routes.py (0% -> 75%+ target)

API Endpoints Tested:
- GET /api/auth/2fa/status - Check 2FA enabled status
- POST /api/auth/2fa/setup - Generate TOTP secret and provisioning URL
- POST /api/auth/2fa/enable - Verify code and enable 2FA
- POST /api/auth/2fa/disable - Disable 2FA after verification

Coverage Target Areas:
- Lines 1-30: Route initialization and dependencies
- Lines 30-55: Status endpoint
- Lines 55-90: Setup endpoint (secret generation)
- Lines 90-125: Enable endpoint (code verification)
- Lines 125-165: Disable endpoint
"""

import pytest
import uuid
from datetime import datetime, timezone
from unittest.mock import Mock, patch, MagicMock, AsyncMock
from fastapi import FastAPI
from fastapi.testclient import TestClient
from sqlalchemy import create_engine
from sqlalchemy.orm import sessionmaker, Session
from sqlalchemy.pool import StaticPool

# Import auth 2FA routes router
from api.auth_2fa_routes import router, TwoFactorSetupResponse, TwoFactorVerifyRequest, TwoFactorStatusResponse

# Import models
from core.models import Base, User, AuditEventType, SecurityLevel

# Import auth dependencies
from core.auth import get_current_user
from core.database import get_db

# Mock audit service globally to avoid database issues
@pytest.fixture(autouse=True)
def mock_audit_service():
    """Mock audit service to avoid database table requirements."""
    with patch('api.auth_2fa_routes.audit_service') as mock_service:
        mock_service.log_event = Mock()
        yield mock_service


# ============================================================================
# Test Database Setup
# ============================================================================

@pytest.fixture(scope="function")
def test_db():
    """Create in-memory SQLite database for testing."""
    engine = create_engine(
        "sqlite:///:memory:",
        connect_args={"check_same_thread": False},
        poolclass=StaticPool
    )

    # Create only the tables we need for auth 2FA routes testing
    from core.models import User

    User.__table__.create(bind=engine, checkfirst=True)

    # Create session
    TestingSessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
    db = TestingSessionLocal()

    yield db

    # Cleanup
    db.close()
    User.__table__.drop(bind=engine)


@pytest.fixture(scope="function")
def test_app(test_db: Session):
    """Create FastAPI app with auth 2FA routes for testing."""
    app = FastAPI()
    app.include_router(router)

    # Override get_db dependency
    def override_get_db():
        try:
            yield test_db
        finally:
            pass

    app.dependency_overrides[get_db] = override_get_db

    yield app

    # Clean up overrides
    app.dependency_overrides.clear()


@pytest.fixture(scope="function")
def client(test_app: FastAPI):
    """Create TestClient for testing."""
    return TestClient(test_app)


@pytest.fixture(scope="function")
def test_user(test_db: Session) -> User:
    """Create test user for authentication."""
    user = User(
        id=str(uuid.uuid4()),
        email="test@example.com",
        first_name="Test",
        last_name="User",
        role="member",
        status="active",
        email_verified=True,
        two_factor_enabled=False,
        two_factor_secret=None,
        two_factor_backup_codes=None
    )
    test_db.add(user)
    test_db.commit()
    test_db.refresh(user)
    return user


@pytest.fixture(scope="function")
def test_user_with_2fa(test_db: Session) -> User:
    """Create test user with 2FA already enabled."""
    user = User(
        id=str(uuid.uuid4()),
        email="test2fa@example.com",
        first_name="Test",
        last_name="User2FA",
        role="member",
        status="active",
        email_verified=True,
        two_factor_enabled=True,
        two_factor_secret="JBSWY3DPEHPK3PXP",
        two_factor_backup_codes=["UP-BACKUP-1234-5678"]
    )
    test_db.add(user)
    test_db.commit()
    test_db.refresh(user)
    return user


@pytest.fixture(scope="function")
def authenticated_client(client: TestClient, test_user: User):
    """Create client with authenticated user override."""
    def override_get_current_user():
        return test_user

    from api.auth_2fa_routes import router
    # Override on the app, not the router
    client.app.dependency_overrides[get_current_user] = override_get_current_user

    yield client

    # Clean up
    client.app.dependency_overrides.clear()


@pytest.fixture(scope="function")
def authenticated_client_with_2fa(client: TestClient, test_user_with_2fa: User):
    """Create client with authenticated user (2FA enabled) override."""
    def override_get_current_user():
        return test_user_with_2fa

    from api.auth_2fa_routes import router
    # Override on the app, not the router
    client.app.dependency_overrides[get_current_user] = override_get_current_user

    yield client

    # Clean up
    client.app.dependency_overrides.clear()


# ============================================================================
# Status Endpoint Tests (GET /api/auth/2fa/status)
# ============================================================================

class TestTwoFactorStatus:
    """Tests for 2FA status endpoint."""

    def test_get_2fa_status_disabled(self, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover status endpoint when 2FA is disabled (lines 28-31)."""
        test_user.two_factor_enabled = False
        test_db.commit()

        response = authenticated_client.get("/api/auth/2fa/status")

        assert response.status_code == 200
        result = response.json()
        assert result["enabled"] is False

    def test_get_2fa_status_enabled(self, authenticated_client_with_2fa: TestClient, test_user_with_2fa: User, test_db: Session):
        """Cover status endpoint when 2FA is enabled."""
        test_user_with_2fa.two_factor_enabled = True
        test_db.commit()

        response = authenticated_client_with_2fa.get("/api/auth/2fa/status")

        assert response.status_code == 200
        result = response.json()
        assert result["enabled"] is True

    def test_status_endpoint_unauthorized(self, client: TestClient):
        """Cover unauthorized access to status endpoint."""
        # No auth override
        response = client.get("/api/auth/2fa/status")

        assert response.status_code == 401

    def test_status_response_model(self, authenticated_client: TestClient):
        """Cover status response model validation."""
        response = authenticated_client.get("/api/auth/2fa/status")

        assert response.status_code == 200
        # Verify response structure matches TwoFactorStatusResponse
        assert "enabled" in response.json()
        assert isinstance(response.json()["enabled"], bool)

    def test_status_endpoint_returns_json(self, authenticated_client: TestClient):
        """Cover status endpoint returns valid JSON."""
        response = authenticated_client.get("/api/auth/2fa/status")

        assert response.headers["content-type"] == "application/json"
        assert response.status_code == 200

    def test_status_no_database_query(self, authenticated_client: TestClient, test_db: Session):
        """Cover status endpoint doesn't query database beyond user context."""
        # Status endpoint only reads from current_user, no additional DB queries
        response = authenticated_client.get("/api/auth/2fa/status")

        assert response.status_code == 200
        # Should return immediately from user object
        assert response.json()["enabled"] is False


# ============================================================================
# Setup Endpoint Tests (POST /api/auth/2fa/setup)
# ============================================================================

class TestTwoFactorSetup:
    """Tests for 2FA setup endpoint."""

    @patch('api.auth_2fa_routes.pyotp.random_base32')
    @patch('api.auth_2fa_routes.pyotp.totp.TOTP')
    def test_setup_2fa_success(self, mock_totp_class, mock_random, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover successful 2FA setup (lines 33-52)."""
        mock_random.return_value = "TESTSECRET123"
        mock_totp = Mock()
        mock_totp.provisioning_uri.return_value = "otpauth://totp/Atom%20AI%20(Upstream):test@example.com?secret=TESTSECRET123&issuer=Atom+AI+(Upstream)"
        mock_totp_class.return_value = mock_totp
        test_user.two_factor_enabled = False
        test_db.commit()

        response = authenticated_client.post("/api/auth/2fa/setup")

        assert response.status_code == 200
        result = response.json()
        assert "secret" in result
        assert "otpauth_url" in result
        assert result["secret"] == "TESTSECRET123"
        # Verify secret was saved to user
        test_db.refresh(test_user)
        assert test_user.two_factor_secret == "TESTSECRET123"

    def test_setup_2fa_already_enabled(self, authenticated_client_with_2fa: TestClient, test_user_with_2fa: User, test_db: Session):
        """Cover setup when 2FA is already enabled."""
        test_user_with_2fa.two_factor_enabled = True
        test_db.commit()

        response = authenticated_client_with_2fa.post("/api/auth/2fa/setup")

        assert response.status_code == 409  # Conflict

    @patch('api.auth_2fa_routes.pyotp.random_base32')
    def test_setup_generates_different_secrets(self, mock_random, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover that each setup generates unique secrets."""
        secrets = ["SECRET1", "SECRET2"]
        mock_random.side_effect = secrets

        response1 = authenticated_client.post("/api/auth/2fa/setup")
        test_db.refresh(test_user)
        response2 = authenticated_client.post("/api/auth/2fa/setup")

        assert response1.status_code == 200
        assert response2.status_code == 200
        assert response1.json()["secret"] == "SECRET1"
        # Second setup should generate a different secret (since 2FA still not enabled)
        test_db.refresh(test_user)
        assert test_user.two_factor_secret == "SECRET2"

    @patch('api.auth_2fa_routes.pyotp.random_base32')
    @patch('api.auth_2fa_routes.pyotp.totp.TOTP')
    def test_setup_creates_otpauth_url(self, mock_totp_class, mock_random, authenticated_client: TestClient):
        """Cover setup creates valid otpauth URL."""
        mock_random.return_value = "MYSECRET"
        mock_totp = Mock()
        mock_totp.provisioning_uri.return_value = "otpauth://totp/Atom%20AI%20(Upstream):test@example.com?secret=MYSECRET&issuer=Atom+AI+(Upstream)"
        mock_totp_class.return_value = mock_totp

        response = authenticated_client.post("/api/auth/2fa/setup")

        assert response.status_code == 200
        result = response.json()
        assert result["otpauth_url"].startswith("otpauth://totp/")
        assert "Atom+AI+(Upstream)" in result["otpauth_url"]
        assert "test@example.com" in result["otpauth_url"]

    @patch('api.auth_2fa_routes.pyotp.random_base32')
    def test_setup_saves_secret_to_database(self, mock_random, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover setup saves secret to user record."""
        mock_random.return_value = "DBSECRET123"
        test_user.two_factor_secret = None
        test_db.commit()

        response = authenticated_client.post("/api/auth/2fa/setup")

        assert response.status_code == 200
        test_db.refresh(test_user)
        assert test_user.two_factor_secret == "DBSECRET123"

    def test_setup_unauthorized(self, client: TestClient):
        """Cover setup endpoint requires authentication."""
        response = client.post("/api/auth/2fa/setup")

        assert response.status_code == 401

    @patch('api.auth_2fa_routes.pyotp.random_base32')
    def test_setup_without_committing_2fa_enabled(self, mock_random, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover setup doesn't enable 2FA, only sets secret."""
        mock_random.return_value = "SECRETONLY"
        test_user.two_factor_enabled = False
        test_db.commit()

        response = authenticated_client.post("/api/auth/2fa/setup")

        assert response.status_code == 200
        test_db.refresh(test_user)
        assert test_user.two_factor_enabled is False  # Still disabled
        assert test_user.two_factor_secret == "SECRETONLY"  # But secret is set


# ============================================================================
# Enable Endpoint Tests (POST /api/auth/2fa/enable)
# ============================================================================

class TestTwoFactorEnable:
    """Tests for 2FA enable endpoint."""

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_enable_2fa_success(self, mock_totp_class, authenticated_client: TestClient, test_user: User, test_db: Session, mock_audit_service):
        """Cover successful 2FA enable (lines 54-90)."""
        test_user.two_factor_enabled = False
        test_user.two_factor_secret = "JBSWY3DPEHPK3PXP"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client.post("/api/auth/2fa/enable", json={"code": "123456"})

        assert response.status_code == 200
        test_db.refresh(test_user)
        assert test_user.two_factor_enabled is True
        assert test_user.two_factor_backup_codes == ["UP-BACKUP-1234-5678"]
        mock_audit_service.log_event.assert_called_once()

    def test_enable_2fa_already_enabled(self, authenticated_client_with_2fa: TestClient, test_user_with_2fa: User, test_db: Session):
        """Cover enable when already enabled."""
        test_user_with_2fa.two_factor_enabled = True
        test_db.commit()

        response = authenticated_client_with_2fa.post("/api/auth/2fa/enable", json={"code": "123456"})

        assert response.status_code == 409  # Conflict

    def test_enable_2fa_no_secret(self, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover enable without setup (no secret)."""
        test_user.two_factor_enabled = False
        test_user.two_factor_secret = None
        test_db.commit()

        response = authenticated_client.post("/api/auth/2fa/enable", json={"code": "123456"})

        assert response.status_code == 400  # Validation error

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_enable_2fa_invalid_code(self, mock_totp_class, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover enable with invalid verification code."""
        test_user.two_factor_enabled = False
        test_user.two_factor_secret = "JBSWY3DPEHPK3PXP"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = False
        mock_totp_class.return_value = mock_totp

        response = authenticated_client.post("/api/auth/2fa/enable", json={"code": "000000"})

        assert response.status_code == 400  # Validation error

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_enable_2fa_valid_code(self, mock_totp_class, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover enable with valid verification code."""
        test_user.two_factor_enabled = False
        test_user.two_factor_secret = "JBSWY3DPEHPK3PXP"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client.post("/api/auth/2fa/enable", json={"code": "123456"})

        assert response.status_code == 200
        test_db.refresh(test_user)
        assert test_user.two_factor_enabled is True

    @pytest.mark.parametrize("code,valid", [
        ("123456", True),
        ("000000", False),
    ])
    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_enable_2fa_code_validation(self, mock_totp_class, authenticated_client: TestClient, test_user: User, test_db: Session, code, valid):
        """Cover various code formats."""
        test_user.two_factor_enabled = False
        test_user.two_factor_secret = "JBSWY3DPEHPK3PXP"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = valid
        mock_totp_class.return_value = mock_totp

        response = authenticated_client.post("/api/auth/2fa/enable", json={"code": code})

        if valid:
            assert response.status_code == 200
        else:
            assert response.status_code == 400

    def test_enable_missing_code_field(self, authenticated_client: TestClient):
        """Cover validation when code field is missing."""
        response = authenticated_client.post("/api/auth/2fa/enable", json={})

        assert response.status_code == 422  # Validation error

    def test_enable_malformed_json_request(self, authenticated_client: TestClient):
        """Cover malformed JSON handling."""
        response = authenticated_client.post(
            "/api/auth/2fa/enable",
            content="invalid json",
            headers={"Content-Type": "application/json"}
        )

        assert response.status_code == 422

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_enable_creates_audit_log(self, mock_totp_class, authenticated_client: TestClient, test_user: User, test_db: Session, mock_audit_service):
        """Cover audit log creation on 2FA enable."""
        test_user.two_factor_enabled = False
        test_user.two_factor_secret = "SECRET"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client.post("/api/auth/2fa/enable", json={"code": "123456"})

        assert response.status_code == 200
        mock_audit_service.log_event.assert_called_once()
        call_args = mock_audit_service.log_event.call_args
        assert call_args[1]['action'] == "2fa_enabled"
        assert call_args[1]['event_type'] == AuditEventType.UPDATE.value
        assert call_args[1]['security_level'] == SecurityLevel.HIGH.value

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_enable_generates_backup_codes(self, mock_totp_class, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover enable generates backup codes."""
        test_user.two_factor_enabled = False
        test_user.two_factor_secret = "SECRET"
        test_user.two_factor_backup_codes = None
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client.post("/api/auth/2fa/enable", json={"code": "123456"})

        assert response.status_code == 200
        test_db.refresh(test_user)
        assert test_user.two_factor_backup_codes == ["UP-BACKUP-1234-5678"]
        result = response.json()
        assert "backup_codes" in result["data"]


# ============================================================================
# Disable Endpoint Tests (POST /api/auth/2fa/disable)
# ============================================================================

class TestTwoFactorDisable:
    """Tests for 2FA disable endpoint."""

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_disable_2fa_success(self, mock_totp_class, authenticated_client_with_2fa: TestClient, test_user_with_2fa: User, test_db: Session, mock_audit_service):
        """Cover successful 2FA disable (lines 92-123)."""
        test_user_with_2fa.two_factor_enabled = True
        test_user_with_2fa.two_factor_secret = "JBSWY3DPEHPK3PXP"
        test_user_with_2fa.two_factor_backup_codes = ["BACKUP123"]
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client_with_2fa.post("/api/auth/2fa/disable", json={"code": "123456"})

        assert response.status_code == 200
        test_db.refresh(test_user_with_2fa)
        assert test_user_with_2fa.two_factor_enabled is False
        assert test_user_with_2fa.two_factor_secret is None
        assert test_user_with_2fa.two_factor_backup_codes is None
        mock_audit_service.log_event.assert_called_once()

    def test_disable_2fa_not_enabled(self, authenticated_client: TestClient, test_user: User, test_db: Session):
        """Cover disable when 2FA is not enabled."""
        test_user.two_factor_enabled = False
        test_db.commit()

        response = authenticated_client.post("/api/auth/2fa/disable", json={"code": "123456"})

        assert response.status_code == 400  # Validation error

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_disable_2fa_invalid_code(self, mock_totp_class, authenticated_client_with_2fa: TestClient, test_user_with_2fa: User, test_db: Session):
        """Cover disable with invalid verification code."""
        test_user_with_2fa.two_factor_enabled = True
        test_user_with_2fa.two_factor_secret = "JBSWY3DPEHPK3PXP"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = False
        mock_totp_class.return_value = mock_totp

        response = authenticated_client_with_2fa.post("/api/auth/2fa/disable", json={"code": "000000"})

        assert response.status_code == 400  # Validation error

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_disable_2fa_valid_code(self, mock_totp_class, authenticated_client_with_2fa: TestClient, test_user_with_2fa: User, test_db: Session):
        """Cover disable with valid verification code."""
        test_user_with_2fa.two_factor_enabled = True
        test_user_with_2fa.two_factor_secret = "JBSWY3DPEHPK3PXP"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client_with_2fa.post("/api/auth/2fa/disable", json={"code": "123456"})

        assert response.status_code == 200
        test_db.refresh(test_user_with_2fa)
        assert test_user_with_2fa.two_factor_enabled is False

    def test_disable_missing_code_field(self, authenticated_client: TestClient):
        """Cover validation when code field is missing."""
        response = authenticated_client.post("/api/auth/2fa/disable", json={})

        assert response.status_code == 422  # Validation error

    def test_disable_malformed_json_request(self, authenticated_client: TestClient):
        """Cover malformed JSON handling."""
        response = authenticated_client.post(
            "/api/auth/2fa/disable",
            content="invalid json",
            headers={"Content-Type": "application/json"}
        )

        assert response.status_code == 422

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_disable_creates_audit_log(self, mock_totp_class, authenticated_client_with_2fa: TestClient, test_user_with_2fa: User, test_db: Session, mock_audit_service):
        """Cover audit log creation on 2FA disable."""
        test_user_with_2fa.two_factor_enabled = True
        test_user_with_2fa.two_factor_secret = "SECRET"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client_with_2fa.post("/api/auth/2fa/disable", json={"code": "123456"})

        assert response.status_code == 200
        mock_audit_service.log_event.assert_called_once()
        call_args = mock_audit_service.log_event.call_args
        assert call_args[1]['action'] == "2fa_disabled"

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_disable_clears_secret_and_backup_codes(self, mock_totp_class, authenticated_client_with_2fa: TestClient, test_user_with_2fa: User, test_db: Session):
        """Cover disable clears secret and backup codes."""
        test_user_with_2fa.two_factor_enabled = True
        test_user_with_2fa.two_factor_secret = "MYSECRET"
        test_user_with_2fa.two_factor_backup_codes = ["BACKUP1", "BACKUP2"]
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client_with_2fa.post("/api/auth/2fa/disable", json={"code": "123456"})

        assert response.status_code == 200
        test_db.refresh(test_user_with_2fa)
        assert test_user_with_2fa.two_factor_secret is None
        assert test_user_with_2fa.two_factor_backup_codes is None

    def test_disable_unauthorized(self, client: TestClient):
        """Cover disable endpoint requires authentication."""
        response = client.post("/api/auth/2fa/disable", json={"code": "123456"})

        assert response.status_code == 401


# ============================================================================
# Audit Service Integration Tests
# ============================================================================

class TestAuditServiceIntegration:
    """Tests for audit service integration with 2FA operations."""

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_enable_audit_log_fields(self, mock_totp_class, authenticated_client: TestClient, test_user: User, test_db: Session, mock_audit_service):
        """Cover audit log contains all required fields for enable."""
        test_user.two_factor_enabled = False
        test_user.two_factor_secret = "SECRET"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client.post("/api/auth/2fa/enable", json={"code": "123456"})

        assert response.status_code == 200
        mock_audit_service.log_event.assert_called_once()
        call_kwargs = mock_audit_service.log_event.call_args[1]
        assert call_kwargs['action'] == "2fa_enabled"
        assert call_kwargs['event_type'] == AuditEventType.UPDATE.value
        assert call_kwargs['user_id'] == test_user.id
        assert call_kwargs['user_email'] == test_user.email
        assert call_kwargs['security_level'] == SecurityLevel.HIGH.value
        assert "2FA enabled" in call_kwargs['description']

    @patch('api.auth_2fa_routes.pyotp.TOTP')
    def test_disable_audit_log_fields(self, mock_totp_class, authenticated_client_with_2fa: TestClient, test_user_with_2fa: User, test_db: Session, mock_audit_service):
        """Cover audit log contains all required fields for disable."""
        test_user_with_2fa.two_factor_enabled = True
        test_user_with_2fa.two_factor_secret = "SECRET"
        test_db.commit()

        mock_totp = Mock()
        mock_totp.verify.return_value = True
        mock_totp_class.return_value = mock_totp

        response = authenticated_client_with_2fa.post("/api/auth/2fa/disable", json={"code": "123456"})

        assert response.status_code == 200
        mock_audit_service.log_event.assert_called_once()
        call_kwargs = mock_audit_service.log_event.call_args[1]
        assert call_kwargs['action'] == "2fa_disabled"
        assert call_kwargs['event_type'] == AuditEventType.UPDATE.value
        assert call_kwargs['user_id'] == test_user_with_2fa.id
        assert call_kwargs['user_email'] == test_user_with_2fa.email
        assert call_kwargs['security_level'] == SecurityLevel.HIGH.value
        assert "2FA disabled" in call_kwargs['description']