|
| 1 | +import supertest from 'supertest'; |
| 2 | +import { vi } from 'vitest'; |
| 3 | + |
| 4 | +import { SpamTag, User } from 'server/models'; |
| 5 | +import { modelize, setup, teardown } from 'stubstub'; |
| 6 | + |
| 7 | +import { __appImmutableListenOnly } from '../../server'; |
| 8 | + |
| 9 | +const normalEmail = `${crypto.randomUUID()}@email.com`; |
| 10 | +const restrictedEmail = `${crypto.randomUUID()}@email.com`; |
| 11 | + |
| 12 | +const models = modelize` |
| 13 | + Community community { |
| 14 | + Member { |
| 15 | + permissions: "admin" |
| 16 | + User legacyUser { |
| 17 | + email: ${normalEmail} |
| 18 | + } |
| 19 | + } |
| 20 | + Member { |
| 21 | + permissions: "admin" |
| 22 | + User restrictedUser { |
| 23 | + email: ${restrictedEmail} |
| 24 | + } |
| 25 | + } |
| 26 | + } |
| 27 | +`; |
| 28 | + |
| 29 | +setup(beforeAll, async () => { |
| 30 | + await models.resolve(); |
| 31 | +}); |
| 32 | + |
| 33 | +teardown(afterAll); |
| 34 | + |
| 35 | +const AUTH_URL = 'http://kf-auth.test'; |
| 36 | +const AUTH_KEY = 'test-internal-key'; |
| 37 | +const ENDPOINT = '/api/internal/legacy-pubpub-login'; |
| 38 | + |
| 39 | +function jsonResponse(body: unknown, status = 200): Response { |
| 40 | + return new Response(JSON.stringify(body), { |
| 41 | + status, |
| 42 | + headers: { 'Content-Type': 'application/json' }, |
| 43 | + }); |
| 44 | +} |
| 45 | + |
| 46 | +beforeEach(() => { |
| 47 | + vi.stubEnv('AUTH_INTERNAL_API_URL', AUTH_URL); |
| 48 | + vi.stubEnv('AUTH_INTERNAL_API_KEY', AUTH_KEY); |
| 49 | +}); |
| 50 | + |
| 51 | +afterEach(() => { |
| 52 | + vi.unstubAllEnvs(); |
| 53 | + vi.restoreAllMocks(); |
| 54 | +}); |
| 55 | + |
| 56 | +describe('/api/login (kf-auth handshake)', () => { |
| 57 | + it('verifies via the internal endpoint and establishes a PubPub session', async () => { |
| 58 | + const { legacyUser } = models; |
| 59 | + const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async (url) => { |
| 60 | + if (String(url).endsWith(ENDPOINT)) { |
| 61 | + return jsonResponse({ verified: true, userId: legacyUser.id }); |
| 62 | + } |
| 63 | + throw new Error(`Unexpected fetch: ${url}`); |
| 64 | + }); |
| 65 | + |
| 66 | + const server = __appImmutableListenOnly.listen(); |
| 67 | + try { |
| 68 | + const res = await supertest(server) |
| 69 | + .post('/api/login') |
| 70 | + .send({ email: legacyUser.email, password: 'sha3-hex-payload' }) |
| 71 | + .expect(201); |
| 72 | + |
| 73 | + expect(res.headers.deprecation).toBe('true'); |
| 74 | + expect(res.headers.sunset).toBeTruthy(); |
| 75 | + const cookies = (res.headers['set-cookie'] as unknown as string[]) ?? []; |
| 76 | + expect(cookies.some((c) => c.startsWith('connect.sid='))).toBe(true); |
| 77 | + expect(cookies.some((c) => c.startsWith('pp-lic='))).toBe(true); |
| 78 | + |
| 79 | + const call = fetchSpy.mock.calls.find(([u]) => String(u).endsWith(ENDPOINT)); |
| 80 | + expect(call).toBeDefined(); |
| 81 | + const init = call![1] as RequestInit; |
| 82 | + expect((init.headers as Record<string, string>).Authorization).toBe( |
| 83 | + `Bearer ${AUTH_KEY}`, |
| 84 | + ); |
| 85 | + const body = JSON.parse(String(init.body)); |
| 86 | + expect(body).toEqual({ |
| 87 | + email: legacyUser.email, |
| 88 | + prehashedPassword: 'sha3-hex-payload', |
| 89 | + }); |
| 90 | + } finally { |
| 91 | + server.close(); |
| 92 | + } |
| 93 | + }); |
| 94 | + |
| 95 | + it('returns 401 when kf-auth reports verified:false (wrong password or unknown user)', async () => { |
| 96 | + const { legacyUser } = models; |
| 97 | + vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ verified: false })); |
| 98 | + |
| 99 | + const server = __appImmutableListenOnly.listen(); |
| 100 | + try { |
| 101 | + const res = await supertest(server) |
| 102 | + .post('/api/login') |
| 103 | + .send({ email: legacyUser.email, password: 'sha3-wrong' }) |
| 104 | + .expect(401); |
| 105 | + expect(res.body).toBe('Login attempt failed'); |
| 106 | + } finally { |
| 107 | + server.close(); |
| 108 | + } |
| 109 | + }); |
| 110 | + |
| 111 | + it('returns 410 when kf-auth reports the hash has been migrated past pubpub-format', async () => { |
| 112 | + const { legacyUser } = models; |
| 113 | + vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ migrated: true }, 410)); |
| 114 | + |
| 115 | + const server = __appImmutableListenOnly.listen(); |
| 116 | + try { |
| 117 | + const res = await supertest(server) |
| 118 | + .post('/api/login') |
| 119 | + .send({ email: legacyUser.email, password: 'sha3-hex' }) |
| 120 | + .expect(410); |
| 121 | + expect(res.text).toMatch(/API token/i); |
| 122 | + } finally { |
| 123 | + server.close(); |
| 124 | + } |
| 125 | + }); |
| 126 | + |
| 127 | + it('returns 403 when the local PubPub account is flagged as confirmed spam', async () => { |
| 128 | + const { restrictedUser } = models; |
| 129 | + const tag = await SpamTag.create({ |
| 130 | + userId: restrictedUser.id, |
| 131 | + status: 'confirmed-spam', |
| 132 | + spamScore: 100, |
| 133 | + spamScoreComputedAt: new Date(), |
| 134 | + fields: { manuallyMarkedBy: [] }, |
| 135 | + } as any); |
| 136 | + await User.update({ spamTagId: tag.id }, { where: { id: restrictedUser.id } }); |
| 137 | + |
| 138 | + vi.spyOn(globalThis, 'fetch').mockResolvedValue( |
| 139 | + jsonResponse({ verified: true, userId: restrictedUser.id }), |
| 140 | + ); |
| 141 | + |
| 142 | + const server = __appImmutableListenOnly.listen(); |
| 143 | + try { |
| 144 | + const res = await supertest(server) |
| 145 | + .post('/api/login') |
| 146 | + .send({ email: restrictedUser.email, password: 'sha3-hex' }) |
| 147 | + .expect(403); |
| 148 | + expect(res.text).toMatch(/restricted/i); |
| 149 | + } finally { |
| 150 | + server.close(); |
| 151 | + } |
| 152 | + }); |
| 153 | + |
| 154 | + it('auto-creates the local PubPub user when kf-auth returns an unknown id', async () => { |
| 155 | + const newId = crypto.randomUUID(); |
| 156 | + const newEmail = `${crypto.randomUUID()}@auto.created`; |
| 157 | + vi.spyOn(globalThis, 'fetch').mockResolvedValue( |
| 158 | + jsonResponse({ verified: true, userId: newId }), |
| 159 | + ); |
| 160 | + |
| 161 | + const before = await User.findOne({ where: { id: newId } }); |
| 162 | + expect(before).toBeNull(); |
| 163 | + |
| 164 | + const server = __appImmutableListenOnly.listen(); |
| 165 | + try { |
| 166 | + await supertest(server) |
| 167 | + .post('/api/login') |
| 168 | + .send({ email: newEmail, password: 'sha3-hex' }) |
| 169 | + .expect(201); |
| 170 | + } finally { |
| 171 | + server.close(); |
| 172 | + } |
| 173 | + |
| 174 | + const after = await User.findOne({ where: { id: newId } }); |
| 175 | + expect(after).not.toBeNull(); |
| 176 | + expect(after!.email).toBe(newEmail); |
| 177 | + }); |
| 178 | +}); |
0 commit comments