swaf/test/Authentication.test.ts

1031 lines
36 KiB
TypeScript
Raw Normal View History

import TestApp from "../src/TestApp";
import useApp from "./_app";
import Controller from "../src/Controller";
import supertest from "supertest";
import CsrfProtectionComponent from "../src/components/CsrfProtectionComponent";
import User from "../src/auth/models/User";
import UserNameComponent from "../src/auth/models/UserNameComponent";
import UserPasswordComponent from "../src/auth/password/UserPasswordComponent";
import {popEmail} from "./_mail_server";
import AuthComponent from "../src/auth/AuthComponent";
import {followMagicLinkFromMail, testLogout} from "./_authentication_common";
import UserEmail from "../src/auth/models/UserEmail";
let app: TestApp;
useApp(async (addr, port) => {
return app = new class extends TestApp {
protected async init(): Promise<void> {
this.use(new class extends Controller {
public routes(): void {
this.get('/', (req, res) => {
res.render('home');
}, 'home');
this.get('/csrf', (req, res) => {
res.send(CsrfProtectionComponent.getCsrfToken(req.getSession()));
}, 'csrf');
this.get('/is-auth', async (req, res) => {
const proofs = await this.getApp().as(AuthComponent).getAuthGuard().getProofs(req);
if (proofs.length > 0) res.sendStatus(200);
else res.sendStatus(401);
}, 'is-auth');
}
}());
await super.init();
}
}(addr, port);
});
let agent: supertest.SuperTest<supertest.Test>;
beforeAll(() => {
agent = supertest(app.getExpressApp());
});
describe('Register with username and password (password)', () => {
let cookies: string[];
let csrf: string;
test('General case', async () => {
const res = await agent.get('/csrf').expect(200);
cookies = res.get('Set-Cookie');
csrf = res.text;
// Register user
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'password',
identifier: 'entrapta',
password: 'darla_is_cute',
password_confirmation: 'darla_is_cute',
terms: 'on',
})
.expect(302)
.expect('Location', '/');
// Verify saved user
const user = await User.select()
.where('name', 'entrapta')
.first();
expect(user).toBeDefined();
expect(user?.as(UserNameComponent).name).toStrictEqual('entrapta');
await expect(user?.as(UserPasswordComponent).verifyPassword('darla_is_cute')).resolves.toStrictEqual(true);
});
test('Can\'t register when logged in', async () => {
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'password',
identifier: 'entrapta2',
password: 'darla_is_cute',
password_confirmation: 'darla_is_cute',
terms: 'on',
})
.expect(302)
.expect('Location', '/csrf');
const user2 = await User.select()
.where('name', 'entrapta2')
.first();
expect(user2).toBeNull();
});
test('Logout', async () => {
await testLogout(agent, cookies, csrf);
});
test('Cannot register taken username', async () => {
// Check that there is no hordak in DB
expect(await User.select()
.where('name', 'hordak')
.count()).toStrictEqual(0);
const res1 = await agent.get('/csrf').expect(200);
const cookies = res1.get('Set-Cookie');
const csrf = res1.text;
// Register user
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'password',
identifier: 'hordak',
password: 'horde_prime_will_rise',
password_confirmation: 'horde_prime_will_rise',
terms: 'on',
})
.expect(302)
.expect('Location', '/');
await testLogout(agent, cookies, csrf);
// Verify saved user
expect(await User.select()
.where('name', 'hordak')
.count()).toStrictEqual(1);
// Attempt register same user
const res = await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'password',
identifier: 'hordak',
password: 'horde_prime_will_rise_unless',
password_confirmation: 'horde_prime_will_rise_unless',
terms: 'on',
})
.expect(400);
// username field should be translated from identifier
expect(res.body.messages?.identifier?.name).toStrictEqual('AlreadyExistsValidationError');
// Verify nothing changed
expect(await User.select()
.where('name', 'hordak')
.count()).toStrictEqual(1);
});
});
describe('Register with email (magic_link)', () => {
test('General case', async () => {
const res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'magic_link',
identifier: 'glimmer@example.org',
name: 'glimmer',
})
.expect(302)
.expect('Location', '/magic/lobby?redirect_uri=%2Fcsrf');
await followMagicLinkFromMail(agent, cookies);
await testLogout(agent, cookies, csrf);
// Verify saved user
const user = await User.select()
.with('mainEmail')
.where('name', 'glimmer')
.first();
expect(user).toBeDefined();
const email = user?.mainEmail.getOrFail();
expect(email).toBeDefined();
expect(email?.email).toStrictEqual('glimmer@example.org');
expect(user?.as(UserNameComponent).name).toStrictEqual('glimmer');
await expect(user?.as(UserPasswordComponent).verifyPassword('')).resolves.toStrictEqual(false);
});
test('Cannot register without specifying username', async () => {
let res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
res = await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'magic_link',
identifier: 'no_user_name@example.org',
})
.expect(400);
expect(res.body.messages?.name?.name).toStrictEqual('UndefinedValueValidationError');
expect(await popEmail()).toBeNull();
});
test('Cannot register taken username', async () => {
const res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'magic_link',
identifier: 'angella@example.org',
name: 'angella',
})
.expect(302)
.expect('Location', '/magic/lobby?redirect_uri=%2Fcsrf');
await followMagicLinkFromMail(agent, cookies);
await testLogout(agent, cookies, csrf);
// Verify saved user
const user = await User.select()
.with('mainEmail')
.where('name', 'angella')
.first();
expect(user).toBeDefined();
// Attempt register with another mail but same username
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'magic_link',
identifier: 'angella_something_else@example.org',
name: 'angella',
})
.expect(400);
expect(await popEmail()).toBeNull();
});
test('Cannot register taken email', async () => {
const res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'magic_link',
identifier: 'bow@example.org',
name: 'bow',
})
.expect(302)
.expect('Location', '/magic/lobby?redirect_uri=%2Fcsrf');
await followMagicLinkFromMail(agent, cookies);
await testLogout(agent, cookies, csrf);
// Verify saved user
const user = await User.select()
.with('mainEmail')
.where('name', 'bow')
.first();
expect(user).toBeDefined();
// Attempt register with another mail but same username
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'magic_link',
identifier: 'bow@example.org',
name: 'bow2',
})
.expect(400);
expect(await popEmail()).toBeNull();
});
});
describe('Authenticate with username and password (password)', () => {
test('Force auth_method', async () => {
let res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Bad password
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'entrapta',
password: 'darla_is_not_cute',
auth_method: 'password',
})
.expect(400);
expect(res.body.messages?.password?.name).toStrictEqual('InvalidFormatValidationError');
// Authenticate
await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'entrapta',
password: 'darla_is_cute',
auth_method: 'password',
})
.expect(302)
.expect('Location', '/');
await testLogout(agent, cookies, csrf);
});
test('Automatic auth_method', async () => {
let res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Bad password
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'entrapta',
password: 'darla_is_not_cute',
})
.expect(400);
expect(res.body.messages?.password?.name).toStrictEqual('InvalidFormatValidationError');
// Authenticate
await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'entrapta',
password: 'darla_is_cute',
})
.expect(302)
.expect('Location', '/');
await testLogout(agent, cookies, csrf);
});
test('Non-existing username', async () => {
let res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Authenticate
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'i_do_not_exist',
password: 'there_is_no_point',
auth_method: 'password',
})
.expect(400);
expect(res.body.messages?.identifier?.name).toStrictEqual('UnknownRelationValidationError');
// Authenticate (automatic method)
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'i_do_not_exist',
password: 'there_is_no_point',
auth_method: 'password',
})
.expect(400);
expect(res.body.messages?.identifier?.name).toStrictEqual('UnknownRelationValidationError');
});
test('No password user', async () => {
let res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Authenticate
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'glimmer',
password: '',
auth_method: 'password',
})
.expect(400);
expect(res.body.messages?.password?.name).toStrictEqual('InvalidFormatValidationError');
// Authenticate (automatic method)
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'glimmer',
password: '',
})
.expect(400);
expect(res.body.messages?.password?.name).toStrictEqual('InvalidFormatValidationError');
// Authenticate without password
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'angella',
auth_method: 'password',
})
.expect(400);
expect(res.body.messages?.password?.name).toStrictEqual('InvalidFormatValidationError');
// Authenticate without password (automatic method)
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'angella',
})
.expect(400);
expect(res.body.messages?.password?.name).toStrictEqual('InvalidFormatValidationError');
});
});
describe('Authenticate with email (magic_link)', () => {
test('Force auth_method', async () => {
const res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Authenticate
await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'glimmer@example.org',
auth_method: 'magic_link',
})
.expect(302)
.expect('Location', '/magic/lobby?redirect_uri=%2Fcsrf');
await followMagicLinkFromMail(agent, cookies);
await testLogout(agent, cookies, csrf);
});
test('Automatic auth_method', async () => {
const res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Authenticate
await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'angella@example.org',
})
.expect(302)
.expect('Location', '/magic/lobby?redirect_uri=%2Fcsrf');
await followMagicLinkFromMail(agent, cookies);
await testLogout(agent, cookies, csrf);
});
test('Non-existing email (forced auth_method)', async () => {
let res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Authenticate
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'i_do_not_exist@invalid.org',
auth_method: 'magic_link',
})
.expect(400);
expect(res.body.messages?.identifier?.name).toStrictEqual('UnknownRelationValidationError');
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
});
test('Non-existing email (automatic auth_method)', async () => {
let res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Authenticate
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'i_do_not_exist@invalid.org',
})
.expect(400);
expect(res.body.messages?.identifier?.name).toStrictEqual('UnknownRelationValidationError');
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
});
});
describe('Authenticate with email and password (password)', () => {
test('Prepare user', async () => {
const res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'magic_link',
identifier: 'double-trouble@example.org',
name: 'double-trouble',
})
.expect(302)
.expect('Location', '/magic/lobby?redirect_uri=%2Fcsrf');
await followMagicLinkFromMail(agent, cookies);
await testLogout(agent, cookies, csrf);
// Verify saved user
const user = await User.select()
.with('mainEmail')
.where('name', 'double-trouble')
.first();
await user?.as(UserPasswordComponent).setPassword('trick-or-treat');
await user?.save();
expect(user).toBeDefined();
const email = user?.mainEmail.getOrFail();
expect(email).toBeDefined();
expect(email?.email).toStrictEqual('double-trouble@example.org');
expect(user?.as(UserNameComponent).name).toStrictEqual('double-trouble');
await expect(user?.as(UserPasswordComponent).verifyPassword('trick-or-treat')).resolves.toStrictEqual(true);
});
test('Force auth_method', async () => {
let res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Bad password
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'double-trouble@example.org',
password: 'i_have_no_imagination',
auth_method: 'password',
})
.expect(400);
expect(res.body.messages?.password?.name).toStrictEqual('InvalidFormatValidationError');
// Authenticate
await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'double-trouble@example.org',
password: 'trick-or-treat',
auth_method: 'password',
})
.expect(302)
.expect('Location', '/');
await testLogout(agent, cookies, csrf);
});
test('Automatic auth_method', async () => {
let res = await agent.get('/csrf').expect(200);
const cookies = res.get('Set-Cookie');
const csrf = res.text;
// Not authenticated
await agent.get('/is-auth').set('Cookie', cookies).expect(401);
// Bad password
res = await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'double-trouble@example.org',
password: 'i_have_no_imagination',
})
.expect(400);
expect(res.body.messages?.password?.name).toStrictEqual('InvalidFormatValidationError');
// Authenticate
await agent.post('/auth/login')
.set('Cookie', cookies)
.send({
csrf: csrf,
identifier: 'double-trouble@example.org',
password: 'trick-or-treat',
})
.expect(302)
.expect('Location', '/');
await testLogout(agent, cookies, csrf);
});
});
describe('Change password', () => {
let cookies: string[], csrf: string;
test('Prepare user', async () => {
const res = await agent.get('/csrf').expect(200);
cookies = res.get('Set-Cookie');
csrf = res.text;
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'magic_link',
identifier: 'aang@example.org',
name: 'aang',
})
.expect(302)
.expect('Location', '/magic/lobby?redirect_uri=%2Fcsrf');
await followMagicLinkFromMail(agent, cookies);
});
test('Set password to blank from blank', async () => {
await agent.post('/account/change-password')
.set('Cookie', cookies)
.send({
csrf: csrf,
'current_password': '',
'new_password': '',
'new_password_confirmation': '',
})
.expect(400);
const user = await User.select()
.where('name', 'aang')
.first();
expect(user).toBeDefined();
expect(user?.as(UserPasswordComponent).hasPassword()).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('bad_password')).toBeFalsy();
});
test('Set password to something from blank', async () => {
await agent.post('/account/change-password')
.set('Cookie', cookies)
.send({
csrf: csrf,
'current_password': '',
'new_password': 'a_very_strong_password',
'new_password_confirmation': 'a_very_strong_password',
})
.expect(302)
.expect('Location', '/csrf'); // TODO: because of buggy RedirectBackComponent, change to /account once fixed.
const user = await User.select()
.where('name', 'aang')
.first();
expect(user).toBeDefined();
expect(user?.as(UserPasswordComponent).hasPassword()).toBeTruthy();
expect(await user?.as(UserPasswordComponent).verifyPassword('')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('bad_password')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('a_very_strong_password')).toBeTruthy();
});
test('Set password to blank from something', async () => {
await agent.post('/account/change-password')
.set('Cookie', cookies)
.send({
csrf: csrf,
'current_password': 'a_very_strong_password',
'new_password': '',
})
.expect(400);
const user = await User.select()
.where('name', 'aang')
.first();
expect(user).toBeDefined();
expect(user?.as(UserPasswordComponent).hasPassword()).toBeTruthy();
expect(await user?.as(UserPasswordComponent).verifyPassword('')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('bad_password')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('a_very_strong_password')).toBeTruthy();
});
test('Set password to something from something', async () => {
await agent.post('/account/change-password')
.set('Cookie', cookies)
.send({
csrf: csrf,
'current_password': 'a_very_strong_password',
'new_password': 'a_very_strong_password_but_different',
'new_password_confirmation': 'a_very_strong_password_but_different',
})
.expect(302)
.expect('Location', '/csrf'); // TODO: because of buggy RedirectBackComponent, change to /account once fixed.
const user = await User.select()
.where('name', 'aang')
.first();
expect(user).toBeDefined();
expect(user?.as(UserPasswordComponent).hasPassword()).toBeTruthy();
expect(await user?.as(UserPasswordComponent).verifyPassword('')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('bad_password')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('a_very_strong_password')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('a_very_strong_password_but_different')).toBeTruthy();
});
test('Set password to unconfirmed', async () => {
await agent.post('/account/change-password')
.set('Cookie', cookies)
.send({
csrf: csrf,
'current_password': 'a_very_strong_password_but_different',
'new_password': 'a_very_strong_password',
'new_password_confirmation': '',
})
.expect(400);
await agent.post('/account/change-password')
.set('Cookie', cookies)
.send({
csrf: csrf,
'current_password': 'a_very_strong_password_but_different',
'new_password': 'a_very_strong_password',
'new_password_confirmation': 'a_very_strong_password_but_different2',
})
.expect(400);
const user = await User.select()
.where('name', 'aang')
.first();
expect(user).toBeDefined();
expect(user?.as(UserPasswordComponent).hasPassword()).toBeTruthy();
expect(await user?.as(UserPasswordComponent).verifyPassword('bad_password')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('a_very_strong_password')).toBeFalsy();
expect(await user?.as(UserPasswordComponent).verifyPassword('a_very_strong_password_but_different')).toBeTruthy();
expect(await user?.as(UserPasswordComponent).verifyPassword('a_very_strong_password_but_different2')).toBeFalsy();
});
test('Set password to too short password', async () => {
await agent.post('/account/change-password')
.set('Cookie', cookies)
.send({
csrf: csrf,
'current_password': 'a_very_strong_password_but_different',
'new_password': '123',
'new_password_confirmation': '123',
})
.expect(400);
const user = await User.select()
.where('name', 'aang')
.first();
expect(user).toBeDefined();
expect(user?.as(UserPasswordComponent).hasPassword()).toBeTruthy();
expect(await user?.as(UserPasswordComponent).verifyPassword('a_very_strong_password_but_different')).toBeTruthy();
expect(await user?.as(UserPasswordComponent).verifyPassword('123')).toBeFalsy();
});
});
describe('Manage email addresses', () => {
async function testMainSecondaryState(main: string, secondary: string) {
const user = await User.select('main_email_id').where('name', 'katara').first();
const mainEmail = await UserEmail.select().where('email', main).first();
expect(mainEmail).not.toBeNull();
expect(user?.main_email_id).toBe(mainEmail?.id);
const secondaryEmail = await UserEmail.select().where('email', secondary).first();
expect(secondaryEmail).not.toBeNull();
expect(user?.main_email_id).not.toBe(secondaryEmail?.id);
return secondaryEmail;
}
let cookies: string[], csrf: string;
test('Prepare user', async () => {
const res = await agent.get('/csrf').expect(200);
cookies = res.get('Set-Cookie');
csrf = res.text;
await agent.post('/auth/register')
.set('Cookie', cookies)
.send({
csrf: csrf,
auth_method: 'magic_link',
identifier: 'katara@example.org',
name: 'katara',
})
.expect(302)
.expect('Location', '/magic/lobby?redirect_uri=%2Fcsrf');
await followMagicLinkFromMail(agent, cookies);
// Add fake, not owned secondary email
const user = User.create({
name: 'not_katara',
});
await user.save();
await UserEmail.create({
email: 'not_katara@example.org',
user_id: user.id,
}).save();
});
describe('Add', () => {
test('Add invalid email addresses', async () => {
await agent.post('/account/add-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
})
.expect(400);
await agent.post('/account/add-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
email: '',
})
.expect(400);
await agent.post('/account/add-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
email: 'katara@example.org',
})
.expect(400);
expect(await UserEmail.select().where('email', 'katara@example.org').count()).toBe(1);
});
test('Add valid email addresses', async () => {
const expectedUserId = (await User.select('id').where('name', 'katara').first())?.id;
for (const email of [
'katara2@example.org',
'katara3@example.org',
'katara4@example.org',
]) {
await agent.post('/account/add-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
email: email,
})
.expect(302)
.expect('Location', '/magic/lobby?redirect_uri=%2Faccount%2F');
await followMagicLinkFromMail(agent, cookies, '/account/');
const userEmail = await UserEmail.select().where('email', email).first();
expect(userEmail).not.toBeNull();
expect(userEmail?.user_id).toBe(expectedUserId);
}
});
});
describe('Set main', () => {
test('Set main email address as main email address', async () => {
await testMainSecondaryState('katara@example.org', 'katara3@example.org');
// Set secondary as main
await agent.post('/account/set-main-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
id: (await UserEmail.select().where('email', 'katara@example.org').first())?.id,
})
.expect(400);
await testMainSecondaryState('katara@example.org', 'katara3@example.org');
});
test('Set secondary email address as main email address', async () => {
const beforeSecondaryEmail = await testMainSecondaryState('katara@example.org', 'katara3@example.org');
// Set secondary as main
await agent.post('/account/set-main-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
id: beforeSecondaryEmail?.id,
})
.expect(302)
.expect('Location', '/csrf'); // TODO: because of buggy RedirectBackComponent, change to /account once fixed.
await testMainSecondaryState('katara3@example.org', 'katara@example.org');
});
test('Set non-owned address as main email address', async () => {
const beforeSecondaryEmail = await testMainSecondaryState('katara3@example.org', 'not_katara@example.org');
// Set secondary as main
await agent.post('/account/set-main-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
id: beforeSecondaryEmail?.id,
})
.expect(403);
await testMainSecondaryState('katara3@example.org', 'not_katara@example.org');
});
test('Set non-existing address as main email address', async () => {
await testMainSecondaryState('katara3@example.org', 'katara4@example.org');
// Set secondary as main
await agent.post('/account/set-main-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
id: 999,
})
.expect(404);
await testMainSecondaryState('katara3@example.org', 'katara4@example.org');
});
});
describe('Remove', () => {
test('Remove secondary email address', async () => {
expect(await UserEmail.select().where('email', 'katara2@example.org').count()).toBe(1);
// Set secondary as main
await agent.post('/account/remove-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
id: (await UserEmail.select().where('email', 'katara2@example.org').first())?.id,
})
.expect(302)
.expect('Location', '/csrf'); // TODO: because of buggy RedirectBackComponent, change to /account once fixed.
expect(await UserEmail.select().where('email', 'katara2@example.org').count()).toBe(0);
});
test('Remove non-owned email address', async () => {
expect(await UserEmail.select().where('email', 'not_katara@example.org').count()).toBe(1);
// Set secondary as main
await agent.post('/account/remove-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
id: (await UserEmail.select().where('email', 'not_katara@example.org').first())?.id,
})
.expect(403);
expect(await UserEmail.select().where('email', 'not_katara@example.org').count()).toBe(1);
});
test('Remove non-existing email address', async () => {
// Set secondary as main
await agent.post('/account/remove-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
id: 999,
})
.expect(404);
});
test('Remove main email address', async () => {
expect(await UserEmail.select().where('email', 'katara3@example.org').count()).toBe(1);
// Set secondary as main
await agent.post('/account/remove-email')
.set('Cookie', cookies)
.send({
csrf: csrf,
id: (await UserEmail.select().where('email', 'katara3@example.org').first())?.id,
})
.expect(400);
expect(await UserEmail.select().where('email', 'katara3@example.org').count()).toBe(1);
});
});
});