mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
test: coverage campaign and mutation testing across five packages (#628)
Coverage 83.6 to 87.36% lines, 81.63 to 84.14% branches. Mutation testing across five packages: image-engine 85, media-engine 92, doc-engine 87, shared+enterprise 86, apps/api security and jobs slice. Runs all five lanes weekly. Fixes the silently-broken mutation CI (babel pin), a redact-pdf envelope-shape test bug, an untested enterprise license valid-signature path, and an audit test that only exercised a hand-copied reproduction. Test and config only, no product code changes beyond the babel pin and one test-only oidc export. Full suite: 16,712 pass, 0 fail.
This commit is contained in:
SnapOtter
@@ -3,7 +3,7 @@
|
||||
* password-change side effects, register validation.
|
||||
*/
|
||||
|
||||
import { eq } from "drizzle-orm";
|
||||
import { asc, eq } from "drizzle-orm";
|
||||
import { afterAll, beforeAll, describe, expect, it } from "vitest";
|
||||
import { db, schema } from "../../../apps/api/src/db/index.js";
|
||||
import { buildTestApp, loginAsAdmin, type TestApp } from "../test-server.js";
|
||||
@@ -13,6 +13,19 @@ let adminToken: string;
|
||||
|
||||
const uid = () => `auth_test_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
|
||||
|
||||
// Upsert a global setting row (mirrors upsertSetting in settings-helpers).
|
||||
async function setSetting(key: string, value: string): Promise<void> {
|
||||
await db
|
||||
.insert(schema.settings)
|
||||
.values({ key, value })
|
||||
.onConflictDoUpdate({ target: schema.settings.key, set: { value } });
|
||||
}
|
||||
|
||||
// Remove a global setting row so it cannot bleed into sibling tests in the fork.
|
||||
async function clearSetting(key: string): Promise<void> {
|
||||
await db.delete(schema.settings).where(eq(schema.settings.key, key));
|
||||
}
|
||||
|
||||
beforeAll(async () => {
|
||||
testApp = await buildTestApp();
|
||||
adminToken = await loginAsAdmin(testApp.app);
|
||||
@@ -511,3 +524,564 @@ describe("Forced password change gate", () => {
|
||||
expect(after.statusCode).toBe(200);
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// DISABLED-USER PATHS (login, session endpoint, auth middleware)
|
||||
// A user whose role is prefixed "disabled:" is treated as deactivated.
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Disabled user paths", () => {
|
||||
it("login is rejected with 403 USER_DISABLED before any password check", async () => {
|
||||
const { username, password, id } = await createUser();
|
||||
await db.update(schema.users).set({ role: `disabled:user` }).where(eq(schema.users.id, id));
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/login",
|
||||
payload: { username, password },
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(403);
|
||||
expect(JSON.parse(res.body).code).toBe("USER_DISABLED");
|
||||
|
||||
// The failed attempt is audited with the disabled_user reason.
|
||||
const audit = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/v1/audit-log?action=LOGIN_FAILED&limit=100",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
});
|
||||
const entries = JSON.parse(audit.body).entries as Array<{
|
||||
action: string;
|
||||
details?: { username?: string; reason?: string };
|
||||
}>;
|
||||
const match = entries.find(
|
||||
(e) => e.details?.username === username && e.details?.reason === "disabled_user",
|
||||
);
|
||||
expect(match).toBeDefined();
|
||||
});
|
||||
|
||||
it("session endpoint denies and purges the session once the user is disabled", async () => {
|
||||
const { username, password, id } = await createUser();
|
||||
const token = await loginAs(username, password);
|
||||
|
||||
// Session works while active.
|
||||
const before = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: `Bearer ${token}` },
|
||||
});
|
||||
expect(before.statusCode).toBe(200);
|
||||
|
||||
await db.update(schema.users).set({ role: `disabled:user` }).where(eq(schema.users.id, id));
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: `Bearer ${token}` },
|
||||
});
|
||||
// The auth middleware rejects and purges a disabled user's session before
|
||||
// the route body runs, so a disabled user is denied (the route's own 403
|
||||
// branch is defense in depth behind the middleware).
|
||||
expect(res.statusCode).toBe(401);
|
||||
|
||||
// The session row is purged as a side effect.
|
||||
const [row] = await db.select().from(schema.sessions).where(eq(schema.sessions.id, token));
|
||||
expect(row).toBeUndefined();
|
||||
});
|
||||
|
||||
it("auth middleware 403s a protected route and purges the session for a disabled user", async () => {
|
||||
const { username, password, id } = await createUser();
|
||||
const token = await loginAs(username, password);
|
||||
|
||||
await db.update(schema.users).set({ role: `disabled:editor` }).where(eq(schema.users.id, id));
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/v1/api-keys",
|
||||
headers: { authorization: `Bearer ${token}` },
|
||||
});
|
||||
expect(res.statusCode).toBe(403);
|
||||
expect(JSON.parse(res.body).code).toBe("USER_DISABLED");
|
||||
|
||||
const [row] = await db.select().from(schema.sessions).where(eq(schema.sessions.id, token));
|
||||
expect(row).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// CONCURRENT SESSION LIMIT (FIFO eviction on login)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Concurrent session limit", () => {
|
||||
it("evicts the oldest sessions when maxSessionsPerUser is exceeded", async () => {
|
||||
const { username, password, id } = await createUser();
|
||||
|
||||
await setSetting("maxSessionsPerUser", "2");
|
||||
try {
|
||||
const t1 = await loginAs(username, password);
|
||||
const t2 = await loginAs(username, password);
|
||||
// Third login pushes the count to 3 > 2, so the single oldest is evicted.
|
||||
const t3 = await loginAs(username, password);
|
||||
|
||||
const remaining = await db
|
||||
.select({ id: schema.sessions.id })
|
||||
.from(schema.sessions)
|
||||
.where(eq(schema.sessions.userId, id))
|
||||
.orderBy(asc(schema.sessions.createdAt));
|
||||
const ids = remaining.map((r) => r.id);
|
||||
|
||||
// Exactly the cap survives, the newest token is always retained, and
|
||||
// precisely one of the two earlier tokens was evicted (FIFO). Asserting
|
||||
// on the count rather than a specific victim keeps this robust even if
|
||||
// t1 and t2 share a createdAt tick.
|
||||
expect(ids).toHaveLength(2);
|
||||
expect(ids).toContain(t3);
|
||||
const survivingEarlier = [t1, t2].filter((t) => ids.includes(t));
|
||||
expect(survivingEarlier).toHaveLength(1);
|
||||
|
||||
// The evicted earlier token no longer authenticates.
|
||||
const evictedToken = [t1, t2].find((t) => !ids.includes(t)) as string;
|
||||
const evicted = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: `Bearer ${evictedToken}` },
|
||||
});
|
||||
expect(evicted.statusCode).toBe(401);
|
||||
} finally {
|
||||
await clearSetting("maxSessionsPerUser");
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// IDLE TIMEOUT ENFORCEMENT (auth middleware)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Session idle timeout", () => {
|
||||
it("expires a session whose last activity predates the idle window", async () => {
|
||||
const { username, password } = await createUser();
|
||||
const token = await loginAs(username, password);
|
||||
|
||||
// Backdate lastActivity well beyond a 1-minute idle window. The token has
|
||||
// never hit a guarded route, so no Redis idle key exists -- the middleware
|
||||
// falls back to the Postgres lastActivity and finds it stale.
|
||||
await db
|
||||
.update(schema.sessions)
|
||||
.set({ lastActivity: new Date(Date.now() - 5 * 60 * 1000) })
|
||||
.where(eq(schema.sessions.id, token));
|
||||
|
||||
await setSetting("sessionIdleTimeoutMinutes", "1");
|
||||
try {
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/v1/api-keys",
|
||||
headers: { authorization: `Bearer ${token}` },
|
||||
});
|
||||
expect(res.statusCode).toBe(401);
|
||||
expect(JSON.parse(res.body).code).toBe("IDLE_TIMEOUT");
|
||||
|
||||
const [row] = await db.select().from(schema.sessions).where(eq(schema.sessions.id, token));
|
||||
expect(row).toBeUndefined();
|
||||
} finally {
|
||||
await clearSetting("sessionIdleTimeoutMinutes");
|
||||
}
|
||||
});
|
||||
|
||||
it("flushes lastActivity to Postgres on a fresh session within the idle window", async () => {
|
||||
const { username, password } = await createUser();
|
||||
const token = await loginAs(username, password);
|
||||
|
||||
// A brand-new session row has a null lastActivity.
|
||||
const [before] = await db
|
||||
.select({ lastActivity: schema.sessions.lastActivity })
|
||||
.from(schema.sessions)
|
||||
.where(eq(schema.sessions.id, token));
|
||||
expect(before.lastActivity).toBeNull();
|
||||
|
||||
await setSetting("sessionIdleTimeoutMinutes", "30");
|
||||
try {
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/v1/api-keys",
|
||||
headers: { authorization: `Bearer ${token}` },
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
|
||||
// On the cache miss the middleware writes lastActivity forward.
|
||||
const [after] = await db
|
||||
.select({ lastActivity: schema.sessions.lastActivity })
|
||||
.from(schema.sessions)
|
||||
.where(eq(schema.sessions.id, token));
|
||||
expect(after.lastActivity).not.toBeNull();
|
||||
} finally {
|
||||
await clearSetting("sessionIdleTimeoutMinutes");
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// MALFORMED / MISSING BEARER ON GUARDED ROUTES
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Bearer token extraction edge cases", () => {
|
||||
it("a non-Bearer Authorization header is treated as no token (401 on a guarded route)", async () => {
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/v1/api-keys",
|
||||
headers: { authorization: "Basic dXNlcjpwYXNz" },
|
||||
});
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
it("a Bearer token that matches no session is rejected on the session endpoint", async () => {
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: "Bearer not-a-real-session-token" },
|
||||
});
|
||||
expect(res.statusCode).toBe(401);
|
||||
expect(JSON.parse(res.body).error).toBe("Session expired or invalid");
|
||||
});
|
||||
|
||||
it("a non-si_ Bearer token on a guarded route falls through to 401 (not treated as an API key)", async () => {
|
||||
const res = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/v1/api-keys",
|
||||
headers: { authorization: "Bearer plain-garbage-token" },
|
||||
});
|
||||
expect(res.statusCode).toBe(401);
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// TEAM RESOLUTION BY ID (register + update paths)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Team resolution by id", () => {
|
||||
it("register resolves a team passed by id (not name)", async () => {
|
||||
const [defaultTeam] = await db
|
||||
.select()
|
||||
.from(schema.teams)
|
||||
.where(eq(schema.teams.name, "Default"));
|
||||
expect(defaultTeam).toBeDefined();
|
||||
|
||||
const username = uid();
|
||||
const res = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/register",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
// Passing the team id exercises the name-miss -> id-lookup fallback.
|
||||
payload: { username, password: "ValidPass1", team: defaultTeam.id },
|
||||
});
|
||||
expect(res.statusCode).toBe(201);
|
||||
expect(JSON.parse(res.body).team).toBe("Default");
|
||||
|
||||
const [row] = await db
|
||||
.select({ team: schema.users.team })
|
||||
.from(schema.users)
|
||||
.where(eq(schema.users.username, username));
|
||||
expect(row.team).toBe(defaultTeam.id);
|
||||
});
|
||||
|
||||
it("update resolves a team passed by id and persists it", async () => {
|
||||
const { id } = await createUser();
|
||||
const [defaultTeam] = await db
|
||||
.select()
|
||||
.from(schema.teams)
|
||||
.where(eq(schema.teams.name, "Default"));
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "PUT",
|
||||
url: `/api/auth/users/${id}`,
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { team: defaultTeam.id },
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
|
||||
const [row] = await db
|
||||
.select({ team: schema.users.team })
|
||||
.from(schema.users)
|
||||
.where(eq(schema.users.id, id));
|
||||
expect(row.team).toBe(defaultTeam.id);
|
||||
});
|
||||
|
||||
it("update with an unknown team returns 400 and does not touch the row", async () => {
|
||||
const { id } = await createUser();
|
||||
const [before] = await db.select().from(schema.users).where(eq(schema.users.id, id));
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "PUT",
|
||||
url: `/api/auth/users/${id}`,
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { team: `ghost_team_${Date.now()}` },
|
||||
});
|
||||
expect(res.statusCode).toBe(400);
|
||||
expect(JSON.parse(res.body).code).toBe("VALIDATION_ERROR");
|
||||
|
||||
const [after] = await db.select().from(schema.users).where(eq(schema.users.id, id));
|
||||
expect(after.team).toBe(before.team);
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// ADMIN USER-MANAGEMENT GUARDS (update / delete / reset authority + shape)
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Admin user-management guards", () => {
|
||||
it("update with an unknown role is a no-op (200, role unchanged)", async () => {
|
||||
const { id } = await createUser({ role: "user" });
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "PUT",
|
||||
url: `/api/auth/users/${id}`,
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { role: "totally-bogus-role" },
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
|
||||
const [row] = await db
|
||||
.select({ role: schema.users.role })
|
||||
.from(schema.users)
|
||||
.where(eq(schema.users.id, id));
|
||||
expect(row.role).toBe("user");
|
||||
});
|
||||
|
||||
it("update against an unknown user id returns 404", async () => {
|
||||
const res = await testApp.app.inject({
|
||||
method: "PUT",
|
||||
url: "/api/auth/users/00000000-0000-0000-0000-000000000000",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { role: "editor" },
|
||||
});
|
||||
expect(res.statusCode).toBe(404);
|
||||
expect(JSON.parse(res.body).code).toBe("NOT_FOUND");
|
||||
});
|
||||
|
||||
it("promoting a user to editor invalidates the target's existing sessions", async () => {
|
||||
const { username, password, id } = await createUser({ role: "user" });
|
||||
const targetToken = await loginAs(username, password);
|
||||
|
||||
// Session valid before the role change.
|
||||
const before = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: `Bearer ${targetToken}` },
|
||||
});
|
||||
expect(before.statusCode).toBe(200);
|
||||
|
||||
const upd = await testApp.app.inject({
|
||||
method: "PUT",
|
||||
url: `/api/auth/users/${id}`,
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { role: "editor" },
|
||||
});
|
||||
expect(upd.statusCode).toBe(200);
|
||||
|
||||
const remaining = await db.select().from(schema.sessions).where(eq(schema.sessions.userId, id));
|
||||
expect(remaining).toHaveLength(0);
|
||||
|
||||
const after = await testApp.app.inject({
|
||||
method: "GET",
|
||||
url: "/api/auth/session",
|
||||
headers: { authorization: `Bearer ${targetToken}` },
|
||||
});
|
||||
expect(after.statusCode).toBe(401);
|
||||
});
|
||||
|
||||
it("delete authority: a below-admin users:manage actor cannot delete an admin", async () => {
|
||||
// Custom role that holds users:manage but sits below admin in the hierarchy.
|
||||
const roleName = `delmgr_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
|
||||
const roleRes = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/roles",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { name: roleName, permissions: ["users:manage"] },
|
||||
});
|
||||
expect(roleRes.statusCode, roleRes.body).toBe(201);
|
||||
|
||||
const target = await createUser({ role: "admin" });
|
||||
const managerName = uid();
|
||||
const managerPassword = "DelMgrPass1";
|
||||
const reg = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/register",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { username: managerName, password: managerPassword, role: roleName },
|
||||
});
|
||||
expect(reg.statusCode, reg.body).toBe(201);
|
||||
await db
|
||||
.update(schema.users)
|
||||
.set({ mustChangePassword: false })
|
||||
.where(eq(schema.users.username, managerName));
|
||||
const managerToken = await loginAs(managerName, managerPassword);
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "DELETE",
|
||||
url: `/api/auth/users/${target.id}`,
|
||||
headers: { authorization: `Bearer ${managerToken}` },
|
||||
});
|
||||
// Past the users:manage gate, but the target outranks the actor.
|
||||
expect(res.statusCode).toBe(403);
|
||||
expect(JSON.parse(res.body).code).toBe("ESCALATION_DENIED");
|
||||
|
||||
// The target admin still exists.
|
||||
const [row] = await db.select().from(schema.users).where(eq(schema.users.id, target.id));
|
||||
expect(row).toBeDefined();
|
||||
});
|
||||
|
||||
it("admin can delete a normal user and cascades their sessions", async () => {
|
||||
const { username, password, id } = await createUser({ role: "user" });
|
||||
await loginAs(username, password);
|
||||
|
||||
const sessionsBefore = await db
|
||||
.select()
|
||||
.from(schema.sessions)
|
||||
.where(eq(schema.sessions.userId, id));
|
||||
expect(sessionsBefore.length).toBeGreaterThan(0);
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "DELETE",
|
||||
url: `/api/auth/users/${id}`,
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
});
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(JSON.parse(res.body).ok).toBe(true);
|
||||
|
||||
const [userRow] = await db.select().from(schema.users).where(eq(schema.users.id, id));
|
||||
expect(userRow).toBeUndefined();
|
||||
const sessionsAfter = await db
|
||||
.select()
|
||||
.from(schema.sessions)
|
||||
.where(eq(schema.sessions.userId, id));
|
||||
expect(sessionsAfter).toHaveLength(0);
|
||||
});
|
||||
|
||||
it("reset-password against an unknown user id returns 404", async () => {
|
||||
const res = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/users/00000000-0000-0000-0000-000000000000/reset-password",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { newPassword: "ResetValid1" },
|
||||
});
|
||||
expect(res.statusCode).toBe(404);
|
||||
expect(JSON.parse(res.body).code).toBe("NOT_FOUND");
|
||||
});
|
||||
|
||||
it("reset-password with a weak new password returns 400", async () => {
|
||||
const { id } = await createUser();
|
||||
const res = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: `/api/auth/users/${id}/reset-password`,
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { newPassword: "weak" },
|
||||
});
|
||||
expect(res.statusCode).toBe(400);
|
||||
expect(JSON.parse(res.body).code).toBe("VALIDATION_ERROR");
|
||||
});
|
||||
|
||||
it("reset-password on a passwordless (OIDC/SSO) user returns 400 OIDC_NO_PASSWORD", async () => {
|
||||
const { id } = await createUser();
|
||||
// Null out the local password hash to emulate an externally-provisioned user.
|
||||
await db.update(schema.users).set({ passwordHash: null }).where(eq(schema.users.id, id));
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: `/api/auth/users/${id}/reset-password`,
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { newPassword: "ResetValid1" },
|
||||
});
|
||||
expect(res.statusCode).toBe(400);
|
||||
expect(JSON.parse(res.body).code).toBe("OIDC_NO_PASSWORD");
|
||||
});
|
||||
|
||||
it("change-password on a passwordless account returns 400 OIDC_NO_PASSWORD", async () => {
|
||||
const { username, password, id } = await createUser();
|
||||
const token = await loginAs(username, password);
|
||||
// Strip the password hash after the session exists.
|
||||
await db.update(schema.users).set({ passwordHash: null }).where(eq(schema.users.id, id));
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/change-password",
|
||||
headers: { authorization: `Bearer ${token}` },
|
||||
payload: { currentPassword: password, newPassword: "NewValid9" },
|
||||
});
|
||||
expect(res.statusCode).toBe(400);
|
||||
expect(JSON.parse(res.body).code).toBe("OIDC_NO_PASSWORD");
|
||||
});
|
||||
|
||||
it("change-password with a wrong current password returns 401 INVALID_PASSWORD", async () => {
|
||||
const { username, password } = await createUser();
|
||||
const token = await loginAs(username, password);
|
||||
|
||||
const res = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/change-password",
|
||||
headers: { authorization: `Bearer ${token}` },
|
||||
payload: { currentPassword: "TotallyWrong1", newPassword: "NewValid9" },
|
||||
});
|
||||
expect(res.statusCode).toBe(401);
|
||||
expect(JSON.parse(res.body).code).toBe("INVALID_PASSWORD");
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// REGISTER: role authority for a custom users:manage actor
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("Register role authority", () => {
|
||||
it("a users:manage actor below admin cannot create an admin (403 ESCALATION_DENIED)", async () => {
|
||||
// Build a custom role that can manage users but is not admin-level.
|
||||
const roleName = `usrmgr_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`;
|
||||
const roleRes = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/v1/roles",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { name: roleName, permissions: ["users:manage"] },
|
||||
});
|
||||
expect(roleRes.statusCode, roleRes.body).toBe(201);
|
||||
|
||||
const managerName = uid();
|
||||
const managerPassword = "ManagerPass1";
|
||||
const reg = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/register",
|
||||
headers: { authorization: `Bearer ${adminToken}` },
|
||||
payload: { username: managerName, password: managerPassword, role: roleName },
|
||||
});
|
||||
expect(reg.statusCode, reg.body).toBe(201);
|
||||
await db
|
||||
.update(schema.users)
|
||||
.set({ mustChangePassword: false })
|
||||
.where(eq(schema.users.username, managerName));
|
||||
const managerToken = await loginAs(managerName, managerPassword);
|
||||
|
||||
// The manager tries to create an admin -- above its authority.
|
||||
const escalate = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/register",
|
||||
headers: { authorization: `Bearer ${managerToken}` },
|
||||
payload: { username: uid(), password: "ValidPass1", role: "admin" },
|
||||
});
|
||||
expect(escalate.statusCode).toBe(403);
|
||||
expect(JSON.parse(escalate.body).code).toBe("ESCALATION_DENIED");
|
||||
});
|
||||
});
|
||||
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
// SSO ENFORCEMENT SETTING WITHOUT THE ENTERPRISE FEATURE
|
||||
// The setting alone must not block local login when sso_enforcement is unlicensed.
|
||||
// ═══════════════════════════════════════════════════════════════════════════
|
||||
describe("SSO enforcement without license", () => {
|
||||
it("local login still works when ssoEnforcement is on but the feature is unlicensed", async () => {
|
||||
const { username, password } = await createUser();
|
||||
|
||||
await setSetting("ssoEnforcement", "true");
|
||||
try {
|
||||
const res = await testApp.app.inject({
|
||||
method: "POST",
|
||||
url: "/api/auth/login",
|
||||
payload: { username, password },
|
||||
});
|
||||
// Enterprise is not licensed in this plain harness, so isFeatureEnabled
|
||||
// is false and the enforcement branch is skipped -- login proceeds.
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(JSON.parse(res.body).token).toBeTruthy();
|
||||
} finally {
|
||||
await clearSetting("ssoEnforcement");
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user