mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
1f8a42e548
Centralize role-authority enforcement across user management, role management, configuration import, SCIM, GDPR, and MFA mutations. Add regression coverage for delegated custom roles and protect higher-privilege accounts from reset, deletion, or takeover.
678 lines
24 KiB
TypeScript
678 lines
24 KiB
TypeScript
import { eq } from "drizzle-orm";
|
|
import { afterAll, beforeAll, describe, expect, it } from "vitest";
|
|
import { db, schema } from "../../../apps/api/src/db/index.js";
|
|
import { buildTestApp, loginAsAdmin, type TestApp } from "../test-server.js";
|
|
|
|
let testApp: TestApp;
|
|
let adminToken: string;
|
|
let userSequence = 0;
|
|
|
|
const BASE_USER_PERMISSIONS = [
|
|
"tools:use",
|
|
"files:own",
|
|
"apikeys:own",
|
|
"pipelines:own",
|
|
"settings:read",
|
|
];
|
|
|
|
const ADMIN_PERMISSIONS = [
|
|
"tools:use",
|
|
"files:own",
|
|
"files:all",
|
|
"apikeys:own",
|
|
"apikeys:all",
|
|
"pipelines:own",
|
|
"pipelines:all",
|
|
"settings:read",
|
|
"settings:write",
|
|
"users:manage",
|
|
"teams:manage",
|
|
"features:manage",
|
|
"system:health",
|
|
"audit:read",
|
|
"compliance:manage",
|
|
"webhooks:manage",
|
|
"security:manage",
|
|
];
|
|
|
|
beforeAll(async () => {
|
|
testApp = await buildTestApp();
|
|
adminToken = await loginAsAdmin(testApp.app);
|
|
}, 30_000);
|
|
|
|
afterAll(async () => {
|
|
await testApp.cleanup();
|
|
}, 10_000);
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Helpers
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/** Create a custom role and return its id. */
|
|
async function createRole(
|
|
name: string,
|
|
permissions: string[],
|
|
description?: string,
|
|
): Promise<string> {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/roles",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { name, permissions, description },
|
|
});
|
|
const body = JSON.parse(res.body);
|
|
if (res.statusCode !== 201) {
|
|
throw new Error(`createRole failed (${res.statusCode}): ${res.body}`);
|
|
}
|
|
return body.id as string;
|
|
}
|
|
|
|
/** Register a user, clear mustChangePassword, return a session token. */
|
|
async function createUserAndLogin(
|
|
username: string,
|
|
password: string,
|
|
role: string,
|
|
): Promise<string> {
|
|
const registerRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/register",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { username, password, role },
|
|
});
|
|
if (registerRes.statusCode !== 201) {
|
|
throw new Error(
|
|
`createUserAndLogin registration failed (${registerRes.statusCode}): ${registerRes.body}`,
|
|
);
|
|
}
|
|
await db
|
|
.update(schema.users)
|
|
.set({ mustChangePassword: false })
|
|
.where(eq(schema.users.username, username));
|
|
|
|
const loginRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username, password },
|
|
});
|
|
return JSON.parse(loginRes.body).token as string;
|
|
}
|
|
|
|
async function createTargetUser(
|
|
prefix: string,
|
|
role: string,
|
|
options: { mfaEnabled?: boolean } = {},
|
|
): Promise<{ id: string; password: string; username: string }> {
|
|
userSequence += 1;
|
|
const username = `${prefix}-${Date.now()}-${userSequence}`;
|
|
const password = "TargetPass1";
|
|
const registerRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/register",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { username, password, role },
|
|
});
|
|
if (registerRes.statusCode !== 201) {
|
|
throw new Error(`createTargetUser failed (${registerRes.statusCode}): ${registerRes.body}`);
|
|
}
|
|
|
|
const id = JSON.parse(registerRes.body).id as string;
|
|
await db
|
|
.update(schema.users)
|
|
.set({
|
|
mustChangePassword: false,
|
|
...(options.mfaEnabled
|
|
? {
|
|
totpEnabled: true,
|
|
totpSecret: "target-authority-test-secret",
|
|
recoveryCodesHash: "target-authority-test-recovery-codes",
|
|
}
|
|
: {}),
|
|
})
|
|
.where(eq(schema.users.id, id));
|
|
|
|
return { id, password, username };
|
|
}
|
|
|
|
async function getUserById(id: string) {
|
|
const [user] = await db.select().from(schema.users).where(eq(schema.users.id, id));
|
|
return user;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Name validation (5 tests)
|
|
// ---------------------------------------------------------------------------
|
|
describe("name validation", () => {
|
|
it("rejects name shorter than 2 chars", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/roles",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { name: "x", permissions: ["tools:use"] },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
});
|
|
|
|
it("rejects name longer than 30 chars", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/roles",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { name: "a".repeat(31), permissions: ["tools:use"] },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
});
|
|
|
|
it("rejects name with spaces", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/roles",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { name: "bad role", permissions: ["tools:use"] },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
});
|
|
|
|
it("normalizes uppercase to lowercase", async () => {
|
|
const suffix = Date.now();
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/roles",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { name: `UpperCase${suffix}`, permissions: ["tools:use"] },
|
|
});
|
|
expect(res.statusCode).toBe(201);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.name).toBe(`uppercase${suffix}`);
|
|
});
|
|
|
|
it("accepts hyphen and underscore", async () => {
|
|
const suffix = Date.now();
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/roles",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { name: `ok-role_${suffix}`, permissions: ["tools:use"] },
|
|
});
|
|
expect(res.statusCode).toBe(201);
|
|
const body = JSON.parse(res.body);
|
|
expect(body.name).toBe(`ok-role_${suffix}`);
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Permission validation (3 tests)
|
|
// ---------------------------------------------------------------------------
|
|
describe("permission validation", () => {
|
|
it("rejects invalid permission names", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/roles",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { name: `inv-${Date.now()}`, permissions: ["fly:to-moon"] },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
expect(JSON.parse(res.body).error).toContain("Invalid permissions");
|
|
});
|
|
|
|
it("rejects missing permissions field", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/roles",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { name: `noperms-${Date.now()}` },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
});
|
|
|
|
it("rejects missing name field", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/v1/roles",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { permissions: ["tools:use"] },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// CRUD edge cases (5 tests)
|
|
// ---------------------------------------------------------------------------
|
|
describe("CRUD edge cases", () => {
|
|
it("PUT non-existent role returns 404", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "PUT",
|
|
url: "/api/v1/roles/00000000-0000-0000-0000-000000000000",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { permissions: ["tools:use"] },
|
|
});
|
|
expect(res.statusCode).toBe(404);
|
|
});
|
|
|
|
it("DELETE non-existent role returns 404", async () => {
|
|
const res = await testApp.app.inject({
|
|
method: "DELETE",
|
|
url: "/api/v1/roles/00000000-0000-0000-0000-000000000000",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(res.statusCode).toBe(404);
|
|
});
|
|
|
|
it("updates role description", async () => {
|
|
const id = await createRole(`desc-${Date.now()}`, ["tools:use"], "original");
|
|
const res = await testApp.app.inject({
|
|
method: "PUT",
|
|
url: `/api/v1/roles/${id}`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { description: "updated description" },
|
|
});
|
|
expect(res.statusCode).toBe(200);
|
|
});
|
|
|
|
it("rejects invalid permissions on update", async () => {
|
|
const id = await createRole(`upd-${Date.now()}`, ["tools:use"]);
|
|
const res = await testApp.app.inject({
|
|
method: "PUT",
|
|
url: `/api/v1/roles/${id}`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { permissions: ["nonexistent:perm"] },
|
|
});
|
|
expect(res.statusCode).toBe(400);
|
|
expect(JSON.parse(res.body).error).toContain("Invalid permissions");
|
|
});
|
|
|
|
it("multiple users on deleted role all get reassigned to user", async () => {
|
|
const suffix = Date.now();
|
|
const roleName = `multi-${suffix}`;
|
|
const roleId = await createRole(roleName, ["tools:use", "files:own"]);
|
|
|
|
// Register three users on this role
|
|
for (let i = 1; i <= 3; i++) {
|
|
await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/register",
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: {
|
|
username: `multi-u${i}-${suffix}`,
|
|
password: "TestPass1",
|
|
role: roleName,
|
|
},
|
|
});
|
|
await db
|
|
.update(schema.users)
|
|
.set({ mustChangePassword: false })
|
|
.where(eq(schema.users.username, `multi-u${i}-${suffix}`));
|
|
}
|
|
|
|
// Delete the role
|
|
const delRes = await testApp.app.inject({
|
|
method: "DELETE",
|
|
url: `/api/v1/roles/${roleId}`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
expect(delRes.statusCode).toBe(200);
|
|
|
|
// Verify all three users were reassigned to "user"
|
|
for (let i = 1; i <= 3; i++) {
|
|
const loginRes = await testApp.app.inject({
|
|
method: "POST",
|
|
url: "/api/auth/login",
|
|
payload: { username: `multi-u${i}-${suffix}`, password: "TestPass1" },
|
|
});
|
|
const body = JSON.parse(loginRes.body);
|
|
expect(body.user.role).toBe("user");
|
|
}
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Functional permissions (1 test)
|
|
// ---------------------------------------------------------------------------
|
|
describe("functional permissions", () => {
|
|
it("custom role with only settings:read can read settings but not audit log", async () => {
|
|
const suffix = Date.now();
|
|
const roleName = `readonly-${suffix}`;
|
|
await createRole(roleName, ["settings:read"]);
|
|
|
|
const token = await createUserAndLogin(`ro-user-${suffix}`, "ReadOnly1", roleName);
|
|
|
|
// Can read settings (GET /api/v1/settings requires only authentication)
|
|
const settingsRes = await testApp.app.inject({
|
|
method: "GET",
|
|
url: "/api/v1/settings",
|
|
headers: { authorization: `Bearer ${token}` },
|
|
});
|
|
expect(settingsRes.statusCode).toBe(200);
|
|
|
|
// Cannot access audit log (requires audit:read permission)
|
|
const auditRes = await testApp.app.inject({
|
|
method: "GET",
|
|
url: "/api/v1/audit-log",
|
|
headers: { authorization: `Bearer ${token}` },
|
|
});
|
|
expect(auditRes.statusCode).toBe(403);
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Target role authority
|
|
// ---------------------------------------------------------------------------
|
|
describe("target role authority", () => {
|
|
let managerRole: string;
|
|
let subordinateRole: string;
|
|
let alternateSubordinateRole: string;
|
|
let managerToken: string;
|
|
let fullPermissionManagerToken: string;
|
|
|
|
beforeAll(async () => {
|
|
const suffix = Date.now();
|
|
managerRole = `mgr-${suffix}`;
|
|
subordinateRole = `sub-${suffix}`;
|
|
alternateSubordinateRole = `alt-${suffix}`;
|
|
|
|
await createRole(managerRole, [...BASE_USER_PERMISSIONS, "users:manage"]);
|
|
await createRole(subordinateRole, BASE_USER_PERMISSIONS);
|
|
await createRole(alternateSubordinateRole, BASE_USER_PERMISSIONS);
|
|
managerToken = await createUserAndLogin(`manager-${suffix}`, "ManagerPass1", managerRole);
|
|
|
|
const fullPermissionManagerRole = `full-mgr-${suffix}`;
|
|
await createRole(fullPermissionManagerRole, ADMIN_PERMISSIONS);
|
|
fullPermissionManagerToken = await createUserAndLogin(
|
|
`full-manager-${suffix}`,
|
|
"FullManagerPass1",
|
|
fullPermissionManagerRole,
|
|
);
|
|
});
|
|
|
|
it("denies a custom role with all 17 admin permissions from managing built-in admins", async () => {
|
|
expect(ADMIN_PERMISSIONS).toHaveLength(17);
|
|
|
|
const demotionTarget = await createTargetUser("full-deny-demote-admin", "admin");
|
|
const passwordTarget = await createTargetUser("full-deny-reset-admin", "admin");
|
|
const deleteTarget = await createTargetUser("full-deny-delete-admin", "admin");
|
|
const mfaTarget = await createTargetUser("full-deny-mfa-admin", "admin", {
|
|
mfaEnabled: true,
|
|
});
|
|
const passwordBefore = await getUserById(passwordTarget.id);
|
|
|
|
const demotionResponse = await testApp.app.inject({
|
|
method: "PUT",
|
|
url: `/api/auth/users/${demotionTarget.id}`,
|
|
headers: { authorization: `Bearer ${fullPermissionManagerToken}` },
|
|
payload: { role: subordinateRole },
|
|
});
|
|
const passwordResponse = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${passwordTarget.id}/reset-password`,
|
|
headers: { authorization: `Bearer ${fullPermissionManagerToken}` },
|
|
payload: { newPassword: "UnauthorizedReset1" },
|
|
});
|
|
const deleteResponse = await testApp.app.inject({
|
|
method: "DELETE",
|
|
url: `/api/auth/users/${deleteTarget.id}`,
|
|
headers: { authorization: `Bearer ${fullPermissionManagerToken}` },
|
|
});
|
|
const mfaResponse = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${mfaTarget.id}/mfa/reset`,
|
|
headers: { authorization: `Bearer ${fullPermissionManagerToken}` },
|
|
});
|
|
|
|
for (const response of [demotionResponse, passwordResponse, deleteResponse, mfaResponse]) {
|
|
expect.soft(response.statusCode).toBe(403);
|
|
expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
|
|
}
|
|
|
|
const [demotionAfter, passwordAfter, deleteAfter, mfaAfter] = await Promise.all([
|
|
getUserById(demotionTarget.id),
|
|
getUserById(passwordTarget.id),
|
|
getUserById(deleteTarget.id),
|
|
getUserById(mfaTarget.id),
|
|
]);
|
|
expect.soft(demotionAfter?.role).toBe("admin");
|
|
expect.soft(passwordAfter?.passwordHash).toBe(passwordBefore?.passwordHash);
|
|
expect.soft(passwordAfter?.mustChangePassword).toBe(false);
|
|
expect.soft(deleteAfter?.role).toBe("admin");
|
|
expect(mfaAfter).toMatchObject({
|
|
role: "admin",
|
|
totpEnabled: true,
|
|
totpSecret: "target-authority-test-secret",
|
|
recoveryCodesHash: "target-authority-test-recovery-codes",
|
|
});
|
|
});
|
|
|
|
it("denies a custom manager demoting an admin and preserves the admin role", async () => {
|
|
const target = await createTargetUser("deny-demote-admin", "admin");
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "PUT",
|
|
url: `/api/auth/users/${target.id}`,
|
|
headers: { authorization: `Bearer ${managerToken}` },
|
|
payload: { role: subordinateRole },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect.soft(response.statusCode).toBe(403);
|
|
expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
|
|
expect(targetAfter?.role).toBe("admin");
|
|
});
|
|
|
|
it("denies a custom manager resetting an admin password and preserves credentials", async () => {
|
|
const target = await createTargetUser("deny-reset-admin", "admin");
|
|
const targetBefore = await getUserById(target.id);
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${target.id}/reset-password`,
|
|
headers: { authorization: `Bearer ${managerToken}` },
|
|
payload: { newPassword: "ReplacementPass1" },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect.soft(response.statusCode).toBe(403);
|
|
expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
|
|
expect(targetAfter?.passwordHash).toBe(targetBefore?.passwordHash);
|
|
expect(targetAfter?.mustChangePassword).toBe(false);
|
|
});
|
|
|
|
it("denies a custom manager deleting an admin and preserves the account", async () => {
|
|
const target = await createTargetUser("deny-delete-admin", "admin");
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "DELETE",
|
|
url: `/api/auth/users/${target.id}`,
|
|
headers: { authorization: `Bearer ${managerToken}` },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect.soft(response.statusCode).toBe(403);
|
|
expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
|
|
expect(targetAfter).toBeDefined();
|
|
expect(targetAfter?.role).toBe("admin");
|
|
});
|
|
|
|
it("denies a custom manager resetting admin MFA and preserves MFA state", async () => {
|
|
const target = await createTargetUser("deny-mfa-admin", "admin", { mfaEnabled: true });
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${target.id}/mfa/reset`,
|
|
headers: { authorization: `Bearer ${managerToken}` },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect.soft(response.statusCode).toBe(403);
|
|
expect.soft(JSON.parse(response.body).code).toBe("ESCALATION_DENIED");
|
|
expect(targetAfter).toMatchObject({
|
|
role: "admin",
|
|
totpEnabled: true,
|
|
totpSecret: "target-authority-test-secret",
|
|
recoveryCodesHash: "target-authority-test-recovery-codes",
|
|
});
|
|
});
|
|
|
|
it("protects a disabled admin from a custom manager while allowing built-in admin recovery", async () => {
|
|
const target = await createTargetUser("disabled-admin-recovery", "admin");
|
|
await db
|
|
.update(schema.users)
|
|
.set({ role: "disabled:admin" })
|
|
.where(eq(schema.users.id, target.id));
|
|
const targetBefore = await getUserById(target.id);
|
|
|
|
const deniedResponse = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${target.id}/reset-password`,
|
|
headers: { authorization: `Bearer ${managerToken}` },
|
|
payload: { newPassword: "UnauthorizedReset1" },
|
|
});
|
|
const targetAfterDenial = await getUserById(target.id);
|
|
|
|
expect.soft(deniedResponse.statusCode).toBe(403);
|
|
expect.soft(JSON.parse(deniedResponse.body).code).toBe("ESCALATION_DENIED");
|
|
expect.soft(targetAfterDenial?.role).toBe("disabled:admin");
|
|
expect.soft(targetAfterDenial?.passwordHash).toBe(targetBefore?.passwordHash);
|
|
expect.soft(targetAfterDenial?.mustChangePassword).toBe(false);
|
|
|
|
const recoveryResponse = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${target.id}/reset-password`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { newPassword: "AdminRecovery1" },
|
|
});
|
|
const targetAfterRecovery = await getUserById(target.id);
|
|
|
|
expect(recoveryResponse.statusCode).toBe(200);
|
|
expect(targetAfterRecovery?.role).toBe("disabled:admin");
|
|
expect(targetAfterRecovery?.passwordHash).not.toBe(targetBefore?.passwordHash);
|
|
expect(targetAfterRecovery?.mustChangePassword).toBe(true);
|
|
});
|
|
|
|
it("allows a custom manager to change a subordinate custom-role user", async () => {
|
|
const target = await createTargetUser("allow-demote-sub", subordinateRole);
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "PUT",
|
|
url: `/api/auth/users/${target.id}`,
|
|
headers: { authorization: `Bearer ${managerToken}` },
|
|
payload: { role: alternateSubordinateRole },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(targetAfter?.role).toBe(alternateSubordinateRole);
|
|
});
|
|
|
|
it("allows a custom manager to reset a subordinate custom-role user password", async () => {
|
|
const target = await createTargetUser("allow-reset-sub", subordinateRole);
|
|
const targetBefore = await getUserById(target.id);
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${target.id}/reset-password`,
|
|
headers: { authorization: `Bearer ${managerToken}` },
|
|
payload: { newPassword: "ReplacementPass1" },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(targetAfter?.passwordHash).not.toBe(targetBefore?.passwordHash);
|
|
expect(targetAfter?.mustChangePassword).toBe(true);
|
|
});
|
|
|
|
it("allows a custom manager to delete a subordinate custom-role user", async () => {
|
|
const target = await createTargetUser("allow-delete-sub", subordinateRole);
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "DELETE",
|
|
url: `/api/auth/users/${target.id}`,
|
|
headers: { authorization: `Bearer ${managerToken}` },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(targetAfter).toBeUndefined();
|
|
});
|
|
|
|
it("allows a custom manager to reset subordinate custom-role user MFA", async () => {
|
|
const target = await createTargetUser("allow-mfa-sub", subordinateRole, { mfaEnabled: true });
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${target.id}/mfa/reset`,
|
|
headers: { authorization: `Bearer ${managerToken}` },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(targetAfter).toMatchObject({
|
|
totpEnabled: false,
|
|
totpSecret: null,
|
|
recoveryCodesHash: null,
|
|
});
|
|
});
|
|
|
|
it("allows an admin to demote an equal admin", async () => {
|
|
const target = await createTargetUser("allow-demote-peer", "admin");
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "PUT",
|
|
url: `/api/auth/users/${target.id}`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { role: subordinateRole },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(targetAfter?.role).toBe(subordinateRole);
|
|
});
|
|
|
|
it("allows an admin to reset an equal admin password", async () => {
|
|
const target = await createTargetUser("allow-reset-peer", "admin");
|
|
const targetBefore = await getUserById(target.id);
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${target.id}/reset-password`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
payload: { newPassword: "ReplacementPass1" },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(targetAfter?.passwordHash).not.toBe(targetBefore?.passwordHash);
|
|
expect(targetAfter?.mustChangePassword).toBe(true);
|
|
});
|
|
|
|
it("allows an admin to delete an equal admin", async () => {
|
|
const target = await createTargetUser("allow-delete-peer", "admin");
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "DELETE",
|
|
url: `/api/auth/users/${target.id}`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(targetAfter).toBeUndefined();
|
|
});
|
|
|
|
it("allows an admin to reset equal admin MFA", async () => {
|
|
const target = await createTargetUser("allow-mfa-peer", "admin", { mfaEnabled: true });
|
|
|
|
const response = await testApp.app.inject({
|
|
method: "POST",
|
|
url: `/api/auth/users/${target.id}/mfa/reset`,
|
|
headers: { authorization: `Bearer ${adminToken}` },
|
|
});
|
|
const targetAfter = await getUserById(target.id);
|
|
|
|
expect(response.statusCode).toBe(200);
|
|
expect(targetAfter).toMatchObject({
|
|
totpEnabled: false,
|
|
totpSecret: null,
|
|
recoveryCodesHash: null,
|
|
});
|
|
});
|
|
});
|