@adminforth/open-signup 2.0.1 → 2.0.3

package/.woodpecker/buildRelease.sh

@@ -2,11 +2,10 @@
 #!/bin/bash
 
 # write npm run output both to console and to build.log
-npm run build 2>&1 | tee build.log
+npm test 2>&1 | tee build.log
 build_status=${PIPESTATUS[0]}
 
-# if exist status from the npm run build is not 0
-# then exit with the status code from the npm run build
+# if exit status is not 0, exit with the status code from the build+test run
 if [ $build_status -ne 0 ]; then
   echo "Build failed. Exiting with status code $build_status"
   exit $build_status

package/build.log

@@ -1,4 +1,8 @@
 
+> @adminforth/open-signup@1.0.9 test
+> npm run build && node --test tests/*.test.mjs
+
+
 > @adminforth/open-signup@1.0.9 build
 > tsc && rsync -av --exclude 'node_modules' custom dist/
 
@@ -10,3 +14,38 @@ custom/tsconfig.json
 
 sent 14,167 bytes  received 77 bytes  28,488.00 bytes/sec
 total size is 13,884  speedup is 0.97
+TAP version 13
+# Subtest: a case-variant signup is rejected instead of creating a second account
+ok 1 - a case-variant signup is rejected instead of creating a second account
+  ---
+  duration_ms: 45.208471
+  ...
+# Subtest: case folding does not depend on which column is the auth username field
+ok 2 - case folding does not depend on which column is the auth username field
+  ---
+  duration_ms: 43.686471
+  ...
+# Subtest: a configured column normalize runs on the folded value, and the stored value is the one probed
+ok 3 - a configured column normalize runs on the folded value, and the stored value is the one probed
+  ---
+  duration_ms: 48.158384
+  ...
+# Subtest: the probed value survives the column normalize core re-applies on write
+ok 4 - the probed value survives the column normalize core re-applies on write
+  ---
+  duration_ms: 41.121963
+  ...
+# Subtest: a login whose account lookup finds nothing returns an error instead of crashing
+ok 5 - a login whose account lookup finds nothing returns an error instead of crashing
+  ---
+  duration_ms: 0.192068
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 345.451587

package/dist/index.d.ts

@@ -11,6 +11,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
     constructor(options: PluginOptions);
     modifyResourceConfig(adminforth: IAdminForth, resourceConfig: AdminForthResource): Promise<void>;
     getAllowedOrigins(): string[];
+    normalizeUsername(email: string): string;
     validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource): void;
     instanceUniqueRepresentation(pluginOptions: any): string;
     doLogin(email: string, response: any, extra: HttpExtra): Promise<{

package/dist/index.js

@@ -115,6 +115,12 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
         return originList.map(o => new URL(o).origin);
     }
+    // Unconditional fold: this value is both the lookup filter and the value stored.
+    normalizeUsername(email) {
+        const folded = typeof email === 'string' ? email.toLowerCase() : email;
+        const normalize = this.emailField.normalize;
+        return normalize ? normalize(folded) : folded;
+    }
     validateConfigAfterDiscover(adminforth, resourceConfig) {
         if (this.options.confirmEmails) {
             this.options.confirmEmails.adapter.validate();
@@ -133,8 +139,11 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
     }
     doLogin(email, response, extra) {
         return __awaiter(this, void 0, void 0, function* () {
-            const username = email;
-            const userRecord = yield this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.emailField.name, email));
+            const username = this.normalizeUsername(email);
+            const userRecord = yield this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.emailField.name, username));
+            if (!userRecord) {
+                return { allowedLogin: false, error: 'User not found' };
+            }
             const adminUser = {
                 dbUser: userRecord,
                 pk: userRecord[this.authResource.columns.find((col) => col.primaryKey).name],
@@ -189,7 +198,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                 if (!decoded || !decoded.email) {
                     return { error: yield tr('Invalid token', 'opensignup'), ok: false };
                 }
-                const { email } = decoded;
+                const email = this.normalizeUsername(decoded.email);
                 if (!password) {
                     return { error: yield tr('Password is required', 'opensignup'), ok: false };
                 }
@@ -219,6 +228,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                 if (!email || typeof email !== 'string') {
                     return { error: yield tr('Email is required', 'opensignup'), ok: false };
                 }
+                const normalizedEmail = this.normalizeUsername(email);
                 if (!this.options.confirmEmails && !password) {
                     return { error: yield tr('Password is required', 'opensignup'), ok: false };
                 }
@@ -238,7 +248,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                 // validate email
                 if (this.emailField.validation) {
                     for (const { regExp, message } of this.emailField.validation) {
-                        if (!new RegExp(regExp).test(email)) {
+                        if (!new RegExp(regExp).test(normalizedEmail)) {
                             return { error: yield tr(message, 'opensignup'), ok: false };
                         }
                     }
@@ -265,9 +275,6 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                         }
                     }
                 }
-                // This is not needed when right email validator is set on email field because
-                // it will not allow to create such email, but if user forgot to set it it might save situation 
-                const normalizedEmail = email.toLowerCase(); // normalize email
                 // first check again if email already exists
                 const existingUser = yield this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.emailField.name, normalizedEmail));
                 if ((!this.options.confirmEmails && existingUser) || (this.options.confirmEmails && (existingUser === null || existingUser === void 0 ? void 0 : existingUser[this.emailConfirmedField.name]))) {
@@ -315,7 +322,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
                 }
                 // send confirmation email
                 const brandName = this.adminforth.config.customization.brandName;
-                const verifyToken = this.adminforth.auth.issueJWT({ email, issuer: brandName }, 'tempVerifyEmailToken', '2h');
+                const verifyToken = this.adminforth.auth.issueJWT({ email: normalizedEmail, issuer: brandName }, 'tempVerifyEmailToken', '2h');
                 process.env.HEAVY_DEBUG && console.log('🐛Sending reset tok to', verifyToken);
                 const emailText = yield tr(`
                   Dear user,
@@ -359,7 +366,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         `;
                 const emailSubject = yield tr(`Signup request at {brandName}`, 'opensignup', { brandName });
                 // send email with AWS SES this.options.providerOptions.AWS_SES
-                this.options.confirmEmails.adapter.sendEmail(this.options.confirmEmails.sendFrom, email, emailText, emailHtml, emailSubject);
+                this.options.confirmEmails.adapter.sendEmail(this.options.confirmEmails.sendFrom, normalizedEmail, emailText, emailHtml, emailSubject);
                 return { ok: true };
             })
         });

package/index.ts

@@ -129,6 +129,13 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
     const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
     return originList.map(o => new URL(o).origin);
   }
+
+  // Unconditional fold: this value is both the lookup filter and the value stored.
+  normalizeUsername(email: string): string {
+    const folded = typeof email === 'string' ? email.toLowerCase() : email;
+    const normalize = (this.emailField as AdminForthResourceColumn & { normalize?: (value: any) => any }).normalize;
+    return normalize ? normalize(folded) : folded;
+  }
   
   validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource) {
     if (this.options.confirmEmails) {
@@ -151,10 +158,12 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
   }
 
   async doLogin(email: string, response: any, extra: HttpExtra): Promise<{ error?: string; allowedLogin: boolean; redirectTo?: string; }> {
-
-    const username = email;
-    const userRecord = await this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.emailField.name, email));
-    const adminUser = { 
+    const username = this.normalizeUsername(email);
+    const userRecord = await this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.emailField.name, username));
+    if (!userRecord) {
+      return { allowedLogin: false, error: 'User not found' };
+    }
+    const adminUser = {
       dbUser: userRecord,
       pk: userRecord[this.authResource.columns.find((col) => col.primaryKey).name], 
       username,
@@ -218,7 +227,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         if (!decoded || !decoded.email) {
           return { error: await tr('Invalid token', 'opensignup'), ok: false };
         }
-        const { email } = decoded;
+        const email = this.normalizeUsername(decoded.email);
 
         if(!password) {
           return { error: await tr('Password is required', 'opensignup'), ok: false };
@@ -251,6 +260,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         if (!email || typeof email !== 'string') {
           return { error: await tr('Email is required', 'opensignup'), ok: false };
         }
+        const normalizedEmail = this.normalizeUsername(email);
         if (!this.options.confirmEmails && !password) {
           return { error: await tr('Password is required', 'opensignup'), ok: false };
         }
@@ -271,7 +281,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         // validate email
         if (this.emailField.validation) {
           for (const { regExp, message } of this.emailField.validation) {
-            if (!new RegExp(regExp).test(email)) {
+            if (!new RegExp(regExp).test(normalizedEmail)) {
               return { error: await tr(message, 'opensignup'), ok: false };
             }
           }
@@ -299,10 +309,6 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
           }
         }
         
-        // This is not needed when right email validator is set on email field because
-        // it will not allow to create such email, but if user forgot to set it it might save situation 
-        const normalizedEmail = email.toLowerCase();  // normalize email
-
         // first check again if email already exists
         const existingUser = await this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.emailField.name, normalizedEmail));
         if ((!this.options.confirmEmails && existingUser) || (this.options.confirmEmails && existingUser?.[this.emailConfirmedField.name])) {
@@ -365,7 +371,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
 
         const brandName = this.adminforth.config.customization.brandName;
 
-        const verifyToken = this.adminforth.auth.issueJWT({email, issuer: brandName }, 'tempVerifyEmailToken', '2h');
+        const verifyToken = this.adminforth.auth.issueJWT({ email: normalizedEmail, issuer: brandName }, 'tempVerifyEmailToken', '2h');
         process.env.HEAVY_DEBUG && console.log('🐛Sending reset tok to', verifyToken);
         const emailText = await tr(`
                   Dear user,
@@ -413,7 +419,7 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         const emailSubject = await tr(`Signup request at {brandName}`, 'opensignup', { brandName });
 
         // send email with AWS SES this.options.providerOptions.AWS_SES
-        this.options.confirmEmails.adapter.sendEmail(this.options.confirmEmails.sendFrom, email, emailText, emailHtml, emailSubject);
+        this.options.confirmEmails.adapter.sendEmail(this.options.confirmEmails.sendFrom, normalizedEmail, emailText, emailHtml, emailSubject);
 
         return { ok: true };
       }
@@ -423,4 +429,4 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
 
   }
 
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/open-signup",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
@@ -9,7 +9,8 @@
   },
   "homepage": "https://adminforth.dev/docs/tutorial/Plugins/open-signup/",
   "scripts": {
-    "build": "tsc && rsync -av --exclude 'node_modules' custom dist/"
+    "build": "tsc && rsync -av --exclude 'node_modules' custom dist/",
+    "test": "npm run build && node --test tests/*.test.mjs"
   },
   "repository": {
     "type": "git",

package/tests/signupEmailCase.test.mjs

@@ -0,0 +1,113 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import OpenSignupPlugin from '../dist/index.js';
+
+function makePlugin({ usernameField = 'email', normalize } = {}) {
+  const records = [];
+  const cookies = [];
+  const plugin = Object.create(OpenSignupPlugin.prototype);
+
+  plugin.options = {
+    emailField: 'email',
+    passwordHashField: 'password_hash',
+    expectedOrigin: 'https://app.example.com',
+  };
+  plugin.pluginInstanceId = 'open-signup-test';
+  plugin.emailField = { name: 'email', ...(normalize ? { normalize } : {}) };
+  plugin.passwordField = { minLength: 8, maxLength: 64 };
+  plugin.authResource = {
+    resourceId: 'users',
+    columns: [{ name: 'id', primaryKey: true }, { name: 'email' }],
+  };
+  plugin.adminforth = {
+    config: { auth: { usernameField }, customization: { brandName: 'Test' } },
+    resource: () => ({
+      get: async (filter) => records.find((record) => record.email === filter.value) ?? null,
+      create: async (record) => {
+        // core applies the column's normalize again on write, so the harness has to as well
+        const email = normalize ? normalize(record.email) : record.email;
+        const created = { id: `user-${records.length + 1}`, ...record, email };
+        records.push(created);
+        return created;
+      },
+    }),
+    restApi: { processLoginCallbacks: async () => {} },
+    auth: { setAuthCookie: (args) => cookies.push(args) },
+  };
+
+  let handler;
+  plugin.setupEndpoints({
+    endpoint: (options) => {
+      if (options.path.endsWith('/signup')) {
+        handler = options.handler;
+      }
+    },
+  });
+
+  const signup = (email) => handler({
+    body: { email, url: 'https://app.example.com/signup', password: 'S3cret-pass' },
+    response: {},
+    headers: {},
+    query: {},
+    cookies: [],
+    requestUrl: '/plugin/open-signup-test/signup',
+    tr: async (message) => message,
+  });
+
+  return { plugin, records, cookies, signup };
+}
+
+test('a case-variant signup is rejected instead of creating a second account', async () => {
+  const { records, signup, cookies } = makePlugin();
+
+  // the first address is deliberately mixed-case: it is what pins the stored value to the folded one
+  const first = await signup('Bob@Example.COM');
+  assert.equal(first.allowedLogin, true);
+  assert.equal(records.length, 1);
+  assert.equal(records[0].email, 'bob@example.com');
+  assert.equal(cookies.at(-1).username, 'bob@example.com');
+
+  const second = await signup('bob@example.com');
+  assert.match(second.error, /already exists/i);
+  assert.equal(records.length, 1);
+});
+
+test('case folding does not depend on which column is the auth username field', async () => {
+  const { records, signup } = makePlugin({ usernameField: 'login' });
+
+  await signup('bob@example.com');
+  const second = await signup('BOB@example.com');
+
+  assert.match(second.error, /already exists/i);
+  assert.equal(records.length, 1);
+});
+
+test('a configured column normalize runs on the folded value, and the stored value is the one probed', async () => {
+  const { records, signup } = makePlugin({ normalize: (value) => value.trim() });
+
+  await signup('  bob@example.com  ');
+  const second = await signup('Bob@Example.com');
+
+  assert.match(second.error, /already exists/i);
+  assert.equal(records.length, 1);
+  assert.equal(records[0].email, 'bob@example.com');
+});
+
+test('the probed value survives the column normalize core re-applies on write', async () => {
+  const { records, signup } = makePlugin({ normalize: (value) => value.toUpperCase() });
+
+  await signup('bob@example.com');
+  const second = await signup('Bob@Example.com');
+
+  assert.match(second.error, /already exists/i);
+  assert.equal(records.length, 1);
+});
+
+test('a login whose account lookup finds nothing returns an error instead of crashing', async () => {
+  const { plugin } = makePlugin();
+
+  const result = await plugin.doLogin('nobody@example.com', {}, {});
+
+  assert.equal(result.allowedLogin, false);
+  assert.match(result.error, /not found/i);
+});