@adminforth/open-signup 2.0.2 → 2.0.3

package/.woodpecker/buildRelease.sh

@@ -2,11 +2,10 @@
 #!/bin/bash
 
 # write npm run output both to console and to build.log
-npm run build 2>&1 | tee build.log
+npm test 2>&1 | tee build.log
 build_status=${PIPESTATUS[0]}
 
-# if exist status from the npm run build is not 0
-# then exit with the status code from the npm run build
+# if exit status is not 0, exit with the status code from the build+test run
 if [ $build_status -ne 0 ]; then
   echo "Build failed. Exiting with status code $build_status"
   exit $build_status

package/build.log

@@ -1,4 +1,8 @@
 
+> @adminforth/open-signup@1.0.9 test
+> npm run build && node --test tests/*.test.mjs
+
+
 > @adminforth/open-signup@1.0.9 build
 > tsc && rsync -av --exclude 'node_modules' custom dist/
 
@@ -8,5 +12,40 @@ custom/SignupPage.vue
 custom/SignupUnderLogin.vue
 custom/tsconfig.json
 
-sent 14,163 bytes  received 77 bytes  28,480.00 bytes/sec
+sent 14,167 bytes  received 77 bytes  28,488.00 bytes/sec
 total size is 13,884  speedup is 0.97
+TAP version 13
+# Subtest: a case-variant signup is rejected instead of creating a second account
+ok 1 - a case-variant signup is rejected instead of creating a second account
+  ---
+  duration_ms: 45.208471
+  ...
+# Subtest: case folding does not depend on which column is the auth username field
+ok 2 - case folding does not depend on which column is the auth username field
+  ---
+  duration_ms: 43.686471
+  ...
+# Subtest: a configured column normalize runs on the folded value, and the stored value is the one probed
+ok 3 - a configured column normalize runs on the folded value, and the stored value is the one probed
+  ---
+  duration_ms: 48.158384
+  ...
+# Subtest: the probed value survives the column normalize core re-applies on write
+ok 4 - the probed value survives the column normalize core re-applies on write
+  ---
+  duration_ms: 41.121963
+  ...
+# Subtest: a login whose account lookup finds nothing returns an error instead of crashing
+ok 5 - a login whose account lookup finds nothing returns an error instead of crashing
+  ---
+  duration_ms: 0.192068
+  ...
+1..5
+# tests 5
+# suites 0
+# pass 5
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 345.451587

package/dist/index.js

@@ -115,12 +115,11 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         const originList = Array.isArray(rawOrigins) ? rawOrigins : [rawOrigins];
         return originList.map(o => new URL(o).origin);
     }
+    // Unconditional fold: this value is both the lookup filter and the value stored.
     normalizeUsername(email) {
-        if (this.adminforth.config.auth.usernameField !== this.emailField.name) {
-            return email;
-        }
+        const folded = typeof email === 'string' ? email.toLowerCase() : email;
         const normalize = this.emailField.normalize;
-        return normalize ? normalize(email) : email;
+        return normalize ? normalize(folded) : folded;
     }
     validateConfigAfterDiscover(adminforth, resourceConfig) {
         if (this.options.confirmEmails) {
@@ -142,6 +141,9 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
         return __awaiter(this, void 0, void 0, function* () {
             const username = this.normalizeUsername(email);
             const userRecord = yield this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.emailField.name, username));
+            if (!userRecord) {
+                return { allowedLogin: false, error: 'User not found' };
+            }
             const adminUser = {
                 dbUser: userRecord,
                 pk: userRecord[this.authResource.columns.find((col) => col.primaryKey).name],

package/index.ts

@@ -130,13 +130,11 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
     return originList.map(o => new URL(o).origin);
   }
 
+  // Unconditional fold: this value is both the lookup filter and the value stored.
   normalizeUsername(email: string): string {
-    if (this.adminforth.config.auth.usernameField !== this.emailField.name) {
-      return email;
-    }
-
+    const folded = typeof email === 'string' ? email.toLowerCase() : email;
     const normalize = (this.emailField as AdminForthResourceColumn & { normalize?: (value: any) => any }).normalize;
-    return normalize ? normalize(email) : email;
+    return normalize ? normalize(folded) : folded;
   }
   
   validateConfigAfterDiscover(adminforth: IAdminForth, resourceConfig: AdminForthResource) {
@@ -162,7 +160,10 @@ export default class OpenSignupPlugin extends AdminForthPlugin {
   async doLogin(email: string, response: any, extra: HttpExtra): Promise<{ error?: string; allowedLogin: boolean; redirectTo?: string; }> {
     const username = this.normalizeUsername(email);
     const userRecord = await this.adminforth.resource(this.authResource.resourceId).get(Filters.EQ(this.emailField.name, username));
-    const adminUser = { 
+    if (!userRecord) {
+      return { allowedLogin: false, error: 'User not found' };
+    }
+    const adminUser = {
       dbUser: userRecord,
       pk: userRecord[this.authResource.columns.find((col) => col.primaryKey).name], 
       username,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/open-signup",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "module",
@@ -9,7 +9,8 @@
   },
   "homepage": "https://adminforth.dev/docs/tutorial/Plugins/open-signup/",
   "scripts": {
-    "build": "tsc && rsync -av --exclude 'node_modules' custom dist/"
+    "build": "tsc && rsync -av --exclude 'node_modules' custom dist/",
+    "test": "npm run build && node --test tests/*.test.mjs"
   },
   "repository": {
     "type": "git",

package/tests/signupEmailCase.test.mjs

@@ -0,0 +1,113 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import OpenSignupPlugin from '../dist/index.js';
+
+function makePlugin({ usernameField = 'email', normalize } = {}) {
+  const records = [];
+  const cookies = [];
+  const plugin = Object.create(OpenSignupPlugin.prototype);
+
+  plugin.options = {
+    emailField: 'email',
+    passwordHashField: 'password_hash',
+    expectedOrigin: 'https://app.example.com',
+  };
+  plugin.pluginInstanceId = 'open-signup-test';
+  plugin.emailField = { name: 'email', ...(normalize ? { normalize } : {}) };
+  plugin.passwordField = { minLength: 8, maxLength: 64 };
+  plugin.authResource = {
+    resourceId: 'users',
+    columns: [{ name: 'id', primaryKey: true }, { name: 'email' }],
+  };
+  plugin.adminforth = {
+    config: { auth: { usernameField }, customization: { brandName: 'Test' } },
+    resource: () => ({
+      get: async (filter) => records.find((record) => record.email === filter.value) ?? null,
+      create: async (record) => {
+        // core applies the column's normalize again on write, so the harness has to as well
+        const email = normalize ? normalize(record.email) : record.email;
+        const created = { id: `user-${records.length + 1}`, ...record, email };
+        records.push(created);
+        return created;
+      },
+    }),
+    restApi: { processLoginCallbacks: async () => {} },
+    auth: { setAuthCookie: (args) => cookies.push(args) },
+  };
+
+  let handler;
+  plugin.setupEndpoints({
+    endpoint: (options) => {
+      if (options.path.endsWith('/signup')) {
+        handler = options.handler;
+      }
+    },
+  });
+
+  const signup = (email) => handler({
+    body: { email, url: 'https://app.example.com/signup', password: 'S3cret-pass' },
+    response: {},
+    headers: {},
+    query: {},
+    cookies: [],
+    requestUrl: '/plugin/open-signup-test/signup',
+    tr: async (message) => message,
+  });
+
+  return { plugin, records, cookies, signup };
+}
+
+test('a case-variant signup is rejected instead of creating a second account', async () => {
+  const { records, signup, cookies } = makePlugin();
+
+  // the first address is deliberately mixed-case: it is what pins the stored value to the folded one
+  const first = await signup('Bob@Example.COM');
+  assert.equal(first.allowedLogin, true);
+  assert.equal(records.length, 1);
+  assert.equal(records[0].email, 'bob@example.com');
+  assert.equal(cookies.at(-1).username, 'bob@example.com');
+
+  const second = await signup('bob@example.com');
+  assert.match(second.error, /already exists/i);
+  assert.equal(records.length, 1);
+});
+
+test('case folding does not depend on which column is the auth username field', async () => {
+  const { records, signup } = makePlugin({ usernameField: 'login' });
+
+  await signup('bob@example.com');
+  const second = await signup('BOB@example.com');
+
+  assert.match(second.error, /already exists/i);
+  assert.equal(records.length, 1);
+});
+
+test('a configured column normalize runs on the folded value, and the stored value is the one probed', async () => {
+  const { records, signup } = makePlugin({ normalize: (value) => value.trim() });
+
+  await signup('  bob@example.com  ');
+  const second = await signup('Bob@Example.com');
+
+  assert.match(second.error, /already exists/i);
+  assert.equal(records.length, 1);
+  assert.equal(records[0].email, 'bob@example.com');
+});
+
+test('the probed value survives the column normalize core re-applies on write', async () => {
+  const { records, signup } = makePlugin({ normalize: (value) => value.toUpperCase() });
+
+  await signup('bob@example.com');
+  const second = await signup('Bob@Example.com');
+
+  assert.match(second.error, /already exists/i);
+  assert.equal(records.length, 1);
+});
+
+test('a login whose account lookup finds nothing returns an error instead of crashing', async () => {
+  const { plugin } = makePlugin();
+
+  const result = await plugin.doLogin('nobody@example.com', {}, {});
+
+  assert.equal(result.allowedLogin, false);
+  assert.match(result.error, /not found/i);
+});