@bitfinex/bfx-facs-auth-google 1.2.3 → 2.0.0

package/test/privileges.test.js

@@ -0,0 +1,160 @@
+/* eslint-env mocha */
+
+'use strict'
+
+const assert = require('assert')
+const { promisify } = require('util')
+const { pick } = require('@bitfinex/lib-js-util-base')
+
+const conf = require('./config/facs/auth-google.config')
+const AuthGoogle = require('../')
+const PrivilegeRepository = require('../src/privilege-repo')
+
+const ctx = { root: './test' }
+const caller = { ctx }
+const authGoogle = new AuthGoogle(caller, { conf, db: ':memory:' }, ctx)
+
+const testAdminEmail = 'testForms@admin.com'
+const testPrivilege = 'sample-privilege:view'
+const adminPayload = {
+  email: testAdminEmail,
+  password: 'test123',
+  level: 0
+}
+
+describe('Admin Privileges', () => {
+  beforeEach(async () => {
+    await new Promise((resolve) => authGoogle.start(resolve))
+  })
+
+  afterEach(async () => {
+    await new Promise((resolve) => authGoogle.stop(resolve))
+  })
+
+  it('should add privilege', async () => {
+    const res = await authGoogle.addPrivilege(testPrivilege)
+    assert.strictEqual(res.name, testPrivilege)
+
+    await new Promise((resolve) => authGoogle.db.get('SELECT * FROM privileges WHERE name=?', [testPrivilege], (err, row) => {
+      if (err) throw err
+      assert.strictEqual(typeof row.id, 'number')
+      assert.equal(row.name, testPrivilege)
+      resolve()
+    }))
+  })
+
+  it('should get all privileges', async () => {
+    await authGoogle.addPrivilege(testPrivilege)
+    const res = await authGoogle.getAllPrivileges()
+    assert.strictEqual(res.length, 1)
+    assert.deepStrictEqual(res, [{ id: 1, name: testPrivilege }])
+  })
+
+  it('should assign privilege to admin', async () => {
+    await authGoogle.addPrivilege(testPrivilege)
+    const savedAdmin = await authGoogle.addAdmin(adminPayload)
+
+    const [privilege] = await authGoogle.getAllPrivileges()
+
+    const res = await authGoogle.assignAdminPrivilege(adminPayload.email, privilege.id)
+    assert.deepStrictEqual(res, {
+      admin: savedAdmin.email,
+      privilege: privilege.name
+    })
+  })
+
+  it('should unassign privilege from admin', async () => {
+    await authGoogle.addPrivilege(testPrivilege)
+    const savedAdmin = await authGoogle.addAdmin(adminPayload)
+
+    const [privilege] = await authGoogle.getAllPrivileges()
+
+    const assigned = await authGoogle.assignAdminPrivilege(adminPayload.email, privilege.id)
+    assert.deepStrictEqual(assigned, {
+      admin: savedAdmin.email,
+      privilege: privilege.name
+    })
+
+    const unassigned = await authGoogle.unAssignAdminPrivilege(adminPayload.email, privilege.id)
+    assert.deepStrictEqual(unassigned, {
+      admin: savedAdmin.email,
+      privilege: privilege.name
+    })
+  })
+
+  it('should throw error when assigning privilege if admin does not exist', async () => {
+    await authGoogle.addPrivilege(testPrivilege)
+
+    const [privilege] = await authGoogle.getAllPrivileges()
+
+    try {
+      await authGoogle.assignAdminPrivilege(adminPayload.email, privilege.id)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'INVALID_ADMIN')
+    }
+  })
+
+  it('should throw error when assigning privilege if privilege does not exist', async () => {
+    await authGoogle.addAdmin(adminPayload)
+
+    try {
+      await authGoogle.assignAdminPrivilege(adminPayload.email, 1)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'INVALID_PRIVILEGE_ID')
+    }
+  })
+
+  it('should return an admin with their associated privileges', async () => {
+    await authGoogle.addPrivilege(testPrivilege)
+    await authGoogle.addAdmin(adminPayload)
+
+    const [privilege] = await authGoogle.getAllPrivileges()
+
+    await authGoogle.assignAdminPrivilege(adminPayload.email, privilege.id)
+
+    const res = await authGoogle.getAdminWithPrivileges(adminPayload.email)
+    assert.deepStrictEqual(pick(res, ['email', 'level', 'active', 'privileges']), {
+      email: adminPayload.email,
+      level: adminPayload.level,
+      active: 1,
+      privileges: [{ id: 1, name: testPrivilege }]
+    })
+  })
+
+  it('should check if an admin has a required privilege', async () => {
+    await authGoogle.addPrivilege(testPrivilege)
+    await authGoogle.addAdmin(adminPayload)
+
+    const [privilege] = await authGoogle.getAllPrivileges()
+
+    await authGoogle.assignAdminPrivilege(adminPayload.email, privilege.id)
+
+    const hasPrivilege = await authGoogle.checkAdminHasRequiredPrivilege(adminPayload.email, privilege.name)
+    assert.deepStrictEqual(hasPrivilege, true)
+
+    const missingPrivilege = await authGoogle.checkAdminHasRequiredPrivilege(adminPayload.email, 'INVALID:PRIVILEGE')
+    assert.deepStrictEqual(missingPrivilege, false)
+  })
+
+  it('deleting a privilege should cascade and unassign the associated assigned privileges', async () => {
+    await authGoogle.addPrivilege(testPrivilege)
+    await authGoogle.addAdmin(adminPayload)
+
+    const [privilege] = await authGoogle.getAllPrivileges()
+
+    await authGoogle.assignAdminPrivilege(adminPayload.email, privilege.id)
+
+    const hasPrivilege = await authGoogle.checkAdminHasRequiredPrivilege(adminPayload.email, privilege.name)
+    assert.deepStrictEqual(hasPrivilege, true)
+
+    const runSqlFn = promisify(authGoogle.db.run.bind(authGoogle.db))
+    await runSqlFn(`DELETE FROM ${PrivilegeRepository.tableName} WHERE id=?`, [privilege.id])
+
+    {
+      const hasPrivilege = await authGoogle.checkAdminHasRequiredPrivilege(adminPayload.email, privilege.name)
+      assert.deepStrictEqual(hasPrivilege, false)
+    }
+  })
+})

package/test/unit.js

@@ -9,11 +9,20 @@ const path = require('path')
 const conf = require('./config/facs/auth-google.config')
 
 const AuthGoogle = require('../')
-const { omit } = require('@bitfinexcom/lib-js-util-base')
+const { omit } = require('@bitfinex/lib-js-util-base')
 
 const dbPath = path.join(__dirname, './db/')
 const ctx = { root: './test' }
-const caller = { ctx }
+
+const mongoFac = {
+  db: {
+    collection: () => ({
+      insertOne: (query, cb) => cb(null, query)
+    })
+  }
+}
+
+const caller = { ctx, dbMongo_m0: mongoFac }
 const authGoogle = new AuthGoogle(caller, { conf }, ctx)
 
 const cleanup = () => {
@@ -24,14 +33,17 @@ const cleanup = () => {
 
 const testForms = ['passport', 'bank_statement', 'merchant']
 const testAdminEmail = 'testForms@admin.com'
-const testAdminWithForms = {
+const adminPayload = {
   email: testAdminEmail,
   password: 'test123',
-  level: 0,
+  level: 0
+}
+const testAdminWithForms = {
+  ...adminPayload,
   forms: testForms
 }
 
-describe('forms field', () => {
+describe('Admin Users', () => {
   beforeEach(async () => {
     cleanup()
     await new Promise((resolve) => authGoogle.start(resolve))
@@ -42,7 +54,8 @@ describe('forms field', () => {
   })
 
   it('should add admin and stringify forms field', async () => {
-    await authGoogle.addAdmin(testAdminWithForms)
+    const admin = await authGoogle.addAdmin(testAdminWithForms)
+    assert.strictEqual(typeof admin.id, 'number', 'admin id should be defined')
 
     await new Promise((resolve) => authGoogle.db.get('SELECT * FROM admin_users WHERE email=?', [testAdminEmail], (err, row) => {
       if (err) throw err
@@ -59,14 +72,54 @@ describe('forms field', () => {
     assert.deepEqual(res.forms, testForms)
   })
 
-  describe('getAdmin', () => {
-    const adminPayload = {
-      email: testAdminEmail,
-      password: 'test123',
-      level: 0
+  describe('loginAdmin', () => {
+    it('should pass error AUTH_FAC_ACCOUNT_IS_NOT_VALID to callback when internal validation of google auth credentials throws an exception', async () => {
+      let errMsg = null
+      const args = { google: { credential: 'invalid credential' } }
+      const cb = (e) => {
+        errMsg = e.message
+      }
+      await authGoogle.loginAdmin(args, cb)
+      assert.strictEqual(errMsg, 'AUTH_FAC_ACCOUNT_IS_NOT_VALID')
+    }).timeout(5000)
+  })
+
+  it('updateAdmin should validate passwordResetToken', async () => {
+    await authGoogle.addAdmin(adminPayload)
+    try {
+      await authGoogle.updateAdmin(adminPayload.email, { passwordResetToken: 40 })
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'passwordResetToken should be a string')
+    }
+
+    try {
+      await authGoogle.updateAdmin(adminPayload.email, { passwordResetToken: false })
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'passwordResetToken should be a string')
+    }
+
+    const update = await authGoogle.updateAdmin(adminPayload.email, { passwordResetToken: 'sample_token' })
+    assert.strictEqual(update.passwordResetToken, 'sample_token')
+  })
+
+  it('updateAdmin should validate passwordResetSentAt', async () => {
+    await authGoogle.addAdmin(adminPayload)
+    try {
+      await authGoogle.updateAdmin(adminPayload.email, { passwordResetSentAt: 'invalid date' })
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'passwordResetSentAt should be a valid date')
     }
 
-    const hasJustBeenCreated = payload => assert.ok(Date.now() - new Date(payload.timestamp) < 1000)
+    const now = new Date().toISOString()
+    const update = await authGoogle.updateAdmin(adminPayload.email, { passwordResetSentAt: now })
+    assert.strictEqual(update.passwordResetSentAt, now)
+  })
+
+  describe('getAdmin', () => {
+    const hasJustBeenCreated = payload => assert.ok(Date.now() - new Date(payload.timestamp + 'Z').getTime() < 1000)
 
     const assertions = (getAdminResult, expectedActive = true) => {
       assert.equal(getAdminResult.email, adminPayload.email)
@@ -197,4 +250,230 @@ describe('forms field', () => {
       assert.ok(!res)
     })
   })
+
+  describe('whitelistedIps field', () => {
+    const ips = ['192.168.1.1', '10.0.0.5']
+    const adminWithIps = {
+      email: testAdminEmail,
+      password: 'test123',
+      level: 0,
+      whitelistedIps: ips
+    }
+
+    it('should add admin and stringify whitelistedIps in the DB', async () => {
+      await authGoogle.addAdmin(adminWithIps)
+
+      await new Promise((resolve) => authGoogle.db.get('SELECT * FROM admin_users WHERE email=?', [testAdminEmail], (err, row) => {
+        if (err) throw err
+        assert.equal(row.whitelistedIps, JSON.stringify(ips))
+        resolve()
+      }))
+    })
+
+    it('should return whitelistedIps as a parsed array from getAdmin', async () => {
+      await authGoogle.addAdmin(adminWithIps)
+
+      const res = await authGoogle.getAdmin(testAdminEmail)
+
+      assert.deepEqual(res.whitelistedIps, ips)
+    })
+
+    it('should return undefined whitelistedIps when not set on admin', async () => {
+      await authGoogle.addAdmin({ email: testAdminEmail, password: 'test123', level: 0 })
+
+      const res = await authGoogle.getAdmin(testAdminEmail)
+
+      assert.equal(res.whitelistedIps, undefined)
+    })
+
+    it('should throw when adding admin with whitelistedIps not being an array', async () => {
+      try {
+        await authGoogle.addAdmin({ ...adminWithIps, whitelistedIps: '192.168.1.1' })
+        throw new Error('SHOULD_NOT_REACH_HERE')
+      } catch (e) {
+        assert.ok(e instanceof assert.AssertionError)
+        assert.strictEqual(e.message, 'whitelistedIps should be an array')
+      }
+    })
+
+    it('should update whitelistedIps and return the new list from getAdmin', async () => {
+      await authGoogle.addAdmin(adminWithIps)
+      const adminBeforeUpdate = await authGoogle.getAdmin(testAdminEmail)
+      assert.deepEqual(adminBeforeUpdate.whitelistedIps, ips)
+
+      const updatedIps = ['203.0.113.10']
+      await authGoogle.updateAdmin(testAdminEmail, { whitelistedIps: updatedIps })
+
+      const adminAfterUpdate = await authGoogle.getAdmin(testAdminEmail)
+      assert.deepEqual(adminAfterUpdate.whitelistedIps, updatedIps)
+    })
+  })
+
+  it('updateAdminPassword should change the user password if the old password is valid', async () => {
+    await authGoogle.addAdmin({ ...adminPayload })
+
+    let resp
+    const cb = (_, res) => {
+      resp = res
+    }
+    await authGoogle.loginAdmin({
+      user: {
+        username: adminPayload.email,
+        password: adminPayload.password
+      }
+    }, cb)
+    assert.strictEqual(resp.username, adminPayload.email)
+    assert.strictEqual(typeof resp.token, 'string')
+    assert.strictEqual(typeof resp.password, 'undefined')
+    assert.strictEqual(typeof resp.id, 'number')
+    assert.ok(resp.active)
+    assert.ok(Array.isArray(resp.privileges))
+
+    const passwordResetToken = 'sample_token'
+    const newPassword = 'newPassword'
+    assert.ok(adminPayload.password !== newPassword)
+    const successful = await authGoogle.updateAdminPassword(adminPayload.email, newPassword, adminPayload.password)
+    assert.strictEqual(successful, true)
+
+    await authGoogle.loginAdmin({
+      user: {
+        username: adminPayload.email,
+        password: newPassword
+      }
+    }, cb)
+    assert.strictEqual(resp.username, adminPayload.email)
+    assert.strictEqual(typeof resp.token, 'string')
+    assert.strictEqual(typeof resp.password, 'undefined')
+    assert.strictEqual(typeof resp.id, 'number')
+    assert.ok(resp.active)
+    assert.ok(Array.isArray(resp.privileges))
+  })
+
+  it('updateAdminPassword should validate the params', async () => {
+    try {
+      await authGoogle.updateAdminPassword(1)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'Email is required')
+    }
+
+    try {
+      await authGoogle.updateAdminPassword(adminPayload.email)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'New Password is required')
+    }
+
+    try {
+      await authGoogle.updateAdminPassword(adminPayload.email, 'newPassword')
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'Old Password is required')
+    }
+
+    try {
+      await authGoogle.updateAdminPassword(adminPayload.email, 'newPassword', adminPayload.password)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'ADMIN_ACCOUNT_DOES_NOT_EXIST_OR_IS_NOT_ACTIVE')
+    }
+
+    await authGoogle.addAdmin({ ...adminPayload })
+
+    try {
+      await authGoogle.updateAdminPassword(adminPayload.email, 'newPassword', 'wrongPassword')
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'INVALID_PASSWORD')
+    }
+  })
+
+  it('resetPassword should reset the user password if the token is valid', async () => {
+    await authGoogle.addAdmin({ ...adminPayload })
+
+    let resp
+    const cb = (_, res) => {
+      resp = res
+    }
+    await authGoogle.loginAdmin({
+      user: {
+        username: adminPayload.email,
+        password: adminPayload.password
+      }
+    }, cb)
+    assert.strictEqual(resp.username, adminPayload.email)
+    assert.strictEqual(typeof resp.token, 'string')
+    assert.strictEqual(typeof resp.password, 'undefined')
+    assert.strictEqual(typeof resp.id, 'number')
+    assert.ok(resp.active)
+    assert.ok(Array.isArray(resp.privileges))
+
+    const passwordResetToken = 'sample_token'
+    const update = await authGoogle.updateAdmin(adminPayload.email, { passwordResetToken, passwordResetSentAt: new Date().toISOString() })
+    assert.strictEqual(update.passwordResetToken, 'sample_token')
+
+    const newPassword = 'newPassword'
+    assert.ok(adminPayload.password !== newPassword)
+    const successful = await authGoogle.resetAdminPassword(adminPayload.email, newPassword, passwordResetToken)
+    assert.strictEqual(successful, true)
+
+    await authGoogle.loginAdmin({
+      user: {
+        username: adminPayload.email,
+        password: newPassword
+      }
+    }, cb)
+    assert.strictEqual(resp.username, adminPayload.email)
+    assert.strictEqual(typeof resp.token, 'string')
+    assert.strictEqual(typeof resp.password, 'undefined')
+    assert.strictEqual(typeof resp.id, 'number')
+    assert.ok(resp.active)
+    assert.ok(Array.isArray(resp.privileges))
+  })
+
+  it('resetPassword should validate the params', async () => {
+    try {
+      await authGoogle.resetAdminPassword(1)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'Email is required')
+    }
+
+    try {
+      await authGoogle.resetAdminPassword(adminPayload.email)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'New Password is required')
+    }
+
+    const passwordResetToken = 'sample_token'
+    try {
+      await authGoogle.resetAdminPassword(adminPayload.email, 'newPassword', passwordResetToken)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'ADMIN_ACCOUNT_DOES_NOT_EXIST_OR_IS_NOT_ACTIVE')
+    }
+
+    await authGoogle.addAdmin({ ...adminPayload })
+
+    try {
+      await authGoogle.resetAdminPassword(adminPayload.email, 'newPassword', passwordResetToken)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'INVALID_passwordResetToken')
+    }
+
+    const update = await authGoogle.updateAdmin(adminPayload.email, {
+      passwordResetToken,
+      passwordResetSentAt: new Date(2020, 1, 1).toISOString() // expired date
+    })
+    assert.strictEqual(update.passwordResetToken, 'sample_token')
+
+    try {
+      await authGoogle.resetAdminPassword(adminPayload.email, 'newPassword', passwordResetToken)
+      throw new Error('SHOULD_NOT_REACH_THIS_POINT')
+    } catch (err) {
+      assert.strictEqual(err.message, 'RESET_LINK_EXPIRED')
+    }
+  })
 })