@budibase/worker 2.3.20 → 2.3.21-alpha.1

package/src/api/routes/global/tests/auth.spec.ts

@@ -1,12 +1,27 @@
+import { CloudAccount, SSOUser, User } from "@budibase/types"
+
 jest.mock("nodemailer")
-import { TestConfiguration, mocks } from "../../../../tests"
+import {
+  TestConfiguration,
+  mocks,
+  structures,
+  generator,
+} from "../../../../tests"
 const sendMailMock = mocks.email.mock()
-import { events } from "@budibase/backend-core"
+import { events, constants } from "@budibase/backend-core"
+import { Response } from "superagent"
+
+import * as userSdk from "../../../../sdk/users"
+
+function getAuthCookie(response: Response) {
+  return response.headers["set-cookie"]
+    .find((s: string) => s.startsWith(`${constants.Cookie.Auth}=`))
+    .split("=")[1]
+    .split(";")[0]
+}
 
-const expectSetAuthCookie = (res: any) => {
-  expect(
-    res.get("Set-Cookie").find((c: string) => c.startsWith("budibase:auth"))
-  ).toBeDefined()
+const expectSetAuthCookie = (response: Response) => {
+  expect(getAuthCookie(response).length > 1).toBe(true)
 }
 
 describe("/api/global/auth", () => {
@@ -24,53 +39,237 @@ describe("/api/global/auth", () => {
     jest.clearAllMocks()
   })
 
+  async function createSSOUser() {
+    return config.doInTenant(async () => {
+      return userSdk.save(structures.users.ssoUser(), {
+        requirePassword: false,
+      })
+    })
+  }
+
   describe("password", () => {
     describe("POST /api/global/auth/:tenantId/login", () => {
-      it("should login", () => {})
+      it("logs in with correct credentials", async () => {
+        const tenantId = config.tenantId!
+        const email = config.user?.email!
+        const password = config.userPassword
+
+        const response = await config.api.auth.login(tenantId, email, password)
+
+        expectSetAuthCookie(response)
+        expect(events.auth.login).toBeCalledTimes(1)
+      })
+
+      it("should return 403 with incorrect credentials", async () => {
+        const tenantId = config.tenantId!
+        const email = config.user?.email!
+        const password = "incorrect"
+
+        const response = await config.api.auth.login(
+          tenantId,
+          email,
+          password,
+          { status: 403 }
+        )
+        expect(response.body).toEqual({
+          message: "Invalid credentials",
+          status: 403,
+        })
+      })
+
+      it("should return 403 when user doesn't exist", async () => {
+        const tenantId = config.tenantId!
+        const email = "invaliduser@test.com"
+        const password = "password"
+
+        const response = await config.api.auth.login(
+          tenantId,
+          email,
+          password,
+          { status: 403 }
+        )
+        expect(response.body).toEqual({
+          message: "Invalid credentials",
+          status: 403,
+        })
+      })
+
+      describe("sso user", () => {
+        let user: User
+
+        async function testSSOUser() {
+          const tenantId = user.tenantId!
+          const email = user.email
+          const password = "test"
+
+          const response = await config.api.auth.login(
+            tenantId,
+            email,
+            password,
+            { status: 403 }
+          )
+
+          expect(response.body).toEqual({
+            message: "Invalid credentials",
+            status: 403,
+          })
+        }
+
+        describe("budibase sso user", () => {
+          it("should prevent user from logging in", async () => {
+            user = await createSSOUser()
+            await testSSOUser()
+          })
+        })
+
+        describe("root account sso user", () => {
+          it("should prevent user from logging in", async () => {
+            user = await config.createUser()
+            const account = structures.accounts.ssoAccount() as CloudAccount
+            mocks.accounts.getAccount.mockReturnValueOnce(
+              Promise.resolve(account)
+            )
+
+            await testSSOUser()
+          })
+        })
+      })
     })
 
     describe("POST /api/global/auth/logout", () => {
       it("should logout", async () => {
-        await config.api.auth.logout()
+        const response = await config.api.auth.logout()
         expect(events.auth.logout).toBeCalledTimes(1)
 
-        // TODO: Verify sessions deleted
+        const authCookie = getAuthCookie(response)
+        expect(authCookie).toBe("")
       })
     })
 
     describe("POST /api/global/auth/:tenantId/reset", () => {
       it("should generate password reset email", async () => {
+        const user = await config.createUser()
+
         const { res, code } = await config.api.auth.requestPasswordReset(
-          sendMailMock
+          sendMailMock,
+          user.email
         )
-        const user = await config.getUser("test@test.com")
 
         expect(res.body).toEqual({
           message: "Please check your email for a reset link.",
         })
         expect(sendMailMock).toHaveBeenCalled()
-
         expect(code).toBeDefined()
         expect(events.user.passwordResetRequested).toBeCalledTimes(1)
         expect(events.user.passwordResetRequested).toBeCalledWith(user)
       })
+
+      describe("sso user", () => {
+        let user: User
+
+        async function testSSOUser() {
+          const { res } = await config.api.auth.requestPasswordReset(
+            sendMailMock,
+            user.email
+          )
+          expect(sendMailMock).not.toHaveBeenCalled()
+        }
+
+        describe("budibase sso user", () => {
+          it("should prevent user from generating password reset email", async () => {
+            user = await createSSOUser()
+            await testSSOUser()
+          })
+        })
+
+        describe("root account sso user", () => {
+          it("should prevent user from generating password reset email", async () => {
+            user = await config.createUser(structures.users.user())
+            const account = structures.accounts.ssoAccount() as CloudAccount
+            mocks.accounts.getAccount.mockReturnValueOnce(
+              Promise.resolve(account)
+            )
+
+            await testSSOUser()
+          })
+        })
+      })
     })
 
     describe("POST /api/global/auth/:tenantId/reset/update", () => {
       it("should reset password", async () => {
+        let user = await config.createUser()
         const { code } = await config.api.auth.requestPasswordReset(
-          sendMailMock
+          sendMailMock,
+          user.email
         )
-        const user = await config.getUser("test@test.com")
         delete user.password
 
-        const res = await config.api.auth.updatePassword(code)
+        const newPassword = "newpassword"
+        const res = await config.api.auth.updatePassword(code!, newPassword)
+
+        user = await config.getUser(user.email)
+        delete user.password
 
         expect(res.body).toEqual({ message: "password reset successfully." })
         expect(events.user.passwordReset).toBeCalledTimes(1)
         expect(events.user.passwordReset).toBeCalledWith(user)
 
-        // TODO: Login using new password
+        // login using new password
+        await config.api.auth.login(user.tenantId, user.email, newPassword)
+      })
+
+      describe("sso user", () => {
+        let user: User | SSOUser
+
+        async function testSSOUser(code: string) {
+          const res = await config.api.auth.updatePassword(
+            code!,
+            generator.string(),
+            { status: 400 }
+          )
+
+          expect(res.body).toEqual({
+            message: "Cannot reset password.",
+            status: 400,
+          })
+        }
+
+        describe("budibase sso user", () => {
+          it("should prevent user from generating password reset email", async () => {
+            user = await config.createUser()
+            const { code } = await config.api.auth.requestPasswordReset(
+              sendMailMock,
+              user.email
+            )
+
+            // convert to sso now that password reset has been requested
+            const ssoUser = user as SSOUser
+            ssoUser.providerType = structures.sso.providerType()
+            delete ssoUser.password
+            await config.doInTenant(() => userSdk.save(ssoUser))
+
+            await testSSOUser(code!)
+          })
+        })
+
+        describe("root account sso user", () => {
+          it("should prevent user from generating password reset email", async () => {
+            user = await config.createUser()
+            const { code } = await config.api.auth.requestPasswordReset(
+              sendMailMock,
+              user.email
+            )
+
+            // convert to account owner now that password has been requested
+            const account = structures.accounts.ssoAccount() as CloudAccount
+            mocks.accounts.getAccount.mockReturnValueOnce(
+              Promise.resolve(account)
+            )
+
+            await testSSOUser(code!)
+          })
+        })
       })
     })
   })
@@ -145,7 +344,7 @@ describe("/api/global/auth", () => {
         const location: string = res.get("location")
         expect(
           location.startsWith(
-            "http://localhost/auth?response_type=code&client_id=clientId&redirect_uri=http%3A%2F%2Flocalhost%3A10000%2Fapi%2Fglobal%2Fauth%2Fdefault%2Foidc%2Fcallback&scope=openid%20profile%20email%20offline_access"
+            `http://localhost/auth?response_type=code&client_id=clientId&redirect_uri=http%3A%2F%2Flocalhost%3A10000%2Fapi%2Fglobal%2Fauth%2F${config.tenantId}%2Foidc%2Fcallback&scope=openid%20profile%20email%20offline_access`
           )
         ).toBe(true)
       })
@@ -158,7 +357,7 @@ describe("/api/global/auth", () => {
 
         const res = await config.api.configs.OIDCCallback(configId, preAuthRes)
 
-        expect(events.auth.login).toBeCalledWith("oidc")
+        expect(events.auth.login).toBeCalledWith("oidc", "oauth@example.com")
         expect(events.auth.login).toBeCalledTimes(1)
         expect(res.status).toBe(302)
         const location: string = res.get("location")

package/src/api/routes/global/tests/configs.spec.ts

@@ -2,12 +2,13 @@
 jest.mock("nodemailer")
 import { TestConfiguration, structures, mocks } from "../../../../tests"
 mocks.email.mock()
-import { Config, events } from "@budibase/backend-core"
+import { events } from "@budibase/backend-core"
+import { GetPublicSettingsResponse, Config, ConfigType } from "@budibase/types"
 
 describe("configs", () => {
   const config = new TestConfiguration()
 
-  beforeAll(async () => {
+  beforeEach(async () => {
     await config.beforeAll()
   })
 
@@ -19,22 +20,29 @@ describe("configs", () => {
     await config.afterAll()
   })
 
-  describe("post /api/global/configs", () => {
-    const saveConfig = async (conf: any, _id?: string, _rev?: string) => {
-      const data = {
-        ...conf,
-        _id,
-        _rev,
-      }
-
-      const res = await config.api.configs.saveConfig(data)
-
-      return {
-        ...data,
-        ...res.body,
-      }
+  const saveConfig = async (conf: Config, _id?: string, _rev?: string) => {
+    const data = {
+      ...conf,
+      _id,
+      _rev,
     }
-
+    const res = await config.api.configs.saveConfig(data)
+    return {
+      ...data,
+      ...res.body,
+    }
+  }
+
+  const saveSettingsConfig = async (
+    conf?: any,
+    _id?: string,
+    _rev?: string
+  ) => {
+    const settingsConfig = structures.configs.settings(conf)
+    return saveConfig(settingsConfig, _id, _rev)
+  }
+
+  describe("POST /api/global/configs", () => {
     describe("google", () => {
       const saveGoogleConfig = async (
         conf?: any,
@@ -49,20 +57,20 @@ describe("configs", () => {
         it("should create activated google config", async () => {
           await saveGoogleConfig()
           expect(events.auth.SSOCreated).toBeCalledTimes(1)
-          expect(events.auth.SSOCreated).toBeCalledWith(Config.GOOGLE)
+          expect(events.auth.SSOCreated).toBeCalledWith(ConfigType.GOOGLE)
           expect(events.auth.SSODeactivated).not.toBeCalled()
           expect(events.auth.SSOActivated).toBeCalledTimes(1)
-          expect(events.auth.SSOActivated).toBeCalledWith(Config.GOOGLE)
-          await config.deleteConfig(Config.GOOGLE)
+          expect(events.auth.SSOActivated).toBeCalledWith(ConfigType.GOOGLE)
+          await config.deleteConfig(ConfigType.GOOGLE)
         })
 
         it("should create deactivated google config", async () => {
           await saveGoogleConfig({ activated: false })
           expect(events.auth.SSOCreated).toBeCalledTimes(1)
-          expect(events.auth.SSOCreated).toBeCalledWith(Config.GOOGLE)
+          expect(events.auth.SSOCreated).toBeCalledWith(ConfigType.GOOGLE)
           expect(events.auth.SSOActivated).not.toBeCalled()
           expect(events.auth.SSODeactivated).not.toBeCalled()
-          await config.deleteConfig(Config.GOOGLE)
+          await config.deleteConfig(ConfigType.GOOGLE)
         })
       })
 
@@ -76,11 +84,11 @@ describe("configs", () => {
             googleConf._rev
           )
           expect(events.auth.SSOUpdated).toBeCalledTimes(1)
-          expect(events.auth.SSOUpdated).toBeCalledWith(Config.GOOGLE)
+          expect(events.auth.SSOUpdated).toBeCalledWith(ConfigType.GOOGLE)
           expect(events.auth.SSOActivated).not.toBeCalled()
           expect(events.auth.SSODeactivated).toBeCalledTimes(1)
-          expect(events.auth.SSODeactivated).toBeCalledWith(Config.GOOGLE)
-          await config.deleteConfig(Config.GOOGLE)
+          expect(events.auth.SSODeactivated).toBeCalledWith(ConfigType.GOOGLE)
+          await config.deleteConfig(ConfigType.GOOGLE)
         })
 
         it("should update google config to activated", async () => {
@@ -92,11 +100,11 @@ describe("configs", () => {
             googleConf._rev
           )
           expect(events.auth.SSOUpdated).toBeCalledTimes(1)
-          expect(events.auth.SSOUpdated).toBeCalledWith(Config.GOOGLE)
+          expect(events.auth.SSOUpdated).toBeCalledWith(ConfigType.GOOGLE)
           expect(events.auth.SSODeactivated).not.toBeCalled()
           expect(events.auth.SSOActivated).toBeCalledTimes(1)
-          expect(events.auth.SSOActivated).toBeCalledWith(Config.GOOGLE)
-          await config.deleteConfig(Config.GOOGLE)
+          expect(events.auth.SSOActivated).toBeCalledWith(ConfigType.GOOGLE)
+          await config.deleteConfig(ConfigType.GOOGLE)
         })
       })
     })
@@ -115,20 +123,20 @@ describe("configs", () => {
         it("should create activated OIDC config", async () => {
           await saveOIDCConfig()
           expect(events.auth.SSOCreated).toBeCalledTimes(1)
-          expect(events.auth.SSOCreated).toBeCalledWith(Config.OIDC)
+          expect(events.auth.SSOCreated).toBeCalledWith(ConfigType.OIDC)
           expect(events.auth.SSODeactivated).not.toBeCalled()
           expect(events.auth.SSOActivated).toBeCalledTimes(1)
-          expect(events.auth.SSOActivated).toBeCalledWith(Config.OIDC)
-          await config.deleteConfig(Config.OIDC)
+          expect(events.auth.SSOActivated).toBeCalledWith(ConfigType.OIDC)
+          await config.deleteConfig(ConfigType.OIDC)
         })
 
         it("should create deactivated OIDC config", async () => {
           await saveOIDCConfig({ activated: false })
           expect(events.auth.SSOCreated).toBeCalledTimes(1)
-          expect(events.auth.SSOCreated).toBeCalledWith(Config.OIDC)
+          expect(events.auth.SSOCreated).toBeCalledWith(ConfigType.OIDC)
           expect(events.auth.SSOActivated).not.toBeCalled()
           expect(events.auth.SSODeactivated).not.toBeCalled()
-          await config.deleteConfig(Config.OIDC)
+          await config.deleteConfig(ConfigType.OIDC)
         })
       })
 
@@ -142,11 +150,11 @@ describe("configs", () => {
             oidcConf._rev
           )
           expect(events.auth.SSOUpdated).toBeCalledTimes(1)
-          expect(events.auth.SSOUpdated).toBeCalledWith(Config.OIDC)
+          expect(events.auth.SSOUpdated).toBeCalledWith(ConfigType.OIDC)
           expect(events.auth.SSOActivated).not.toBeCalled()
           expect(events.auth.SSODeactivated).toBeCalledTimes(1)
-          expect(events.auth.SSODeactivated).toBeCalledWith(Config.OIDC)
-          await config.deleteConfig(Config.OIDC)
+          expect(events.auth.SSODeactivated).toBeCalledWith(ConfigType.OIDC)
+          await config.deleteConfig(ConfigType.OIDC)
         })
 
         it("should update OIDC config to activated", async () => {
@@ -158,11 +166,11 @@ describe("configs", () => {
             oidcConf._rev
           )
           expect(events.auth.SSOUpdated).toBeCalledTimes(1)
-          expect(events.auth.SSOUpdated).toBeCalledWith(Config.OIDC)
+          expect(events.auth.SSOUpdated).toBeCalledWith(ConfigType.OIDC)
           expect(events.auth.SSODeactivated).not.toBeCalled()
           expect(events.auth.SSOActivated).toBeCalledTimes(1)
-          expect(events.auth.SSOActivated).toBeCalledWith(Config.OIDC)
-          await config.deleteConfig(Config.OIDC)
+          expect(events.auth.SSOActivated).toBeCalledWith(ConfigType.OIDC)
+          await config.deleteConfig(ConfigType.OIDC)
         })
       })
     })
@@ -179,11 +187,11 @@ describe("configs", () => {
 
       describe("create", () => {
         it("should create SMTP config", async () => {
-          await config.deleteConfig(Config.SMTP)
+          await config.deleteConfig(ConfigType.SMTP)
           await saveSMTPConfig()
           expect(events.email.SMTPUpdated).not.toBeCalled()
           expect(events.email.SMTPCreated).toBeCalledTimes(1)
-          await config.deleteConfig(Config.SMTP)
+          await config.deleteConfig(ConfigType.SMTP)
         })
       })
 
@@ -194,24 +202,15 @@ describe("configs", () => {
           await saveSMTPConfig(smtpConf.config, smtpConf._id, smtpConf._rev)
           expect(events.email.SMTPCreated).not.toBeCalled()
           expect(events.email.SMTPUpdated).toBeCalledTimes(1)
-          await config.deleteConfig(Config.SMTP)
+          await config.deleteConfig(ConfigType.SMTP)
         })
       })
     })
 
     describe("settings", () => {
-      const saveSettingsConfig = async (
-        conf?: any,
-        _id?: string,
-        _rev?: string
-      ) => {
-        const settingsConfig = structures.configs.settings(conf)
-        return saveConfig(settingsConfig, _id, _rev)
-      }
-
       describe("create", () => {
         it("should create settings config with default settings", async () => {
-          await config.deleteConfig(Config.SETTINGS)
+          await config.deleteConfig(ConfigType.SETTINGS)
 
           await saveSettingsConfig()
 
@@ -221,8 +220,8 @@ describe("configs", () => {
         })
 
         it("should create settings config with non-default settings", async () => {
-          config.modeSelf()
-          await config.deleteConfig(Config.SETTINGS)
+          config.selfHosted()
+          await config.deleteConfig(ConfigType.SETTINGS)
           const conf = {
             company: "acme",
             logoUrl: "http://example.com",
@@ -234,14 +233,14 @@ describe("configs", () => {
           expect(events.org.nameUpdated).toBeCalledTimes(1)
           expect(events.org.logoUpdated).toBeCalledTimes(1)
           expect(events.org.platformURLUpdated).toBeCalledTimes(1)
-          config.modeCloud()
+          config.cloudHosted()
         })
       })
 
       describe("update", () => {
         it("should update settings config", async () => {
-          config.modeSelf()
-          await config.deleteConfig(Config.SETTINGS)
+          config.selfHosted()
+          await config.deleteConfig(ConfigType.SETTINGS)
           const settingsConfig = await saveSettingsConfig()
           settingsConfig.config.company = "acme"
           settingsConfig.config.logoUrl = "http://example.com"
@@ -256,20 +255,49 @@ describe("configs", () => {
           expect(events.org.nameUpdated).toBeCalledTimes(1)
           expect(events.org.logoUpdated).toBeCalledTimes(1)
           expect(events.org.platformURLUpdated).toBeCalledTimes(1)
-          config.modeCloud()
+          config.cloudHosted()
         })
       })
     })
   })
 
-  it("should return the correct checklist status based on the state of the budibase installation", async () => {
-    await config.saveSmtpConfig()
+  describe("GET /api/global/configs/checklist", () => {
+    it("should return the correct checklist", async () => {
+      await config.saveSmtpConfig()
+
+      const res = await config.api.configs.getConfigChecklist()
+      const checklist = res.body
 
-    const res = await config.api.configs.getConfigChecklist()
-    const checklist = res.body
+      expect(checklist.apps.checked).toBeFalsy()
+      expect(checklist.smtp.checked).toBeTruthy()
+      expect(checklist.adminUser.checked).toBeTruthy()
+    })
+  })
 
-    expect(checklist.apps.checked).toBeFalsy()
-    expect(checklist.smtp.checked).toBeTruthy()
-    expect(checklist.adminUser.checked).toBeTruthy()
+  describe("GET /api/global/configs/public", () => {
+    it("should return the expected public settings", async () => {
+      await saveSettingsConfig()
+
+      const res = await config.api.configs.getPublicSettings()
+      const body = res.body as GetPublicSettingsResponse
+
+      const expected = {
+        _id: "config_settings",
+        type: "settings",
+        config: {
+          company: "Budibase",
+          logoUrl: "",
+          analyticsEnabled: false,
+          google: true,
+          googleCallbackUrl: `http://localhost:10000/api/global/auth/${config.tenantId}/google/callback`,
+          isSSOEnforced: false,
+          oidc: false,
+          oidcCallbackUrl: `http://localhost:10000/api/global/auth/${config.tenantId}/oidc/callback`,
+          platformUrl: "http://localhost:10000",
+        },
+      }
+      delete body._rev
+      expect(body).toEqual(expected)
+    })
   })
 })

package/src/api/routes/global/tests/realEmail.spec.ts

@@ -1,3 +1,4 @@
+jest.unmock("node-fetch")
 import { TestConfiguration } from "../../../../tests"
 import { EmailTemplatePurpose } from "../../../../constants"
 const nodemailer = require("nodemailer")

package/src/api/routes/global/tests/roles.spec.ts

@@ -1,6 +1,7 @@
 import { structures, TestConfiguration } from "../../../../tests"
 import { context, db, permissions, roles } from "@budibase/backend-core"
 import { Mock } from "jest-mock"
+import { Database } from "@budibase/types"
 
 jest.mock("@budibase/backend-core", () => {
   const core = jest.requireActual("@budibase/backend-core")
@@ -16,14 +17,13 @@ jest.mock("@budibase/backend-core", () => {
   }
 })
 
-const appDb = db.getDB("app_test")
-const mockAppDB = context.getAppDB as Mock
-mockAppDB.mockReturnValue(appDb)
+let appId: string
+let appDb: Database
 
 async function addAppMetadata() {
   await appDb.put({
     _id: "app_metadata",
-    appId: "app_test",
+    appId: appId,
     name: "New App",
     version: "version",
     url: "url",
@@ -32,6 +32,7 @@ async function addAppMetadata() {
 
 describe("/api/global/roles", () => {
   const config = new TestConfiguration()
+
   const role = new roles.Role(
     db.generateRoleID("newRole"),
     roles.BUILTIN_ROLE_IDS.BASIC,
@@ -39,12 +40,19 @@ describe("/api/global/roles", () => {
   )
 
   beforeAll(async () => {
-    console.debug(role)
-    appDb.put(role)
-    await addAppMetadata()
     await config.beforeAll()
   })
 
+  beforeEach(async () => {
+    appId = db.generateAppID(config.tenantId)
+    appDb = db.getDB(appId)
+    const mockAppDB = context.getAppDB as Mock
+    mockAppDB.mockReturnValue(appDb)
+
+    await addAppMetadata()
+    await appDb.put(role)
+  })
+
   afterAll(async () => {
     await config.afterAll()
   })
@@ -57,16 +65,14 @@ describe("/api/global/roles", () => {
     it("retrieves roles", async () => {
       const res = await config.api.roles.get()
       expect(res.body).toBeDefined()
-      expect(res.body["app_test"].roles.length).toEqual(5)
-      expect(res.body["app_test"].roles.map((r: any) => r._id)).toContain(
-        role._id
-      )
+      expect(res.body[appId].roles.length).toEqual(5)
+      expect(res.body[appId].roles.map((r: any) => r._id)).toContain(role._id)
     })
   })
 
   describe("GET api/global/roles/:appId", () => {
     it("finds a role by appId", async () => {
-      const res = await config.api.roles.find("app_test")
+      const res = await config.api.roles.find(appId)
       expect(res.body).toBeDefined()
       expect(res.body.name).toEqual("New App")
     })
@@ -79,9 +85,9 @@ describe("/api/global/roles", () => {
         app_test: "role1",
       }
       const userResponse = await config.createUser(user)
-      const res = await config.api.roles.remove("app_test")
+      const res = await config.api.roles.remove(appId)
       const updatedUser = await config.api.users.getUser(userResponse._id!)
-      expect(updatedUser.body.roles).not.toHaveProperty("app_test")
+      expect(updatedUser.body.roles).not.toHaveProperty(appId)
       expect(res.body.message).toEqual("App role removed from all users")
     })
   })