@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/tests/cases/integration/mocked/prepareOtpMutation.test.ts

@@ -1,12 +1,18 @@
-import { authenticatedIdentityId, executeTenantTest } from '../../../src/testTenant'
-import { testUuid } from '../../../src/testUuid'
-import { prepareOtpMutation } from './gql/prepareOtp'
-import { getPersonByIdentity } from './sql/getPersonByIdentity'
+import { authenticatedIdentityId, executeTenantTest, now } from '../../../src/testTenant.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { prepareOtpMutation } from './gql/prepareOtp.js'
+import { getPersonByIdentity } from './sql/getPersonByIdentity.js'
 import { expect, test } from 'bun:test'
+import { Buffer } from 'buffer'
 
 test('prepare otp', async () => {
 	const personId = testUuid(1)
 	await executeTenantTest({
+		providers: {
+			// Encrypt the freshly generated secret into the pending slot (version >= 1).
+			encrypt: (value: Buffer) => Promise.resolve({ value: Buffer.concat([Buffer.from('ENC:'), value]), version: 1 }),
+			encryptionEnabled: true,
+		},
 		query: prepareOtpMutation({}),
 		executes: [
 			getPersonByIdentity({
@@ -19,8 +25,19 @@ test('prepare otp', async () => {
 				},
 			}),
 			{
-				sql: `update "tenant"."person" set "otp_uri" = ?, "otp_activated_at" = ? where "id" = ?`,
-				parameters: [(url: string) => url.startsWith('otpauth:'), null, personId],
+				sql: `insert into "tenant"."person_mfa" ("person_id", "totp_pending_secret", "totp_pending_version", "totp_pending_created_at")
+					values (?, ?, ?, ?)
+					on conflict ("person_id")
+					do update set "totp_pending_secret" = ?, "totp_pending_version" = ?, "totp_pending_created_at" = ?`,
+				parameters: [
+					personId,
+					(value: Buffer) => Buffer.isBuffer(value) && value.toString('utf8').startsWith('ENC:'),
+					1,
+					now,
+					(value: Buffer) => Buffer.isBuffer(value) && value.toString('utf8').startsWith('ENC:'),
+					1,
+					now,
+				],
 				response: {
 					rowCount: 1,
 				},
@@ -32,3 +49,89 @@ test('prepare otp', async () => {
 		},
 	})
 })
+
+test('prepare otp does not disable an existing active secret (rollover)', async () => {
+	const personId = testUuid(1)
+	const activeUri = 'otpauth://totp/contember:john?secret=ABDEF&period=30&digits=6&algorithm=SHA1&issuer=contember'
+	await executeTenantTest({
+		providers: {
+			encrypt: (value: Buffer) => Promise.resolve({ value: Buffer.concat([Buffer.from('ENC:'), value]), version: 1 }),
+			encryptionEnabled: true,
+		},
+		query: prepareOtpMutation({}),
+		executes: [
+			getPersonByIdentity({
+				identityId: authenticatedIdentityId,
+				response: {
+					personId,
+					password: '123',
+					roles: [],
+					email: 'john@doe.com',
+					// person already has an active TOTP factor
+					otpUri: activeUri,
+				},
+			}),
+			{
+				// Only the pending slot is written; the active secret is never touched.
+				sql: `insert into "tenant"."person_mfa" ("person_id", "totp_pending_secret", "totp_pending_version", "totp_pending_created_at")
+					values (?, ?, ?, ?)
+					on conflict ("person_id")
+					do update set "totp_pending_secret" = ?, "totp_pending_version" = ?, "totp_pending_created_at" = ?`,
+				parameters: [
+					personId,
+					(value: Buffer) => Buffer.isBuffer(value) && value.toString('utf8').startsWith('ENC:'),
+					1,
+					now,
+					(value: Buffer) => Buffer.isBuffer(value) && value.toString('utf8').startsWith('ENC:'),
+					1,
+					now,
+				],
+				response: { rowCount: 1 },
+			},
+		],
+		// No auth log expected: the premature 2fa_disable on prepare was removed.
+		return: (response: any) => {
+			expect(response.data.prepareOtp.ok).toEqual(true)
+		},
+	})
+})
+
+test('prepare otp without an encryption key stores the plaintext URI as version 0', async () => {
+	const personId = testUuid(1)
+	await executeTenantTest({
+		// No `encrypt` override and encryptionEnabled stays false (the default): the
+		// otpauth URI must be stored as version-0 plaintext, like legacy secrets.
+		query: prepareOtpMutation({}),
+		executes: [
+			getPersonByIdentity({
+				identityId: authenticatedIdentityId,
+				response: {
+					personId,
+					password: '123',
+					roles: [],
+					email: 'john@doe.com',
+				},
+			}),
+			{
+				sql: `insert into "tenant"."person_mfa" ("person_id", "totp_pending_secret", "totp_pending_version", "totp_pending_created_at")
+					values (?, ?, ?, ?)
+					on conflict ("person_id")
+					do update set "totp_pending_secret" = ?, "totp_pending_version" = ?, "totp_pending_created_at" = ?`,
+				parameters: [
+					personId,
+					(value: Buffer) => Buffer.isBuffer(value) && value.toString('utf8').startsWith('otpauth://'),
+					0,
+					now,
+					(value: Buffer) => Buffer.isBuffer(value) && value.toString('utf8').startsWith('otpauth://'),
+					0,
+					now,
+				],
+				response: { rowCount: 1 },
+			},
+		],
+		return: (response: any) => {
+			expect(response.data.prepareOtp.ok).toEqual(true)
+			expect(response.data.prepareOtp.result.otpUri).toMatch(/otpauth:.+/)
+		},
+	})
+})

package/tests/cases/integration/mocked/projectApiKeysQuery.test.ts

@@ -0,0 +1,142 @@
+import { executeTenantTest, now } from '../../../src/testTenant.js'
+import { GQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { test } from 'bun:test'
+import { getProjectBySlugSql } from './sql/getProjectBySlugSql.js'
+import { projectApiKeysSql } from './sql/listApiKeysSql.js'
+
+test('project.apiKeys lists permanent project api keys', async () => {
+	const projectId = testUuid(1)
+	const apiKeyId = testUuid(10)
+	const identityId = testUuid(11)
+
+	await executeTenantTest({
+		query: {
+			query: GQL`
+query {
+	projectBySlug(slug: "sandbox") {
+		apiKeys {
+			id
+			description
+			type
+			enabled
+			createdAt
+			lastUsedAt
+			expiresAt
+			identity {
+				id
+			}
+		}
+	}
+}`,
+			variables: {},
+		},
+		executes: [
+			getProjectBySlugSql({
+				projectSlug: 'sandbox',
+				response: { id: projectId, name: 'sandbox', slug: 'sandbox', config: {} },
+			}),
+			projectApiKeysSql({
+				projectId,
+				rows: [
+					{ id: apiKeyId, identityId, description: 'CI token', createdAt: now, disabledAt: null },
+				],
+			}),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					apiKeys: [
+						{
+							id: apiKeyId,
+							description: 'CI token',
+							type: 'PERMANENT',
+							enabled: true,
+							createdAt: now.toISOString(),
+							lastUsedAt: null,
+							expiresAt: null,
+							identity: { id: identityId },
+						},
+					],
+				},
+			},
+		},
+	})
+})
+
+test('project.apiKeys reports enabled=false for disabled key', async () => {
+	const projectId = testUuid(1)
+	const apiKeyId = testUuid(10)
+	const identityId = testUuid(11)
+
+	await executeTenantTest({
+		query: {
+			query: GQL`
+query {
+	projectBySlug(slug: "sandbox") {
+		apiKeys {
+			id
+			enabled
+		}
+	}
+}`,
+			variables: {},
+		},
+		executes: [
+			getProjectBySlugSql({
+				projectSlug: 'sandbox',
+				response: { id: projectId, name: 'sandbox', slug: 'sandbox', config: {} },
+			}),
+			projectApiKeysSql({
+				projectId,
+				rows: [
+					{ id: apiKeyId, identityId, createdAt: now, disabledAt: now },
+				],
+			}),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					apiKeys: [
+						{ id: apiKeyId, enabled: false },
+					],
+				},
+			},
+		},
+	})
+})
+
+test('project.apiKeys returns empty (no key query) for a caller without project view members', async () => {
+	const projectId = testUuid(1)
+
+	await executeTenantTest({
+		query: {
+			query: GQL`
+query {
+	projectBySlug(slug: "sandbox") {
+		apiKeys {
+			id
+		}
+	}
+}`,
+			variables: {},
+		},
+		// Allows project:view (so projectBySlug resolves) but denies project:viewMembers.
+		authorizator: {
+			isAllowed: async (identity, scope, action) => action.resource === 'project' && action.privilege === 'view',
+		},
+		executes: [
+			getProjectBySlugSql({
+				projectSlug: 'sandbox',
+				response: { id: projectId, name: 'sandbox', slug: 'sandbox', config: {} },
+			}),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					apiKeys: [],
+				},
+			},
+		},
+	})
+})

package/tests/cases/integration/mocked/projectSecretsQuery.test.ts

@@ -0,0 +1,86 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { test } from 'bun:test'
+import { getProjectBySlugSql } from './sql/getProjectBySlugSql.js'
+import { listProjectSecretsSql } from './sql/listProjectSecretsSql.js'
+
+test('project.secrets lists secret keys without values', async () => {
+	const projectId = testUuid(1)
+	const createdAt = new Date('2019-09-01 10:00')
+	const updatedAt = new Date('2019-09-02 10:00')
+
+	await executeTenantTest({
+		query: {
+			query: GQL`
+query {
+	projectBySlug(slug: "sandbox") {
+		secrets {
+			key
+			createdAt
+			updatedAt
+		}
+	}
+}`,
+			variables: {},
+		},
+		executes: [
+			getProjectBySlugSql({
+				projectSlug: 'sandbox',
+				response: { id: projectId, name: 'sandbox', slug: 'sandbox', config: {} },
+			}),
+			listProjectSecretsSql({
+				projectId,
+				rows: [
+					{ key: 'API_TOKEN', createdAt, updatedAt },
+					{ key: 'WEBHOOK_SECRET', createdAt, updatedAt },
+				],
+			}),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					secrets: [
+						{ key: 'API_TOKEN', createdAt: createdAt.toISOString(), updatedAt: updatedAt.toISOString() },
+						{ key: 'WEBHOOK_SECRET', createdAt: createdAt.toISOString(), updatedAt: updatedAt.toISOString() },
+					],
+				},
+			},
+		},
+	})
+})
+
+test('project.secrets returns empty (no secrets query) for a caller without project:viewSecrets', async () => {
+	const projectId = testUuid(1)
+
+	await executeTenantTest({
+		query: {
+			query: GQL`
+query {
+	projectBySlug(slug: "sandbox") {
+		secrets {
+			key
+		}
+	}
+}`,
+			variables: {},
+		},
+		// Allows project:view (so projectBySlug resolves) but denies project:viewSecrets.
+		authorizator: {
+			isAllowed: async (identity, scope, action) => action.resource === 'project' && action.privilege === 'view',
+		},
+		executes: [
+			getProjectBySlugSql({
+				projectSlug: 'sandbox',
+				response: { id: projectId, name: 'sandbox', slug: 'sandbox', config: {} },
+			}),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					secrets: [],
+				},
+			},
+		},
+	})
+})

package/tests/cases/integration/mocked/removeProjectMemberMutation.test.ts

@@ -1,14 +1,18 @@
-import { GQL, SQL } from '../../../src/tags'
-import { testUuid } from '../../../src/testUuid'
-import { executeTenantTest } from '../../../src/testTenant'
-import { selectMembershipsSql } from './sql/selectMembershipsSql'
-import { getProjectBySlugSql } from './sql/getProjectBySlugSql'
-import { sqlTransaction } from './sql/sqlTransaction'
+import { GQL, SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
+import { getProjectBySlugSql } from './sql/getProjectBySlugSql.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
+import { getPersonsByIdentitySql } from './sql/getPersonsByIdentitySql.js'
 import { test } from 'bun:test'
 
 test('removes a project member', async () => {
 	const identityId = testUuid(6)
 	const projectId = testUuid(5)
+	const personId = testUuid(7)
+	const role = 'editor'
+	const beforeMemberships = [{ role, variables: [] }]
 	await executeTenantTest({
 		query: GQL`mutation {
           removeProjectMember(projectSlug: "blog", identityId: "${identityId}") {
@@ -23,7 +27,12 @@ test('removes a project member', async () => {
 			selectMembershipsSql({
 				identityId,
 				projectId,
-				membershipsResponse: [{ role: 'editor', variables: [] }],
+				membershipsResponse: beforeMemberships,
+			}),
+			selectMembershipsSql({
+				identityId,
+				projectId,
+				membershipsResponse: beforeMemberships,
 			}),
 			...sqlTransaction({
 				sql: SQL`DELETE
@@ -34,6 +43,10 @@ test('removes a project member', async () => {
 					rowCount: 1,
 				},
 			}),
+			getPersonsByIdentitySql({
+				identityIds: [identityId],
+				response: [{ personId, identityId, email: 'john@doe.com' }],
+			}),
 		],
 		return: {
 			data: {
@@ -43,5 +56,16 @@ test('removes a project member', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'project_membership_remove',
+			response: { ok: true, result: null },
+			targetPersonId: personId,
+			eventData: {
+				projectId,
+				identityId,
+				before: beforeMemberships,
+				after: [],
+			},
+		},
 	})
 })

package/tests/cases/integration/mocked/requestEmailVerificationMutation.test.ts

@@ -0,0 +1,191 @@
+import { executeTenantTest, now } from '../../../src/testTenant.js'
+import { SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { expect, test } from 'bun:test'
+import { requestEmailVerificationMutation } from './gql/emailVerification.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { getNextMailAttemptSql } from './sql/getNextMailAttemptSql.js'
+import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { getMailTemplateSql } from './sql/getMailTemplateSql.js'
+import { ExpectedQuery } from '@contember/database-tester'
+
+const anyString = (val: unknown) => typeof val === 'string'
+const isDate = (val: unknown) => val instanceof Date
+
+// Mirrors RateLimitCountQuery — whitespace/case are normalised by the matcher.
+const rateLimitCountSql = (args: { scope: string; keyHash: Buffer; count: number }): ExpectedQuery => ({
+	sql: `select count(*)::text as count from "tenant"."rate_limit_event"
+		where "scope" = ? and "key_hash" = ? and occurred_at >= NOW() - make_interval(secs => ?)`,
+	parameters: [args.scope, args.keyHash, (val: unknown) => typeof val === 'number'],
+	response: { rows: [{ count: String(args.count) }] },
+})
+
+// Anti-enumeration: an unknown address still reports ok and does nothing
+// observable — no mail, no auth-log entry — so the endpoint can't be used to
+// probe which addresses are registered.
+test('requestEmailVerification - unknown email reports ok without sending mail', async () => {
+	const email = 'ghost@example.com'
+	await executeTenantTest({
+		query: requestEmailVerificationMutation({ email }),
+		executes: [
+			// Config is fetched first for the per-IP rate limit + captcha gate
+			// (both disabled by default), then the anti-enumeration lookup.
+			getConfigSql(),
+			getPersonByEmailSql({ email, response: null }),
+		],
+		return: {
+			data: {
+				requestEmailVerification: {
+					ok: true,
+					error: null,
+				},
+			},
+		},
+		// No mail goes out, so no `email_verify_init` audit entry is recorded.
+		sentMails: [],
+	})
+})
+
+// A known, still-unverified address gets a verification mail and an
+// `email_verify_init` audit entry. Rate-limiting runs before the token write.
+test('requestEmailVerification - sends a verification mail for an unverified person', async () => {
+	const email = 'jane@doe.com'
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+	const projectId = testUuid(10)
+	await executeTenantTest({
+		query: requestEmailVerificationMutation({ email }),
+		executes: [
+			getConfigSql(),
+			getPersonByEmailSql({ email, response: { personId, identityId, password: '123', roles: [], emailVerifiedAt: null } }),
+			getNextMailAttemptSql({ email, initType: 'email_verify_init', completionType: 'email_verify_complete' }),
+			{
+				sql: SQL`INSERT INTO "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "meta")
+				         VALUES (?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?) RETURNING "expires_at"`,
+				parameters: [
+					anyString,
+					anyString,
+					personId,
+					(val: any) => typeof val === 'number',
+					isDate,
+					null,
+					'email_verification',
+					(val: any) => !!val && val.email === email,
+				],
+				response: { rows: [{ expires_at: now }] },
+			},
+			getIdentityProjectsSql({ identityId, projectId }),
+			getMailTemplateSql({ type: 'emailVerification', projectId }),
+			getMailTemplateSql({ type: 'emailVerification', projectId: null }),
+		],
+		return: {
+			data: {
+				requestEmailVerification: {
+					ok: true,
+					error: null,
+				},
+			},
+		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_verify_init',
+			personId,
+			personInput: email,
+			response: expect.objectContaining({ ok: true }),
+		}),
+		sentMails: [
+			{
+				subject: 'Verify your e-mail address',
+			},
+		],
+	})
+})
+
+// Per-IP rate limit mirrors createResetPasswordRequest: when the window is
+// full the request is rejected before any person lookup or mail, and crucially
+// no INSERT follows so a denied attempt does not extend the window.
+test('requestEmailVerification - returns RATE_LIMIT_EXCEEDED when the per-IP window is full', async () => {
+	const email = 'jane@doe.com'
+	await executeTenantTest({
+		query: requestEmailVerificationMutation({ email }),
+		httpInfo: { ip: '1.2.3.4' },
+		executes: [
+			getConfigSql({ rate_limit_email_verification_per_ip_limit: 1 }),
+			rateLimitCountSql({ scope: 'email_verification_per_ip', keyHash: Buffer.from('1.2.3.4'), count: 1 }),
+		],
+		return: {
+			data: {
+				requestEmailVerification: {
+					ok: false,
+					error: { code: 'RATE_LIMIT_EXCEEDED' },
+				},
+			},
+		},
+		// Rejected before the anti-enumeration lookup, so nothing is sent.
+		sentMails: [],
+	})
+})
+
+// Captcha gate mirrors createResetPasswordRequest: when captcha is configured
+// AND enforced for this flow but no token is supplied, the request is rejected
+// before any person lookup. Email verification is opt-in, so the test enables
+// `captcha_protect_email_verification` explicitly.
+test('requestEmailVerification - returns INVALID_CAPTCHA when captcha is enabled for this flow but no token is supplied', async () => {
+	const email = 'jane@doe.com'
+	await executeTenantTest({
+		query: requestEmailVerificationMutation({ email }),
+		providers: {
+			decrypt: async () => ({ value: Buffer.from('turnstile-secret'), needsReEncrypt: false }),
+		},
+		executes: [
+			getConfigSql({
+				captcha_provider: 'turnstile',
+				captcha_secret: Buffer.from('encrypted'),
+				captcha_secret_version: 1,
+				captcha_protect_email_verification: true,
+			}),
+			// rate limits stay at 0 and the test IP is empty, so the limiter
+			// short-circuits before any DB call — captcha is the only gate hit.
+		],
+		return: {
+			data: {
+				requestEmailVerification: {
+					ok: false,
+					error: { code: 'INVALID_CAPTCHA' },
+				},
+			},
+		},
+		sentMails: [],
+	})
+})
+
+// With captcha configured but NOT enforced for email verification (the default),
+// the flow skips the captcha gate entirely and proceeds to the normal lookup.
+test('requestEmailVerification - skips captcha when not enforced for this flow', async () => {
+	const email = 'ghost@example.com'
+	await executeTenantTest({
+		query: requestEmailVerificationMutation({ email }),
+		providers: {
+			decrypt: async () => ({ value: Buffer.from('turnstile-secret'), needsReEncrypt: false }),
+		},
+		executes: [
+			getConfigSql({
+				captcha_provider: 'turnstile',
+				captcha_secret: Buffer.from('encrypted'),
+				captcha_secret_version: 1,
+				// captcha_protect_email_verification defaults to false → gate skipped,
+				// so we reach the anti-enumeration lookup without a captcha token.
+			}),
+			getPersonByEmailSql({ email, response: null }),
+		],
+		return: {
+			data: {
+				requestEmailVerification: {
+					ok: true,
+					error: null,
+				},
+			},
+		},
+		sentMails: [],
+	})
+})