@johnnyboy11234/esg-idea-contest 0.3.0 → 0.3.2

package/backend/internal/account/integration_test.go

@@ -32,7 +32,7 @@ func newEnv(t *testing.T) env {
 	auditSvc := audit.New(db, nil)
 	errs := server.ErrorAdapter{Audit: auditSvc}
 	api := server.API{Account: account.Handler{
-		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.StubPolicy{}},
+		Service: &account.Service{DB: db, Audit: auditSvc, Policy: account.DefaultPolicy()},
 		Fail:    errs.Write,
 	}}
 	h := apispec.Load(t).Validate(t, server.NewPublic(slog.New(slog.DiscardHandler), server.Mount(api)))
@@ -49,6 +49,8 @@ func (e env) register(body string) *httptest.ResponseRecorder {
 	return rec
 }
 
+const goodPW = "Correct-Horse-1"
+
 func reg(empNo, name, email, pw string) string {
 	b, _ := json.Marshal(map[string]string{"empNo": empNo, "name": name, "email": email, "password": pw})
 	return string(b)
@@ -150,16 +152,16 @@ func TestRegisterSuccess(t *testing.T) {
 
 func TestRegisterConflicts(t *testing.T) {
 	e := newEnv(t)
-	if rec := e.register(reg("089290", "A", "a@x.com", "pw")); rec.Code != 201 {
+	if rec := e.register(reg("089290", "A", "a@x.com", goodPW)); rec.Code != 201 {
 		t.Fatal(rec.Body)
 	}
 
 	cases := []struct {
 		name, body, code, reason string
 	}{
-		{"same employee ID", reg("089290", "B", "b@x.com", "pw"), "EMP_NO_TAKEN", "emp_no_taken"},
-		{"same email, any case", reg("089291", "B", " A@X.COM ", "pw"), "EMAIL_TAKEN", "email_taken"},
-		{"both taken reports the employee ID", reg("089290", "B", "a@x.com", "pw"), "EMP_NO_TAKEN", "emp_no_taken"},
+		{"same employee ID", reg("089290", "B", "b@x.com", goodPW), "EMP_NO_TAKEN", "emp_no_taken"},
+		{"same email, any case", reg("089291", "B", " A@X.COM ", goodPW), "EMAIL_TAKEN", "email_taken"},
+		{"both taken reports the employee ID", reg("089290", "B", "a@x.com", goodPW), "EMP_NO_TAKEN", "emp_no_taken"},
 	}
 	for _, tc := range cases {
 		rec := e.register(tc.body)
@@ -189,14 +191,14 @@ func TestRegisterConflicts(t *testing.T) {
 
 func TestRegisterValidationBeatsConflictAndIsAudited(t *testing.T) {
 	e := newEnv(t)
-	e.register(reg("089290", "A", "a@x.com", "pw"))
+	e.register(reg("089290", "A", "a@x.com", goodPW))
 
 	// The employee ID is taken, but the email is malformed: 422, never 409.
-	rec := e.register(reg("089290", "B", "a b@x.com", "pw"))
+	rec := e.register(reg("089290", "B", "a b@x.com", goodPW))
 	if rec.Code != 422 || problemCode(t, rec) != "VALIDATION_FAILED" {
 		t.Fatalf("%d %s", rec.Code, rec.Body)
 	}
-	rec = e.register(reg("12 4", "B/C", "ok@x.com", "pw"))
+	rec = e.register(reg("12 4", "B/C", "ok@x.com", goodPW))
 	if rec.Code != 422 {
 		t.Fatalf("%d %s", rec.Code, rec.Body)
 	}
@@ -248,7 +250,7 @@ func TestRegisterRaceHasOneWinner(t *testing.T) {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-			codes[i] = e.register(reg("089290", "A", "race"+string(rune('a'+i))+"@x.com", "pw")).Code
+			codes[i] = e.register(reg("089290", "A", "race"+string(rune('a'+i))+"@x.com", goodPW)).Code
 		}()
 	}
 	wg.Wait()
@@ -266,3 +268,37 @@ func TestRegisterRaceHasOneWinner(t *testing.T) {
 		t.Fatalf("codes = %v, users = %d", codes, e.users(t))
 	}
 }
+
+func TestRegisterWeakPasswordListsEveryRuleInTableOrder(t *testing.T) {
+	e := newEnv(t)
+	// Format and policy errors come back together; the password contains the
+	// employee ID, repeats a character and has only two classes.
+	rec := e.register(reg("089290", "A", "nope", "aaa089290"))
+	if rec.Code != 422 || problemCode(t, rec) != "VALIDATION_FAILED" {
+		t.Fatalf("%d %s", rec.Code, rec.Body)
+	}
+	var body struct {
+		Errors []struct{ Field, Code, Rule string }
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	var got []string
+	for _, f := range body.Errors {
+		got = append(got, f.Field+":"+f.Code+":"+f.Rule)
+	}
+	want := "email:INVALID_FORMAT: password:PASSWORD_POLICY:LENGTH password:PASSWORD_POLICY:COMPLEXITY " +
+		"password:PASSWORD_POLICY:REPEAT password:PASSWORD_POLICY:CONTAINS_EMP_NO"
+	if strings.Join(got, " ") != want {
+		t.Errorf("errors = %v\nwant     %s", got, want)
+	}
+
+	// Alone, a weak password makes PASSWORD_POLICY the top-level code.
+	rec = e.register(reg("089290", "A", "a@x.com", "short"))
+	if rec.Code != 422 || problemCode(t, rec) != "PASSWORD_POLICY" {
+		t.Fatalf("%d %s", rec.Code, rec.Body)
+	}
+	if e.users(t) != 0 {
+		t.Error("a rejected registration created a user")
+	}
+}

package/backend/internal/account/internal/passwords/NOTICE

@@ -0,0 +1,36 @@
+common-passwords.txt
+====================
+
+Source:  SecLists, Passwords/Common-Credentials/10k-most-common.txt
+         https://github.com/danielmiessler/SecLists
+Commit:  a1a06ab57c3f4efc450d80738a72c11597aac81a
+SHA-256: 68782d6a4a19a4768d5f15dd66bd534e7a33055cc755411e33f16d18c50fdcce
+Entries: 10,001 lines, printable ASCII, no case-folded duplicates
+Changes: none (byte-for-byte copy)
+
+Used by: backend rule COMMON_PASSWORD (PRD §6.4, embedded with go:embed) and
+the frontend live password checklist (lazy-loaded chunk).
+
+Licence of the source file:
+
+MIT License
+
+Copyright (c) 2018 Daniel Miessler
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.