@lifeready/core 1.0.1 → 1.0.2

package/src/lib/trusted-parties/tp-password-reset.service.spec.ts

@@ -1,602 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { AppModule } from 'projects/lr-auth-app/src/app/app.module';
-import { environment } from 'projects/lr-auth-app/src/environments/environment';
-import {
-  loginTestUser,
-  logoutUser,
-} from '../auth/life-ready-auth.service.spec';
-import { HttpClient } from '@angular/common/http';
-import { LifeReadyConfig, LR_CONFIG } from '../life-ready.config';
-import { LifeReadyAuthService } from '../auth/life-ready-auth.service';
-import { lrExpectAsyncThrow, lrit } from '../_common/tests';
-import { LoginResult } from '../auth/auth.types';
-import { LrGraphQLService } from '../api/lr-graphql';
-import { TpAssemblyState } from '../api/types/lr-graphql.types';
-import { TpPasswordResetService } from './tp-password-reset.service';
-import { TpPasswordResetRequestService } from './tp-password-reset-request.service';
-import { TpPasswordResetUserService } from './tp-password-reset-user.service';
-import { setupTps2, getTp2, getTps2 } from './trusted-party2.service.spec';
-import { TrustedParty2Service } from './trusted-party2.service';
-const enableTests = environment.test.enableTests;
-
-const TIMEOUT = 1000 * 60 * 10;
-
-const COVE_DEBUG_V_CODE = '111111';
-
-const RESET_USERNAME_SUFFIX = '.tp_password_reset';
-
-describe('TpPasswordResetService', () => {
-  let tpprService: TpPasswordResetService;
-  let resetUserService: TpPasswordResetUserService;
-  let resetRequestService: TpPasswordResetRequestService;
-  let tp2Service: TrustedParty2Service;
-  let http: HttpClient;
-  let config: LifeReadyConfig;
-  let lrAuth: LifeReadyAuthService;
-  let lrGraphQL: LrGraphQLService;
-
-  beforeEach(async () => {
-    TestBed.configureTestingModule({
-      imports: [AppModule],
-      providers: [],
-    });
-    config = TestBed.inject(LR_CONFIG);
-    tpprService = TestBed.inject(TpPasswordResetService);
-    resetUserService = TestBed.inject(TpPasswordResetUserService);
-    resetRequestService = TestBed.inject(TpPasswordResetRequestService);
-    tp2Service = TestBed.inject(TrustedParty2Service);
-    http = TestBed.inject(HttpClient);
-    lrAuth = TestBed.inject(LifeReadyAuthService);
-    lrGraphQL = TestBed.inject(LrGraphQLService);
-  }, TIMEOUT);
-
-  async function debugAssociate(
-    sub,
-    requestId,
-    associateResetUserToken
-  ): Promise<void> {
-    await http
-      .post<any>(
-        `${config.apiUrl}debug_only/tp/password-reset/request/${requestId}/associate/`,
-        {
-          sub,
-          associate_reset_user_token: associateResetUserToken,
-          backend: 'cognito',
-        }
-      )
-      .toPromise();
-  }
-
-  async function debugCancelResetRequest(username) {
-    await logoutUser();
-    await http
-      .post<any>(
-        `${config.apiUrl}debug_only/tp/password-reset/cancel-request/`,
-        {
-          username,
-        }
-      )
-      .toPromise();
-  }
-
-  let username1;
-  let password1;
-  let email1;
-  let username2;
-  let password2;
-  let email2;
-  let username3;
-  let password3;
-  let email3;
-  let username4;
-  let password4;
-  let email4;
-  let RESET_USER_PASSWORD;
-
-  if (enableTests) {
-    username1 = environment.test.users[0].username;
-    password1 = environment.test.users[0].password;
-    email1 = environment.test.users[0].email;
-
-    username2 = environment.test.users[1].username;
-    password2 = environment.test.users[1].password;
-    email2 = environment.test.users[1].email;
-
-    username3 = environment.test.users[2].username;
-    password3 = environment.test.users[2].password;
-    email3 = environment.test.users[2].email;
-
-    username4 = environment.test.users[3].username;
-    password4 = environment.test.users[3].password;
-    email4 = environment.test.users[3].email;
-
-    RESET_USER_PASSWORD = password1;
-  }
-
-  async function validateApprovers(tpIds: string[]) {
-    const tps = await Promise.all(
-      tpIds.map((t) => {
-        return getTp2(t);
-      })
-    );
-
-    // Ensure all approvers have mkSharedKey.
-    try {
-      tpprService.validateApprovers(tps);
-      return tps;
-    } catch (error) {
-      await reshareMkSharedKeys();
-      const tps2 = await Promise.all(
-        tpIds.map((t) => {
-          return getTp2(t);
-        })
-      );
-      tpprService.validateApprovers(tps2);
-      return tps2;
-    }
-  }
-
-  async function setupReset() {
-    const { U1_TP_U2_ID, U2_TP_U1_ID } = await setupTps2(
-      username1,
-      password1,
-      username2,
-      password2
-    );
-
-    // ------------------------------------------------------
-    // Test User 1: Get current reset
-    // ------------------------------------------------------
-    const currentUser = await loginTestUser(username1, password1);
-    const reset = await tpprService.getReset();
-    console.log(reset);
-
-    // ------------------------------------------------------
-    // Test User 1: Delete and create new reset
-    // ------------------------------------------------------
-    // Ensure all approvers have mkSharedKey.
-    const [U1_TP_U2] = await validateApprovers([U1_TP_U2_ID]);
-
-    if (await tpprService.getReset()) {
-      await tpprService.deleteReset();
-    }
-
-    await tpprService.createReset({
-      quorum: 1,
-      singleReject: true,
-      createSubAssemblies: [
-        {
-          name: 'G1',
-          quorum: 1,
-          singleReject: false,
-          approverTps: [U1_TP_U2],
-        },
-      ],
-    });
-  }
-
-  async function requestReset() {
-    let res;
-
-    await logoutUser();
-    // ------------------------------------------------------
-    // Pre-auth
-    // ------------------------------------------------------
-    const { claimId } = await resetUserService.verifyEmailContact(email1);
-    const claimToken = await resetUserService.verifyContactRespond(
-      claimId,
-      COVE_DEBUG_V_CODE
-    );
-    res = await resetUserService.requestReset(
-      RESET_USER_PASSWORD,
-      claimId,
-      claimToken
-    );
-
-    // AWS Cognito can't use lambda to associate reset user with local server. So need to
-    // do this via debug endpoint.
-    if (environment.env === 'local') {
-      await debugAssociate(
-        res.signUpResult.userSub,
-        res.requestResetResult.id,
-        res.requestResetResult.associate_reset_user_token
-      );
-    }
-  }
-
-  async function approveResetRequest(username, password) {
-    await loginTestUser(username, password);
-    const requests = await resetRequestService.getSharedResets();
-    const request = requests.edges.find(
-      (edge) => edge.node.tp.other.username === username1
-    );
-    expect(request).toBeTruthy();
-    await resetRequestService.approveRequest(request.node.id);
-  }
-
-  async function rejectResetRequest(username, password) {
-    await loginTestUser(username, password);
-    const requests = await resetRequestService.getSharedResets();
-    const request = requests.edges.find(
-      (edge) => edge.node.tp.other.username === username1
-    );
-    expect(request).toBeTruthy();
-    await resetRequestService.rejectRequest(request.node.id);
-  }
-
-  // Assuming signed in as the reset user.
-  async function reshareMkSharedKeys() {
-    // ------------------------------------------------------
-    // Request mkSharedKey reshare
-    // ------------------------------------------------------
-
-    let tps = await getTps2();
-    for (const edge of tps.edges) {
-      if (!edge.node.currentUserSharedKey.userSharedKey.mkReshareRequestSent) {
-        await lrGraphQL.lrMutate(tp2Service.requestMkReshare(edge.node.id));
-      }
-    }
-
-    tps = await getTps2();
-
-    // ------------------------------------------------------
-    // Respond mkSharedKey reshare
-    // ------------------------------------------------------
-    for (const edge of tps.edges) {
-      const tpUser = environment.test.users.find(
-        (t) => t.username === edge.node.other.username
-      );
-
-      await loginTestUser(tpUser.username, tpUser.password);
-
-      const otherTps = await getTps2();
-      const otherTp = otherTps.edges.find(
-        (otherEdge) => otherEdge.node.other.username === username1
-      ).node;
-
-      if (!otherTp.currentUserSharedKey.userSharedKey.mkReshareResponseSent) {
-        await lrGraphQL.lrMutate(tp2Service.respondMkReshare(otherTp.id));
-      }
-    }
-
-    // ------------------------------------------------------
-    // Complete mkSharedKey reshare
-    // ------------------------------------------------------
-    await loginTestUser(username1, password1);
-    tps = await getTps2();
-    for (const edge of tps.edges) {
-      const tp = edge.node;
-      if (tp.currentUserSharedKey.userSharedKey.mkReshareResponseCipher) {
-        await lrGraphQL.lrMutate(tp2Service.completeMkReshare(tp.id));
-      }
-    }
-  }
-
-  async function loginResetUser() {
-    await logoutUser();
-    const res = await lrAuth.login(username1, RESET_USER_PASSWORD);
-    // console.log('Reset user: ', res);
-    return res;
-  }
-
-  // This will request, approve, and complete the reset. But before
-  // the TPs have reshared their shared_master_keys.
-  async function performReset() {
-    let res;
-
-    // ------------------------------------------------------
-    // Pre-auth
-    // ------------------------------------------------------
-    await requestReset();
-
-    // ------------------------------------------------------
-    // Reset user
-    // ------------------------------------------------------
-    res = await loginResetUser();
-
-    expect(res.resetUser.state).toEqual(TpAssemblyState.CLAIMED);
-
-    // ------------------------------------------------------
-    // Approve
-    // ------------------------------------------------------
-    await approveResetRequest(username2, password2);
-
-    // ------------------------------------------------------
-    // Complete reset
-    // ------------------------------------------------------
-    res = await loginResetUser();
-    expect(res.user).toBeUndefined();
-    expect(res.resetUser).toBeTruthy();
-
-    expect(res.resetUser.state).toEqual(TpAssemblyState.APPROVED);
-
-    await resetUserService.completeRequest(RESET_USER_PASSWORD);
-    console.log('TP password reset complete');
-
-    // ------------------------------------------------------
-    // Login using new password
-    // ------------------------------------------------------
-    await logoutUser();
-    res = await loginResetUser();
-    expect(res.user).toBeTruthy();
-    expect(res.resetUser).toBeUndefined();
-
-    // ----------------------------------------------------------------------------------------------
-    // Reshare mkSharedKey
-    // ----------------------------------------------------------------------------------------------
-    await reshareMkSharedKeys();
-  }
-
-  lrit(
-    'Should reset user password',
-    async () => {
-      await logoutUser();
-
-      await debugCancelResetRequest(username1);
-
-      // ------------------------------------------------------
-      // Re-create TP password reset
-      // ------------------------------------------------------
-      try {
-        await setupReset();
-      } catch (error) {
-        // If the reset is interrupted before the resharing of mk_shared_key between TPs are complete
-        // then you can't update the reset. So we complete the reset, then create and try again.
-        await performReset();
-        await setupReset();
-      }
-
-      // ------------------------------------------------------
-      // Do a TP password reset
-      // ------------------------------------------------------
-      await performReset();
-    },
-    TIMEOUT
-  );
-
-  lrit(
-    'Should reset user password with more approver.',
-    async () => {
-      let res;
-      let loginResult: LoginResult;
-
-      await logoutUser();
-      await debugCancelResetRequest(username1);
-
-      const { U1_TP_U2_ID, U2_TP_U1_ID } = await setupTps2(
-        username1,
-        password1,
-        username2,
-        password2
-      );
-      const {
-        U1_TP_U2_ID: U1_TP_U3_ID,
-        U2_TP_U1_ID: U3_TP_U1_ID,
-      } = await setupTps2(username1, password1, username3, password3);
-      const {
-        U1_TP_U2_ID: U1_TP_U4_ID,
-        U2_TP_U1_ID: U4_TP_U1_ID,
-      } = await setupTps2(username1, password1, username4, password4);
-
-      await loginTestUser(username1, password1);
-
-      // Ensure all approvers have mkSharedKey. Also reloads TPs every time because the key graph is cleared on logout.
-      let [U1_TP_U2, U1_TP_U3, U1_TP_U4] = await validateApprovers([
-        U1_TP_U2_ID,
-        U1_TP_U3_ID,
-        U1_TP_U4_ID,
-      ]);
-
-      if (await tpprService.getReset()) {
-        await tpprService.deleteReset();
-      }
-
-      await tpprService.createReset({
-        quorum: 1,
-        singleReject: true,
-        createSubAssemblies: [
-          {
-            name: 'G1.1',
-            quorum: 1,
-            singleReject: false,
-            approverTps: [U1_TP_U2],
-          },
-        ],
-      });
-
-      const reset1 = await tpprService.getReset();
-
-      // Should fail when already exists
-      (
-        await lrExpectAsyncThrow(
-          tpprService.createReset({
-            quorum: 1,
-            singleReject: true,
-            createSubAssemblies: [
-              {
-                name: 'G1.1',
-                quorum: 1,
-                singleReject: false,
-                approverTps: [U1_TP_U2],
-              },
-            ],
-          })
-        )
-      ).toBeTruthy();
-
-      await tpprService.updateReset({
-        quorum: 1,
-        singleReject: true,
-        updateSubAssemblies: [
-          {
-            id: reset1.assembly.subAssemblies.edges[0].node.id,
-            name: 'G1.2',
-            quorum: 2,
-            singleReject: true,
-            approverTps: [U1_TP_U2, U1_TP_U3],
-          },
-        ],
-        createSubAssemblies: [
-          {
-            name: 'G2.1',
-            quorum: 1,
-            singleReject: true,
-            approverTps: [U1_TP_U2, U1_TP_U3, U1_TP_U4],
-          },
-          {
-            name: 'G3.1',
-            quorum: 1,
-            singleReject: true,
-            approverTps: [U1_TP_U2],
-          },
-        ],
-      });
-
-      const reset2 = await tpprService.getReset();
-      expect(reset1.assembly.assemblyKey.id).not.toEqual(
-        reset2.assembly.assemblyKey.id,
-        'assembly key should refresh.'
-      );
-
-      // ------------------------------------------------------
-      // Test single reject
-      // ------------------------------------------------------
-      await requestReset();
-
-      // Single reject from any user should reject whole request
-      await rejectResetRequest(username3, password3);
-
-      loginResult = await loginResetUser();
-      expect(loginResult.resetUser.state).toEqual(TpAssemblyState.REJECTED);
-
-      // ------------------------------------------------------
-      // Test non single reject
-      // ------------------------------------------------------
-      await debugCancelResetRequest(username1);
-      await loginTestUser(username1, password1);
-
-      // Reload TPs every time because the key graph is cleared on logout.
-      [U1_TP_U2, U1_TP_U3, U1_TP_U4] = await validateApprovers([
-        U1_TP_U2_ID,
-        U1_TP_U3_ID,
-        U1_TP_U4_ID,
-      ]);
-
-      let reset = await tpprService.getReset();
-
-      // Test deleting of sub assemblies and approvers
-      await tpprService.updateReset({
-        quorum: 2,
-        singleReject: false,
-        updateSubAssemblies: [
-          {
-            id: reset.assembly.subAssemblies.edges[0].node.id,
-            name: 'G1.3',
-            quorum: 1,
-            singleReject: false,
-            approverTps: [U1_TP_U2, U1_TP_U3],
-          },
-          {
-            id: reset.assembly.subAssemblies.edges[1].node.id,
-            name: 'G2.2',
-            quorum: 2,
-            singleReject: false,
-            approverTps: [U1_TP_U2, U1_TP_U4],
-          },
-        ],
-        createSubAssemblies: [],
-      });
-
-      reset = await tpprService.getReset();
-      console.log(reset);
-      expect(reset.assembly.subAssemblies.edges.length).toEqual(2);
-
-      // Test approvers have been updated/detected
-      const G1 = reset.assembly.subAssemblies.edges.find(
-        (edge) => edge.node.subjectCipherDataClearJson.name === 'G1.3'
-      ).node;
-      expect(G1.approvers.edges.length).toEqual(2);
-      G1.approvers.edges.forEach((edge) => {
-        expect([U1_TP_U2.id, U1_TP_U3.id].includes(edge.node.id));
-      });
-
-      const G2 = reset.assembly.subAssemblies.edges.find(
-        (edge) => edge.node.subjectCipherDataClearJson.name === 'G2.2'
-      ).node;
-      expect(G2.approvers.edges.length).toEqual(2);
-      G2.approvers.edges.forEach((edge) => {
-        expect([U1_TP_U2.id, U1_TP_U4.id].includes(edge.node.id));
-      });
-
-      await requestReset();
-
-      // Reject but not enough to reject the request
-      await rejectResetRequest(username3, password3); // G1 can still meet quorum
-
-      loginResult = await loginResetUser();
-      expect(loginResult.resetUser.state).toEqual(TpAssemblyState.CLAIMED);
-
-      await rejectResetRequest(username2, password2); // Both G1 and G2 can not meet quorum anymore
-
-      loginResult = await loginResetUser();
-      expect(loginResult.resetUser.state).toEqual(TpAssemblyState.REJECTED);
-
-      // ------------------------------------------------------
-      // Request again
-      // ------------------------------------------------------
-      // Must cancel request first because we are using the same password for
-      // the reset user and the original user. If the reset request is present, it
-      // will log into the reset user account.
-      await debugCancelResetRequest(username1);
-      await loginTestUser(username1, password1);
-
-      await requestReset();
-
-      // ------------------------------------------------------
-      // Approve
-      // ------------------------------------------------------
-      await approveResetRequest(username2, password2);
-
-      // Check it's not approved yet.
-      loginResult = await loginResetUser();
-      expect(loginResult.resetUser.state).toEqual(TpAssemblyState.CLAIMED);
-
-      // G1 has a quorum of 1, this is redundant, but testing if we can have redundant approvals
-      await approveResetRequest(username3, password3);
-
-      // Check it's not approved yet.
-      loginResult = await loginResetUser();
-      expect(loginResult.resetUser.state).toEqual(TpAssemblyState.CLAIMED);
-
-      await approveResetRequest(username4, password4);
-
-      // Should be approved now
-      loginResult = await loginResetUser();
-      expect(loginResult.resetUser.state).toEqual(TpAssemblyState.APPROVED);
-
-      // ------------------------------------------------------
-      // Complete reset
-      // ------------------------------------------------------
-      // Should be approved now.
-      loginResult = await loginResetUser();
-      expect(loginResult.resetUser.state).toEqual(TpAssemblyState.APPROVED);
-
-      await resetUserService.completeRequest(RESET_USER_PASSWORD);
-      console.log('TP password reset complete after multiple approval');
-
-      // ------------------------------------------------------
-      // Login using new password
-      // ------------------------------------------------------
-      await logoutUser();
-      res = await lrAuth.login(username1, RESET_USER_PASSWORD);
-      expect(res.user).toBeTruthy();
-      expect(res.resetUser).toBeUndefined();
-
-      // ----------------------------------------------------------------------------------------------
-      // Reshare mkSharedKey
-      // ----------------------------------------------------------------------------------------------
-      await reshareMkSharedKeys();
-    },
-    TIMEOUT
-  );
-});