@mshima/generator-jhipster-nodejs 0.0.0-stage → 0.0.1

package/generators/node-server/templates/server/e2e/cors.e2e-spec.ts.ejs

@@ -0,0 +1,110 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { Test, TestingModule } from '@nestjs/testing';
+import request from 'supertest';
+import { INestApplication } from '@nestjs/common';
+import { AppModule } from '../src/app.module.ts';
+import { configureApp } from '../src/app.config.ts';
+import { config } from '../src/config.ts';
+
+describe('CORS', () => {
+    let app: INestApplication;
+
+    const createApp = async (properties: Record<string, any>): Promise<void> => {
+        config.addAll(properties);
+        const moduleFixture: TestingModule = await Test.createTestingModule({
+            imports: [AppModule],
+        }).compile();
+
+        app = moduleFixture.createNestApplication();
+        configureApp(app);
+        await app.init();
+    };
+
+    afterEach(async () => {
+        config.addAll({ 'jhipster.cors.allowed-origins': '', 'jhipster.cors.allowed-origin-patterns': '', 'jhipster.cors.allow-credentials': false });
+        await app?.close();
+    });
+
+    describe('without allowed origins, like the test and prod profiles', () => {
+        beforeEach(() => createApp({}));
+
+        it('does not allow other origins', async () => {
+            const response = await request(app.getHttpServer()).get('/management/health').set('Origin', 'http://localhost:9000').expect(200);
+            if (response.headers['access-control-allow-origin'] !== undefined) {
+                throw new Error(`Unexpected Access-Control-Allow-Origin: ${response.headers['access-control-allow-origin']}`);
+            }
+        });
+    });
+
+    describe('with the properties of the dev profile', () => {
+        beforeEach(() =>
+            createApp({
+                'jhipster.cors.allowed-origins': 'http://localhost:9000',
+                'jhipster.cors.allowed-origin-patterns': 'https://*.githubpreview.dev',
+                'jhipster.cors.allowed-methods': '*',
+                'jhipster.cors.allowed-headers': '*',
+                'jhipster.cors.exposed-headers': 'Authorization,Link,X-Total-Count',
+                'jhipster.cors.allow-credentials': true,
+                'jhipster.cors.max-age': 1800,
+            }),
+        );
+
+        it('allows an allowed origin on /management', () =>
+            request(app.getHttpServer())
+                .get('/management/health')
+                .set('Origin', 'http://localhost:9000')
+                .expect(200)
+                .expect('Access-Control-Allow-Origin', 'http://localhost:9000')
+                .expect('Access-Control-Allow-Credentials', 'true')
+                .expect('Access-Control-Expose-Headers', 'Authorization,Link,X-Total-Count'));
+
+        it('allows an origin of a pattern on a preflight request of /api', () =>
+            request(app.getHttpServer())
+                .options('/api/account')
+                .set('Origin', 'https://my-codespace.githubpreview.dev')
+                .set('Access-Control-Request-Method', 'POST')
+                .set('Access-Control-Request-Headers', 'authorization,content-type')
+                .expect(204)
+                .expect('Access-Control-Allow-Origin', 'https://my-codespace.githubpreview.dev')
+                .expect('Access-Control-Allow-Headers', 'authorization,content-type')
+                .expect('Access-Control-Max-Age', '1800'));
+
+        it('does not allow another origin', async () => {
+            const response = await request(app.getHttpServer()).get('/management/health').set('Origin', 'http://other.example.com').expect(200);
+            if (response.headers['access-control-allow-origin'] !== undefined) {
+                throw new Error(`Unexpected Access-Control-Allow-Origin: ${response.headers['access-control-allow-origin']}`);
+            }
+        });
+    });
+
+    describe('with * as allowed origins, without credentials', () => {
+        beforeEach(() => createApp({ 'jhipster.cors.allowed-origins': '*', 'jhipster.cors.allow-credentials': false }));
+
+        it('allows any origin, like the CorsConfiguration of Spring', async () => {
+            const response = await request(app.getHttpServer())
+                .get('/management/health')
+                .set('Origin', 'http://any.example.com')
+                .expect(200)
+                .expect('Access-Control-Allow-Origin', '*');
+            expect(response.headers['access-control-allow-credentials']).toBeUndefined();
+        });
+    });
+
+    it('refuses * as allowed origins with credentials, which browsers refuse, like the CorsConfiguration of Spring', async () => {
+        await expect(createApp({ 'jhipster.cors.allowed-origins': '*', 'jhipster.cors.allow-credentials': true })).rejects.toThrow(
+            /allowed-origin-patterns/,
+        );
+    });
+
+    describe('with * as allowed origin patterns and credentials', () => {
+        beforeEach(() => createApp({ 'jhipster.cors.allowed-origin-patterns': '*', 'jhipster.cors.allow-credentials': true }));
+
+        it('allows any origin with credentials, the origin given back', () =>
+            request(app.getHttpServer())
+                .get('/management/health')
+                .set('Origin', 'http://any.example.com')
+                .expect(200)
+                .expect('Access-Control-Allow-Origin', 'http://any.example.com')
+                .expect('Access-Control-Allow-Credentials', 'true'));
+    });
+});

package/generators/node-server/templates/server/e2e/management.e2e-spec.ts.ejs

@@ -0,0 +1,180 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { Test, TestingModule } from '@nestjs/testing';
+import request from 'supertest';
+import { ExecutionContext, INestApplication } from '@nestjs/common';
+import { AppModule } from '../src/app.module.ts';
+import { configureApp } from '../src/app.config.ts';
+import { loggerLevels } from '../src/common/logging.ts';
+import { setupSwagger } from '../src/swagger.ts';
+import { AuthGuard } from '../src/auth/guards/auth.guard.ts';
+import { RolesGuard } from '../src/auth/guards/roles.guard.ts';
+
+describe('Management', () => {
+    let app: INestApplication;
+
+    /** The application with its guards, without them (an administrator), or with an authenticated user of some roles. */
+    const createApp = async (guards: boolean | string[]): Promise<INestApplication> => {
+        let builder = Test.createTestingModule({ imports: [AppModule] });
+        if (guards === false) {
+            // An administrator.
+            builder = builder.overrideGuard(AuthGuard).useValue({ canActivate: () => true }).overrideGuard(RolesGuard).useValue({ canActivate: () => true });
+        } else if (Array.isArray(guards)) {
+            // A user of these roles, checked by the RolesGuard of the application.
+            builder = builder.overrideGuard(AuthGuard).useValue({
+                canActivate: (context: ExecutionContext) => {
+                    context.switchToHttp().getRequest().user = { login: 'managementtest', authorities: guards };
+                    return true;
+                },
+            });
+        }
+        const moduleFixture: TestingModule = await builder.compile();
+        const nestApp = moduleFixture.createNestApplication();
+        configureApp(nestApp);
+        await nestApp.init();
+        return nestApp;
+    };
+
+    afterEach(async () => {
+        loggerLevels.setLevel('ManagementTest', null);
+        await app?.close();
+    });
+
+    describe('as an administrator', () => {
+        beforeEach(async () => {
+            app = await createApp(false);
+        });
+
+        it('/GET loggers gives the levels and the ROOT logger', async () => {
+            const { body } = await request(app.getHttpServer()).get('/management/loggers').expect(200);
+
+            expect(body.levels).toEqual(['OFF', 'ERROR', 'WARN', 'INFO', 'DEBUG', 'TRACE']);
+            expect(Object.keys(body.loggers)[0]).toBe('ROOT');
+            expect(body.loggers.ROOT.configuredLevel).toEqual(expect.any(String));
+        });
+
+        it('/POST loggers changes the level of a logger, and null gives it the ROOT level again', async () => {
+            await request(app.getHttpServer()).post('/management/loggers/ManagementTest').send({ configuredLevel: 'TRACE' }).expect(204);
+            await request(app.getHttpServer())
+                .get('/management/loggers/ManagementTest')
+                .expect(200)
+                .expect({ configuredLevel: 'TRACE', effectiveLevel: 'TRACE' });
+
+            await request(app.getHttpServer()).post('/management/loggers/ManagementTest').send({ configuredLevel: null }).expect(204);
+            const { body } = await request(app.getHttpServer()).get('/management/loggers/ManagementTest').expect(200);
+            expect(body).toEqual({ configuredLevel: null, effectiveLevel: loggerLevels.getLevel('ROOT').effectiveLevel });
+        });
+
+        it('/POST loggers with an unknown level is a bad request', () =>
+            request(app.getHttpServer()).post('/management/loggers/ManagementTest').send({ configuredLevel: 'LOUD' }).expect(400));
+
+        it('/GET jhimetrics gives the memory, the processor and the requests by endpoint', async () => {
+            await request(app.getHttpServer()).get('/management/info').expect(200);
+            const { body } = await request(app.getHttpServer()).get('/management/jhimetrics').expect(200);
+
+            expect(body.jvm.heap).toEqual({ used: expect.any(Number), committed: expect.any(Number), max: expect.any(Number) });
+            expect(body.processMetrics['system.cpu.count']).toBeGreaterThan(0);
+            expect(body['http.server.requests'].percode['200'].count).toBeGreaterThan(0);
+            expect(body.services['/management/info'].GET.count).toBe(1);
+        });
+
+        it('/GET env gives the sources of the configuration, their values hidden like Spring Boot', async () => {
+            const { body } = await request(app.getHttpServer()).get('/management/env').expect(200);
+
+            expect(body.activeProfiles).toContain('test');
+            expect(body.propertySources.map((source: { name: string }) => source.name)).toEqual([
+                'systemEnvironment',
+                "Config resource 'config/application-secret-samples.yml'",
+                "Config resource 'config/application-test.yml'",
+                "Config resource 'config/application.yml'",
+            ]);
+            const applicationYml = body.propertySources[3];
+            expect(applicationYml.properties['management.endpoint.env.show-values']).toEqual({ value: '******' });
+        });
+
+        it('/GET configprops gives the properties of the application by prefix, their values hidden like Spring Boot', async () => {
+            const { body } = await request(app.getHttpServer()).get('/management/configprops').expect(200);
+
+            const [context] = Object.values<{ beans: Record<string, { prefix: string; properties: any }> }>(body.contexts);
+            expect(context.beans.jhipster.prefix).toBe('jhipster');
+            expect(context.beans.jhipster.properties.mail.from).toBe('******');
+        });
+
+        it('/GET threaddump gives the thread of the event loop', async () => {
+            const { body } = await request(app.getHttpServer()).get('/management/threaddump').expect(200);
+
+            expect(body.threads).toEqual([expect.objectContaining({ threadName: 'main', threadState: 'RUNNABLE' })]);
+        });
+    });
+
+    describe('as a user without the administrator role', () => {
+        beforeEach(async () => {
+            app = await createApp(['ROLE_USER']);
+        });
+
+        it('/GET and /POST loggers are forbidden, the role of the controller class applies to its routes', async () => {
+            await request(app.getHttpServer()).get('/management/loggers').expect(403);
+            await request(app.getHttpServer()).post('/management/loggers/ManagementTest').send({ configuredLevel: 'OFF' }).expect(403);
+            expect(loggerLevels.getLevel('ManagementTest').configuredLevel).toBeNull();
+        });
+
+        it('/GET jhimetrics is forbidden', () => request(app.getHttpServer()).get('/management/jhimetrics').expect(403));
+
+        it('/GET v3/api-docs is forbidden, like JHipster Spring Boot', async () => {
+            setupSwagger(app);
+            await request(app.getHttpServer()).get('/v3/api-docs').expect(403);
+        });
+    });
+
+    describe('as a user with the administrator role', () => {
+        beforeEach(async () => {
+            app = await createApp(['ROLE_ADMIN']);
+        });
+
+        it('/GET loggers is allowed', () => request(app.getHttpServer()).get('/management/loggers').expect(200));
+
+        it('/GET v3/api-docs is not found without the api-docs profile', () => request(app.getHttpServer()).get('/v3/api-docs').expect(404));
+
+        it('/GET v3/api-docs gives the OpenAPI document of the api-docs profile', async () => {
+            setupSwagger(app);
+            const { body } = await request(app.getHttpServer()).get('/v3/api-docs').expect(200);
+
+            expect(body.openapi).toEqual(expect.any(String));
+            expect(body.info.title).toBe('<%= baseName %> API');
+            expect(Object.keys(body.paths)).toContainEqual(expect.stringMatching(/^\/api\//));
+            // The controller of the document itself is left out.
+            expect(Object.keys(body.paths)).not.toContain('/v3/api-docs');
+        });
+    });
+
+    describe('Prometheus', () => {
+        beforeEach(async () => {
+            app = await createApp(true);
+        });
+
+        it('/GET prometheus gives the metrics without authentication', async () => {
+            await request(app.getHttpServer()).get('/management/info').expect(200);
+            const response = await request(app.getHttpServer()).get('/management/prometheus').expect(200).expect('Content-Type', /text\/plain/);
+
+            expect(response.text).toContain('http_server_requests_seconds_count{method="GET",uri="/management/info",status="200",outcome="SUCCESS"} 1');
+            expect(response.text).toContain('nodejs_heap_size_used_bytes');
+        });
+    });
+
+<%_ if (authenticationTypeJwt || authenticationTypeSession) { _%>
+    describe('without authentication', () => {
+        beforeEach(async () => {
+            app = await createApp(true);
+        });
+
+        it('/GET loggers is refused', async () => {
+            const { status } = await request(app.getHttpServer()).get('/management/loggers');
+            expect([401, 403]).toContain(status);
+        });
+
+        it('/GET v3/api-docs is refused', async () => {
+            setupSwagger(app);
+            await request(app.getHttpServer()).get('/v3/api-docs').expect(401);
+        });
+    });
+<%_ } _%>
+});

package/generators/node-server/templates/server/e2e/oauth2-bearer.e2e-spec.ts.ejs

@@ -0,0 +1,71 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { createServer, Server } from 'node:http';
+import { AddressInfo } from 'node:net';
+import { generateKeyPairSync, KeyObject, sign } from 'node:crypto';
+import { INestApplication } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+
+// The identity provider: a JWKS server with a key, and the tokens it signs, like the access tokens of Keycloak.
+const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+const otherKey = generateKeyPairSync('rsa', { modulusLength: 2048 }).privateKey;
+const kid = 'test-key';
+const base64url = (value: object | Buffer): string => (Buffer.isBuffer(value) ? value : Buffer.from(JSON.stringify(value))).toString('base64url');
+
+describe('OAuth2 bearer tokens', () => {
+  let jwks: Server;
+  let app: INestApplication;
+  let issuer: string;
+
+  const token = (claims: object, key: KeyObject = privateKey): string => {
+    const payload = { iss: issuer, aud: 'account', exp: Math.floor(Date.now() / 1000) + 300, sub: 'abc', ...claims };
+    const unsigned = `${base64url({ alg: 'RS256', typ: 'JWT', kid })}.${base64url(payload)}`;
+    return `${unsigned}.${base64url(sign('RSA-SHA256', Buffer.from(unsigned), key))}`;
+  };
+  const account = (authorization?: string): request.Test => {
+    const test = request(app.getHttpServer()).get('/api/account');
+    return authorization ? test.set('Authorization', authorization) : test;
+  };
+
+  beforeAll(async () => {
+    jwks = createServer((_req, res) => {
+      res.setHeader('content-type', 'application/json');
+      res.end(JSON.stringify({ keys: [{ ...publicKey.export({ format: 'jwk' }), kid, use: 'sig', alg: 'RS256' }] }));
+    });
+    await new Promise<void>(resolve => jwks.listen(0, '127.0.0.1', resolve));
+    issuer = `http://127.0.0.1:${(jwks.address() as AddressInfo).port}/realms/test`;
+    // The issuer of the configuration, before the application reads it.
+    process.env.JHIPSTER_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUERURI = issuer;
+    const { AppModule } = await import('../src/app.module.ts');
+    const { configureApp } = await import('../src/app.config.ts');
+    const moduleFixture = await Test.createTestingModule({ imports: [AppModule] }).compile();
+    app = moduleFixture.createNestApplication();
+    configureApp(app);
+    await app.init();
+  });
+
+  afterAll(async () => {
+    await app?.close();
+    jwks?.close();
+    delete process.env.JHIPSTER_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUERURI;
+  });
+
+  it('answers 401 without a session nor a bearer token, like JHipster Spring Boot', () => account().expect(401));
+
+  it('accepts an access token of the identity provider, its user from its claims', async () => {
+    const { body } = await account(`Bearer ${token({ preferred_username: 'Bearer-User', email: 'Bearer@Example.com', groups: ['ROLE_USER'] })}`).expect(200);
+    expect(body).toMatchObject({ login: 'bearer-user', email: 'bearer@example.com', authorities: ['ROLE_USER'] });
+  });
+
+  it('reads the authentication scheme case insensitively', () => account(`bearer ${token({ preferred_username: 'user' })}`).expect(200));
+
+  it('refuses a token signed by another key', () => account(`Bearer ${token({}, otherKey)}`).expect(401));
+
+  it('refuses an expired token', () => account(`Bearer ${token({ exp: 1 })}`).expect(401));
+
+  it('refuses a token of another issuer, like the issuer validator of JHipster Spring Boot', () =>
+    account(`Bearer ${token({ iss: 'http://127.0.0.1:1/realms/other' })}`).expect(401));
+
+  it('refuses a token for another audience, like the audience validator of JHipster Spring Boot', () =>
+    account(`Bearer ${token({ aud: 'another-api' })}`).expect(401));
+});

package/generators/node-server/templates/server/e2e/session.e2e-spec.ts.ejs

@@ -0,0 +1,219 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { Test, TestingModule } from '@nestjs/testing';
+import { INestApplication } from '@nestjs/common';
+import request from 'supertest';
+import { AppModule } from '../src/app.module.ts';
+import { configureApp } from '../src/app.config.ts';
+import { <%= user.dtoClass %> } from '../src/users/dto/user.dto.ts';
+import { UserService } from '../src/users/user.service.ts';
+import { PasswordService } from '../src/auth/password.service.ts';
+import { getRepositoryToken } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { Session } from '../src/auth/session.entity.ts';
+
+/** A cookie of the Set-Cookie headers of a response, with its attributes. */
+const setCookie = (response: request.Response, name: string): string | undefined =>
+  ([] as string[]).concat(response.headers['set-cookie'] ?? []).find(value => value.startsWith(`${name}=`));
+
+/** The value of a cookie of the Set-Cookie headers of a response. */
+const cookieValue = (response: request.Response, name: string): string | undefined => {
+  const cookie = setCookie(response, name);
+  return cookie ? decodeURIComponent(cookie.split(';')[0].slice(name.length + 1)) : undefined;
+};
+
+/** The expiry of a cookie of the Set-Cookie headers of a response. */
+const cookieExpiry = (response: request.Response, name: string): number =>
+  Date.parse(/Expires=([^;]+)/.exec(setCookie(response, name) ?? '')?.[1] ?? '');
+
+describe('Session authentication', () => {
+  let app: INestApplication;
+  let agent: ReturnType<typeof request.agent>;
+  let service: UserService;
+  let users: <%= user.dtoClass %>[];
+
+  const password = 'sessionPassword';
+
+  beforeEach(async () => {
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+    configureApp(app);
+    await app.init();
+    service = moduleFixture.get<UserService>(UserService);
+    users = [
+      await service.save({ login: 'session-user', email: 'session-user@localhost', password, activated: true }, 'session-user', true),
+      await service.save({ login: 'session-inactive', email: 'session-inactive@localhost', password, activated: false }, 'session-inactive', true),
+    ];
+    // An agent keeps the cookies of the responses, like a browser: the session and the XSRF-TOKEN cookie.
+    agent = request.agent(app.getHttpServer());
+    csrfToken = undefined;
+  });
+
+  afterEach(async () => {
+    for (const user of users ?? []) {
+      await service.delete(user);
+    }
+    await app?.close();
+  });
+
+  /** The XSRF-TOKEN cookie a client without a session gets, the token of its login, kept by the agent. */
+  let csrfToken: string | undefined;
+  const anonymousToken = async (): Promise<string> => {
+    csrfToken = cookieValue(await agent.get('/api/account').expect(401), 'XSRF-TOKEN') ?? csrfToken;
+    return csrfToken!;
+  };
+
+  /** The login of the form the JHipster clients post, with the token of the XSRF-TOKEN cookie. */
+  const login = async (form: Record<string, string>): Promise<request.Response> => {
+    const token = await anonymousToken();
+    return agent.post('/api/authentication').set('X-XSRF-TOKEN', token).type('form').send(form);
+  };
+
+  it('answers 401 without a session, like JHipster Spring Boot, giving the client a CSRF token cookie', async () => {
+    const response = await agent.get('/api/account').expect(401);
+    expect(cookieValue(response, 'XSRF-TOKEN')).toEqual(expect.any(String));
+  });
+
+  it('refuses a login without the CSRF token of the cookie of the client, like Spring Security, whatever its path', async () => {
+    await anonymousToken();
+    // Express routes the paths whatever their case and a trailing slash.
+    for (const path of ['/api/authentication', '/API/Authentication', '/api/authentication/']) {
+      await agent.post(path).type('form').send({ username: 'session-user', password }).expect(403);
+    }
+    await agent.get('/api/account').expect(401);
+  });
+
+  it('refuses a form of other values than texts with 401', async () => {
+    const token = await anonymousToken();
+    await agent.post('/api/authentication').set('X-XSRF-TOKEN', token).send({ username: ['session-user'], password: { value: password } }).expect(401);
+  });
+
+  it('checks the password of an unknown login too, answering in the time of a known one', async () => {
+    const matches = vi.spyOn(app.get(PasswordService), 'matches');
+    await login({ username: 'unknown', password });
+    expect(matches).toHaveBeenCalledWith(password, expect.any(String));
+  });
+
+  it('logs out a user deactivated or removed at its next request, like JHipster Spring Boot reads the user again', async () => {
+    await login({ username: 'session-user', password, 'remember-me': 'true' });
+    await agent.get('/api/account').expect(200);
+    const user = (await service.findByFields({ where: { login: 'session-user' } }))!;
+    await service.save({ ...user, activated: false }, 'admin');
+    await agent.get('/api/account').expect(401);
+  });
+
+  it('applies the authorities given to the user of a session at once', async () => {
+    await login({ username: 'session-user', password });
+    await agent.get('/api/admin/users').expect(403);
+    const user = (await service.findByFields({ where: { login: 'session-user' } }))!;
+    await service.save({ ...user, authorities: ['ROLE_USER', 'ROLE_ADMIN'] }, 'admin');
+    await agent.get('/api/admin/users').expect(200);
+  });
+
+  it('refuses a wrong password, an unknown login, a missing password and a user not activated with 401', async () => {
+    await login({ username: 'session-user', password: 'wrong' }).then(response => expect(response.status).toBe(401));
+    await login({ username: 'unknown', password }).then(response => expect(response.status).toBe(401));
+    await login({ username: 'session-user' }).then(response => expect(response.status).toBe(401));
+    await login({ username: 'session-inactive', password }).then(response => expect(response.status).toBe(401));
+    await agent.get('/api/account').expect(401);
+  });
+
+  it('logs in the user of the login, in lower case, in a session of 30 minutes without requests', async () => {
+    const response = await login({ username: 'Session-User', password, 'remember-me': 'false' });
+    expect(response.status).toBe(200);
+    expect(cookieExpiry(response, 'JSESSIONID')).toBeLessThanOrEqual(Date.now() + 30 * 60 * 1000);
+    const { body } = await agent.get('/api/account').expect(200);
+    expect(body).toMatchObject({ login: 'session-user' });
+    expect(body.password).toBeUndefined();
+  });
+
+  it('keeps the session in the database, which outlives a restart of the application, and removes it at the logout', async () => {
+    const sessions = app.get<Repository<Session>>(getRepositoryToken(Session));
+    const token = cookieValue(await login({ username: 'session-user', password }), 'XSRF-TOKEN')!;
+    const stored = await sessions.find({ where: { login: 'session-user' } });
+    expect(stored).toHaveLength(1);
+    expect(stored[0].expires.getTime()).toBeGreaterThan(Date.now());
+    expect(JSON.parse(stored[0].data)).toMatchObject({ user: { login: 'session-user' } });
+    expect(stored[0].data).not.toContain(password);
+
+    await agent.post('/api/logout').set('X-XSRF-TOKEN', token).expect(200);
+    expect(await sessions.find({ where: { login: 'session-user' } })).toHaveLength(0);
+  });
+
+  it('names the session cookie like JHipster Spring Boot, not secure behind an untrusted proxy (forward-headers-strategy none)', async () => {
+    const token = await anonymousToken();
+    const response = await agent
+      .post('/api/authentication')
+      .set('X-XSRF-TOKEN', token)
+      .set('X-Forwarded-Proto', 'https')
+      .type('form')
+      .send({ username: 'session-user', password });
+    expect(setCookie(response, 'JSESSIONID')).toMatch(/HttpOnly; SameSite=Lax$/);
+    expect(setCookie(response, 'JSESSIONID')).not.toContain('Secure');
+  });
+
+  it('keeps a remember-me login 31 days without requests, like the remember-me of JHipster Spring Boot', async () => {
+    const response = await login({ username: 'session-user', password, 'remember-me': 'true' });
+    expect(response.status).toBe(200);
+    expect(cookieExpiry(response, 'JSESSIONID')).toBeGreaterThan(Date.now() + 30 * 24 * 60 * 60 * 1000);
+    expect(cookieExpiry(response, 'XSRF-TOKEN')).toBeGreaterThan(Date.now() + 30 * 24 * 60 * 60 * 1000);
+  });
+
+  it('refuses the unsafe requests of a session without its CSRF token, the logout included', async () => {
+    const token = cookieValue(await login({ username: 'session-user', password }), 'XSRF-TOKEN')!;
+    await agent.post('/api/logout').expect(403);
+    await agent.post('/api/logout').set('X-XSRF-TOKEN', 'other').expect(403);
+    await agent.get('/api/account').expect(200);
+    await agent.post('/api/logout').set('X-XSRF-TOKEN', token).expect(200);
+  });
+
+  it('logs out, ending the session', async () => {
+    const token = cookieValue(await login({ username: 'session-user', password }), 'XSRF-TOKEN')!;
+    await agent.post('/api/logout').set('X-XSRF-TOKEN', token).expect(200);
+    await agent.get('/api/account').expect(401);
+  });
+
+  it('lists the sessions of the user and ends one of them, like the sessions page of JHipster Spring Boot', async () => {
+    await request(app.getHttpServer()).get('/api/account/sessions').expect(401);
+    const token = cookieValue(await login({ username: 'session-user', password }), 'XSRF-TOKEN')!;
+    // Another session of the same user, in another browser.
+    const other = request.agent(app.getHttpServer());
+    const otherToken = cookieValue(await other.get('/api/account').expect(401), 'XSRF-TOKEN')!;
+    await other.post('/api/authentication').set('X-XSRF-TOKEN', otherToken).set('User-Agent', 'other-browser').type('form').send({ username: 'session-user', password }).expect(200);
+
+    const { body: sessions } = await agent.get('/api/account/sessions').expect(200);
+    expect(sessions).toHaveLength(2);
+    expect(sessions).toEqual(
+      expect.arrayContaining([
+        { series: expect.any(String), tokenDate: new Date().toISOString().slice(0, 10), ipAddress: expect.any(String), userAgent: 'other-browser' },
+      ]),
+    );
+    const otherSeries = sessions.find((session: any) => session.userAgent === 'other-browser').series;
+
+    await agent.delete(`/api/account/sessions/${otherSeries}`).expect(403);
+    await agent.delete(`/api/account/sessions/${otherSeries}`).set('X-XSRF-TOKEN', token).expect(200);
+    await other.get('/api/account').expect(401);
+    await agent.get('/api/account').expect(200);
+    expect((await agent.get('/api/account/sessions').expect(200)).body).toHaveLength(1);
+  });
+
+  it('neither lists nor ends the sessions of another user', async () => {
+    await login({ username: 'session-user', password });
+    const admin = request.agent(app.getHttpServer());
+    users.push(await service.save({ login: 'session-other', email: 'session-other@localhost', password, activated: true }, 'session-other', true));
+    const adminToken = cookieValue(await admin.get('/api/account').expect(401), 'XSRF-TOKEN')!;
+    await admin.post('/api/authentication').set('X-XSRF-TOKEN', adminToken).type('form').send({ username: 'session-other', password }).expect(200);
+    const { body: otherSessions } = await admin.get('/api/account/sessions').expect(200);
+    const { body: sessions } = await agent.get('/api/account/sessions').expect(200);
+    expect(sessions).toHaveLength(1);
+    expect(otherSessions).toHaveLength(1);
+    expect(otherSessions[0].series).not.toEqual(sessions[0].series);
+  });
+
+  it('refuses the administration to a user without ROLE_ADMIN', async () => {
+    await login({ username: 'session-user', password });
+    await agent.get('/api/admin/users').expect(403);
+  });
+});

package/generators/node-server/templates/server/e2e/setup.test.js.ejs

@@ -0,0 +1 @@
+process.env.BACKEND_ENV='test'