@nymphjs/tilmeld 1.0.0-beta.11 → 1.0.0-beta.111

package/src/Tilmeld.types.ts

@@ -1,5 +1,5 @@
-import Group, { GroupData } from './Group';
-import User, { UserData } from './User';
+import Group, { GroupData } from './Group.js';
+import User, { UserData } from './User.js';
 
 export type AccessControlData = {
   user?: User & UserData;
@@ -7,7 +7,7 @@ export type AccessControlData = {
   acUser?: number;
   acGroup?: number;
   acOther?: number;
-  acFull?: ((User & UserData) | (Group & GroupData))[];
-  acWrite?: ((User & UserData) | (Group & GroupData))[];
-  acRead?: ((User & UserData) | (Group & GroupData))[];
+  acFull?: string[];
+  acWrite?: string[];
+  acRead?: string[];
 };

package/src/User.test.ts

@@ -1,8 +1,9 @@
 import { SQLite3Driver } from '@nymphjs/driver-sqlite3';
-import { Nymph } from '@nymphjs/nymph';
+import { Nymph, EntityUniqueConstraintError } from '@nymphjs/nymph';
 
-import Tilmeld from './Tilmeld';
-import defaults from './conf/defaults';
+import Tilmeld from './Tilmeld.js';
+import defaults from './conf/defaults.js';
+import { AccessControlError } from './errors/index.js';
 
 const tilmeld = new Tilmeld({
   appName: 'My App',
@@ -11,17 +12,21 @@ const tilmeld = new Tilmeld({
   cookiePath: '/',
   setupPath: '/user',
   emailUsernames: false,
+  domainSupport: true,
   verifyRedirect: 'http://localhost:8080',
   verifyChangeRedirect: 'http://localhost:8080',
   cancelChangeRedirect: 'http://localhost:8080',
   jwtSecret: 'shhhhh',
+  sendEmail: async (_tilmeld, _options, _user) => {
+    return true;
+  },
 });
-const _nymph = new Nymph(
+const nymph = new Nymph(
   {},
   new SQLite3Driver({
     filename: ':memory:',
   }),
-  tilmeld
+  tilmeld,
 );
 
 const User = tilmeld.User;
@@ -44,7 +49,7 @@ describe('User', () => {
     const validUser = await makeNewUser();
 
     expect(() => {
-      defaults.validatorUser(validUser);
+      defaults.validatorUser({ config: defaults } as Tilmeld, validUser);
     }).not.toThrow();
   });
 
@@ -55,7 +60,158 @@ describe('User', () => {
     invalidUser.unknown = 'I should cause an error.';
 
     expect(() => {
-      defaults.validatorUser(invalidUser);
+      defaults.validatorUser({ config: defaults } as Tilmeld, invalidUser);
     }).toThrow('Invalid User:  "unknown" is not allowed');
   });
+
+  it("doesn't allow duplicate usernames", async () => {
+    const transaction = 'duplicate-usernames';
+    const tnymph = await nymph.startTransaction(transaction);
+    const TUser = tnymph.getEntityClass(User.class) as typeof User;
+    const newUserA = await TUser.factory();
+
+    newUserA.username = 'new-user';
+    newUserA.email = 'newusera@localhost';
+    newUserA.nameFirst = 'New';
+    newUserA.nameLast = 'User';
+    newUserA.name = 'New User';
+    newUserA.$password('password');
+
+    const newUserB = await TUser.factory();
+
+    newUserB.username = 'new-user';
+    newUserB.email = 'newuserb@localhost';
+    newUserB.nameFirst = 'New';
+    newUserB.nameLast = 'User';
+    newUserB.name = 'New User';
+    newUserB.$password('password');
+
+    const promises = [newUserA.$saveSkipAC(), newUserB.$saveSkipAC()];
+
+    try {
+      await Promise.all(promises);
+
+      throw new Error("Shouldn't get here because of unique constraint.");
+    } catch (e: any) {
+      expect(e).toBeInstanceOf(EntityUniqueConstraintError);
+    }
+
+    await Promise.allSettled(promises);
+    await tnymph.rollback(transaction);
+  });
+
+  it("doesn't allow duplicate emails", async () => {
+    const transaction = 'duplicate-usernames';
+    const tnymph = await nymph.startTransaction(transaction);
+    const TUser = tnymph.getEntityClass(User.class) as typeof User;
+    const newUserA = await TUser.factory();
+
+    newUserA.username = 'new-user-a';
+    newUserA.email = 'newuser@localhost';
+    newUserA.nameFirst = 'New';
+    newUserA.nameLast = 'User';
+    newUserA.name = 'New User';
+    newUserA.$password('password');
+
+    const newUserB = await TUser.factory();
+
+    newUserB.username = 'new-user-b';
+    newUserB.email = 'newuser@localhost';
+    newUserB.nameFirst = 'New';
+    newUserB.nameLast = 'User';
+    newUserB.name = 'New User';
+    newUserB.$password('password');
+
+    const promises = [newUserA.$saveSkipAC(), newUserB.$saveSkipAC()];
+
+    try {
+      await Promise.all(promises);
+
+      throw new Error("Shouldn't get here because of unique constraint.");
+    } catch (e: any) {
+      expect(e).toBeInstanceOf(EntityUniqueConstraintError);
+    }
+
+    await Promise.allSettled(promises);
+    await tnymph.rollback(transaction);
+  });
+
+  it('allows a domain user', async () => {
+    const domainAdmin = await User.factory();
+
+    domainAdmin.username = 'admin';
+    domainAdmin.email = 'admin@localhost';
+    domainAdmin.nameFirst = 'Admin';
+    domainAdmin.nameLast = 'User';
+    domainAdmin.name = 'Admin User';
+    domainAdmin.$password('password');
+    domainAdmin.$grant('tilmeld/domain/example.com/admin');
+
+    expect(await domainAdmin.$saveSkipAC()).toEqual(true);
+
+    // Log in the domain admin.
+    await tilmeld.fillSession(domainAdmin);
+
+    const domainUser = await User.factory();
+
+    domainUser.username = 'new-user@example.com';
+    domainUser.email = 'newuser@localhost';
+    domainUser.nameFirst = 'New';
+    domainUser.nameLast = 'User';
+    domainUser.name = 'New User';
+    domainUser.$password('password');
+
+    expect(await domainUser.$save()).toEqual(true);
+
+    tilmeld.clearSession();
+
+    for (const user of [domainAdmin, domainUser]) {
+      if (user.guid != null) {
+        expect(await user.$deleteSkipAC()).toEqual(true);
+      }
+    }
+  });
+
+  it('disallows a domain user with no admin permission', async () => {
+    const domainAdmin = await User.factory();
+
+    domainAdmin.username = 'admin';
+    domainAdmin.email = 'admin@localhost';
+    domainAdmin.nameFirst = 'Admin';
+    domainAdmin.nameLast = 'User';
+    domainAdmin.name = 'Admin User';
+    domainAdmin.$password('password');
+    domainAdmin.$grant('tilmeld/domain/example.com/admin');
+
+    expect(await domainAdmin.$saveSkipAC()).toEqual(true);
+
+    // Log in the domain admin.
+    await tilmeld.fillSession(domainAdmin);
+
+    const domainUser = await User.factory();
+
+    // The wrong domain name.
+    domainUser.username = 'new-user@example.net';
+    domainUser.email = 'newuser@localhost';
+    domainUser.nameFirst = 'New';
+    domainUser.nameLast = 'User';
+    domainUser.name = 'New User';
+    domainUser.$password('password');
+
+    try {
+      await domainUser.$save();
+
+      throw new Error("Shouldn't get here because of access control.");
+    } catch (e: any) {
+      expect(e).toBeInstanceOf(AccessControlError);
+    }
+
+    tilmeld.clearSession();
+
+    for (const user of [domainAdmin, domainUser]) {
+      if (user.guid != null) {
+        expect(await user.$deleteSkipAC()).toEqual(true);
+      }
+    }
+  });
 });