@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Server/API/TeamMemberLeaveScimLockEdition.test.ts

@@ -0,0 +1,252 @@
+import TeamMemberAPI from "../../../Server/API/TeamMemberAPI";
+import ProjectSCIMService from "../../../Server/Services/ProjectSCIMService";
+import TeamMemberService from "../../../Server/Services/TeamMemberService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import FakeEnterpriseModule, {
+  createEditionStateCases,
+  createLicenseSnapshotWithStatus,
+  EditionStateCase,
+  installFakeEnterpriseModule,
+  uninstallEnterpriseModule,
+} from "../Enterprise/FakeEnterpriseModule";
+import logger from "../../../Server/Utils/Logger";
+import { setTestBillingEnabled } from "../Enterprise/TestBillingFlag";
+import { getJestSpyOn } from "../../Spy";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+type SpyInstance = ReturnType<typeof getJestSpyOn>;
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  const billingFlag: typeof import("../Enterprise/TestBillingFlag") =
+    jest.requireActual(
+      "../Enterprise/TestBillingFlag",
+    ) as typeof import("../Enterprise/TestBillingFlag");
+
+  return billingFlag.withLiveBillingFlag(
+    jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >,
+  );
+});
+
+/*
+ * POST /team-member/:id/leave lets a member leave a team. While SCIM Push
+ * Groups owns the project's teams, only the identity provider may remove
+ * members, so the route refuses - while SCIM is active
+ * (EnterpriseEdition.isFeatureActive(SCIM)). The Community Edition has no
+ * SCIM endpoint, and an Enterprise install whose license lapsed answers none,
+ * so there a Push Groups setting left on must not trap the member in the team.
+ */
+
+const ROUTE: string = "/team-member/:id/leave";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const MEMBERSHIP_ID: ObjectID = new ObjectID(
+  "66666666-6666-4666-8666-666666666666",
+);
+const USER_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+
+const EDITION_CASES: Array<EditionStateCase> = createEditionStateCases();
+
+const toMatrix: (
+  cases: Array<EditionStateCase>,
+) => Array<[string, EditionStateCase]> = (
+  cases: Array<EditionStateCase>,
+): Array<[string, EditionStateCase]> => {
+  return cases.map(
+    (editionCase: EditionStateCase): [string, EditionStateCase] => {
+      return [editionCase.label, editionCase];
+    },
+  );
+};
+
+const LOCKED_MATRIX: Array<[string, EditionStateCase]> = toMatrix(
+  EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+    return editionCase.isActive;
+  }),
+);
+
+const UNLOCKED_MATRIX: Array<[string, EditionStateCase]> = toMatrix(
+  EDITION_CASES.filter((editionCase: EditionStateCase): boolean => {
+    return !editionCase.isActive;
+  }),
+);
+
+let scimCount: SpyInstance;
+let deleteMembership: SpyInstance;
+
+const leave: () => Promise<void> = async (): Promise<void> => {
+  const req: ExpressRequest = {
+    params: { id: MEMBERSHIP_ID.toString() },
+    query: {},
+    body: {},
+    headers: {},
+    userAuthorization: { userId: USER_ID },
+  } as unknown as ExpressRequest;
+
+  const res: ExpressResponse = {
+    send: jest.fn(),
+    json: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+  } as unknown as ExpressResponse;
+
+  const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+  await mockRouter.match("POST", ROUTE).handlerFunction(req, res, next);
+
+  expect(next).not.toHaveBeenCalled();
+};
+
+const expectRefusedBecauseOfScim: () => void = (): void => {
+  expect(Response.sendErrorResponse).toHaveBeenCalledWith(
+    expect.anything(),
+    expect.anything(),
+    new BadDataException(
+      "Team membership is managed by SCIM Push Groups for this project. Please contact your administrator to be removed.",
+    ),
+  );
+  expect(deleteMembership).not.toHaveBeenCalled();
+  expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
+};
+
+const expectLeft: () => void = (): void => {
+  expect(Response.sendErrorResponse).not.toHaveBeenCalled();
+  expect(deleteMembership).toHaveBeenCalledWith({
+    id: MEMBERSHIP_ID,
+    props: { isRoot: true },
+  });
+  expect(Response.sendEmptySuccessResponse).toHaveBeenCalledTimes(1);
+};
+
+describe("POST /team-member/:id/leave and SCIM Push Groups, by edition", () => {
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new TeamMemberAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    setTestBillingEnabled(false);
+    uninstallEnterpriseModule();
+
+    const membership: TeamMember = new TeamMember();
+    membership.userId = USER_ID;
+    membership.projectId = PROJECT_ID;
+
+    getJestSpyOn(TeamMemberService, "findOneById").mockResolvedValue(
+      membership,
+    );
+    deleteMembership = getJestSpyOn(
+      TeamMemberService,
+      "deleteOneById",
+    ).mockResolvedValue(1);
+    getJestSpyOn(logger, "warn").mockImplementation((): void => {
+      return undefined;
+    });
+    getJestSpyOn(logger, "info").mockImplementation((): void => {
+      return undefined;
+    });
+
+    // Push Groups is ON for the project.
+    scimCount = getJestSpyOn(ProjectSCIMService, "countBy").mockResolvedValue(
+      new PositiveNumber(1),
+    );
+  });
+
+  afterEach(() => {
+    uninstallEnterpriseModule();
+    setTestBillingEnabled(false);
+    jest.restoreAllMocks();
+  });
+
+  test.each(LOCKED_MATRIX)(
+    "SCIM active (%s): leaving is refused",
+    async (_label: string, editionCase: EditionStateCase) => {
+      editionCase.apply();
+
+      await leave();
+
+      expect(scimCount).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: { projectId: PROJECT_ID, enablePushGroups: true },
+        }),
+      );
+      expectRefusedBecauseOfScim();
+    },
+  );
+
+  test.each(UNLOCKED_MATRIX)(
+    "SCIM not active (%s): the member can leave",
+    async (_label: string, editionCase: EditionStateCase) => {
+      editionCase.apply();
+
+      await leave();
+
+      expect(scimCount).not.toHaveBeenCalled();
+      expectLeft();
+    },
+  );
+
+  test("the lock follows the license at request time: a lapse lets the member leave, a renewal locks again", async () => {
+    const fake: FakeEnterpriseModule = installFakeEnterpriseModule({
+      snapshot: createLicenseSnapshotWithStatus("valid"),
+    });
+
+    await leave();
+    expectRefusedBecauseOfScim();
+
+    jest.clearAllMocks();
+    fake.setSnapshot(createLicenseSnapshotWithStatus("expired"));
+
+    await leave();
+    expectLeft();
+  });
+
+  test("with Push Groups off the Enterprise Edition lets the member leave", async () => {
+    installFakeEnterpriseModule();
+    scimCount.mockResolvedValue(new PositiveNumber(0));
+
+    await leave();
+
+    expectLeft();
+  });
+});

package/Tests/Server/API/TeamMemberRemoveUserFromProjectAPI.test.ts

@@ -242,6 +242,13 @@ describe("POST /team-member/remove-user-from-project", () => {
     );
   });
 
+  /*
+   * The handler's own check, called directly. On the router an anonymous
+   * request (an expired session) never gets this far any more:
+   * requireUserAuthentication answers it with a 401 first, which is pinned
+   * in ExpiredSessionRouteGuards.test.ts. This stays as defence in depth for
+   * a credentialed caller with no user id, such as a project API key.
+   */
   test("rejects an unauthenticated caller without deleting anything", async () => {
     await callRoute({ body: { userId: targetUserId.toString() } });
 

package/Tests/Server/API/UserIncomingCallNumberApi.test.ts

@@ -157,6 +157,12 @@ describe("UserIncomingCallNumberAPI", () => {
         expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
       });
 
+      /*
+       * The handler's own check, reached directly. Through the router, a
+       * request with no session is answered 401 by requireUserAuthentication
+       * before the limiter or this handler runs (see
+       * ExpiredSessionRouteGuards.test.ts); this pins the defence in depth.
+       */
       it("should reject when the request carries no user authorization", async () => {
         mockRequest.body = { itemId: ITEM_ID };
         UserIncomingCallNumberService.findOneById = jest

package/Tests/Server/API/UserNotificationSettingAPI.test.ts

@@ -12,9 +12,13 @@ import Response from "../../../Server/Utils/Response";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
 import { ROUTINE_EMAIL_EVENT_TYPES } from "../../../Types/NotificationSetting/RoutineEmailEvents";
 import ObjectID from "../../../Types/ObjectID";
 import Permission from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
 
 jest.mock("../../../Server/Utils/Express", () => {
   return {
@@ -29,6 +33,15 @@ const USER_ID: ObjectID = ObjectID.generate();
 const PROJECT_ID: ObjectID = ObjectID.generate();
 const OTHER_PROJECT_ID: ObjectID = ObjectID.generate();
 
+/*
+ * The exception the handler handed to next(). Its code is the HTTP status the
+ * client sees, and the browser client refreshes the session on 401 only, so
+ * the code is asserted alongside the class.
+ */
+function errorPassedTo(next: jest.Mock): Exception {
+  return next.mock.calls[0]![0] as Exception;
+}
+
 describe("POST reduce routine emails", () => {
   let props: DatabaseCommonInteractionProps;
   let reduceSpy: jest.SpyInstance;
@@ -128,21 +141,67 @@ describe("POST reduce routine emails", () => {
     });
   });
 
-  test.each(["anonymous", "project API key"])(
-    "rejects a %s without an authenticated user",
-    async () => {
+  /*
+   * Both callers are refused, but differently. The anonymous one - no user, no
+   * key, typically a dashboard tab whose access-token cookie expired - gets
+   * NotAuthenticatedException (401), which is what makes the browser refresh
+   * the session and resend; it used to get the 422 below. A project API key
+   * is authenticated but is nobody's preferences, so it keeps the 422: a 401
+   * would send its client off to refresh a session it never had.
+   */
+  test.each([
+    {
+      caller: "an anonymous caller",
+      userType: undefined,
+      exception: NotAuthenticatedException,
+      code: ExceptionCode.NotAuthenticatedException,
+    },
+    {
+      caller: "an explicitly Public caller",
+      userType: UserType.Public,
+      exception: NotAuthenticatedException,
+      code: ExceptionCode.NotAuthenticatedException,
+    },
+    {
+      caller: "a project API key",
+      userType: UserType.API,
+      exception: NotAuthorizedException,
+      code: ExceptionCode.NotAuthorizedException,
+    },
+  ])(
+    "rejects $caller without an authenticated user",
+    async (testCase: {
+      caller: string;
+      userType: UserType | undefined;
+      exception:
+        | typeof NotAuthenticatedException
+        | typeof NotAuthorizedException;
+      code: ExceptionCode;
+    }) => {
       props.userId = undefined;
+      props.userType = testCase.userType;
       const next: jest.Mock = await call({ userId: USER_ID.toString() });
-      expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+      expect(next).toHaveBeenCalledWith(expect.any(testCase.exception));
+      expect(errorPassedTo(next).code).toBe(testCase.code);
       expect(reduceSpy).not.toHaveBeenCalled();
       expect(responseSpy).not.toHaveBeenCalled();
     },
   );
 
+  test("an anonymous caller with no tenant is asked to log in before the missing project is reported", async () => {
+    props.userId = undefined;
+    props.tenantId = undefined;
+    const next: jest.Mock = await call();
+    expect(next).toHaveBeenCalledWith(expect.any(NotAuthenticatedException));
+    expect(errorPassedTo(next).code).toBe(401);
+    expect(reduceSpy).not.toHaveBeenCalled();
+  });
+
   test("rejects missing project context before changing preferences", async () => {
     props.tenantId = undefined;
     const next: jest.Mock = await call({ projectId: PROJECT_ID.toString() });
     expect(next).toHaveBeenCalledWith(expect.any(BadDataException));
+    expect(errorPassedTo(next).code).toBe(ExceptionCode.BadDataException);
     expect(reduceSpy).not.toHaveBeenCalled();
   });
 
@@ -150,6 +209,7 @@ describe("POST reduce routine emails", () => {
     props.userTenantAccessPermission = undefined;
     const next: jest.Mock = await call();
     expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+    expect(errorPassedTo(next).code).toBe(ExceptionCode.NotAuthorizedException);
     expect(reduceSpy).not.toHaveBeenCalled();
   });
 
@@ -157,6 +217,7 @@ describe("POST reduce routine emails", () => {
     props.tenantId = OTHER_PROJECT_ID;
     const next: jest.Mock = await call();
     expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+    expect(errorPassedTo(next).code).toBe(ExceptionCode.NotAuthorizedException);
     expect(reduceSpy).not.toHaveBeenCalled();
   });
 

package/Tests/Server/API/UserProjectsAPI.test.ts

@@ -18,6 +18,10 @@ import TeamMember from "../../../Models/DatabaseModels/TeamMember";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import { DEFAULT_LIMIT } from "../../../Types/Database/LimitMax";
 import Dictionary from "../../../Types/Dictionary";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 import { JSONObject } from "../../../Types/JSON";
 import JSONWebTokenData from "../../../Types/JsonWebTokenData";
@@ -916,7 +920,7 @@ describe("POST /user/:userId/projects — the master API key path", () => {
   type MiddlewareCallResult = {
     // Whether the gate let the request through to the read.
     reachedHandler: boolean;
-    errorSentToClient: NotAuthorizedException | undefined;
+    errorSentToClient: Exception | undefined;
     // The request object as the handler saw it, to inspect what the gate set.
     request: ExpressRequest;
   };
@@ -974,7 +978,7 @@ describe("POST /user/:userId/projects — the master API key path", () => {
 
     return {
       reachedHandler: reachedHandler,
-      errorSentToClient: errorCall?.[2] as NotAuthorizedException | undefined,
+      errorSentToClient: errorCall?.[2] as Exception | undefined,
       request: req,
     };
   }
@@ -1145,7 +1149,19 @@ describe("POST /user/:userId/projects — the master API key path", () => {
         expect(findBySpy).not.toHaveBeenCalled();
         expect(Response.sendJsonArrayResponse).not.toHaveBeenCalled();
 
-        expect(result.errorSentToClient).toBeInstanceOf(NotAuthorizedException);
+        /*
+         * An unusable key falls through to the session check, and with no
+         * session that is the no-token refusal - a 401 now, where it used to
+         * be a NotAuthorizedException (422). Still a refusal, and still AT the
+         * gate; only the status changed, so that an Admin Dashboard tab whose
+         * session cookie has expired refreshes instead of showing an error.
+         */
+        expect(result.errorSentToClient).toBeInstanceOf(
+          NotAuthenticatedException,
+        );
+        expect(result.errorSentToClient?.code).toBe(
+          ExceptionCode.NotAuthenticatedException,
+        );
         expect(result.errorSentToClient?.message).toBe(
           "Unauthorized: Access token is required.",
         );
@@ -1159,6 +1175,41 @@ describe("POST /user/:userId/projects — the master API key path", () => {
 
       expect(result.reachedHandler).toBe(false);
       expect(findBySpy).not.toHaveBeenCalled();
+
+      /*
+       * This is what the Admin Dashboard's User > Projects page sends once
+       * its session cookie has expired. Only a 401 makes the browser client
+       * refresh the session and replay the read.
+       */
+      expect(result.errorSentToClient).toBeInstanceOf(
+        NotAuthenticatedException,
+      );
+      expect(result.errorSentToClient?.code).toBe(
+        ExceptionCode.NotAuthenticatedException,
+      );
+    });
+
+    test("refuses an expired session with no key with a 401, without reading anything", async () => {
+      jest
+        .spyOn(UserMiddleware, "getAccessTokenFromExpressRequest")
+        .mockReturnValue("an.expired.token" as never);
+
+      jest.spyOn(JSONWebToken, "decode").mockImplementation(() => {
+        throw new BadDataException("AccessToken is invalid or expired");
+      });
+
+      const result: MiddlewareCallResult = await callThroughMiddleware({
+        headers: {},
+      });
+
+      expect(result.reachedHandler).toBe(false);
+      expect(findBySpy).not.toHaveBeenCalled();
+      expect(result.errorSentToClient).toBeInstanceOf(
+        NotAuthenticatedException,
+      );
+      expect(result.errorSentToClient?.message).toBe(
+        "Unauthorized: Invalid or expired access token.",
+      );
     });
 
     /*
@@ -1231,6 +1282,15 @@ describe("POST /user/:userId/projects — the master API key path", () => {
       expect(result.errorSentToClient?.message).toBe(
         "Unauthorized: Only master admins can perform this action.",
       );
+
+      /*
+       * Still a 422, unlike the missing-token case: this caller is signed in,
+       * and refreshing their session would not make them a master admin.
+       */
+      expect(result.errorSentToClient).toBeInstanceOf(NotAuthorizedException);
+      expect(result.errorSentToClient?.code).toBe(
+        ExceptionCode.NotAuthorizedException,
+      );
     });
 
     /*

package/Tests/Server/API/UserTotpAuthAPI.test.ts

@@ -1,4 +1,5 @@
 import UserTotpAuthAPI from "../../../Server/API/UserTotpAuthAPI";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
 import UserTotpAuthService from "../../../Server/Services/UserTotpAuthService";
 import UserService from "../../../Server/Services/UserService";
 import UserTwoFactorBackupCodeService from "../../../Server/Services/UserTwoFactorBackupCodeService";
@@ -17,6 +18,8 @@ import Dictionary from "../../../Types/Dictionary";
 import Email from "../../../Types/Email";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import UserTotpAuth from "../../../Models/DatabaseModels/UserTotpAuth";
@@ -358,11 +361,54 @@ describe("POST /user-totp-auth/validate", () => {
      * `userAuthorization` off an unauthenticated request, the ownership
      * comparison below would compare against `undefined`, and anybody could
      * verify anybody's TOTP row.
+     *
+     * Two middlewares now, asserted by identity (a count of two would not
+     * notice one being swapped for another). getUserMiddleware resolves the
+     * session, but lets a request with NO session through as Public;
+     * requireUserAuthentication is what turns that request into a 401. It was
+     * added because an enrolment page left open past the session lifetime
+     * sends exactly that request - the access-token cookie expires with the
+     * token - and the handler answered it with a "Two factor auth not found"
+     * 400 (after reading the row as root), which the browser client does not
+     * treat as a cue to refresh the session and retry.
      */
     test("is behind an authentication middleware", () => {
-      expect(mockRouter.match("post", VALIDATE_ROUTE).middlewares.length).toBe(
-        1,
+      expect(mockRouter.match("post", VALIDATE_ROUTE).middlewares).toEqual([
+        UserMiddleware.getUserMiddleware,
+        UserMiddleware.requireUserAuthentication,
+      ]);
+    });
+
+    test("answers a request with no session 401 before any row is read", async () => {
+      const req: OneUptimeRequest = {
+        body: { id: TOTP_ID.toString(), code: "123456" },
+        params: {},
+        query: {},
+        headers: {},
+      } as unknown as OneUptimeRequest;
+
+      const res: OneUptimeResponse = {
+        status: jest.fn().mockReturnThis(),
+      } as unknown as OneUptimeResponse;
+
+      const next: jest.Mock = jest.fn();
+
+      await mockRouter.match("post", VALIDATE_ROUTE).middlewares[1]!(
+        req,
+        res,
+        next as unknown as NextFunction,
       );
+
+      expect(next).not.toHaveBeenCalled();
+
+      const error: Exception = asMock(Response.sendErrorResponse).mock
+        .calls[0]![2] as Exception;
+
+      expect(error).toBeInstanceOf(NotAuthenticatedException);
+      expect(error.code).toBe(ExceptionCode.NotAuthenticatedException);
+      expect(findTotpById).not.toHaveBeenCalled();
+      expect(updateTotpById).not.toHaveBeenCalled();
+      expect(generateForUserIfNoneSpy).not.toHaveBeenCalled();
     });
   });
 

package/Tests/Server/API/UserWebAuthnAuthenticationOptionsRoute.test.ts

@@ -281,20 +281,29 @@ describe("POST /user-webauthn/generate-authentication-options", () => {
       ["registration options", REGISTRATION_OPTIONS_ROUTE],
       ["verify registration", VERIFY_REGISTRATION_ROUTE],
     ])(
-      "%s stays behind the user middleware alone",
+      "%s stays behind the user middleware and its authentication guard alone",
       (_name: string, uri: string) => {
         /*
          * Both are authenticated, and neither carries an email in its body --
          * so the limiter's account key would collapse to the same value for
          * every caller and one user's enrolment attempts would throttle
          * everybody's.
+         *
+         * The second entry is requireUserAuthentication, not a limiter. It
+         * turns a request with no session (the access-token cookie expired
+         * while the enrolment dialog was open) into a 401 the browser client
+         * refreshes on. It is the only thing allowed after getUserMiddleware.
          */
         const route: { middlewares: Array<unknown> } = mockRouter.match(
           "post",
           uri,
         );
 
-        expect(route.middlewares).toEqual([UserMiddleware.getUserMiddleware]);
+        expect(route.middlewares).toEqual([
+          UserMiddleware.getUserMiddleware,
+          UserMiddleware.requireUserAuthentication,
+        ]);
+        expect(route.middlewares).not.toContain(mountedMiddleware);
       },
     );
   });

package/Tests/Server/API/UserWebAuthnBackupCodeMinting.test.ts

@@ -13,6 +13,9 @@ import { mockRouter } from "./Helpers";
 import { getJestSpyOn } from "../../Spy";
 import Dictionary from "../../../Types/Dictionary";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import {
@@ -336,20 +339,60 @@ afterEach(() => {
 
 describe("POST /user-webauthn/verify-registration", () => {
   describe("the route itself", () => {
-    test("is registered as a POST behind the user middleware", () => {
+    test("is registered as a POST behind the user middleware and the authentication guard", () => {
       /*
        * The handler takes the owning user from `userAuthorization`, which is
        * put on the request by this middleware and by nothing else. Without it
        * the id would be undefined for every caller, and asserted by IDENTITY
        * rather than by counting because swapping in a different middleware
-       * keeps the count at one.
+       * keeps the count the same.
+       *
+       * getUserMiddleware lets a request with NO session through as Public,
+       * so requireUserAuthentication follows it and answers that request with
+       * a 401. A key-enrolment dialog left open until the access-token cookie
+       * expired sends exactly that request, and only a 401 makes the browser
+       * client refresh the session and replay the registration.
        */
       const route: { middlewares: Array<unknown> } = mockRouter.match(
         "post",
         VERIFY_REGISTRATION_ROUTE,
       );
 
-      expect(route.middlewares).toEqual([UserMiddleware.getUserMiddleware]);
+      expect(route.middlewares).toEqual([
+        UserMiddleware.getUserMiddleware,
+        UserMiddleware.requireUserAuthentication,
+      ]);
+    });
+
+    test("answers a request with no session 401 before registering or minting anything", async () => {
+      const req: OneUptimeRequest = {
+        params: {},
+        query: {},
+        body: { credential: CREDENTIAL_FROM_THE_BROWSER, name: KEY_NAME },
+        headers: {},
+      } as unknown as OneUptimeRequest;
+
+      const res: OneUptimeResponse = {
+        status: jest.fn().mockReturnThis(),
+      } as unknown as OneUptimeResponse;
+
+      const next: jest.Mock = jest.fn();
+
+      await mockRouter.match("post", VERIFY_REGISTRATION_ROUTE).middlewares[1]!(
+        req,
+        res,
+        next as unknown as NextFunction,
+      );
+
+      expect(next).not.toHaveBeenCalled();
+
+      const error: Exception = asMock(Response.sendErrorResponse).mock
+        .calls[0]![2] as Exception;
+
+      expect(error).toBeInstanceOf(NotAuthenticatedException);
+      expect(error.code).toBe(ExceptionCode.NotAuthenticatedException);
+      expect(verifyRegistrationSpy).not.toHaveBeenCalled();
+      expect(mintSpy).not.toHaveBeenCalled();
     });
 
     test("carries no route parameter that could name a user", () => {