@oneuptime/common 14.0.10 → 14.0.11

package/Tests/App/Accounts/LoginSsoEdition.test.tsx

@@ -1,616 +0,0 @@
-import "@testing-library/jest-dom";
-import {
-  afterEach,
-  beforeEach,
-  describe,
-  expect,
-  jest,
-  test,
-} from "@jest/globals";
-import { act, cleanup, render, screen } from "@testing-library/react";
-import userEvent from "@testing-library/user-event";
-import fs from "fs";
-import path from "path";
-import * as React from "react";
-import { MemoryRouter } from "react-router-dom";
-import API from "../../../UI/Utils/API/API";
-import HTTPErrorResponse from "../../../Types/API/HTTPErrorResponse";
-import HTTPResponse from "../../../Types/API/HTTPResponse";
-import { JSONObject } from "../../../Types/JSON";
-import LoginUtil from "../../../UI/Utils/Login";
-import Navigation from "../../../UI/Utils/Navigation";
-import UiAnalytics from "../../../UI/Utils/Analytics";
-import UserUtil from "../../../UI/Utils/User";
-import i18n from "../../../../App/FeatureSet/Accounts/src/Utils/i18n";
-import english from "../../../../App/FeatureSet/Accounts/src/Locales/en.json";
-import german from "../../../../App/FeatureSet/Accounts/src/Locales/de.json";
-import LoginPage from "../../../../App/FeatureSet/Accounts/src/Pages/Login";
-import LoginWithSSOPage from "../../../../App/FeatureSet/Accounts/src/Pages/LoginWithSSO";
-import {
-  isSsoLoginOffered,
-  isSsoUnavailableStatusCode,
-} from "../../../../App/FeatureSet/Accounts/src/Utils/SsoAvailability";
-
-/*
- * Sign-in surfaces on the Community Edition (design v2 section 0/5).
- *
- * SSO login is part of the Enterprise Edition, which the cloud also runs. So:
- *   - the password page offers "Use single sign-on (SSO) instead" only when
- *     the EFFECTIVE edition (env.js IS_ENTERPRISE_EDITION, true only when the
- *     enterprise code is loaded) is Enterprise, or billing is on;
- *   - the SSO page, reached directly on a Community Edition server, gets 404
- *     from every provider lookup, and on an Enterprise Edition server whose
- *     license has lapsed (or does not include SSO) it gets 402 - SSO is off
- *     there until a license is activated, and that server still offers the
- *     link. Either way the page explains that SSO needs the Enterprise
- *     Edition with an active license, instead of "no SSO configuration
- *     found" - and never tells an Enterprise server that SSO is only part of
- *     the Enterprise Edition, as it used to.
- *
- * Billing and the edition are pinned in every test: CI's config.env sets
- * BILLING_ENABLED=true.
- *
- * The explanation is a real locale string (sso.enterpriseEditionRequired),
- * not the English defaultValue the page passes as a safety net: the tests
- * below check the key exists in every Accounts locale and that the page
- * renders the locale's text, in English and in another language.
- */
-
-let billingEnabledForTest: boolean = false;
-let enterpriseEditionForTest: boolean = false;
-
-jest.mock("../../../UI/Config", () => {
-  const actual: Record<string, unknown> = jest.requireActual(
-    "../../../UI/Config",
-  ) as Record<string, unknown>;
-
-  const mocked: Record<string, unknown> = { ...actual };
-
-  Object.defineProperty(mocked, "BILLING_ENABLED", {
-    get: (): boolean => {
-      return billingEnabledForTest;
-    },
-  });
-
-  Object.defineProperty(mocked, "IS_ENTERPRISE_EDITION", {
-    get: (): boolean => {
-      return enterpriseEditionForTest;
-    },
-  });
-
-  return mocked;
-});
-
-jest.mock("../../../UI/Components/EditionLabel/EditionLabel", () => {
-  return {
-    __esModule: true,
-    default: (): null => {
-      return null;
-    },
-  };
-});
-
-const USE_SSO_LINK: string = "Use single sign-on (SSO) instead";
-const ENTERPRISE_NOTICE: RegExp =
-  /Single sign-on \(SSO\) is not available on this server/;
-const USE_PASSWORD_LINK: string = "Use username and password instead.";
-const ENTERPRISE_NOTICE_KEY: string = "sso.enterpriseEditionRequired";
-const ENTERPRISE_NOTICE_TEXT: string =
-  "Single sign-on (SSO) is not available on this server: it needs the OneUptime Enterprise Edition with an active license. Sign in with your email and password instead.";
-/*
- * The explanation before the license could stop SSO. It only fits the
- * Community Edition: on an Enterprise server whose license lapsed it says the
- * server is not what it is.
- */
-const RETIRED_COMMUNITY_ONLY_NOTICE_TEXT: string =
-  "Single sign-on (SSO) is part of the OneUptime Enterprise Edition and is not available on this server. Sign in with your email and password instead.";
-const LOGIN_WITH_SSO_SOURCE: string = path.resolve(
-  __dirname,
-  "..",
-  "..",
-  "..",
-  "..",
-  "App",
-  "FeatureSet",
-  "Accounts",
-  "src",
-  "Pages",
-  "LoginWithSSO.tsx",
-);
-
-/*
- * What the explanation must say to fit both servers that show it: the
- * Community Edition (no SSO routes) needs to hear about the Enterprise
- * Edition, an Enterprise server with a lapsed license about the license. And
- * it must not claim the server lacks the Enterprise Edition.
- */
-interface NoticeRule {
-  problem: string;
-  pattern: RegExp;
-  // true: the text must match; false: it must not.
-  isRequired: boolean;
-}
-
-const NOTICE_RULES: Array<NoticeRule> = [
-  {
-    problem: "does not say SSO is unavailable here",
-    pattern: /\bnot available on this server\b/,
-    isRequired: true,
-  },
-  {
-    problem: "does not name the Enterprise Edition",
-    pattern: /\bOneUptime Enterprise Edition\b/,
-    isRequired: true,
-  },
-  {
-    problem: "does not mention the license",
-    pattern: /\bactive license\b/,
-    isRequired: true,
-  },
-  {
-    problem: "tells an Enterprise server it is not the Enterprise Edition",
-    pattern:
-      /\bis part of the OneUptime Enterprise Edition and is not available\b/,
-    isRequired: false,
-  },
-  {
-    problem: "does not point to password sign-in",
-    pattern: /\bemail and password\b/,
-    isRequired: true,
-  },
-];
-
-const noticeProblems: (text: string) => Array<string> = (
-  text: string,
-): Array<string> => {
-  return NOTICE_RULES.filter((rule: NoticeRule): boolean => {
-    return rule.pattern.test(text) !== rule.isRequired;
-  }).map((rule: NoticeRule): string => {
-    return rule.problem;
-  });
-};
-
-const ACCOUNTS_LOCALES_DIR: string = path.resolve(
-  __dirname,
-  "..",
-  "..",
-  "..",
-  "..",
-  "App",
-  "FeatureSet",
-  "Accounts",
-  "src",
-  "Locales",
-);
-
-type LookupAnswer = { status: number; data: Array<JSONObject> | JSONObject };
-
-let globalSamlAnswer: LookupAnswer;
-let globalOidcAnswer: LookupAnswer;
-let emailSamlAnswer: LookupAnswer;
-let emailOidcAnswer: LookupAnswer;
-let requestedUrls: Array<string>;
-
-const toResponse: (
-  answer: LookupAnswer,
-) => HTTPResponse<JSONObject> | HTTPErrorResponse = (
-  answer: LookupAnswer,
-): HTTPResponse<JSONObject> | HTTPErrorResponse => {
-  if (answer.status >= 400) {
-    return new HTTPErrorResponse(answer.status, answer.data, {});
-  }
-
-  return new HTTPResponse<JSONObject>(answer.status, answer.data, {});
-};
-
-const NOT_SERVED: LookupAnswer = {
-  status: 404,
-  data: { message: "Page not found - /identity/..." },
-};
-const NO_PROVIDERS: LookupAnswer = { status: 200, data: [] };
-const NO_CONFIG_FOR_EMAIL: LookupAnswer = {
-  status: 400,
-  data: { message: "No SSO config found for this user" },
-};
-
-const renderLogin: () => void = (): void => {
-  render(
-    <MemoryRouter>
-      <LoginPage />
-    </MemoryRouter>,
-  );
-};
-
-const renderSso: () => Promise<void> = async (): Promise<void> => {
-  await act(async () => {
-    render(
-      <MemoryRouter>
-        <LoginWithSSOPage />
-      </MemoryRouter>,
-    );
-  });
-};
-
-const submitEmail: (email: string) => Promise<void> = async (
-  email: string,
-): Promise<void> => {
-  const user: ReturnType<typeof userEvent.setup> = userEvent.setup({
-    delay: null,
-  });
-
-  await user.type(await screen.findByTestId("email"), email);
-
-  await act(async () => {
-    await user.click(screen.getByTestId("Login with SSO"));
-  });
-};
-
-describe("Accounts sign-in on the Community and Enterprise Editions", () => {
-  beforeEach(() => {
-    billingEnabledForTest = false;
-    enterpriseEditionForTest = false;
-    requestedUrls = [];
-    globalSamlAnswer = NO_PROVIDERS;
-    globalOidcAnswer = NO_PROVIDERS;
-    emailSamlAnswer = NO_CONFIG_FOR_EMAIL;
-    emailOidcAnswer = NO_CONFIG_FOR_EMAIL;
-
-    jest.spyOn(UserUtil, "isLoggedIn").mockReturnValue(false);
-    jest.spyOn(Navigation, "navigate").mockImplementation(() => {});
-    jest.spyOn(Navigation, "getQueryStringByName").mockReturnValue("");
-    jest.spyOn(UiAnalytics, "userAuth").mockImplementation(() => {});
-    jest.spyOn(UiAnalytics, "capture").mockImplementation(() => {});
-    jest.spyOn(LoginUtil, "login").mockImplementation(() => {});
-
-    jest
-      .spyOn(API, "get")
-      .mockImplementation(
-        async (
-          options: Parameters<typeof API.get>[0],
-        ): Promise<HTTPResponse<JSONObject> | HTTPErrorResponse> => {
-          const url: string = options.url?.toString() || "";
-          requestedUrls.push(url);
-
-          if (url.includes("/global-sso/service-provider-login")) {
-            return toResponse(globalSamlAnswer);
-          }
-
-          if (url.includes("/global-oidc/service-provider-login")) {
-            return toResponse(globalOidcAnswer);
-          }
-
-          if (url.includes("/service-provider-login-oidc")) {
-            return toResponse(emailOidcAnswer);
-          }
-
-          if (url.includes("/service-provider-login")) {
-            return toResponse(emailSamlAnswer);
-          }
-
-          return toResponse(NOT_SERVED);
-        },
-      );
-  });
-
-  afterEach(async () => {
-    cleanup();
-    jest.restoreAllMocks();
-    billingEnabledForTest = false;
-    enterpriseEditionForTest = false;
-    await i18n.changeLanguage("en");
-  });
-
-  describe("SsoAvailability", () => {
-    test.each([
-      [false, false, false],
-      [true, false, true],
-      [false, true, true],
-      [true, true, true],
-    ])(
-      "IS_ENTERPRISE_EDITION=%p, BILLING_ENABLED=%p -> SSO offered: %p",
-      (enterprise: boolean, billing: boolean, offered: boolean) => {
-        enterpriseEditionForTest = enterprise;
-        billingEnabledForTest = billing;
-
-        expect(isSsoLoginOffered()).toBe(offered);
-      },
-    );
-
-    test.each([
-      [404, true],
-      [402, true],
-      [400, false],
-      [401, false],
-      [403, false],
-      [500, false],
-      [200, false],
-    ])(
-      "status %p means 'this server has no SSO login': %p",
-      (statusCode: number, unavailable: boolean) => {
-        expect(isSsoUnavailableStatusCode(statusCode)).toBe(unavailable);
-      },
-    );
-  });
-
-  describe("password sign-in page", () => {
-    test("the Community Edition does not offer SSO", async () => {
-      renderLogin();
-
-      expect(await screen.findByTestId("email")).toBeInTheDocument();
-      expect(screen.getByTestId("password")).toBeInTheDocument();
-      expect(screen.queryByText(USE_SSO_LINK)).not.toBeInTheDocument();
-    });
-
-    test("the Enterprise Edition offers SSO", async () => {
-      enterpriseEditionForTest = true;
-      renderLogin();
-
-      expect(await screen.findByTestId("email")).toBeInTheDocument();
-      expect(screen.getByText(USE_SSO_LINK)).toBeInTheDocument();
-      expect(screen.getByText(USE_SSO_LINK).closest("a")).toHaveAttribute(
-        "href",
-        "/accounts/sso",
-      );
-    });
-
-    test("the cloud (billing on) offers SSO", async () => {
-      billingEnabledForTest = true;
-      renderLogin();
-
-      expect(await screen.findByTestId("email")).toBeInTheDocument();
-      expect(screen.getByText(USE_SSO_LINK)).toBeInTheDocument();
-    });
-  });
-
-  describe("SSO sign-in page", () => {
-    test("on the Community Edition (the provider routes answer 404) it explains SSO is an Enterprise Edition feature", async () => {
-      globalSamlAnswer = NOT_SERVED;
-      globalOidcAnswer = NOT_SERVED;
-
-      await renderSso();
-
-      expect(
-        await screen.findByTestId("sso-enterprise-edition-required"),
-      ).toBeInTheDocument();
-      expect(screen.getByText(ENTERPRISE_NOTICE)).toBeInTheDocument();
-      expect(screen.getByText(USE_PASSWORD_LINK).closest("a")).toHaveAttribute(
-        "href",
-        "/accounts/login",
-      );
-      // No email form to fill in for a lookup that cannot succeed.
-      expect(screen.queryByTestId("email")).not.toBeInTheDocument();
-    });
-
-    test("the explanation is the only message: the notice and the way back, nothing else", async () => {
-      globalSamlAnswer = NOT_SERVED;
-      globalOidcAnswer = NOT_SERVED;
-
-      await renderSso();
-
-      const notice: HTMLElement = await screen.findByTestId(
-        "sso-enterprise-edition-required",
-      );
-
-      expect(notice.textContent).toBe(
-        `${ENTERPRISE_NOTICE_TEXT}${USE_PASSWORD_LINK}`,
-      );
-      expect(screen.getAllByText(ENTERPRISE_NOTICE)).toHaveLength(1);
-      expect(
-        screen.queryByText(/No SSO configuration found/),
-      ).not.toBeInTheDocument();
-      expect(screen.queryByText(english.sso.subtitle)).not.toBeInTheDocument();
-    });
-
-    test("the explanation resolves from the Accounts locales, not from its defaultValue", async () => {
-      globalSamlAnswer = NOT_SERVED;
-      globalOidcAnswer = NOT_SERVED;
-
-      expect(i18n.exists(ENTERPRISE_NOTICE_KEY)).toBe(true);
-      expect(english.sso.enterpriseEditionRequired).toBe(
-        ENTERPRISE_NOTICE_TEXT,
-      );
-      // Without a defaultValue, a missing key would come back as the key.
-      expect(i18n.t(ENTERPRISE_NOTICE_KEY)).toBe(ENTERPRISE_NOTICE_TEXT);
-
-      await renderSso();
-
-      expect(
-        await screen.findByTestId("sso-enterprise-edition-required"),
-      ).toHaveTextContent(ENTERPRISE_NOTICE_TEXT);
-    });
-
-    test("the explanation is translated: German gets the German text", async () => {
-      globalSamlAnswer = NOT_SERVED;
-      globalOidcAnswer = NOT_SERVED;
-      await i18n.changeLanguage("de");
-
-      await renderSso();
-
-      const notice: HTMLElement = await screen.findByTestId(
-        "sso-enterprise-edition-required",
-      );
-
-      expect(notice).toHaveTextContent(german.sso.enterpriseEditionRequired);
-      expect(notice).not.toHaveTextContent(ENTERPRISE_NOTICE_TEXT);
-      expect(german.sso.enterpriseEditionRequired).not.toBe(
-        ENTERPRISE_NOTICE_TEXT,
-      );
-    });
-
-    test("every Accounts locale translates the explanation", () => {
-      const locales: Array<string> = fs
-        .readdirSync(ACCOUNTS_LOCALES_DIR)
-        .filter((file: string) => {
-          return file.endsWith(".json") && file !== "en.json";
-        });
-
-      expect(locales).toHaveLength(16);
-
-      for (const file of locales) {
-        const locale: { sso?: Record<string, unknown> } = JSON.parse(
-          fs.readFileSync(path.join(ACCOUNTS_LOCALES_DIR, file), "utf8"),
-        ) as { sso?: Record<string, unknown> };
-        const value: unknown = locale.sso?.["enterpriseEditionRequired"];
-
-        expect([file, typeof value]).toEqual([file, "string"]);
-        expect((value as string).trim()).not.toBe("");
-        expect([file, value]).not.toEqual([file, ENTERPRISE_NOTICE_TEXT]);
-        expect([file, value]).not.toEqual([
-          file,
-          RETIRED_COMMUNITY_ONLY_NOTICE_TEXT,
-        ]);
-        // The product name stays in Latin script in every language.
-        expect([
-          file,
-          (value as string).includes("OneUptime Enterprise Edition"),
-        ]).toEqual([file, true]);
-      }
-    });
-
-    test("a 402 from the provider routes is explained the same way", async () => {
-      globalSamlAnswer = { status: 402, data: { message: "Payment required" } };
-      globalOidcAnswer = { status: 402, data: { message: "Payment required" } };
-
-      await renderSso();
-
-      expect(
-        await screen.findByTestId("sso-enterprise-edition-required"),
-      ).toBeInTheDocument();
-    });
-
-    /*
-     * An Enterprise Edition server whose license has lapsed still offers the
-     * SSO link (isSsoLoginOffered follows the edition, not the license), and
-     * every SSO discovery route answers 402 until a license is activated.
-     */
-    test("an Enterprise server whose license lapsed (402 everywhere): the explanation fits it", async () => {
-      enterpriseEditionForTest = true;
-      const lapsed: LookupAnswer = {
-        status: 402,
-        data: {
-          message:
-            "Single sign-on is unavailable because this OneUptime installation's Enterprise license has lapsed or does not include it.",
-        },
-      };
-      globalSamlAnswer = lapsed;
-      globalOidcAnswer = lapsed;
-      emailSamlAnswer = lapsed;
-      emailOidcAnswer = lapsed;
-
-      expect(isSsoLoginOffered()).toBe(true);
-
-      await renderSso();
-
-      const notice: HTMLElement = await screen.findByTestId(
-        "sso-enterprise-edition-required",
-      );
-
-      expect(notice).toHaveTextContent(ENTERPRISE_NOTICE_TEXT);
-      expect(noticeProblems(notice.textContent || "")).toEqual([]);
-      expect(notice).not.toHaveTextContent(RETIRED_COMMUNITY_ONLY_NOTICE_TEXT);
-      expect(screen.queryByTestId("email")).not.toBeInTheDocument();
-    });
-
-    test("the English explanation fits both servers, and the page's defaultValue is the same text", () => {
-      expect(noticeProblems(english.sso.enterpriseEditionRequired)).toEqual([]);
-
-      const source: string = fs.readFileSync(LOGIN_WITH_SSO_SOURCE, "utf8");
-
-      expect(source).toContain(JSON.stringify(ENTERPRISE_NOTICE_TEXT));
-      expect(source).not.toContain(RETIRED_COMMUNITY_ONLY_NOTICE_TEXT);
-    });
-
-    test("the explanation check rejects the retired Community-only copy (negative control)", () => {
-      expect(noticeProblems(RETIRED_COMMUNITY_ONLY_NOTICE_TEXT)).toEqual([
-        "does not mention the license",
-        "tells an Enterprise server it is not the Enterprise Edition",
-      ]);
-      expect(
-        noticeProblems(
-          "Single sign-on (SSO) is not available on this server. Sign in with your email and password instead.",
-        ),
-      ).toEqual([
-        "does not name the Enterprise Edition",
-        "does not mention the license",
-      ]);
-      expect(
-        noticeProblems(
-          "Single sign-on (SSO) is not available on this server: it needs the OneUptime Enterprise Edition with an active license.",
-        ),
-      ).toEqual(["does not point to password sign-in"]);
-    });
-
-    test("when only the email lookups answer 404, submitting the email shows the explanation", async () => {
-      emailSamlAnswer = NOT_SERVED;
-      emailOidcAnswer = NOT_SERVED;
-
-      await renderSso();
-      await submitEmail("ada@example.com");
-
-      expect(
-        await screen.findByTestId("sso-enterprise-edition-required"),
-      ).toBeInTheDocument();
-      expect(
-        screen.queryByText(/No SSO configuration found/),
-      ).not.toBeInTheDocument();
-    });
-
-    test("on the Enterprise Edition the email form is shown, and an unknown email gets the normal message", async () => {
-      await renderSso();
-
-      expect(
-        screen.queryByTestId("sso-enterprise-edition-required"),
-      ).not.toBeInTheDocument();
-
-      await submitEmail("ada@example.com");
-
-      expect(
-        await screen.findByText(
-          "No SSO configuration found for the email: ada@example.com",
-        ),
-      ).toBeInTheDocument();
-      expect(
-        screen.queryByTestId("sso-enterprise-edition-required"),
-      ).not.toBeInTheDocument();
-      expect(
-        requestedUrls.some((url: string) => {
-          return url.includes("/service-provider-login?email=");
-        }),
-      ).toBe(true);
-    });
-
-    test("one lookup answering 404 is not enough: the other may still have providers", async () => {
-      emailSamlAnswer = NOT_SERVED;
-      emailOidcAnswer = {
-        status: 200,
-        data: [
-          {
-            _id: "99999999-9999-4999-8999-999999999999",
-            name: "Entra ID",
-            projectId: "11111111-1111-4111-8111-111111111111",
-          },
-        ],
-      };
-
-      await renderSso();
-      await submitEmail("ada@example.com");
-
-      expect(await screen.findByText("Entra ID")).toBeInTheDocument();
-      expect(
-        screen.queryByTestId("sso-enterprise-edition-required"),
-      ).not.toBeInTheDocument();
-    });
-
-    test("a server error is not mistaken for the Community Edition", async () => {
-      globalSamlAnswer = { status: 500, data: { message: "boom" } };
-      globalOidcAnswer = { status: 500, data: { message: "boom" } };
-
-      await renderSso();
-
-      expect(await screen.findByTestId("email")).toBeInTheDocument();
-      expect(
-        screen.queryByTestId("sso-enterprise-edition-required"),
-      ).not.toBeInTheDocument();
-    });
-  });
-});