@ossy/users 3.11.0 → 3.11.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ossy/users",
   "description": "User domain - aggregate, events, and validators for the Ossy user model",
-  "version": "3.11.0",
+  "version": "3.11.1",
   "private": false,
   "type": "module",
   "main": "./src/index.js",
@@ -49,5 +49,5 @@
     "/src",
     "README.md"
   ],
-  "gitHead": "53ff8456920e09151c9d88df4a6c3ee958d811eb"
+  "gitHead": "f279de3535b6bc76631cbc6b943dae8f92a1565f"
 }

package/src/users.integration.spec.js

@@ -221,6 +221,130 @@ describe('[authentication/actions/request-sign-in]', () => {
 
 })
 
+describe('[authentication/actions/verify-sign-in]', () => {
+
+  describe('given email + code from request-sign-in', () => {
+    it('must return a WebAuth session and set an auth cookie via POST /actions', async () => {
+      const email = casual.email
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      const createdEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        event: 'Created',
+        'payload.email': email,
+      })
+
+      const code = await TestUtil.getLatestVerificationCodeForSubject(createdEvent.resourceId)
+
+      const response = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+
+      const body = await response.json()
+      const signInVerifiedEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        resourceId: createdEvent.resourceId,
+        event: 'SignInVerified',
+      })
+
+      expect(response.status).toBe(200)
+      expect(body).toMatchObject({ sub: createdEvent.resourceId, token: expect.any(String) })
+      expect(!!signInVerifiedEvent).toBe(true)
+      expect(getSetCookieHeader(response).includes(signInVerifiedEvent.payload.token)).toEqual(true)
+    })
+
+    it('must reject reuse of the same code with 401', async () => {
+      const email = casual.email
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      const createdEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        event: 'Created',
+        'payload.email': email,
+      })
+
+      const code = await TestUtil.getLatestVerificationCodeForSubject(createdEvent.resourceId)
+
+      const first = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+      expect(first.status).toBe(200)
+
+      const second = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+      expect(second.status).toBe(401)
+    })
+
+    it('must reject the magic link JWT after sign-in via code with 401', async () => {
+      const email = casual.email
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      const createdEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        event: 'Created',
+        'payload.email': email,
+      })
+
+      const code = await TestUtil.getLatestVerificationCodeForSubject(createdEvent.resourceId)
+      const verificationJwt = await TestUtil.getLatestVerificationJwtForSubject(createdEvent.resourceId)
+
+      const codeResponse = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+      expect(codeResponse.status).toBe(200)
+
+      const linkResponse = await fetch(
+        `${getApiTestBaseUrl()}/users/verify-sign-in?token=${verificationJwt}`,
+        { method: 'GET' },
+      )
+      expect(linkResponse.status).toBe(401)
+    })
+  })
+
 describe('[/users/verify-sign-in][GET]', () => {
 
   describe('given a valid token created from a Created event', () => {
@@ -333,6 +457,13 @@ describe('[/users/verify-sign-in][GET]', () => {
       }))
     })
 
+    it('must return 400 when email+code are provided without a token (codes are POST-only)', () => TestUtil.AssertResponse({
+      endpoint: '/users/verify-sign-in?email=test@example.com&code=123456',
+      method: 'GET',
+      expectedResponseStatus: 400,
+      expectedResponseBody: '',
+    }))
+
   })
 
 })