@ossy/users 3.8.0 → 3.11.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ossy/users",
   "description": "User domain - aggregate, events, and validators for the Ossy user model",
-  "version": "3.8.0",
+  "version": "3.11.1",
   "private": false,
   "type": "module",
   "main": "./src/index.js",
@@ -10,6 +10,7 @@
     ".": "./src/index.js",
     "./server": "./src/server.js",
     "./update-email.flow.js": "./src/update-email.flow.js",
+    "./update-profile-name.flow.js": "./src/update-profile-name.flow.js",
     "./update-profile-details.schema.js": "./src/update-profile-details.schema.js"
   },
   "scripts": {
@@ -48,5 +49,5 @@
     "/src",
     "README.md"
   ],
-  "gitHead": "14548dfc2019e7258e8c75db527acbf66fe829bd"
+  "gitHead": "f279de3535b6bc76631cbc6b943dae8f92a1565f"
 }

package/src/get-api-tokens.task.js

@@ -14,6 +14,7 @@ export async function run ({ payload, req }) {
     type: TokenSchema.token,
     'state.subject': userId,
     'state.type': 'Api',
+    'state.status': 'Active',
   }, { state: true }).toArray().then(docs => docs.map(d => d.state))
 
   return tokens.map(({ token: _secret, ...meta }) => meta)

package/src/update-profile-name.flow.js

@@ -0,0 +1,50 @@
+import signUpFlow from '@ossy/authentication/sign-up.flow.js'
+import { metadata as EditProfileDetails } from './edit-profile-details.action.js'
+import { metadata as SaveProfileDetails } from './save-profile-details.action.js'
+import { metadata as UpdateProfileDetailsForm } from './update-profile-details.form.js'
+
+export const metadata = {
+  id: '@ossy/users/flows/update-profile-name',
+  feature: 'users',
+  requires: ['server', 'database'],
+}
+
+/**
+ * Happy path for issue #5 — change first/last name from profile without
+ * requesting an email change (email stays the sign-up address).
+ */
+export default {
+  title: 'Update profile name',
+  description:
+    'Signed-in user edits profile name only, saves, and sees the updated name on profile',
+  steps: [
+    ...signUpFlow.steps,
+    { page: '@profile' },
+    { result: { action: EditProfileDetails, timeout: 10000 } },
+    { action: EditProfileDetails },
+    { result: { action: SaveProfileDetails, timeout: 10000 } },
+    // Keep sign-up email so RequestEmailChange does not run — name-only path.
+    {
+      form: UpdateProfileDetailsForm,
+      fields: {
+        firstName: 'E2E',
+        lastName: 'UpdatedName',
+        email: '$email',
+      },
+    },
+    { action: SaveProfileDetails },
+    {
+      result: {
+        selector: '[data-user-name="E2E UpdatedName"]',
+        timeout: 15000,
+      },
+    },
+    {
+      result: {
+        selector: '[data-action="@ossy/users/actions/save-profile-details"]',
+        hidden: true,
+        timeout: 10000,
+      },
+    },
+  ],
+}

package/src/users.integration.spec.js

@@ -221,6 +221,130 @@ describe('[authentication/actions/request-sign-in]', () => {
 
 })
 
+describe('[authentication/actions/verify-sign-in]', () => {
+
+  describe('given email + code from request-sign-in', () => {
+    it('must return a WebAuth session and set an auth cookie via POST /actions', async () => {
+      const email = casual.email
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      const createdEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        event: 'Created',
+        'payload.email': email,
+      })
+
+      const code = await TestUtil.getLatestVerificationCodeForSubject(createdEvent.resourceId)
+
+      const response = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+
+      const body = await response.json()
+      const signInVerifiedEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        resourceId: createdEvent.resourceId,
+        event: 'SignInVerified',
+      })
+
+      expect(response.status).toBe(200)
+      expect(body).toMatchObject({ sub: createdEvent.resourceId, token: expect.any(String) })
+      expect(!!signInVerifiedEvent).toBe(true)
+      expect(getSetCookieHeader(response).includes(signInVerifiedEvent.payload.token)).toEqual(true)
+    })
+
+    it('must reject reuse of the same code with 401', async () => {
+      const email = casual.email
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      const createdEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        event: 'Created',
+        'payload.email': email,
+      })
+
+      const code = await TestUtil.getLatestVerificationCodeForSubject(createdEvent.resourceId)
+
+      const first = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+      expect(first.status).toBe(200)
+
+      const second = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+      expect(second.status).toBe(401)
+    })
+
+    it('must reject the magic link JWT after sign-in via code with 401', async () => {
+      const email = casual.email
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/sign-up',
+        body: TestUtil.signUpBody({ email }),
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      await TestUtil.AssertActionResponse({
+        actionId: '@ossy/authentication/actions/request-sign-in',
+        payload: { email },
+        expectedResponseStatus: 200,
+        expectedResponseBody: { ok: true },
+      })
+
+      const createdEvent = await TestUtil.GetEvent({
+        type: USER_SCHEMA,
+        event: 'Created',
+        'payload.email': email,
+      })
+
+      const code = await TestUtil.getLatestVerificationCodeForSubject(createdEvent.resourceId)
+      const verificationJwt = await TestUtil.getLatestVerificationJwtForSubject(createdEvent.resourceId)
+
+      const codeResponse = await TestUtil.InvokeAction({
+        actionId: '@ossy/authentication/actions/verify-sign-in',
+        payload: { email, code },
+      })
+      expect(codeResponse.status).toBe(200)
+
+      const linkResponse = await fetch(
+        `${getApiTestBaseUrl()}/users/verify-sign-in?token=${verificationJwt}`,
+        { method: 'GET' },
+      )
+      expect(linkResponse.status).toBe(401)
+    })
+  })
+
 describe('[/users/verify-sign-in][GET]', () => {
 
   describe('given a valid token created from a Created event', () => {
@@ -333,6 +457,13 @@ describe('[/users/verify-sign-in][GET]', () => {
       }))
     })
 
+    it('must return 400 when email+code are provided without a token (codes are POST-only)', () => TestUtil.AssertResponse({
+      endpoint: '/users/verify-sign-in?email=test@example.com&code=123456',
+      method: 'GET',
+      expectedResponseStatus: 400,
+      expectedResponseBody: '',
+    }))
+
   })
 
 })