@proteinjs/user-server 1.17.0 → 1.18.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +11 -0
- package/dist/generated/index.js +1 -1
- package/dist/generated/index.js.map +1 -1
- package/dist/src/routes/devLogin.d.ts +10 -0
- package/dist/src/routes/devLogin.d.ts.map +1 -1
- package/dist/src/routes/devLogin.js +28 -9
- package/dist/src/routes/devLogin.js.map +1 -1
- package/dist/src/services/Roles.d.ts +20 -1
- package/dist/src/services/Roles.d.ts.map +1 -1
- package/dist/src/services/Roles.js +79 -3
- package/dist/src/services/Roles.js.map +1 -1
- package/dist/test/DevLogin.test.js +13 -41
- package/dist/test/DevLogin.test.js.map +1 -1
- package/dist/test/DevLoginBootstrapAdmin.test.d.ts +2 -0
- package/dist/test/DevLoginBootstrapAdmin.test.d.ts.map +1 -0
- package/dist/test/DevLoginBootstrapAdmin.test.js +384 -0
- package/dist/test/DevLoginBootstrapAdmin.test.js.map +1 -0
- package/dist/test/devLoginHarness.d.ts +16 -0
- package/dist/test/devLoginHarness.d.ts.map +1 -0
- package/dist/test/devLoginHarness.js +79 -0
- package/dist/test/devLoginHarness.js.map +1 -0
- package/generated/index.ts +1 -1
- package/package.json +2 -2
- package/src/routes/devLogin.ts +17 -0
- package/src/services/Roles.ts +49 -4
- package/test/DevLogin.test.ts +5 -36
- package/test/DevLoginBootstrapAdmin.test.ts +175 -0
- package/test/devLoginHarness.ts +39 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA8D,MAAM,iBAAiB,CAAC;AAE3G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C
|
|
1
|
+
{"version":3,"file":"Roles.d.ts","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA8D,MAAM,iBAAiB,CAAC;AAE3G,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,KAAM,YAAW,YAAY;IACjC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAIhD;IAEI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7D;;;;;;;;;;;;;OAaG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;YAqBzE,UAAU;IA8ExB,+GAA+G;YACjG,WAAW;CAK1B"}
|
|
@@ -55,7 +55,9 @@ var logger_1 = require("@proteinjs/logger");
|
|
|
55
55
|
* audited: the role update and its `role_grant_event` row (actor, target, role, action; `created`
|
|
56
56
|
* is the timestamp) commit in one transaction, so the trail cannot diverge from the grants.
|
|
57
57
|
*
|
|
58
|
-
* Break-glass roles are never granted
|
|
58
|
+
* Break-glass roles are never granted through the service door — see `changeRole`; revoking one
|
|
59
|
+
* stays allowed. The ONE break-glass grant in code is `bootstrapAdmin`, the dev first-admin door
|
|
60
|
+
* (server-internal; reachable only through `/dev/login`'s gates, never over RPC).
|
|
59
61
|
*
|
|
60
62
|
* Nobody edits their OWN roles: separating 'roles' from 'users' means nothing if the holder can
|
|
61
63
|
* simply grant themselves more, and a self-revoke is the mirror hazard (the last holder locking
|
|
@@ -93,6 +95,63 @@ var Roles = /** @class */ (function () {
|
|
|
93
95
|
});
|
|
94
96
|
});
|
|
95
97
|
};
|
|
98
|
+
/**
|
|
99
|
+
* The dev first-admin door's grant — `/dev/login` honoring `DEV_BOOTSTRAP_ADMIN_EMAIL`
|
|
100
|
+
* (routes/devLogin.ts). A fresh dev database has no privileged account to grant from, and the
|
|
101
|
+
* only other path to break-glass is a manual UPDATE in Spanner Studio — right for prod and every
|
|
102
|
+
* clone-backed instance, wrong for a lane's throwaway estate on a real dev database, where raw
|
|
103
|
+
* writes are forbidden. So this grants 'admin' to `email`'s account exactly when NO account
|
|
104
|
+
* carries it yet (the membership test `UserAuth.hasRole` makes, over every row), audited like
|
|
105
|
+
* any grant — actor = the account itself, because the door acts for nobody else. Once an admin
|
|
106
|
+
* exists it never grants again: every later grant rides Admin → Users.
|
|
107
|
+
*
|
|
108
|
+
* Server-internal, like `Signup.createAccount`: absent from `RolesService`, so never
|
|
109
|
+
* RPC-reachable. The caller's two gates (DEVELOPMENT + DEV_AUTO_LOGIN_EMAIL) are the only way
|
|
110
|
+
* in, and test/prod never set the variable.
|
|
111
|
+
*/
|
|
112
|
+
Roles.prototype.bootstrapAdmin = function (email) {
|
|
113
|
+
var _a;
|
|
114
|
+
return __awaiter(this, void 0, void 0, function () {
|
|
115
|
+
var logger, db, user, roles;
|
|
116
|
+
var _this = this;
|
|
117
|
+
return __generator(this, function (_b) {
|
|
118
|
+
switch (_b.label) {
|
|
119
|
+
case 0:
|
|
120
|
+
logger = new logger_1.Logger({ name: 'Roles.bootstrapAdmin' });
|
|
121
|
+
db = (0, db_1.getDbAsSystem)();
|
|
122
|
+
return [4 /*yield*/, this.adminExists()];
|
|
123
|
+
case 1:
|
|
124
|
+
if (_b.sent()) {
|
|
125
|
+
return [2 /*return*/, 'admin-exists'];
|
|
126
|
+
}
|
|
127
|
+
return [4 /*yield*/, db.get(user_1.tables.User, { email: email.toLowerCase() })];
|
|
128
|
+
case 2:
|
|
129
|
+
user = _b.sent();
|
|
130
|
+
if (!user) {
|
|
131
|
+
return [2 /*return*/, 'no-account'];
|
|
132
|
+
}
|
|
133
|
+
roles = (_a = user.roles) !== null && _a !== void 0 ? _a : [];
|
|
134
|
+
return [4 /*yield*/, db.runTransaction(function () { return __awaiter(_this, void 0, void 0, function () {
|
|
135
|
+
return __generator(this, function (_a) {
|
|
136
|
+
switch (_a.label) {
|
|
137
|
+
case 0: return [4 /*yield*/, db.update(user_1.tables.User, { id: user.id, roles: __spreadArray(__spreadArray([], roles, true), ['admin'], false) })];
|
|
138
|
+
case 1:
|
|
139
|
+
_a.sent();
|
|
140
|
+
return [4 /*yield*/, db.insert(user_1.tables.RoleGrantEvent, { actor: user.id, target: user.id, role: 'admin', action: 'grant' })];
|
|
141
|
+
case 2:
|
|
142
|
+
_a.sent();
|
|
143
|
+
return [2 /*return*/];
|
|
144
|
+
}
|
|
145
|
+
});
|
|
146
|
+
}); })];
|
|
147
|
+
case 3:
|
|
148
|
+
_b.sent();
|
|
149
|
+
logger.info({ message: 'Break-glass admin granted by the dev first-admin door', obj: { target: user.id, email: email } });
|
|
150
|
+
return [2 /*return*/, 'granted'];
|
|
151
|
+
}
|
|
152
|
+
});
|
|
153
|
+
});
|
|
154
|
+
};
|
|
96
155
|
Roles.prototype.changeRole = function (userId, role, action) {
|
|
97
156
|
var _a;
|
|
98
157
|
return __awaiter(this, void 0, void 0, function () {
|
|
@@ -108,8 +167,9 @@ var Roles = /** @class */ (function () {
|
|
|
108
167
|
}
|
|
109
168
|
// Break-glass passes every permission check, so no permission-mapped role — including
|
|
110
169
|
// 'roles' — may mint it: the only path to break-glass is a manual UPDATE on the user row
|
|
111
|
-
// in Spanner Studio, by a human, on purpose
|
|
112
|
-
// "held by nobody day-to-day"
|
|
170
|
+
// in Spanner Studio, by a human, on purpose (and, on a DEV server only, the first-admin door
|
|
171
|
+
// `bootstrapAdmin`). Revoke stays open: de-escalation toward "held by nobody day-to-day"
|
|
172
|
+
// should ride the audited path, not require database access.
|
|
113
173
|
if (entry.breakGlass && action === 'grant') {
|
|
114
174
|
throw new Error("'".concat(role, "' is a break-glass role \u2014 this service refuses to grant it. The only path to ") +
|
|
115
175
|
"break-glass is a manual UPDATE on the user row in Spanner Studio. (Revoking it here " +
|
|
@@ -180,6 +240,22 @@ var Roles = /** @class */ (function () {
|
|
|
180
240
|
});
|
|
181
241
|
});
|
|
182
242
|
};
|
|
243
|
+
/** Whether any account carries the break-glass role — `UserAuth.hasRole`'s membership test, over every row. */
|
|
244
|
+
Roles.prototype.adminExists = function () {
|
|
245
|
+
return __awaiter(this, void 0, void 0, function () {
|
|
246
|
+
var qb, users;
|
|
247
|
+
return __generator(this, function (_a) {
|
|
248
|
+
switch (_a.label) {
|
|
249
|
+
case 0:
|
|
250
|
+
qb = new db_1.QueryBuilderFactory().getQueryBuilder(user_1.tables.User).select({ fields: ['id', 'roles'] });
|
|
251
|
+
return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.User, qb)];
|
|
252
|
+
case 1:
|
|
253
|
+
users = _a.sent();
|
|
254
|
+
return [2 /*return*/, users.some(function (user) { var _a; return ((_a = user.roles) !== null && _a !== void 0 ? _a : []).includes('admin'); })];
|
|
255
|
+
}
|
|
256
|
+
});
|
|
257
|
+
});
|
|
258
|
+
};
|
|
183
259
|
return Roles;
|
|
184
260
|
}());
|
|
185
261
|
exports.Roles = Roles;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,
|
|
1
|
+
{"version":3,"file":"Roles.js","sourceRoot":"","sources":["../../../src/services/Roles.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAmE;AACnE,wCAA2G;AAC3G,4CAA2C;AAG3C;;;;;;;;;;;;;GAaG;AACH;IAAA;QACS,oBAAe,GAA+B;YACnD,IAAI,EAAE;gBACJ,UAAU,EAAE,uBAAgB,CAAC,KAAK;aACnC;SACF,CAAC;IAiIJ,CAAC;IA/HO,yBAAS,GAAf,UAAgB,MAAc,EAAE,IAAY;;;;4BAC1C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,EAAA;;wBAA5C,SAA4C,CAAC;;;;;KAC9C;IAEK,0BAAU,GAAhB,UAAiB,MAAc,EAAE,IAAY;;;;4BAC3C,qBAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAA;;wBAA7C,SAA6C,CAAC;;;;;KAC/C;IAED;;;;;;;;;;;;;OAaG;IACG,8BAAc,GAApB,UAAqB,KAAa;;;;;;;;wBAC1B,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;wBACtD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACvB,qBAAM,IAAI,CAAC,WAAW,EAAE,EAAA;;wBAA5B,IAAI,SAAwB,EAAE;4BAC5B,sBAAO,cAAc,EAAC;yBACvB;wBAEY,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAAhE,IAAI,GAAG,SAAyD;wBACtE,IAAI,CAAC,IAAI,EAAE;4BACT,sBAAO,YAAY,EAAC;yBACrB;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,kCAAM,KAAK,UAAE,OAAO,SAAC,EAAE,CAAC,EAAA;;4CAAzE,SAAyE,CAAC;4CAC1E,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAA;;4CAA3G,SAA2G,CAAC;;;;iCAC7G,CAAC,EAAA;;wBAHF,SAGE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;wBACnH,sBAAO,SAAS,EAAC;;;;KAClB;IAEa,0BAAU,GAAxB,UAAyB,MAAc,EAAE,IAAY,EAAE,MAA0B;;;;;;;;wBACzE,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,gBAAS,MAAM,SAAM,EAAE,CAAC,CAAC;wBACrD,KAAK,GAAG,mBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC1C,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,WAAI,IAAI,4DAAyD,CAAC,CAAC;yBACpF;wBAED,sFAAsF;wBACtF,yFAAyF;wBACzF,6FAA6F;wBAC7F,yFAAyF;wBACzF,6DAA6D;wBAC7D,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE;4BAC1C,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,uFAA+E;gCACrF,sFAAsF;gCACtF,iBAAiB,CACpB,CAAC;yBACH;wBAED,2FAA2F;wBAC3F,6FAA6F;wBAC7F,yFAAyF;wBACzF,2FAA2F;wBAC3F,IAAI,KAAK,CAAC,cAAc,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,eAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;4BAC5E,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,mFAA2E;gCACjF,mCAAmC,CACtC,CAAC;yBACH;wBAEK,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACd,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;wBAAhD,IAAI,GAAG,SAAyC;wBACtD,IAAI,CAAC,IAAI,EAAE;4BACT,MAAM,IAAI,KAAK,CAAC,gCAAyB,MAAM,CAAE,CAAC,CAAC;yBACpD;wBAED,4FAA4F;wBAC5F,4FAA4F;wBAC5F,iFAAiF;wBACjF,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE;4BACpC,MAAM,IAAI,KAAK,CACb,WAAI,IAAI,CAAC,KAAK,gFAA6E;gCACzF,6FAA6F,CAChG,CAAC;yBACH;wBAEK,KAAK,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC;wBACvC,wFAAwF;wBACxF,0FAA0F;wBAC1F,2EAA2E;wBAC3E,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,EAAE;4BACvB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,EAAE,CAAC,CAAC;4BACxG,MAAM,IAAI,KAAK,CAAC,oBAAa,MAAM,qDAA6C,CAAC,CAAC;yBACnF;wBAEK,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC;wBAC/B,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;4BACrE,mFAAmF;4BACnF,sBAAO;yBACR;wBAEK,QAAQ,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,iCAAK,KAAK,UAAE,IAAI,UAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAC,QAAQ,IAAK,OAAA,QAAQ,KAAK,IAAI,EAAjB,CAAiB,CAAC,CAAC;wBACvG,qBAAM,EAAE,CAAC,cAAc,CAAC;;;gDACtB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAA;;4CAA7D,SAA6D,CAAC;4CAC9D,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,cAAc,EAAE;oDACrC,KAAK,EAAE,KAAK,CAAC,EAAE;oDACf,MAAM,EAAE,MAAM;oDACd,IAAI,MAAA;oDACJ,MAAM,QAAA;iDACP,CAAC,EAAA;;4CALF,SAKE,CAAC;;;;iCACJ,CAAC,EAAA;;wBARF,SAQE,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC;4BACV,OAAO,EAAE,eAAQ,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAE;4BAC7D,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,MAAA,EAAE;yBAC/C,CAAC,CAAC;;;;;KACJ;IAED,+GAA+G;IACjG,2BAAW,GAAzB;;;;;;wBACQ,EAAE,GAAG,IAAI,wBAAmB,EAAE,CAAC,eAAe,CAAC,aAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;wBACxF,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;wBAApD,KAAK,GAAG,SAA4C;wBAC1D,sBAAO,KAAK,CAAC,IAAI,CAAC,UAAC,IAAI,YAAK,OAAA,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA,EAAA,CAAC,EAAC;;;;KACnE;IACH,YAAC;AAAD,CAAC,AAtID,IAsIC;AAtIY,sBAAK"}
|
|
@@ -39,8 +39,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
39
39
|
var db_1 = require("@proteinjs/db");
|
|
40
40
|
var user_1 = require("@proteinjs/user");
|
|
41
41
|
var PasswordHasher_1 = require("../src/authentication/PasswordHasher");
|
|
42
|
-
var
|
|
43
|
-
var passportSessionHarness_1 = require("./passportSessionHarness");
|
|
42
|
+
var devLoginHarness_1 = require("./devLoginHarness");
|
|
44
43
|
var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
|
|
45
44
|
var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
|
|
46
45
|
/**
|
|
@@ -51,39 +50,10 @@ var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
|
|
|
51
50
|
* - Double gate: `DEVELOPMENT` AND `DEV_AUTO_LOGIN_EMAIL` both present, else 404 (unchanged).
|
|
52
51
|
* - Domain rail: a `?email=` param must share `DEV_AUTO_LOGIN_EMAIL`'s domain — even a dev server
|
|
53
52
|
* must not mint sessions (much less accounts) for arbitrary domains. Others 400.
|
|
53
|
+
* The first-admin door (`DEV_BOOTSTRAP_ADMIN_EMAIL`) has its own suite, DevLoginBootstrapAdmin.test.ts;
|
|
54
|
+
* here the variable is unset, so every created account is role-less.
|
|
54
55
|
*/
|
|
55
56
|
var ENV_EMAIL = 'dev@test.local';
|
|
56
|
-
var invokeDevLogin = function (query) { return __awaiter(void 0, void 0, void 0, function () {
|
|
57
|
-
var _a, request, events, outcome, response;
|
|
58
|
-
var _b;
|
|
59
|
-
return __generator(this, function (_c) {
|
|
60
|
-
switch (_c.label) {
|
|
61
|
-
case 0: return [4 /*yield*/, (0, passportSessionHarness_1.createPassportRequest)({ query: query })];
|
|
62
|
-
case 1:
|
|
63
|
-
_a = _c.sent(), request = _a.request, events = _a.events;
|
|
64
|
-
outcome = { sessionRegenerated: false, sessionSaved: false };
|
|
65
|
-
response = {
|
|
66
|
-
status: function (code) {
|
|
67
|
-
outcome.status = code;
|
|
68
|
-
return this;
|
|
69
|
-
},
|
|
70
|
-
send: function (body) {
|
|
71
|
-
outcome.body = body;
|
|
72
|
-
},
|
|
73
|
-
redirect: function (path) {
|
|
74
|
-
outcome.redirect = path;
|
|
75
|
-
},
|
|
76
|
-
};
|
|
77
|
-
return [4 /*yield*/, devLogin_1.devLogin.onRequest(request, response)];
|
|
78
|
-
case 2:
|
|
79
|
-
_c.sent();
|
|
80
|
-
outcome.loggedInAs = (_b = request.session.passport) === null || _b === void 0 ? void 0 : _b.user;
|
|
81
|
-
outcome.sessionRegenerated = events.includes('regenerate');
|
|
82
|
-
outcome.sessionSaved = events.includes('save');
|
|
83
|
-
return [2 /*return*/, outcome];
|
|
84
|
-
}
|
|
85
|
-
});
|
|
86
|
-
}); };
|
|
87
57
|
var getUserRow = function (email) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
|
|
88
58
|
switch (_a.label) {
|
|
89
59
|
case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { email: email })];
|
|
@@ -94,6 +64,7 @@ describe('devLogin route', function () {
|
|
|
94
64
|
var originalEnv = {
|
|
95
65
|
DEVELOPMENT: process.env.DEVELOPMENT,
|
|
96
66
|
DEV_AUTO_LOGIN_EMAIL: process.env.DEV_AUTO_LOGIN_EMAIL,
|
|
67
|
+
DEV_BOOTSTRAP_ADMIN_EMAIL: process.env.DEV_BOOTSTRAP_ADMIN_EMAIL,
|
|
97
68
|
};
|
|
98
69
|
beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
|
|
99
70
|
return __generator(this, function (_a) {
|
|
@@ -118,6 +89,7 @@ describe('devLogin route', function () {
|
|
|
118
89
|
beforeEach(function () {
|
|
119
90
|
process.env.DEVELOPMENT = 'true';
|
|
120
91
|
process.env.DEV_AUTO_LOGIN_EMAIL = ENV_EMAIL;
|
|
92
|
+
delete process.env.DEV_BOOTSTRAP_ADMIN_EMAIL;
|
|
121
93
|
});
|
|
122
94
|
afterEach(function () {
|
|
123
95
|
for (var _i = 0, _a = Object.entries(originalEnv); _i < _a.length; _i++) {
|
|
@@ -137,7 +109,7 @@ describe('devLogin route', function () {
|
|
|
137
109
|
case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Dev Default', email: ENV_EMAIL })];
|
|
138
110
|
case 1:
|
|
139
111
|
_a.sent();
|
|
140
|
-
return [4 /*yield*/, invokeDevLogin()];
|
|
112
|
+
return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)()];
|
|
141
113
|
case 2:
|
|
142
114
|
outcome = _a.sent();
|
|
143
115
|
expect(outcome.loggedInAs).toBe(ENV_EMAIL);
|
|
@@ -156,7 +128,7 @@ describe('devLogin route', function () {
|
|
|
156
128
|
case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Agent Two', email: 'agent2@test.local' })];
|
|
157
129
|
case 1:
|
|
158
130
|
_a.sent();
|
|
159
|
-
return [4 /*yield*/, invokeDevLogin({ email: 'agent2@test.local' })];
|
|
131
|
+
return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'agent2@test.local' })];
|
|
160
132
|
case 2:
|
|
161
133
|
outcome = _a.sent();
|
|
162
134
|
expect(outcome.loggedInAs).toBe('agent2@test.local');
|
|
@@ -175,7 +147,7 @@ describe('devLogin route', function () {
|
|
|
175
147
|
return [4 /*yield*/, getUserRow('agent3@test.local')];
|
|
176
148
|
case 1:
|
|
177
149
|
_a.apply(void 0, [_c.sent()]).toBeUndefined();
|
|
178
|
-
return [4 /*yield*/, invokeDevLogin({ email: 'agent3@test.local' })];
|
|
150
|
+
return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'agent3@test.local' })];
|
|
179
151
|
case 2:
|
|
180
152
|
outcome = _c.sent();
|
|
181
153
|
expect(outcome.loggedInAs).toBe('agent3@test.local');
|
|
@@ -200,7 +172,7 @@ describe('devLogin route', function () {
|
|
|
200
172
|
var outcome, _a;
|
|
201
173
|
return __generator(this, function (_b) {
|
|
202
174
|
switch (_b.label) {
|
|
203
|
-
case 0: return [4 /*yield*/, invokeDevLogin({ email: 'intruder@evil.example' })];
|
|
175
|
+
case 0: return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'intruder@evil.example' })];
|
|
204
176
|
case 1:
|
|
205
177
|
outcome = _b.sent();
|
|
206
178
|
expect(outcome.status).toBe(400);
|
|
@@ -221,7 +193,7 @@ describe('devLogin route', function () {
|
|
|
221
193
|
switch (_b.label) {
|
|
222
194
|
case 0:
|
|
223
195
|
malformed = 'brent shareproof-a@test.local';
|
|
224
|
-
return [4 /*yield*/, invokeDevLogin({ email: malformed })];
|
|
196
|
+
return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: malformed })];
|
|
225
197
|
case 1:
|
|
226
198
|
outcome = _b.sent();
|
|
227
199
|
expect(outcome.status).toBe(400);
|
|
@@ -242,7 +214,7 @@ describe('devLogin route', function () {
|
|
|
242
214
|
var outcome, _a;
|
|
243
215
|
return __generator(this, function (_b) {
|
|
244
216
|
switch (_b.label) {
|
|
245
|
-
case 0: return [4 /*yield*/, invokeDevLogin({ email: 'agent6+lane-a@test.local' })];
|
|
217
|
+
case 0: return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'agent6+lane-a@test.local' })];
|
|
246
218
|
case 1:
|
|
247
219
|
outcome = _b.sent();
|
|
248
220
|
expect(outcome.loggedInAs).toBe('agent6+lane-a@test.local');
|
|
@@ -262,7 +234,7 @@ describe('devLogin route', function () {
|
|
|
262
234
|
switch (_b.label) {
|
|
263
235
|
case 0:
|
|
264
236
|
delete process.env.DEVELOPMENT;
|
|
265
|
-
return [4 /*yield*/, invokeDevLogin({ email: 'agent4@test.local' })];
|
|
237
|
+
return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'agent4@test.local' })];
|
|
266
238
|
case 1:
|
|
267
239
|
outcome = _b.sent();
|
|
268
240
|
expect(outcome.status).toBe(404);
|
|
@@ -281,7 +253,7 @@ describe('devLogin route', function () {
|
|
|
281
253
|
switch (_b.label) {
|
|
282
254
|
case 0:
|
|
283
255
|
delete process.env.DEV_AUTO_LOGIN_EMAIL;
|
|
284
|
-
return [4 /*yield*/, invokeDevLogin({ email: 'agent5@test.local' })];
|
|
256
|
+
return [4 /*yield*/, (0, devLoginHarness_1.invokeDevLogin)({ email: 'agent5@test.local' })];
|
|
285
257
|
case 1:
|
|
286
258
|
outcome = _b.sent();
|
|
287
259
|
expect(outcome.status).toBe(404);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"DevLogin.test.js","sourceRoot":"","sources":["../../test/DevLogin.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAyC;AACzC,uEAAsE;AACtE,
|
|
1
|
+
{"version":3,"file":"DevLogin.test.js","sourceRoot":"","sources":["../../test/DevLogin.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAA8C;AAC9C,wCAAyC;AACzC,uEAAsE;AACtE,qDAAmD;AACnD,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;;;GAUG;AAEH,IAAM,SAAS,GAAG,gBAAgB,CAAC;AAEnC,IAAM,UAAU,GAAG,UAAO,KAAa;;gBAAK,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;gBAAjD,sBAAA,SAAiD,EAAA;;SAAA,CAAC;AAE9F,QAAQ,CAAC,gBAAgB,EAAE;IACzB,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;KACjE,CAAC;IAEF,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE;;;;wBACvF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAAnE,SAAmE,CAAC;oBAEpD,qBAAM,IAAA,gCAAc,GAAE,EAAA;;oBAAhC,OAAO,GAAG,SAAsB;oBAEtC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;oBACzF,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SACxC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE;;;;wBACnE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA3E,SAA2E,CAAC;oBAE5D,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE;;;;;oBAChG,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;oBAE9C,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACrD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAInB,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA/C,OAAO,GAAG,SAAqC;oBACrD,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC9B,MAAM,CAAC,OAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9D,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAI,+BAAc,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAA;;oBAAnE,kBAAO,SAA4D,EAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChF,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACnC,MAAM,CAAC,OAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;;;;SACpC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE;;;;wBAC/E,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAAlE,OAAO,GAAG,SAAwD;oBAExE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,uBAAuB,CAAC,EAAA;;oBAAhD,kBAAO,SAAyC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SACnE,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE;;;;;oBAI7E,SAAS,GAAG,+BAA+B,CAAC;oBAElC,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAApD,OAAO,GAAG,SAA0C;oBAE1D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;oBAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,qCAAqC;oBAClF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,SAAS,CAAC,EAAA;;oBAAlC,kBAAO,SAA2B,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SACrD,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE;;;;wBACtE,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,EAAA;;oBAArE,OAAO,GAAG,SAA2D;oBAE3E,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;oBAC5D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACnC,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,0BAA0B,CAAC,EAAA;;oBAAnD,kBAAO,SAA4C,EAAC,CAAC,WAAW,EAAE,CAAC;;;;SACpE,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE;;;;;oBACvD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBAEf,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE;;;;;oBAChE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBAExB,qBAAM,IAAA,gCAAc,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAA;;oBAA9D,OAAO,GAAG,SAAoD;oBAEpE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;oBAC3C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,mBAAmB,CAAC,EAAA;;oBAA5C,kBAAO,SAAqC,EAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC/D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"DevLoginBootstrapAdmin.test.d.ts","sourceRoot":"","sources":["../../test/DevLoginBootstrapAdmin.test.ts"],"names":[],"mappings":""}
|