@proteinjs/user-server 1.20.2 → 1.21.1

package/dist/test/SignupResendInvite.integration.test.js

@@ -0,0 +1,235 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var moment_1 = __importDefault(require("moment"));
+/**
+ * Re-sending an invite (`SignupService.resendInvite`), against the emulator — outcomes on the row
+ * and on the transport fake, never call counts alone:
+ *
+ *  - the token in the earlier email stops resolving, the fresh one resolves to the SAME invite;
+ *  - the row count for the address stays one, its expiry re-stamped from the TTL knob, its inviter kept;
+ *  - exactly one email goes out for the re-send, to the address, carrying the fresh signup link;
+ *  - an address with no standing invite is refused: nothing written, nothing sent;
+ *  - an address that already has an account is refused the same way (the invite was used).
+ *
+ * The email transport is stubbed at the module boundary (the SignupInvite.test.ts pattern) — SMTP
+ * is an external transport; the config fake echoes the signup path so the link can be asserted.
+ * The service door (`serviceMetadata.auth`) is pinned here too: re-send rides the 'users' permission
+ * exactly like send and revoke — the earlier gap that left invite minting public must not reopen.
+ */
+var sendEmail = jest.fn();
+jest.mock('@proteinjs/email-server', function () { return ({
+    EmailSender: jest.fn().mockImplementation(function () { return ({ sendEmail: sendEmail }); }),
+    getDefaultInviteEmailConfigFactory: function () { return ({
+        getConfig: function () { return ({
+            options: { subject: 'Your invite' },
+            getEmailContent: function (signupPathWithToken) { return ({
+                text: "Accept: /".concat(signupPathWithToken),
+                html: "<a href=\"/".concat(signupPathWithToken, "\">Accept</a>"),
+            }); },
+        }); },
+    }); },
+    getDefaultSignupConfirmationEmailConfigFactory: function () { return ({
+        getConfig: function () { return ({ getNewUserEmailContent: function () { return ({ text: 'welcome', html: '<p>welcome</p>' }); } }); },
+    }); },
+}); });
+var db_1 = require("@proteinjs/db");
+var reflection_1 = require("@proteinjs/reflection");
+var user_1 = require("@proteinjs/user");
+var Signup_1 = require("../src/services/Signup");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var TIMEOUT = 60000;
+/** Tolerance for the clock advancing between the stamp and the assertion. */
+var CLOCK_SKEW_TOLERANCE_SECONDS = 60;
+var inviteRows = function (email) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.Invite, { email: email })];
+        case 1: return [2 /*return*/, (_a.sent())];
+    }
+}); }); };
+/** The re-send's own transport call: the one addressed to `email` after the earlier `before` calls. */
+var emailsTo = function (email) {
+    return sendEmail.mock.calls.map(function (_a) {
+        var message = _a[0];
+        return message;
+    }).filter(function (message) { return message.to === email; });
+};
+describe('SignupService.resendInvite — against the emulator', function () {
+    var env = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+    var inviter;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, env.beforeAll()];
+                case 1:
+                    _a.sent();
+                    // The invite-mode factory the token lookup consults (`initializeSignup`) — seeded like the
+                    // environment seeds its own loadables (the suites load src, never the generated source
+                    // graph, so an unseeded lookup has no graph to walk); invite-optional, the library default.
+                    reflection_1.SourceRepository.get().objectCache['@proteinjs/user-server/DefaultInviteConfigFactory'] = [{ getConfig: function () { return ({ isInviteOnly: false }); } }];
+                    return [4 /*yield*/, env.createUser({ name: 'Inviter', email: 'inviter@example.com', roles: ['admin'] })];
+                case 2:
+                    inviter = _a.sent();
+                    env.actAs(inviter);
+                    return [2 /*return*/];
+            }
+        });
+    }); }, TIMEOUT);
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, env.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, TIMEOUT);
+    beforeEach(function () {
+        sendEmail.mockClear();
+    });
+    it('retires the earlier token, mints a fresh one on the SAME row, and emails the fresh link exactly once', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var email, sent, standing, earlierToken, earlierExpiry, resent, rows, refreshed, earlier, fresh, messages, resend;
+        var _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    email = 'guest@example.com';
+                    return [4 /*yield*/, new Signup_1.Signup().sendInvite(email)];
+                case 1:
+                    sent = _c.sent();
+                    expect(sent).toEqual({ sent: true });
+                    return [4 /*yield*/, inviteRows(email)];
+                case 2:
+                    standing = (_c.sent())[0];
+                    earlierToken = standing.token;
+                    earlierExpiry = (0, moment_1.default)(standing.tokenExpiresAt);
+                    expect(emailsTo(email)).toHaveLength(1);
+                    return [4 /*yield*/, new Signup_1.Signup().resendInvite('Guest@Example.com')];
+                case 3:
+                    resent = _c.sent();
+                    expect(resent).toEqual({ sent: true });
+                    return [4 /*yield*/, inviteRows(email)];
+                case 4:
+                    rows = _c.sent();
+                    expect(rows).toHaveLength(1);
+                    refreshed = rows[0];
+                    expect(refreshed.id).toBe(standing.id);
+                    expect(refreshed.token).not.toBe(earlierToken);
+                    expect((_a = refreshed.invitedBy) === null || _a === void 0 ? void 0 : _a._id).toBe(inviter.id);
+                    // The expiry is re-stamped from the knob (fresh window), never left at the earlier stamp.
+                    expect((0, moment_1.default)(refreshed.tokenExpiresAt).isSameOrAfter(earlierExpiry)).toBe(true);
+                    expect(Math.abs((0, moment_1.default)(refreshed.tokenExpiresAt).diff((0, moment_1.default)().add(Signup_1.INVITE_TOKEN_TTL_DAYS, 'days'), 'seconds'))).toBeLessThan(CLOCK_SKEW_TOLERANCE_SECONDS);
+                    return [4 /*yield*/, new Signup_1.Signup().initializeSignup(earlierToken)];
+                case 5:
+                    earlier = _c.sent();
+                    expect(earlier.isReady).toBe(false);
+                    expect(earlier.error).toMatch(/no longer valid/i);
+                    return [4 /*yield*/, new Signup_1.Signup().initializeSignup(refreshed.token)];
+                case 6:
+                    fresh = _c.sent();
+                    expect(fresh.isReady).toBe(true);
+                    expect((_b = fresh.invite) === null || _b === void 0 ? void 0 : _b.email).toBe(email);
+                    messages = emailsTo(email);
+                    expect(messages).toHaveLength(2);
+                    resend = messages[1];
+                    expect(resend.subject).toBe('Your invite');
+                    expect(resend.text).toContain("signup?token=".concat(refreshed.token));
+                    expect(resend.html).toContain("signup?token=".concat(refreshed.token));
+                    expect(resend.text).not.toContain(earlierToken);
+                    return [2 /*return*/];
+            }
+        });
+    }); }, TIMEOUT);
+    it('refuses an address with no standing invite — nothing written, nothing sent', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var email, response, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    email = 'nobody@example.com';
+                    return [4 /*yield*/, new Signup_1.Signup().resendInvite(email)];
+                case 1:
+                    response = _b.sent();
+                    expect(response.sent).toBe(false);
+                    expect(response.error).toMatch(/no invite/i);
+                    _a = expect;
+                    return [4 /*yield*/, inviteRows(email)];
+                case 2:
+                    _a.apply(void 0, [_b.sent()]).toHaveLength(0);
+                    expect(emailsTo(email)).toHaveLength(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); }, TIMEOUT);
+    it('refuses an address that already has an account — the invite was used', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var email, response;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    email = 'member@example.com';
+                    return [4 /*yield*/, env.createUser({ name: 'Member', email: email })];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, new Signup_1.Signup().resendInvite(email)];
+                case 2:
+                    response = _a.sent();
+                    expect(response.sent).toBe(false);
+                    expect(response.error).toMatch(/already exists/i);
+                    expect(emailsTo(email)).toHaveLength(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); }, TIMEOUT);
+    it('rides the users-permission door like send and revoke (never public)', function () {
+        var hasPermission = jest.spyOn(user_1.UserAuth, 'hasPermission');
+        try {
+            hasPermission.mockReturnValue(false);
+            expect(new Signup_1.Signup().serviceMetadata.auth.canAccess('resendInvite', ['x@example.com'])).toBe(false);
+            hasPermission.mockReturnValue(true);
+            expect(new Signup_1.Signup().serviceMetadata.auth.canAccess('resendInvite', ['x@example.com'])).toBe(true);
+            expect(hasPermission).toHaveBeenCalledWith(user_1.USER_PERMISSIONS.users);
+        }
+        finally {
+            hasPermission.mockRestore();
+        }
+    });
+});
+//# sourceMappingURL=SignupResendInvite.integration.test.js.map

package/dist/test/SignupResendInvite.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignupResendInvite.integration.test.js","sourceRoot":"","sources":["../../test/SignupResendInvite.integration.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAE5B;;;;;;;;;;;;;;GAcG;AAEH,IAAM,SAAS,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;AAC5B,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,cAAM,OAAA,CAAC;IAC1C,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,cAAM,OAAA,CAAC,EAAE,SAAS,WAAA,EAAE,CAAC,EAAf,CAAe,CAAC;IAChE,kCAAkC,EAAE,cAAM,OAAA,CAAC;QACzC,SAAS,EAAE,cAAM,OAAA,CAAC;YAChB,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE;YACnC,eAAe,EAAE,UAAC,mBAA2B,IAAK,OAAA,CAAC;gBACjD,IAAI,EAAE,mBAAY,mBAAmB,CAAE;gBACvC,IAAI,EAAE,qBAAa,mBAAmB,kBAAc;aACrD,CAAC,EAHgD,CAGhD;SACH,CAAC,EANe,CAMf;KACH,CAAC,EARwC,CAQxC;IACF,8CAA8C,EAAE,cAAM,OAAA,CAAC;QACrD,SAAS,EAAE,cAAM,OAAA,CAAC,EAAE,sBAAsB,EAAE,cAAM,OAAA,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAA7C,CAA6C,EAAE,CAAC,EAAjF,CAAiF;KACnG,CAAC,EAFoD,CAEpD;CACH,CAAC,EAdyC,CAczC,CAAC,CAAC;AAEJ,oCAA8C;AAC9C,oDAAyD;AACzD,wCAA6F;AAC7F,iDAAuE;AACvE,yEAAwE;AAExE,IAAM,OAAO,GAAG,KAAM,CAAC;AAEvB,6EAA6E;AAC7E,IAAM,4BAA4B,GAAG,EAAE,CAAC;AAExC,IAAM,UAAU,GAAG,UAAO,KAAa;;gBACpC,qBAAM,IAAA,kBAAa,GAAE,CAAC,KAAK,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;gBAAtD,sBAAA,CAAC,SAAqD,CAAa,EAAA;;SAAA,CAAC;AAEtE,uGAAuG;AACvG,IAAM,QAAQ,GAAG,UAAC,KAAa;IAC7B,OAAA,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAC,EAAS;YAAR,OAAO,QAAA;QAAM,OAAA,OAAO;IAAP,CAAO,CAAC,CAAC,MAAM,CAAC,UAAC,OAAO,IAAK,OAAA,OAAO,CAAC,EAAE,KAAK,KAAK,EAApB,CAAoB,CAAC;AAA1F,CAA0F,CAAC;AAE7F,QAAQ,CAAC,mDAAmD,EAAE;IAC5D,IAAM,GAAG,GAAG,IAAI,qDAAyB,EAAE,CAAC;IAC5C,IAAI,OAAa,CAAC;IAElB,SAAS,CAAC;;;wBACR,qBAAM,GAAG,CAAC,SAAS,EAAE,EAAA;;oBAArB,SAAqB,CAAC;oBACtB,2FAA2F;oBAC3F,uFAAuF;oBACvF,4FAA4F;oBAC3F,6BAAgB,CAAC,GAAG,EAA4D,CAAC,WAAW,CAC3F,mDAAmD,CACpD,GAAG,CAAC,EAAE,SAAS,EAAE,cAAM,OAAA,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAzB,CAAyB,EAAE,CAAC,CAAC;oBAC3C,qBAAM,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;oBAAnG,OAAO,GAAG,SAAyF,CAAC;oBACpG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;;;SACpB,EAAE,OAAO,CAAC,CAAC;IAEZ,QAAQ,CAAC;;;wBACP,qBAAM,GAAG,CAAC,QAAQ,EAAE,EAAA;;oBAApB,SAAoB,CAAC;;;;SACtB,EAAE,OAAO,CAAC,CAAC;IAEZ,UAAU,CAAC;QACT,SAAS,CAAC,SAAS,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CACA,sGAAsG,EACtG;;;;;;oBACQ,KAAK,GAAG,mBAAmB,CAAC;oBACrB,qBAAM,IAAI,eAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAA;;oBAA3C,IAAI,GAAG,SAAoC;oBACjD,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAClB,qBAAM,UAAU,CAAC,KAAK,CAAC,EAAA;;oBAAnC,QAAQ,GAAI,CAAA,SAAuB,CAAA,GAA3B;oBACT,YAAY,GAAG,QAAQ,CAAC,KAAe,CAAC;oBACxC,aAAa,GAAG,IAAA,gBAAM,EAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;oBACtD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAEzB,qBAAM,IAAI,eAAM,EAAE,CAAC,YAAY,CAAC,mBAAmB,CAAC,EAAA;;oBAA7D,MAAM,GAAG,SAAoD;oBACnE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAG1B,qBAAM,UAAU,CAAC,KAAK,CAAC,EAAA;;oBAA9B,IAAI,GAAG,SAAuB;oBACpC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBACtB,SAAS,GAAI,IAAI,GAAR,CAAS;oBACzB,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACvC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAC/C,MAAM,CAAC,MAAA,SAAS,CAAC,SAAS,0CAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAClD,0FAA0F;oBAC1F,MAAM,CAAC,IAAA,gBAAM,EAAC,SAAS,CAAC,cAAc,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjF,MAAM,CACJ,IAAI,CAAC,GAAG,CAAC,IAAA,gBAAM,EAAC,SAAS,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,8BAAqB,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CACxG,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC;oBAG7B,qBAAM,IAAI,eAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAA;;oBAA3D,OAAO,GAAG,SAAiD;oBACjE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACpC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;oBACpC,qBAAM,IAAI,eAAM,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAe,CAAC,EAAA;;oBAAtE,KAAK,GAAG,SAA8D;oBAC5E,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjC,MAAM,CAAC,MAAA,KAAK,CAAC,MAAM,0CAAE,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAGlC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;oBAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAgB,SAAS,CAAC,KAAK,CAAE,CAAC,CAAC;oBACjE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAgB,SAAS,CAAC,KAAK,CAAE,CAAC,CAAC;oBACjE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;;;;SACjD,EACD,OAAO,CACR,CAAC;IAEF,EAAE,CACA,4EAA4E,EAC5E;;;;;oBACQ,KAAK,GAAG,oBAAoB,CAAC;oBAClB,qBAAM,IAAI,eAAM,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;oBAAjD,QAAQ,GAAG,SAAsC;oBACvD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAClC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;oBAC7C,KAAA,MAAM,CAAA;oBAAC,qBAAM,UAAU,CAAC,KAAK,CAAC,EAAA;;oBAA9B,kBAAO,SAAuB,EAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAChD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SACzC,EACD,OAAO,CACR,CAAC;IAEF,EAAE,CACA,sEAAsE,EACtE;;;;;oBACQ,KAAK,GAAG,oBAAoB,CAAC;oBACnC,qBAAM,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAA/C,SAA+C,CAAC;oBAC/B,qBAAM,IAAI,eAAM,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAA;;oBAAjD,QAAQ,GAAG,SAAsC;oBACvD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAClC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;oBAClD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;;;;SACzC,EACD,OAAO,CACR,CAAC;IAEF,EAAE,CAAC,qEAAqE,EAAE;QACxE,IAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,eAAQ,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI;YACF,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,eAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnG,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,eAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClG,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,uBAAgB,CAAC,KAAK,CAAC,CAAC;SACpE;gBAAS;YACR,aAAa,CAAC,WAAW,EAAE,CAAC;SAC7B;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/ValidateResetToken.test.js

@@ -43,6 +43,7 @@ var moment_1 = __importDefault(require("moment"));
 var db_1 = require("@proteinjs/db");
 var user_1 = require("@proteinjs/user");
 var validateResetPasswordToken_1 = require("../src/routes/validateResetPasswordToken");
+var PasswordResetToken_1 = require("../src/authentication/PasswordResetToken");
 var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
 var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
 var invokeValidate = function (query) { return __awaiter(void 0, void 0, void 0, function () {
@@ -67,6 +68,7 @@ var invokeValidate = function (query) { return __awaiter(void 0, void 0, void 0,
         }
     });
 }); };
+var mintToken = function () { return new PasswordResetToken_1.PasswordResetToken().mint(); };
 var armResetToken = function (email, token, expiration) { return __awaiter(void 0, void 0, void 0, function () {
     var user;
     return __generator(this, function (_a) {
@@ -107,13 +109,15 @@ describe('validateResetPasswordToken route', function () {
         });
     }); });
     it('a valid token resolves isValid WITH the account email (the reset form identifier)', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var outcome;
+        var token, outcome;
         return __generator(this, function (_a) {
             switch (_a.label) {
-                case 0: return [4 /*yield*/, armResetToken('reset-valid@test.local', 'tok-valid-1', (0, moment_1.default)().add(1, 'hour'))];
+                case 0:
+                    token = mintToken();
+                    return [4 /*yield*/, armResetToken('reset-valid@test.local', token, (0, moment_1.default)().add(1, 'hour'))];
                 case 1:
                     _a.sent();
-                    return [4 /*yield*/, invokeValidate({ token: 'tok-valid-1' })];
+                    return [4 /*yield*/, invokeValidate({ token: token })];
                 case 2:
                     outcome = _a.sent();
                     expect(outcome.status).toBe(200);
@@ -123,13 +127,15 @@ describe('validateResetPasswordToken route', function () {
         });
     }); });
     it('an expired token resolves invalid and leaks no email', function () { return __awaiter(void 0, void 0, void 0, function () {
-        var outcome;
+        var token, outcome;
         return __generator(this, function (_a) {
             switch (_a.label) {
-                case 0: return [4 /*yield*/, armResetToken('reset-expired@test.local', 'tok-expired-1', (0, moment_1.default)().subtract(1, 'minute'))];
+                case 0:
+                    token = mintToken();
+                    return [4 /*yield*/, armResetToken('reset-expired@test.local', token, (0, moment_1.default)().subtract(1, 'minute'))];
                 case 1:
                     _a.sent();
-                    return [4 /*yield*/, invokeValidate({ token: 'tok-expired-1' })];
+                    return [4 /*yield*/, invokeValidate({ token: token })];
                 case 2:
                     outcome = _a.sent();
                     expect(outcome.status).toBe(200);
@@ -143,7 +149,7 @@ describe('validateResetPasswordToken route', function () {
         var outcome;
         return __generator(this, function (_a) {
             switch (_a.label) {
-                case 0: return [4 /*yield*/, invokeValidate({ token: 'tok-never-issued' })];
+                case 0: return [4 /*yield*/, invokeValidate({ token: mintToken() })];
                 case 1:
                     outcome = _a.sent();
                     expect(outcome.status).toBe(200);
@@ -153,6 +159,23 @@ describe('validateResetPasswordToken route', function () {
             }
         });
     }); });
+    it.each([
+        ['a string of another shape', 'tok-never-issued'],
+        ['a parsed array', ['a', 'b']],
+        ['a parsed object', { passwordResetToken: null }],
+    ])('%s resolves invalid without a lookup and leaks no email', function (_label, token) { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, invokeValidate({ token: token })];
+                case 1:
+                    outcome = _a.sent();
+                    expect(outcome.status).toBe(200);
+                    expect(outcome.body).toEqual({ isValid: false, message: 'Invalid token' });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
     it('a missing token is a 400', function () { return __awaiter(void 0, void 0, void 0, function () {
         var outcome;
         return __generator(this, function (_a) {

package/dist/test/ValidateResetToken.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"ValidateResetToken.test.js","sourceRoot":"","sources":["../../test/ValidateResetToken.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAC5B,oCAA8C;AAC9C,wCAAyC;AACzC,uFAAsF;AACtF,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAahD,IAAM,cAAc,GAAG,UAAO,KAA8B;;;;;gBACpD,OAAO,GAAiB,EAAE,CAAC;gBAC3B,QAAQ,GAAG;oBACf,MAAM,YAAC,IAAY;wBACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,YAAC,IAAc;wBACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBACtB,CAAC;iBACF,CAAC;gBACF,qBAAM,uDAA0B,CAAC,SAAS,CAAC,EAAE,KAAK,OAAA,EAAW,EAAE,QAAiB,CAAC,EAAA;;gBAAjF,SAAiF,CAAC;gBAClF,sBAAO,OAAO,EAAC;;;KAChB,CAAC;AAEF,IAAM,aAAa,GAAG,UAAO,KAAa,EAAE,KAAa,EAAE,UAAyB;;;;oBACrE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gBAA9D,IAAI,GAAG,SAAuD;gBACpE,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;wBACxC,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,kBAAkB,EAAE,KAAK;wBACzB,4BAA4B,EAAE,UAAU;qBACzC,CAAC,EAAA;;gBAJF,SAIE,CAAC;;;;KACJ,CAAC;AAEF,QAAQ,CAAC,kCAAkC,EAAE;IAC3C,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE;;;;wBACtF,qBAAM,aAAa,CAAC,wBAAwB,EAAE,aAAa,EAAE,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAA;;oBAArF,SAAqF,CAAC;oBAEtE,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAA;;oBAAxD,OAAO,GAAG,SAA8C;oBAE9D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;;;;SAClF,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE;;;;wBACzD,qBAAM,aAAa,CAAC,0BAA0B,EAAE,eAAe,EAAE,IAAA,gBAAM,GAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAA;;oBAAhG,SAAgG,CAAC;oBAEjF,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAA;;oBAA1D,OAAO,GAAG,SAAgD;oBAEhE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC5C,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE;;;;wBACzC,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAA;;oBAA7D,OAAO,GAAG,SAAmD;oBAEnE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC5C,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE;;;;wBACb,qBAAM,cAAc,CAAC,EAAE,CAAC,EAAA;;oBAAlC,OAAO,GAAG,SAAwB;oBAExC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;;;SAC1C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"ValidateResetToken.test.js","sourceRoot":"","sources":["../../test/ValidateResetToken.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,kDAA4B;AAC5B,oCAA8C;AAC9C,wCAAyC;AACzC,uFAAsF;AACtF,+EAA8E;AAC9E,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAehD,IAAM,cAAc,GAAG,UAAO,KAA8B;;;;;gBACpD,OAAO,GAAiB,EAAE,CAAC;gBAC3B,QAAQ,GAAG;oBACf,MAAM,YAAC,IAAY;wBACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,YAAC,IAAc;wBACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;oBACtB,CAAC;iBACF,CAAC;gBACF,qBAAM,uDAA0B,CAAC,SAAS,CAAC,EAAE,KAAK,OAAA,EAAW,EAAE,QAAiB,CAAC,EAAA;;gBAAjF,SAAiF,CAAC;gBAClF,sBAAO,OAAO,EAAC;;;KAChB,CAAC;AAEF,IAAM,SAAS,GAAG,cAAM,OAAA,IAAI,uCAAkB,EAAE,CAAC,IAAI,EAAE,EAA/B,CAA+B,CAAC;AAExD,IAAM,aAAa,GAAG,UAAO,KAAa,EAAE,KAAa,EAAE,UAAyB;;;;oBACrE,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;gBAA9D,IAAI,GAAG,SAAuD;gBACpE,qBAAM,IAAA,kBAAa,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;wBACxC,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,kBAAkB,EAAE,KAAK;wBACzB,4BAA4B,EAAE,UAAU;qBACzC,CAAC,EAAA;;gBAJF,SAIE,CAAC;;;;KACJ,CAAC;AAEF,QAAQ,CAAC,kCAAkC,EAAE;IAC3C,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;;;;SAC3B,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE;;;;;oBAChF,KAAK,GAAG,SAAS,EAAE,CAAC;oBAC1B,qBAAM,aAAa,CAAC,wBAAwB,EAAE,KAAK,EAAE,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAA;;oBAA7E,SAA6E,CAAC;oBAE9D,qBAAM,cAAc,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAAzC,OAAO,GAAG,SAA+B;oBAE/C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;;;;SAClF,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE;;;;;oBACnD,KAAK,GAAG,SAAS,EAAE,CAAC;oBAC1B,qBAAM,aAAa,CAAC,0BAA0B,EAAE,KAAK,EAAE,IAAA,gBAAM,GAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAA;;oBAAtF,SAAsF,CAAC;oBAEvE,qBAAM,cAAc,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAAzC,OAAO,GAAG,SAA+B;oBAE/C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC5C,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE;;;;wBACzC,qBAAM,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,EAAA;;oBAAtD,OAAO,GAAG,SAA4C;oBAE5D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;;;;SAC5C,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,2BAA2B,EAAE,kBAAkB,CAAC;QACjD,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC,CAAC,yDAAyD,EAAE,UAAO,MAAM,EAAE,KAAK;;;;wBAChE,qBAAM,cAAc,CAAC,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;oBAAzC,OAAO,GAAG,SAA+B;oBAE/C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;;;;SAC5E,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE;;;;wBACb,qBAAM,cAAc,CAAC,EAAE,CAAC,EAAA;;oBAAlC,OAAO,GAAG,SAAwB;oBAExC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;;;SAC1C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}