@proteinjs/user-server 1.21.0 → 1.22.0

package/dist/test/DevMail.test.js

@@ -0,0 +1,250 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var email_server_1 = require("@proteinjs/email-server");
+var devMail_1 = require("../src/routes/devMail");
+/**
+ * `GET /dev/mail` and `GET /dev/mail/<id>` — the dev-only door onto the mail sink, gated exactly
+ * like `/dev/login`: `DEVELOPMENT` AND `DEV_AUTO_LOGIN_EMAIL`, else 404 as if unregistered. With
+ * the gates open, the last invite a development sender recorded is readable — its link off the
+ * list, its rendered html off the message — so a lane never needs a real inbox. No database:
+ * the sink is the process's own ring.
+ */
+var ENV_EMAIL = 'dev@test.local';
+var invoke = function (route, _a) {
+    var _b = _a === void 0 ? {} : _a, query = _b.query, params = _b.params;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, response;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    outcome = {};
+                    response = {
+                        status: function (code) {
+                            outcome.status = code;
+                            return this;
+                        },
+                        type: function (kind) {
+                            outcome.type = kind;
+                            return this;
+                        },
+                        send: function (body) {
+                            outcome.body = body;
+                        },
+                        json: function (body) {
+                            outcome.body = body;
+                        },
+                    };
+                    return [4 /*yield*/, route.onRequest({ query: query !== null && query !== void 0 ? query : {}, params: params !== null && params !== void 0 ? params : {} }, response)];
+                case 1:
+                    _c.sent();
+                    return [2 /*return*/, outcome];
+            }
+        });
+    });
+};
+var INVITE_LINK = 'http://localhost:7985/auth/signup?token=abc123';
+var INVITE_HTML = "<html><body><p>You are invited.</p><a href=\"".concat(INVITE_LINK, "\">Accept</a></body></html>");
+/** The product's path onto the sink: a development sender with a real-looking SMTP config, no opt-in. */
+var sendInviteThroughSender = function (to) { return __awaiter(void 0, void 0, void 0, function () {
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, new email_server_1.EmailSender({
+                    host: 'smtp.test.local',
+                    port: 465,
+                    secure: true,
+                    auth: { user: 'mailbox@test.local', pass: 'unused' },
+                    from: '"Example" <hi@example.com>',
+                }).sendEmail({ to: to, subject: "You're invited", text: "Accept your invite: ".concat(INVITE_LINK), html: INVITE_HTML })];
+            case 1:
+                _a.sent();
+                return [2 /*return*/];
+        }
+    });
+}); };
+describe('devMail routes', function () {
+    var originalEnv = {
+        DEVELOPMENT: process.env.DEVELOPMENT,
+        DEV_AUTO_LOGIN_EMAIL: process.env.DEV_AUTO_LOGIN_EMAIL,
+        EMAIL_TRANSPORT: process.env.EMAIL_TRANSPORT,
+        EMAIL_ALLOW_REAL_SEND: process.env.EMAIL_ALLOW_REAL_SEND,
+    };
+    beforeEach(function () {
+        process.env.DEVELOPMENT = 'true';
+        process.env.DEV_AUTO_LOGIN_EMAIL = ENV_EMAIL;
+        delete process.env.EMAIL_TRANSPORT;
+        delete process.env.EMAIL_ALLOW_REAL_SEND;
+        email_server_1.MailSink.get().clear();
+    });
+    afterEach(function () {
+        for (var _i = 0, _a = Object.entries(originalEnv); _i < _a.length; _i++) {
+            var _b = _a[_i], key = _b[0], value = _b[1];
+            if (value === undefined) {
+                delete process.env[key];
+            }
+            else {
+                process.env[key] = value;
+            }
+        }
+    });
+    it("lists the last sent messages newest first — the invite's recipient, subject, first link and timestamp — and the message renders its html", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var list, messages, message;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, sendInviteThroughSender('earlier@test.local')];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, sendInviteThroughSender('lane-after@test.local')];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, invoke(devMail_1.devMail)];
+                case 3:
+                    list = _a.sent();
+                    expect(list.status).toBe(200);
+                    messages = list.body.messages;
+                    expect(messages).toHaveLength(2);
+                    expect(messages[0]).toMatchObject({
+                        to: ['lane-after@test.local'],
+                        subject: "You're invited",
+                        link: INVITE_LINK,
+                        from: 'hi@example.com',
+                        refused: true,
+                    });
+                    expect(typeof messages[0].id).toBe('string');
+                    expect(Date.parse(String(messages[0].at))).not.toBeNaN();
+                    expect(messages[0].url).toBe("/dev/mail/".concat(messages[0].id));
+                    expect(messages[1].to).toEqual(['earlier@test.local']);
+                    return [4 /*yield*/, invoke(devMail_1.devMailMessage, { params: { id: String(messages[0].id) } })];
+                case 4:
+                    message = _a.sent();
+                    expect(message.status).toBe(200);
+                    expect(message.type).toBe('html');
+                    expect(message.body).toBe(INVITE_HTML);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('?n= bounds the list; a text-only message renders as text; an unknown id is 404', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var one, all, messages, plain, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.EMAIL_TRANSPORT = 'sink';
+                    return [4 /*yield*/, new email_server_1.EmailSender({ host: 'h', port: 465, secure: true, from: '"Example" <hi@example.com>' }).sendEmail({
+                            to: 'a@test.local',
+                            subject: 'Plain',
+                            text: 'just text',
+                        })];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, sendInviteThroughSender('b@test.local')];
+                case 2:
+                    _b.sent();
+                    return [4 /*yield*/, invoke(devMail_1.devMail, { query: { n: '1' } })];
+                case 3:
+                    one = _b.sent();
+                    expect(one.body.messages).toHaveLength(1);
+                    return [4 /*yield*/, invoke(devMail_1.devMail, { query: { n: 'garbage' } })];
+                case 4:
+                    all = _b.sent();
+                    messages = all.body.messages;
+                    expect(messages.map(function (m) { return m.subject; })).toEqual(["You're invited", 'Plain']);
+                    expect(messages[1].refused).toBe(false);
+                    return [4 /*yield*/, invoke(devMail_1.devMailMessage, { params: { id: messages[1].id } })];
+                case 5:
+                    plain = _b.sent();
+                    expect(plain.status).toBe(200);
+                    expect(plain.type).toBe('text');
+                    expect(plain.body).toBe('just text');
+                    _a = expect;
+                    return [4 /*yield*/, invoke(devMail_1.devMailMessage, { params: { id: 'nope' } })];
+                case 6:
+                    _a.apply(void 0, [(_b.sent()).status]).toBe(404);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('DEVELOPMENT unset → 404 on both paths, even with messages in the sink', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var record, _a, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, sendInviteThroughSender('lane@test.local')];
+                case 1:
+                    _c.sent();
+                    record = email_server_1.MailSink.get().list()[0];
+                    delete process.env.DEVELOPMENT;
+                    _a = expect;
+                    return [4 /*yield*/, invoke(devMail_1.devMail)];
+                case 2:
+                    _a.apply(void 0, [(_c.sent()).status]).toBe(404);
+                    _b = expect;
+                    return [4 /*yield*/, invoke(devMail_1.devMailMessage, { params: { id: record.id } })];
+                case 3:
+                    _b.apply(void 0, [(_c.sent()).status]).toBe(404);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('DEV_AUTO_LOGIN_EMAIL unset (or blank) → 404 on both paths', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var record, _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0: return [4 /*yield*/, sendInviteThroughSender('lane@test.local')];
+                case 1:
+                    _d.sent();
+                    record = email_server_1.MailSink.get().list()[0];
+                    delete process.env.DEV_AUTO_LOGIN_EMAIL;
+                    _a = expect;
+                    return [4 /*yield*/, invoke(devMail_1.devMail)];
+                case 2:
+                    _a.apply(void 0, [(_d.sent()).status]).toBe(404);
+                    _b = expect;
+                    return [4 /*yield*/, invoke(devMail_1.devMailMessage, { params: { id: record.id } })];
+                case 3:
+                    _b.apply(void 0, [(_d.sent()).status]).toBe(404);
+                    process.env.DEV_AUTO_LOGIN_EMAIL = '   ';
+                    _c = expect;
+                    return [4 /*yield*/, invoke(devMail_1.devMail)];
+                case 4:
+                    _c.apply(void 0, [(_d.sent()).status]).toBe(404);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=DevMail.test.js.map

package/dist/test/DevMail.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DevMail.test.js","sourceRoot":"","sources":["../../test/DevMail.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wDAAgE;AAChE,iDAAgE;AAEhE;;;;;;GAMG;AAEH,IAAM,SAAS,GAAG,gBAAgB,CAAC;AAInC,IAAM,MAAM,GAAG,UACb,KAAqB,EACrB,EAA4F;QAA5F,qBAA0F,EAAE,KAAA,EAA1F,KAAK,WAAA,EAAE,MAAM,YAAA;;;;;;oBAET,OAAO,GAAY,EAAE,CAAC;oBACtB,QAAQ,GAAG;wBACf,MAAM,YAAC,IAAY;4BACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;4BACtB,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,IAAI,YAAC,IAAY;4BACf,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;4BACpB,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,IAAI,YAAC,IAAc;4BACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;wBACtB,CAAC;wBACD,IAAI,YAAC,IAAa;4BAChB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;wBACtB,CAAC;qBACF,CAAC;oBACF,qBAAM,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,EAAE,MAAM,EAAE,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,EAAW,EAAE,QAAiB,CAAC,EAAA;;oBAA/F,SAA+F,CAAC;oBAChG,sBAAO,OAAO,EAAC;;;;CAChB,CAAC;AAEF,IAAM,WAAW,GAAG,gDAAgD,CAAC;AACrE,IAAM,WAAW,GAAG,uDAA+C,WAAW,gCAA4B,CAAC;AAE3G,yGAAyG;AACzG,IAAM,uBAAuB,GAAG,UAAO,EAAU;;;oBAC/C,qBAAM,IAAI,0BAAW,CAAC;oBACpB,IAAI,EAAE,iBAAiB;oBACvB,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,IAAI;oBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACpD,IAAI,EAAE,4BAA4B;iBACnC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAA,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,8BAAuB,WAAW,CAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAA;;gBAN9G,SAM8G,CAAC;;;;KAChH,CAAC;AAEF,QAAQ,CAAC,gBAAgB,EAAE;IACzB,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACtD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5C,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;KACzD,CAAC;IAEF,UAAU,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACzC,uBAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0IAA0I,EAAE;;;;wBAC7I,qBAAM,uBAAuB,CAAC,oBAAoB,CAAC,EAAA;;oBAAnD,SAAmD,CAAC;oBACpD,qBAAM,uBAAuB,CAAC,uBAAuB,CAAC,EAAA;;oBAAtD,SAAsD,CAAC;oBAE1C,qBAAM,MAAM,CAAC,iBAAO,CAAC,EAAA;;oBAA5B,IAAI,GAAG,SAAqB;oBAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACtB,QAAQ,GAAK,IAAI,CAAC,IAAoD,SAA9D,CAA+D;oBAC/E,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBACjC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;wBAChC,EAAE,EAAE,CAAC,uBAAuB,CAAC;wBAC7B,OAAO,EAAE,gBAAgB;wBACzB,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,gBAAgB;wBACtB,OAAO,EAAE,IAAI;qBACd,CAAC,CAAC;oBACH,MAAM,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;oBACzD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAa,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC;oBAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;oBAEvC,qBAAM,MAAM,CAAC,wBAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAlF,OAAO,GAAG,SAAwE;oBACxF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAClC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;;;;SACxC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE;;;;;oBACnF,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC;oBACrC,qBAAM,IAAI,0BAAW,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC,SAAS,CAAC;4BAC1G,EAAE,EAAE,cAAc;4BAClB,OAAO,EAAE,OAAO;4BAChB,IAAI,EAAE,WAAW;yBAClB,CAAC,EAAA;;oBAJF,SAIE,CAAC;oBACH,qBAAM,uBAAuB,CAAC,cAAc,CAAC,EAAA;;oBAA7C,SAA6C,CAAC;oBAElC,qBAAM,MAAM,CAAC,iBAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,EAAA;;oBAAlD,GAAG,GAAG,SAA4C;oBACxD,MAAM,CAAE,GAAG,CAAC,IAAgC,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC3D,qBAAM,MAAM,CAAC,iBAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,EAAA;;oBAAxD,GAAG,GAAG,SAAkD;oBACtD,QAAQ,GAAK,GAAG,CAAC,IAA8E,SAAvF,CAAwF;oBACxG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,OAAO,EAAT,CAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;oBAC5E,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAE1B,qBAAM,MAAM,CAAC,wBAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAA;;oBAAxE,KAAK,GAAG,SAAgE;oBAC9E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC/B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAChC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBAErC,KAAA,MAAM,CAAA;oBAAE,qBAAM,MAAM,CAAC,wBAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAA;;oBAAhE,kBAAO,CAAC,SAAwD,CAAC,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SACrF,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE;;;;wBAC1E,qBAAM,uBAAuB,CAAC,iBAAiB,CAAC,EAAA;;oBAAhD,SAAgD,CAAC;oBAC1C,MAAM,GAAI,uBAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAzB,CAA0B;oBACvC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBAE/B,KAAA,MAAM,CAAA;oBAAE,qBAAM,MAAM,CAAC,iBAAO,CAAC,EAAA;;oBAA7B,kBAAO,CAAC,SAAqB,CAAC,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjD,KAAA,MAAM,CAAA;oBAAE,qBAAM,MAAM,CAAC,wBAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,EAAA;;oBAAnE,kBAAO,CAAC,SAA2D,CAAC,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SACxF,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE;;;;wBAC9D,qBAAM,uBAAuB,CAAC,iBAAiB,CAAC,EAAA;;oBAAhD,SAAgD,CAAC;oBAC1C,MAAM,GAAI,uBAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAzB,CAA0B;oBAEvC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;oBACxC,KAAA,MAAM,CAAA;oBAAE,qBAAM,MAAM,CAAC,iBAAO,CAAC,EAAA;;oBAA7B,kBAAO,CAAC,SAAqB,CAAC,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACjD,KAAA,MAAM,CAAA;oBAAE,qBAAM,MAAM,CAAC,wBAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,EAAA;;oBAAnE,kBAAO,CAAC,SAA2D,CAAC,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAEvF,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,KAAK,CAAC;oBACzC,KAAA,MAAM,CAAA;oBAAE,qBAAM,MAAM,CAAC,iBAAO,CAAC,EAAA;;oBAA7B,kBAAO,CAAC,SAAqB,CAAC,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;SAClD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/ExecutePasswordReset.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ExecutePasswordReset.test.d.ts.map

package/dist/test/ExecutePasswordReset.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExecutePasswordReset.test.d.ts","sourceRoot":"","sources":["../../test/ExecutePasswordReset.test.ts"],"names":[],"mappings":""}

package/dist/test/ExecutePasswordReset.test.js

@@ -0,0 +1,394 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var moment_1 = __importDefault(require("moment"));
+var db_1 = require("@proteinjs/db");
+var logger_1 = require("@proteinjs/logger");
+var user_1 = require("@proteinjs/user");
+var executePasswordReset_1 = require("../src/routes/executePasswordReset");
+var PasswordHasher_1 = require("../src/authentication/PasswordHasher");
+var PasswordResetToken_1 = require("../src/authentication/PasswordResetToken");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+var invokeExecute = function (body) { return __awaiter(void 0, void 0, void 0, function () {
+    var outcome, response;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                outcome = { status: 200 };
+                response = {
+                    status: function (code) {
+                        outcome.status = code;
+                        return this;
+                    },
+                    send: function (body) {
+                        outcome.body = body;
+                    },
+                };
+                return [4 /*yield*/, executePasswordReset_1.executePasswordReset.onRequest({ body: body }, response)];
+            case 1:
+                _a.sent();
+                return [2 /*return*/, outcome];
+        }
+    });
+}); };
+var mintToken = function () { return new PasswordResetToken_1.PasswordResetToken().mint(); };
+var armResetToken = function (email, token, expiration) { return __awaiter(void 0, void 0, void 0, function () {
+    var user;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: email })];
+            case 1:
+                user = _a.sent();
+                return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
+                        id: user.id,
+                        passwordResetToken: token,
+                        passwordResetTokenExpiration: expiration,
+                    })];
+            case 2:
+                _a.sent();
+                return [2 /*return*/, user];
+        }
+    });
+}); };
+var userRow = function (id) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { id: id })];
+        case 1: return [2 /*return*/, _a.sent()];
+    }
+}); }); };
+/** Every password in the table, by email — the whole-table outcome a refused request must leave untouched. */
+var passwordsByEmail = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var byEmail, _i, _a, user;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                byEmail = {};
+                _i = 0;
+                return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.User, {})];
+            case 1:
+                _a = _b.sent();
+                _b.label = 2;
+            case 2:
+                if (!(_i < _a.length)) return [3 /*break*/, 4];
+                user = _a[_i];
+                byEmail[user.email] = user.password;
+                _b.label = 3;
+            case 3:
+                _i++;
+                return [3 /*break*/, 2];
+            case 4: return [2 /*return*/, byEmail];
+        }
+    });
+}); };
+describe('executePasswordReset route', function () {
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    // No pending reset — the account a `null` token's `IS NULL` filter would match.
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Idle User', email: 'reset-idle@test.local' })];
+                case 2:
+                    // No pending reset — the account a `null` token's `IS NULL` filter would match.
+                    _a.sent();
+                    // An emptied token column — the account an empty token would match.
+                    return [4 /*yield*/, armResetToken('reset-emptied@test.local', '', (0, moment_1.default)().add(1, 'hour'))];
+                case 3:
+                    // An emptied token column — the account an empty token would match.
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    describe('a request without a well-formed token is refused before any lookup', function () {
+        it.each([
+            ['absent', {}],
+            ['null', { token: null }],
+            ['empty', { token: '' }],
+            ['not a token string', { token: 'tok-valid-1' }],
+            ['a number', { token: 123 }],
+            ['an array', { token: ['a', 'b'] }],
+            ['an object', { token: { passwordResetToken: null } }],
+        ])('%s: 400, and no password in the table changes', function (_label, tokenField) { return __awaiter(void 0, void 0, void 0, function () {
+            var before, outcome, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, passwordsByEmail()];
+                    case 1:
+                        before = _b.sent();
+                        return [4 /*yield*/, invokeExecute(__assign(__assign({}, tokenField), { newPassword: 'hijacked' }))];
+                    case 2:
+                        outcome = _b.sent();
+                        expect(outcome.status).toBe(400);
+                        expect(outcome.body).toEqual({ error: 'Invalid or expired reset token' });
+                        _a = expect;
+                        return [4 /*yield*/, passwordsByEmail()];
+                    case 3:
+                        _a.apply(void 0, [_b.sent()]).toEqual(before);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    it('a live token resets the password once: the row verifies it, the token clears, a re-presentation is refused', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var token, user, first, afterFirst, second, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    token = mintToken();
+                    return [4 /*yield*/, armResetToken('reset-live@test.local', token, (0, moment_1.default)().add(1, 'hour'))];
+                case 1:
+                    user = _b.sent();
+                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'first new password' })];
+                case 2:
+                    first = _b.sent();
+                    expect(first.status).toBe(200);
+                    expect(first.body).toEqual({ message: 'Password has been successfully reset' });
+                    return [4 /*yield*/, userRow(user.id)];
+                case 3:
+                    afterFirst = _b.sent();
+                    return [4 /*yield*/, expect(new PasswordHasher_1.PasswordHasher().verify(afterFirst.password, 'first new password')).resolves.toBe(true)];
+                case 4:
+                    _b.sent();
+                    expect(afterFirst.passwordResetToken).toBeNull();
+                    expect(afterFirst.passwordResetTokenExpiration).toBeNull();
+                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'second new password' })];
+                case 5:
+                    second = _b.sent();
+                    expect(second.status).toBe(400);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(user.id)];
+                case 6:
+                    _a.apply(void 0, [(_b.sent()).password]).toBe(afterFirst.password);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an expired token is refused and changes nothing', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var token, user, before, outcome, row;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    token = mintToken();
+                    return [4 /*yield*/, armResetToken('reset-expired@test.local', token, (0, moment_1.default)().subtract(1, 'minute'))];
+                case 1:
+                    user = _a.sent();
+                    return [4 /*yield*/, userRow(user.id)];
+                case 2:
+                    before = (_a.sent()).password;
+                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'hijacked' })];
+                case 3:
+                    outcome = _a.sent();
+                    expect(outcome.status).toBe(400);
+                    expect(outcome.body).toEqual({ error: 'Reset token has expired' });
+                    return [4 /*yield*/, userRow(user.id)];
+                case 4:
+                    row = _a.sent();
+                    expect(row.password).toBe(before);
+                    expect(row.passwordResetToken).toBe(token);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a token whose row carries no expiry is refused — never live by omission', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var token, user, before, outcome, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    token = mintToken();
+                    return [4 /*yield*/, armResetToken('reset-no-expiry@test.local', token, null)];
+                case 1:
+                    user = _b.sent();
+                    return [4 /*yield*/, userRow(user.id)];
+                case 2:
+                    before = (_b.sent()).password;
+                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'hijacked' })];
+                case 3:
+                    outcome = _b.sent();
+                    expect(outcome.status).toBe(400);
+                    _a = expect;
+                    return [4 /*yield*/, userRow(user.id)];
+                case 4:
+                    _a.apply(void 0, [(_b.sent()).password]).toBe(before);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a blank new password is refused without consuming the token', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var token, user, before, _i, _a, newPassword, outcome, row;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    token = mintToken();
+                    return [4 /*yield*/, armResetToken('reset-blank@test.local', token, (0, moment_1.default)().add(1, 'hour'))];
+                case 1:
+                    user = _b.sent();
+                    return [4 /*yield*/, userRow(user.id)];
+                case 2:
+                    before = (_b.sent()).password;
+                    _i = 0, _a = ['', undefined, 42];
+                    _b.label = 3;
+                case 3:
+                    if (!(_i < _a.length)) return [3 /*break*/, 6];
+                    newPassword = _a[_i];
+                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: newPassword })];
+                case 4:
+                    outcome = _b.sent();
+                    expect(outcome.status).toBe(400);
+                    _b.label = 5;
+                case 5:
+                    _i++;
+                    return [3 /*break*/, 3];
+                case 6: return [4 /*yield*/, userRow(user.id)];
+                case 7:
+                    row = _b.sent();
+                    expect(row.password).toBe(before);
+                    expect(row.passwordResetToken).toBe(token);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the presented token never reaches the log', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var token, info, _i, _a, entry;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    token = mintToken();
+                    info = jest.spyOn(logger_1.Logger.prototype, 'info');
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 3, 4]);
+                    return [4 /*yield*/, invokeExecute({ token: token, newPassword: 'hijacked' })];
+                case 2:
+                    _b.sent();
+                    expect(info).toHaveBeenCalled();
+                    for (_i = 0, _a = info.mock.calls; _i < _a.length; _i++) {
+                        entry = _a[_i][0];
+                        expect(JSON.stringify(entry)).not.toContain(token);
+                    }
+                    return [3 /*break*/, 4];
+                case 3:
+                    info.mockRestore();
+                    return [7 /*endfinally*/];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    describe('PasswordResetToken', function () {
+        var internals = new PasswordResetToken_1.PasswordResetToken();
+        it('mints 64 lowercase hex characters, fresh each time', function () {
+            var token = mintToken();
+            expect(token).toMatch(/^[0-9a-f]{64}$/);
+            expect(mintToken()).not.toBe(token);
+        });
+        it('a stored token matches only the same string — never an absent or emptied one', function () {
+            var token = mintToken();
+            expect(internals.matches(token, token)).toBe(true);
+            expect(internals.matches(mintToken(), token)).toBe(false);
+            expect(internals.matches(null, token)).toBe(false);
+            expect(internals.matches(undefined, token)).toBe(false);
+            expect(internals.matches('', token)).toBe(false);
+        });
+        it('an expiry is live only as a valid timestamp in the future', function () {
+            expect(internals.isLive((0, moment_1.default)().add(1, 'minute'))).toBe(true);
+            expect(internals.isLive((0, moment_1.default)().subtract(1, 'minute'))).toBe(false);
+            expect(internals.isLive(null)).toBe(false);
+            expect(internals.isLive(undefined)).toBe(false);
+            expect(internals.isLive(moment_1.default.invalid())).toBe(false);
+        });
+        it('redeem writes only while the row still carries the token', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var live, user, before, _a, row;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        live = mintToken();
+                        return [4 /*yield*/, armResetToken('reset-redeem@test.local', live, (0, moment_1.default)().add(1, 'hour'))];
+                    case 1:
+                        user = _b.sent();
+                        return [4 /*yield*/, userRow(user.id)];
+                    case 2:
+                        before = (_b.sent()).password;
+                        return [4 /*yield*/, expect(new PasswordResetToken_1.PasswordResetToken().redeem(user, mintToken(), 'other-hash')).resolves.toBe(false)];
+                    case 3:
+                        _b.sent();
+                        _a = expect;
+                        return [4 /*yield*/, userRow(user.id)];
+                    case 4:
+                        _a.apply(void 0, [(_b.sent()).password]).toBe(before);
+                        return [4 /*yield*/, expect(new PasswordResetToken_1.PasswordResetToken().redeem(user, live, 'new-hash')).resolves.toBe(true)];
+                    case 5:
+                        _b.sent();
+                        return [4 /*yield*/, userRow(user.id)];
+                    case 6:
+                        row = _b.sent();
+                        expect(row.password).toBe('new-hash');
+                        expect(row.passwordResetToken).toBeNull();
+                        expect(row.passwordResetTokenExpiration).toBeNull();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});
+//# sourceMappingURL=ExecutePasswordReset.test.js.map