@proteinjs/user-server 1.22.0 → 1.22.2

package/test/ValidateResetToken.test.ts

@@ -1,9 +1,13 @@
+import { createHash } from 'crypto';
 import moment from 'moment';
 import { getDbAsSystem } from '@proteinjs/db';
 import { tables } from '@proteinjs/user';
 import { validateResetPasswordToken } from '../src/routes/validateResetPasswordToken';
 import { PasswordResetToken } from '../src/authentication/PasswordResetToken';
 import { UserServerTestEnvironment } from './UserServerTestEnvironment';
+import { DbTraffic } from './DbTraffic';
+import { LogCapture } from './LogCapture';
+import { MalformedResetTokens } from './MalformedResetTokens';
 
 const testEnv = new UserServerTestEnvironment();
 
@@ -14,8 +18,15 @@ const testEnv = new UserServerTestEnvironment();
  * with the stored credential. The email only ever rides a VALID token's response — the
  * token was delivered to that very inbox, so it reveals nothing the holder doesn't know —
  * while invalid/expired verdicts stay email-free (no account-probing oracle). A query value
- * that is not a well-formed token (a parsed object or array, a string of another shape) is
- * invalid without a lookup.
+ * that is not a well-formed token — every type a parsed query string can deliver, and every
+ * near-miss cut from a live token — is invalid without a lookup: nothing reaches the database
+ * (no lookup built, no statement run), which the verdict alone could not prove, since a wrongly
+ * admitted value still matches no row. The row stores the token's SHA-256 digest, never the
+ * token: the stored digest presented as a token is invalid — it has a token's shape, so the one
+ * lookup it builds is by the digest OF the presented value — and so is a token an earlier
+ * release stored in clear. No token, no leading characters of one and no full digest reach the
+ * log. Live tokens are seeded through `PasswordResetToken.mint`, so the suite moves with what
+ * the owner stores.
  */
 
 type RouteOutcome = { status?: number; body?: any };
@@ -35,15 +46,19 @@ const invokeValidate = async (query: Record<string, unknown>): Promise<RouteOutc
   return outcome;
 };
 
-const mintToken = () => new PasswordResetToken().mint();
+const sha256Hex = (value: string) => createHash('sha256').update(value).digest('hex');
 
-const armResetToken = async (email: string, token: string, expiration: moment.Moment) => {
+/** A well-formed token that was never issued to anyone. */
+const unissuedToken = () => sha256Hex(`never issued ${Math.random()}`);
+
+/** A user with a token minted by the owner; `expiration` (when given) replaces the expiry the mint stored. */
+const armResetToken = async (email: string, expiration?: moment.Moment): Promise<string> => {
   const user = await testEnv.createUser({ name: 'Reset User', email });
-  await getDbAsSystem().update(tables.User, {
-    id: user.id,
-    passwordResetToken: token,
-    passwordResetTokenExpiration: expiration,
-  });
+  const token = await new PasswordResetToken().mint(user);
+  if (expiration !== undefined) {
+    await getDbAsSystem().update(tables.User, { id: user.id, passwordResetTokenExpiration: expiration });
+  }
+  return token;
 };
 
 describe('validateResetPasswordToken route', () => {
@@ -56,8 +71,7 @@ describe('validateResetPasswordToken route', () => {
   });
 
   it('a valid token resolves isValid WITH the account email (the reset form identifier)', async () => {
-    const token = mintToken();
-    await armResetToken('reset-valid@test.local', token, moment().add(1, 'hour'));
+    const token = await armResetToken('reset-valid@test.local');
 
     const outcome = await invokeValidate({ token });
 
@@ -66,8 +80,7 @@ describe('validateResetPasswordToken route', () => {
   });
 
   it('an expired token resolves invalid and leaks no email', async () => {
-    const token = mintToken();
-    await armResetToken('reset-expired@test.local', token, moment().subtract(1, 'minute'));
+    const token = await armResetToken('reset-expired@test.local', moment().subtract(1, 'minute'));
 
     const outcome = await invokeValidate({ token });
 
@@ -77,28 +90,99 @@ describe('validateResetPasswordToken route', () => {
   });
 
   it('an unknown token resolves invalid and leaks no email', async () => {
-    const outcome = await invokeValidate({ token: mintToken() });
+    const outcome = await invokeValidate({ token: unissuedToken() });
 
     expect(outcome.status).toBe(200);
     expect(outcome.body.isValid).toBe(false);
     expect(outcome.body.email).toBeUndefined();
   });
 
-  it.each([
-    ['a string of another shape', 'tok-never-issued'],
-    ['a parsed array', ['a', 'b']],
-    ['a parsed object', { passwordResetToken: null }],
-  ])('%s resolves invalid without a lookup and leaks no email', async (_label, token) => {
-    const outcome = await invokeValidate({ token });
+  it('the stored digest presented as a token resolves invalid — the row holds nothing that can be presented', async () => {
+    const token = await armResetToken('reset-digest@test.local');
+    const row = await getDbAsSystem().get(tables.User, { email: 'reset-digest@test.local' });
+    expect(row.passwordResetToken).toBe(sha256Hex(token));
+
+    const { result: outcome, traffic } = await DbTraffic.during(
+      testEnv.spannerDriver,
+      async () => await invokeValidate({ token: row.passwordResetToken })
+    );
 
     expect(outcome.status).toBe(200);
     expect(outcome.body).toEqual({ isValid: false, message: 'Invalid token' });
+    expect(traffic.lookups).toEqual([{ passwordResetToken: sha256Hex(sha256Hex(token)) }]);
+    expect(traffic.statements).toBe(1);
+    expect(traffic.writes).toBe(0);
   });
 
-  it('a missing token is a 400', async () => {
-    const outcome = await invokeValidate({});
+  it('a token an earlier release stored in clear resolves invalid — no migration, the person asks again', async () => {
+    const clearToken = unissuedToken();
+    const user = await testEnv.createUser({ name: 'Reset User', email: 'reset-stored-in-clear@test.local' });
+    await getDbAsSystem().update(tables.User, {
+      id: user.id,
+      passwordResetToken: clearToken,
+      passwordResetTokenExpiration: moment().add(1, 'hour'),
+    });
 
-    expect(outcome.status).toBe(400);
-    expect(outcome.body.isValid).toBe(false);
+    const outcome = await invokeValidate({ token: clearToken });
+
+    expect(outcome.status).toBe(200);
+    expect(outcome.body).toEqual({ isValid: false, message: 'Invalid token' });
+  });
+
+  describe('a query without a well-formed token is invalid without a lookup', () => {
+    let liveToken: string;
+
+    beforeAll(async () => {
+      liveToken = await armResetToken('reset-shapes@test.local');
+    });
+
+    it.each(MalformedResetTokens.CASES)(
+      '%s: invalid, no email, and nothing reaches the database',
+      async (_label, tokenField) => {
+        const query = tokenField(liveToken);
+
+        const { result: outcome, traffic } = await DbTraffic.during(
+          testEnv.spannerDriver,
+          async () => await invokeValidate(query)
+        );
+
+        // Nothing usable in the query is a 400; anything else that is not a token is an invalid token.
+        expect(outcome).toEqual(
+          query.token
+            ? { status: 200, body: { isValid: false, message: 'Invalid token' } }
+            : { status: 400, body: { isValid: false, message: 'No token provided' } }
+        );
+        expect(traffic).toEqual(DbTraffic.NONE);
+      }
+    );
+
+    it('after every refusal the live token is still valid', async () => {
+      const outcome = await invokeValidate({ token: liveToken });
+
+      expect(outcome.body).toEqual({ isValid: true, email: 'reset-shapes@test.local' });
+    });
+  });
+
+  it('no token, no leading characters of one and no full digest reach the log — every verdict', async () => {
+    const live = await armResetToken('reset-log-live@test.local');
+    const expired = await armResetToken('reset-log-expired@test.local', moment().subtract(1, 'minute'));
+    const unissued = unissuedToken();
+
+    const log = await LogCapture.during(async () => {
+      await invokeValidate({ token: unissued });
+      await invokeValidate({ token: live.toUpperCase() });
+      await invokeValidate({ token: sha256Hex(live) });
+      await invokeValidate({ token: expired });
+      await invokeValidate({ token: live });
+    });
+
+    // The capture saw the route's lines: the refusals above logged.
+    expect(log.text).toContain('Invalid reset token used');
+    expect(log.text).toContain('Expired reset token used');
+    expect(log.lines.length).toBeGreaterThanOrEqual(4);
+    // The digest presented as a token is covered by `live`: its full digest is what was presented.
+    for (const token of [unissued, live, expired]) {
+      log.expectFreeOf(token);
+    }
   });
 });

package/test/emulatorLock.js

@@ -7,11 +7,10 @@
  * FAILED_PRECONDITION). This lock closes that gap for this package: a lockfile in os.tmpdir()
  * keyed by the emulator host string, held for the whole jest run via globalSetup/globalTeardown.
  *
- * The lockfile PATH FORMULA must stay byte-identical to the fleet's canonical implementation
- * (`EmulatorLock.lockFilePathFor` in @n3xah/thought-common/test) so suites from every repo
- * pointed at the same emulator actually contend on the same file. The logic is duplicated here
- * because this repo sits BELOW @n3xah in the dependency layering (thought-common itself depends
- * on @proteinjs/user) — future extraction target: @proteinjs/db-driver-spanner/test, beside
+ * The lockfile PATH FORMULA must stay byte-identical in every copy of this lock (other
+ * repositories' suites, a consumer application's suites) so runs pointed at the same emulator
+ * actually contend on the same file. The logic is duplicated here because no shared package
+ * carries it yet — future extraction target: @proteinjs/db-driver-spanner/test, beside
  * SpannerEmulatorProvisioner.
  */
 const crypto = require('crypto');
@@ -30,7 +29,7 @@ function lockFilePathFor(host) {
     .replace(/^-+|-+$/g, '')
     .slice(0, 64);
   const hash = crypto.createHash('sha1').update(host).digest('hex').slice(0, 8);
-  return path.join(os.tmpdir(), `n3xa-spanner-emulator-${slug}-${hash}.lock`);
+  return path.join(os.tmpdir(), `spanner-emulator-${slug}-${hash}.lock`);
 }
 
 function isPidAlive(pid) {

package/test/emulatorLock.test.ts

@@ -0,0 +1,32 @@
+import crypto from 'crypto';
+import os from 'os';
+import path from 'path';
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { lockFilePathFor } = require('./emulatorLock') as { lockFilePathFor: (host: string) => string };
+
+/**
+ * The lockfile path is a CONTRACT between every copy of the emulator lock: two jest runs only
+ * serialize when they compute the same file for the same emulator host. The formula is pinned
+ * here byte for byte — a neutral `spanner-emulator-` name (no application's name belongs in a
+ * shared lock), the sanitized host slug, and the first 8 hex characters of the host's sha1.
+ */
+describe('emulatorLock.lockFilePathFor', () => {
+  const expectedFor = (host: string, slug: string) =>
+    path.join(
+      os.tmpdir(),
+      `spanner-emulator-${slug}-${crypto.createHash('sha1').update(host).digest('hex').slice(0, 8)}.lock`
+    );
+
+  it('names the lock by the emulator alone: spanner-emulator-<slug>-<sha1[0..8]>.lock in os.tmpdir()', () => {
+    expect(lockFilePathFor('localhost:9010')).toBe(expectedFor('localhost:9010', 'localhost-9010'));
+    expect(lockFilePathFor('127.0.0.1:9710')).toBe(expectedFor('127.0.0.1:9710', '127-0-0-1-9710'));
+  });
+
+  it('gives two emulators two files, and one emulator the same file every time', () => {
+    expect(lockFilePathFor('localhost:9010')).toBe(lockFilePathFor('localhost:9010'));
+    expect(lockFilePathFor('localhost:9010')).not.toBe(lockFilePathFor('localhost:9011'));
+    // The hash keeps hosts apart even when their slugs collide.
+    expect(lockFilePathFor('localhost:9010')).not.toBe(lockFilePathFor('localhost-9010'));
+  });
+});

package/test/emulatorLockName.test.ts

@@ -0,0 +1,33 @@
+import os from 'os';
+import path from 'path';
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { lockFilePathFor } = require('./emulatorLock') as { lockFilePathFor: (host: string) => string };
+
+/**
+ * The emulator lock's FILE NAME is a contract between every copy of the lock: two jest runs
+ * serialize on a shared emulator only when they compute the same file for the same host. No
+ * shared package carries the lock yet, so the contract is pinned by value — this table is the
+ * same, row for row, in every repository that keeps a copy. A change to a row here is a change
+ * to all of them, made in the same window; a copy that drifts stops contending, silently.
+ */
+// [emulator host, lock file name, what the row pins]
+const LOCK_FILE_NAMES: [string, string, string][] = [
+  ['localhost:9010', 'spanner-emulator-localhost-9010-0091e79a.lock', 'the default shared emulator'],
+  [
+    'localhost-9010',
+    'spanner-emulator-localhost-9010-493b66d1.lock',
+    'the same slug as the row above: the hash alone keeps two hosts apart',
+  ],
+  [
+    '[emulator.a-host-name-long-enough-to-run-past-the-sixty-four-cap.example.test]:9010',
+    'spanner-emulator-emulator-a-host-name-long-enough-to-run-past-the-sixty-four-cap--fe958a1a.lock',
+    'edge dashes trimmed first, the slug capped at 64 second (the cap lands on a dash, and it stays)',
+  ],
+];
+
+describe('the emulator lock file name (the contract every copy of the lock shares)', () => {
+  it.each(LOCK_FILE_NAMES)('%s locks on %s (%s)', (host, fileName) => {
+    expect(lockFilePathFor(host)).toBe(path.join(os.tmpdir(), fileName));
+  });
+});

package/test/setup.js

@@ -1,2 +1,4 @@
 process.env.SPANNER_EMULATOR_HOST = process.env.SPANNER_EMULATOR_HOST || 'localhost:9010';
 process.env.DB_LOG_LEVEL = 'error';
+// The key the throttled doors' digests (RequestDigests) derive from; a process without one refuses to digest.
+process.env.SESSION_SECRET = process.env.SESSION_SECRET || 'user-server-test-secret';