@proteinjs/user-server 1.22.0 → 1.22.2

package/dist/test/InitiatePasswordReset.test.js

@@ -0,0 +1,783 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var crypto_1 = require("crypto");
+var moment_1 = __importDefault(require("moment"));
+var db_1 = require("@proteinjs/db");
+var email_server_1 = require("@proteinjs/email-server");
+var reflection_1 = require("@proteinjs/reflection");
+var user_1 = require("@proteinjs/user");
+var initiatePasswordReset_1 = require("../src/routes/initiatePasswordReset");
+var executePasswordReset_1 = require("../src/routes/executePasswordReset");
+var PasswordHasher_1 = require("../src/authentication/PasswordHasher");
+var PasswordResetToken_1 = require("../src/authentication/PasswordResetToken");
+var login_1 = require("../src/routes/login");
+var passportSessionHarness_1 = require("./passportSessionHarness");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var LogCapture_1 = require("./LogCapture");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/** Each request arrives from its own client address unless the test names one (the dev shape: no proxy). */
+var nextAddress = 0;
+var fromAddress = function (ip) { return ({
+    headers: {},
+    socket: { remoteAddress: ip !== null && ip !== void 0 ? ip : "10.20.".concat(Math.floor(nextAddress / 250), ".").concat((nextAddress++ % 250) + 1) },
+    app: { get: function () { return false; } },
+}); };
+var invoke = function (route, request, events) { return __awaiter(void 0, void 0, void 0, function () {
+    var outcome, response;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                outcome = { status: 200 };
+                response = {
+                    status: function (code) {
+                        outcome.status = code;
+                        return this;
+                    },
+                    send: function (body) {
+                        events === null || events === void 0 ? void 0 : events.push('answered');
+                        outcome.body = body;
+                    },
+                };
+                return [4 /*yield*/, route.onRequest(__assign(__assign({}, fromAddress()), request), response)];
+            case 1:
+                _a.sent();
+                return [2 /*return*/, outcome];
+        }
+    });
+}); };
+var GENERIC = { message: 'If that address has an account, a reset link is on its way.' };
+var sha256Hex = function (value) { return (0, crypto_1.createHash)('sha256').update(value).digest('hex'); };
+var userRow = function (email) { return __awaiter(void 0, void 0, void 0, function () { return __generator(this, function (_a) {
+    switch (_a.label) {
+        case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(user_1.tables.User, { email: email })];
+        case 1: return [2 /*return*/, _a.sent()];
+    }
+}); }); };
+/** Every stored reset token in the table, by email — the whole-table outcome a refused request must leave untouched. */
+var tokensByEmail = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var byEmail, _i, _a, user;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                byEmail = {};
+                _i = 0;
+                return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.User, {})];
+            case 1:
+                _a = _b.sent();
+                _b.label = 2;
+            case 2:
+                if (!(_i < _a.length)) return [3 /*break*/, 4];
+                user = _a[_i];
+                byEmail[user.email] = user.passwordResetToken;
+                _b.label = 3;
+            case 3:
+                _i++;
+                return [3 /*break*/, 2];
+            case 4: return [2 /*return*/, byEmail];
+        }
+    });
+}); };
+/** The token in a reset mail's link. */
+var tokenInLink = function (mailText) {
+    var _a;
+    var token = (_a = /[?&]token=([0-9a-f]{64})\b/.exec(mailText !== null && mailText !== void 0 ? mailText : '')) === null || _a === void 0 ? void 0 : _a[1];
+    if (!token) {
+        throw new Error('The mail carries no reset link');
+    }
+    return token;
+};
+/** The token in the newest mailed reset link. */
+var mailedToken = function () { var _a; return tokenInLink((_a = email_server_1.MailSink.get().list(1)[0]) === null || _a === void 0 ? void 0 : _a.text); };
+/** Moves an account's last mint back past the five-minute gap, so only the windows can refuse. */
+var ageLastMint = function (email) { return __awaiter(void 0, void 0, void 0, function () {
+    var armed;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0: return [4 /*yield*/, userRow(email)];
+            case 1:
+                armed = _a.sent();
+                return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
+                        id: armed.id,
+                        passwordResetTokenExpiration: (0, moment_1.default)().add(54, 'minutes'),
+                    })];
+            case 2:
+                _a.sent();
+                return [2 /*return*/];
+        }
+    });
+}); };
+/** Log text without terminal colour codes. */
+var plain = function (text) { return text.replace(new RegExp("".concat(String.fromCharCode(27), "\\[[0-9;]*m"), 'g'), ''); };
+/** The `field: '<16 hex>'` value on each line containing `marker` ('missing' where absent). */
+var fieldsOn = function (log, marker, field) {
+    return log.lines
+        .map(plain)
+        .filter(function (line) { return line.includes(marker); })
+        .map(function (line) { var _a, _b; return (_b = (_a = new RegExp("".concat(field, ": '([0-9a-f]{16})'")).exec(line)) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : 'missing'; });
+};
+describe('initiatePasswordReset route', function () {
+    var originalTransport = process.env.EMAIL_TRANSPORT;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var objectCache;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    process.env.EMAIL_TRANSPORT = 'sink';
+                    objectCache = reflection_1.SourceRepository.get().objectCache;
+                    objectCache['@proteinjs/email-server/DefaultEmailConfigFactory'] = [
+                        {
+                            getEmailConfig: function () { return ({
+                                host: 'smtp.test.local',
+                                port: 465,
+                                secure: true,
+                                from: '"Example" <hi@example.com>',
+                            }); },
+                        },
+                    ];
+                    objectCache['@proteinjs/email-server/DefaultPasswordResetEmailConfigFactory'] = [
+                        {
+                            getConfig: function () { return ({
+                                getEmailContent: function (resetPathWithToken) { return ({
+                                    text: "Reset your password: https://app.test.local/".concat(resetPathWithToken),
+                                }); },
+                            }); },
+                        },
+                    ];
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    beforeEach(function () {
+        email_server_1.MailSink.get().clear();
+    });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    if (originalTransport === undefined) {
+                        delete process.env.EMAIL_TRANSPORT;
+                    }
+                    else {
+                        process.env.EMAIL_TRANSPORT = originalTransport;
+                    }
+                    return [4 /*yield*/, testEnv.afterAll()];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("the token travels only in the mailed link: the row stores its digest and an hour's expiry, and the link's token resets the password", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome, mail, token, armed, minutesOut, reset, row;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'initiate-live@test.local' })];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'Initiate-Live@test.local' } })];
+                case 2:
+                    outcome = _a.sent();
+                    expect(outcome).toEqual({ status: 200, body: GENERIC });
+                    mail = email_server_1.MailSink.get().list()[0];
+                    expect(mail.to).toEqual(['initiate-live@test.local']);
+                    token = mailedToken();
+                    return [4 /*yield*/, userRow('initiate-live@test.local')];
+                case 3:
+                    armed = _a.sent();
+                    expect(armed.passwordResetToken).toBe(sha256Hex(token));
+                    expect(JSON.stringify(armed)).not.toContain(token);
+                    minutesOut = (0, moment_1.default)(armed.passwordResetTokenExpiration).diff((0, moment_1.default)(), 'minutes', true);
+                    expect(minutesOut).toBeGreaterThan(59);
+                    expect(minutesOut).toBeLessThanOrEqual(60);
+                    return [4 /*yield*/, invoke(executePasswordReset_1.executePasswordReset, { body: { token: token, newPassword: 'a new password' } })];
+                case 4:
+                    reset = _a.sent();
+                    expect(reset.status).toBe(200);
+                    return [4 /*yield*/, userRow('initiate-live@test.local')];
+                case 5:
+                    row = _a.sent();
+                    return [4 /*yield*/, expect(new PasswordHasher_1.PasswordHasher().verify(row.password, 'a new password')).resolves.toBe(true)];
+                case 6:
+                    _a.sent();
+                    expect(row.passwordResetToken).toBeNull();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a send that fails withdraws the token — asking again straight away mails a link', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var send, failed, withdrawn, again, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'initiate-send-fails@test.local' })];
+                case 1:
+                    _b.sent();
+                    send = jest
+                        .spyOn(email_server_1.EmailSender.prototype, 'sendEmail')
+                        .mockRejectedValueOnce(new Error('Failed to send email'));
+                    _b.label = 2;
+                case 2:
+                    _b.trys.push([2, , 5, 6]);
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-send-fails@test.local' } })];
+                case 3:
+                    failed = _b.sent();
+                    expect(failed).toEqual({ status: 200, body: GENERIC });
+                    return [4 /*yield*/, userRow('initiate-send-fails@test.local')];
+                case 4:
+                    withdrawn = _b.sent();
+                    expect(withdrawn.passwordResetToken).toBeNull();
+                    expect(withdrawn.passwordResetTokenExpiration).toBeNull();
+                    return [3 /*break*/, 6];
+                case 5:
+                    send.mockRestore();
+                    return [7 /*endfinally*/];
+                case 6: return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-send-fails@test.local' } })];
+                case 7:
+                    again = _b.sent();
+                    expect(again).toEqual({ status: 200, body: GENERIC });
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(1);
+                    _a = expect;
+                    return [4 /*yield*/, userRow('initiate-send-fails@test.local')];
+                case 8:
+                    _a.apply(void 0, [(_b.sent()).passwordResetToken]).toBe(sha256Hex(mailedToken()));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a second request inside five minutes is throttled: no new mail, the row unchanged', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var armed, second, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'initiate-throttled@test.local' })];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-throttled@test.local' } })];
+                case 2:
+                    _b.sent();
+                    return [4 /*yield*/, userRow('initiate-throttled@test.local')];
+                case 3:
+                    armed = _b.sent();
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-throttled@test.local' } })];
+                case 4:
+                    second = _b.sent();
+                    expect(second).toEqual({ status: 200, body: GENERIC });
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(1);
+                    _a = expect;
+                    return [4 /*yield*/, userRow('initiate-throttled@test.local')];
+                case 5:
+                    _a.apply(void 0, [(_b.sent()).passwordResetToken]).toBe(armed.passwordResetToken);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('a token minted more than five minutes ago is replaced: a new link is mailed and the old token stops working', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var first, armed, second, _a, stale;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'initiate-replaced@test.local' })];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-replaced@test.local' } })];
+                case 2:
+                    _b.sent();
+                    first = mailedToken();
+                    return [4 /*yield*/, userRow('initiate-replaced@test.local')];
+                case 3:
+                    armed = _b.sent();
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().update(user_1.tables.User, {
+                            id: armed.id,
+                            passwordResetTokenExpiration: (0, moment_1.default)().add(54, 'minutes'),
+                        })];
+                case 4:
+                    _b.sent();
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-replaced@test.local' } })];
+                case 5:
+                    _b.sent();
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(2);
+                    second = mailedToken();
+                    expect(second).not.toBe(first);
+                    _a = expect;
+                    return [4 /*yield*/, userRow('initiate-replaced@test.local')];
+                case 6:
+                    _a.apply(void 0, [(_b.sent()).passwordResetToken]).toBe(sha256Hex(second));
+                    return [4 /*yield*/, invoke(executePasswordReset_1.executePasswordReset, { body: { token: first, newPassword: 'hijacked' } })];
+                case 7:
+                    stale = _b.sent();
+                    expect(stale.status).toBe(400);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('no minted token, no leading characters of one and no full digest reach the log — mailed, throttled, unknown, failed send', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var mailed, withdrawn, log, _i, _a, token;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'initiate-log@test.local' })];
+                case 1:
+                    _b.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'initiate-log-send-fails@test.local' })];
+                case 2:
+                    _b.sent();
+                    mailed = '';
+                    withdrawn = '';
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var send, failed;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-log@test.local' } })];
+                                    case 1:
+                                        _a.sent();
+                                        mailed = mailedToken();
+                                        return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-log@test.local' } })];
+                                    case 2:
+                                        _a.sent();
+                                        return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-log-nobody@test.local' } })];
+                                    case 3:
+                                        _a.sent();
+                                        send = jest.spyOn(email_server_1.EmailSender.prototype, 'sendEmail').mockImplementationOnce(function (mail) { return __awaiter(void 0, void 0, void 0, function () {
+                                            return __generator(this, function (_a) {
+                                                withdrawn = tokenInLink(mail.text);
+                                                throw new Error('Failed to send email');
+                                            });
+                                        }); });
+                                        _a.label = 4;
+                                    case 4:
+                                        _a.trys.push([4, , 6, 7]);
+                                        return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-log-send-fails@test.local' } })];
+                                    case 5:
+                                        failed = _a.sent();
+                                        expect(failed).toEqual({ status: 200, body: GENERIC });
+                                        return [3 /*break*/, 7];
+                                    case 6:
+                                        send.mockRestore();
+                                        return [7 /*endfinally*/];
+                                    case 7: return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 3:
+                    log = _b.sent();
+                    // The capture saw the route's lines: the throttle, the unknown address and the failed send logged.
+                    expect(log.text).toContain('Password reset requested too soon for user');
+                    expect(log.text).toContain('Password reset requested for non-existent user');
+                    expect(log.text).toContain('Failed to send password reset email');
+                    expect(withdrawn).not.toBe(mailed);
+                    for (_i = 0, _a = [mailed, withdrawn]; _i < _a.length; _i++) {
+                        token = _a[_i];
+                        log.expectFreeOf(token);
+                    }
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('an unknown address gets the same response and no mail', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var outcome;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'initiate-nobody@test.local' } })];
+                case 1:
+                    outcome = _a.sent();
+                    expect(outcome).toEqual({ status: 200, body: GENERIC });
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it.each([
+        ['no body', {}],
+        ['a null body', { body: null }],
+        ['no email', { body: {} }],
+        ['a blank email', { body: { email: '' } }],
+        ['an email that is not a string', { body: { email: { toLowerCase: null } } }],
+    ])('a request with %s: 400, no mail, no token minted', function (_label, request) { return __awaiter(void 0, void 0, void 0, function () {
+        var tokensBefore, outcome, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, tokensByEmail()];
+                case 1:
+                    tokensBefore = _b.sent();
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, request)];
+                case 2:
+                    outcome = _b.sent();
+                    expect(outcome.status).toBe(400);
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(0);
+                    _a = expect;
+                    return [4 /*yield*/, tokensByEmail()];
+                case 3:
+                    _a.apply(void 0, [_b.sent()]).toEqual(tokensBefore);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('one answer whatever happens behind it: mailed, no account, too soon, over a window, a failed send', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var answers, ask, i, send;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'one-answer@test.local' })];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'one-answer-fails@test.local' })];
+                case 2:
+                    _a.sent();
+                    answers = [];
+                    ask = function (email, ip) { return __awaiter(void 0, void 0, void 0, function () { var _a, _b; return __generator(this, function (_c) {
+                        switch (_c.label) {
+                            case 0:
+                                _b = (_a = answers).push;
+                                return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, __assign(__assign({}, fromAddress(ip)), { body: { email: email } }))];
+                            case 1: return [2 /*return*/, _b.apply(_a, [_c.sent()])];
+                        }
+                    }); }); };
+                    return [4 /*yield*/, ask('one-answer@test.local')];
+                case 3:
+                    _a.sent(); // mailed
+                    return [4 /*yield*/, ask('one-answer-nobody@test.local')];
+                case 4:
+                    _a.sent(); // no account
+                    return [4 /*yield*/, ask('one-answer@test.local')];
+                case 5:
+                    _a.sent(); // too soon
+                    return [4 /*yield*/, ask('one-answer@test.local')];
+                case 6:
+                    _a.sent();
+                    return [4 /*yield*/, ask('one-answer@test.local')];
+                case 7:
+                    _a.sent(); // over the address window
+                    i = 0;
+                    _a.label = 8;
+                case 8:
+                    if (!(i < 11)) return [3 /*break*/, 11];
+                    return [4 /*yield*/, ask("one-answer-sweep-".concat(i, "@test.local"), '198.18.0.1')];
+                case 9:
+                    _a.sent(); // the eleventh is over the client window
+                    _a.label = 10;
+                case 10:
+                    i++;
+                    return [3 /*break*/, 8];
+                case 11:
+                    send = jest
+                        .spyOn(email_server_1.EmailSender.prototype, 'sendEmail')
+                        .mockRejectedValueOnce(new Error('Failed to send email'));
+                    _a.label = 12;
+                case 12:
+                    _a.trys.push([12, , 14, 15]);
+                    return [4 /*yield*/, ask('one-answer-fails@test.local')];
+                case 13:
+                    _a.sent(); // a failed send
+                    return [3 /*break*/, 15];
+                case 14:
+                    send.mockRestore();
+                    return [7 /*endfinally*/];
+                case 15:
+                    expect(answers).toHaveLength(17);
+                    expect(new Set(answers.map(function (answer) { return JSON.stringify(answer); }))).toEqual(new Set([JSON.stringify({ status: 200, body: GENERIC })]));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('the answer goes out before the account is looked up, a token minted or a mail sent — its timing says nothing', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var events, realMint, mint, send;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'answer-first@test.local' })];
+                case 1:
+                    _a.sent();
+                    events = [];
+                    realMint = PasswordResetToken_1.PasswordResetToken.prototype.mint;
+                    mint = jest.spyOn(PasswordResetToken_1.PasswordResetToken.prototype, 'mint').mockImplementation(function () {
+                        var args = [];
+                        for (var _i = 0; _i < arguments.length; _i++) {
+                            args[_i] = arguments[_i];
+                        }
+                        return __awaiter(this, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        events.push('minted');
+                                        return [4 /*yield*/, realMint.apply(this, args)];
+                                    case 1: return [2 /*return*/, _a.sent()];
+                                }
+                            });
+                        });
+                    });
+                    send = jest.spyOn(email_server_1.EmailSender.prototype, 'sendEmail').mockImplementation(function () { return __awaiter(void 0, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            events.push('mailed');
+                            return [2 /*return*/];
+                        });
+                    }); });
+                    _a.label = 2;
+                case 2:
+                    _a.trys.push([2, , 4, 5]);
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'answer-first@test.local' } }, events)];
+                case 3:
+                    _a.sent();
+                    return [3 /*break*/, 5];
+                case 4:
+                    mint.mockRestore();
+                    send.mockRestore();
+                    return [7 /*endfinally*/];
+                case 5:
+                    expect(events).toEqual(['answered', 'minted', 'mailed']);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('per address: the fourth request inside the hour mails nothing, even past the five-minute gap', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var i, armed, fourth, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'address-window@test.local' })];
+                case 1:
+                    _b.sent();
+                    i = 0;
+                    _b.label = 2;
+                case 2:
+                    if (!(i < 3)) return [3 /*break*/, 6];
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'Address-Window@test.local' } })];
+                case 3:
+                    _b.sent();
+                    return [4 /*yield*/, ageLastMint('address-window@test.local')];
+                case 4:
+                    _b.sent();
+                    _b.label = 5;
+                case 5:
+                    i++;
+                    return [3 /*break*/, 2];
+                case 6:
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(3);
+                    return [4 /*yield*/, userRow('address-window@test.local')];
+                case 7:
+                    armed = _b.sent();
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'address-window@test.local' } })];
+                case 8:
+                    fourth = _b.sent();
+                    expect(fourth).toEqual({ status: 200, body: GENERIC });
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(3);
+                    _a = expect;
+                    return [4 /*yield*/, userRow('address-window@test.local')];
+                case 9:
+                    _a.apply(void 0, [(_b.sent()).passwordResetToken]).toBe(armed.passwordResetToken);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('per client address: after ten requests the eleventh mails nothing, even for an account; another address still gets its link', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var i, eleventh;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'client-window@test.local' })];
+                case 1:
+                    _a.sent();
+                    i = 0;
+                    _a.label = 2;
+                case 2:
+                    if (!(i < 10)) return [3 /*break*/, 5];
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, __assign(__assign({}, fromAddress('198.18.1.1')), { body: { email: "client-window-".concat(i, "@test.local") } }))];
+                case 3:
+                    _a.sent();
+                    _a.label = 4;
+                case 4:
+                    i++;
+                    return [3 /*break*/, 2];
+                case 5: return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, __assign(__assign({}, fromAddress('198.18.1.1')), { body: { email: 'client-window@test.local' } }))];
+                case 6:
+                    eleventh = _a.sent();
+                    expect(eleventh).toEqual({ status: 200, body: GENERIC });
+                    expect(email_server_1.MailSink.get().list()).toHaveLength(0);
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, __assign(__assign({}, fromAddress('198.18.1.2')), { body: { email: 'client-window@test.local' } }))];
+                case 7:
+                    _a.sent();
+                    expect(email_server_1.MailSink.get()
+                        .list()
+                        .map(function (mail) { return mail.to; })).toEqual([['client-window@test.local']]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('every request is one outcome line with the account digest and the coarse IP hash — never the address', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var log, markers, accounts, person, ips, text, _i, _a, fragment;
+        var _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'reset.privacy.person@test.local' })];
+                case 1:
+                    _c.sent();
+                    return [4 /*yield*/, LogCapture_1.LogCapture.during(function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var ask;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        ask = function (email) { return invoke(initiatePasswordReset_1.initiatePasswordReset, __assign(__assign({}, fromAddress('198.18.2.7')), { body: { email: email } })); };
+                                        return [4 /*yield*/, ask('reset.privacy.person@test.local')];
+                                    case 1:
+                                        _a.sent(); // mailed
+                                        return [4 /*yield*/, ask('Reset.Privacy.Person@TEST.local')];
+                                    case 2:
+                                        _a.sent(); // too soon
+                                        return [4 /*yield*/, ask('RESET.PRIVACY.PERSON@test.local')];
+                                    case 3:
+                                        _a.sent(); // too soon
+                                        return [4 /*yield*/, ask('reset.privacy.person@test.local')];
+                                    case 4:
+                                        _a.sent(); // over the address window
+                                        return [4 /*yield*/, ask('reset.privacy.nobody@test.local')];
+                                    case 5:
+                                        _a.sent(); // no account
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 2:
+                    log = _c.sent();
+                    markers = [
+                        'Password reset link mailed',
+                        'Password reset requested too soon for user',
+                        'Password reset throttled',
+                        'Password reset requested for non-existent user',
+                    ];
+                    accounts = markers.map(function (marker) { return fieldsOn(log, marker, 'account'); });
+                    expect(accounts.map(function (values) { return values.length; })).toEqual([1, 2, 1, 1]);
+                    person = accounts[0][0];
+                    expect(person).toMatch(/^[0-9a-f]{16}$/);
+                    expect(__spreadArray(__spreadArray([], accounts[1], true), accounts[2], true)).toEqual([person, person, person]);
+                    expect(accounts[3][0]).toMatch(/^[0-9a-f]{16}$/);
+                    expect(accounts[3][0]).not.toBe(person);
+                    ips = (_b = []).concat.apply(_b, markers.map(function (marker) { return fieldsOn(log, marker, 'ip'); }));
+                    expect(ips).toHaveLength(5);
+                    expect(ips[0]).toMatch(/^[0-9a-f]{16}$/);
+                    expect(new Set(ips)).toEqual(new Set([ips[0]]));
+                    text = plain(log.text).toLowerCase();
+                    for (_i = 0, _a = ['reset.privacy.person', 'reset.privacy.nobody', 'reset.privacy', '198.18.2.']; _i < _a.length; _i++) {
+                        fragment = _a[_i];
+                        expect(text).not.toContain(fragment);
+                    }
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("a reset link redeemed while wrong guesses hold the account's sign-in window shut lets the new password in at once", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var signIn, i, _a, redeemed, after;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, testEnv.createUser({ name: 'Reset User', email: 'reset-while-shut@test.local' })];
+                case 1:
+                    _b.sent();
+                    signIn = function (password) { return __awaiter(void 0, void 0, void 0, function () {
+                        var sent, response, request;
+                        var _a;
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0:
+                                    response = {
+                                        send: function (body) {
+                                            sent = body;
+                                        },
+                                        status: function () { return response; },
+                                    };
+                                    return [4 /*yield*/, (0, passportSessionHarness_1.createPassportRequest)(__assign({ body: { email: 'reset-while-shut@test.local', password: password } }, fromAddress()))];
+                                case 1:
+                                    request = (_b.sent()).request;
+                                    return [4 /*yield*/, login_1.login.onRequest(request, response)];
+                                case 2:
+                                    _b.sent();
+                                    return [2 /*return*/, { sent: sent, signedInAs: (_a = request.session.passport) === null || _a === void 0 ? void 0 : _a.user }];
+                            }
+                        });
+                    }); };
+                    i = 0;
+                    _b.label = 2;
+                case 2:
+                    if (!(i < 10)) return [3 /*break*/, 5];
+                    return [4 /*yield*/, signIn('wrong guess')];
+                case 3:
+                    _b.sent();
+                    _b.label = 4;
+                case 4:
+                    i++;
+                    return [3 /*break*/, 2];
+                case 5:
+                    _a = expect;
+                    return [4 /*yield*/, signIn('wrong guess')];
+                case 6:
+                    _a.apply(void 0, [(_b.sent()).sent]).toEqual({ error: 'Too many attempts. Try again in a few minutes.' });
+                    return [4 /*yield*/, invoke(initiatePasswordReset_1.initiatePasswordReset, { body: { email: 'reset-while-shut@test.local' } })];
+                case 7:
+                    _b.sent();
+                    return [4 /*yield*/, invoke(executePasswordReset_1.executePasswordReset, {
+                            body: { token: mailedToken(), newPassword: 'a brand new password' },
+                        })];
+                case 8:
+                    redeemed = _b.sent();
+                    expect(redeemed.status).toBe(200);
+                    return [4 /*yield*/, signIn('a brand new password')];
+                case 9:
+                    after = _b.sent();
+                    expect(after.sent).toEqual({});
+                    expect(after.signedInAs).toBe('reset-while-shut@test.local');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=InitiatePasswordReset.test.js.map