@proteinjs/user-server 1.22.2 → 1.22.4

package/test/SignupRace.integration.test.ts

@@ -0,0 +1,230 @@
+import { randomBytes } from 'crypto';
+import { getDbAsSystem } from '@proteinjs/db';
+import { MailSink, MailSinkRecord } from '@proteinjs/email-server';
+import { SourceRepository } from '@proteinjs/reflection';
+import { tables } from '@proteinjs/user';
+import { PasswordHasher } from '../src/authentication/PasswordHasher';
+import { signup } from '../src/routes/signup';
+import { Signup } from '../src/services/Signup';
+import { RequestDigests } from '../src/throttle/RequestDigests';
+import { LogCapture } from './LogCapture';
+import { createPassportRequest } from './passportSessionHarness';
+import { UserServerTestEnvironment } from './UserServerTestEnvironment';
+
+/**
+ * Two sign-ups for one address at the same moment. The signup door has one rule for an address
+ * that already has an account: the caller gets the response a new account gets, byte for byte, no
+ * session is minted, the address's owner is told by mail, and no log line names the address. A
+ * race used to break it: both requests passed the existence check before either wrote, the unique
+ * index on the address refused the second insert, and the database's sentence — which names the
+ * address — came back as the loser's response and its log line.
+ *
+ * Driven end to end against the Spanner emulator: the real route, the real passport session
+ * machinery, the real mail sink (`EMAIL_TRANSPORT=sink`), the log captured as the default writer
+ * emits it. Each create's password hash is held until both creates have arrived, so both have
+ * passed the existence check and both inserts race.
+ */
+
+const testEnv = new UserServerTestEnvironment();
+
+type SourceRepositoryInternals = { objectCache: Record<string, unknown[]> };
+const objectCache = () => (SourceRepository.get() as unknown as SourceRepositoryInternals).objectCache;
+
+const CONFIG_KEYS = [
+  '@proteinjs/email-server/DefaultEmailConfigFactory',
+  '@proteinjs/email-server/DefaultSignupConfirmationEmailConfigFactory',
+  '@proteinjs/user-server/DefaultInviteConfigFactory',
+];
+
+const WELCOME_SUBJECT = 'Welcome';
+const EXISTS_SUBJECT = 'Account already exists';
+
+type SignupOutcome = {
+  status: number;
+  /** The body as the wire carries it (express serializes an object body as JSON). */
+  bytes: string;
+  loggedInAs?: string;
+  sessionEvents: string[];
+};
+
+/** One sign-up through the route, the session read back off the request as passport left it. */
+const signUp = async (body: Record<string, unknown>): Promise<SignupOutcome> => {
+  const { request, events } = await createPassportRequest({ body });
+  const outcome: SignupOutcome = { status: 200, bytes: '', sessionEvents: events };
+  const response = {
+    status(code: number) {
+      outcome.status = code;
+      return this;
+    },
+    send(sent?: unknown) {
+      outcome.bytes = JSON.stringify(sent);
+    },
+  };
+  await signup.onRequest(request as never, response as never);
+  outcome.loggedInAs = request.session.passport?.user;
+  return outcome;
+};
+
+/**
+ * Runs `run` with every account creation's password hash held until `count` hashes have started —
+ * each create has passed the existence check by then, so their inserts race.
+ */
+const withCreatesHeldTogether = async <T>(count: number, run: () => Promise<T>): Promise<T> => {
+  const hash = PasswordHasher.prototype.hash;
+  let arrived = 0;
+  let release!: () => void;
+  const allArrived = new Promise<void>((resolve) => (release = resolve));
+  const held = jest.spyOn(PasswordHasher.prototype, 'hash').mockImplementation(async function (
+    this: PasswordHasher,
+    password: string
+  ) {
+    const hashed = await hash.call(this, password);
+    if (++arrived === count) {
+      release();
+    }
+    await allArrived;
+    return hashed;
+  });
+  try {
+    return await run();
+  } finally {
+    held.mockRestore();
+  }
+};
+
+/** The mail the sink holds for `address`, oldest first. */
+const mailTo = (address: string): MailSinkRecord[] =>
+  MailSink.get()
+    .list()
+    .filter((record) => record.to.includes(address))
+    .reverse();
+
+describe('two sign-ups for one address at once', () => {
+  let originalTransport: string | undefined;
+
+  beforeAll(async () => {
+    await testEnv.beforeAll();
+    originalTransport = process.env.EMAIL_TRANSPORT;
+    process.env.EMAIL_TRANSPORT = 'sink';
+    const cache = objectCache();
+    cache['@proteinjs/email-server/DefaultEmailConfigFactory'] = [
+      {
+        getEmailConfig: () => ({
+          host: 'smtp.test.local',
+          port: 465,
+          secure: true,
+          from: '"Example" <hi@example.com>',
+        }),
+      },
+    ];
+    cache['@proteinjs/email-server/DefaultSignupConfirmationEmailConfigFactory'] = [
+      {
+        getConfig: () => ({
+          newUserSubject: WELCOME_SUBJECT,
+          existingUserSubject: EXISTS_SUBJECT,
+          getNewUserEmailContent: () => ({ text: 'welcome' }),
+          getExistingUserEmailContent: () => ({ text: 'someone tried to sign up with your address' }),
+        }),
+      },
+    ];
+    // Invite-optional, the library default — the suites load src, never the generated source graph.
+    cache['@proteinjs/user-server/DefaultInviteConfigFactory'] = [{ getConfig: () => ({ isInviteOnly: false }) }];
+  }, 120000);
+
+  afterAll(async () => {
+    const cache = objectCache();
+    for (const key of CONFIG_KEYS) {
+      delete cache[key];
+    }
+    if (originalTransport === undefined) {
+      delete process.env.EMAIL_TRANSPORT;
+    } else {
+      process.env.EMAIL_TRANSPORT = originalTransport;
+    }
+    await testEnv.afterAll();
+  });
+
+  beforeEach(() => {
+    MailSink.get().clear();
+  });
+
+  it('the loser answers exactly as a plain existing address does: the same bytes, no session, one mail to the owner, no address in the log', async () => {
+    // Typed with capitals, stored lowercased — the address a person types.
+    const local = `race-${randomBytes(4).toString('hex')}`;
+    const address = `${local}@test.local`;
+    const body = { name: 'Racer', email: `${local.toUpperCase()}@Test.local`, password: 'a-password' };
+
+    let raced: SignupOutcome[] = [];
+    const log = await LogCapture.during(async () => {
+      raced = await withCreatesHeldTogether(2, () => Promise.all([signUp(body), signUp(body)]));
+    });
+    const racedMail = mailTo(address);
+
+    // A plain sign-up for the address that now exists: the response the rule promises.
+    const plain = await signUp(body);
+    expect(plain.loggedInAs).toBeUndefined();
+
+    // Both racers got that response, byte for byte.
+    expect(raced.map((outcome) => [outcome.status, outcome.bytes])).toEqual([
+      [plain.status, plain.bytes],
+      [plain.status, plain.bytes],
+    ]);
+    // One account; one session, for the racer that created it; the loser none at all.
+    expect((await getDbAsSystem().query(tables.User, { email: address })).length).toBe(1);
+    expect(raced.filter((outcome) => outcome.loggedInAs === address)).toHaveLength(1);
+    const loser = raced.find((outcome) => outcome.loggedInAs === undefined);
+    expect(loser?.sessionEvents).toEqual([]);
+    // The owner's mail: the winner's welcome and ONE notice that someone tried the address again.
+    expect(racedMail.map((record) => record.subject).sort()).toEqual([EXISTS_SUBJECT, WELCOME_SUBJECT].sort());
+
+    // No line this process wrote names the address (its local part, in any case or encoding) except the database
+    // driver's own line for the refused statement: the driver's version (the one a package lock
+    // pins) decides whether that line prints bound values; it is the driver's to keep clean.
+    const lines = log.lines.filter((line) => !line.includes('[SpannerDriver]'));
+    expect(lines.length).toBeGreaterThan(0);
+    expect(lines.filter((line) => line.toLowerCase().includes(local))).toEqual([]);
+    // The account lines name the account by its digest: the winner's `Created user` and the
+    // loser's `already exists`, each carrying the same digest for the one address.
+    const digest = new RequestDigests().account(address);
+    expect(lines.filter((line) => line.includes('Created user') && line.includes(digest))).toHaveLength(1);
+    expect(lines.filter((line) => line.includes('already exists') && line.includes(digest))).toHaveLength(1);
+  });
+
+  it('a create that loses the race to the same address reports it as existing, the account row the winner wrote untouched', async () => {
+    const local = `race-${randomBytes(4).toString('hex')}`;
+    const address = `${local}@test.local`;
+    // Both creates carry the address as typed (capitals): the row is stored lowercased, and the
+    // loser's re-read must ask for the address the way the row holds it.
+    const account = (name: string) => ({
+      name,
+      email: `${local.toUpperCase()}@Test.local`,
+      password: 'a-password',
+      emailVerified: false,
+      invitedBy: null,
+    });
+
+    const outcomes = await withCreatesHeldTogether(2, () =>
+      Promise.all([new Signup().createAccount(account('First')), new Signup().createAccount(account('Second'))])
+    );
+
+    expect(outcomes.slice().sort()).toEqual(['created', 'exists']);
+    const rows = await getDbAsSystem().query(tables.User, { email: address });
+    expect(rows).toHaveLength(1);
+    expect(rows[0].name).toBe(outcomes[0] === 'created' ? 'First' : 'Second');
+  });
+
+  it('an insert the database refuses while the address has no account is a real failure: it throws, never "exists"', async () => {
+    const address = `race-${randomBytes(4).toString('hex')}@test.local`;
+    // The name column holds 255 characters; the database refuses a longer one.
+    const create = new Signup().createAccount({
+      name: 'n'.repeat(300),
+      email: address,
+      password: 'a-password',
+      emailVerified: false,
+      invitedBy: null,
+    });
+
+    await expect(create).rejects.toThrow();
+    expect(await getDbAsSystem().query(tables.User, { email: address })).toHaveLength(0);
+  });
+});

package/test/SignupRoute.test.ts

@@ -35,7 +35,7 @@ jest.mock('@proteinjs/email-server', () => ({
 
 import { getDbAsSystem, Reference } from '@proteinjs/db';
 import { SourceRepository } from '@proteinjs/reflection';
-import { tables } from '@proteinjs/user';
+import { MachineAccount, tables } from '@proteinjs/user';
 import { signup } from '../src/routes/signup';
 import { createPassportRequest } from './passportSessionHarness';
 import { UserServerTestEnvironment } from './UserServerTestEnvironment';
@@ -45,6 +45,31 @@ const testEnv = new UserServerTestEnvironment();
 const INVITE_CONFIG_KEY = '@proteinjs/user-server/DefaultInviteConfigFactory';
 
 type ObjectCache = { objectCache: Record<string, unknown[]> };
+type NamedObjectCache = {
+  namedObjectCache: Record<string, { qualifiedName: string; packageName: string; object: unknown }[]>;
+};
+
+/** A code-declared machine account owning an address (the declaration only — never booted here). */
+class DeclaredMachineAccount extends MachineAccount {
+  id = 'declared-machine';
+  email = 'declared.machine@test.local';
+  accountName = 'Declared machine';
+  roles = [];
+  secretName = 'declared-machine-secret';
+}
+
+const LOADER_KEY = '@proteinjs/db/SourceRecordLoader';
+
+/** Seed the build's source-record declarations (the machine-account read resolves them by name). */
+const setDeclarations = (declarations: unknown[]) => {
+  (SourceRepository.get() as unknown as NamedObjectCache).namedObjectCache[LOADER_KEY] = declarations.map(
+    (object, i) => ({
+      qualifiedName: `@proteinjs/user-server-test/Declared${i}`,
+      packageName: '@test/declarer',
+      object,
+    })
+  );
+};
 
 /** Seed the invite-config lookup (tests don't load the generated source graph). */
 const setInviteConfig = (factories: unknown[]) => {
@@ -94,12 +119,14 @@ describe('signup route — auto-login after signup', () => {
   }, 120000);
 
   afterAll(async () => {
+    delete (SourceRepository.get() as unknown as NamedObjectCache).namedObjectCache[LOADER_KEY];
     await testEnv.afterAll();
   });
 
   beforeEach(async () => {
     jest.clearAllMocks();
     setInviteConfig([]);
+    setDeclarations([]);
     const db = getDbAsSystem();
     await db.delete(tables.Invite, {});
     await db.delete(tables.User, {});
@@ -180,6 +207,32 @@ describe('signup route — auto-login after signup', () => {
     expect(sendEmail).toHaveBeenCalledTimes(1); // "account already exists" email
   });
 
+  it(`an address a machine-account declaration owns can't be registered — by signup or by invite: plain words, no account, no session`, async () => {
+    setDeclarations([new DeclaredMachineAccount()]);
+
+    const direct = await invokeSignup({
+      name: 'Squatter',
+      email: 'Declared.Machine@test.local',
+      password: 'pw-squat-1',
+    });
+    expect(direct.body).toEqual({ error: "This address can't be registered." });
+    expect(direct.loggedInAs).toBeUndefined();
+    expect(direct.sessionEvents).toEqual([]);
+
+    await getDbAsSystem().insert(tables.Invite, {
+      email: 'declared.machine@test.local',
+      token: 'invite-token-declared',
+      tokenExpiresAt: moment().add(1, 'day'),
+      invitedBy: new Reference(tables.User.name, 'inviter-1'),
+    });
+    const invited = await invokeSignup({ name: 'Squatter', password: 'pw-squat-2', token: 'invite-token-declared' });
+    expect(invited.body).toEqual({ error: "This address can't be registered." });
+    expect(invited.loggedInAs).toBeUndefined();
+
+    expect(await getUserRow('declared.machine@test.local')).toBeUndefined();
+    expect(sendEmail).not.toHaveBeenCalled();
+  });
+
   it('an unknown invite token gets the honest error — no session, no account', async () => {
     const outcome = await invokeSignup({
       name: 'Token Guess',

package/test/SocketIOSessionWatcher.test.ts

@@ -0,0 +1,86 @@
+import { createServer } from 'http';
+import { QueryBuilder } from '@proteinjs/db';
+import { SourceRepository } from '@proteinjs/reflection';
+import { SocketIOServerRepo } from '@proteinjs/server';
+import { Session } from '@proteinjs/user';
+import { SocketIOSessionWatcher } from '../src/authentication/SocketIOSessionWatcher';
+
+type ObjectCache = { objectCache: Record<string, unknown[]> };
+
+/** What the watcher asked the socket server to do: which rooms (session ids) it closed. */
+type DisconnectCall = { rooms: string[]; close: boolean };
+
+/**
+ * The socket server this file installs through the repo's own factory seam — a stand-in that
+ * records every `in(rooms).disconnectSockets(close)` it receives (no socket.io client is part of
+ * this package, so no real socket can connect to observe).
+ */
+class RecordingSocketIOServer {
+  readonly calls: DisconnectCall[] = [];
+
+  in(rooms: string | string[]) {
+    return {
+      disconnectSockets: (close: boolean) => {
+        this.calls.push({ rooms: ([] as string[]).concat(rooms), close });
+      },
+    };
+  }
+}
+
+const session = (sessionId: string): Session =>
+  ({ id: `row-${sessionId}`, sessionId, session: '{}', userEmail: 'someone@test.local' }) as unknown as Session;
+
+const deleteSessions = async (sessions: Session[]) =>
+  await new SocketIOSessionWatcher().afterDelete(
+    sessions.length,
+    sessions,
+    new QueryBuilder<Session>('session'),
+    new QueryBuilder<Session>('session')
+  );
+
+/**
+ * Deleting session rows closes their sockets — and a deletion is not always made by a running
+ * server: a boot's source-record sync (and a migration Job, which never starts one) deactivates a
+ * withdrawn machine account and deletes its sessions before any socket server exists.
+ */
+describe('SocketIOSessionWatcher', () => {
+  it('a deletion before the socket server exists resolves — no socket can be open yet', async () => {
+    expect(SocketIOServerRepo.getSocketIOServerIfExists()).toBeUndefined();
+
+    await expect(deleteSessions([session('before-boot')])).resolves.toBeUndefined();
+  });
+
+  describe('with the socket server up', () => {
+    const server = new RecordingSocketIOServer();
+
+    beforeAll(async () => {
+      (SourceRepository.get() as unknown as ObjectCache).objectCache['@proteinjs/event/DefaultSocketIOServerFactory'] =
+        [{ createSocketIOServer: async () => server }];
+      await SocketIOServerRepo.createSocketIOServer(createServer());
+    });
+
+    afterAll(() => {
+      delete (SourceRepository.get() as unknown as ObjectCache).objectCache[
+        '@proteinjs/event/DefaultSocketIOServerFactory'
+      ];
+    });
+
+    beforeEach(() => {
+      server.calls.length = 0;
+    });
+
+    it(`closes exactly the deleted sessions' sockets`, async () => {
+      await deleteSessions([session('s-1'), session('s-2')]);
+
+      expect(server.calls).toEqual([{ rooms: ['s-1', 's-2'], close: true }]);
+    });
+
+    it('a deletion with no session ids closes nothing — an empty room list would address every socket', async () => {
+      // socket.io's in-memory adapter applies an operation with NO rooms to every socket on the
+      // namespace (`apply`: `if (rooms.size) … else for every sid`), so `in([])` must never be sent.
+      await deleteSessions([]);
+
+      expect(server.calls).toEqual([]);
+    });
+  });
+});