@proteinjs/user-server 1.4.2 → 1.4.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/src/authentication/DbSessionStore.d.ts +0 -1
- package/dist/src/authentication/DbSessionStore.d.ts.map +1 -1
- package/dist/src/services/Signup.d.ts.map +1 -1
- package/dist/src/services/Signup.js +4 -1
- package/dist/src/services/Signup.js.map +1 -1
- package/dist/test/Signup.test.d.ts +2 -0
- package/dist/test/Signup.test.d.ts.map +1 -0
- package/dist/test/Signup.test.js +34 -0
- package/dist/test/Signup.test.js.map +1 -0
- package/package.json +8 -4
- package/src/services/Signup.ts +4 -1
- package/test/Signup.test.ts +52 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"DbSessionStore.d.ts","sourceRoot":"","sources":["../../../src/authentication/DbSessionStore.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"DbSessionStore.d.ts","sourceRoot":"","sources":["../../../src/authentication/DbSessionStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAMxC,qBAAa,cAAe,SAAQ,KAAK;IACvC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAuB;IAC3D;yEACqE;IACrE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAiB;IACvD,OAAO,CAAC,MAAM,CAA+C;IAC7D,OAAO,CAAC,WAAW,CAA6B;;IAchD,GAAG,cAAe,MAAM,cAAc,GAAG,YAAY,QAAQ,WAAW,GAAG,IAAI,KAAK,IAAI,UAUtF;IAEF,GAAG,cAAe,MAAM,WAAW,QAAQ,WAAW,iBAAgB,GAAG,KAAK,IAAI,uBAiBhF;IAEF,KAAK,cAAe,MAAM,WAAW,QAAQ,WAAW,iBAAgB,GAAG,KAAK,IAAI,uBA8BlF;IAEF,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAKjC;;;OAGG;IACH,OAAO,cAAe,MAAM,iBAAgB,GAAG,KAAK,IAAI,uBAWtD;YAEY,cAAc;YA2Cd,KAAK;CAYpB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Signup.d.ts","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAIlB,aAAa,EACb,wBAAwB,EAGxB,UAAU,EACX,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,0BAA2B,SAAQ,QAAQ;IAC1D,SAAS,IAAI,YAAY,CAAC;CAC3B;AAED,eAAO,MAAM,6BAA6B,QAAO,0BAShD,CAAC;AAEF,qBAAa,MAAO,YAAW,aAAa;IACnC,eAAe;;oCAEM,MAAM,QAAQ,GAAG,EAAE;;
|
|
1
|
+
{"version":3,"file":"Signup.d.ts","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAIlB,aAAa,EACb,wBAAwB,EAGxB,UAAU,EACX,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EAAE,QAAQ,EAAoB,MAAM,uBAAuB,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,0BAA2B,SAAQ,QAAQ;IAC1D,SAAS,IAAI,YAAY,CAAC;CAC3B;AAED,eAAO,MAAM,6BAA6B,QAAO,0BAShD,CAAC;AAEF,qBAAa,MAAO,YAAW,aAAa;IACnC,eAAe;;oCAEM,MAAM,QAAQ,GAAG,EAAE;;MAW7C;IAEI,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2D3D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA0DtD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShD;;;OAGG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAoC1F,wFAAwF;YAC1E,cAAc;CAe7B"}
|
|
@@ -72,8 +72,11 @@ var Signup = /** @class */ (function () {
|
|
|
72
72
|
this.serviceMetadata = {
|
|
73
73
|
auth: {
|
|
74
74
|
canAccess: function (methodName, args) {
|
|
75
|
+
// Admin-only invite management. This previously evaluated hasRole WITHOUT returning it,
|
|
76
|
+
// which made sendInvite/revokeInvite effectively public — any caller (even logged out)
|
|
77
|
+
// could mint themselves a valid signup token and bypass invite-only signup.
|
|
75
78
|
if (methodName === 'sendInvite' || methodName === 'revokeInvite') {
|
|
76
|
-
user_1.UserAuth.hasRole('admin');
|
|
79
|
+
return user_1.UserAuth.hasRole('admin');
|
|
77
80
|
}
|
|
78
81
|
return true;
|
|
79
82
|
},
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Signup.js","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAqD;AACrD,wCAUyB;AACzB,kDAA4B;AAC5B,uCAAgC;AAChC,4CAA2C;AAC3C,wDAIiC;AACjC,4DAAsC;AACtC,oDAAmE;AAU5D,IAAM,6BAA6B,GAAG;IAC3C,IAAM,cAAc,GAA+B;QACjD,SAAS,EAAE,cAAoB,OAAA,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAzB,CAAyB;KACzD,CAAC;IAEF,IAAM,OAAO,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,mDAAmD,CACpD,CAAC;IACF,OAAO,OAAO,IAAI,cAAc,CAAC;AACnC,CAAC,CAAC;AATW,QAAA,6BAA6B,iCASxC;AAEF;IAAA;QACS,oBAAe,GAAG;YACvB,IAAI,EAAE;gBACJ,SAAS,EAAE,UAAC,UAAkB,EAAE,IAAW;oBACzC,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,cAAc,EAAE;wBAChE,eAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"Signup.js","sourceRoot":"","sources":["../../../src/services/Signup.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAAqD;AACrD,wCAUyB;AACzB,kDAA4B;AAC5B,uCAAgC;AAChC,4CAA2C;AAC3C,wDAIiC;AACjC,4DAAsC;AACtC,oDAAmE;AAU5D,IAAM,6BAA6B,GAAG;IAC3C,IAAM,cAAc,GAA+B;QACjD,SAAS,EAAE,cAAoB,OAAA,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAzB,CAAyB;KACzD,CAAC;IAEF,IAAM,OAAO,GAAG,6BAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,mDAAmD,CACpD,CAAC;IACF,OAAO,OAAO,IAAI,cAAc,CAAC;AACnC,CAAC,CAAC;AATW,QAAA,6BAA6B,iCASxC;AAEF;IAAA;QACS,oBAAe,GAAG;YACvB,IAAI,EAAE;gBACJ,SAAS,EAAE,UAAC,UAAkB,EAAE,IAAW;oBACzC,wFAAwF;oBACxF,uFAAuF;oBACvF,4EAA4E;oBAC5E,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,cAAc,EAAE;wBAChE,OAAO,eAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;qBAClC;oBAED,OAAO,IAAI,CAAC;gBACd,CAAC;aACF;SACF,CAAC;IAwLJ,CAAC;IAtLO,2BAAU,GAAhB,UAAiB,IAAgB,EAAE,KAAc;;;;;;;wBACzC,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBACnD,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBAEA,qBAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAA;;wBAAvD,kBAAkB,GAAG,SAAkC;wBAC7D,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE;4BAC/B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;yBAC3C;6BAEc,KAAK,EAAL,wBAAK;wBAAG,qBAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAA;;wBAAhC,KAAA,SAAgC,CAAA;;;wBAAG,KAAA,IAAI,CAAA;;;wBAAxD,MAAM,KAAkD;6BAC1D,KAAK,EAAL,wBAAK;wBACP,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;wBAAzC,SAAyC,CAAC;;;wBAGtC,KAAK,GAAG,MAAA,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,0CAAE,WAAW,EAAE,CAAC;wBAClE,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;yBAC9D;wBAEK,yBAAyB,GAAG,IAAA,6DAA8C,GAAE,CAAC;wBAC7E,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,CAAC;wBAC/C,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;wBAEnB,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;wBAAjD,UAAU,GAAG,SAAoC;6BACnD,UAAU,EAAV,yBAAU;wBACZ,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;6BAC7E,MAAM,CAAC,2BAA2B,EAAlC,wBAAkC;wBAC9B,KAAiB,MAAM,CAAC,2BAA2B,EAAE,EAAnD,gBAAI,EAAE,gBAAI,CAA0C;wBAC5D,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,KAAK,EACT,OAAO,EAAE,MAAM,CAAC,mBAAmB,KAAI,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,CAAA,IAAI,wBAAwB,EAC1F,IAAI,QAAA,EACJ,IAAI,QAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;;4BAEL,sBAAO;6BAGT,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE;4BAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,KAAK,OAAA;4BACL,QAAQ,EAAE,IAAA,gBAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE;4BAC1C,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;4BACpC,KAAK,EAAE,EAAE;4BACT,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;yBAC5C,CAAC,EAAA;;wBAPF,SAOE,CAAC;wBAEG,KAAiB,MAAM,CAAC,sBAAsB,EAAE,EAA9C,IAAI,UAAA,EAAE,IAAI,UAAA,CAAqC;wBACvD,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,KAAK,EACT,OAAO,EAAE,MAAM,CAAC,cAAc,KAAI,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,CAAA,IAAI,UAAU,EACvE,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,KAAK,OAAA,EAAE,EAAE,CAAC,CAAC;;;;;KAC1D;IAEK,2BAAU,GAAhB,UAAiB,KAAa;;;;;;;wBACtB,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBACnD,oBAAoB,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;;;;wBAEzC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACR,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAA;;wBAAvE,UAAU,GAAG,SAA0D;wBAC7E,IAAI,UAAU,EAAE;4BACd,sBAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,EAAC;yBACvE;wBAEK,WAAW,GAAG,IAAI,0BAAW,EAAE,CAAC;wBAChC,oBAAoB,GAAG,IAAA,iDAAkC,GAAE,CAAC;wBAClE,IAAI,CAAC,oBAAoB,EAAE;4BACzB,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;yBACH;wBACK,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC;wBAE1C,KAAK,GAAG,eAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;wBAC5C,cAAc,GAAG,IAAA,gBAAM,GAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAClC,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAA;;wBAArE,MAAM,GAAG,SAA4D;6BACrE,MAAM,EAAN,wBAAM;wBACR,MAAM,yBACD,MAAM,KACT,KAAK,OAAA,EACL,cAAc,gBAAA,GACf,CAAC;wBACF,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAA;;wBAAtC,SAAsC,CAAC;;;wBAEjC,MAAM,GAAG,IAAI,eAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;wBAClC,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE;gCACtC,KAAK,EAAE,oBAAoB;gCAC3B,KAAK,OAAA;gCACL,cAAc,gBAAA;gCACd,SAAS,EAAE,MAAM;6BAClB,CAAC,EAAA;;wBALF,MAAM,GAAG,SAKP,CAAC;;;wBAGC,KAAiB,MAAM,CAAC,eAAe,CAAC,UAAG,eAAQ,CAAC,IAAI,CAAC,MAAM,oBAAU,KAAK,CAAE,CAAC,EAA/E,IAAI,UAAA,EAAE,IAAI,UAAA,CAAsE;wBACxF,qBAAM,WAAW,CAAC,SAAS,YACzB,EAAE,EAAE,oBAAoB,EACxB,OAAO,EAAE,CAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,OAAO,KAAI,gBAAgB,EACpD,IAAI,MAAA,EACJ,IAAI,MAAA,IACD,MAAM,CAAC,OAAO,EACjB,EAAA;;wBANF,SAME,CAAC;wBAEH,sBAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAC;;;wBAEtB,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;wBAC/F,sBAAO;gCACL,IAAI,EAAE,KAAK;gCACX,KAAK,EAAE,iBAAiB;6BACzB,EAAC;;;;;KAEL;IAEK,6BAAY,GAAlB,UAAmB,KAAa;;;;;;wBAC9B,IAAI,CAAC,KAAK,EAAE;4BACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;yBAC3C;wBAEK,EAAE,GAAG,IAAA,UAAK,GAAE,CAAC;wBACnB,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;wBAA9D,SAA8D,CAAC;;;;;KAChE;IAED;;;OAGG;IACG,iCAAgB,GAAtB,UAAuB,WAA+B;;;;;;;wBAE5C,MAAM,GAAG,IAAA,qCAA6B,GAAE,CAAC,SAAS,EAAE,CAAC;wBACnD,YAAY,GAAK,MAAM,aAAX,CAAY;6BACjB,WAAW,EAAX,wBAAW;wBAAG,qBAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAA;;wBAAtC,KAAA,SAAsC,CAAA;;;wBAAG,KAAA,SAAS,CAAA;;;wBAAzE,MAAM,KAAmE;wBAE/E,IAAI,YAAY,EAAE;4BAChB,IAAI,CAAC,WAAW,EAAE;gCAChB,sBAAO;wCACL,OAAO,EAAE,KAAK;wCACd,KAAK,EAAE,mCAAmC;wCAC1C,YAAY,cAAA;qCACb,EAAC;6BACH;4BACD,IAAI,CAAC,MAAM,EAAE;gCACX,sBAAO;wCACL,OAAO,EAAE,KAAK;wCACd,KAAK,EAAE,mDAAmD;wCAC1D,YAAY,cAAA;qCACb,EAAC;6BACH;yBACF;wBAED,sBAAO;gCACL,OAAO,EAAE,IAAI;gCACb,YAAY,cAAA;gCACZ,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;6BACpC,EAAC;;;wBAEF,sBAAO;gCACL,OAAO,EAAE,KAAK;gCACd,KAAK,EAAE,8BAA8B;6BACtC,EAAC;;;;;KAEL;IAED,wFAAwF;IAC1E,+BAAc,GAA5B,UAA6B,KAAa;;;;;;wBAClC,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;wBACZ,qBAAM,EAAE,CAAC,GAAG,CAAC,aAAM,CAAC,MAAM,EAAE,EAAE,KAAK,OAAA,EAAE,CAAC,EAAA;;wBAA/C,MAAM,GAAG,SAAsC;wBAErD,IAAI,CAAC,MAAM,EAAE;4BACX,sBAAO,IAAI,EAAC;yBACb;wBAEK,WAAW,GAAG,IAAA,gBAAM,GAAE,CAAC;wBAC7B,IAAI,MAAM,CAAC,cAAc,IAAI,IAAA,gBAAM,EAAC,MAAM,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;4BAChF,sBAAO,IAAI,EAAC;yBACb;wBAED,sBAAO,MAAM,EAAC;;;;KACf;IACH,aAAC;AAAD,CAAC,AAtMD,IAsMC;AAtMY,wBAAM"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Signup.test.d.ts","sourceRoot":"","sources":["../../test/Signup.test.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
var user_1 = require("@proteinjs/user");
|
|
4
|
+
var Signup_1 = require("../src/services/Signup");
|
|
5
|
+
var setUser = function (roles) {
|
|
6
|
+
user_1.UserAuth.userRepo = {
|
|
7
|
+
getUser: function () { return ({ email: 'user@test.local', roles: roles }); },
|
|
8
|
+
};
|
|
9
|
+
};
|
|
10
|
+
var canAccess = function (methodName) {
|
|
11
|
+
var signup = new Signup_1.Signup();
|
|
12
|
+
return signup.serviceMetadata.auth.canAccess(methodName, []);
|
|
13
|
+
};
|
|
14
|
+
describe('Signup service auth', function () {
|
|
15
|
+
afterEach(function () {
|
|
16
|
+
user_1.UserAuth.userRepo = undefined;
|
|
17
|
+
});
|
|
18
|
+
it('denies sendInvite and revokeInvite to a non-admin', function () {
|
|
19
|
+
setUser([]);
|
|
20
|
+
expect(canAccess('sendInvite')).toBe(false);
|
|
21
|
+
expect(canAccess('revokeInvite')).toBe(false);
|
|
22
|
+
});
|
|
23
|
+
it('allows sendInvite and revokeInvite for an admin', function () {
|
|
24
|
+
setUser(['admin']);
|
|
25
|
+
expect(canAccess('sendInvite')).toBe(true);
|
|
26
|
+
expect(canAccess('revokeInvite')).toBe(true);
|
|
27
|
+
});
|
|
28
|
+
it('keeps the signup flow itself open (createUser / initializeSignup)', function () {
|
|
29
|
+
setUser([]);
|
|
30
|
+
expect(canAccess('createUser')).toBe(true);
|
|
31
|
+
expect(canAccess('initializeSignup')).toBe(true);
|
|
32
|
+
});
|
|
33
|
+
});
|
|
34
|
+
//# sourceMappingURL=Signup.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"Signup.test.js","sourceRoot":"","sources":["../../test/Signup.test.ts"],"names":[],"mappings":";;AAAA,wCAA2C;AAC3C,iDAAgD;AAiBhD,IAAM,OAAO,GAAG,UAAC,KAAe;IAC7B,eAAyC,CAAC,QAAQ,GAAG;QACpD,OAAO,EAAE,cAAM,OAAA,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,OAAA,EAAE,CAAC,EAArC,CAAqC;KACrD,CAAC;AACJ,CAAC,CAAC;AAEF,IAAM,SAAS,GAAG,UAAC,UAAkB;IACnC,IAAM,MAAM,GAAG,IAAI,eAAM,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC,CAAC;AAEF,QAAQ,CAAC,qBAAqB,EAAE;IAC9B,SAAS,CAAC;QACP,eAAyC,CAAC,QAAQ,GAAG,SAAS,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE;QACtD,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE;QACpD,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACnB,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE;QACtE,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@proteinjs/user-server",
|
|
3
|
-
"version": "1.4.
|
|
3
|
+
"version": "1.4.4",
|
|
4
4
|
"description": "User server components",
|
|
5
5
|
"publishConfig": {
|
|
6
6
|
"access": "public"
|
|
@@ -18,16 +18,17 @@
|
|
|
18
18
|
"scripts": {
|
|
19
19
|
"clean": "rm -rf dist/ generated/ node_modules/",
|
|
20
20
|
"build": "reflection-build && tsc",
|
|
21
|
-
"watch": "reflection-watch"
|
|
21
|
+
"watch": "reflection-watch",
|
|
22
|
+
"test": "jest --passWithNoTests"
|
|
22
23
|
},
|
|
23
24
|
"dependencies": {
|
|
24
|
-
"@proteinjs/db": "^1.25.
|
|
25
|
+
"@proteinjs/db": "^1.25.2",
|
|
25
26
|
"@proteinjs/email-server": "^1.2.18",
|
|
26
27
|
"@proteinjs/logger": "^1.0.21",
|
|
27
28
|
"@proteinjs/reflection": "^1.1.12",
|
|
28
29
|
"@proteinjs/server": "^3.1.12",
|
|
29
30
|
"@proteinjs/server-api": "^3.0.10",
|
|
30
|
-
"@proteinjs/user": "^1.5.
|
|
31
|
+
"@proteinjs/user": "^1.5.14",
|
|
31
32
|
"crypto-js": "4.0.0",
|
|
32
33
|
"express-session": "1.17.1",
|
|
33
34
|
"moment": "2.29.4"
|
|
@@ -36,12 +37,15 @@
|
|
|
36
37
|
"@proteinjs/reflection-build": "^1.4.10",
|
|
37
38
|
"@types/crypto-js": "4.0.1",
|
|
38
39
|
"@types/express-session": "1.17.0",
|
|
40
|
+
"@types/jest": "29.5.5",
|
|
39
41
|
"@types/node": "14.0.13",
|
|
40
42
|
"@typescript-eslint/eslint-plugin": "7.8.0",
|
|
41
43
|
"@typescript-eslint/parser": "7.8.0",
|
|
42
44
|
"eslint": "8.57.0",
|
|
43
45
|
"eslint-config-prettier": "9.1.0",
|
|
44
46
|
"eslint-plugin-prettier": "5.1.3",
|
|
47
|
+
"jest": "29.7.0",
|
|
48
|
+
"ts-jest": "29.1.1",
|
|
45
49
|
"typescript": "5.2.2"
|
|
46
50
|
},
|
|
47
51
|
"main": "./dist/generated/index.js",
|
package/src/services/Signup.ts
CHANGED
|
@@ -44,8 +44,11 @@ export class Signup implements SignupService {
|
|
|
44
44
|
public serviceMetadata = {
|
|
45
45
|
auth: {
|
|
46
46
|
canAccess: (methodName: string, args: any[]) => {
|
|
47
|
+
// Admin-only invite management. This previously evaluated hasRole WITHOUT returning it,
|
|
48
|
+
// which made sendInvite/revokeInvite effectively public — any caller (even logged out)
|
|
49
|
+
// could mint themselves a valid signup token and bypass invite-only signup.
|
|
47
50
|
if (methodName === 'sendInvite' || methodName === 'revokeInvite') {
|
|
48
|
-
UserAuth.hasRole('admin');
|
|
51
|
+
return UserAuth.hasRole('admin');
|
|
49
52
|
}
|
|
50
53
|
|
|
51
54
|
return true;
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
import { UserAuth } from '@proteinjs/user';
|
|
2
|
+
import { Signup } from '../src/services/Signup';
|
|
3
|
+
|
|
4
|
+
/**
|
|
5
|
+
* Covers the SignupService auth gate. The invite-management methods are the door into
|
|
6
|
+
* invite-only signup: `sendInvite` mints a valid signup token (as system), so if it is callable
|
|
7
|
+
* by non-admins, ANYONE can invite themselves and bypass invite-only signup entirely.
|
|
8
|
+
*
|
|
9
|
+
* Regression under test: `canAccess` evaluated `UserAuth.hasRole('admin')` for
|
|
10
|
+
* sendInvite/revokeInvite but DISCARDED the result and returned true unconditionally —
|
|
11
|
+
* making both methods effectively public.
|
|
12
|
+
*
|
|
13
|
+
* `UserAuth` reads from a static repo; tests stub it directly per identity — no server needed
|
|
14
|
+
* (same pattern as @proteinjs/db's TableServiceAuth.test.ts).
|
|
15
|
+
*/
|
|
16
|
+
|
|
17
|
+
type UserAuthInternals = { userRepo?: { getUser: () => { email: string; roles: string[] } } };
|
|
18
|
+
|
|
19
|
+
const setUser = (roles: string[]) => {
|
|
20
|
+
(UserAuth as unknown as UserAuthInternals).userRepo = {
|
|
21
|
+
getUser: () => ({ email: 'user@test.local', roles }),
|
|
22
|
+
};
|
|
23
|
+
};
|
|
24
|
+
|
|
25
|
+
const canAccess = (methodName: string) => {
|
|
26
|
+
const signup = new Signup();
|
|
27
|
+
return signup.serviceMetadata.auth.canAccess(methodName, []);
|
|
28
|
+
};
|
|
29
|
+
|
|
30
|
+
describe('Signup service auth', () => {
|
|
31
|
+
afterEach(() => {
|
|
32
|
+
(UserAuth as unknown as UserAuthInternals).userRepo = undefined;
|
|
33
|
+
});
|
|
34
|
+
|
|
35
|
+
it('denies sendInvite and revokeInvite to a non-admin', () => {
|
|
36
|
+
setUser([]);
|
|
37
|
+
expect(canAccess('sendInvite')).toBe(false);
|
|
38
|
+
expect(canAccess('revokeInvite')).toBe(false);
|
|
39
|
+
});
|
|
40
|
+
|
|
41
|
+
it('allows sendInvite and revokeInvite for an admin', () => {
|
|
42
|
+
setUser(['admin']);
|
|
43
|
+
expect(canAccess('sendInvite')).toBe(true);
|
|
44
|
+
expect(canAccess('revokeInvite')).toBe(true);
|
|
45
|
+
});
|
|
46
|
+
|
|
47
|
+
it('keeps the signup flow itself open (createUser / initializeSignup)', () => {
|
|
48
|
+
setUser([]);
|
|
49
|
+
expect(canAccess('createUser')).toBe(true);
|
|
50
|
+
expect(canAccess('initializeSignup')).toBe(true);
|
|
51
|
+
});
|
|
52
|
+
});
|