@proteinjs/user-server 1.7.0 → 1.9.0

package/test/Signup.test.ts

@@ -61,9 +61,11 @@ describe('Signup service auth', () => {
     expect(canAccess('revokeInvite')).toBe(true);
   });
 
-  it('keeps the signup flow itself open (createUser / initializeSignup)', () => {
+  it('keeps the pre-submit signup flow open (initializeSignup)', () => {
+    // Account creation itself is no longer RPC-reachable — it moved to the signup ROUTE
+    // (src/routes/signup.ts, covered by SignupRoute.test.ts), which establishes the session
+    // in the same request (auto-login).
     setUser([]);
-    expect(canAccess('createUser')).toBe(true);
     expect(canAccess('initializeSignup')).toBe(true);
   });
 });

package/test/SignupRoute.test.ts

@@ -0,0 +1,219 @@
+import moment from 'moment';
+
+/**
+ * `POST /user/signup` — signup with auto-login. Signup used to be an RPC service, and services
+ * never see the request, so the client was bounced to the login form to type the credentials it
+ * had JUST submitted. Session establishment is a request-level concern; signup now lives at the
+ * route layer beside its siblings (login, dev login) and mints the session through the same
+ * single owner (`establishSession`) in the same request.
+ *
+ * Covered here, outcomes only (rows written, session minted), against the Spanner emulator:
+ * - plain signup: account row created, session established in the same request;
+ * - invited signup: email resolved from the invite, invite consumed, session established;
+ * - already-registered email: response body indistinguishable from success, but NO session —
+ *   auto-login must never hand out a session for an account the caller didn't just create;
+ * - invalid token / invite-only violations: honest error, no session, no account row.
+ *
+ * The email transport is stubbed at the module boundary (SignupInvite.test.ts pattern); the db
+ * stays real.
+ */
+
+const sendEmail = jest.fn();
+
+jest.mock('@proteinjs/email-server', () => ({
+  EmailSender: jest.fn().mockImplementation(() => ({ sendEmail })),
+  getDefaultInviteEmailConfigFactory: () => ({
+    getConfig: () => ({ getEmailContent: () => ({ text: 'invite', html: '<p>invite</p>' }) }),
+  }),
+  getDefaultSignupConfirmationEmailConfigFactory: () => ({
+    getConfig: () => ({
+      getNewUserEmailContent: () => ({ text: 'welcome', html: '<p>welcome</p>' }),
+      getExistingUserEmailContent: () => ({ text: 'exists', html: '<p>exists</p>' }),
+    }),
+  }),
+}));
+
+import { getDbAsSystem } from '@proteinjs/db';
+import { SourceRepository } from '@proteinjs/reflection';
+import { tables } from '@proteinjs/user';
+import { signup } from '../src/routes/signup';
+import { createPassportRequest } from './passportSessionHarness';
+import { UserServerTestEnvironment } from './UserServerTestEnvironment';
+
+const testEnv = new UserServerTestEnvironment();
+
+const INVITE_CONFIG_KEY = '@proteinjs/user-server/DefaultInviteConfigFactory';
+
+type ObjectCache = { objectCache: Record<string, unknown[]> };
+
+/** Seed the invite-config lookup (tests don't load the generated source graph). */
+const setInviteConfig = (factories: unknown[]) => {
+  (SourceRepository.get() as unknown as ObjectCache).objectCache[INVITE_CONFIG_KEY] = factories;
+};
+
+type RouteOutcome = {
+  loggedInAs?: string;
+  /**
+   * 'regenerate' / 'login' / 'save' in call order — recorded by the REAL passport 0.6 login
+   * machinery (see passportSessionHarness): regenerate FIRST (a fresh session id on privilege
+   * change, so an attacker-planted pre-auth sid never survives signup/login: session fixation),
+   * then the bind of the account onto the fresh session, then save (the row must commit before
+   * the response). Exactly one of each — a wrapper-level regenerate or save around
+   * `request.login` would double up and break the single-owner contract.
+   */
+  sessionEvents: string[];
+  status?: number;
+  body?: { error?: string };
+};
+
+const invokeSignup = async (body: Record<string, unknown>): Promise<RouteOutcome> => {
+  const { request, events } = await createPassportRequest({ body });
+  const outcome: RouteOutcome = { sessionEvents: events };
+  const response = {
+    status(code: number) {
+      outcome.status = code;
+      return this;
+    },
+    send(body?: unknown) {
+      outcome.body = body as RouteOutcome['body'];
+    },
+  };
+  await signup.onRequest(request as never, response as never);
+  // The OUTCOME of establishment: the account email bound onto the (post-regeneration) session.
+  outcome.loggedInAs = request.session.passport?.user;
+  return outcome;
+};
+
+const getUserRow = async (email: string) => await getDbAsSystem().get(tables.User, { email });
+const userRowCount = async (email: string) => (await getDbAsSystem().query(tables.User, { email })).length;
+
+describe('signup route — auto-login after signup', () => {
+  beforeAll(async () => {
+    await testEnv.beforeAll();
+    setInviteConfig([]); // default config: invite optional
+  }, 120000);
+
+  afterAll(async () => {
+    await testEnv.afterAll();
+  });
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    setInviteConfig([]);
+    const db = getDbAsSystem();
+    await db.delete(tables.Invite, {});
+    await db.delete(tables.User, {});
+  });
+
+  it('plain signup creates the account and establishes the session in the same request', async () => {
+    const outcome = await invokeSignup({
+      name: 'Plain Signup',
+      email: 'Signup.Plain@Test.local',
+      password: 'pw-plain-1',
+    });
+
+    expect(outcome.body).toEqual({});
+    expect(outcome.loggedInAs).toBe('signup.plain@test.local');
+    // Fresh id on privilege change (fixation), then login, then commit-before-response (the
+    // client's follow-up navigation must never race the store write and land on /login).
+    expect(outcome.sessionEvents).toEqual(['regenerate', 'login', 'save']);
+
+    const created = await getUserRow('signup.plain@test.local');
+    expect(created).toBeDefined();
+    // At-rest contract: argon2id from the first write (the per-login-migration KDF stores
+    // new credentials as argon2id directly — never a legacy sha256 row).
+    expect(created!.password).toMatch(/^\$argon2id\$/);
+    expect(created!.password).not.toContain('pw-plain-1');
+    expect(created!.emailVerified).toBe(false);
+    expect(created!.roles).toEqual([]);
+    expect(sendEmail).toHaveBeenCalledTimes(1); // welcome email still goes out
+  });
+
+  it('invited signup resolves the email from the invite, consumes it, and establishes the session', async () => {
+    const db = getDbAsSystem();
+    await db.insert(tables.Invite, {
+      email: 'invited@test.local',
+      token: 'invite-token-1',
+      tokenExpiresAt: moment().add(1, 'day'),
+      invitedBy: 'inviter-1',
+    });
+
+    const outcome = await invokeSignup({
+      name: 'Invited Signup',
+      password: 'pw-invited-1',
+      token: 'invite-token-1',
+    });
+
+    expect(outcome.body).toEqual({});
+    expect(outcome.loggedInAs).toBe('invited@test.local');
+    expect(outcome.sessionEvents).toEqual(['regenerate', 'login', 'save']);
+
+    const created = await getUserRow('invited@test.local');
+    expect(created).toBeDefined();
+    expect(created!.emailVerified).toBe(true); // the email came from the invite record
+    expect(created!.invitedBy).toBe('inviter-1');
+    expect(await db.get(tables.Invite, { token: 'invite-token-1' })).toBeUndefined();
+  });
+
+  it('an already-registered email answers indistinguishably but mints NO session', async () => {
+    await testEnv.createUser({ name: 'Existing User', email: 'existing@test.local' });
+
+    const outcome = await invokeSignup({
+      name: 'Existing User',
+      email: 'existing@test.local',
+      password: 'pw-existing-1',
+    });
+
+    // The response body must be exactly the success shape (anti-enumeration: existence is
+    // reported to the mailbox owner by email, never to the caller)...
+    expect(outcome.body).toEqual({});
+    // ...but auto-login must never mint a session for an account the caller didn't just create.
+    expect(outcome.loggedInAs).toBeUndefined();
+    expect(outcome.sessionEvents).toEqual([]);
+
+    expect(await userRowCount('existing@test.local')).toBe(1);
+    const existing = await getUserRow('existing@test.local');
+    expect(existing!.password).toBe('test'); // untouched — seeded by testEnv.createUser
+    expect(sendEmail).toHaveBeenCalledTimes(1); // "account already exists" email
+  });
+
+  it('an unknown invite token gets the honest error — no session, no account', async () => {
+    const outcome = await invokeSignup({
+      name: 'Token Guess',
+      password: 'pw-guess-1',
+      token: 'never-existed',
+    });
+
+    expect(outcome.body?.error).toMatch(/no longer valid/i);
+    expect(outcome.loggedInAs).toBeUndefined();
+    expect(outcome.sessionEvents).toEqual([]);
+    expect((await getDbAsSystem().query(tables.User, {})).length).toBe(0);
+  });
+
+  it('invite-only mode refuses a tokenless signup — no session, no account', async () => {
+    setInviteConfig([{ getConfig: () => ({ isInviteOnly: true }) }]);
+
+    const outcome = await invokeSignup({
+      name: 'No Invite',
+      email: 'no.invite@test.local',
+      password: 'pw-noinvite-1',
+    });
+
+    expect(outcome.body?.error).toMatch(/invite is required/i);
+    expect(outcome.loggedInAs).toBeUndefined();
+    expect(outcome.sessionEvents).toEqual([]);
+    expect(await getUserRow('no.invite@test.local')).toBeUndefined();
+  });
+
+  it('a blank name or password is refused before any write', async () => {
+    const missingName = await invokeSignup({ email: 'blank@test.local', password: 'pw-blank-1' });
+    expect(missingName.body?.error).toBeTruthy();
+    expect(missingName.sessionEvents).toEqual([]);
+
+    const missingPassword = await invokeSignup({ name: 'Blank', email: 'blank@test.local' });
+    expect(missingPassword.body?.error).toBeTruthy();
+    expect(missingPassword.sessionEvents).toEqual([]);
+
+    expect(await getUserRow('blank@test.local')).toBeUndefined();
+  });
+});

package/test/UserStatusGate.integration.test.ts

@@ -0,0 +1,68 @@
+import sha256 from 'crypto-js/sha256';
+import { getDbAsSystem } from '@proteinjs/db';
+import { tables } from '@proteinjs/user';
+import { authenticate } from '../src/authentication/authenticate';
+import { userCache } from '../src/authorization/userCache';
+import { UserServerTestEnvironment } from './UserServerTestEnvironment';
+
+const testEnv = new UserServerTestEnvironment();
+
+/**
+ * The deactivation gate, both halves, asserted on outcomes against the emulator:
+ * - login half (authenticate): correct credentials on a deactivated account are refused;
+ * - session half (userCache): the session cache is rebuilt per request, so a live session stops
+ *   resolving the moment its account is deactivated — requests run as the unauthenticated guest.
+ */
+describe('user status gate — login refusal and session resolution', () => {
+  beforeAll(async () => {
+    await testEnv.beforeAll();
+  }, 120000);
+
+  afterAll(async () => {
+    await testEnv.afterAll();
+  });
+
+  /** Insert an account the way the product stores it: lowercased email, sha256 password. */
+  const createAccount = async (email: string, password: string, status?: 'active' | 'deactivated') => {
+    return await getDbAsSystem().insert(tables.User, {
+      name: 'Gate test user',
+      email,
+      password: sha256(password).toString(),
+      emailVerified: true,
+      roles: [],
+      ...(status ? { status } : {}),
+    });
+  };
+
+  it('refuses login for a deactivated account even with correct credentials', async () => {
+    await createAccount('deactivated-login@test.local', 'correct-password', 'deactivated');
+
+    const result = await authenticate('deactivated-login@test.local', 'correct-password');
+
+    expect(result).toBe('This account has been deactivated');
+  });
+
+  it('logs an active account in unaffected', async () => {
+    await createAccount('active-login@test.local', 'correct-password');
+
+    expect(await authenticate('active-login@test.local', 'correct-password')).toBe(true);
+    expect(await authenticate('active-login@test.local', 'wrong-password')).toBe('User name or password incorrect');
+  });
+
+  it('stops resolving a live session once its user is deactivated, and resumes on reactivation', async () => {
+    const account = await createAccount('live-session@test.local', 'correct-password');
+
+    const before = await userCache.create('live-session', 'live-session@test.local');
+    expect(before.id).toBe(account.id);
+    expect(before.email).toBe('live-session@test.local');
+
+    await getDbAsSystem().update(tables.User, { id: account.id, status: 'deactivated' });
+    const during = await userCache.create('live-session', 'live-session@test.local');
+    expect(during.id).toBe('guest');
+    expect(during.roles).toEqual([]);
+
+    await getDbAsSystem().update(tables.User, { id: account.id, status: 'active' });
+    const after = await userCache.create('live-session', 'live-session@test.local');
+    expect(after.id).toBe(account.id);
+  });
+});

package/test/ValidateResetToken.test.ts

@@ -0,0 +1,86 @@
+import moment from 'moment';
+import { getDbAsSystem } from '@proteinjs/db';
+import { tables } from '@proteinjs/user';
+import { validateResetPasswordToken } from '../src/routes/validateResetPasswordToken';
+import { UserServerTestEnvironment } from './UserServerTestEnvironment';
+
+const testEnv = new UserServerTestEnvironment();
+
+/**
+ * `GET /user/validate-reset-token`. Beyond the valid/expired/unknown verdicts, the valid
+ * response carries the account EMAIL: the reset page renders it as the read-only
+ * `autocomplete="username"` field so password managers can associate the updated password
+ * with the stored credential. The email only ever rides a VALID token's response — the
+ * token was delivered to that very inbox, so it reveals nothing the holder doesn't know —
+ * while invalid/expired verdicts stay email-free (no account-probing oracle).
+ */
+
+type RouteOutcome = { status?: number; body?: any };
+
+const invokeValidate = async (query: Record<string, unknown>): Promise<RouteOutcome> => {
+  const outcome: RouteOutcome = {};
+  const response = {
+    status(code: number) {
+      outcome.status = code;
+      return this;
+    },
+    send(body?: unknown) {
+      outcome.body = body;
+    },
+  };
+  await validateResetPasswordToken.onRequest({ query } as never, response as never);
+  return outcome;
+};
+
+const armResetToken = async (email: string, token: string, expiration: moment.Moment) => {
+  const user = await testEnv.createUser({ name: 'Reset User', email });
+  await getDbAsSystem().update(tables.User, {
+    id: user.id,
+    passwordResetToken: token,
+    passwordResetTokenExpiration: expiration,
+  });
+};
+
+describe('validateResetPasswordToken route', () => {
+  beforeAll(async () => {
+    await testEnv.beforeAll();
+  });
+
+  afterAll(async () => {
+    await testEnv.afterAll();
+  });
+
+  it('a valid token resolves isValid WITH the account email (the reset form identifier)', async () => {
+    await armResetToken('reset-valid@test.local', 'tok-valid-1', moment().add(1, 'hour'));
+
+    const outcome = await invokeValidate({ token: 'tok-valid-1' });
+
+    expect(outcome.status).toBe(200);
+    expect(outcome.body).toEqual({ isValid: true, email: 'reset-valid@test.local' });
+  });
+
+  it('an expired token resolves invalid and leaks no email', async () => {
+    await armResetToken('reset-expired@test.local', 'tok-expired-1', moment().subtract(1, 'minute'));
+
+    const outcome = await invokeValidate({ token: 'tok-expired-1' });
+
+    expect(outcome.status).toBe(200);
+    expect(outcome.body.isValid).toBe(false);
+    expect(outcome.body.email).toBeUndefined();
+  });
+
+  it('an unknown token resolves invalid and leaks no email', async () => {
+    const outcome = await invokeValidate({ token: 'tok-never-issued' });
+
+    expect(outcome.status).toBe(200);
+    expect(outcome.body.isValid).toBe(false);
+    expect(outcome.body.email).toBeUndefined();
+  });
+
+  it('a missing token is a 400', async () => {
+    const outcome = await invokeValidate({});
+
+    expect(outcome.status).toBe(400);
+    expect(outcome.body.isValid).toBe(false);
+  });
+});

package/test/passportSessionHarness.ts

@@ -0,0 +1,58 @@
+import passport from 'passport';
+
+/** Session-lifecycle events in call order — the session-establishment contract under test. */
+export type SessionEvent = 'regenerate' | 'login' | 'save';
+
+export type PassportRequest = {
+  /** Express-shaped request whose `login`/`logout` are REAL passport machinery. */
+  request: any;
+  /**
+   * 'regenerate' / 'login' / 'save' in call order. The full contract of session establishment:
+   * regenerate FIRST (a fresh session id on privilege change — session fixation), then the bind
+   * of the account onto the fresh session, then save (the row must commit before the response).
+   */
+  events: SessionEvent[];
+};
+
+/**
+ * Builds a request whose `request.login` / `request.logout` are the GENUINE passport 0.6
+ * machinery, wired through `authenticator.initialize()` — the same middleware the server runs —
+ * over an express-session-shaped session mock.
+ *
+ * Why real passport and not a hand-mocked `login`: since passport 0.6 (the CVE-2022-25896
+ * session-fixation fix), the regenerate and the commit-before-response save live INSIDE
+ * `request.login` (SessionManager.logIn: regenerate → serializeUser → bind → save). A mocked
+ * `login` would assert nothing about either — the door suites must drive the real owner to
+ * prove the doors inherit the contract.
+ *
+ * serializeUser mirrors @proteinjs/server's identity pass-through (the session stores the
+ * account email directly), instrumented to record the bind ('login') between 'regenerate' and
+ * 'save'. The session mock replicates the one express-session behavior passport depends on:
+ * `regenerate` REPLACES `request.session` with a fresh session (new id, no passport state), so
+ * the bind provably lands on the post-regeneration session.
+ */
+export const createPassportRequest = async (extra: Record<string, unknown> = {}): Promise<PassportRequest> => {
+  const events: SessionEvent[] = [];
+  const authenticator = new passport.Passport();
+  authenticator.serializeUser((user: unknown, done: (err: unknown, id?: unknown) => void) => {
+    events.push('login');
+    done(null, user);
+  });
+
+  const request: any = { ...extra };
+  const makeSession = (): any => ({
+    regenerate: (done: (err?: unknown) => void) => {
+      events.push('regenerate');
+      request.session = makeSession();
+      done();
+    },
+    save: (done: (err?: unknown) => void) => {
+      events.push('save');
+      done();
+    },
+  });
+  request.session = makeSession();
+
+  await new Promise<void>((resolve) => authenticator.initialize()(request, {} as never, () => resolve()));
+  return { request, events };
+};