@proteinjs/user-server 1.8.0 → 1.9.1

package/test/ValidateResetToken.test.ts

@@ -0,0 +1,86 @@
+import moment from 'moment';
+import { getDbAsSystem } from '@proteinjs/db';
+import { tables } from '@proteinjs/user';
+import { validateResetPasswordToken } from '../src/routes/validateResetPasswordToken';
+import { UserServerTestEnvironment } from './UserServerTestEnvironment';
+
+const testEnv = new UserServerTestEnvironment();
+
+/**
+ * `GET /user/validate-reset-token`. Beyond the valid/expired/unknown verdicts, the valid
+ * response carries the account EMAIL: the reset page renders it as the read-only
+ * `autocomplete="username"` field so password managers can associate the updated password
+ * with the stored credential. The email only ever rides a VALID token's response — the
+ * token was delivered to that very inbox, so it reveals nothing the holder doesn't know —
+ * while invalid/expired verdicts stay email-free (no account-probing oracle).
+ */
+
+type RouteOutcome = { status?: number; body?: any };
+
+const invokeValidate = async (query: Record<string, unknown>): Promise<RouteOutcome> => {
+  const outcome: RouteOutcome = {};
+  const response = {
+    status(code: number) {
+      outcome.status = code;
+      return this;
+    },
+    send(body?: unknown) {
+      outcome.body = body;
+    },
+  };
+  await validateResetPasswordToken.onRequest({ query } as never, response as never);
+  return outcome;
+};
+
+const armResetToken = async (email: string, token: string, expiration: moment.Moment) => {
+  const user = await testEnv.createUser({ name: 'Reset User', email });
+  await getDbAsSystem().update(tables.User, {
+    id: user.id,
+    passwordResetToken: token,
+    passwordResetTokenExpiration: expiration,
+  });
+};
+
+describe('validateResetPasswordToken route', () => {
+  beforeAll(async () => {
+    await testEnv.beforeAll();
+  });
+
+  afterAll(async () => {
+    await testEnv.afterAll();
+  });
+
+  it('a valid token resolves isValid WITH the account email (the reset form identifier)', async () => {
+    await armResetToken('reset-valid@test.local', 'tok-valid-1', moment().add(1, 'hour'));
+
+    const outcome = await invokeValidate({ token: 'tok-valid-1' });
+
+    expect(outcome.status).toBe(200);
+    expect(outcome.body).toEqual({ isValid: true, email: 'reset-valid@test.local' });
+  });
+
+  it('an expired token resolves invalid and leaks no email', async () => {
+    await armResetToken('reset-expired@test.local', 'tok-expired-1', moment().subtract(1, 'minute'));
+
+    const outcome = await invokeValidate({ token: 'tok-expired-1' });
+
+    expect(outcome.status).toBe(200);
+    expect(outcome.body.isValid).toBe(false);
+    expect(outcome.body.email).toBeUndefined();
+  });
+
+  it('an unknown token resolves invalid and leaks no email', async () => {
+    const outcome = await invokeValidate({ token: 'tok-never-issued' });
+
+    expect(outcome.status).toBe(200);
+    expect(outcome.body.isValid).toBe(false);
+    expect(outcome.body.email).toBeUndefined();
+  });
+
+  it('a missing token is a 400', async () => {
+    const outcome = await invokeValidate({});
+
+    expect(outcome.status).toBe(400);
+    expect(outcome.body.isValid).toBe(false);
+  });
+});

package/test/passportSessionHarness.ts

@@ -0,0 +1,58 @@
+import passport from 'passport';
+
+/** Session-lifecycle events in call order — the session-establishment contract under test. */
+export type SessionEvent = 'regenerate' | 'login' | 'save';
+
+export type PassportRequest = {
+  /** Express-shaped request whose `login`/`logout` are REAL passport machinery. */
+  request: any;
+  /**
+   * 'regenerate' / 'login' / 'save' in call order. The full contract of session establishment:
+   * regenerate FIRST (a fresh session id on privilege change — session fixation), then the bind
+   * of the account onto the fresh session, then save (the row must commit before the response).
+   */
+  events: SessionEvent[];
+};
+
+/**
+ * Builds a request whose `request.login` / `request.logout` are the GENUINE passport 0.6
+ * machinery, wired through `authenticator.initialize()` — the same middleware the server runs —
+ * over an express-session-shaped session mock.
+ *
+ * Why real passport and not a hand-mocked `login`: since passport 0.6 (the CVE-2022-25896
+ * session-fixation fix), the regenerate and the commit-before-response save live INSIDE
+ * `request.login` (SessionManager.logIn: regenerate → serializeUser → bind → save). A mocked
+ * `login` would assert nothing about either — the door suites must drive the real owner to
+ * prove the doors inherit the contract.
+ *
+ * serializeUser mirrors @proteinjs/server's identity pass-through (the session stores the
+ * account email directly), instrumented to record the bind ('login') between 'regenerate' and
+ * 'save'. The session mock replicates the one express-session behavior passport depends on:
+ * `regenerate` REPLACES `request.session` with a fresh session (new id, no passport state), so
+ * the bind provably lands on the post-regeneration session.
+ */
+export const createPassportRequest = async (extra: Record<string, unknown> = {}): Promise<PassportRequest> => {
+  const events: SessionEvent[] = [];
+  const authenticator = new passport.Passport();
+  authenticator.serializeUser((user: unknown, done: (err: unknown, id?: unknown) => void) => {
+    events.push('login');
+    done(null, user);
+  });
+
+  const request: any = { ...extra };
+  const makeSession = (): any => ({
+    regenerate: (done: (err?: unknown) => void) => {
+      events.push('regenerate');
+      request.session = makeSession();
+      done();
+    },
+    save: (done: (err?: unknown) => void) => {
+      events.push('save');
+      done();
+    },
+  });
+  request.session = makeSession();
+
+  await new Promise<void>((resolve) => authenticator.initialize()(request, {} as never, () => resolve()));
+  return { request, events };
+};