@teleporthq/teleport-plugin-next-workflows 0.44.11 → 0.45.0

package/__tests__/auth-session-cost.test.ts

@@ -1,4 +1,5 @@
 /* tslint:disable:no-eval */
+import * as crypto from 'crypto'
 import {
   generateAuthOptionsFile,
   generateSessionProviderWrapper,
@@ -112,6 +113,11 @@ const bootAuthOptions = (auth: UIDLAuthentication) => {
     if (name === 'pg') {
       return { Client: FakeClient }
     }
+    // The refresh fingerprints the stored password hash before it copies the
+    // row onto the token; a stubbed crypto would throw there and drop the role.
+    if (name === 'crypto') {
+      return crypto
+    }
     const provider = (config: unknown) => config
     ;(provider as any).default = provider
     return provider
@@ -190,6 +196,31 @@ describe('sanitizeUser allow-list', () => {
     expect(fields).toContain('id')
   })
 
+  // A sign-in snapshot of the Newsletter's columns goes stale the moment the
+  // person confirms or unsubscribes: pages read the row, never the session.
+  it('keeps the Newsletter status columns off the session', () => {
+    const newsletter = [
+      'newsletter_status',
+      'newsletter_subscribed_at',
+      'newsletter_unsubscribed_at',
+      'newsletter_source',
+    ]
+    const fields = buildSessionUserFields(
+      {
+        users: [
+          ...CANONICAL_USERS_COLUMNS,
+          ...newsletter.map((name) => ({ name, type: 'VARCHAR(32)', nullable: true })),
+        ],
+      },
+      CUSTOM_PROPS
+    )
+    for (const name of newsletter) {
+      expect(fields).not.toContain(name)
+    }
+    expect(fields).toContain('email_unsubscribed')
+    expect(fields).toContain('company')
+  })
+
   it('cannot be re-opened by a custom property named after a credential', () => {
     const fields = buildSessionUserFields(buildAuth().tables, [
       {