@tellescope/sdk 1.255.6 → 1.255.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/cjs/tests/api_tests/journey_delete_cancels_actions.test.d.ts +6 -0
- package/lib/cjs/tests/api_tests/journey_delete_cancels_actions.test.d.ts.map +1 -0
- package/lib/cjs/tests/api_tests/journey_delete_cancels_actions.test.js +250 -0
- package/lib/cjs/tests/api_tests/journey_delete_cancels_actions.test.js.map +1 -0
- package/lib/cjs/tests/api_tests/security/register_business_id_injection.test.d.ts +36 -0
- package/lib/cjs/tests/api_tests/security/register_business_id_injection.test.d.ts.map +1 -0
- package/lib/cjs/tests/api_tests/security/register_business_id_injection.test.js +203 -0
- package/lib/cjs/tests/api_tests/security/register_business_id_injection.test.js.map +1 -0
- package/lib/cjs/tests/tests.d.ts.map +1 -1
- package/lib/cjs/tests/tests.js +174 -166
- package/lib/cjs/tests/tests.js.map +1 -1
- package/lib/esm/enduser.d.ts +0 -1
- package/lib/esm/enduser.d.ts.map +1 -1
- package/lib/esm/sdk.d.ts +2 -3
- package/lib/esm/sdk.d.ts.map +1 -1
- package/lib/esm/tests/api_tests/journey_delete_cancels_actions.test.d.ts +6 -0
- package/lib/esm/tests/api_tests/journey_delete_cancels_actions.test.d.ts.map +1 -0
- package/lib/esm/tests/api_tests/journey_delete_cancels_actions.test.js +223 -0
- package/lib/esm/tests/api_tests/journey_delete_cancels_actions.test.js.map +1 -0
- package/lib/esm/tests/api_tests/security/register_business_id_injection.test.d.ts +36 -0
- package/lib/esm/tests/api_tests/security/register_business_id_injection.test.d.ts.map +1 -0
- package/lib/esm/tests/api_tests/security/register_business_id_injection.test.js +196 -0
- package/lib/esm/tests/api_tests/security/register_business_id_injection.test.js.map +1 -0
- package/lib/esm/tests/tests.d.ts.map +1 -1
- package/lib/esm/tests/tests.js +174 -166
- package/lib/esm/tests/tests.js.map +1 -1
- package/lib/tsconfig.tsbuildinfo +1 -1
- package/package.json +6 -6
- package/src/tests/api_tests/journey_delete_cancels_actions.test.ts +152 -0
- package/src/tests/api_tests/security/register_business_id_injection.test.ts +140 -0
- package/src/tests/tests.ts +4 -0
- package/test_generated.pdf +0 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"journey_delete_cancels_actions.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/api_tests/journey_delete_cancels_actions.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAMnC,eAAO,MAAM,oCAAoC;SAAuC,OAAO;iBAAe,OAAO;mBAmGpH,CAAA"}
|
|
@@ -0,0 +1,250 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
18
|
+
var __importStar = (this && this.__importStar) || function (mod) {
|
|
19
|
+
if (mod && mod.__esModule) return mod;
|
|
20
|
+
var result = {};
|
|
21
|
+
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
|
|
22
|
+
__setModuleDefault(result, mod);
|
|
23
|
+
return result;
|
|
24
|
+
};
|
|
25
|
+
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
|
|
26
|
+
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
|
|
27
|
+
return new (P || (P = Promise))(function (resolve, reject) {
|
|
28
|
+
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
|
|
29
|
+
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
|
|
30
|
+
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
|
|
31
|
+
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
32
|
+
});
|
|
33
|
+
};
|
|
34
|
+
var __generator = (this && this.__generator) || function (thisArg, body) {
|
|
35
|
+
var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
|
|
36
|
+
return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
|
|
37
|
+
function verb(n) { return function (v) { return step([n, v]); }; }
|
|
38
|
+
function step(op) {
|
|
39
|
+
if (f) throw new TypeError("Generator is already executing.");
|
|
40
|
+
while (g && (g = 0, op[0] && (_ = 0)), _) try {
|
|
41
|
+
if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
|
|
42
|
+
if (y = 0, t) op = [op[0] & 2, t.value];
|
|
43
|
+
switch (op[0]) {
|
|
44
|
+
case 0: case 1: t = op; break;
|
|
45
|
+
case 4: _.label++; return { value: op[1], done: false };
|
|
46
|
+
case 5: _.label++; y = op[1]; op = [0]; continue;
|
|
47
|
+
case 7: op = _.ops.pop(); _.trys.pop(); continue;
|
|
48
|
+
default:
|
|
49
|
+
if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
|
|
50
|
+
if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
|
|
51
|
+
if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
|
|
52
|
+
if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
|
|
53
|
+
if (t[2]) _.ops.pop();
|
|
54
|
+
_.trys.pop(); continue;
|
|
55
|
+
}
|
|
56
|
+
op = body.call(thisArg, _);
|
|
57
|
+
} catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
|
|
58
|
+
if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
|
|
59
|
+
}
|
|
60
|
+
};
|
|
61
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
62
|
+
exports.journey_delete_cancels_actions_tests = void 0;
|
|
63
|
+
var sdk_1 = require("../../sdk");
|
|
64
|
+
var testing_1 = require("@tellescope/testing");
|
|
65
|
+
var constants_1 = require("@tellescope/constants");
|
|
66
|
+
var host = process.env.API_URL || 'http://localhost:8080';
|
|
67
|
+
var journey_delete_cancels_actions_tests = function (_a) {
|
|
68
|
+
var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
|
|
69
|
+
return __awaiter(void 0, void 0, void 0, function () {
|
|
70
|
+
var journeyId, enduserId, stepId, journey, step, enduser_1, activeAction_1, finishedAction_1, before, expectedReason_1, finishedAfter;
|
|
71
|
+
return __generator(this, function (_b) {
|
|
72
|
+
switch (_b.label) {
|
|
73
|
+
case 0:
|
|
74
|
+
(0, testing_1.log_header)("Journey Delete Cancels Pending Actions Tests");
|
|
75
|
+
_b.label = 1;
|
|
76
|
+
case 1:
|
|
77
|
+
_b.trys.push([1, , 11, 13]);
|
|
78
|
+
return [4 /*yield*/, sdk.api.journeys.createOne({ title: "Cascade Cancel Journey " + Date.now() })];
|
|
79
|
+
case 2:
|
|
80
|
+
journey = _b.sent();
|
|
81
|
+
journeyId = journey.id;
|
|
82
|
+
return [4 /*yield*/, sdk.api.automation_steps.createOne({
|
|
83
|
+
journeyId: journey.id,
|
|
84
|
+
action: { type: 'setEnduserStatus', info: { status: 'Test Status' } },
|
|
85
|
+
events: [{ type: 'onJourneyStart', info: {} }],
|
|
86
|
+
})];
|
|
87
|
+
case 3:
|
|
88
|
+
step = _b.sent();
|
|
89
|
+
stepId = step.id;
|
|
90
|
+
return [4 /*yield*/, sdk.api.endusers.createOne({
|
|
91
|
+
fname: 'Cascade',
|
|
92
|
+
lname: 'Cancel',
|
|
93
|
+
email: 'test-cascade-cancel-' + Date.now() + '@example.com',
|
|
94
|
+
})];
|
|
95
|
+
case 4:
|
|
96
|
+
enduser_1 = _b.sent();
|
|
97
|
+
enduserId = enduser_1.id;
|
|
98
|
+
return [4 /*yield*/, sdk.api.automated_actions.createOne({
|
|
99
|
+
journeyId: journey.id,
|
|
100
|
+
automationStepId: step.id,
|
|
101
|
+
enduserId: enduser_1.id,
|
|
102
|
+
processAfter: Date.now() + 1000000,
|
|
103
|
+
status: 'active',
|
|
104
|
+
event: { type: 'onJourneyStart', info: {} },
|
|
105
|
+
action: { type: 'setEnduserStatus', info: { status: 'Test Status' } },
|
|
106
|
+
})
|
|
107
|
+
// Create a finished action to confirm it is left untouched by the cascade
|
|
108
|
+
];
|
|
109
|
+
case 5:
|
|
110
|
+
activeAction_1 = _b.sent();
|
|
111
|
+
return [4 /*yield*/, sdk.api.automated_actions.createOne({
|
|
112
|
+
journeyId: journey.id,
|
|
113
|
+
automationStepId: step.id,
|
|
114
|
+
enduserId: enduser_1.id,
|
|
115
|
+
processAfter: Date.now() + 1000000,
|
|
116
|
+
status: 'finished',
|
|
117
|
+
event: { type: 'onJourneyStart', info: {} },
|
|
118
|
+
action: { type: 'setEnduserStatus', info: { status: 'Test Status' } },
|
|
119
|
+
})
|
|
120
|
+
// Assert the action starts active
|
|
121
|
+
];
|
|
122
|
+
case 6:
|
|
123
|
+
finishedAction_1 = _b.sent();
|
|
124
|
+
return [4 /*yield*/, sdk.api.automated_actions.getOne(activeAction_1.id)];
|
|
125
|
+
case 7:
|
|
126
|
+
before = _b.sent();
|
|
127
|
+
if (before.status !== 'active') {
|
|
128
|
+
throw new Error("Expected action to start 'active', got '".concat(before.status, "'"));
|
|
129
|
+
}
|
|
130
|
+
console.log("✓ Action is active before journey deletion");
|
|
131
|
+
// Delete the journey — this should cascade cancel the pending action
|
|
132
|
+
return [4 /*yield*/, sdk.api.journeys.deleteOne(journey.id)];
|
|
133
|
+
case 8:
|
|
134
|
+
// Delete the journey — this should cascade cancel the pending action
|
|
135
|
+
_b.sent();
|
|
136
|
+
journeyId = undefined; // already deleted, skip in cleanup
|
|
137
|
+
expectedReason_1 = constants_1.AUTOMATED_ACTION_CANCEL_REASONS.indexOf('Journey Deleted');
|
|
138
|
+
return [4 /*yield*/, pollForResults(function () { return __awaiter(void 0, void 0, void 0, function () {
|
|
139
|
+
var actions, active, finished;
|
|
140
|
+
return __generator(this, function (_a) {
|
|
141
|
+
switch (_a.label) {
|
|
142
|
+
case 0: return [4 /*yield*/, sdk.api.automated_actions.getSome({ filter: { enduserId: enduser_1.id } })];
|
|
143
|
+
case 1:
|
|
144
|
+
actions = _a.sent();
|
|
145
|
+
active = actions.find(function (a) { return a.id === activeAction_1.id; });
|
|
146
|
+
finished = actions.find(function (a) { return a.id === finishedAction_1.id; });
|
|
147
|
+
return [2 /*return*/, { active: active, finished: finished }];
|
|
148
|
+
}
|
|
149
|
+
});
|
|
150
|
+
}); }, function (_a) {
|
|
151
|
+
var active = _a.active;
|
|
152
|
+
return ((active === null || active === void 0 ? void 0 : active.status) === 'cancelled'
|
|
153
|
+
&& (active === null || active === void 0 ? void 0 : active.cancelReason) === expectedReason_1
|
|
154
|
+
&& (active === null || active === void 0 ? void 0 : active.cancelledBy) === sdk.userInfo.id);
|
|
155
|
+
}, 'Active action should be cancelled with Journey Deleted reason and cancelledBy after journey deletion')];
|
|
156
|
+
case 9:
|
|
157
|
+
_b.sent();
|
|
158
|
+
console.log("✓ Active action cancelled with Journey Deleted reason and cancelledBy set to deleting user");
|
|
159
|
+
return [4 /*yield*/, sdk.api.automated_actions.getOne(finishedAction_1.id)];
|
|
160
|
+
case 10:
|
|
161
|
+
finishedAfter = _b.sent();
|
|
162
|
+
if (finishedAfter.status !== 'finished') {
|
|
163
|
+
throw new Error("Expected finished action to remain 'finished', got '".concat(finishedAfter.status, "'"));
|
|
164
|
+
}
|
|
165
|
+
console.log("✓ Finished action left untouched");
|
|
166
|
+
console.log("✅ Journey Delete Cancels Pending Actions tests completed successfully");
|
|
167
|
+
return [3 /*break*/, 13];
|
|
168
|
+
case 11:
|
|
169
|
+
// Cleanup — journey is already deleted if the flow completed
|
|
170
|
+
return [4 /*yield*/, Promise.all([
|
|
171
|
+
enduserId ? sdk.api.endusers.deleteOne(enduserId).catch(function () { }) : undefined,
|
|
172
|
+
stepId ? sdk.api.automation_steps.deleteOne(stepId).catch(function () { }) : undefined,
|
|
173
|
+
journeyId ? sdk.api.journeys.deleteOne(journeyId).catch(function () { }) : undefined,
|
|
174
|
+
])];
|
|
175
|
+
case 12:
|
|
176
|
+
// Cleanup — journey is already deleted if the flow completed
|
|
177
|
+
_b.sent();
|
|
178
|
+
return [7 /*endfinally*/];
|
|
179
|
+
case 13: return [2 /*return*/];
|
|
180
|
+
}
|
|
181
|
+
});
|
|
182
|
+
});
|
|
183
|
+
};
|
|
184
|
+
exports.journey_delete_cancels_actions_tests = journey_delete_cancels_actions_tests;
|
|
185
|
+
var pollForResults = function (fetchFn, evaluateFn, description, intervalMs, maxIterations) {
|
|
186
|
+
if (intervalMs === void 0) { intervalMs = 500; }
|
|
187
|
+
if (maxIterations === void 0) { maxIterations = 30; }
|
|
188
|
+
return __awaiter(void 0, void 0, void 0, function () {
|
|
189
|
+
var lastResult, i;
|
|
190
|
+
return __generator(this, function (_a) {
|
|
191
|
+
switch (_a.label) {
|
|
192
|
+
case 0:
|
|
193
|
+
i = 0;
|
|
194
|
+
_a.label = 1;
|
|
195
|
+
case 1:
|
|
196
|
+
if (!(i < maxIterations)) return [3 /*break*/, 5];
|
|
197
|
+
return [4 /*yield*/, (0, testing_1.wait)(undefined, intervalMs)];
|
|
198
|
+
case 2:
|
|
199
|
+
_a.sent();
|
|
200
|
+
return [4 /*yield*/, fetchFn()];
|
|
201
|
+
case 3:
|
|
202
|
+
lastResult = _a.sent();
|
|
203
|
+
if (evaluateFn(lastResult)) {
|
|
204
|
+
console.log("\u2713 ".concat(description, " - completed after ").concat((i + 1) * intervalMs, "ms"));
|
|
205
|
+
return [2 /*return*/];
|
|
206
|
+
}
|
|
207
|
+
_a.label = 4;
|
|
208
|
+
case 4:
|
|
209
|
+
i++;
|
|
210
|
+
return [3 /*break*/, 1];
|
|
211
|
+
case 5:
|
|
212
|
+
console.log('Final polling result:', lastResult);
|
|
213
|
+
throw new Error("Polling timeout: ".concat(description, " - waited ").concat(maxIterations * intervalMs, "ms"));
|
|
214
|
+
}
|
|
215
|
+
});
|
|
216
|
+
});
|
|
217
|
+
};
|
|
218
|
+
// Allow running this test file independently
|
|
219
|
+
if (require.main === module) {
|
|
220
|
+
console.log("\uD83C\uDF10 Using API URL: ".concat(host));
|
|
221
|
+
var sdk_2 = new sdk_1.Session({ host: host });
|
|
222
|
+
var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
|
|
223
|
+
var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
|
|
224
|
+
var setup_tests;
|
|
225
|
+
return __generator(this, function (_a) {
|
|
226
|
+
switch (_a.label) {
|
|
227
|
+
case 0: return [4 /*yield*/, Promise.resolve().then(function () { return __importStar(require("../setup")); })];
|
|
228
|
+
case 1:
|
|
229
|
+
setup_tests = (_a.sent()).setup_tests;
|
|
230
|
+
return [4 /*yield*/, setup_tests(sdk_2, sdkNonAdmin_1)];
|
|
231
|
+
case 2:
|
|
232
|
+
_a.sent();
|
|
233
|
+
return [4 /*yield*/, (0, exports.journey_delete_cancels_actions_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
|
|
234
|
+
case 3:
|
|
235
|
+
_a.sent();
|
|
236
|
+
return [2 /*return*/];
|
|
237
|
+
}
|
|
238
|
+
});
|
|
239
|
+
}); };
|
|
240
|
+
runTests()
|
|
241
|
+
.then(function () {
|
|
242
|
+
console.log("✅ Journey Delete Cancels Pending Actions test suite completed successfully");
|
|
243
|
+
process.exit(0);
|
|
244
|
+
})
|
|
245
|
+
.catch(function (error) {
|
|
246
|
+
console.error("❌ Journey Delete Cancels Pending Actions test suite failed:", error);
|
|
247
|
+
process.exit(1);
|
|
248
|
+
});
|
|
249
|
+
}
|
|
250
|
+
//# sourceMappingURL=journey_delete_cancels_actions.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"journey_delete_cancels_actions.test.js","sourceRoot":"","sources":["../../../../src/tests/api_tests/journey_delete_cancels_actions.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,iCAAmC;AACnC,+CAAsD;AACtD,mDAAuE;AAEvE,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;AAEpD,IAAM,oCAAoC,GAAG,UAAO,EAA4D;QAA1D,GAAG,SAAA,EAAE,WAAW,iBAAA;;;;;;oBAC3E,IAAA,oBAAU,EAAC,8CAA8C,CAAC,CAAA;;;;oBAQxC,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAA;;oBAA7F,OAAO,GAAG,SAAmF;oBACnG,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;oBAET,qBAAM,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC;4BACpD,SAAS,EAAE,OAAO,CAAC,EAAE;4BACrB,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;4BACrE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;yBAC/C,CAAC,EAAA;;oBAJI,IAAI,GAAG,SAIX;oBACF,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;oBAGA,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC/C,KAAK,EAAE,SAAS;4BAChB,KAAK,EAAE,QAAQ;4BACf,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;yBAC5D,CAAC,EAAA;;oBAJI,YAAU,SAId;oBACF,SAAS,GAAG,SAAO,CAAC,EAAE,CAAA;oBAGD,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC;4BAC7D,SAAS,EAAE,OAAO,CAAC,EAAE;4BACrB,gBAAgB,EAAE,IAAI,CAAC,EAAE;4BACzB,SAAS,EAAE,SAAO,CAAC,EAAE;4BACrB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;4BAClC,MAAM,EAAE,QAAQ;4BAChB,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE;4BAC3C,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;yBACtE,CAAC;wBAEF,0EAA0E;sBAFxE;;oBARI,iBAAe,SAQnB;oBAGqB,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC;4BAC/D,SAAS,EAAE,OAAO,CAAC,EAAE;4BACrB,gBAAgB,EAAE,IAAI,CAAC,EAAE;4BACzB,SAAS,EAAE,SAAO,CAAC,EAAE;4BACrB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;4BAClC,MAAM,EAAE,UAAU;4BAClB,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE;4BAC3C,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;yBACtE,CAAC;wBAEF,kCAAkC;sBAFhC;;oBARI,mBAAiB,SAQrB;oBAGa,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,cAAY,CAAC,EAAE,CAAC,EAAA;;oBAAhE,MAAM,GAAG,SAAuD;oBACtE,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE;wBAC9B,MAAM,IAAI,KAAK,CAAC,kDAA2C,MAAM,CAAC,MAAM,MAAG,CAAC,CAAA;qBAC7E;oBACD,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAA;oBAEzD,qEAAqE;oBACrE,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;oBAD5C,qEAAqE;oBACrE,SAA4C,CAAA;oBAC5C,SAAS,GAAG,SAAS,CAAA,CAAC,mCAAmC;oBAInD,mBAAiB,2CAA+B,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;oBACjF,qBAAM,cAAc,CAClB;;;;4CACkB,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,SAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAA;;wCAAxF,OAAO,GAAG,SAA8E;wCACxF,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,EAAE,KAAK,cAAY,CAAC,EAAE,EAAxB,CAAwB,CAAC,CAAA;wCACpD,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAA,CAAC,IAAI,OAAA,CAAC,CAAC,EAAE,KAAK,gBAAc,CAAC,EAAE,EAA1B,CAA0B,CAAC,CAAA;wCAC9D,sBAAO,EAAE,MAAM,QAAA,EAAE,QAAQ,UAAA,EAAE,EAAA;;;6BAC5B,EACD,UAAC,EAAU;gCAAR,MAAM,YAAA;4BAAO,OAAA,CACd,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,MAAK,WAAW;mCAC3B,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,MAAK,gBAAc;mCACvC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW,MAAK,GAAG,CAAC,QAAQ,CAAC,EAAE,CAC3C;wBAJe,CAIf,EACD,sGAAsG,CACvG,EAAA;;oBAbD,SAaC,CAAA;oBACD,OAAO,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAA;oBAOnF,qBAAM,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,gBAAc,CAAC,EAAE,CAAC,EAAA;;oBAAzE,aAAa,GAAG,SAAyD;oBAC/E,IAAI,aAAa,CAAC,MAAM,KAAK,UAAU,EAAE;wBACvC,MAAM,IAAI,KAAK,CAAC,8DAAuD,aAAa,CAAC,MAAM,MAAG,CAAC,CAAA;qBAChG;oBACD,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAA;oBAE/C,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAA;;;gBAEpF,6DAA6D;gBAC7D,qBAAM,OAAO,CAAC,GAAG,CAAC;wBAChB,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;wBAC7E,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;wBAC/E,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;qBAC9E,CAAC,EAAA;;oBALF,6DAA6D;oBAC7D,SAIE,CAAA;;;;;;CAEL,CAAA;AAnGY,QAAA,oCAAoC,wCAmGhD;AAED,IAAM,cAAc,GAAG,UACrB,OAAyB,EACzB,UAAkC,EAClC,WAAmB,EACnB,UAAgB,EAChB,aAAkB;IADlB,2BAAA,EAAA,gBAAgB;IAChB,8BAAA,EAAA,kBAAkB;;;;;;oBAIT,CAAC,GAAG,CAAC;;;yBAAE,CAAA,CAAC,GAAG,aAAa,CAAA;oBAC/B,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,UAAU,CAAC,EAAA;;oBAAjC,SAAiC,CAAA;oBAEpB,qBAAM,OAAO,EAAE,EAAA;;oBAA5B,UAAU,GAAG,SAAe,CAAA;oBAC5B,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE;wBAC1B,OAAO,CAAC,GAAG,CAAC,iBAAK,WAAW,gCAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,OAAI,CAAC,CAAA;wBAC3E,sBAAM;qBACP;;;oBAPgC,CAAC,EAAE,CAAA;;;oBAUtC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAA;oBAChD,MAAM,IAAI,KAAK,CAAC,2BAAoB,WAAW,uBAAa,aAAa,GAAG,UAAU,OAAI,CAAC,CAAA;;;;CAC5F,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;;wBACS,sFAAa,UAAU,QAAC;;oBAAxC,WAAW,GAAK,CAAA,SAAwB,CAAA,YAA7B;oBACnB,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,4CAAoC,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAhE,SAAgE,CAAA;;;;SACjE,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAA;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,6DAA6D,EAAE,KAAK,CAAC,CAAA;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
import { Session } from "../../../sdk";
|
|
2
|
+
/**
|
|
3
|
+
* Reproduction + regression test for the reported vulnerability:
|
|
4
|
+
*
|
|
5
|
+
* A @wearehackerone.com email "joined" a customer's organization without being invited, and
|
|
6
|
+
* duplicate user records existed for that email — each bound to a different businessId.
|
|
7
|
+
*
|
|
8
|
+
* Root cause: the public `POST /v1/users/register` endpoint. `addPublicEndpoint` accepts an
|
|
9
|
+
* OPTIONAL, caller-supplied `businessId` (routing.ts) and bakes it into the handler's DB. The
|
|
10
|
+
* register handler's only duplicate guard (`DB.users.findOne({ email })`) is therefore scoped to
|
|
11
|
+
* whatever org the caller named, and the subsequent `DB.users.insertOne(...)` stamps that
|
|
12
|
+
* caller-supplied businessId onto a new `accountType: 'Business'` user — bypassing the
|
|
13
|
+
* globalUnique: ['email'] enforcement that only runs in the generic create route.
|
|
14
|
+
*
|
|
15
|
+
* The "victim org" here is the test admin's own org (sdk.userInfo.businessId): an org the
|
|
16
|
+
* anonymous caller was never invited to. The admin is used purely to OBSERVE whether an
|
|
17
|
+
* uninvited user record materialized inside their org (getOne({ email }) is org-scoped and
|
|
18
|
+
* throws when the email is absent from the caller's tenant).
|
|
19
|
+
*
|
|
20
|
+
* Expected results:
|
|
21
|
+
* - VULNERABLE code: the assertions FAIL — the planted user appears inside the victim org,
|
|
22
|
+
* proving the exploit ("EXPLOIT CONFIRMED" in the failure message).
|
|
23
|
+
* - FIXED code: register ignores the caller-supplied businessId (self-signups are created
|
|
24
|
+
* org-less and duplicates are rejected globally), so nothing appears in the victim org and
|
|
25
|
+
* the assertions PASS.
|
|
26
|
+
*
|
|
27
|
+
* Uses unique emails per run (Date.now()) so re-runs never collide on the platform-wide unique
|
|
28
|
+
* email constraint. NOTE: on the FIXED path these registrations create org-less user records
|
|
29
|
+
* that an org-scoped admin cannot delete — harmless residue (unique emails), inherent to the
|
|
30
|
+
* legitimate "root register, no org" signup behavior.
|
|
31
|
+
*/
|
|
32
|
+
export declare const register_business_id_injection_tests: ({ sdk }: {
|
|
33
|
+
sdk: Session;
|
|
34
|
+
sdkNonAdmin: Session;
|
|
35
|
+
}) => Promise<void>;
|
|
36
|
+
//# sourceMappingURL=register_business_id_injection.test.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"register_business_id_injection.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/register_business_id_injection.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAsBtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC;SAA2B,OAAO;iBAAe,OAAO;mBA+DxG,CAAA"}
|
|
@@ -0,0 +1,203 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
|
|
3
|
+
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
|
|
4
|
+
return new (P || (P = Promise))(function (resolve, reject) {
|
|
5
|
+
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
|
|
6
|
+
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
|
|
7
|
+
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
|
|
8
|
+
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
9
|
+
});
|
|
10
|
+
};
|
|
11
|
+
var __generator = (this && this.__generator) || function (thisArg, body) {
|
|
12
|
+
var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
|
|
13
|
+
return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
|
|
14
|
+
function verb(n) { return function (v) { return step([n, v]); }; }
|
|
15
|
+
function step(op) {
|
|
16
|
+
if (f) throw new TypeError("Generator is already executing.");
|
|
17
|
+
while (g && (g = 0, op[0] && (_ = 0)), _) try {
|
|
18
|
+
if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
|
|
19
|
+
if (y = 0, t) op = [op[0] & 2, t.value];
|
|
20
|
+
switch (op[0]) {
|
|
21
|
+
case 0: case 1: t = op; break;
|
|
22
|
+
case 4: _.label++; return { value: op[1], done: false };
|
|
23
|
+
case 5: _.label++; y = op[1]; op = [0]; continue;
|
|
24
|
+
case 7: op = _.ops.pop(); _.trys.pop(); continue;
|
|
25
|
+
default:
|
|
26
|
+
if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
|
|
27
|
+
if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
|
|
28
|
+
if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
|
|
29
|
+
if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
|
|
30
|
+
if (t[2]) _.ops.pop();
|
|
31
|
+
_.trys.pop(); continue;
|
|
32
|
+
}
|
|
33
|
+
op = body.call(thisArg, _);
|
|
34
|
+
} catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
|
|
35
|
+
if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
|
|
36
|
+
}
|
|
37
|
+
};
|
|
38
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
39
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
40
|
+
};
|
|
41
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
42
|
+
exports.register_business_id_injection_tests = void 0;
|
|
43
|
+
require('source-map-support').install();
|
|
44
|
+
var axios_1 = __importDefault(require("axios"));
|
|
45
|
+
var sdk_1 = require("../../../sdk");
|
|
46
|
+
var testing_1 = require("@tellescope/testing");
|
|
47
|
+
var setup_1 = require("../../setup");
|
|
48
|
+
var host = process.env.API_URL || 'http://localhost:8080';
|
|
49
|
+
var post = function (path, body, headers) {
|
|
50
|
+
if (headers === void 0) { headers = {}; }
|
|
51
|
+
return __awaiter(void 0, void 0, void 0, function () {
|
|
52
|
+
var res, err_1;
|
|
53
|
+
var _a, _b;
|
|
54
|
+
return __generator(this, function (_c) {
|
|
55
|
+
switch (_c.label) {
|
|
56
|
+
case 0:
|
|
57
|
+
_c.trys.push([0, 2, , 3]);
|
|
58
|
+
return [4 /*yield*/, axios_1.default.post("".concat(host).concat(path), body, {
|
|
59
|
+
validateStatus: function () { return true; },
|
|
60
|
+
headers: headers,
|
|
61
|
+
})];
|
|
62
|
+
case 1:
|
|
63
|
+
res = _c.sent();
|
|
64
|
+
return [2 /*return*/, { status: res.status, data: res.data }];
|
|
65
|
+
case 2:
|
|
66
|
+
err_1 = _c.sent();
|
|
67
|
+
return [2 /*return*/, { status: (_a = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _a === void 0 ? void 0 : _a.status, data: (_b = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _b === void 0 ? void 0 : _b.data }];
|
|
68
|
+
case 3: return [2 /*return*/];
|
|
69
|
+
}
|
|
70
|
+
});
|
|
71
|
+
});
|
|
72
|
+
};
|
|
73
|
+
/**
|
|
74
|
+
* Reproduction + regression test for the reported vulnerability:
|
|
75
|
+
*
|
|
76
|
+
* A @wearehackerone.com email "joined" a customer's organization without being invited, and
|
|
77
|
+
* duplicate user records existed for that email — each bound to a different businessId.
|
|
78
|
+
*
|
|
79
|
+
* Root cause: the public `POST /v1/users/register` endpoint. `addPublicEndpoint` accepts an
|
|
80
|
+
* OPTIONAL, caller-supplied `businessId` (routing.ts) and bakes it into the handler's DB. The
|
|
81
|
+
* register handler's only duplicate guard (`DB.users.findOne({ email })`) is therefore scoped to
|
|
82
|
+
* whatever org the caller named, and the subsequent `DB.users.insertOne(...)` stamps that
|
|
83
|
+
* caller-supplied businessId onto a new `accountType: 'Business'` user — bypassing the
|
|
84
|
+
* globalUnique: ['email'] enforcement that only runs in the generic create route.
|
|
85
|
+
*
|
|
86
|
+
* The "victim org" here is the test admin's own org (sdk.userInfo.businessId): an org the
|
|
87
|
+
* anonymous caller was never invited to. The admin is used purely to OBSERVE whether an
|
|
88
|
+
* uninvited user record materialized inside their org (getOne({ email }) is org-scoped and
|
|
89
|
+
* throws when the email is absent from the caller's tenant).
|
|
90
|
+
*
|
|
91
|
+
* Expected results:
|
|
92
|
+
* - VULNERABLE code: the assertions FAIL — the planted user appears inside the victim org,
|
|
93
|
+
* proving the exploit ("EXPLOIT CONFIRMED" in the failure message).
|
|
94
|
+
* - FIXED code: register ignores the caller-supplied businessId (self-signups are created
|
|
95
|
+
* org-less and duplicates are rejected globally), so nothing appears in the victim org and
|
|
96
|
+
* the assertions PASS.
|
|
97
|
+
*
|
|
98
|
+
* Uses unique emails per run (Date.now()) so re-runs never collide on the platform-wide unique
|
|
99
|
+
* email constraint. NOTE: on the FIXED path these registrations create org-less user records
|
|
100
|
+
* that an org-scoped admin cannot delete — harmless residue (unique emails), inherent to the
|
|
101
|
+
* legitimate "root register, no org" signup behavior.
|
|
102
|
+
*/
|
|
103
|
+
var register_business_id_injection_tests = function (_a) {
|
|
104
|
+
var sdk = _a.sdk;
|
|
105
|
+
return __awaiter(void 0, void 0, void 0, function () {
|
|
106
|
+
var victimBusinessId, password, termsVersion, email1, before, res1, planted1, injectedIntoVictimOrg, email2, resRoot, resDup, planted2, duplicateInVictimOrg;
|
|
107
|
+
return __generator(this, function (_b) {
|
|
108
|
+
switch (_b.label) {
|
|
109
|
+
case 0:
|
|
110
|
+
(0, testing_1.log_header)("register businessId injection");
|
|
111
|
+
victimBusinessId = sdk.userInfo.businessId;
|
|
112
|
+
password = 'testpassword123!';
|
|
113
|
+
termsVersion = '1';
|
|
114
|
+
email1 = "security+reg-inject-".concat(Date.now(), "@wearehackerone.com");
|
|
115
|
+
return [4 /*yield*/, sdk.api.users.getOne({ email: email1 }).catch(function () { return null; })];
|
|
116
|
+
case 1:
|
|
117
|
+
before = _b.sent();
|
|
118
|
+
(0, testing_1.assert)(before === null, "precondition failed: ".concat(email1, " already present in victim org"), 'precondition: victim org has no such user');
|
|
119
|
+
return [4 /*yield*/, post('/v1/users/register', { email: email1, password: password, termsVersion: termsVersion, businessId: victimBusinessId })];
|
|
120
|
+
case 2:
|
|
121
|
+
res1 = _b.sent();
|
|
122
|
+
console.log(" register(businessId=victim) -> HTTP ".concat(res1.status));
|
|
123
|
+
return [4 /*yield*/, sdk.api.users.getOne({ email: email1 }).catch(function () { return null; })];
|
|
124
|
+
case 3:
|
|
125
|
+
planted1 = _b.sent();
|
|
126
|
+
injectedIntoVictimOrg = !!planted1 && planted1.businessId === victimBusinessId;
|
|
127
|
+
if (!(planted1 === null || planted1 === void 0 ? void 0 : planted1.id)) return [3 /*break*/, 5];
|
|
128
|
+
return [4 /*yield*/, sdk.api.users.deleteOne(planted1.id).catch(function () { })];
|
|
129
|
+
case 4:
|
|
130
|
+
_b.sent();
|
|
131
|
+
_b.label = 5;
|
|
132
|
+
case 5:
|
|
133
|
+
(0, testing_1.assert)(!injectedIntoVictimOrg, "\u274C EXPLOIT CONFIRMED: anonymous POST /v1/users/register with businessId=".concat(victimBusinessId, " created user ")
|
|
134
|
+
+ "".concat(email1, " (accountType=").concat(planted1 === null || planted1 === void 0 ? void 0 : planted1.accountType, ") inside the victim org \u2014 no invite required"), '✅ register ignores caller-supplied businessId — no user injected into victim org');
|
|
135
|
+
return [4 /*yield*/, (0, testing_1.wait)(undefined, 1200)
|
|
136
|
+
// ==================================================================================
|
|
137
|
+
// Scenario 2 — cross-org duplicate for the same email
|
|
138
|
+
// First register with NO businessId (the legitimate "root register, no org" record —
|
|
139
|
+
// the "oldest" account in the report). Then register the SAME email WITH the victim
|
|
140
|
+
// businessId. On vulnerable code the scoped duplicate check misses the org-less record,
|
|
141
|
+
// so a SECOND user record for the same email is created inside the victim org.
|
|
142
|
+
// ==================================================================================
|
|
143
|
+
]; // register endpoint rate-limits ~1/sec per IP
|
|
144
|
+
case 6:
|
|
145
|
+
_b.sent(); // register endpoint rate-limits ~1/sec per IP
|
|
146
|
+
email2 = "security+reg-dup-".concat(Date.now(), "@wearehackerone.com");
|
|
147
|
+
return [4 /*yield*/, post('/v1/users/register', { email: email2, password: password, termsVersion: termsVersion })];
|
|
148
|
+
case 7:
|
|
149
|
+
resRoot = _b.sent();
|
|
150
|
+
console.log(" register(no businessId) -> HTTP ".concat(resRoot.status));
|
|
151
|
+
return [4 /*yield*/, (0, testing_1.wait)(undefined, 1200)];
|
|
152
|
+
case 8:
|
|
153
|
+
_b.sent();
|
|
154
|
+
return [4 /*yield*/, post('/v1/users/register', { email: email2, password: password, termsVersion: termsVersion, businessId: victimBusinessId })];
|
|
155
|
+
case 9:
|
|
156
|
+
resDup = _b.sent();
|
|
157
|
+
console.log(" register(same email, businessId=victim) -> HTTP ".concat(resDup.status));
|
|
158
|
+
return [4 /*yield*/, sdk.api.users.getOne({ email: email2 }).catch(function () { return null; })];
|
|
159
|
+
case 10:
|
|
160
|
+
planted2 = _b.sent();
|
|
161
|
+
duplicateInVictimOrg = !!planted2 && planted2.businessId === victimBusinessId;
|
|
162
|
+
if (!(planted2 === null || planted2 === void 0 ? void 0 : planted2.id)) return [3 /*break*/, 12];
|
|
163
|
+
return [4 /*yield*/, sdk.api.users.deleteOne(planted2.id).catch(function () { })];
|
|
164
|
+
case 11:
|
|
165
|
+
_b.sent();
|
|
166
|
+
_b.label = 12;
|
|
167
|
+
case 12:
|
|
168
|
+
(0, testing_1.assert)(!duplicateInVictimOrg, "\u274C EXPLOIT CONFIRMED: same email ".concat(email2, " registered into a second org \u2014 duplicate user ")
|
|
169
|
+
+ "(accountType=".concat(planted2 === null || planted2 === void 0 ? void 0 : planted2.accountType, ") created in victim org ").concat(victimBusinessId), '✅ register enforces global email uniqueness — no cross-org duplicate created');
|
|
170
|
+
return [2 /*return*/];
|
|
171
|
+
}
|
|
172
|
+
});
|
|
173
|
+
});
|
|
174
|
+
};
|
|
175
|
+
exports.register_business_id_injection_tests = register_business_id_injection_tests;
|
|
176
|
+
// Allow running this test file independently
|
|
177
|
+
if (require.main === module) {
|
|
178
|
+
var sdk_2 = new sdk_1.Session({ host: host });
|
|
179
|
+
var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
|
|
180
|
+
var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
|
|
181
|
+
return __generator(this, function (_a) {
|
|
182
|
+
switch (_a.label) {
|
|
183
|
+
case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
|
|
184
|
+
case 1:
|
|
185
|
+
_a.sent();
|
|
186
|
+
return [4 /*yield*/, (0, exports.register_business_id_injection_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
|
|
187
|
+
case 2:
|
|
188
|
+
_a.sent();
|
|
189
|
+
return [2 /*return*/];
|
|
190
|
+
}
|
|
191
|
+
});
|
|
192
|
+
}); };
|
|
193
|
+
runTests()
|
|
194
|
+
.then(function () {
|
|
195
|
+
console.log("✅ register businessId injection test suite completed successfully");
|
|
196
|
+
process.exit(0);
|
|
197
|
+
})
|
|
198
|
+
.catch(function (error) {
|
|
199
|
+
console.error("❌ register businessId injection test suite failed:", error);
|
|
200
|
+
process.exit(1);
|
|
201
|
+
});
|
|
202
|
+
}
|
|
203
|
+
//# sourceMappingURL=register_business_id_injection.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"register_business_id_injection.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/register_business_id_injection.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,gDAAyB;AACzB,oCAAsC;AACtC,+CAI4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,UAAO,IAAY,EAAE,IAAS,EAAE,OAAoC;IAApC,wBAAA,EAAA,YAAoC;;;;;;;;oBAEjE,qBAAM,eAAK,CAAC,IAAI,CAAC,UAAG,IAAI,SAAG,IAAI,CAAE,EAAE,IAAI,EAAE;4BACnD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4BAC1B,OAAO,SAAA;yBACR,CAAC,EAAA;;oBAHI,GAAG,GAAG,SAGV;oBACF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAA;;;oBAE7C,sBAAO,EAAE,MAAM,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,MAAM,EAAE,IAAI,EAAE,MAAA,KAAG,aAAH,KAAG,uBAAH,KAAG,CAAE,QAAQ,0CAAE,IAAI,EAAE,EAAA;;;;;CAEtE,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACI,IAAM,oCAAoC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAC9D,IAAA,oBAAU,EAAC,+BAA+B,CAAC,CAAA;oBAErC,gBAAgB,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAA;oBAC1C,QAAQ,GAAG,kBAAkB,CAAA;oBAC7B,YAAY,GAAG,GAAG,CAAA;oBAOlB,MAAM,GAAG,8BAAuB,IAAI,CAAC,GAAG,EAAE,wBAAqB,CAAA;oBAEtD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC,EAAA;;oBAAxE,MAAM,GAAG,SAA+D;oBAC9E,IAAA,gBAAM,EAAC,MAAM,KAAK,IAAI,EAAE,+BAAwB,MAAM,mCAAgC,EAAE,2CAA2C,CAAC,CAAA;oBAEvH,qBAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAA,EAAE,YAAY,cAAA,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAAhH,IAAI,GAAG,SAAyG;oBACtH,OAAO,CAAC,GAAG,CAAC,iDAA0C,IAAI,CAAC,MAAM,CAAE,CAAC,CAAA;oBAE9C,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC,EAAA;;oBAA/E,QAAQ,GAAQ,SAA+D;oBAC/E,qBAAqB,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,gBAAgB,CAAA;yBAGhF,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,EAAE,CAAA,EAAZ,wBAAY;oBAAE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,EAAA;;oBAA1D,SAA0D,CAAA;;;oBAE5E,IAAA,gBAAM,EACJ,CAAC,qBAAqB,EACtB,sFAA0E,gBAAgB,mBAAgB;0BACtG,UAAG,MAAM,2BAAiB,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,WAAW,sDAA8C,EACjG,kFAAkF,CACnF,CAAA;oBAED,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC;wBAE3B,qFAAqF;wBACrF,sDAAsD;wBACtD,qFAAqF;wBACrF,oFAAoF;wBACpF,wFAAwF;wBACxF,+EAA+E;wBAC/E,qFAAqF;sBAR1D,CAAC,8CAA8C;;oBAA1E,SAA2B,CAAA,CAAC,8CAA8C;oBASpE,MAAM,GAAG,2BAAoB,IAAI,CAAC,GAAG,EAAE,wBAAqB,CAAA;oBAElD,qBAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAA,EAAE,YAAY,cAAA,EAAE,CAAC,EAAA;;oBAArF,OAAO,GAAG,SAA2E;oBAC3F,OAAO,CAAC,GAAG,CAAC,6CAAsC,OAAO,CAAC,MAAM,CAAE,CAAC,CAAA;oBAEnE,qBAAM,IAAA,cAAI,EAAC,SAAS,EAAE,IAAI,CAAC,EAAA;;oBAA3B,SAA2B,CAAA;oBAEZ,qBAAM,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,UAAA,EAAE,YAAY,cAAA,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAAlH,MAAM,GAAG,SAAyG;oBACxH,OAAO,CAAC,GAAG,CAAC,6DAAsD,MAAM,CAAC,MAAM,CAAE,CAAC,CAAA;oBAE5D,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,IAAI,EAAJ,CAAI,CAAC,EAAA;;oBAA/E,QAAQ,GAAQ,SAA+D;oBAC/E,oBAAoB,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,gBAAgB,CAAA;yBAE/E,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,EAAE,CAAA,EAAZ,yBAAY;oBAAE,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,EAAA;;oBAA1D,SAA0D,CAAA;;;oBAE5E,IAAA,gBAAM,EACJ,CAAC,oBAAoB,EACrB,+CAAmC,MAAM,yDAAiD;0BACtF,uBAAgB,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,WAAW,qCAA2B,gBAAgB,CAAE,EACtF,8EAA8E,CAC/E,CAAA;;;;;CACF,CAAA;AA/DY,QAAA,oCAAoC,wCA+DhD;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,4CAAoC,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAhE,SAAgE,CAAA;;;;SACjE,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAA;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tests.d.ts","sourceRoot":"","sources":["../../../src/tests/tests.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"tests.d.ts","sourceRoot":"","sources":["../../../src/tests/tests.ts"],"names":[],"mappings":"AAg0EA,eAAO,MAAM,kCAAkC,qBAgJ9C,CAAA;AAED,eAAO,MAAM,mCAAmC,qBA2K/C,CAAA;AAGD,eAAO,MAAM,oBAAoB,qBAoHhC,CAAA;AAED,eAAO,MAAM,+BAA+B,qBAsF3C,CAAA;AAID,eAAO,MAAM,0BAA0B,qBAqCtC,CAAA;AAu1FD,eAAO,MAAM,cAAc,qBAqC1B,CAAA;AAotBD,eAAO,MAAM,0BAA0B,qBAmFtC,CAAA;AAqED,eAAO,MAAM,eAAe,qBAmD3B,CAAA;AAED,eAAO,MAAM,oBAAoB,6BAsBhC,CAAA;AAED,eAAO,MAAM,oCAAoC,qBA4pBhD,CAAA;AAED,eAAO,MAAM,mCAAmC,qBAkE/C,CAAA;AAw7CD,eAAO,MAAM,yBAAyB,qBA0DrC,CAAA;AAED,eAAO,MAAM,kBAAkB,qBAmK9B,CAAA;AAED,eAAO,MAAM,sBAAsB,qBA0BlC,CAAA;AAGD,eAAO,MAAM,mBAAmB,qBAmC/B,CAAA;AAED,eAAO,MAAM,gCAAgC,mCA8C5C,CAAA;AAED,eAAO,MAAM,cAAc,qBAwb1B,CAAA;AAGD,eAAO,MAAM,oBAAoB,uBAuBhC,CAAA;AA4wBD,eAAO,MAAM,4BAA4B,qBAoExC,CAAA;AAED,eAAO,MAAM,+BAA+B,qBA4U3C,CAAA;AAED,eAAO,MAAM,gDAAgD,qBAwC5D,CAAA;AAED,eAAO,MAAM,qBAAqB,qBAwIjC,CAAA"}
|