@terreno/api 0.0.1

package/dist/auth.test.js

@@ -0,0 +1,778 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var bun_test_1 = require("bun:test");
+var supertest_1 = __importDefault(require("supertest"));
+var api_1 = require("./api");
+var auth_1 = require("./auth");
+var expressServer_1 = require("./expressServer");
+var permissions_1 = require("./permissions");
+var tests_1 = require("./tests");
+var transformers_1 = require("./transformers");
+var utils_1 = require("./utils");
+(0, bun_test_1.describe)("auth tests", function () {
+    var app;
+    var admin;
+    var notAdmin;
+    var agent;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        function addRoutes(router) {
+            router.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                allowAnonymous: true,
+                permissions: {
+                    create: [permissions_1.Permissions.IsAuthenticated],
+                    delete: [permissions_1.Permissions.IsAuthenticated],
+                    list: [permissions_1.Permissions.IsAny],
+                    read: [permissions_1.Permissions.IsAny],
+                    update: [permissions_1.Permissions.IsAuthenticated],
+                },
+                queryFilter: function (user) {
+                    if (!(user === null || user === void 0 ? void 0 : user.admin)) {
+                        return { hidden: { $ne: true } };
+                    }
+                    return {};
+                },
+                transformer: (0, transformers_1.AdminOwnerTransformer)({
+                    adminReadFields: ["name", "calories", "created", "ownerId"],
+                    adminWriteFields: ["name", "calories", "created", "ownerId"],
+                    anonReadFields: ["name"],
+                    anonWriteFields: [],
+                    authReadFields: ["name", "calories", "created"],
+                    authWriteFields: ["name", "calories"],
+                    ownerReadFields: ["name", "calories", "created", "ownerId"],
+                    ownerWriteFields: ["name", "calories", "created"],
+                }),
+            }));
+        }
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    // Reset to real time - don't freeze time here as passport-local-mongoose
+                    // lockout mechanism needs real time to progress
+                    (0, bun_test_1.setSystemTime)();
+                    return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _a = __read.apply(void 0, [_b.sent(), 2]), admin = _a[0], notAdmin = _a[1];
+                    return [4 /*yield*/, Promise.all([
+                            tests_1.FoodModel.create({
+                                calories: 1,
+                                created: new Date(),
+                                name: "Spinach",
+                                ownerId: notAdmin._id,
+                            }),
+                            tests_1.FoodModel.create({
+                                calories: 100,
+                                created: Date.now() - 10,
+                                hidden: true,
+                                name: "Apple",
+                                ownerId: admin._id,
+                            }),
+                            tests_1.FoodModel.create({
+                                calories: 100,
+                                created: Date.now() - 10,
+                                name: "Carrots",
+                                ownerId: admin._id,
+                            }),
+                        ])];
+                case 2:
+                    _b.sent();
+                    app = (0, expressServer_1.setupServer)({
+                        addRoutes: addRoutes,
+                        skipListen: true,
+                        userModel: tests_1.UserModel,
+                    });
+                    agent = supertest_1.default.agent(app);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.afterEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            (0, bun_test_1.setSystemTime)();
+            return [2 /*return*/];
+        });
+    }); });
+    (0, bun_test_1.it)("completes token signup e2e", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, _a, userId, token, refreshToken, food, meRes, mePatchRes, getRes, updateRes;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/signup")
+                        .send({ email: "new@example.com", password: "123" })
+                        .expect(200)];
+                case 1:
+                    res = _b.sent();
+                    _a = res.body.data, userId = _a.userId, token = _a.token, refreshToken = _a.refreshToken;
+                    (0, bun_test_1.expect)(userId).toBeDefined();
+                    (0, bun_test_1.expect)(token).toBeDefined();
+                    (0, bun_test_1.expect)(refreshToken).toBeDefined();
+                    return [4 /*yield*/, agent
+                            .post("/auth/login")
+                            .send({ email: "new@example.com", password: "123" })
+                            .expect(200)];
+                case 2:
+                    res = _b.sent();
+                    return [4 /*yield*/, agent.set("authorization", "Bearer ".concat(res.body.data.token))];
+                case 3:
+                    _b.sent();
+                    userId = res.body.data.userId;
+                    token = res.body.data.token;
+                    (0, bun_test_1.expect)(userId).toBeDefined();
+                    (0, bun_test_1.expect)(token).toBeDefined();
+                    (0, bun_test_1.expect)(refreshToken).toBeDefined();
+                    return [4 /*yield*/, tests_1.FoodModel.create({
+                            calories: 1,
+                            created: new Date(),
+                            name: "Peas",
+                            ownerId: userId,
+                        })];
+                case 4:
+                    food = _b.sent();
+                    return [4 /*yield*/, agent.get("/auth/me").expect(200)];
+                case 5:
+                    meRes = _b.sent();
+                    (0, bun_test_1.expect)(meRes.body.data._id).toBeDefined();
+                    (0, bun_test_1.expect)(meRes.body.data.id).toBeDefined();
+                    (0, bun_test_1.expect)(meRes.body.data.hash).toBeUndefined();
+                    (0, bun_test_1.expect)(meRes.body.data.email).toBe("new@example.com");
+                    (0, bun_test_1.expect)(meRes.body.data.updated).toBeDefined();
+                    (0, bun_test_1.expect)(meRes.body.data.created).toBeDefined();
+                    (0, bun_test_1.expect)(meRes.body.data.admin).toBe(false);
+                    return [4 /*yield*/, agent
+                            .patch("/auth/me")
+                            .send({ email: "new2@example.com" })
+                            .set("authorization", "Bearer ".concat(token))
+                            .expect(200)];
+                case 6:
+                    mePatchRes = _b.sent();
+                    (0, bun_test_1.expect)(mePatchRes.body.data._id).toBeDefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.id).toBeDefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.hash).toBeUndefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.email).toBe("new2@example.com");
+                    (0, bun_test_1.expect)(mePatchRes.body.data.updated).toBeDefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.created).toBeDefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.admin).toBe(false);
+                    return [4 /*yield*/, agent.get("/food").expect(200)];
+                case 7:
+                    getRes = _b.sent();
+                    (0, bun_test_1.expect)(getRes.body.data).toHaveLength(3);
+                    (0, bun_test_1.expect)(getRes.body.data.find(function (f) { return f.name === "Peas"; })).toBeDefined();
+                    return [4 /*yield*/, agent
+                            .patch("/food/".concat(food._id))
+                            .send({ name: "PeasAndCarrots" })
+                            .expect(200)];
+                case 8:
+                    updateRes = _b.sent();
+                    (0, bun_test_1.expect)(updateRes.body.data.name).toBe("PeasAndCarrots");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("signup with extra data", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, _a, userId, token, refreshToken, user;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/signup")
+                        .send({ age: 25, email: "new@example.com", password: "123" })
+                        .expect(200)];
+                case 1:
+                    res = _b.sent();
+                    _a = res.body.data, userId = _a.userId, token = _a.token, refreshToken = _a.refreshToken;
+                    (0, bun_test_1.expect)(userId).toBeDefined();
+                    (0, bun_test_1.expect)(token).toBeDefined();
+                    (0, bun_test_1.expect)(refreshToken).toBeDefined();
+                    return [4 /*yield*/, tests_1.UserModel.findOne({ email: "new@example.com" })];
+                case 2:
+                    user = _b.sent();
+                    (0, bun_test_1.expect)(user === null || user === void 0 ? void 0 : user.age).toBe(25);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("login failure", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/login")
+                        .send({ email: "admin@example.com", password: "wrong" })
+                        .expect(401)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body).toEqual({
+                        message: "Password or username is incorrect",
+                    });
+                    return [4 /*yield*/, agent
+                            .post("/auth/login")
+                            .send({ email: "nope@example.com", password: "wrong" })
+                            .expect(401)];
+                case 2:
+                    res = _a.sent();
+                    // we don't really want to expose if a given email address has an account in our system or not
+                    (0, bun_test_1.expect)(res.body).toEqual({
+                        message: "Password or username is incorrect",
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("case insensitive email", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/login")
+                        .send({ email: "ADMIN@example.com", password: "securePassword" })
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.token).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("case insensitive email with emails with symbols", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/login")
+                        .send({ email: "ADMIN+other@example.com", password: "otherPassword" })
+                        .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.token).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("completes token login e2e", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, _a, userId, token, meRes, mePatchRes, getRes, food, updateRes;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/login")
+                        .send({ email: "admin@example.com", password: "securePassword" })
+                        .expect(200)];
+                case 1:
+                    res = _b.sent();
+                    _a = res.body.data, userId = _a.userId, token = _a.token;
+                    (0, bun_test_1.expect)(userId).toBeDefined();
+                    (0, bun_test_1.expect)(token).toBeDefined();
+                    return [4 /*yield*/, agent.set("authorization", "Bearer ".concat(res.body.data.token))];
+                case 2:
+                    _b.sent();
+                    return [4 /*yield*/, agent.get("/auth/me").expect(200)];
+                case 3:
+                    meRes = _b.sent();
+                    (0, bun_test_1.expect)(meRes.body.data._id).toBeDefined();
+                    (0, bun_test_1.expect)(meRes.body.data.id).toBeDefined();
+                    (0, bun_test_1.expect)(meRes.body.data.hash).toBeUndefined();
+                    (0, bun_test_1.expect)(meRes.body.data.email).toBe("admin@example.com");
+                    (0, bun_test_1.expect)(meRes.body.data.updated).toBeDefined();
+                    (0, bun_test_1.expect)(meRes.body.data.created).toBeDefined();
+                    (0, bun_test_1.expect)(meRes.body.data.admin).toBe(true);
+                    return [4 /*yield*/, agent
+                            .patch("/auth/me")
+                            .send({ email: "admin2@example.com" })
+                            .expect(200)];
+                case 4:
+                    mePatchRes = _b.sent();
+                    (0, bun_test_1.expect)(mePatchRes.body.data._id).toBeDefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.id).toBeDefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.hash).toBeUndefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.email).toBe("admin2@example.com");
+                    (0, bun_test_1.expect)(mePatchRes.body.data.updated).toBeDefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.created).toBeDefined();
+                    (0, bun_test_1.expect)(mePatchRes.body.data.admin).toBe(true);
+                    return [4 /*yield*/, agent.get("/food").expect(200)];
+                case 5:
+                    getRes = _b.sent();
+                    (0, bun_test_1.expect)(getRes.body.data).toHaveLength(3);
+                    food = getRes.body.data.find(function (f) { return f.name === "Apple"; });
+                    (0, bun_test_1.expect)(food).toBeDefined();
+                    return [4 /*yield*/, agent
+                            .patch("/food/".concat(food.id))
+                            .set("authorization", "Bearer ".concat(token))
+                            .send({ name: "Apple Pie" })
+                            .expect(200)];
+                case 6:
+                    updateRes = _b.sent();
+                    (0, bun_test_1.expect)(updateRes.body.data.name).toBe("Apple Pie");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("login successfully and tokens expire", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, _a, userId, token;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/login")
+                        .send({ email: "admin@example.com", password: "securePassword" })
+                        .expect(200)];
+                case 1:
+                    res = _b.sent();
+                    _a = res.body.data, userId = _a.userId, token = _a.token;
+                    (0, bun_test_1.expect)(userId).toBeDefined();
+                    (0, bun_test_1.expect)(token).toBeDefined();
+                    return [4 /*yield*/, agent.set("authorization", "Bearer ".concat(res.body.data.token))];
+                case 2:
+                    _b.sent();
+                    return [4 /*yield*/, agent.get("/auth/me").expect(200)];
+                case 3:
+                    _b.sent();
+                    // Advance time to past token expiration
+                    (0, bun_test_1.setSystemTime)(Date.now() + 1000 * 60 * 60 * 24 * 30);
+                    return [4 /*yield*/, agent.get("/auth/me").expect(401)];
+                case 4:
+                    _b.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("locks out after failed password attempts", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res, user;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/login")
+                        .send({ email: "admin@example.com", password: "wrong" })
+                        .expect(401)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body).toEqual({
+                        message: "Password or username is incorrect",
+                    });
+                    return [4 /*yield*/, tests_1.UserModel.findById(admin._id)];
+                case 2:
+                    user = _a.sent();
+                    (0, bun_test_1.expect)(user === null || user === void 0 ? void 0 : user.attempts).toBe(1);
+                    return [4 /*yield*/, agent
+                            .post("/auth/login")
+                            .send({ email: "admin@example.com", password: "wrong" })
+                            .expect(401)];
+                case 3:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body).toEqual({
+                        message: "Password or username is incorrect",
+                    });
+                    return [4 /*yield*/, tests_1.UserModel.findById(admin._id)];
+                case 4:
+                    user = _a.sent();
+                    (0, bun_test_1.expect)(user === null || user === void 0 ? void 0 : user.attempts).toBe(2);
+                    return [4 /*yield*/, agent
+                            .post("/auth/login")
+                            .send({ email: "admin@example.com", password: "wrong" })
+                            .expect(401)];
+                case 5:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body).toEqual({
+                        message: "Account locked due to too many failed login attempts",
+                    });
+                    return [4 /*yield*/, tests_1.UserModel.findById(admin._id)];
+                case 6:
+                    user = _a.sent();
+                    (0, bun_test_1.expect)(user === null || user === void 0 ? void 0 : user.attempts).toBe(3);
+                    return [4 /*yield*/, agent
+                            .post("/auth/login")
+                            .send({ email: "admin@example.com", password: "securePassword" })
+                            .expect(401)];
+                case 7:
+                    // Logging in with correct password fails because account is locked
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body).toEqual({
+                        message: "Account locked due to too many failed login attempts",
+                    });
+                    return [4 /*yield*/, tests_1.UserModel.findById(admin._id)];
+                case 8:
+                    user = _a.sent();
+                    // Not incremented
+                    (0, bun_test_1.expect)(user === null || user === void 0 ? void 0 : user.attempts).toBe(3);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("refresh token allows refresh of auth token", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var initialLoginRes, initialToken, refreshRes, newToken, meRes;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/login")
+                        .send({ email: "ADMIN@example.com", password: "securePassword" })
+                        .expect(200)];
+                case 1:
+                    initialLoginRes = _a.sent();
+                    (0, bun_test_1.expect)(initialLoginRes.body.data.token).toBeDefined();
+                    (0, bun_test_1.expect)(initialLoginRes.body.data.refreshToken).toBeDefined();
+                    initialToken = initialLoginRes.body.data.token;
+                    return [4 /*yield*/, agent.set("authorization", "Bearer ".concat(initialToken))];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, agent
+                            .post("/auth/refresh_token")
+                            .send({ refreshToken: initialLoginRes.body.data.refreshToken })
+                            .expect(200)];
+                case 3:
+                    refreshRes = _a.sent();
+                    (0, bun_test_1.expect)(refreshRes.body.data.token).toBeDefined();
+                    (0, bun_test_1.expect)(refreshRes.body.data.refreshToken).toBeDefined();
+                    newToken = refreshRes.body.data.token;
+                    // note that new token will most likely be the same as the old token because
+                    // an HMAC signature will always be the same for a header + payload combination that is equal.
+                    // make sure new token works
+                    return [4 /*yield*/, agent.set("authorization", "Bearer ".concat(newToken))];
+                case 4:
+                    // note that new token will most likely be the same as the old token because
+                    // an HMAC signature will always be the same for a header + payload combination that is equal.
+                    // make sure new token works
+                    _a.sent();
+                    return [4 /*yield*/, agent.get("/auth/me").expect(200)];
+                case 5:
+                    meRes = _a.sent();
+                    (0, bun_test_1.expect)(meRes.body.data._id).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("disabled user fails", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var initialLoginRes, initialToken, meRes, failRes;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/login")
+                        .send({ email: "ADMIN@example.com", password: "securePassword" })
+                        .expect(200)];
+                case 1:
+                    initialLoginRes = _a.sent();
+                    (0, bun_test_1.expect)(initialLoginRes.body.data.token).toBeDefined();
+                    (0, bun_test_1.expect)(initialLoginRes.body.data.refreshToken).toBeDefined();
+                    initialToken = initialLoginRes.body.data.token;
+                    return [4 /*yield*/, agent.set("authorization", "Bearer ".concat(initialToken))];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, agent.get("/auth/me").expect(200)];
+                case 3:
+                    meRes = _a.sent();
+                    (0, bun_test_1.expect)(meRes.body.data._id).toBeDefined();
+                    admin.disabled = true;
+                    return [4 /*yield*/, admin.save()];
+                case 4:
+                    _a.sent();
+                    return [4 /*yield*/, agent.get("/auth/me").expect(401)];
+                case 5:
+                    failRes = _a.sent();
+                    (0, bun_test_1.expect)(failRes.body).toEqual({ status: 401, title: "User is disabled" });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("signup user with email that is already registered", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var res2;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, agent
+                        .post("/auth/signup")
+                        .send({ age: 25, email: "new@example.com", password: "123" })
+                        .expect(200)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, agent
+                            .post("/auth/signup")
+                            .send({ age: 31, email: "new@example.com", password: "456" })
+                            .expect(500)];
+                case 2:
+                    res2 = _a.sent();
+                    return [4 /*yield*/, (0, utils_1.timeout)(1000)];
+                case 3:
+                    _a.sent();
+                    (0, bun_test_1.expect)(res2.body.title).toBe("A user with the given username is already registered");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("custom auth options", function () {
+    var app;
+    var admin;
+    var notAdmin;
+    (0, bun_test_1.beforeEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    // Reset to real time - don't freeze time here as passport-local-mongoose
+                    // lockout mechanism needs real time to progress
+                    (0, bun_test_1.setSystemTime)();
+                    return [4 /*yield*/, (0, tests_1.setupDb)()];
+                case 1:
+                    _a = __read.apply(void 0, [_b.sent(), 2]), admin = _a[0], notAdmin = _a[1];
+                    return [4 /*yield*/, Promise.all([
+                            tests_1.FoodModel.create({
+                                calories: 1,
+                                created: new Date(),
+                                name: "Spinach",
+                                ownerId: notAdmin._id,
+                            }),
+                            tests_1.FoodModel.create({
+                                calories: 100,
+                                created: Date.now() - 10,
+                                hidden: true,
+                                name: "Apple",
+                                ownerId: admin._id,
+                            }),
+                            tests_1.FoodModel.create({
+                                calories: 100,
+                                created: Date.now() - 10,
+                                name: "Carrots",
+                                ownerId: admin._id,
+                            }),
+                        ])];
+                case 2:
+                    _b.sent();
+                    app = (0, tests_1.getBaseServer)();
+                    (0, auth_1.addAuthRoutes)(app, tests_1.UserModel, {
+                        // custom refresh token logic based on admin or non admin
+                        generateTokenExpiration: function (user) {
+                            if (user === null || user === void 0 ? void 0 : user.admin) {
+                                return "30d";
+                            }
+                            return "365d";
+                        },
+                    });
+                    (0, auth_1.setupAuth)(app, tests_1.UserModel);
+                    (0, auth_1.addMeRoutes)(app, tests_1.UserModel);
+                    app.use("/food", (0, api_1.modelRouter)(tests_1.FoodModel, {
+                        allowAnonymous: true,
+                        permissions: {
+                            create: [permissions_1.Permissions.IsAuthenticated],
+                            delete: [permissions_1.Permissions.IsAuthenticated],
+                            list: [permissions_1.Permissions.IsAny],
+                            read: [permissions_1.Permissions.IsAny],
+                            update: [permissions_1.Permissions.IsAuthenticated],
+                        },
+                        queryFilter: function (user) {
+                            if (!(user === null || user === void 0 ? void 0 : user.admin)) {
+                                return { hidden: { $ne: true } };
+                            }
+                            return {};
+                        },
+                        transformer: (0, transformers_1.AdminOwnerTransformer)({
+                            adminReadFields: ["name", "calories", "created", "ownerId"],
+                            adminWriteFields: ["name", "calories", "created", "ownerId"],
+                            anonReadFields: ["name"],
+                            anonWriteFields: [],
+                            authReadFields: ["name", "calories", "created"],
+                            authWriteFields: ["name", "calories"],
+                            ownerReadFields: ["name", "calories", "created", "ownerId"],
+                            ownerWriteFields: ["name", "calories", "created"],
+                        }),
+                    }));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.afterEach)(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            (0, bun_test_1.setSystemTime)();
+            return [2 /*return*/];
+        });
+    }); });
+    (0, bun_test_1.it)("login successfully and tokens expire with custom token options", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var adminAgent, res, notAdminAgent, res2;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    adminAgent = supertest_1.default.agent(app);
+                    return [4 /*yield*/, adminAgent
+                            .post("/auth/login")
+                            .send({ email: "admin@example.com", password: "securePassword" })
+                            .expect(200)];
+                case 1:
+                    res = _a.sent();
+                    (0, bun_test_1.expect)(res.body.data.userId).toBeDefined();
+                    (0, bun_test_1.expect)(res.body.data.token).toBeDefined();
+                    return [4 /*yield*/, adminAgent.set("authorization", "Bearer ".concat(res.body.data.token))];
+                case 2:
+                    _a.sent();
+                    notAdminAgent = supertest_1.default.agent(app);
+                    return [4 /*yield*/, notAdminAgent
+                            .post("/auth/login")
+                            .send({ email: "notadmin@example.com", password: "password" })
+                            .expect(200)];
+                case 3:
+                    res2 = _a.sent();
+                    (0, bun_test_1.expect)(res2.body.data.userId).toBeDefined();
+                    (0, bun_test_1.expect)(res2.body.data.token).toBeDefined();
+                    return [4 /*yield*/, notAdminAgent.set("authorization", "Bearer ".concat(res2.body.data.token))];
+                case 4:
+                    _a.sent();
+                    //  and check that tokens are working for both users
+                    return [4 /*yield*/, adminAgent.get("/auth/me").expect(200)];
+                case 5:
+                    //  and check that tokens are working for both users
+                    _a.sent();
+                    return [4 /*yield*/, notAdminAgent.get("/auth/me").expect(200)];
+                case 6:
+                    _a.sent();
+                    // Advance time by 30 days check that admin can no longer access with old token,
+                    // and non-admin can due to custom times set as auth options
+                    (0, bun_test_1.setSystemTime)(Date.now() + 1000 * 60 * 60 * 24 * 30);
+                    return [4 /*yield*/, adminAgent.get("/auth/me").expect(401)];
+                case 7:
+                    _a.sent();
+                    return [4 /*yield*/, notAdminAgent.get("/auth/me").expect(200)];
+                case 8:
+                    _a.sent();
+                    // Advance time by an additional 335 days to pass the 365 day expiration for non-admin
+                    (0, bun_test_1.setSystemTime)(Date.now() + 1000 * 60 * 60 * 24 * 365);
+                    // ensure non-admin can no longer access
+                    return [4 /*yield*/, notAdminAgent.get("/auth/me").expect(401)];
+                case 9:
+                    // ensure non-admin can no longer access
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+(0, bun_test_1.describe)("generateTokens", function () {
+    var OLD_ENV = process.env;
+    (0, bun_test_1.beforeEach)(function () {
+        process.env = __assign({}, OLD_ENV);
+        process.env.TOKEN_SECRET = "secret";
+        process.env.REFRESH_TOKEN_SECRET = "refresh_secret";
+    });
+    (0, bun_test_1.afterEach)(function () {
+        process.env = OLD_ENV;
+    });
+    (0, bun_test_1.it)("generates a token and refresh token for a valid user", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, _a, token, refreshToken, tokenParts;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    user = { _id: "12345" };
+                    return [4 /*yield*/, (0, auth_1.generateTokens)(user)];
+                case 1:
+                    _a = _b.sent(), token = _a.token, refreshToken = _a.refreshToken;
+                    (0, bun_test_1.expect)(token).toBeDefined();
+                    (0, bun_test_1.expect)(refreshToken).toBeDefined();
+                    tokenParts = token === null || token === void 0 ? void 0 : token.split(".");
+                    (0, bun_test_1.expect)(tokenParts === null || tokenParts === void 0 ? void 0 : tokenParts.length).toBe(3);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("throws an error if TOKEN_SECRET is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.TOKEN_SECRET = undefined;
+                    user = { _id: "12345" };
+                    return [4 /*yield*/, (0, bun_test_1.expect)((0, auth_1.generateTokens)(user)).rejects.toThrow("TOKEN_SECRET must be set in env.")];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("returns null tokens if user is missing", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, auth_1.generateTokens)(undefined)];
+                case 1:
+                    result = _a.sent();
+                    (0, bun_test_1.expect)(result).toEqual({ refreshToken: null, token: null });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    (0, bun_test_1.it)("respects custom expiration from authOptions", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var user, authOptions, _a, token, refreshToken;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    user = { _id: "12345" };
+                    authOptions = {
+                        generateRefreshTokenExpiration: function () { return "7d"; },
+                        generateTokenExpiration: function () { return "1h"; },
+                    };
+                    return [4 /*yield*/, (0, auth_1.generateTokens)(user, authOptions)];
+                case 1:
+                    _a = _b.sent(), token = _a.token, refreshToken = _a.refreshToken;
+                    (0, bun_test_1.expect)(token).toBeDefined();
+                    (0, bun_test_1.expect)(refreshToken).toBeDefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});