@things-factory/auth-base 10.1.250 → 10.1.254

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "10.1.250",
+  "version": "10.1.254",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -35,10 +35,10 @@
     "@reduxjs/toolkit": "^2.2.5",
     "@simplewebauthn/browser": "^13.0.0",
     "@simplewebauthn/server": "^13.0.0",
-    "@things-factory/email-base": "^10.1.250",
+    "@things-factory/email-base": "^10.1.254",
     "@things-factory/env": "^10.1.149",
-    "@things-factory/shell": "^10.1.247",
-    "@things-factory/task-lease": "^10.1.247",
+    "@things-factory/shell": "^10.1.254",
+    "@things-factory/task-lease": "^10.1.254",
     "@things-factory/utils": "^10.1.179",
     "@types/webappsec-credential-management": "^0.6.9",
     "jsonwebtoken": "^9.0.0",
@@ -50,5 +50,5 @@
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "4fdb6d24ef24f43d9e158d4c6d6396ad3097bb9e"
+  "gitHead": "793e2fd617db5bb917ec892e64956fb690f7e7b0"
 }

package/tests/passkey-signin-route-db.test.ts

@@ -0,0 +1,139 @@
+/**
+ * The passkey sign-in route, through `authenticate401Middleware`, the way the sign-in screen reaches it.
+ *
+ * The screen used to fetch it. A fetch says `Accept: *\/*`, the middleware takes that for a page request,
+ * so a locked account got the whole `auth-activate` page back as the body - and the screen put that body
+ * in a toast. Now the screen posts a form, as the password does, and every refusal is answered with the
+ * page its code leads to: the activate page for a locked or unconfirmed account, the sign-in page with
+ * its one line for the rest.
+ */
+
+import { closeAuthDatabase, Domain, getRepository, openAuthDatabase, resetAuthDatabase } from './db'
+import { loadCompiled } from './compiled'
+import { SoftwareAuthenticator } from './passkey-authenticator'
+
+const { User } = loadCompiled('service/user/user')
+const { authenticate401Middleware } = loadCompiled('middlewares/authenticate-401-middleware')
+const { webAuthnGlobalPublicRouter } = loadCompiled('router/webauthn-router')
+const CODES = loadCompiled('constants/error-code')
+const passkey = loadCompiled('controllers/passkey')
+
+const SITE = { rpID: 'localhost', origin: 'http://localhost:3000' }
+const NAVIGATION = 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'
+
+let domain: any
+let kim: any
+
+const signinRoute = webAuthnGlobalPublicRouter.stack.find(
+  (layer: any) => layer.path === '/auth/signin-webauthn' && layer.methods.includes('POST')
+)
+
+/** What the browser gets back for the form the screen posts. */
+async function post(body: (challenge: string) => any) {
+  const { challenge } = await passkey.signinOptions(SITE)
+  const answer: any = { status: 200, cookies: {} }
+
+  const context: any = {
+    t: (key: string) => key,
+    method: 'POST',
+    path: '/auth/signin-webauthn',
+    originalUrl: '/auth/signin-webauthn',
+    header: { accept: NAVIGATION },
+    hostname: SITE.rpID,
+    origin: SITE.origin,
+    secure: false,
+    query: {},
+    session: { challenge },
+    state: { domain },
+    request: { body: body(challenge) },
+    cookies: { set: (key: string, value: string) => (answer.cookies[key] = value) },
+    render: async (view: string, options: any) => (answer.page = { view, ...options }),
+    redirect: (url: string) => (answer.redirect = url)
+  }
+
+  await authenticate401Middleware(context, () => signinRoute.stack[0](context, async () => {}))
+
+  return { ...answer, status: context.status, body: context.body }
+}
+
+async function registered(user: any) {
+  const authenticator = new SoftwareAuthenticator()
+  const { challenge } = await passkey.registrationOptions(user, 'Operato', SITE)
+  await passkey.registerPasskey(user, authenticator.register(challenge, SITE), 'macOS · Chrome', challenge, SITE)
+  return authenticator
+}
+
+const formWith = (authenticator: SoftwareAuthenticator) => (challenge: string) => ({
+  response: JSON.stringify(authenticator.assert(challenge, SITE)),
+  redirectTo: '/office'
+})
+
+beforeAll(async () => {
+  await openAuthDatabase()
+})
+
+afterAll(async () => {
+  await closeAuthDatabase()
+})
+
+beforeEach(async () => {
+  await resetAuthDatabase()
+  domain = await getRepository(Domain).save({ name: 'factory', subdomain: 'factory' })
+
+  const salt = User.generateSalt()
+  kim = await getRepository(User).save({
+    username: 'kim',
+    email: 'kim@example.com',
+    name: 'kim',
+    salt,
+    password: User.encode('Passw0rd!', salt),
+    status: 'activated',
+    domains: [domain]
+  })
+})
+
+it('signs in and goes on to check-in, with the token in the cookie', async () => {
+  const answer = await post(formWith(await registered(kim)))
+
+  expect(answer.redirect).toBe('/auth/checkin/factory?redirect_to=%2Foffice')
+  expect(Object.values(answer.cookies)).toHaveLength(1)
+})
+
+describe.each([
+  ['locked', CODES.USER_LOCKED],
+  ['inactive', CODES.USER_NOT_ACTIVATED]
+])('a %s account', (status, errorCode) => {
+  it('lands on the activate page with its code and its line, the way a password does', async () => {
+    const authenticator = await registered(kim)
+    await getRepository(User).update({ id: kim.id }, { status, lockedAt: new Date() })
+
+    const answer = await post(formWith(authenticator))
+
+    expect(answer.status).toBe(401)
+    expect(answer.page.pageElement).toBe('auth-activate')
+    expect(answer.page.data).toMatchObject({ errorCode, message: `error.${errorCode}`, username: 'kim', redirectTo: '/office' })
+    expect(answer.cookies).toEqual({})
+  })
+})
+
+describe.each([
+  ['deleted', CODES.USER_DELETED],
+  ['password_reset_required', CODES.PASSWORD_SETUP_PENDING]
+])('a %s account', (status, errorCode) => {
+  it('stays on the sign-in page with its one line', async () => {
+    const authenticator = await registered(kim)
+    await getRepository(User).update({ id: kim.id }, { status })
+
+    const answer = await post(formWith(authenticator))
+
+    expect(answer.page.pageElement).toBe('auth-signin')
+    expect(answer.page.data.message).toBe(`error.${errorCode}`)
+  })
+})
+
+it('an answer that is not JSON is a failed verification, said in one line on the sign-in page', async () => {
+  const answer = await post(() => ({ response: '<not json>', redirectTo: '/office' }))
+
+  expect(answer.page.pageElement).toBe('auth-signin')
+  expect(answer.page.data.message).toBe(`error.${CODES.AUTHN_VERIFICATION_FAILED}`)
+})