@tiledesk/tiledesk-server 2.22.7 → 2.23.1

package/CHANGELOG.md

@@ -5,7 +5,15 @@
 🚀        IN PRODUCTION                        🚀
 (https://www.npmjs.com/package/@tiledesk/tiledesk-server/v/2.3.77) 
 
-# 2.22.0
+# 2.23.1
+- Restored cross-project access for global subscriptions (`id_project: '*'` or `global: true`); bots and project-bound subscriptions remain scoped to their own project
+
+# 2.23.0
+- Deprecated JWT helper routes (`/jwt/decode`, `/jwt/generatetestjwt`); they now return 410
+- Restricted bot and subscription tokens to their own project (cross-project access denied)
+- Improved error response sanitization for integration routes
+
+# 2.22.7
 - Addressed and resolved a security vulnerability
 - Updated tybot-connector to 2.1.11
 

package/app.js

@@ -622,7 +622,7 @@ app.use('/:projectid/publicanalytics', publicAnalytics);
 
 app.use('/:projectid/keys', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRole('agent')], key);
 
-//TODO deprecated?
+// Deprecated helper routes (/jwt/decode, /jwt/generatetestjwt) — respond with 410.
 app.use('/:projectid/jwt', jwtroute);
 
 

package/middleware/has-role.js

@@ -36,14 +36,35 @@ class RoleChecker {
 
 
 
-      isTypeAsFunction(type, user) {                 
+      /**
+       * Bot and subscription tokens must only authorize the project they belong to.
+       * Fail closed if id_project is missing.
+       */
+      belongsToProject(user, projectid) {
+        if (!user || user.id_project == null || projectid == null) {
+          return false;
+        }
+        if (!(user instanceof Faq_kb) && (String(user.id_project) === '*' || user.global === true)) {
+          return true;
+        }
+        return String(user.id_project) === String(projectid);
+      }
+
+      isTypeAsFunction(type, user, projectid) {
             winston.debug("isType:"+type);
             winston.debug("user", user);
-           //TODO Check if belongs to project
             if (type=='subscription' && user instanceof Subscription){
+              if (!this.belongsToProject(user, projectid)) {
+                winston.warn("Subscription " + (user && user._id) + " denied cross-project access to " + projectid);
+                return false;
+              }
               winston.debug("isTypeAsFunction is subscription");
               return true
             } else if (type=='bot' && user instanceof Faq_kb){
+              if (!this.belongsToProject(user, projectid)) {
+                winston.warn("Bot " + (user && user._id) + " denied cross-project access to " + projectid);
+                return false;
+              }
               winston.debug("isTypeAsFunction is bot");
               return true
             } else {
@@ -51,7 +72,7 @@ class RoleChecker {
 
               var adminEmail = process.env.ADMIN_EMAIL || "admin@tiledesk.com";
 
-              if (user && user.email && user.email === adminEmail) { //skip has role check 
+              if (user && user.email && user.email === adminEmail) { //skip has role check
                 return true;
               }
               return false;
@@ -59,7 +80,7 @@ class RoleChecker {
        }
 
 
-      isTypesAsFunction(types, user) {                 
+      isTypesAsFunction(types, user, projectid) {
         winston.debug("isTypes:"+types);
         winston.debug("user", user);
         var isType = false;
@@ -69,7 +90,7 @@ class RoleChecker {
           try {
             types.forEach(type => {
               winston.debug("type:"+type);
-              isType = this.isTypeAsFunction(type, user);
+              isType = this.isTypeAsFunction(type, user, projectid);
               winston.debug("isType:"+ isType);
               if (isType==true) {
                 throw BreakException; //https://stackoverflow.com/questions/2641347/short-circuit-array-foreach-like-calling-break
@@ -191,12 +212,12 @@ class RoleChecker {
           // console.log("QUIIIIIIIIIIIIIIIIIIIIIII",type);
           if (types && types.length>0) {
             // console.log("QUIIIIIIIIIIIIIIIIIIIIIII");
-            var checkRes = that.isTypesAsFunction(types, req.user);
+            var checkRes = that.isTypesAsFunction(types, req.user, projectid);
             winston.debug("checkRes: " + checkRes);
 
             if (checkRes) {
              return next();
-            }            
+            }
             // return that.isType(type)(req,res,next);
             // console.log("typers",typers);
           }

package/middleware/passport.js

@@ -321,7 +321,7 @@ module.exports = function(passport) {
 
     } else if (subject=="subscription") {
     
-      Subscription.findOne({_id: identifier}, function(err, subscription) {
+      Subscription.findOne({_id: identifier}).select('+global').exec(function(err, subscription) {
         if (err) {
           winston.error("Passport JWT subscription err", err);
           return done(err, false);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tiledesk/tiledesk-server",
   "description": "The Tiledesk server module",
-  "version": "2.22.7",
+  "version": "2.23.1",
   "scripts": {
     "start": "node ./bin/www",
     "pretest": "mongodb-runner start",

package/routes/authtestWithRoleCheck.js

@@ -15,6 +15,12 @@ router.get('/',  function (req, res) {
      function (req, res) {
     res.send('{"success":true}');
   });
+
+  router.get('/subscription', [
+    roleChecker.hasRoleOrTypes(null,['subscription'])],
+     function (req, res) {
+    res.send('{"success":true}');
+  });
   
   router.get('/noentitycheck', 
     [noentitycheck,

package/routes/integration.js

@@ -52,7 +52,7 @@ router.get('/:integration_id', async (req, res) => {
     Integration.findOne({ _id: integration_id, id_project: id_project }, (err, integration) => {
         if (err) {
             winston.error("Error find integration by id: ", err);
-            return res.status(404).send({ success: false, err: err });
+            return res.status(500).send({ success: false, message: "Error getting integration" });
         }
         if (!integration) {
             return res.status(404).send({ success: false, message: "Integration not found" });
@@ -73,7 +73,7 @@ router.get('/name/:integration_name', async (req, res) => {
     Integration.findOne({ id_project: id_project, name: integration_name }, (err, integration) => {
         if (err) {
             winston.error("Error find integration by name: ", err);
-            return res.status(404).send({ success: false, err: err });
+            return res.status(500).send({ success: false, message: "Error getting integration" });
         }
 
         if (!integration) {
@@ -96,7 +96,7 @@ router.post('/', async (req, res) => {
         existingIntegration = await Integration.findOne({ id_project: id_project, name: req.body.name });
     } catch (err) {
         winston.error("Error finding existing integration ", err);
-        return res.status(500).send({ success: false, err: err });
+        return res.status(500).send({ success: false, message: "Error creating integration" });
     }
 
     let newIntegration = {
@@ -112,7 +112,7 @@ router.post('/', async (req, res) => {
     Integration.findOneAndUpdate({ id_project: id_project, name: req.body.name },  newIntegration, { new: true, upsert: true, setDefaultsOnInsert: false}, (err, savedIntegration) => {
         if (err) {
             winston.error("Error creating new integration ", err);
-            return res.status(404).send({ success: false, err: err })
+            return res.status(500).send({ success: false, message: "Error creating integration" });
         }
 
         winston.debug("New integration created: ", savedIntegration);
@@ -168,7 +168,7 @@ router.put('/:integration_id', async (req, res) => {
         existingIntegration = await Integration.findOne({ _id: integration_id, id_project: id_project });
     } catch (err) {
         winston.error("Error finding integration to update ", err);
-        return res.status(500).send({ success: false, error: err });
+        return res.status(500).send({ success: false, message: "Error updating integration" });
     }
     if (!existingIntegration) {
         return res.status(404).send({ success: false, message: "Integration not found" });
@@ -187,7 +187,7 @@ router.put('/:integration_id', async (req, res) => {
     Integration.findOneAndUpdate({ _id: integration_id, id_project: id_project }, update, { new: true }, (err, savedIntegration) => {
         if (err) {
             winston.error("Error find by id and update integration: ", err);
-            return res.status(500).send({ success: false, error: err })
+            return res.status(500).send({ success: false, message: "Error updating integration" });
         }
         if (!savedIntegration) {
             return res.status(404).send({ success: false, message: "Integration not found" });
@@ -213,7 +213,7 @@ router.delete('/:integration_id', async (req, res) => {
     Integration.findOneAndDelete({ _id: integration_id, id_project: id_project }, (err, result) => {
         if (err) {
             winston.error("Error find by id and delete integration: ", err);
-            return res.status(500).send({ success: false, error: err })
+            return res.status(500).send({ success: false, message: "Error deleting integration" });
         }
         if (!result) {
             return res.status(404).send({ success: false, message: "Integration not found" });

package/routes/jwt.js

@@ -4,32 +4,35 @@
 // Modules imports
 const express = require('express');
 var router = express.Router();
-var config = require('../config/database'); 
+
+// Deprecated test/helper endpoints. Kept mounted so callers get an explicit
+// deprecation response instead of a silent 404. Do not re-enable without
+// proper authentication (passport + role checks).
+function deprecated(req, res) {
+  return res.status(410).send({
+    success: false,
+    msg: 'deprecated'
+  });
+}
+
+router.post('/decode', deprecated);
+router.post('/generatetestjwt', deprecated);
+
+/*
+var config = require('../config/database');
 var jwt = require('jsonwebtoken');
 var validtoken = require('../middleware/valid-token');
 var requestUtil = require('../utils/requestUtil');
 var Project = require('../models/project');
 var winston = require('../config/winston');
 
-// deprecated??
 router.post('/decode', validtoken, function (req, res) {
-
-    // var project_id = req.query.project_id;
-
-    // winston.debug("project_id", project_id);
-
-    // if (!project_id) {
-    //     winston.error("project_id parameter is required");
-    //     res.status(400).send({ success: false, msg: "project_id parameter is required" });
-    // }
-
-
-    return  Project.findOne({_id: req.projectid, status: 100}, '+jwtSecret',function(err, project) {
+    return Project.findOne({_id: req.projectid, status: 100}, '+jwtSecret',function(err, project) {
       if (err) {
         winston.error('Error finding project', err);
         return res.status(500).send({ success: false, msg: 'Error finding project.' });
      }
-    
+
       winston.debug('project', project);
 
       if (!project) {
@@ -40,74 +43,60 @@ router.post('/decode', validtoken, function (req, res) {
         return res.status(404).send({ success: false, msg: 'Project hasnt  a jwtSecret' });
       }
 
-
         try {
           winston.debug("requestUtil", requestUtil);
             var token = requestUtil.getToken(req.headers);
 
-
             winston.debug("token", token);
-            // verify a token symmetric - synchronous
             var decoded = jwt.verify(token, project.jwtSecret);
-            
+
             winston.debug("decoded", decoded);
-      
 
-            if(!decoded.iat ) {                  
+            if(!decoded.iat ) {
                 winston.debug("token.iat is required");
                 return res.status(401).send({ success: false, msg: 'Authentication failed. Token iat is required'});
             }
-            if(!decoded.exp ) {                  
+            if(!decoded.exp ) {
                 winston.debug("token.exp is required");
                 return res.status(401).send({ success: false, msg: 'Authentication failed. Token exp is required'});
             }
-            if(decoded.exp - decoded.iat  > 600  ) {                  
+            if(decoded.exp - decoded.iat  > 600  ) {
                 winston.debug("The value of exp is permitted to be up to a maximum of 10 minutes from the iat value");
                 return res.status(401).send({ success: false, msg: 'Authentication failed. The value of exp is permitted to be up to a maximum of 10 minutes from the iat value'});
             }
 
-
             return res.json({decoded: decoded});
-          
-    
+
         } catch(err) {
             winston.error("Authentication failed", err);
             return res.status(401).send({ success: false, msg: 'Authentication failed', err: err });
-        }  
+        }
 
     });
-    
-  
   });
 
   router.post('/generatetestjwt', validtoken, function (req, res) {
-    
     winston.debug("req.body", req.body);
-    return  Project.findOne({_id: req.projectid, status: 100}, '+jwtSecret',function(err, project) {    
+    return Project.findOne({_id: req.projectid, status: 100}, '+jwtSecret',function(err, project) {
         if (err) {
           winston.error('Error finding project', err);
           return res.status(500).send({ success: false, msg: 'Error finding project.' });
        }
-      
+
         winston.debug('project', project);
-  
+
         if (!project) {
             return res.status(404).send({ success: false, msg: 'Project not found' });
         }
-  
+
         if (!project.jwtSecret) {
           return res.status(404).send({ success: false, msg: 'Project hasnt  a jwtSecret' });
         }
 
         var token = jwt.sign(req.body, project.jwtSecret,{ expiresIn: 300 });
-        // var token = jwt.sign(req.body, project.jwtSecret);
-
-
-     
         res.json({ success: true, token: 'JWT ' + token });
     });
-
   });
+*/
 
-
-  module.exports = router;
+module.exports = router;

package/test/authenticationJwt.js

@@ -20,6 +20,7 @@ var assert = chai.assert;
 var jwt = require('jsonwebtoken');
 var config = require('../config/database'); // get db config file
 var faqService = require('../services/faqService');
+var Subscription = require('../models/subscription');
 
 let log = false;
 
@@ -401,7 +402,160 @@ describe('AuthenticationJWT', () => {
                 });
             });
         });
-    }); 
+    });
+
+    it('subscriptionJwt-wildcard-id-project-can-access-specific-project', (done) => {
+
+        var email = "test-signup-" + Date.now() + "@email.com";
+        var pwd = "pwd";
+
+        userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
+            projectService.create("test-sub-wildcard-project", savedUser._id).then(function (savedProject) {
+                var subscription = new Subscription({
+                    event: "queues.request.create." + Date.now(),
+                    target: "https://queues.example.com/hook",
+                    id_project: "*",
+                    createdBy: savedUser._id
+                });
+                subscription.save(function (err, savedSub) {
+                    if (err) { console.error("err: ", err); return done(err); }
+
+                    var signOptions = {
+                        subject: 'subscription',
+                        audience: 'https://tiledesk.com/subscriptions/' + savedSub._id,
+                    };
+                    var jwtToken = jwt.sign(savedSub.toObject(), savedSub.secret, signOptions);
+
+                    chai.request(server)
+                        .get('/' + savedProject._id + '/authtestWithRoleCheck/subscription')
+                        .set('Authorization', 'JWT ' + jwtToken)
+                        .send()
+                        .end((err, res) => {
+                            if (err) { console.error("err: ", err); }
+                            if (log) { console.log("res.body", res.body); }
+
+                            res.should.have.status(200);
+                            done();
+                        });
+                });
+            });
+        });
+    }).timeout(20000);
+
+    it('subscriptionJwt-global-true-can-access-specific-project', (done) => {
+
+        var email = "test-signup-" + Date.now() + "@email.com";
+        var pwd = "pwd";
+
+        userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
+            projectService.create("test-sub-global-a", savedUser._id).then(function (projectA) {
+                projectService.create("test-sub-global-b", savedUser._id).then(function (projectB) {
+                    var subscription = new Subscription({
+                        event: "queues.global." + Date.now(),
+                        target: "https://queues.example.com/hook",
+                        id_project: projectA._id,
+                        global: true,
+                        createdBy: savedUser._id
+                    });
+                    subscription.save(function (err, savedSub) {
+                        if (err) { console.error("err: ", err); return done(err); }
+
+                        var signOptions = {
+                            subject: 'subscription',
+                            audience: 'https://tiledesk.com/subscriptions/' + savedSub._id,
+                        };
+                        var jwtToken = jwt.sign(savedSub.toObject(), savedSub.secret, signOptions);
+
+                        chai.request(server)
+                            .get('/' + projectB._id + '/authtestWithRoleCheck/subscription')
+                            .set('Authorization', 'JWT ' + jwtToken)
+                            .send()
+                            .end((err, res) => {
+                                if (err) { console.error("err: ", err); }
+                                if (log) { console.log("res.body", res.body); }
+
+                                res.should.have.status(200);
+                                done();
+                            });
+                    });
+                });
+            });
+        });
+    }).timeout(20000);
+
+    it('subscriptionJwt-denied-cross-project', (done) => {
+
+        var email = "test-signup-" + Date.now() + "@email.com";
+        var pwd = "pwd";
+
+        userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
+            projectService.create("test-sub-project-a", savedUser._id).then(function (projectA) {
+                projectService.create("test-sub-project-b", savedUser._id).then(function (projectB) {
+                    var subscription = new Subscription({
+                        event: "webhook.request.create." + Date.now(),
+                        target: "https://hooks.example.com/hook",
+                        id_project: projectA._id,
+                        createdBy: savedUser._id
+                    });
+                    subscription.save(function (err, savedSub) {
+                        if (err) { console.error("err: ", err); return done(err); }
+
+                        var signOptions = {
+                            subject: 'subscription',
+                            audience: 'https://tiledesk.com/subscriptions/' + savedSub._id,
+                        };
+                        var jwtToken = jwt.sign(savedSub.toObject(), savedSub.secret, signOptions);
+
+                        chai.request(server)
+                            .get('/' + projectB._id + '/authtestWithRoleCheck/subscription')
+                            .set('Authorization', 'JWT ' + jwtToken)
+                            .send()
+                            .end((err, res) => {
+                                if (err) { console.error("err: ", err); }
+                                if (log) { console.log("res.body", res.body); }
+
+                                res.should.have.status(403);
+                                done();
+                            });
+                    });
+                });
+            });
+        });
+    }).timeout(20000);
+
+    it('botJwt-denied-cross-project', (done) => {
+
+        var email = "test-signup-" + Date.now() + "@email.com";
+        var pwd = "pwd";
+
+        userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
+            projectService.create("test-bot-project-a", savedUser._id).then(function (projectA) {
+                projectService.create("test-bot-project-b", savedUser._id).then(function (projectB) {
+                    faqService.create(projectA._id, savedUser._id, { name: "testbot-cross" }).then(function (savedBot) {
+
+                        var savedBotObj = savedBot.toObject();
+                        var signOptions = {
+                            subject: 'bot',
+                            audience: 'https://tiledesk.com/bots/' + savedBot._id,
+                        };
+                        var jwtToken = jwt.sign(savedBotObj, savedBot.secret, signOptions);
+
+                        chai.request(server)
+                            .get('/' + projectB._id + '/authtestWithRoleCheck/bot')
+                            .set('Authorization', 'JWT ' + jwtToken)
+                            .send()
+                            .end((err, res) => {
+                                if (err) { console.error("err: ", err); }
+                                if (log) { console.log("res.body", res.body); }
+
+                                res.should.have.status(403);
+                                done();
+                            });
+                    });
+                });
+            });
+        });
+    });
 
 });
 

package/test/hasRole.js

@@ -0,0 +1,127 @@
+process.env.NODE_ENV = 'test';
+process.env.LOG_LEVEL = 'critical';
+
+const { expect } = require('chai');
+const roleChecker = require('../middleware/has-role');
+const Subscription = require('../models/subscription');
+const Faq_kb = require('../models/faq_kb');
+
+describe('RoleChecker.belongsToProject', () => {
+
+    const projectA = '6565047fdd64fd001323f37c';
+    const projectB = '507f1f77bcf86cd799439011';
+
+    it('fails closed when user, id_project or projectid is missing', () => {
+        expect(roleChecker.belongsToProject(null, projectA)).to.equal(false);
+        expect(roleChecker.belongsToProject({}, projectA)).to.equal(false);
+        expect(roleChecker.belongsToProject(new Subscription({ event: 'e', target: 't', createdBy: 'u' }), projectA)).to.equal(false);
+        expect(roleChecker.belongsToProject(new Subscription({ event: 'e', target: 't', id_project: projectA, createdBy: 'u' }), null)).to.equal(false);
+    });
+
+    it('allows a subscription with id_project "*" to access a specific projectid', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://queues.example.com',
+            id_project: '*',
+            createdBy: 'queues'
+        });
+        expect(roleChecker.belongsToProject(subscription, projectA)).to.equal(true);
+    });
+
+    it('allows a subscription with global: true to access a specific projectid', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://queues.example.com',
+            id_project: projectA,
+            global: true,
+            createdBy: 'queues'
+        });
+        expect(roleChecker.belongsToProject(subscription, projectB)).to.equal(true);
+    });
+
+    it('denies a subscription bound to project A from accessing project B', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://hooks.example.com',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        expect(roleChecker.belongsToProject(subscription, projectB)).to.equal(false);
+        expect(roleChecker.belongsToProject(subscription, projectA)).to.equal(true);
+    });
+
+    it('denies a bot for project A from accessing project B', () => {
+        const bot = new Faq_kb({
+            name: 'testbot',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        expect(roleChecker.belongsToProject(bot, projectB)).to.equal(false);
+        expect(roleChecker.belongsToProject(bot, projectA)).to.equal(true);
+    });
+
+    it('does not give bots a wildcard even if id_project is "*" or global is true', () => {
+        const wildcardBot = new Faq_kb({
+            name: 'wildcard-bot',
+            id_project: '*',
+            createdBy: 'user1'
+        });
+        expect(roleChecker.belongsToProject(wildcardBot, projectA)).to.equal(false);
+
+        const globalBot = new Faq_kb({
+            name: 'global-bot',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        globalBot.set('global', true);
+        expect(roleChecker.belongsToProject(globalBot, projectB)).to.equal(false);
+    });
+});
+
+describe('RoleChecker.isTypeAsFunction', () => {
+
+    const projectA = '6565047fdd64fd001323f37c';
+    const projectB = '507f1f77bcf86cd799439011';
+
+    it('allows a subscription with id_project "*" to access a specific projectid', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://queues.example.com',
+            id_project: '*',
+            createdBy: 'queues'
+        });
+        expect(roleChecker.isTypeAsFunction('subscription', subscription, projectA)).to.equal(true);
+    });
+
+    it('allows a subscription with global: true to access a specific projectid', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://queues.example.com',
+            id_project: projectA,
+            global: true,
+            createdBy: 'queues'
+        });
+        expect(roleChecker.isTypeAsFunction('subscription', subscription, projectB)).to.equal(true);
+    });
+
+    it('denies a subscription bound to project A from accessing project B', () => {
+        const subscription = new Subscription({
+            event: 'request.create',
+            target: 'https://hooks.example.com',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        expect(roleChecker.isTypeAsFunction('subscription', subscription, projectB)).to.equal(false);
+        expect(roleChecker.isTypeAsFunction('subscription', subscription, projectA)).to.equal(true);
+    });
+
+    it('denies a bot for project A from accessing project B', () => {
+        const bot = new Faq_kb({
+            name: 'testbot',
+            id_project: projectA,
+            createdBy: 'user1'
+        });
+        expect(roleChecker.isTypeAsFunction('bot', bot, projectB)).to.equal(false);
+        expect(roleChecker.isTypeAsFunction('bot', bot, projectA)).to.equal(true);
+    });
+});

package/test/jwtRoute.js

@@ -1,7 +1,6 @@
 //During the test the env variable is set to test
 process.env.NODE_ENV = 'test';
 
-var User = require('../models/user');
 var projectService = require('../services/projectService');
 var userService = require('../services/userService');
 
@@ -10,158 +9,60 @@ let chai = require('chai');
 let chaiHttp = require('chai-http');
 let server = require('../app');
 let should = chai.should();
-var jwt = require('jsonwebtoken');
 
 let log = false;
 
-// chai.config.includeStack = true;
-
 var expect = chai.expect;
-var assert = chai.assert;
 
 chai.use(chaiHttp);
 
 describe('JWTRoute', () => {
 
-  describe('/decode', () => {
-
-    it('decodeWithIatExp', (done) => {
+  describe('deprecated endpoints', () => {
 
+    it('generatetestjwt returns deprecated', (done) => {
       var email = "test-signup-" + Date.now() + "@email.com";
       var pwd = "pwd";
 
       userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
-        projectService.create("test-join-member", savedUser._id).then(function (savedProject) {
+        projectService.create("test-jwt-deprecated", savedUser._id).then(function (savedProject) {
           chai.request(server)
-            .post('/' + savedProject._id + '/keys/generate')
+            .post('/' + savedProject._id + '/jwt/generatetestjwt')
             .auth(email, pwd)
-            .send()
+            .send({ "name": "andrea", "surname": "leo" })
             .end((err, res) => {
-
               if (err) { console.error("err: ", err); }
               if (log) { console.log("res.body", res.body); }
 
-              res.should.have.status(200);
+              res.should.have.status(410);
               res.body.should.be.a('object');
-              expect(res.body.jwtSecret).to.not.equal(null);
-
-              chai.request(server)
-                .post('/' + savedProject._id + '/jwt/generatetestjwt')
-                .auth(email, pwd)
-                .send({ "name": "andrea", "surname": "leo" })
-                .end((err, res) => {
-
-                  if (err) { console.error("err: ", err); }
-                  if (log) { console.log("res.body", res.body); }
-
-                  res.should.have.status(200);
-                  res.body.should.be.a('object');
-                  expect(res.body.token).to.not.equal(null);
-
-                  var jwtToken = res.body.token;
-                  if (log) { console.log("jwtToken", jwtToken); }
-                  
-                  chai.request(server)
-                    .post('/' + savedProject._id + '/jwt/decode')
-                    .set('Authorization', jwtToken)
-                    .send()
-                    .end((err, res) => {
-
-                      res.should.have.status(200);
-                      res.body.should.be.a('object');
-                      
-                      expect(res.body.name).to.not.equal("andrea");
-                      expect(res.body.surname).to.not.equal("leo");
-                      expect(res.body.iat).to.not.equal(null);
-                      expect(res.body.exp).to.not.equal(null);
-
-                      done();
-                    });
-                });
+              expect(res.body.success).to.equal(false);
+              expect(res.body.msg).to.equal('deprecated');
+              done();
             });
         });
       });
     }).timeout(20000);
 
-
-    it('decodeWithIatNoExp', (done) => {
-
+    it('decode returns deprecated', (done) => {
       var email = "test-signup-" + Date.now() + "@email.com";
       var pwd = "pwd";
 
       userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
-        projectService.create("test-join-member", savedUser._id).then(function (savedProject) {
+        projectService.create("test-jwt-deprecated-decode", savedUser._id).then(function (savedProject) {
           chai.request(server)
-            .post('/' + savedProject._id + '/keys/generate')
+            .post('/' + savedProject._id + '/jwt/decode')
             .auth(email, pwd)
             .send()
             .end((err, res) => {
-
               if (err) { console.error("err: ", err); }
               if (log) { console.log("res.body", res.body); }
 
-              res.should.have.status(200);
+              res.should.have.status(410);
               res.body.should.be.a('object');
-              expect(res.body.jwtSecret).to.not.equal(null);
-
-              var jwtToken = jwt.sign({ "name": "andrea", "surname": "leo" }, res.body.jwtSecret);
-              if (log) { console.log("jwtToken", jwtToken); }
-
-              chai.request(server)
-                .post('/' + savedProject._id + '/jwt/decode')
-                .set('Authorization', 'JWT ' + jwtToken)
-                .send()
-                .end((err, res) => {
-
-                  if (err) { console.error("err: ", err); }
-                  if (log) { console.log("res.body", res.body); }
-
-                  res.should.have.status(401);
-
-                  done();
-                });
-            });
-        });
-      });
-    }).timeout(20000);
-
-
-    it('decodeWithIatTooHightExp', (done) => {
-
-      var email = "test-signup-" + Date.now() + "@email.com";
-      var pwd = "pwd";
-
-      userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
-        projectService.create("test-join-member", savedUser._id).then(function (savedProject) {
-          chai.request(server)
-            .post('/' + savedProject._id + '/keys/generate')
-            .auth(email, pwd)
-            .send()
-            .end((err, res) => {
-
-              if (err) { console.error("err: ", err); }
-              if (log) { console.log("res.body", res.body); }
-
-              res.should.have.status(200);
-              res.body.should.be.a('object');
-              expect(res.body.jwtSecret).to.not.equal(null);
-
-              var jwtToken = jwt.sign({ "name": "andrea", "surname": "leo" }, res.body.jwtSecret, { expiresIn: 800 });
-              if (log) { console.log("jwtToken", jwtToken); }
-
-              chai.request(server)
-                .post('/' + savedProject._id + '/jwt/decode')
-                .set('Authorization', 'JWT ' + jwtToken)
-                .send()
-                .end((err, res) => {
-
-                  if (err) { console.error("err: ", err); }
-                  if (log) { console.log("res.body", res.body); }
-
-                  res.should.have.status(401);
-
-                  done();
-                });
+              expect(res.body.success).to.equal(false);
+              expect(res.body.msg).to.equal('deprecated');
+              done();
             });
         });
       });
@@ -170,5 +71,3 @@ describe('JWTRoute', () => {
   });
 
 });
-
-