@verdaccio/api 6.0.0-6-next.23 → 6.0.0-6-next.26

package/test/integration/package.spec.ts

@@ -2,32 +2,7 @@ import supertest from 'supertest';
 
 import { HEADERS, HEADER_TYPE, HTTP_STATUS } from '@verdaccio/core';
 
-import { $RequestExtend, $ResponseExtend } from '../../types/custom';
-import { initializeServer, publishTaggedVersion, publishVersion } from './_helper';
-
-const mockApiJWTmiddleware = jest.fn(
-  () =>
-    (req: $RequestExtend, res: $ResponseExtend, _next): void => {
-      req.remote_user = { name: 'foo', groups: [], real_groups: [] };
-      _next();
-    }
-);
-
-jest.mock('@verdaccio/auth', () => ({
-  Auth: class {
-    apiJWTmiddleware() {
-      return mockApiJWTmiddleware();
-    }
-    allow_access(_d, _f, cb) {
-      // always allow access
-      cb(null, true);
-    }
-    allow_publish(_d, _f, cb) {
-      // always allow publish
-      cb(null, true);
-    }
-  },
-}));
+import { initializeServer, publishVersion } from './_helper';
 
 describe('package', () => {
   let app;
@@ -35,57 +10,39 @@ describe('package', () => {
     app = await initializeServer('package.yaml');
   });
 
-  test('should return a package', async () => {
-    await publishVersion(app, 'package.yaml', 'foo', '1.0.0');
-    return new Promise((resolve) => {
-      supertest(app)
-        .get('/foo')
-        .set('Accept', HEADERS.JSON)
-        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
-        .expect(HTTP_STATUS.OK)
-        .then((response) => {
-          expect(response.body.name).toEqual('foo');
-          resolve(response);
-        });
-    });
-  });
-
-  test('should return a package by version', async () => {
-    await publishVersion(app, 'package.yaml', 'foo2', '1.0.0');
-    return new Promise((resolve) => {
-      supertest(app)
-        .get('/foo2/1.0.0')
-        .set('Accept', HEADERS.JSON)
-        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
-        .expect(HTTP_STATUS.OK)
-        .then((response) => {
-          expect(response.body.name).toEqual('foo2');
-          resolve(response);
-        });
-    });
-  });
-
-  // FIXME: investigate the 404
-  test.skip('should return a package by dist-tag', async (done) => {
-    // await publishVersion(app, 'package.yaml', 'foo3', '1.0.0');
-    await publishVersion(app, 'package.yaml', 'foo-tagged', '1.0.0');
-    await publishTaggedVersion(app, 'package.yaml', 'foo-tagged', '1.0.1', 'test');
-    return supertest(app)
-      .get('/foo-tagged/1.0.1')
-      .set('Accept', HEADERS.JSON)
+  test.each([['foo'], ['@scope/foo']])('should return a foo private package', async (pkg) => {
+    await publishVersion(app, pkg, '1.0.0');
+    const response = await supertest(app)
+      .get(`/${pkg}`)
+      .set(HEADERS.ACCEPT, HEADERS.JSON)
       .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
-      .expect(HTTP_STATUS.CREATED)
-      .then((response) => {
-        expect(response.body.name).toEqual('foo3');
-        done();
-      });
+      .expect(HTTP_STATUS.OK);
+    expect(response.body.name).toEqual(pkg);
   });
 
-  test('should return 404', async () => {
-    return supertest(app)
-      .get('/404-not-found')
-      .set('Accept', HEADERS.JSON)
-      .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
-      .expect(HTTP_STATUS.NOT_FOUND);
-  });
+  test.each([['foo'], ['@scope/foo']])(
+    'should return a foo private package by version',
+    async (pkg) => {
+      await publishVersion(app, pkg, '1.0.0');
+      const response = await supertest(app)
+        .get(`/${pkg}`)
+        .set(HEADERS.ACCEPT, HEADERS.JSON)
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.OK);
+      expect(response.body.name).toEqual(pkg);
+    }
+  );
+
+  test.each([['foo'], ['@scope/foo']])(
+    'should return a foo private package by version',
+    async (pkg) => {
+      await publishVersion(app, pkg, '1.0.0');
+      const response = await supertest(app)
+        .get(`/${pkg}`)
+        .set(HEADERS.ACCEPT, HEADERS.JSON)
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.OK);
+      expect(response.body.name).toEqual(pkg);
+    }
+  );
 });

package/test/integration/ping.spec.ts

@@ -6,11 +6,12 @@ import { initializeServer } from './_helper';
 
 describe('ping', () => {
   test('should return the reply the ping', async () => {
-    return supertest(await initializeServer('ping.yaml'))
+    const app = await initializeServer('ping.yaml');
+    const response = await supertest(app)
       .get('/-/ping')
       .set('Accept', HEADERS.JSON)
       .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
-      .expect(HTTP_STATUS.OK)
-      .then((response) => expect(response.body).toEqual({}));
+      .expect(HTTP_STATUS.OK);
+    expect(response.body).toEqual({});
   });
 });

package/test/integration/publish.spec.ts

@@ -2,7 +2,7 @@ import supertest from 'supertest';
 
 import { HTTP_STATUS } from '@verdaccio/core';
 import { API_ERROR, API_MESSAGE, HEADERS, HEADER_TYPE } from '@verdaccio/core';
-import { generatePackageMetadata } from '@verdaccio/helper';
+import { generatePackageMetadata } from '@verdaccio/test-helper';
 
 import { $RequestExtend, $ResponseExtend } from '../../types/custom';
 import { initializeServer, publishVersion } from './_helper';
@@ -60,9 +60,9 @@ describe('publish', () => {
   describe('handle invalid publish formats', () => {
     const pkgName = 'test';
     const pkgMetadata = generatePackageMetadata(pkgName, '1.0.0');
-    test.skip('should fail on publish a bad _attachments package', async (done) => {
+    test('should fail on publish a bad _attachments package', async () => {
       const app = await initializeServer('publish.yaml');
-      return supertest(app)
+      const response = await supertest(app)
         .put(`/${encodeURIComponent(pkgName)}`)
         .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
         .send(
@@ -73,12 +73,8 @@ describe('publish', () => {
           )
         )
         .set('accept', HEADERS.GZIP)
-        .expect(HTTP_STATUS.BAD_REQUEST)
-        .then((response) => {
-          console.log('response.body', response.body);
-          expect(response.body.error).toEqual(API_ERROR.UNSUPORTED_REGISTRY_CALL);
-          done();
-        });
+        .expect(HTTP_STATUS.BAD_REQUEST);
+      expect(response.body.error).toEqual(API_ERROR.UNSUPORTED_REGISTRY_CALL);
     });
 
     test('should fail on publish a bad versions package', async () => {
@@ -97,7 +93,6 @@ describe('publish', () => {
           .set('accept', HEADERS.GZIP)
           .expect(HTTP_STATUS.BAD_REQUEST)
           .then((response) => {
-            console.log('response.body', response.body);
             expect(response.body.error).toEqual(API_ERROR.UNSUPORTED_REGISTRY_CALL);
             resolve(response);
           });
@@ -109,7 +104,7 @@ describe('publish', () => {
     test('should publish a package', async () => {
       const app = await initializeServer('publish.yaml');
       return new Promise((resolve) => {
-        publishVersion(app, 'publish.yaml', 'foo', '1.0.0')
+        publishVersion(app, 'foo', '1.0.0')
           .expect(HTTP_STATUS.CREATED)
           .then((response) => {
             expect(response.body.ok).toEqual(API_MESSAGE.PKG_CREATED);
@@ -126,13 +121,7 @@ describe('publish', () => {
         supertest(app)
           .put(`/${encodeURIComponent(pkgName)}`)
           .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
-          .send(
-            JSON.stringify(
-              Object.assign({}, pkgMetadata, {
-                _attachments: null,
-              })
-            )
-          )
+          .send(JSON.stringify(Object.assign({}, pkgMetadata)))
           .set('accept', HEADERS.GZIP)
           .expect(HTTP_STATUS.CREATED)
           .then((response) => {
@@ -173,12 +162,11 @@ describe('publish', () => {
 
   test('should fails on publish a duplicated package', async () => {
     const app = await initializeServer('publish.yaml');
-    await publishVersion(app, 'publish.yaml', 'foo', '1.0.0');
+    await publishVersion(app, 'foo', '1.0.0');
     return new Promise((resolve) => {
-      publishVersion(app, 'publish.yaml', 'foo', '1.0.0')
+      publishVersion(app, 'foo', '1.0.0')
         .expect(HTTP_STATUS.CONFLICT)
         .then((response) => {
-          console.log('response.body', response.body);
           expect(response.body.error).toEqual(API_ERROR.PACKAGE_EXIST);
           resolve(response);
         });
@@ -186,14 +174,61 @@ describe('publish', () => {
   });
 
   describe('unpublish a package', () => {
-    let app;
+    test('should unpublish entirely a package', async () => {
+      const app = await initializeServer('publish.yaml');
+      await publishVersion(app, 'foo', '1.0.0');
+      const response = await supertest(app)
+        // FIXME: should be filtered by revision to avoid
+        // conflicts
+        .delete(`/${encodeURIComponent('foo')}/-rev/xxx`)
+        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+        .expect(HTTP_STATUS.CREATED);
+      expect(response.body.ok).toEqual(API_MESSAGE.PKG_REMOVED);
+      // package should be completely un published
+      await supertest(app)
+        .get('/foo')
+        .set('Accept', HEADERS.JSON)
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.NOT_FOUND);
+    });
+
+    test('should fails unpublish entirely a package', async () => {
+      const app = await initializeServer('publish.yaml');
+      const response = await supertest(app)
+        .delete(`/${encodeURIComponent('foo')}/-rev/1cf3-fe3`)
+        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+        .expect(HTTP_STATUS.NOT_FOUND);
+      expect(response.body.error).toEqual(API_ERROR.NO_PACKAGE);
+    });
+
+    test('should fails remove a tarball of a package does not exist', async () => {
+      const app = await initializeServer('publish.yaml');
+      const response = await supertest(app)
+        .delete(`/foo/-/foo-1.0.3.tgz/-rev/revision`)
+        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+        .expect(HTTP_STATUS.NOT_FOUND);
+      expect(response.body.error).toEqual(API_ERROR.NO_PACKAGE);
+    });
 
-    beforeEach(async () => {
-      app = await initializeServer('publish.yaml');
-      await publishVersion(app, 'publish.yaml', 'foo', '1.0.0');
+    test('should fails on try remove a tarball does not exist', async () => {
+      const app = await initializeServer('publish.yaml');
+      await publishVersion(app, 'foo', '1.0.0');
+      const response = await supertest(app)
+        .delete(`/foo/-/foo-1.0.3.tgz/-rev/revision`)
+        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+        .expect(HTTP_STATUS.NOT_FOUND);
+      expect(response.body.error).toEqual(API_ERROR.NO_SUCH_FILE);
     });
 
-    test('should unpublish a package', () => {});
+    test('should remove a tarball that does exist', async () => {
+      const app = await initializeServer('publish.yaml');
+      await publishVersion(app, 'foo', '1.0.0');
+      const response = await supertest(app)
+        .delete(`/foo/-/foo-1.0.0.tgz/-rev/revision`)
+        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+        .expect(HTTP_STATUS.CREATED);
+      expect(response.body.ok).toEqual(API_MESSAGE.TARBALL_REMOVED);
+    });
   });
 
   describe('star a package', () => {});

package/test/integration/search.spec.ts

@@ -0,0 +1,126 @@
+import MockDate from 'mockdate';
+import supertest from 'supertest';
+
+import { HEADERS, HEADER_TYPE, HTTP_STATUS } from '@verdaccio/core';
+
+import { createUser, initializeServer, publishVersionWithToken } from './_helper';
+
+describe('search', () => {
+  let app;
+  beforeEach(async () => {
+    app = await initializeServer('search.yaml');
+  });
+
+  describe('search authenticated', () => {
+    test.each([['foo']])('should return a foo private package', async (pkg) => {
+      const mockDate = '2018-01-14T11:17:40.712Z';
+      MockDate.set(mockDate);
+      const res = await createUser(app, 'test', 'test');
+      await publishVersionWithToken(app, pkg, '1.0.0', res.body.token);
+      // this should not be displayed as part of the search
+      await publishVersionWithToken(app, 'private-auth', '1.0.0', res.body.token);
+      const response = await supertest(app)
+        .get(
+          `/-/v1/search?text=${encodeURIComponent(
+            pkg
+          )}&size=2000&from=0&quality=1&popularity=0.1&maintenance=0.1`
+        )
+        .set(HEADERS.ACCEPT, HEADERS.JSON)
+        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+        .expect(HEADERS.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.OK);
+      expect(response.body).toEqual({
+        objects: [
+          {
+            package: {
+              author: {
+                email: 'user@domain.com',
+                name: 'User NPM',
+              },
+              date: mockDate,
+              description: 'package generated',
+              keywords: [],
+              links: {
+                npm: '',
+              },
+              name: pkg,
+              publisher: {},
+              scope: '',
+              version: '1.0.0',
+            },
+            score: {
+              detail: {
+                maintenance: 0,
+                popularity: 1,
+                quality: 1,
+              },
+              final: 1,
+            },
+            searchScore: 1,
+            verdaccioPkgCached: false,
+            verdaccioPrivate: true,
+          },
+        ],
+        time: 'Sun, 14 Jan 2018 11:17:40 GMT',
+        total: 1,
+      });
+    });
+
+    test.each([['@scope/foo']])('should return a scoped foo private package', async (pkg) => {
+      const mockDate = '2018-01-14T11:17:40.712Z';
+      MockDate.set(mockDate);
+      const res = await createUser(app, 'test', 'test');
+      await publishVersionWithToken(app, pkg, '1.0.0', res.body.token);
+      // this should not be displayed as part of the search
+      await publishVersionWithToken(app, '@private/auth', '1.0.0', res.body.token);
+      const response = await supertest(app)
+        .get(
+          `/-/v1/search?text=${encodeURIComponent(
+            pkg
+          )}&size=2000&from=0&quality=1&popularity=0.1&maintenance=0.1`
+        )
+        .set(HEADERS.ACCEPT, HEADERS.JSON)
+        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+        .expect(HEADERS.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.OK);
+      expect(response.body).toEqual({
+        objects: [
+          {
+            package: {
+              author: {
+                email: 'user@domain.com',
+                name: 'User NPM',
+              },
+              date: mockDate,
+              description: 'package generated',
+              keywords: [],
+              links: {
+                npm: '',
+              },
+              name: pkg,
+              publisher: {},
+              scope: '@scope',
+              version: '1.0.0',
+            },
+            score: {
+              detail: {
+                maintenance: 0,
+                popularity: 1,
+                quality: 1,
+              },
+              final: 1,
+            },
+            searchScore: 1,
+            verdaccioPkgCached: false,
+            verdaccioPrivate: true,
+          },
+        ],
+        time: 'Sun, 14 Jan 2018 11:17:40 GMT',
+        total: 1,
+      });
+    });
+  });
+  describe('error handling', () => {
+    test.todo('should able to abort the request');
+  });
+});

package/test/integration/token.spec.ts

@@ -0,0 +1,124 @@
+import _ from 'lodash';
+import supertest from 'supertest';
+
+import {
+  API_ERROR,
+  HEADERS,
+  HEADER_TYPE,
+  HTTP_STATUS,
+  SUPPORT_ERRORS,
+  TOKEN_BEARER,
+} from '@verdaccio/core';
+import { buildToken } from '@verdaccio/utils';
+
+import { deleteTokenCLI, generateTokenCLI, getNewToken, initializeServer } from './_helper';
+
+describe('token', () => {
+  describe('basics', () => {
+    test.each([['token.yaml'], ['token.jwt.yaml']])('should list empty tokens', async (conf) => {
+      const app = await initializeServer(conf);
+      const token = await getNewToken(app, { name: 'jota_token', password: 'secretPass' });
+      const response = await supertest(app)
+        .get('/-/npm/v1/tokens')
+        .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token))
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.OK);
+      expect(response.body.objects).toHaveLength(0);
+    });
+
+    test.each([['token.yaml'], ['token.jwt.yaml']])('should generate one token', async (conf) => {
+      const app = await initializeServer(conf);
+      const credentials = { name: 'jota_token', password: 'secretPass' };
+      const token = await getNewToken(app, credentials);
+      await generateTokenCLI(app, token, {
+        password: credentials.password,
+        readonly: false,
+        cidr_whitelist: [],
+      });
+      const response = await supertest(app)
+        .get('/-/npm/v1/tokens')
+        .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token))
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.OK);
+      const { objects, urls } = response.body;
+
+      expect(objects).toHaveLength(1);
+      const [tokenGenerated] = objects;
+      expect(tokenGenerated.user).toEqual(credentials.name);
+      expect(tokenGenerated.readonly).toBeFalsy();
+      expect(tokenGenerated.token).toMatch(/.../);
+      expect(_.isString(tokenGenerated.created)).toBeTruthy();
+
+      // we don't support pagination yet
+      expect(urls.next).toEqual('');
+    });
+
+    test.each([['token.yaml'], ['token.jwt.yaml']])('should delete a token', async (conf) => {
+      const app = await initializeServer(conf);
+      const credentials = { name: 'jota_token', password: 'secretPass' };
+      const token = await getNewToken(app, credentials);
+      const response = await generateTokenCLI(app, token, {
+        password: credentials.password,
+        readonly: false,
+        cidr_whitelist: [],
+      });
+
+      const key = response.body.key;
+      await deleteTokenCLI(app, token, key);
+      const response2 = await supertest(app)
+        .get('/-/npm/v1/tokens')
+        .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token))
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.OK);
+      const { objects } = response2.body;
+      expect(objects).toHaveLength(0);
+    });
+  });
+
+  describe('handle errors', () => {
+    test.each([['token.yaml'], ['token.jwt.yaml']])('should delete a token', async (conf) => {
+      const app = await initializeServer(conf);
+      const credentials = { name: 'jota_token', password: 'secretPass' };
+      const token = await getNewToken(app, credentials);
+      const resp = await generateTokenCLI(app, token, {
+        password: 'wrongPassword',
+        readonly: false,
+        cidr_whitelist: [],
+      });
+      expect(resp.body.error).toEqual(API_ERROR.BAD_USERNAME_PASSWORD);
+    });
+
+    test.each([['token.yaml'], ['token.jwt.yaml']])(
+      'should fail if readonly is missing',
+      async (conf) => {
+        const app = await initializeServer(conf);
+        const credentials = { name: 'jota_token', password: 'secretPass' };
+        const token = await getNewToken(app, credentials);
+        const resp = await generateTokenCLI(app, token, {
+          password: credentials.password,
+          cidr_whitelist: [],
+        });
+        expect(resp.body.error).toEqual(SUPPORT_ERRORS.PARAMETERS_NOT_VALID);
+      }
+    );
+  });
+
+  test.each([['token.yaml'], ['token.jwt.yaml']])(
+    'should fail if cidr_whitelist is missing',
+    async (conf) => {
+      const app = await initializeServer(conf);
+      const credentials = { name: 'jota_token', password: 'secretPass' };
+      const token = await getNewToken(app, credentials);
+      const resp = await generateTokenCLI(app, token, {
+        password: credentials.password,
+        readonly: false,
+      });
+      expect(resp.body.error).toEqual(SUPPORT_ERRORS.PARAMETERS_NOT_VALID);
+    }
+  );
+
+  test.todo('handle failure if delete token');
+  test.todo('handle failure if getApiToken fails');
+  test.todo('handle failure if token creating fails');
+  test.todo('handle failure if token list fails');
+});

package/test/integration/user.jwt.spec.ts

@@ -0,0 +1,87 @@
+import nock from 'nock';
+import supertest from 'supertest';
+
+import { API_ERROR, HEADERS, HEADER_TYPE, HTTP_STATUS, TOKEN_BEARER } from '@verdaccio/core';
+import { generateRemotePackageMetadata } from '@verdaccio/test-helper';
+import { buildToken } from '@verdaccio/utils';
+
+import { createUser, getPackage, initializeServer } from './_helper';
+
+const FORBIDDEN_VUE = 'authorization required to access package vue';
+
+describe('token', () => {
+  describe('basics', () => {
+    const FAKE_TOKEN: string = buildToken(TOKEN_BEARER, 'fake');
+    test.each([['user.yaml'], ['user.jwt.yaml']])('should test add a new user', async (conf) => {
+      const upstreamManifest = generateRemotePackageMetadata(
+        'vue',
+        '1.0.0',
+        'https://registry.verdaccio.org'
+      );
+      nock('https://registry.verdaccio.org').get(`/vue`).reply(201, upstreamManifest);
+
+      const app = await initializeServer(conf);
+      const credentials = { name: 'JotaJWT', password: 'secretPass' };
+      const response = await createUser(app, credentials.name, credentials.password);
+      expect(response.body.ok).toMatch(`user '${credentials.name}' created`);
+
+      const vueResponse = await getPackage(app, response.body.token, 'vue');
+      expect(vueResponse.body).toBeDefined();
+      expect(vueResponse.body.name).toMatch('vue');
+
+      const vueFailResp = await getPackage(app, FAKE_TOKEN, 'vue', HTTP_STATUS.UNAUTHORIZED);
+      expect(vueFailResp.body.error).toMatch(FORBIDDEN_VUE);
+    });
+
+    test.each([['user.yaml'], ['user.jwt.yaml']])('should test add a new user', async (conf) => {
+      const app = await initializeServer(conf);
+      const credentials = { name: 'JotaJWT', password: 'secretPass' };
+      const response = await createUser(app, credentials.name, credentials.password);
+      expect(response.body.ok).toMatch(`user '${credentials.name}' created`);
+      const response2 = await supertest(app)
+        .put(`/-/user/org.couchdb.user:${credentials.name}`)
+        .send({
+          name: credentials.name,
+          password: credentials.password,
+        })
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HTTP_STATUS.CONFLICT);
+      expect(response2.body.error).toBe(API_ERROR.USERNAME_ALREADY_REGISTERED);
+    });
+
+    test.each([['user.yaml'], ['user.jwt.yaml']])(
+      'should fails on login if user credentials are invalid even if jwt',
+      async (conf) => {
+        const app = await initializeServer(conf);
+        const credentials = { name: 'newFailsUser', password: 'secretPass' };
+        const response = await createUser(app, credentials.name, credentials.password);
+        expect(response.body.ok).toMatch(`user '${credentials.name}' created`);
+        const response2 = await supertest(app)
+          .put(`/-/user/org.couchdb.user:${credentials.name}`)
+          .send({
+            name: credentials.name,
+            password: 'BAD_PASSWORD',
+          })
+          .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+          .expect(HTTP_STATUS.UNAUTHORIZED);
+        expect(response2.body.error).toBe(API_ERROR.UNAUTHORIZED_ACCESS);
+      }
+    );
+
+    test.each([['user.yaml'], ['user.jwt.yaml']])(
+      'should verify if user is logged',
+      async (conf) => {
+        const app = await initializeServer(conf);
+        const credentials = { name: 'jota', password: 'secretPass' };
+        const response = await createUser(app, credentials.name, credentials.password);
+        expect(response.body.ok).toMatch(`user '${credentials.name}' created`);
+        const response2 = await supertest(app)
+          .get(`/-/user/org.couchdb.user:${credentials.name}`)
+          .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, response.body.token))
+          .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+          .expect(HTTP_STATUS.OK);
+        expect(response2.body.ok).toBe(`you are authenticated as '${credentials.name}'`);
+      }
+    );
+  });
+});

package/test/integration/user.spec.ts

@@ -47,6 +47,7 @@ jest.mock('@verdaccio/auth', () => ({
   },
 }));
 
+// FIXME:  This might be covered with user.jwt.spec
 describe('user', () => {
   const credentials = { name: 'test', password: 'test' };