@verdaccio/web 6.0.0-6-next.58 → 6.0.0-6-next.60
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +32 -0
- package/build/api/user.js +9 -10
- package/build/api/user.js.map +1 -1
- package/package.json +14 -15
- package/src/api/user.ts +10 -15
- package/test/api.user.test.ts +116 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,37 @@
|
|
|
1
1
|
# @verdaccio/web
|
|
2
2
|
|
|
3
|
+
## 6.0.0-6-next.60
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [f859d2b1a]
|
|
8
|
+
- @verdaccio/core@6.0.0-6-next.73
|
|
9
|
+
- @verdaccio/middleware@6.0.0-6-next.52
|
|
10
|
+
- @verdaccio/auth@6.0.0-6-next.52
|
|
11
|
+
- @verdaccio/config@6.0.0-6-next.73
|
|
12
|
+
- @verdaccio/tarball@11.0.0-6-next.42
|
|
13
|
+
- @verdaccio/url@11.0.0-6-next.39
|
|
14
|
+
- @verdaccio/loaders@6.0.0-6-next.42
|
|
15
|
+
- @verdaccio/store@6.0.0-6-next.53
|
|
16
|
+
- @verdaccio/utils@6.0.0-6-next.41
|
|
17
|
+
- @verdaccio/logger@6.0.0-6-next.41
|
|
18
|
+
|
|
19
|
+
## 6.0.0-6-next.59
|
|
20
|
+
|
|
21
|
+
### Patch Changes
|
|
22
|
+
|
|
23
|
+
- 702d5c497: Fix the password validation logic for the `/reset_password` route to ensure that the password is only reset if it is valid.
|
|
24
|
+
- @verdaccio/core@6.0.0-6-next.72
|
|
25
|
+
- @verdaccio/config@6.0.0-6-next.72
|
|
26
|
+
- @verdaccio/auth@6.0.0-6-next.51
|
|
27
|
+
- @verdaccio/tarball@11.0.0-6-next.41
|
|
28
|
+
- @verdaccio/url@11.0.0-6-next.38
|
|
29
|
+
- @verdaccio/loaders@6.0.0-6-next.41
|
|
30
|
+
- @verdaccio/middleware@6.0.0-6-next.51
|
|
31
|
+
- @verdaccio/store@6.0.0-6-next.52
|
|
32
|
+
- @verdaccio/utils@6.0.0-6-next.40
|
|
33
|
+
- @verdaccio/logger@6.0.0-6-next.40
|
|
34
|
+
|
|
3
35
|
## 6.0.0-6-next.58
|
|
4
36
|
|
|
5
37
|
### Patch Changes
|
package/build/api/user.js
CHANGED
|
@@ -53,18 +53,17 @@ function addUserAuthApi(auth, config) {
|
|
|
53
53
|
name
|
|
54
54
|
} = req.remote_user;
|
|
55
55
|
if (_core.validatioUtils.validatePassword(password.new, config === null || config === void 0 ? void 0 : (_config$serverSetting = config.serverSettings) === null || _config$serverSetting === void 0 ? void 0 : _config$serverSetting.passwordValidationRegex) === false) {
|
|
56
|
-
auth.changePassword(name, password.old, password.new, (err, isUpdated) => {
|
|
57
|
-
if (_lodash.default.isNil(err) && isUpdated) {
|
|
58
|
-
next({
|
|
59
|
-
ok: true
|
|
60
|
-
});
|
|
61
|
-
} else {
|
|
62
|
-
return next(_core.errorUtils.getInternalError(_core.API_ERROR.INTERNAL_SERVER_ERROR));
|
|
63
|
-
}
|
|
64
|
-
});
|
|
65
|
-
} else {
|
|
66
56
|
return next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.APP_ERROR.PASSWORD_VALIDATION));
|
|
67
57
|
}
|
|
58
|
+
auth.changePassword(name, password.old, password.new, (err, isUpdated) => {
|
|
59
|
+
if (_lodash.default.isNil(err) && isUpdated) {
|
|
60
|
+
next({
|
|
61
|
+
ok: true
|
|
62
|
+
});
|
|
63
|
+
} else {
|
|
64
|
+
return next(_core.errorUtils.getInternalError(_core.API_ERROR.INTERNAL_SERVER_ERROR));
|
|
65
|
+
}
|
|
66
|
+
});
|
|
68
67
|
});
|
|
69
68
|
}
|
|
70
69
|
return route;
|
package/build/api/user.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"user.js","names":["_debug","_interopRequireDefault","require","_express","_lodash","_core","_middleware","obj","__esModule","default","debug","buildDebug","addUserAuthApi","auth","config","_config$flags","route","Router","post","rateLimit","userRateLimit","req","res","next","username","password","body","authenticate","err","user","errorCode","message","HTTP_STATUS","UNAUTHORIZED","INTERNAL_ERROR","errorUtils","getCode","remote_user","jWTSignOptions","security","web","sign","set","HEADERS","CACHE_CONTROL","token","jwtEncrypt","name","flags","changePassword","put","_config$serverSetting","_","isNil","status","API_ERROR","MUST_BE_LOGGED","validatioUtils","validatePassword","new","serverSettings","passwordValidationRegex","
|
|
1
|
+
{"version":3,"file":"user.js","names":["_debug","_interopRequireDefault","require","_express","_lodash","_core","_middleware","obj","__esModule","default","debug","buildDebug","addUserAuthApi","auth","config","_config$flags","route","Router","post","rateLimit","userRateLimit","req","res","next","username","password","body","authenticate","err","user","errorCode","message","HTTP_STATUS","UNAUTHORIZED","INTERNAL_ERROR","errorUtils","getCode","remote_user","jWTSignOptions","security","web","sign","set","HEADERS","CACHE_CONTROL","token","jwtEncrypt","name","flags","changePassword","put","_config$serverSetting","_","isNil","status","API_ERROR","MUST_BE_LOGGED","validatioUtils","validatePassword","new","serverSettings","passwordValidationRegex","BAD_REQUEST","APP_ERROR","PASSWORD_VALIDATION","old","isUpdated","ok","getInternalError","INTERNAL_SERVER_ERROR","_default","exports"],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Request, Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n APP_ERROR,\n HEADERS,\n HTTP_STATUS,\n VerdaccioError,\n errorUtils,\n validatioUtils,\n} from '@verdaccio/core';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nfunction addUserAuthApi(auth: Auth, config: Config): Router {\n const route = Router(); /* eslint new-cap: 0 */\n route.post(\n '/login',\n rateLimit(config?.userRateLimit),\n function (req: Request, res: Response, next: $NextFunctionVer): void {\n const { username, password } = req.body;\n debug('authenticate %o', username);\n auth.authenticate(\n username,\n password,\n async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n if (err) {\n const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n debug('error authenticate %o', errorCode);\n next(errorUtils.getCode(errorCode, err.message));\n } else {\n req.remote_user = user as RemoteUser;\n const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n next({\n token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n username: req.remote_user.name,\n });\n }\n }\n );\n }\n );\n\n if (config?.flags?.changePassword === true) {\n route.put(\n '/reset_password',\n rateLimit(config?.userRateLimit),\n function (req: Request, res: Response, next: $NextFunctionVer): void {\n if (_.isNil(req.remote_user.name)) {\n res.status(HTTP_STATUS.UNAUTHORIZED);\n return next({\n // FUTURE: update to a more meaningful message\n message: API_ERROR.MUST_BE_LOGGED,\n });\n }\n\n const { password } = req.body;\n const { name } = req.remote_user;\n\n if (\n validatioUtils.validatePassword(\n password.new,\n config?.serverSettings?.passwordValidationRegex\n ) === false\n ) {\n return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n }\n\n auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {\n if (_.isNil(err) && isUpdated) {\n next({\n ok: true,\n });\n } else {\n return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n }\n });\n }\n );\n }\n\n return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,QAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAGA,IAAAG,KAAA,GAAAH,OAAA;AASA,IAAAI,WAAA,GAAAJ,OAAA;AAAkD,SAAAD,uBAAAM,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAKlD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,wBAAwB,CAAC;AAElD,SAASC,cAAcA,CAACC,IAAU,EAAEC,MAAc,EAAU;EAAA,IAAAC,aAAA;EAC1D,MAAMC,KAAK,GAAG,IAAAC,eAAM,EAAC,CAAC,CAAC,CAAC;EACxBD,KAAK,CAACE,IAAI,CACR,QAAQ,EACR,IAAAC,qBAAS,EAACL,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEM,aAAa,CAAC,EAChC,UAAUC,GAAY,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IACnE,MAAM;MAAEC,QAAQ;MAAEC;IAAS,CAAC,GAAGJ,GAAG,CAACK,IAAI;IACvChB,KAAK,CAAC,iBAAiB,EAAEc,QAAQ,CAAC;IAClCX,IAAI,CAACc,YAAY,CACfH,QAAQ,EACRC,QAAQ,EACR,OAAOG,GAA0B,EAAEC,IAAiB,KAAoB;MACtE,IAAID,GAAG,EAAE;QACP,MAAME,SAAS,GAAGF,GAAG,CAACG,OAAO,GAAGC,iBAAW,CAACC,YAAY,GAAGD,iBAAW,CAACE,cAAc;QACrFxB,KAAK,CAAC,uBAAuB,EAAEoB,SAAS,CAAC;QACzCP,IAAI,CAACY,gBAAU,CAACC,OAAO,CAACN,SAAS,EAAEF,GAAG,CAACG,OAAO,CAAC,CAAC;MAClD,CAAC,MAAM;QACLV,GAAG,CAACgB,WAAW,GAAGR,IAAkB;QACpC,MAAMS,cAA8B,GAAGxB,MAAM,CAACyB,QAAQ,CAACC,GAAG,CAACC,IAAI;QAC/DnB,GAAG,CAACoB,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpDrB,IAAI,CAAC;UACHsB,KAAK,EAAE,MAAMhC,IAAI,CAACiC,UAAU,CAACjB,IAAI,EAAgBS,cAAc,CAAC;UAChEd,QAAQ,EAAEH,GAAG,CAACgB,WAAW,CAACU;QAC5B,CAAC,CAAC;MACJ;IACF,CACF,CAAC;EACH,CACF,CAAC;EAED,IAAI,CAAAjC,MAAM,aAANA,MAAM,wBAAAC,aAAA,GAAND,MAAM,CAAEkC,KAAK,cAAAjC,aAAA,uBAAbA,aAAA,CAAekC,cAAc,MAAK,IAAI,EAAE;IAC1CjC,KAAK,CAACkC,GAAG,CACP,iBAAiB,EACjB,IAAA/B,qBAAS,EAACL,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEM,aAAa,CAAC,EAChC,UAAUC,GAAY,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;MAAA,IAAA4B,qBAAA;MACnE,IAAIC,eAAC,CAACC,KAAK,CAAChC,GAAG,CAACgB,WAAW,CAACU,IAAI,CAAC,EAAE;QACjCzB,GAAG,CAACgC,MAAM,CAACtB,iBAAW,CAACC,YAAY,CAAC;QACpC,OAAOV,IAAI,CAAC;UACV;UACAQ,OAAO,EAAEwB,eAAS,CAACC;QACrB,CAAC,CAAC;MACJ;MAEA,MAAM;QAAE/B;MAAS,CAAC,GAAGJ,GAAG,CAACK,IAAI;MAC7B,MAAM;QAAEqB;MAAK,CAAC,GAAG1B,GAAG,CAACgB,WAAW;MAEhC,IACEoB,oBAAc,CAACC,gBAAgB,CAC7BjC,QAAQ,CAACkC,GAAG,EACZ7C,MAAM,aAANA,MAAM,wBAAAqC,qBAAA,GAANrC,MAAM,CAAE8C,cAAc,cAAAT,qBAAA,uBAAtBA,qBAAA,CAAwBU,uBAC1B,CAAC,KAAK,KAAK,EACX;QACA,OAAOtC,IAAI,CAACY,gBAAU,CAACC,OAAO,CAACJ,iBAAW,CAAC8B,WAAW,EAAEC,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACzF;MAEAnD,IAAI,CAACoC,cAAc,CAACF,IAAI,EAAYtB,QAAQ,CAACwC,GAAG,EAAExC,QAAQ,CAACkC,GAAG,EAAE,CAAC/B,GAAG,EAAEsC,SAAS,KAAW;QACxF,IAAId,eAAC,CAACC,KAAK,CAACzB,GAAG,CAAC,IAAIsC,SAAS,EAAE;UAC7B3C,IAAI,CAAC;YACH4C,EAAE,EAAE;UACN,CAAC,CAAC;QACJ,CAAC,MAAM;UACL,OAAO5C,IAAI,CAACY,gBAAU,CAACiC,gBAAgB,CAACb,eAAS,CAACc,qBAAqB,CAAC,CAAC;QAC3E;MACF,CAAC,CAAC;IACJ,CACF,CAAC;EACH;EAEA,OAAOrD,KAAK;AACd;AAAC,IAAAsD,QAAA,GAEc1D,cAAc;AAAA2D,OAAA,CAAA9D,OAAA,GAAA6D,QAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@verdaccio/web",
|
|
3
|
-
"version": "6.0.0-6-next.
|
|
3
|
+
"version": "6.0.0-6-next.60",
|
|
4
4
|
"description": "web ui middleware",
|
|
5
5
|
"main": "./build/index.js",
|
|
6
6
|
"types": "build/index.d.ts",
|
|
@@ -25,32 +25,31 @@
|
|
|
25
25
|
},
|
|
26
26
|
"license": "MIT",
|
|
27
27
|
"dependencies": {
|
|
28
|
-
"@verdaccio/auth": "6.0.0-6-next.
|
|
29
|
-
"@verdaccio/core": "6.0.0-6-next.
|
|
30
|
-
"@verdaccio/config": "6.0.0-6-next.
|
|
31
|
-
"@verdaccio/loaders": "6.0.0-6-next.
|
|
32
|
-
"@verdaccio/logger": "6.0.0-6-next.
|
|
33
|
-
"@verdaccio/middleware": "6.0.0-6-next.
|
|
34
|
-
"@verdaccio/store": "6.0.0-6-next.
|
|
35
|
-
"@verdaccio/tarball": "11.0.0-6-next.
|
|
36
|
-
"@verdaccio/url": "11.0.0-6-next.
|
|
37
|
-
"@verdaccio/utils": "6.0.0-6-next.
|
|
28
|
+
"@verdaccio/auth": "6.0.0-6-next.52",
|
|
29
|
+
"@verdaccio/core": "6.0.0-6-next.73",
|
|
30
|
+
"@verdaccio/config": "6.0.0-6-next.73",
|
|
31
|
+
"@verdaccio/loaders": "6.0.0-6-next.42",
|
|
32
|
+
"@verdaccio/logger": "6.0.0-6-next.41",
|
|
33
|
+
"@verdaccio/middleware": "6.0.0-6-next.52",
|
|
34
|
+
"@verdaccio/store": "6.0.0-6-next.53",
|
|
35
|
+
"@verdaccio/tarball": "11.0.0-6-next.42",
|
|
36
|
+
"@verdaccio/url": "11.0.0-6-next.39",
|
|
37
|
+
"@verdaccio/utils": "6.0.0-6-next.41",
|
|
38
38
|
"debug": "4.3.4",
|
|
39
39
|
"express": "4.18.2",
|
|
40
40
|
"lodash": "4.17.21"
|
|
41
41
|
},
|
|
42
42
|
"devDependencies": {
|
|
43
|
-
"@types/node": "16.18.10",
|
|
44
43
|
"@verdaccio/types": "11.0.0-6-next.25",
|
|
45
44
|
"@verdaccio/test-helper": "2.0.0-6-next.8",
|
|
46
|
-
"@verdaccio/api": "6.0.0-6-next.
|
|
45
|
+
"@verdaccio/api": "6.0.0-6-next.56",
|
|
47
46
|
"node-html-parser": "4.1.5",
|
|
48
47
|
"supertest": "6.3.3",
|
|
49
48
|
"nock": "13.2.9",
|
|
50
49
|
"jsdom": "20.0.3",
|
|
51
50
|
"undici": "4.16.0",
|
|
52
|
-
"verdaccio-auth-memory": "11.0.0-6-next.
|
|
53
|
-
"verdaccio-memory": "11.0.0-6-next.
|
|
51
|
+
"verdaccio-auth-memory": "11.0.0-6-next.38",
|
|
52
|
+
"verdaccio-memory": "11.0.0-6-next.40"
|
|
54
53
|
},
|
|
55
54
|
"funding": {
|
|
56
55
|
"type": "opencollective",
|
package/src/api/user.ts
CHANGED
|
@@ -71,23 +71,18 @@ function addUserAuthApi(auth: Auth, config: Config): Router {
|
|
|
71
71
|
config?.serverSettings?.passwordValidationRegex
|
|
72
72
|
) === false
|
|
73
73
|
) {
|
|
74
|
-
auth.changePassword(
|
|
75
|
-
name as string,
|
|
76
|
-
password.old,
|
|
77
|
-
password.new,
|
|
78
|
-
(err, isUpdated): void => {
|
|
79
|
-
if (_.isNil(err) && isUpdated) {
|
|
80
|
-
next({
|
|
81
|
-
ok: true,
|
|
82
|
-
});
|
|
83
|
-
} else {
|
|
84
|
-
return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));
|
|
85
|
-
}
|
|
86
|
-
}
|
|
87
|
-
);
|
|
88
|
-
} else {
|
|
89
74
|
return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));
|
|
90
75
|
}
|
|
76
|
+
|
|
77
|
+
auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {
|
|
78
|
+
if (_.isNil(err) && isUpdated) {
|
|
79
|
+
next({
|
|
80
|
+
ok: true,
|
|
81
|
+
});
|
|
82
|
+
} else {
|
|
83
|
+
return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));
|
|
84
|
+
}
|
|
85
|
+
});
|
|
91
86
|
}
|
|
92
87
|
);
|
|
93
88
|
}
|
package/test/api.user.test.ts
CHANGED
|
@@ -79,6 +79,122 @@ describe('test web server', () => {
|
|
|
79
79
|
.expect(HTTP_STATUS.CANNOT_HANDLE, JSON.stringify({ error: 'cannot handle this' }));
|
|
80
80
|
});
|
|
81
81
|
|
|
82
|
+
test('should change password', async () => {
|
|
83
|
+
const oldPass = 'test';
|
|
84
|
+
const newPass = 'new-pass';
|
|
85
|
+
|
|
86
|
+
const api = supertest(await initializeServer('default-test.yaml'));
|
|
87
|
+
|
|
88
|
+
// Login with the old password.
|
|
89
|
+
const loginRes = await api
|
|
90
|
+
.post('/-/verdaccio/sec/login')
|
|
91
|
+
.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
|
|
92
|
+
.send(
|
|
93
|
+
JSON.stringify({
|
|
94
|
+
username: 'test',
|
|
95
|
+
password: oldPass,
|
|
96
|
+
})
|
|
97
|
+
)
|
|
98
|
+
.expect(HTTP_STATUS.OK);
|
|
99
|
+
|
|
100
|
+
// Change the password.
|
|
101
|
+
await api
|
|
102
|
+
.put('/-/verdaccio/sec/reset_password')
|
|
103
|
+
.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
|
|
104
|
+
.set(HEADER_TYPE.AUTHORIZATION, `Bearer ${loginRes.body.token}`)
|
|
105
|
+
.send(
|
|
106
|
+
JSON.stringify({
|
|
107
|
+
password: {
|
|
108
|
+
old: oldPass,
|
|
109
|
+
new: newPass,
|
|
110
|
+
},
|
|
111
|
+
})
|
|
112
|
+
)
|
|
113
|
+
.expect(HTTP_STATUS.OK);
|
|
114
|
+
|
|
115
|
+
// Verify that you cannot login with the old password.
|
|
116
|
+
await api
|
|
117
|
+
.post('/-/verdaccio/sec/login')
|
|
118
|
+
.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
|
|
119
|
+
.send(
|
|
120
|
+
JSON.stringify({
|
|
121
|
+
username: 'test',
|
|
122
|
+
password: oldPass,
|
|
123
|
+
})
|
|
124
|
+
)
|
|
125
|
+
.expect(HTTP_STATUS.UNAUTHORIZED);
|
|
126
|
+
|
|
127
|
+
// Verify that you can login with the new password.
|
|
128
|
+
await api
|
|
129
|
+
.post('/-/verdaccio/sec/login')
|
|
130
|
+
.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
|
|
131
|
+
.send(
|
|
132
|
+
JSON.stringify({
|
|
133
|
+
username: 'test',
|
|
134
|
+
password: newPass,
|
|
135
|
+
})
|
|
136
|
+
)
|
|
137
|
+
.expect(HTTP_STATUS.OK);
|
|
138
|
+
});
|
|
139
|
+
|
|
140
|
+
test('should not change to invalid password', async () => {
|
|
141
|
+
const oldPass = 'test';
|
|
142
|
+
const newPass = '12'; // Invalid password: Too short.
|
|
143
|
+
|
|
144
|
+
const api = supertest(await initializeServer('default-test.yaml'));
|
|
145
|
+
|
|
146
|
+
// Login with the old password.
|
|
147
|
+
const loginRes = await api
|
|
148
|
+
.post('/-/verdaccio/sec/login')
|
|
149
|
+
.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
|
|
150
|
+
.send(
|
|
151
|
+
JSON.stringify({
|
|
152
|
+
username: 'test',
|
|
153
|
+
password: oldPass,
|
|
154
|
+
})
|
|
155
|
+
)
|
|
156
|
+
.expect(HTTP_STATUS.OK);
|
|
157
|
+
|
|
158
|
+
// Try changing to an invalid password.
|
|
159
|
+
await api
|
|
160
|
+
.put('/-/verdaccio/sec/reset_password')
|
|
161
|
+
.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
|
|
162
|
+
.set(HEADER_TYPE.AUTHORIZATION, `Bearer ${loginRes.body.token}`)
|
|
163
|
+
.send(
|
|
164
|
+
JSON.stringify({
|
|
165
|
+
password: {
|
|
166
|
+
old: oldPass,
|
|
167
|
+
new: newPass,
|
|
168
|
+
},
|
|
169
|
+
})
|
|
170
|
+
)
|
|
171
|
+
.expect(HTTP_STATUS.BAD_REQUEST);
|
|
172
|
+
|
|
173
|
+
// Verify that you cannot login with the new (invalid) password.
|
|
174
|
+
await api
|
|
175
|
+
.post('/-/verdaccio/sec/login')
|
|
176
|
+
.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
|
|
177
|
+
.send(
|
|
178
|
+
JSON.stringify({
|
|
179
|
+
username: 'test',
|
|
180
|
+
password: newPass,
|
|
181
|
+
})
|
|
182
|
+
)
|
|
183
|
+
.expect(HTTP_STATUS.UNAUTHORIZED);
|
|
184
|
+
|
|
185
|
+
// Verify that you can still login with the old password.
|
|
186
|
+
await api
|
|
187
|
+
.post('/-/verdaccio/sec/login')
|
|
188
|
+
.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
|
|
189
|
+
.send(
|
|
190
|
+
JSON.stringify({
|
|
191
|
+
username: 'test',
|
|
192
|
+
password: oldPass,
|
|
193
|
+
})
|
|
194
|
+
)
|
|
195
|
+
.expect(HTTP_STATUS.OK);
|
|
196
|
+
});
|
|
197
|
+
|
|
82
198
|
test('should not change password if flag is disabled', async () => {
|
|
83
199
|
const oldPass = 'test';
|
|
84
200
|
const newPass = 'new-pass';
|
|
@@ -136,6 +252,4 @@ describe('test web server', () => {
|
|
|
136
252
|
)
|
|
137
253
|
.expect(HTTP_STATUS.OK);
|
|
138
254
|
});
|
|
139
|
-
|
|
140
|
-
test.todo('should change password');
|
|
141
255
|
});
|