@xenon-device-management/xenon 2.14.0 → 2.15.0

package/lib/test/unit/profile-router.test.js

@@ -39,7 +39,12 @@ describe('profile router', () => {
     }));
     it('POST /profile/access-key/rotate returns a new accessKey', () => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'rotateAccessKey').resolves({ id: 'u1', accessKey: 'xen_NEW' });
-        const app = appWithAuth({ userId: 'u1', role: 'ADMIN', scopes: 'devices,sessions,read' });
+        const app = appWithAuth({
+            kind: 'user-session',
+            userId: 'u1',
+            role: 'ADMIN',
+            scopes: 'admin,devices,sessions,read',
+        });
         const r = yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate');
         (0, chai_1.expect)(r.body.accessKey).to.equal('xen_NEW');
     }));
@@ -147,4 +152,120 @@ describe('profile router', () => {
         const r = yield (0, loopbackRequest_1.default)(app).delete('/profile/tokens/k1');
         (0, chai_1.expect)(r.status).to.equal(404);
     }));
+    // A credential can't do more to its owner's account than it could itself
+    // have been made to do.
+    describe('what the credential in use limits', () => {
+        // Rotating the access key ends every key pair its owner has, whatever
+        // their scopes, so it takes the person themselves (a dashboard sign-in)
+        // or a credential with the admin scope. Any credential, a read-only
+        // token included, could do it.
+        describe('POST /profile/access-key/rotate', () => {
+            let rotate;
+            beforeEach(() => {
+                rotate = sinon_1.default
+                    .stub(typedi_1.Container.get(UserService_1.UserService), 'rotateAccessKey')
+                    .resolves({ id: 'u1', accessKey: 'xen_NEW' });
+            });
+            for (const [kind, scopes] of [
+                ['bearer', 'read'],
+                ['api-key', 'read'],
+                ['api-key', 'devices,sessions,read'],
+                ['bearer', 'sessions'],
+            ]) {
+                it(`is refused to ${kind === 'bearer' ? 'a Bearer token' : 'an API key'} with ${scopes}`, () => __awaiter(void 0, void 0, void 0, function* () {
+                    const app = appWithAuth({ kind, userId: 'u1', role: 'ADMIN', scopes });
+                    const r = yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate');
+                    (0, chai_1.expect)(r.status).to.equal(403);
+                    (0, chai_1.expect)(r.body.error).to.match(/dashboard sign-in or a credential with the admin scope/);
+                    (0, chai_1.expect)(rotate.called).to.equal(false);
+                }));
+            }
+            it('is allowed to a dashboard sign-in, a member included', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'user-session',
+                    userId: 'u1',
+                    role: 'MEMBER',
+                    scopes: 'devices,sessions,read',
+                });
+                (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate')).status).to.equal(200);
+            }));
+            it('is allowed to a credential with the admin scope', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'api-key',
+                    userId: 'u1',
+                    role: 'SUPER_ADMIN',
+                    scopes: 'admin',
+                });
+                (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(app).post('/profile/access-key/rotate')).status).to.equal(200);
+            }));
+        });
+        // A token made with a credential that expires ends no later than it: a
+        // 1-hour Bearer token made itself a key that never expired.
+        describe('POST /profile/tokens from a credential that expires', () => {
+            const inAnHour = new Date(Date.now() + 3600000);
+            const bearer = () => appWithAuth({
+                kind: 'bearer',
+                userId: 'u1',
+                role: 'MEMBER',
+                scopes: 'sessions,read',
+                credentialExpiresAt: inAnHour.getTime(),
+            });
+            let create;
+            beforeEach(() => {
+                create = sinon_1.default
+                    .stub(typedi_1.Container.get(ApiKeyService_1.ApiKeyService), 'create')
+                    .resolves({ id: 'k9', raw: 'raw' });
+            });
+            it('expires with that credential when no expiresAt is asked for', () => __awaiter(void 0, void 0, void 0, function* () {
+                var _a;
+                const r = yield (0, loopbackRequest_1.default)(bearer()).post('/profile/tokens').send({ name: 'CI' });
+                (0, chai_1.expect)(r.status).to.equal(201);
+                (0, chai_1.expect)(r.body.expiresAt).to.equal(inAnHour.toISOString());
+                (0, chai_1.expect)((_a = create.firstCall.args[0].expiresAt) === null || _a === void 0 ? void 0 : _a.getTime()).to.equal(inAnHour.getTime());
+            }));
+            it('refuses an expiresAt later than that credential', () => __awaiter(void 0, void 0, void 0, function* () {
+                const later = new Date(inAnHour.getTime() + 60000).toISOString();
+                const r = yield (0, loopbackRequest_1.default)(bearer())
+                    .post('/profile/tokens')
+                    .send({ name: 'CI', expiresAt: later });
+                (0, chai_1.expect)(r.status).to.equal(400);
+                (0, chai_1.expect)(r.body.error).to.match(/later than the credential/);
+                (0, chai_1.expect)(create.called).to.equal(false);
+            }));
+            // Verification allows 60 s of clock skew, so a token can still be
+            // accepted just after its exp: it must not make a key already expired.
+            it('refuses when that credential has already expired', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'bearer',
+                    userId: 'u1',
+                    role: 'MEMBER',
+                    scopes: 'sessions,read',
+                    credentialExpiresAt: Date.now() - 1000,
+                });
+                const r = yield (0, loopbackRequest_1.default)(app).post('/profile/tokens').send({ name: 'CI' });
+                (0, chai_1.expect)(r.status).to.equal(400);
+                (0, chai_1.expect)(r.body.error).to.match(/has expired/);
+                (0, chai_1.expect)(create.called).to.equal(false);
+            }));
+            it('keeps an earlier expiresAt', () => __awaiter(void 0, void 0, void 0, function* () {
+                const sooner = new Date(Date.now() + 600000).toISOString();
+                const r = yield (0, loopbackRequest_1.default)(bearer())
+                    .post('/profile/tokens')
+                    .send({ name: 'CI', expiresAt: sooner });
+                (0, chai_1.expect)(r.status).to.equal(201);
+                (0, chai_1.expect)(r.body.expiresAt).to.equal(sooner);
+            }));
+            it('leaves a dashboard sign-in free to make a key that never expires', () => __awaiter(void 0, void 0, void 0, function* () {
+                const app = appWithAuth({
+                    kind: 'user-session',
+                    userId: 'u1',
+                    role: 'MEMBER',
+                    scopes: 'devices,sessions,read',
+                });
+                const r = yield (0, loopbackRequest_1.default)(app).post('/profile/tokens').send({ name: 'CI' });
+                (0, chai_1.expect)(r.status).to.equal(201);
+                (0, chai_1.expect)(r.body.expiresAt).to.equal(null);
+            }));
+        });
+    });
 });

package/lib/test/unit/queue-requester.spec.js

@@ -126,7 +126,7 @@ describe('createSession records who asked on the pending-session row', () => {
         typedi_1.Container.set(JwtKeyService_1.JwtKeyService, {
             verify: (t) => __awaiter(void 0, void 0, void 0, function* () {
                 const [sub, teamId] = t.replace(/^jwt:/, '').split('@');
-                return { sub, teamId: teamId !== null && teamId !== void 0 ? teamId : null };
+                return { sub, teamId: teamId !== null && teamId !== void 0 ? teamId : null, scopes: 'sessions' };
             }),
         });
         teamRows = sinon_1.default.stub(prisma_1.prisma.teamMember, 'findMany').resolves([]);

package/lib/test/unit/reset-link-address.spec.js

@@ -0,0 +1,266 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const express_1 = __importDefault(require("express"));
+const loopbackRequest_1 = __importDefault(require("../helpers/loopbackRequest"));
+const typedi_1 = require("typedi");
+const users_1 = require("../../src/app/routers/users");
+const auth_1 = require("../../src/app/routers/auth");
+const PasswordResetService_1 = require("../../src/services/PasswordResetService");
+const EmailService_1 = require("../../src/services/EmailService");
+const UserService_1 = require("../../src/services/UserService");
+const prisma_1 = require("../../src/prisma");
+const config_1 = require("../../src/config");
+const passwordResetMode_1 = require("../../src/services/passwordResetMode");
+const passwordResetLink_1 = require("../../src/services/passwordResetLink");
+/**
+ * Where a password reset link that Xenon sends points.
+ *
+ * Through 2.14 it was built from the Host header of the request that asked
+ * for it. Anyone could ask for a reset of someone else's account with a Host
+ * of their own choosing (a matching Origin passes the CSRF check), and with
+ * SMTP set up Xenon emailed the victim a genuine link to the attacker's host:
+ * opening it handed the attacker the token, which opens the account.
+ *
+ * A link Xenon emails or logs is now built from XENON_PUBLIC_URL, the address
+ * people open the dashboard at. Without it Xenon sends no link at all: the
+ * sign-in page sends people to an administrator, and an administrator's
+ * "send reset link" hands the link back to them instead of emailing it.
+ */
+const RAW = 'RAWTOKEN_abcdefghijklmnopqrstuvwxyz0123456789';
+const EVIL = 'attacker.example';
+function withConfig(patch) {
+    const orig = {};
+    for (const k of Object.keys(patch)) {
+        orig[k] = config_1.config[k];
+        config_1.config[k] = patch[k];
+    }
+    return () => Object.assign(config_1.config, orig);
+}
+function until(pred_1) {
+    return __awaiter(this, arguments, void 0, function* (pred, ms = 3000) {
+        const t0 = Date.now();
+        while (!pred()) {
+            if (Date.now() - t0 > ms)
+                throw new Error('timed out waiting for the route to finish');
+            yield new Promise((r) => setTimeout(r, 5));
+        }
+    });
+}
+describe('password reset links point at XENON_PUBLIC_URL, never the request', () => {
+    let restore;
+    afterEach(() => {
+        sinon_1.default.restore();
+        restore === null || restore === void 0 ? void 0 : restore();
+        restore = undefined;
+    });
+    function publicApp() {
+        const app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        app.use('/auth', (0, auth_1.authPublicRouter)());
+        return app;
+    }
+    function usersApp() {
+        const app = (0, express_1.default)();
+        app.use(express_1.default.json());
+        app.use((req, _res, next) => {
+            req.auth = {
+                userId: 'admin1',
+                role: 'ADMIN',
+                scopes: 'admin,devices,sessions,read',
+            };
+            next();
+        });
+        app.use('/users', (0, users_1.usersRouter)());
+        return app;
+    }
+    const active = { id: 'u1', email: 'u@x.local', name: 'U', role: 'MEMBER', status: 'ACTIVE' };
+    describe('POST /auth/forgot-password', () => {
+        it('emails a link to XENON_PUBLIC_URL whatever Host the request names', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
+            sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            sinon_1.default
+                .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
+                .resolves({ raw: RAW, id: 't1' });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            yield (0, loopbackRequest_1.default)(publicApp())
+                .post('/auth/forgot-password')
+                .set('Host', EVIL)
+                .set('X-Forwarded-Proto', 'http')
+                .send({ email: 'u@x.local' });
+            yield until(() => send.called);
+            const text = send.firstCall.args[0].text;
+            (0, chai_1.expect)(text).to.include(`https://xenon.example.com/xenon/reset-password#${RAW}`);
+            (0, chai_1.expect)(text).to.not.include(EVIL);
+        }));
+        it("builds a link that opens when XENON_PUBLIC_URL is the dashboard's address", () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'http://localhost:4723/xenon/',
+            });
+            sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            sinon_1.default
+                .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
+                .resolves({ raw: RAW, id: 't1' });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            yield (0, loopbackRequest_1.default)(publicApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            yield until(() => send.called);
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.include(`http://localhost:4723/xenon/reset-password#${RAW}`);
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.not.include('/xenon/xenon/');
+        }));
+        it('sends nothing, and mints nothing, when XENON_PUBLIC_URL is not set', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587', publicUrl: undefined });
+            const find = sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            const r = yield (0, loopbackRequest_1.default)(publicApp())
+                .post('/auth/forgot-password')
+                .set('Host', EVIL)
+                .send({ email: 'u@x.local' });
+            yield until(() => find.called);
+            yield new Promise((resolve) => setImmediate(resolve));
+            (0, chai_1.expect)(r.status).to.equal(204);
+            (0, chai_1.expect)(create.called).to.equal(false);
+            (0, chai_1.expect)(send.called).to.equal(false);
+        }));
+        it('sends nothing through the log fallback without XENON_PUBLIC_URL either', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: undefined,
+                passwordResetLogFallback: true,
+                publicUrl: undefined,
+            });
+            const find = sinon_1.default.stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail').resolves(active);
+            const create = sinon_1.default.stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken');
+            yield (0, loopbackRequest_1.default)(publicApp()).post('/auth/forgot-password').send({ email: 'u@x.local' });
+            yield until(() => find.called);
+            yield new Promise((resolve) => setImmediate(resolve));
+            (0, chai_1.expect)(create.called).to.equal(false);
+        }));
+    });
+    describe('GET /auth/options tells the sign-in page whether self-service reset works', () => {
+        it("is 'admin' with SMTP but no XENON_PUBLIC_URL, 'email' with both", () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587', publicUrl: undefined });
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(publicApp()).get('/auth/options')).body.passwordReset).to.equal('admin');
+            config_1.config.publicUrl = 'https://xenon.example.com';
+            (0, chai_1.expect)((yield (0, loopbackRequest_1.default)(publicApp()).get('/auth/options')).body.passwordReset).to.equal('email');
+        }));
+    });
+    describe('POST /users/:id/reset-link', () => {
+        beforeEach(() => {
+            sinon_1.default.stub(prisma_1.prisma.user, 'findUnique').resolves(active);
+            sinon_1.default
+                .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
+                .resolves({ raw: RAW, id: 't1' });
+        });
+        it('emails a link to XENON_PUBLIC_URL whatever Host the request names', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            const r = yield (0, loopbackRequest_1.default)(usersApp()).post('/users/u1/reset-link').set('Host', EVIL);
+            (0, chai_1.expect)(r.body).to.include({ emailed: true });
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.include(`https://xenon.example.com/xenon/reset-password#${RAW}`);
+            (0, chai_1.expect)(send.firstCall.args[0].text).to.not.include(EVIL);
+        }));
+        it('without XENON_PUBLIC_URL, hands the link to the admin instead of emailing it', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587', publicUrl: undefined });
+            const send = sinon_1.default.stub(typedi_1.Container.get(EmailService_1.EmailService), 'send').resolves();
+            const r = yield (0, loopbackRequest_1.default)(usersApp()).post('/users/u1/reset-link');
+            (0, chai_1.expect)(r.status).to.equal(200);
+            (0, chai_1.expect)(r.body.emailed).to.equal(false);
+            (0, chai_1.expect)(r.body.link).to.match(new RegExp(`/xenon/reset-password#${RAW}$`));
+            (0, chai_1.expect)(send.called).to.equal(false);
+        }));
+    });
+    describe('resetLinkBase (XENON_PUBLIC_URL)', () => {
+        // The variable is the server's address. The dashboard's own address,
+        // with /xenon (README gives http://localhost:4723/xenon/), is taken too:
+        // kept as given it made /xenon/xenon/reset-password, which the dashboard
+        // routes to the sign-in page, losing the token.
+        it('is the server address, with or without a trailing slash', () => {
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://xenon.example.com' })).to.equal('https://xenon.example.com');
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://xenon.example.com/' })).to.equal('https://xenon.example.com');
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'http://lab-mac:4723' })).to.equal('http://lab-mac:4723');
+        });
+        for (const publicUrl of [
+            'http://localhost:4723/xenon',
+            'http://localhost:4723/xenon/',
+            'http://localhost:4723/xenon//',
+        ]) {
+            it(`takes the dashboard's address too: ${publicUrl}`, () => {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl })).to.equal('http://localhost:4723');
+                (0, chai_1.expect)((0, passwordResetLink_1.buildResetLink)(String((0, passwordResetLink_1.resetLinkBase)({ publicUrl })), 'TOK')).to.equal('http://localhost:4723/xenon/reset-password#TOK');
+            });
+        }
+        // The dashboard loads its pages, scripts and API from /xenon on the
+        // server's root, so it can't be served under another prefix: an address
+        // with any other path is a mistake, and no link is sent rather than one
+        // that can't open.
+        it('is null for an address with any other path', () => {
+            for (const publicUrl of [
+                'https://lab.example.com/qa/',
+                'https://lab.example.com/qa/xenon',
+                'http://localhost:4723/xenon/login',
+            ]) {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl }), publicUrl).to.equal(null);
+            }
+        });
+        it('is null when unset, or not an http(s) address', () => {
+            for (const publicUrl of [
+                undefined,
+                '',
+                '   ',
+                'not a url',
+                'ftp://x.example',
+                'javascript:alert(1)',
+            ]) {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl }), String(publicUrl)).to.equal(null);
+            }
+        });
+        it('is null for an address with a query or fragment, which would swallow the token', () => {
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://x.example/?a=1' })).to.equal(null);
+            (0, chai_1.expect)((0, passwordResetLink_1.resetLinkBase)({ publicUrl: 'https://x.example/#a' })).to.equal(null);
+        });
+    });
+    describe('passwordResetMode', () => {
+        it("is 'email' only with both SMTP and XENON_PUBLIC_URL", () => {
+            (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ smtpUrl: 'smtp://m:587', publicUrl: 'https://x.example' })).to.equal('email');
+            (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ smtpUrl: 'smtp://m:587' })).to.equal('admin');
+            (0, chai_1.expect)((0, passwordResetMode_1.passwordResetMode)({ publicUrl: 'https://x.example' })).to.equal('admin');
+        });
+    });
+    // The email said "1 hour" whatever XENON_RESET_TOKEN_TTL_MS was.
+    describe('the email says how long the link really lasts', () => {
+        const user = { email: 'u@x.local', name: 'U' };
+        for (const [ms, words] of [
+            [60 * 60 * 1000, '1 hour'],
+            [30 * 60 * 1000, '30 minutes'],
+            [2 * 60 * 60 * 1000, '2 hours'],
+            [90 * 60 * 1000, '90 minutes'],
+            [24 * 60 * 60 * 1000, '24 hours'],
+            [60 * 1000, '1 minute'],
+        ]) {
+            it(`${words} for ${ms} ms`, () => {
+                (0, chai_1.expect)((0, passwordResetLink_1.resetEmail)(user, 'https://x/l', ms).text).to.include(`This link expires in ${words}.`);
+            });
+        }
+    });
+});

package/lib/test/unit/reset-link.test.js

@@ -82,7 +82,10 @@ describe('password-reset links', () => {
             (0, chai_1.expect)(logged.join('\n')).to.not.include(RAW);
         }));
         it('with SMTP, emails the user and returns no link', () => __awaiter(void 0, void 0, void 0, function* () {
-            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587' });
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
             sinon_1.default.stub(prisma_1.prisma.user, 'findUnique').resolves(member);
             sinon_1.default
                 .stub(typedi_1.Container.get(PasswordResetService_1.PasswordResetService), 'createToken')
@@ -164,8 +167,11 @@ describe('password-reset links', () => {
             (0, chai_1.expect)(r.status).to.equal(204);
             (0, chai_1.expect)(create.called).to.equal(false);
         }));
-        it('still mints and sends when SMTP is configured', () => __awaiter(void 0, void 0, void 0, function* () {
-            restore = withConfig({ smtpUrl: 'smtp://mail.example.com:587' });
+        it('still mints and sends when SMTP and XENON_PUBLIC_URL are configured', () => __awaiter(void 0, void 0, void 0, function* () {
+            restore = withConfig({
+                smtpUrl: 'smtp://mail.example.com:587',
+                publicUrl: 'https://xenon.example.com',
+            });
             sinon_1.default
                 .stub(typedi_1.Container.get(UserService_1.UserService), 'findByEmail')
                 .resolves({ id: 'u1', email: 'u@x.local', name: 'U', status: 'ACTIVE' });
@@ -181,7 +187,7 @@ describe('password-reset links', () => {
     });
     describe('token placement (never in a URL the server sees)', () => {
         it('puts the token in the fragment, which browsers never send', () => {
-            const link = (0, passwordResetLink_1.buildResetLink)({ secure: false, headers: { host: 'lab:4723' } }, RAW);
+            const link = (0, passwordResetLink_1.buildResetLink)('http://lab:4723', RAW);
             (0, chai_1.expect)(link).to.equal(`http://lab:4723/xenon/reset-password#${RAW}`);
             (0, chai_1.expect)(new URL(link).pathname).to.not.include(RAW);
         });