apostrophe 3.4.1 → 3.8.0

package/test/login.js

@@ -161,4 +161,187 @@ describe('Login', function() {
     assert(page.match(/logged out/));
   });
 
+  it('Changing a user\'s password should invalidate sessions for that user', async function() {
+
+    const jar = apos.http.jar();
+
+    // establish session
+    let page = await apos.http.get(
+      '/',
+      {
+        jar
+      }
+    );
+
+    assert(page.match(/logged out/));
+
+    await apos.http.post(
+      '/api/v1/@apostrophecms/login/login',
+      {
+        method: 'POST',
+        body: {
+          username: 'HarryPutter',
+          password: 'crookshanks',
+          session: true
+        },
+        jar
+      }
+    );
+
+    page = await apos.http.get(
+      '/',
+      {
+        jar
+      }
+    );
+
+    assert(page.match(/logged in/));
+
+    const req = apos.task.getReq();
+    let user = await apos.user.find(req, {
+      username: 'HarryPutter'
+    }).toObject();
+    assert(user);
+    user.password = 'VeryPasswordManySecure🐶';
+    await apos.user.update(req, user);
+
+    page = await apos.http.get(
+      '/',
+      {
+        jar
+      }
+    );
+
+    assert(!page.match(/logged in/));
+    assert(page.match(/logged out/));
+
+    // Make sure we can come back from that
+    await apos.http.post(
+      '/api/v1/@apostrophecms/login/login',
+      {
+        method: 'POST',
+        body: {
+          username: 'HarryPutter',
+          password: 'VeryPasswordManySecure🐶',
+          session: true
+        },
+        jar
+      }
+    );
+
+    page = await apos.http.get(
+      '/',
+      {
+        jar
+      }
+    );
+
+    assert(page.match(/logged in/));
+
+    // So we do not have a stale _passwordUpdated flag
+    user = await apos.user.find(req, {
+      _id: user._id
+    }).toObject();
+
+    // Unrelated writes to user should not invalidate sessions
+    user.title = 'Extra Cool Putter';
+    await apos.user.update(req, user);
+
+    page = await apos.http.get(
+      '/',
+      {
+        jar
+      }
+    );
+
+    assert(page.match(/logged in/));
+
+    // Marking a user account as disabled should invalidate sessions
+    user.disabled = true;
+    await apos.user.update(req, user);
+
+    page = await apos.http.get(
+      '/',
+      {
+        jar
+      }
+    );
+
+    assert(page.match(/logged out/));
+
+    // Restore access for next test
+    user.disabled = false;
+    await apos.user.update(req, user);
+
+  });
+
+  it('Changing a user\'s password should invalidate bearer tokens for that user', async function() {
+
+    // Log in
+    let response = await apos.http.post('/api/v1/@apostrophecms/login/login', {
+      body: {
+        username: 'HarryPutter',
+        password: 'VeryPasswordManySecure🐶'
+      }
+    });
+    assert(response.token);
+    let token = response.token;
+
+    // For verification: can't do this without an admin bearer token
+    await apos.http.get(
+      '/api/v1/@apostrophecms/user',
+      {
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      }
+    );
+
+    const req = apos.task.getReq();
+    const user = await apos.user.find(req, {
+      username: 'HarryPutter'
+    }).toObject();
+    assert(user);
+    user.password = 'AnotherLovelyPassword';
+    await apos.user.update(req, user);
+
+    let failed = false;
+    try {
+      await apos.http.get(
+        '/api/v1/@apostrophecms/user',
+        {
+          headers: {
+            Authorization: `Bearer ${token}`
+          }
+        }
+      );
+      // Should NOT work
+      assert(false);
+    } catch (e) {
+      failed = true;
+      assert.strictEqual(e.status, 401);
+    }
+    assert(failed);
+
+    // Make sure we can come back from that
+    response = await apos.http.post('/api/v1/@apostrophecms/login/login', {
+      body: {
+        username: 'HarryPutter',
+        password: 'AnotherLovelyPassword'
+      }
+    });
+    assert(response.token);
+    token = response.token;
+
+    await apos.http.get(
+      '/api/v1/@apostrophecms/user',
+      {
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      }
+    );
+
+  });
+
 });

package/test/modules/@apostrophecms/global/index.js

@@ -0,0 +1,8 @@
+module.exports = {
+  options: {
+    verifyProjectLevelLoaded: true,
+    // Verify we can override these
+    testPieceTypeLevel: false,
+    testGlobalLevel: false
+  }
+};

package/test/modules/fragment-all/views/aux-test.html

@@ -0,0 +1,7 @@
+{% extends data.outerLayout %}
+
+{% import "fragment.html" as fragment %}
+
+{% block main %}
+{% render fragment.auxTest('Gee Whiz') %}
+{% endblock %}

package/test/modules/fragment-all/views/fragment.html

@@ -28,3 +28,8 @@
 {% fragment _print(text) %}
   {{ text }}
 {% endfragment %}
+
+{% fragment auxTest(s) %}
+  {{ apos.util.slugify(s) }}
+  {{ __t('apostrophe:modifyOrDelete') }}
+{% endfragment %}

package/test/moog.js

@@ -237,6 +237,53 @@ describe('moog', function() {
       assert(myObject.extended(5) === 20);
     });
 
+    it('should support inheriting field group fields rather than requiring all fields to be restated', async function() {
+      const moog = require('../lib/moog.js')({});
+
+      moog.define('myObject', {
+        cascades: [ 'fields' ],
+        fields: {
+          add: {
+            one: { type: 'string' },
+            two: { type: 'string' },
+            three: { type: 'string' }
+          },
+          group: {
+            basics: {
+              fields: [ 'one', 'two', 'three' ]
+            }
+          }
+        }
+      });
+
+      moog.define('myObject', {
+        fields: {
+          add: {
+            four: { type: 'string' },
+            five: { type: 'string' }
+          },
+          group: {
+            basics: {
+              fields: [ 'four', 'five' ]
+            },
+            other: {
+              fields: [ 'one' ]
+            }
+          }
+        }
+      });
+
+      const myObject = await moog.create('myObject', {});
+      assert(myObject);
+      assert(myObject.fieldsGroups);
+      assert(!myObject.fieldsGroups.basics.fields.includes('one'));
+      assert(myObject.fieldsGroups.other.fields.includes('one'));
+      assert(myObject.fieldsGroups.basics.fields.includes('two'));
+      assert(myObject.fieldsGroups.basics.fields.includes('three'));
+      assert(myObject.fieldsGroups.basics.fields.includes('four'));
+      assert(myObject.fieldsGroups.basics.fields.includes('five'));
+    });
+
     // ==================================================
     // `redefine` AND `isDefined`
     // ==================================================

package/test/package.json

@@ -1,10 +1,11 @@
-
 {
   "name": "test",
   "dependencies": {
-    "apostrophe": "^3.0.0"
+    "apostrophe": "^3.0.0",
+    "improve-global": "1.0.0",
+    "improve-piece-type": "1.0.0"
   },
   "devDependencies": {
-    "test-bundle": {}
-    }
+    "test-bundle": "1.0.0"
+  }
 }

package/test/pieces.js

@@ -768,6 +768,23 @@ describe('Pieces', function() {
     relatedArticleId = response._articles[0]._id;
   });
 
+  it('can GET a single product using projections', async () => {
+    const response = await apos.http.get(`/api/v1/product/${relatedProductId}`, {
+      qs: {
+        project: {
+          _id: 1,
+          title: 1
+        }
+      }
+    });
+
+    const keys = Object.keys(response);
+
+    assert(response);
+    assert(keys.length === 2);
+    assert(keys.every((key) => [ '_id', 'title' ].includes(key)));
+  });
+
   it('can GET a single article with reverse relationships', async () => {
     const response = await apos.http.get(`/api/v1/article/${relatedArticleId}`);
     assert(response);

package/test/reverse-relationship.js

@@ -0,0 +1,170 @@
+// Bug report that motivated these tests:
+//
+// If products are related to salespeople, and salespeople have a reverse relationship
+// back to products allowing that relationship to be viewed from the other end, everything
+// works.
+//
+// But if products are also related to locations, the reverse relationship back from
+// salespeople stops working.
+
+const t = require('../test-lib/test.js');
+const assert = require('assert');
+
+describe('Basic reverse relationships', function() {
+
+  this.timeout(t.timeout);
+
+  it('basic reverse relationship query works', async function () {
+    let apos;
+    try {
+      apos = await t.create({
+        root: module,
+        modules: {
+          product: {
+            options: {
+              alias: 'product'
+            },
+            extend: '@apostrophecms/piece-type',
+            fields: {
+              add: {
+                _salespeople: {
+                  type: 'relationship',
+                  withType: 'salesperson'
+                }
+              }
+            }
+          },
+          salesperson: {
+            options: {
+              alias: 'salesperson'
+            },
+            extend: '@apostrophecms/piece-type',
+            fields: {
+              add: {
+                _products: {
+                  type: 'relationshipReverse',
+                  withType: 'product',
+                  reverseOf: '_salespeople'
+                }
+              }
+            }
+          }
+        }
+      });
+
+      const req = apos.task.getReq();
+      const salesperson = await apos.salesperson.insert(req, {
+        title: 'Willie Loman'
+      });
+      await apos.salesperson.insert(req, {
+        title: 'Bernie Sanders'
+      });
+      await apos.product.insert(req, {
+        title: 'Soap',
+        _salespeople: [ salesperson ]
+      });
+      await apos.product.insert(req, {
+        title: 'Rope'
+      });
+      const fetched = await apos.salesperson.find(req, {
+        title: 'Willie Loman'
+      }).toObject();
+      assert(fetched);
+      assert.strictEqual(fetched.title, 'Willie Loman');
+      assert(fetched._products);
+      assert.strictEqual(fetched._products.length, 1);
+      assert.strictEqual(fetched._products[0].title, 'Soap');
+    } finally {
+      if (apos) {
+        await t.destroy(apos);
+      }
+    }
+  });
+});
+
+describe('Reverse relationships plus an extra relationship', function() {
+
+  this.timeout(t.timeout);
+
+  it('basic reverse relationship query works in the presence of an extra relationship with the types configured in an unexpected order', async function () {
+    let apos;
+    try {
+      apos = await t.create({
+        root: module,
+        modules: {
+          salesperson: {
+            options: {
+              alias: 'salesperson'
+            },
+            extend: '@apostrophecms/piece-type',
+            fields: {
+              add: {
+                _products: {
+                  type: 'relationshipReverse',
+                  withType: 'product',
+                  reverseOf: '_salespeople'
+                }
+              }
+            }
+          },
+          location: {
+            options: {
+              alias: 'location'
+            },
+            extend: '@apostrophecms/piece-type'
+          },
+          product: {
+            options: {
+              alias: 'product'
+            },
+            extend: '@apostrophecms/piece-type',
+            fields: {
+              add: {
+                _salespeople: {
+                  type: 'relationship',
+                  withType: 'salesperson'
+                },
+                _location: {
+                  type: 'relationship',
+                  withType: 'location'
+                }
+              }
+            }
+          }
+        }
+      });
+
+      const req = apos.task.getReq();
+      const salesperson = await apos.salesperson.insert(req, {
+        title: 'Willie Loman'
+      });
+      await apos.salesperson.insert(req, {
+        title: 'Bernie Sanders'
+      });
+      await apos.product.insert(req, {
+        title: 'Soap',
+        _salespeople: [ salesperson ]
+      });
+      await apos.product.insert(req, {
+        title: 'Rope'
+      });
+      const fetched = await apos.salesperson.find(req, {
+        title: 'Willie Loman'
+      }).toObject();
+      const soap = await apos.product.find(req, {
+        title: 'Soap'
+      }).toObject();
+      assert(fetched);
+      assert.strictEqual(fetched.title, 'Willie Loman');
+      assert(fetched._products);
+      assert.strictEqual(fetched._products.length, 1);
+      assert.strictEqual(fetched._products[0].title, 'Soap');
+      assert.strictEqual(soap.title, 'Soap');
+      assert.strictEqual(soap._salespeople[0].title, 'Willie Loman');
+    } finally {
+      if (apos) {
+        await t.destroy(apos);
+      }
+    }
+  });
+});

package/test/subdir-project/app.js

@@ -0,0 +1,3 @@
+module.exports = {
+  root: module
+};

package/test/subdir-project.js

@@ -0,0 +1,26 @@
+const t = require('../test-lib/test.js');
+const assert = require('assert');
+
+describe('Project with package.json in its parent folder works', function() {
+
+  this.timeout(t.timeout);
+
+  /// ///
+  // EXISTENCE
+  /// ///
+
+  it('should allow a project relying on a package.json in its parent folder', async function() {
+    let apos;
+    try {
+      apos = await t.create(require('./subdir-project/app.js'));
+      // Sniff test: a normal apos object
+      assert(apos.user);
+    } finally {
+      if (apos) {
+        await t.destroy(apos);
+      }
+    }
+    assert(apos);
+  });
+
+});

package/test/templates.js

@@ -182,7 +182,6 @@ describe('Templates', function() {
   it('should render fragments containing async components correctly', async () => {
     const req = apos.task.getReq();
     const result = await apos.modules['fragment-page'].renderPage(req, 'page');
-
     const aboveFragment = result.indexOf('Above Fragment');
     const beforeComponent = result.indexOf('Before Component');
     const componentText = result.indexOf('Component Text');
@@ -295,4 +294,11 @@ describe('Templates', function() {
     ]);
   });
 
+  it('should support apos helpers and localization in fragments', async () => {
+    const req = apos.task.getReq();
+    const result = await apos.modules['fragment-all'].renderPage(req, 'aux-test');
+    assert(result.includes('gee-whiz'));
+    assert(result.includes('Modify / Delete'));
+  });
+
 });

package/test-lib/test.js

@@ -1,9 +1,16 @@
 const fs = require('fs-extra');
 const path = require('path');
 
-fs.removeSync(path.join(__dirname, '/../test/node_modules'));
-fs.mkdirSync(path.join(__dirname, '/../test/node_modules'));
-fs.symlinkSync(path.join(__dirname, '/..'), path.join(__dirname, '/../test/node_modules/apostrophe'), 'dir');
+const testNodeModules = path.join(__dirname, '/../test/node_modules');
+fs.removeSync(testNodeModules);
+fs.mkdirSync(testNodeModules);
+fs.symlinkSync(path.join(__dirname, '/..'), path.join(testNodeModules, 'apostrophe'), 'dir');
+
+const extras = path.join(__dirname, '../test/extra_node_modules');
+const dirs = fs.existsSync(extras) ? fs.readdirSync(extras) : [];
+for (const dir of dirs) {
+  fs.symlinkSync(path.join(extras, dir), path.join(testNodeModules, dir), 'dir');
+}
 
 // Need a "project level" package.json for functionality that checks
 // whether packages in node_modules are project level or not
@@ -12,15 +19,19 @@ const packageJson = path.join(__dirname, '/../test/package.json');
 // Remove it first, in case it's the old-style symlink to the main package.json,
 // which would break
 fs.removeSync(packageJson);
-fs.writeFileSync(packageJson, `
-{
-  "name": "test",
-  "dependencies": {
-    "apostrophe": "^3.0.0"
+const packageJsonInfo = {
+  name: 'test',
+  dependencies: {
+    apostrophe: '^3.0.0'
   },
-  "devDependencies": {
-    "test-bundle": {}
-    }
-}`);
+  devDependencies: {
+    'test-bundle': '1.0.0'
+  }
+};
+for (const dir of dirs) {
+  packageJsonInfo.dependencies[dir] = '1.0.0';
+}
+
+fs.writeFileSync(packageJson, JSON.stringify(packageJsonInfo, null, '  '));
 
 module.exports = require('./util.js');

package/test-lib/util.js

@@ -37,6 +37,7 @@ async function create(options) {
       _: [],
       'ignore-orphan-modules': true
     },
+    test: true,
     autoBuild: false,
     ...options
   };
@@ -56,8 +57,40 @@ async function create(options) {
   return require('../index.js')(config);
 }
 
+// Create an admin user. By default the username and password are both 'admin'
+async function createAdmin(apos, { username, password } = {}) {
+  const user = apos.user.newInstance();
+  const name = username || 'admin';
+
+  user.title = name;
+  user.username = name;
+  user.password = password || 'admin';
+  user.email = `${name}@admin.io`;
+  user.role = 'admin';
+
+  return await apos.user.insert(apos.task.getReq(), user);
+}
+
+async function getUserJar(apos, { username, password } = {}) {
+  const jar = apos.http.jar();
+
+  // Log in
+  await apos.http.post('/api/v1/@apostrophecms/login/login', {
+    body: {
+      username: username || 'admin',
+      password: password || 'admin',
+      session: true
+    },
+    jar
+  });
+
+  return jar;
+}
+
 module.exports = {
   destroy,
   create,
+  createAdmin,
+  getUserJar,
   timeout: (process.env.TEST_TIMEOUT && parseInt(process.env.TEST_TIMEOUT)) || 20000
 };