backend-manager 5.9.4 → 5.9.6

package/test/functions/user/delete.js

@@ -1,135 +0,0 @@
-/**
- * User deletion flow tests
- * Tests:
- * - Users with active subscriptions cannot delete themselves
- * - Users cannot delete other users
- * - Users can delete themselves after subscription is removed
- * - Admins can delete any user
- */
-module.exports = {
-  description: 'User deletion flow',
-  type: 'suite',
-
-  tests: [
-    // --- Self-deletion tests ---
-    {
-      name: 'verify-delete-user-exists',
-      async run({ firestore, assert, state, accounts }) {
-        // Get the delete test account uid
-        state.deleteUid = accounts.delete.uid;
-
-        // Verify the user doc exists
-        const userDoc = await firestore.get(`users/${state.deleteUid}`);
-
-        assert.ok(userDoc, 'Delete user doc should exist before deletion');
-        assert.ok(userDoc?.auth?.uid === state.deleteUid, 'User doc should have correct uid');
-      },
-    },
-
-    {
-      name: 'delete-blocked-with-subscription',
-      async run({ http, assert }) {
-        // Auth as the delete user and try to delete themselves
-        // Should be blocked due to active subscription
-        const deleteResponse = await http.as('delete').command('user:delete', {});
-
-        assert.isError(deleteResponse, 400, 'Deletion should be blocked with active subscription');
-        assert.ok(
-          deleteResponse.error?.includes('paid subscription'),
-          `Error should mention paid subscription: ${deleteResponse.error}`,
-        );
-      },
-    },
-
-    // NOTE: The user:delete API ignores the payload uid parameter for non-admin users.
-    // It always uses the authenticated user's uid from resolveUser().
-    // This means non-admins cannot delete other users by design - the uid param is simply ignored.
-    // A test for "delete other user blocked" would be misleading since it would actually
-    // try to delete the authenticated user (basic), not the target user.
-    // If we want to explicitly block this, the API should be updated to check payload.uid
-    // against user.auth.uid and return a 403 if they don't match.
-
-    {
-      name: 'remove-subscription-from-delete-user',
-      async run({ firestore, state }) {
-        // Remove the subscription (set to null to overwrite)
-        await firestore.set(`users/${state.deleteUid}`, { subscription: null }, { merge: true });
-      },
-    },
-
-    {
-      name: 'delete-user-succeeds',
-      async run({ http, assert }) {
-        // Auth as the delete user and delete themselves
-        const deleteResponse = await http.as('delete').command('user:delete', {});
-
-        assert.isSuccess(deleteResponse, `user:delete should succeed: ${JSON.stringify(deleteResponse, null, 2)}`);
-      },
-    },
-
-    {
-      name: 'verify-firestore-doc-deleted',
-      async run({ firestore, assert, state, waitFor }) {
-        // on-delete handler deletes Firestore doc when Auth user is deleted
-        // Wait for the deletion to complete
-        const docDeleted = await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${state.deleteUid}`);
-          return !userDoc;
-        }, 10000, 500);
-
-        assert.ok(docDeleted, 'Firestore doc should be deleted after Auth user deletion');
-      },
-    },
-
-    // --- Admin deletion tests ---
-    {
-      name: 'verify-admin-delete-target-exists',
-      async run({ firestore, assert, state, accounts }) {
-        // Get the delete-by-admin test account uid
-        state.adminDeleteUid = accounts['delete-by-admin'].uid;
-
-        // Verify the user doc exists
-        const userDoc = await firestore.get(`users/${state.adminDeleteUid}`);
-
-        assert.ok(userDoc, 'Admin delete target user doc should exist');
-        assert.ok(userDoc?.auth?.uid === state.adminDeleteUid, 'User doc should have correct uid');
-      },
-    },
-
-    {
-      name: 'admin-can-delete-other-user',
-      async run({ http, assert, state }) {
-        // Auth as admin (using backendManagerKey) and delete another user
-        const deleteResponse = await http.as('admin').command('user:delete', {
-          uid: state.adminDeleteUid,
-        });
-
-        assert.isSuccess(deleteResponse, `Admin should be able to delete another user: ${JSON.stringify(deleteResponse, null, 2)}`);
-      },
-    },
-
-    {
-      name: 'verify-admin-deleted-user-firestore-deleted',
-      async run({ firestore, assert, state, waitFor }) {
-        // on-delete handler deletes Firestore doc when Auth user is deleted
-        // Wait for the deletion to complete
-        const docDeleted = await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${state.adminDeleteUid}`);
-          return !userDoc;
-        }, 10000, 500);
-
-        assert.ok(docDeleted, 'Firestore doc should be deleted after admin deletion');
-      },
-    },
-
-    // --- Auth rejection test (at end per convention) ---
-    {
-      name: 'unauthenticated-rejected',
-      async run({ http, assert }) {
-        const deleteResponse = await http.as('none').command('user:delete', {});
-
-        assert.isError(deleteResponse, 401, 'Delete should fail without authentication');
-      },
-    },
-  ],
-};

package/test/functions/user/get-active-sessions.js

@@ -1,111 +0,0 @@
-/**
- * Test: user:get-active-sessions
- * Tests the user get active sessions command
- * Returns sessions for authenticated users from Realtime Database
- */
-module.exports = {
-  description: 'User get active sessions',
-  type: 'group',
-  tests: [
-    // Test 1: Authenticated user can get sessions
-    {
-      name: 'authenticated-user-succeeds',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:get-active-sessions', {});
-
-        assert.isSuccess(response, 'Get active sessions should succeed for authenticated user');
-        assert.ok(
-          typeof response.data === 'object',
-          'Response data should be an object'
-        );
-      },
-    },
-
-    // Test 2: Default session id is 'app'
-    {
-      name: 'default-session-is-app',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        // With no id specified, should query sessions/app
-        const response = await http.command('user:get-active-sessions', {});
-
-        assert.isSuccess(response, 'Get active sessions should succeed');
-        // Response is an object (may be empty if no sessions)
-        assert.ok(
-          response.data !== undefined,
-          'Response should have data'
-        );
-      },
-    },
-
-    // Test 3: Custom session id
-    {
-      name: 'custom-session-id',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:get-active-sessions', {
-          id: 'custom-session-type',
-        });
-
-        assert.isSuccess(response, 'Get active sessions with custom id should succeed');
-        assert.ok(
-          typeof response.data === 'object',
-          'Response data should be an object'
-        );
-      },
-    },
-
-    // Test 4: Empty sessions returns empty object
-    {
-      name: 'no-sessions-returns-empty',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        // Query a session type that definitely doesn't exist
-        const response = await http.command('user:get-active-sessions', {
-          id: 'nonexistent-session-type-12345',
-        });
-
-        assert.isSuccess(response, 'Get sessions for empty type should succeed');
-        assert.ok(
-          Object.keys(response.data).length === 0,
-          'Empty session type should return empty object'
-        );
-      },
-    },
-
-    // Test 5: Admin can get sessions
-    {
-      name: 'admin-succeeds',
-      auth: 'admin',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:get-active-sessions', {});
-
-        assert.isSuccess(response, 'Get active sessions should succeed for admin');
-      },
-    },
-
-    // Test 6: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:get-active-sessions', {});
-
-        assert.isError(response, 401, 'Get active sessions should fail without authentication');
-      },
-    },
-  ],
-};

package/test/functions/user/get-subscription-info.js

@@ -1,99 +0,0 @@
-/**
- * Test: user:get-subscription-info
- * Tests the user get subscription info command
- * Returns subscription details for authenticated users
- */
-module.exports = {
-  description: 'User get subscription info',
-  type: 'group',
-  tests: [
-    // Test 1: Basic user can get subscription info
-    {
-      name: 'basic-user-succeeds',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:get-subscription-info', {});
-
-        assert.isSuccess(response, 'Get subscription info should succeed for authenticated user');
-        assert.hasProperty(response, 'data.subscription', 'Response should contain subscription object');
-        assert.hasProperty(response, 'data.subscription.product.id', 'Subscription should have id');
-        assert.hasProperty(response, 'data.subscription.expires', 'Subscription should have expires');
-        assert.hasProperty(response, 'data.subscription.trial', 'Subscription should have trial info');
-        assert.hasProperty(response, 'data.subscription.payment', 'Subscription should have payment info');
-      },
-    },
-
-    // Test 2: Subscription has correct structure
-    {
-      name: 'subscription-structure-valid',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:get-subscription-info', {});
-
-        assert.isSuccess(response, 'Get subscription info should succeed');
-
-        const subscription = response.data.subscription;
-
-        // Check expires structure
-        assert.hasProperty(response, 'data.subscription.expires.timestamp', 'expires should have timestamp');
-        assert.hasProperty(response, 'data.subscription.expires.timestampUNIX', 'expires should have timestampUNIX');
-
-        // Check trial structure
-        assert.ok(
-          typeof subscription.trial.claimed === 'boolean',
-          'trial.claimed should be boolean'
-        );
-
-        // Check payment structure
-        assert.hasProperty(response, 'data.subscription.payment', 'subscription should have payment');
-      },
-    },
-
-    // Test 3: Premium user has active subscription
-    {
-      name: 'premium-user-has-active-subscription',
-      auth: 'premium-active',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:get-subscription-info', {});
-
-        assert.isSuccess(response, 'Get subscription info should succeed for premium user');
-        assert.hasProperty(response, 'data.subscription.product.id', 'Premium user should have subscription id');
-        assert.hasProperty(response, 'data.subscription.payment', 'Premium user should have payment info');
-      },
-    },
-
-    // Test 4: Expired premium user still gets info
-    {
-      name: 'expired-premium-returns-info',
-      auth: 'premium-expired',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:get-subscription-info', {});
-
-        assert.isSuccess(response, 'Get subscription info should succeed for expired premium');
-        assert.hasProperty(response, 'data.subscription.product.id', 'Should still have subscription id');
-        assert.hasProperty(response, 'data.subscription.expires.timestampUNIX', 'Should have expires timestamp');
-      },
-    },
-
-    // Test 5: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:get-subscription-info', {});
-
-        assert.isError(response, 401, 'Get subscription info should fail without authentication');
-      },
-    },
-  ],
-};

package/test/functions/user/regenerate-api-keys.js

@@ -1,156 +0,0 @@
-/**
- * Test: user:regenerate-api-keys
- * Tests the user regenerate API keys command
- * This is a suite because we need to track state and restore original keys
- */
-module.exports = {
-  description: 'User regenerate API keys',
-  type: 'suite',
-  timeout: 30000,
-
-  tests: [
-    // Test 1: Store original keys
-    {
-      name: 'store-original-keys',
-      async run({ firestore, assert, state, accounts }) {
-        // Get the basic account's current keys to restore later
-        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
-
-        assert.ok(userDoc, 'User doc should exist');
-        assert.hasProperty({ data: userDoc }, 'data.api.clientId', 'User should have clientId');
-        assert.hasProperty({ data: userDoc }, 'data.api.privateKey', 'User should have privateKey');
-
-        state.originalClientId = userDoc.api.clientId;
-        state.originalPrivateKey = userDoc.api.privateKey;
-
-        assert.ok(state.originalClientId, 'Original clientId should exist');
-        assert.ok(state.originalPrivateKey, 'Original privateKey should exist');
-      },
-    },
-
-    // Test 2: Regenerate both keys (default)
-    {
-      name: 'regenerate-both-keys',
-      async run({ http, assert, state }) {
-        const response = await http.as('basic').command('user:regenerate-api-keys', {});
-
-        assert.isSuccess(response, 'Regenerate API keys should succeed');
-        assert.hasProperty(response, 'data.clientId', 'Response should contain new clientId');
-        assert.hasProperty(response, 'data.privateKey', 'Response should contain new privateKey');
-
-        // Keys should be different from original
-        assert.notEqual(
-          response.data.clientId,
-          state.originalClientId,
-          'New clientId should be different from original'
-        );
-        assert.notEqual(
-          response.data.privateKey,
-          state.originalPrivateKey,
-          'New privateKey should be different from original'
-        );
-
-        // Store new keys for verification
-        state.newClientId = response.data.clientId;
-        state.newPrivateKey = response.data.privateKey;
-      },
-    },
-
-    // Test 3: Verify keys are persisted in Firestore
-    {
-      name: 'verify-keys-persisted',
-      async run({ firestore, assert, state, accounts }) {
-        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
-
-        assert.equal(
-          userDoc.api.clientId,
-          state.newClientId,
-          'Persisted clientId should match returned value'
-        );
-        assert.equal(
-          userDoc.api.privateKey,
-          state.newPrivateKey,
-          'Persisted privateKey should match returned value'
-        );
-      },
-    },
-
-    // Test 4: Regenerate only clientId
-    // Note: After test 2, the privateKey changed so we need to use the new one
-    {
-      name: 'regenerate-only-clientId',
-      async run({ http, assert, state }) {
-        // Use the new privateKey from test 2 since old one is invalid
-        const response = await http.withPrivateKey(state.newPrivateKey).command('user:regenerate-api-keys', {
-          keys: ['clientId'],
-        });
-
-        assert.isSuccess(response, 'Regenerate clientId only should succeed');
-        assert.hasProperty(response, 'data.clientId', 'Response should contain new clientId');
-        assert.ok(
-          !response.data.privateKey,
-          'Response should NOT contain privateKey when only clientId requested'
-        );
-        assert.notEqual(
-          response.data.clientId,
-          state.newClientId,
-          'New clientId should be different from previous'
-        );
-      },
-    },
-
-    // Test 5: Regenerate only privateKey
-    {
-      name: 'regenerate-only-privateKey',
-      async run({ http, assert, state, accounts, firestore }) {
-        // Get current clientId to verify it stays the same
-        const beforeDoc = await firestore.get(`users/${accounts.basic.uid}`);
-        const currentClientId = beforeDoc.api.clientId;
-
-        // Still use newPrivateKey since test 4 didn't change it
-        const response = await http.withPrivateKey(state.newPrivateKey).command('user:regenerate-api-keys', {
-          keys: ['privateKey'],
-        });
-
-        assert.isSuccess(response, 'Regenerate privateKey only should succeed');
-        assert.hasProperty(response, 'data.privateKey', 'Response should contain new privateKey');
-        assert.ok(
-          !response.data.clientId,
-          'Response should NOT contain clientId when only privateKey requested'
-        );
-
-        // Verify clientId stayed the same
-        const afterDoc = await firestore.get(`users/${accounts.basic.uid}`);
-        assert.equal(
-          afterDoc.api.clientId,
-          currentClientId,
-          'clientId should remain unchanged when only privateKey regenerated'
-        );
-      },
-    },
-
-    // Test 6: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      async run({ http, assert }) {
-        const response = await http.as('none').command('user:regenerate-api-keys', {});
-
-        assert.isError(response, 401, 'Regenerate API keys should fail without authentication');
-      },
-    },
-
-    // Test 7: Restore original keys
-    {
-      name: 'restore-original-keys',
-      async run({ firestore, state, accounts }) {
-        // Restore original keys so other tests aren't affected
-        await firestore.set(`users/${accounts.basic.uid}`, {
-          api: {
-            clientId: state.originalClientId,
-            privateKey: state.originalPrivateKey,
-          },
-        }, { merge: true });
-      },
-    },
-  ],
-};

package/test/functions/user/resolve.js

@@ -1,52 +0,0 @@
-/**
- * Test: user:resolve
- * Tests the user resolve command
- * Returns user account info for authenticated users
- *
- * SKIPPED: The user:resolve command is not yet implemented (has TODO in handler)
- */
-module.exports = {
-  description: 'User resolve (account info)',
-  skip: 'user:resolve command not yet implemented',
-  type: 'group',
-  tests: [
-    // Test 1: Authenticated user can call resolve
-    {
-      name: 'authenticated-user-succeeds',
-      auth: 'basic',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:resolve', {});
-
-        assert.isSuccess(response, 'Resolve should succeed for authenticated user');
-      },
-    },
-
-    // Test 2: Premium user can call resolve
-    {
-      name: 'premium-user-succeeds',
-      auth: 'premium-active',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:resolve', {});
-
-        assert.isSuccess(response, 'Resolve should succeed for premium user');
-      },
-    },
-
-    // Test 3: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:resolve', {});
-
-        assert.isError(response, 401, 'Resolve should fail without authentication');
-      },
-    },
-  ],
-};

package/test/functions/user/sign-out-all-sessions.js

@@ -1,94 +0,0 @@
-/**
- * Test: user:sign-out-all-sessions
- * Tests the user sign out all sessions command
- * This revokes refresh tokens and clears session data
- * Note: This is a potentially destructive test, so we use a dedicated test account
- */
-module.exports = {
-  description: 'User sign out all sessions',
-  type: 'group',
-  tests: [
-    // Test 1: Authenticated user can sign out all sessions
-    {
-      name: 'authenticated-user-succeeds',
-      auth: 'basic',
-      timeout: 30000, // Longer timeout due to session cleanup
-
-      async run({ http, assert }) {
-        const response = await http.command('user:sign-out-all-sessions', {});
-
-        assert.isSuccess(response, 'Sign out all sessions should succeed for authenticated user');
-        assert.hasProperty(response, 'data.sessions', 'Response should contain sessions count');
-        assert.hasProperty(response, 'data.message', 'Response should contain message');
-        assert.ok(
-          typeof response.data.sessions === 'number',
-          'sessions should be a number'
-        );
-        assert.ok(
-          response.data.sessions >= 0,
-          'sessions count should be non-negative'
-        );
-      },
-    },
-
-    // Test 2: Custom session id
-    {
-      name: 'custom-session-id',
-      auth: 'basic',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:sign-out-all-sessions', {
-          id: 'custom-session-type',
-        });
-
-        assert.isSuccess(response, 'Sign out with custom session id should succeed');
-        assert.hasProperty(response, 'data.sessions', 'Response should contain sessions count');
-      },
-    },
-
-    // Test 3: Premium user can sign out all sessions
-    // Note: backendManagerKey admin doesn't have auth.uid, so we test with premium user instead
-    {
-      name: 'premium-user-succeeds',
-      auth: 'premium-active',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:sign-out-all-sessions', {});
-
-        assert.isSuccess(response, 'Sign out all sessions should succeed for premium user');
-        assert.hasProperty(response, 'data.sessions', 'Response should contain sessions count');
-      },
-    },
-
-    // Test 4: Multiple calls are idempotent
-    {
-      name: 'idempotent-operation',
-      auth: 'basic',
-      timeout: 30000,
-
-      async run({ http, assert }) {
-        // Call twice in a row - both should succeed
-        const response1 = await http.command('user:sign-out-all-sessions', {});
-        const response2 = await http.command('user:sign-out-all-sessions', {});
-
-        assert.isSuccess(response1, 'First sign out should succeed');
-        assert.isSuccess(response2, 'Second sign out should succeed (idempotent)');
-      },
-    },
-
-    // Test 5: Unauthenticated request fails
-    {
-      name: 'unauthenticated-rejected',
-      auth: 'none',
-      timeout: 15000,
-
-      async run({ http, assert }) {
-        const response = await http.command('user:sign-out-all-sessions', {});
-
-        assert.isError(response, 401, 'Sign out all sessions should fail without authentication');
-      },
-    },
-  ],
-};