backend-manager 5.9.6 → 5.9.8

package/test/functions/user/delete.js

@@ -0,0 +1,135 @@
+/**
+ * User deletion flow tests
+ * Tests:
+ * - Users with active subscriptions cannot delete themselves
+ * - Users cannot delete other users
+ * - Users can delete themselves after subscription is removed
+ * - Admins can delete any user
+ */
+module.exports = {
+  description: 'User deletion flow',
+  type: 'suite',
+
+  tests: [
+    // --- Self-deletion tests ---
+    {
+      name: 'verify-delete-user-exists',
+      async run({ firestore, assert, state, accounts }) {
+        // Get the delete test account uid
+        state.deleteUid = accounts.delete.uid;
+
+        // Verify the user doc exists
+        const userDoc = await firestore.get(`users/${state.deleteUid}`);
+
+        assert.ok(userDoc, 'Delete user doc should exist before deletion');
+        assert.ok(userDoc?.auth?.uid === state.deleteUid, 'User doc should have correct uid');
+      },
+    },
+
+    {
+      name: 'delete-blocked-with-subscription',
+      async run({ http, assert }) {
+        // Auth as the delete user and try to delete themselves
+        // Should be blocked due to active subscription
+        const deleteResponse = await http.as('delete').command('user:delete', {});
+
+        assert.isError(deleteResponse, 400, 'Deletion should be blocked with active subscription');
+        assert.ok(
+          deleteResponse.error?.includes('paid subscription'),
+          `Error should mention paid subscription: ${deleteResponse.error}`,
+        );
+      },
+    },
+
+    // NOTE: The user:delete API ignores the payload uid parameter for non-admin users.
+    // It always uses the authenticated user's uid from resolveUser().
+    // This means non-admins cannot delete other users by design - the uid param is simply ignored.
+    // A test for "delete other user blocked" would be misleading since it would actually
+    // try to delete the authenticated user (basic), not the target user.
+    // If we want to explicitly block this, the API should be updated to check payload.uid
+    // against user.auth.uid and return a 403 if they don't match.
+
+    {
+      name: 'remove-subscription-from-delete-user',
+      async run({ firestore, state }) {
+        // Remove the subscription (set to null to overwrite)
+        await firestore.set(`users/${state.deleteUid}`, { subscription: null }, { merge: true });
+      },
+    },
+
+    {
+      name: 'delete-user-succeeds',
+      async run({ http, assert }) {
+        // Auth as the delete user and delete themselves
+        const deleteResponse = await http.as('delete').command('user:delete', {});
+
+        assert.isSuccess(deleteResponse, `user:delete should succeed: ${JSON.stringify(deleteResponse, null, 2)}`);
+      },
+    },
+
+    {
+      name: 'verify-firestore-doc-deleted',
+      async run({ firestore, assert, state, waitFor }) {
+        // on-delete handler deletes Firestore doc when Auth user is deleted
+        // Wait for the deletion to complete
+        const docDeleted = await waitFor(async () => {
+          const userDoc = await firestore.get(`users/${state.deleteUid}`);
+          return !userDoc;
+        }, 10000, 500);
+
+        assert.ok(docDeleted, 'Firestore doc should be deleted after Auth user deletion');
+      },
+    },
+
+    // --- Admin deletion tests ---
+    {
+      name: 'verify-admin-delete-target-exists',
+      async run({ firestore, assert, state, accounts }) {
+        // Get the delete-by-admin test account uid
+        state.adminDeleteUid = accounts['delete-by-admin'].uid;
+
+        // Verify the user doc exists
+        const userDoc = await firestore.get(`users/${state.adminDeleteUid}`);
+
+        assert.ok(userDoc, 'Admin delete target user doc should exist');
+        assert.ok(userDoc?.auth?.uid === state.adminDeleteUid, 'User doc should have correct uid');
+      },
+    },
+
+    {
+      name: 'admin-can-delete-other-user',
+      async run({ http, assert, state }) {
+        // Auth as admin (using backendManagerKey) and delete another user
+        const deleteResponse = await http.as('admin').command('user:delete', {
+          uid: state.adminDeleteUid,
+        });
+
+        assert.isSuccess(deleteResponse, `Admin should be able to delete another user: ${JSON.stringify(deleteResponse, null, 2)}`);
+      },
+    },
+
+    {
+      name: 'verify-admin-deleted-user-firestore-deleted',
+      async run({ firestore, assert, state, waitFor }) {
+        // on-delete handler deletes Firestore doc when Auth user is deleted
+        // Wait for the deletion to complete
+        const docDeleted = await waitFor(async () => {
+          const userDoc = await firestore.get(`users/${state.adminDeleteUid}`);
+          return !userDoc;
+        }, 10000, 500);
+
+        assert.ok(docDeleted, 'Firestore doc should be deleted after admin deletion');
+      },
+    },
+
+    // --- Auth rejection test (at end per convention) ---
+    {
+      name: 'unauthenticated-rejected',
+      async run({ http, assert }) {
+        const deleteResponse = await http.as('none').command('user:delete', {});
+
+        assert.isError(deleteResponse, 401, 'Delete should fail without authentication');
+      },
+    },
+  ],
+};

package/test/functions/user/get-active-sessions.js

@@ -0,0 +1,111 @@
+/**
+ * Test: user:get-active-sessions
+ * Tests the user get active sessions command
+ * Returns sessions for authenticated users from Realtime Database
+ */
+module.exports = {
+  description: 'User get active sessions',
+  type: 'group',
+  tests: [
+    // Test 1: Authenticated user can get sessions
+    {
+      name: 'authenticated-user-succeeds',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:get-active-sessions', {});
+
+        assert.isSuccess(response, 'Get active sessions should succeed for authenticated user');
+        assert.ok(
+          typeof response.data === 'object',
+          'Response data should be an object'
+        );
+      },
+    },
+
+    // Test 2: Default session id is 'app'
+    {
+      name: 'default-session-is-app',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        // With no id specified, should query sessions/app
+        const response = await http.command('user:get-active-sessions', {});
+
+        assert.isSuccess(response, 'Get active sessions should succeed');
+        // Response is an object (may be empty if no sessions)
+        assert.ok(
+          response.data !== undefined,
+          'Response should have data'
+        );
+      },
+    },
+
+    // Test 3: Custom session id
+    {
+      name: 'custom-session-id',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:get-active-sessions', {
+          id: 'custom-session-type',
+        });
+
+        assert.isSuccess(response, 'Get active sessions with custom id should succeed');
+        assert.ok(
+          typeof response.data === 'object',
+          'Response data should be an object'
+        );
+      },
+    },
+
+    // Test 4: Empty sessions returns empty object
+    {
+      name: 'no-sessions-returns-empty',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        // Query a session type that definitely doesn't exist
+        const response = await http.command('user:get-active-sessions', {
+          id: 'nonexistent-session-type-12345',
+        });
+
+        assert.isSuccess(response, 'Get sessions for empty type should succeed');
+        assert.ok(
+          Object.keys(response.data).length === 0,
+          'Empty session type should return empty object'
+        );
+      },
+    },
+
+    // Test 5: Admin can get sessions
+    {
+      name: 'admin-succeeds',
+      auth: 'admin',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:get-active-sessions', {});
+
+        assert.isSuccess(response, 'Get active sessions should succeed for admin');
+      },
+    },
+
+    // Test 6: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:get-active-sessions', {});
+
+        assert.isError(response, 401, 'Get active sessions should fail without authentication');
+      },
+    },
+  ],
+};

package/test/functions/user/get-subscription-info.js

@@ -0,0 +1,99 @@
+/**
+ * Test: user:get-subscription-info
+ * Tests the user get subscription info command
+ * Returns subscription details for authenticated users
+ */
+module.exports = {
+  description: 'User get subscription info',
+  type: 'group',
+  tests: [
+    // Test 1: Basic user can get subscription info
+    {
+      name: 'basic-user-succeeds',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:get-subscription-info', {});
+
+        assert.isSuccess(response, 'Get subscription info should succeed for authenticated user');
+        assert.hasProperty(response, 'data.subscription', 'Response should contain subscription object');
+        assert.hasProperty(response, 'data.subscription.product.id', 'Subscription should have id');
+        assert.hasProperty(response, 'data.subscription.expires', 'Subscription should have expires');
+        assert.hasProperty(response, 'data.subscription.trial', 'Subscription should have trial info');
+        assert.hasProperty(response, 'data.subscription.payment', 'Subscription should have payment info');
+      },
+    },
+
+    // Test 2: Subscription has correct structure
+    {
+      name: 'subscription-structure-valid',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:get-subscription-info', {});
+
+        assert.isSuccess(response, 'Get subscription info should succeed');
+
+        const subscription = response.data.subscription;
+
+        // Check expires structure
+        assert.hasProperty(response, 'data.subscription.expires.timestamp', 'expires should have timestamp');
+        assert.hasProperty(response, 'data.subscription.expires.timestampUNIX', 'expires should have timestampUNIX');
+
+        // Check trial structure
+        assert.ok(
+          typeof subscription.trial.claimed === 'boolean',
+          'trial.claimed should be boolean'
+        );
+
+        // Check payment structure
+        assert.hasProperty(response, 'data.subscription.payment', 'subscription should have payment');
+      },
+    },
+
+    // Test 3: Premium user has active subscription
+    {
+      name: 'premium-user-has-active-subscription',
+      auth: 'premium-active',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:get-subscription-info', {});
+
+        assert.isSuccess(response, 'Get subscription info should succeed for premium user');
+        assert.hasProperty(response, 'data.subscription.product.id', 'Premium user should have subscription id');
+        assert.hasProperty(response, 'data.subscription.payment', 'Premium user should have payment info');
+      },
+    },
+
+    // Test 4: Expired premium user still gets info
+    {
+      name: 'expired-premium-returns-info',
+      auth: 'premium-expired',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:get-subscription-info', {});
+
+        assert.isSuccess(response, 'Get subscription info should succeed for expired premium');
+        assert.hasProperty(response, 'data.subscription.product.id', 'Should still have subscription id');
+        assert.hasProperty(response, 'data.subscription.expires.timestampUNIX', 'Should have expires timestamp');
+      },
+    },
+
+    // Test 5: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:get-subscription-info', {});
+
+        assert.isError(response, 401, 'Get subscription info should fail without authentication');
+      },
+    },
+  ],
+};

package/test/functions/user/regenerate-api-keys.js

@@ -0,0 +1,156 @@
+/**
+ * Test: user:regenerate-api-keys
+ * Tests the user regenerate API keys command
+ * This is a suite because we need to track state and restore original keys
+ */
+module.exports = {
+  description: 'User regenerate API keys',
+  type: 'suite',
+  timeout: 30000,
+
+  tests: [
+    // Test 1: Store original keys
+    {
+      name: 'store-original-keys',
+      async run({ firestore, assert, state, accounts }) {
+        // Get the basic account's current keys to restore later
+        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
+
+        assert.ok(userDoc, 'User doc should exist');
+        assert.hasProperty({ data: userDoc }, 'data.api.clientId', 'User should have clientId');
+        assert.hasProperty({ data: userDoc }, 'data.api.privateKey', 'User should have privateKey');
+
+        state.originalClientId = userDoc.api.clientId;
+        state.originalPrivateKey = userDoc.api.privateKey;
+
+        assert.ok(state.originalClientId, 'Original clientId should exist');
+        assert.ok(state.originalPrivateKey, 'Original privateKey should exist');
+      },
+    },
+
+    // Test 2: Regenerate both keys (default)
+    {
+      name: 'regenerate-both-keys',
+      async run({ http, assert, state }) {
+        const response = await http.as('basic').command('user:regenerate-api-keys', {});
+
+        assert.isSuccess(response, 'Regenerate API keys should succeed');
+        assert.hasProperty(response, 'data.clientId', 'Response should contain new clientId');
+        assert.hasProperty(response, 'data.privateKey', 'Response should contain new privateKey');
+
+        // Keys should be different from original
+        assert.notEqual(
+          response.data.clientId,
+          state.originalClientId,
+          'New clientId should be different from original'
+        );
+        assert.notEqual(
+          response.data.privateKey,
+          state.originalPrivateKey,
+          'New privateKey should be different from original'
+        );
+
+        // Store new keys for verification
+        state.newClientId = response.data.clientId;
+        state.newPrivateKey = response.data.privateKey;
+      },
+    },
+
+    // Test 3: Verify keys are persisted in Firestore
+    {
+      name: 'verify-keys-persisted',
+      async run({ firestore, assert, state, accounts }) {
+        const userDoc = await firestore.get(`users/${accounts.basic.uid}`);
+
+        assert.equal(
+          userDoc.api.clientId,
+          state.newClientId,
+          'Persisted clientId should match returned value'
+        );
+        assert.equal(
+          userDoc.api.privateKey,
+          state.newPrivateKey,
+          'Persisted privateKey should match returned value'
+        );
+      },
+    },
+
+    // Test 4: Regenerate only clientId
+    // Note: After test 2, the privateKey changed so we need to use the new one
+    {
+      name: 'regenerate-only-clientId',
+      async run({ http, assert, state }) {
+        // Use the new privateKey from test 2 since old one is invalid
+        const response = await http.withPrivateKey(state.newPrivateKey).command('user:regenerate-api-keys', {
+          keys: ['clientId'],
+        });
+
+        assert.isSuccess(response, 'Regenerate clientId only should succeed');
+        assert.hasProperty(response, 'data.clientId', 'Response should contain new clientId');
+        assert.ok(
+          !response.data.privateKey,
+          'Response should NOT contain privateKey when only clientId requested'
+        );
+        assert.notEqual(
+          response.data.clientId,
+          state.newClientId,
+          'New clientId should be different from previous'
+        );
+      },
+    },
+
+    // Test 5: Regenerate only privateKey
+    {
+      name: 'regenerate-only-privateKey',
+      async run({ http, assert, state, accounts, firestore }) {
+        // Get current clientId to verify it stays the same
+        const beforeDoc = await firestore.get(`users/${accounts.basic.uid}`);
+        const currentClientId = beforeDoc.api.clientId;
+
+        // Still use newPrivateKey since test 4 didn't change it
+        const response = await http.withPrivateKey(state.newPrivateKey).command('user:regenerate-api-keys', {
+          keys: ['privateKey'],
+        });
+
+        assert.isSuccess(response, 'Regenerate privateKey only should succeed');
+        assert.hasProperty(response, 'data.privateKey', 'Response should contain new privateKey');
+        assert.ok(
+          !response.data.clientId,
+          'Response should NOT contain clientId when only privateKey requested'
+        );
+
+        // Verify clientId stayed the same
+        const afterDoc = await firestore.get(`users/${accounts.basic.uid}`);
+        assert.equal(
+          afterDoc.api.clientId,
+          currentClientId,
+          'clientId should remain unchanged when only privateKey regenerated'
+        );
+      },
+    },
+
+    // Test 6: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      async run({ http, assert }) {
+        const response = await http.as('none').command('user:regenerate-api-keys', {});
+
+        assert.isError(response, 401, 'Regenerate API keys should fail without authentication');
+      },
+    },
+
+    // Test 7: Restore original keys
+    {
+      name: 'restore-original-keys',
+      async run({ firestore, state, accounts }) {
+        // Restore original keys so other tests aren't affected
+        await firestore.set(`users/${accounts.basic.uid}`, {
+          api: {
+            clientId: state.originalClientId,
+            privateKey: state.originalPrivateKey,
+          },
+        }, { merge: true });
+      },
+    },
+  ],
+};

package/test/functions/user/resolve.js

@@ -0,0 +1,52 @@
+/**
+ * Test: user:resolve
+ * Tests the user resolve command
+ * Returns user account info for authenticated users
+ *
+ * SKIPPED: The user:resolve command is not yet implemented (has TODO in handler)
+ */
+module.exports = {
+  description: 'User resolve (account info)',
+  skip: 'user:resolve command not yet implemented',
+  type: 'group',
+  tests: [
+    // Test 1: Authenticated user can call resolve
+    {
+      name: 'authenticated-user-succeeds',
+      auth: 'basic',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:resolve', {});
+
+        assert.isSuccess(response, 'Resolve should succeed for authenticated user');
+      },
+    },
+
+    // Test 2: Premium user can call resolve
+    {
+      name: 'premium-user-succeeds',
+      auth: 'premium-active',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:resolve', {});
+
+        assert.isSuccess(response, 'Resolve should succeed for premium user');
+      },
+    },
+
+    // Test 3: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:resolve', {});
+
+        assert.isError(response, 401, 'Resolve should fail without authentication');
+      },
+    },
+  ],
+};

package/test/functions/user/sign-out-all-sessions.js

@@ -0,0 +1,94 @@
+/**
+ * Test: user:sign-out-all-sessions
+ * Tests the user sign out all sessions command
+ * This revokes refresh tokens and clears session data
+ * Note: This is a potentially destructive test, so we use a dedicated test account
+ */
+module.exports = {
+  description: 'User sign out all sessions',
+  type: 'group',
+  tests: [
+    // Test 1: Authenticated user can sign out all sessions
+    {
+      name: 'authenticated-user-succeeds',
+      auth: 'basic',
+      timeout: 30000, // Longer timeout due to session cleanup
+
+      async run({ http, assert }) {
+        const response = await http.command('user:sign-out-all-sessions', {});
+
+        assert.isSuccess(response, 'Sign out all sessions should succeed for authenticated user');
+        assert.hasProperty(response, 'data.sessions', 'Response should contain sessions count');
+        assert.hasProperty(response, 'data.message', 'Response should contain message');
+        assert.ok(
+          typeof response.data.sessions === 'number',
+          'sessions should be a number'
+        );
+        assert.ok(
+          response.data.sessions >= 0,
+          'sessions count should be non-negative'
+        );
+      },
+    },
+
+    // Test 2: Custom session id
+    {
+      name: 'custom-session-id',
+      auth: 'basic',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:sign-out-all-sessions', {
+          id: 'custom-session-type',
+        });
+
+        assert.isSuccess(response, 'Sign out with custom session id should succeed');
+        assert.hasProperty(response, 'data.sessions', 'Response should contain sessions count');
+      },
+    },
+
+    // Test 3: Premium user can sign out all sessions
+    // Note: backendManagerKey admin doesn't have auth.uid, so we test with premium user instead
+    {
+      name: 'premium-user-succeeds',
+      auth: 'premium-active',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:sign-out-all-sessions', {});
+
+        assert.isSuccess(response, 'Sign out all sessions should succeed for premium user');
+        assert.hasProperty(response, 'data.sessions', 'Response should contain sessions count');
+      },
+    },
+
+    // Test 4: Multiple calls are idempotent
+    {
+      name: 'idempotent-operation',
+      auth: 'basic',
+      timeout: 30000,
+
+      async run({ http, assert }) {
+        // Call twice in a row - both should succeed
+        const response1 = await http.command('user:sign-out-all-sessions', {});
+        const response2 = await http.command('user:sign-out-all-sessions', {});
+
+        assert.isSuccess(response1, 'First sign out should succeed');
+        assert.isSuccess(response2, 'Second sign out should succeed (idempotent)');
+      },
+    },
+
+    // Test 5: Unauthenticated request fails
+    {
+      name: 'unauthenticated-rejected',
+      auth: 'none',
+      timeout: 15000,
+
+      async run({ http, assert }) {
+        const response = await http.command('user:sign-out-all-sessions', {});
+
+        assert.isError(response, 401, 'Sign out all sessions should fail without authentication');
+      },
+    },
+  ],
+};