cabloy 5.1.136 → 5.1.138

package/vona/src/suite/a-home/modules/home-user/test/account.test.ts

@@ -0,0 +1,249 @@
+import fse from 'fs-extra';
+import assert from 'node:assert';
+import os from 'node:os';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+import { app } from 'vona-mock';
+
+const tinyPng = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQIHWP4z8DwHwAFAAH/e+m+7wAAAABJRU5ErkJggg==',
+  'base64',
+);
+
+const currentPath = '/home/user/account/current';
+const profilePath = '/home/user/account/profile';
+const passwordChangePath = '/home/user/account/password/change';
+
+interface IAccountFixture {
+  userId: string;
+  authId: string;
+  authSimpleId: string;
+  name: string;
+}
+
+describe('account.test.ts', { concurrency: false }, () => {
+  it('uses the current Passport subject for profile updates and password changes', async () => {
+    let fixture: IAccountFixture | undefined;
+    try {
+      fixture = await createFixture();
+
+      await app.bean.executor.mockCtx(async () => {
+        await app.bean.passport.signinSystem('mock', -10001 as any, fixture!.name);
+        try {
+          const current = await app.bean.executor.performAction('get', currentPath, {
+            innerAccess: false,
+          });
+          assert.equal(current.name, fixture!.name);
+          assert.equal(current.hasSimpleAuth, true);
+          assert.equal(current.canSendSetPasswordLink, false);
+
+          const updated = await app.bean.executor.performAction('patch', profilePath, {
+            innerAccess: false,
+            body: {
+              name: `${fixture!.name}-updated`,
+              locale: 'en_us',
+              tz: 'America/New_York',
+              ignored: 'must-not-persist',
+            },
+          });
+          assert.equal(updated.name, `${fixture!.name}-updated`);
+          assert.equal(updated.locale, 'en-us');
+          assert.equal(updated.tz, 'America/New_York');
+        } finally {
+          await app.bean.passport.signout();
+        }
+      });
+
+      await app.bean.executor.mockCtx(async () => {
+        const user = await app.bean.user.findOneById(fixture!.userId);
+        assert.equal(user?.name, `${fixture!.name}-updated`);
+        assert.equal((user as Record<string, unknown>)?.ignored, undefined);
+      });
+
+      await app.bean.executor.mockCtx(async () => {
+        await app.bean.passport.signinSystem('mock', -10002 as any, `${fixture!.name}-updated`);
+        try {
+          const result = await app.bean.executor.performAction('post', passwordChangePath, {
+            innerAccess: false,
+            body: {
+              currentPassword: 'initial-password',
+              newPassword: 'updated-password',
+              passwordConfirm: 'updated-password',
+            },
+          });
+          assert.deepEqual(result, { requiresRelogin: true });
+        } finally {
+          await app.bean.passport.signout();
+        }
+      });
+
+      await app.bean.executor.mockCtx(async () => {
+        const authSimple = app.scope('auth-simple').service.authSimple;
+        assert.equal(
+          await authSimple.verifyPassword(fixture!.userId, 'initial-password'),
+          undefined,
+        );
+        assert.ok(await authSimple.verifyPassword(fixture!.userId, 'updated-password'));
+      });
+    } finally {
+      if (fixture) await removeFixture(fixture);
+    }
+  });
+
+  it('accepts a freshly uploaded avatar during profile update', async () => {
+    let fixture: IAccountFixture | undefined;
+    let imageId: string | number | undefined;
+    const imagePath = path.join(os.tmpdir(), `account-avatar-${crypto.randomUUID()}.png`);
+    await fse.writeFile(imagePath, tinyPng);
+    try {
+      fixture = await createFixture();
+      await app.bean.executor.mockCtx(async () => {
+        await app.bean.passport.signinSystem('mock', -10004 as any, fixture!.name);
+        try {
+          const policy = await app.bean.imageUploadPolicy.resolveUploadPolicy({
+            imageScene: 'home-user:homeUserAvatar',
+            size: tinyPng.length,
+            mimeType: 'image/png',
+          });
+          const uploaded = await app.bean.image.upload(
+            policy.providerName,
+            {
+              file: imagePath,
+              filename: 'avatar.png',
+              contentType: policy.mimeType,
+              public: policy.public,
+            },
+            {
+              clientName: policy.clientName,
+              imageScene: policy.imageScene,
+              meta: policy.meta,
+              public: policy.public,
+            },
+          );
+          imageId = uploaded.id;
+          const uploadedResponse = await app.bean.image.createImageActionResponse(uploaded);
+          const uploadedUrl = uploadedResponse.url;
+          const reloaded = await app.scope('a-image').model.image.getById(imageId);
+          assert.strictEqual(reloaded?.public, true);
+          assert.strictEqual(typeof reloaded?.public, 'boolean');
+          assert.equal(reloaded?.imageScene, 'home-user:homeUserAvatar');
+          assert.equal(reloaded?.status, 'ready');
+          assert.equal(reloaded?.meta?.ownerUserId, fixture!.userId);
+          assert.equal(typeof uploadedUrl, 'string');
+          const updated = await app.bean.executor.performAction('patch', profilePath, {
+            innerAccess: false,
+            body: {
+              name: fixture!.name,
+              avatar: uploadedUrl,
+            },
+          });
+          assert.equal(updated.avatar, uploadedUrl);
+          assert.equal(typeof updated.avatar, 'string');
+
+          const persisted = await app.scope('home-user').model.user.getById(fixture!.userId);
+          assert.equal(persisted?.avatar, uploadedUrl);
+
+          const preserved = await app.bean.executor.performAction('patch', profilePath, {
+            innerAccess: false,
+            body: { name: fixture!.name },
+          });
+          assert.equal(preserved.avatar, uploadedUrl);
+
+          const thirdPartyAvatar = 'https://example.com/avatar.png';
+          const thirdPartyUpdated = await app.bean.executor.performAction('patch', profilePath, {
+            innerAccess: false,
+            body: {
+              name: fixture!.name,
+              avatar: thirdPartyAvatar,
+            },
+          });
+          assert.equal(thirdPartyUpdated.avatar, thirdPartyAvatar);
+
+          const cleared = await app.bean.executor.performAction('patch', profilePath, {
+            innerAccess: false,
+            body: { name: fixture!.name, avatar: null },
+          });
+          assert.equal(cleared.avatar, undefined);
+        } finally {
+          await app.bean.passport.signout();
+        }
+      });
+    } finally {
+      await app.bean.executor.mockCtx(async () => {
+        if (imageId) await app.bean.image.delete(imageId);
+      });
+      if (fixture) await removeFixture(fixture);
+      await fse.remove(imagePath);
+    }
+  });
+
+  it('rejects an invalid current password without changing the credential', async () => {
+    let fixture: IAccountFixture | undefined;
+    try {
+      fixture = await createFixture();
+      await app.bean.executor.mockCtx(async () => {
+        await app.bean.passport.signinSystem('mock', -10003 as any, fixture!.name);
+        try {
+          await assert.rejects(
+            () =>
+              app.bean.executor.performAction('post', passwordChangePath, {
+                innerAccess: false,
+                body: {
+                  currentPassword: 'wrong-password',
+                  newPassword: 'updated-password',
+                  passwordConfirm: 'updated-password',
+                },
+              }),
+            (error: { code?: number }) => error.code === 403,
+          );
+        } finally {
+          await app.bean.passport.signout();
+        }
+      });
+
+      await app.bean.executor.mockCtx(async () => {
+        assert.ok(
+          await app
+            .scope('auth-simple')
+            .service.authSimple.verifyPassword(fixture!.userId, 'initial-password'),
+        );
+      });
+    } finally {
+      if (fixture) await removeFixture(fixture);
+    }
+  });
+});
+
+async function createFixture(): Promise<IAccountFixture> {
+  return await app.bean.executor.mockCtx(async () => {
+    const name = `account-test-${crypto.randomUUID()}`;
+    const user = await app.bean.user.register({ name }, true);
+    const authSimple = await app
+      .scope('auth-simple')
+      .service.authSimple.createForUser(user.id, 'initial-password');
+    if (!authSimple) throw new Error('failed to create the test local credential');
+    const provider = await app.bean.authProvider.get({
+      providerName: 'auth-simple:simple',
+      clientName: 'default',
+    });
+    const auth = await app.scope('a-auth').model.auth.get({
+      userId: user.id,
+      authProviderId: provider.id,
+    });
+    if (!auth) throw new Error('failed to create the test auth relation');
+    return {
+      userId: user.id.toString(),
+      authId: auth.id.toString(),
+      authSimpleId: authSimple.id.toString(),
+      name,
+    };
+  });
+}
+
+async function removeFixture(fixture: IAccountFixture): Promise<void> {
+  await app.bean.executor.mockCtx(async () => {
+    await app.scope('a-auth').model.auth.deleteById(fixture.authId);
+    await app.scope('auth-simple').model.authSimple.deleteById(fixture.authSimpleId);
+    await app.bean.user.removeById(fixture.userId);
+  });
+}

package/vona/src/suite/a-home/modules/home-user/test/accountActivation.test.ts

@@ -0,0 +1,344 @@
+import assert from 'node:assert';
+import { after, before, describe, it } from 'node:test';
+import { createHash } from 'vona';
+import { acquireTestLock, app } from 'vona-mock';
+
+const activationConsumePath = '/home/user/account/activation/consume';
+const activationConsumerUrl = 'https://account.example.test/home/user/activation';
+
+describe('accountActivation.test.ts', { concurrency: false, sequential: true }, () => {
+  const releases: Array<() => void> = [];
+  let restoreConfig: (() => void) | undefined;
+
+  before(async () => {
+    for (const scene of ['a-mail', 'a-security', 'home-user']) {
+      releases.push(await acquireTestLock(scene));
+    }
+    restoreConfig = await configureActivation();
+  });
+
+  after(() => {
+    restoreConfig?.();
+    for (const release of releases.reverse()) release();
+  });
+
+  it('issues a digest-backed activation link and consumes it once', async () => {
+    let fixture: IFixture | undefined;
+    try {
+      fixture = await createFixture();
+      const issued = await issueActivationLink(fixture);
+      assert.match(issued.token, /^[0-9a-f-]{36}$/);
+      assert.equal(issued.path, '/home/user/activation');
+      const digest = getDigest(issued.token);
+      assert.deepEqual(await getActivationState(digest), {
+        purpose: 'account-activation',
+        userId: fixture.userId,
+        consumerPath: '/home/user/activation',
+        email: fixture.email,
+      });
+      assert.equal(await getCurrentDigest(fixture.userId), digest);
+
+      await consumeActivation(issued.token);
+      await app.bean.executor.mockCtx(async () => {
+        const user = await app.bean.user.findOneById(fixture!.userId);
+        assert.equal(user?.activated, true);
+        const role = await app.scope('home-user').model.role.getByName('registeredUser');
+        assert.ok(
+          await app.scope('home-user').model.roleUser.get({
+            roleId: role!.id,
+            userId: fixture!.userId,
+          }),
+        );
+      });
+      assert.equal(await getActivationState(digest), undefined);
+      assert.equal(await getCurrentDigest(fixture.userId), undefined);
+      await assertActivationRejected(issued.token);
+    } finally {
+      if (fixture) await removeFixture(fixture);
+    }
+  });
+
+  it('supersedes an earlier activation token', async () => {
+    let fixture: IFixture | undefined;
+    try {
+      fixture = await createFixture();
+      const first = await issueActivationLink(fixture);
+      const second = await issueActivationLink(fixture);
+      assert.equal(await getActivationState(getDigest(first.token)), undefined);
+      assert.equal(await getCurrentDigest(fixture.userId), getDigest(second.token));
+      await assertActivationRejected(first.token);
+      await consumeActivation(second.token);
+    } finally {
+      if (fixture) await removeFixture(fixture);
+    }
+  });
+
+  it('issues an activation link through registration and activates the registered user', async () => {
+    let registration: IRegistration | undefined;
+    try {
+      registration = await registerWithActivationLink();
+      assert.equal(registration.passport.user.activated, false);
+      assert.equal(registration.path, '/home/user/activation');
+      const digest = getDigest(registration.token);
+      assert.deepEqual(await getActivationState(digest), {
+        purpose: 'account-activation',
+        userId: registration.userId,
+        consumerPath: '/home/user/activation',
+        email: registration.email,
+      });
+
+      await consumeActivation(registration.token);
+      await app.bean.executor.mockCtx(async () => {
+        const user = await app.bean.user.findOneById(registration!.userId);
+        assert.equal(user?.activated, true);
+      });
+    } finally {
+      if (registration) await removeRegistration(registration);
+    }
+  });
+
+  it('cleans activation state when mail enqueue fails', async () => {
+    let fixture: IFixture | undefined;
+    const mail = app.bean.mail;
+    const send = mail.send;
+    try {
+      fixture = await createFixture();
+      mail.send = async () => {
+        throw new Error('mail unavailable');
+      };
+      await assert.rejects(() =>
+        app.bean.executor.mockCtx(async () => {
+          await app
+            .scope('home-user')
+            .service.account.issueActivationLink(fixture!.userId, activationConsumerUrl);
+        }),
+      );
+      assert.equal(await getCurrentDigest(fixture.userId), undefined);
+    } finally {
+      mail.send = send;
+      if (fixture) await removeFixture(fixture);
+    }
+  });
+
+  it('rejects unsafe activation consumer URLs before creating state', async () => {
+    let fixture: IFixture | undefined;
+    let sendCount = 0;
+    const mail = app.bean.mail;
+    const send = mail.send;
+    try {
+      fixture = await createFixture();
+      mail.send = async () => {
+        sendCount++;
+      };
+      for (const consumerUrl of [
+        'https://account.example.test/home/user/activation?next=/other',
+        'https://account.example.test/home/user/activation?token=attacker',
+        'https://account.example.test/home/user/activation#token=attacker',
+        'https://user@account.example.test/home/user/activation',
+        'https://account.example.test:444/home/user/activation',
+        'https://evil.account.example.test/home/user/activation',
+        'https://account.example.test/home/user/password-set',
+        '/home/user/activation',
+        'not a URL',
+        'javascript:alert(1)',
+        'file:///home/user/activation',
+        'https://user:password@account.example.test/home/user/activation',
+        'https:\\\\account.example.test/home/user/activation',
+      ]) {
+        await assert.rejects(
+          () =>
+            app.bean.executor.mockCtx(async () => {
+              await app
+                .scope('home-user')
+                .service.account.issueActivationLink(fixture!.userId, consumerUrl);
+            }),
+          (error: { code?: number }) => error.code === 503,
+        );
+        assert.equal(await getCurrentDigest(fixture.userId), undefined);
+      }
+      assert.equal(sendCount, 0);
+    } finally {
+      mail.send = send;
+      if (fixture) await removeFixture(fixture);
+    }
+  });
+});
+
+interface IFixture {
+  userId: string;
+  email: string;
+}
+
+interface IRegistration extends IFixture {
+  passport: { user: { activated: boolean } };
+  token: string;
+  path: string;
+}
+
+async function configureActivation() {
+  return await app.bean.executor.mockCtx(async () => {
+    const options =
+      app.bean.onion.middlewareSystem.getOnionSlice('a-security:cors').beanOptions.options;
+    const whiteListPrevious = options.whiteList;
+    options.whiteList = ['https://account.example.test'];
+    return () => {
+      options.whiteList = whiteListPrevious;
+    };
+  });
+}
+
+async function registerWithActivationLink(): Promise<IRegistration> {
+  let text: unknown;
+  const mail = app.bean.mail;
+  const send = mail.send;
+  const username = `account-activation-register-${crypto.randomUUID()}`;
+  const email = `${crypto.randomUUID()}@example.test`;
+  mail.send = async options => {
+    text = options.text;
+  };
+  try {
+    const passport = await app.bean.executor.mockCtx(async () => {
+      const captcha = await app.bean.captcha.create('captcha-simple:simple');
+      const captchaData = await app.bean.captcha.getCaptchaData(captcha.id);
+      if (!captchaData?.token) throw new Error('registration CAPTCHA token not found');
+      return await app.bean.executor.performAction('post', '/home/user/passport/register', {
+        innerAccess: false,
+        onions: {
+          interceptor: {
+            'a-ratelimit:rateLimit': { enable: false },
+          },
+        },
+        body: {
+          username,
+          email,
+          password: 'initial-password',
+          passwordConfirm: 'initial-password',
+          consumerUrl: activationConsumerUrl,
+          captcha: { id: captcha.id, token: captchaData.token },
+        },
+      });
+    });
+    if (typeof text !== 'string') throw new Error('activation email text not found');
+    const url = new URL(text.match(/https?:\/\/\S+/)?.[0] ?? '');
+    const token = url.searchParams.get('token');
+    if (!token) throw new Error('activation token not found');
+    return {
+      userId: passport.passport.user.id,
+      email,
+      passport: passport.passport,
+      token,
+      path: url.pathname,
+    };
+  } finally {
+    mail.send = send;
+  }
+}
+
+async function removeRegistration(registration: IRegistration) {
+  await app.bean.executor.mockCtx(async () => {
+    const provider = await app.bean.authProvider.get({
+      providerName: 'auth-simple:simple',
+      clientName: 'default',
+    });
+    const auth = await app.scope('a-auth').model.auth.get({
+      userId: registration.userId,
+      authProviderId: provider.id,
+    });
+    if (auth) {
+      await app.scope('a-auth').model.auth.deleteById(auth.id);
+      await app.scope('auth-simple').model.authSimple.deleteById(auth.profileId);
+    }
+    const role = await app.scope('home-user').model.role.getByName('registeredUser');
+    await app.scope('home-user').model.roleUser.delete({
+      roleId: role!.id,
+      userId: registration.userId,
+    });
+    const digest = await app
+      .scope('home-user')
+      .cacheRedis.activationCurrent.get(registration.userId as any);
+    if (digest) await app.scope('home-user').cacheRedis.activation.del(digest);
+    await app.scope('home-user').cacheRedis.activationCurrent.del(registration.userId as any);
+    await app.bean.user.removeById(registration.userId);
+  });
+}
+
+async function createFixture(): Promise<IFixture> {
+  return await app.bean.executor.mockCtx(async () => {
+    const email = `${crypto.randomUUID()}@example.test`;
+    const user = await app.bean.user.register({
+      name: `account-activation-test-${crypto.randomUUID()}`,
+      email,
+    });
+    return { userId: user.id.toString(), email };
+  });
+}
+
+async function removeFixture(fixture: IFixture) {
+  await app.bean.executor.mockCtx(async () => {
+    const role = await app.scope('home-user').model.role.getByName('registeredUser');
+    await app
+      .scope('home-user')
+      .model.roleUser.delete({ roleId: role!.id, userId: fixture.userId });
+    const digest = await app
+      .scope('home-user')
+      .cacheRedis.activationCurrent.get(fixture.userId as any);
+    if (digest) await app.scope('home-user').cacheRedis.activation.del(digest);
+    await app.scope('home-user').cacheRedis.activationCurrent.del(fixture.userId as any);
+    await app.bean.user.removeById(fixture.userId);
+  });
+}
+
+async function issueActivationLink(fixture: IFixture) {
+  let text: unknown;
+  const mail = app.bean.mail;
+  const send = mail.send;
+  mail.send = async options => {
+    text = options.text;
+  };
+  try {
+    await app.bean.executor.mockCtx(async () => {
+      await app
+        .scope('home-user')
+        .service.account.issueActivationLink(fixture.userId, activationConsumerUrl);
+    });
+  } finally {
+    mail.send = send;
+  }
+  if (typeof text !== 'string') throw new Error('activation email text not found');
+  const url = new URL(text.match(/https?:\/\/\S+/)?.[0] ?? '');
+  const token = url.searchParams.get('token');
+  if (!token) throw new Error('activation token not found');
+  return { token, path: url.pathname };
+}
+
+async function consumeActivation(token: string) {
+  await app.bean.executor.mockCtx(async () => {
+    await app.bean.executor.performAction('post', activationConsumePath, {
+      innerAccess: false,
+      body: { token },
+    });
+  });
+}
+
+async function assertActivationRejected(token: string) {
+  await assert.rejects(
+    () => consumeActivation(token),
+    (error: { code?: number }) => error.code === 403,
+  );
+}
+
+function getDigest(token: string) {
+  return createHash(token, 'hex', 'sha256');
+}
+
+async function getActivationState(digest: string) {
+  return await app.bean.executor.mockCtx(async () => {
+    return await app.scope('home-user').cacheRedis.activation.get(digest);
+  });
+}
+
+async function getCurrentDigest(userId: string) {
+  return await app.bean.executor.mockCtx(async () => {
+    return await app.scope('home-user').cacheRedis.activationCurrent.get(userId as any);
+  });
+}