zibri 2.4.0 → 2.5.0

package/src/__testing__/test-server/start-test-server.function.ts

@@ -11,26 +11,52 @@ import { defaultTestServerProviders } from './providers';
 import './user-repository'; // this import is needed so that the DI system can pick up the user repository.
 import { ZibriApplication } from '../../application';
 import { ZibriApplicationOptions } from '../../application-options.model';
-import { PostgresDataSource, PostgresOptions } from '../../data-source/data-sources/postgres-data-source.model';
+import { PostgresDataSource, PostgresOptions } from '../../data-source/data-sources/postgres-typeorm-data-source.model';
 import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
 import { DiContainer } from '../../di/di-container';
 import { inject } from '../../di/inject.function';
+import { AppState } from '../../global/app-state.enum';
+import { GlobalRegistry } from '../../global/global-registry';
 import { LoggerInterface } from '../../logging/logger.interface';
 import { Newable } from '../../types/newable.type';
 import { noOp, POSTGRES_TEST_IMAGE, testAssetsFolder } from '../constants';
 import { createTestDataSource } from './create-test-data-source.function';
 import { AssetServiceInterface } from '../../assets/asset-service.interface';
+import { OmitStrict } from '../../types/omit-strict.type';
 
-type StartTestServerOptions = Partial<Pick<ZibriApplicationOptions, 'providers' | 'plugins' | 'controllers'>> & {
+type StartTestServerOptions = Partial<
+    Pick<
+        ZibriApplicationOptions,
+        'providers'
+        | 'plugins'
+        | 'controllers'
+        | 'cronJobs'
+        | 'version'
+        | 'websocketControllers'
+    >
+> & {
     dataSources?: Newable<PostgresDataSource>[]
 };
 
 export class StartedTestServer {
+    private readonly containerPorts: Map<Newable<PostgresDataSource>, number>;
+
     constructor(
-        private readonly app: ZibriApplication,
+        private app: ZibriApplication,
         private readonly containers: AbstractStartedContainer[],
         private readonly exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => undefined as never)
-    ) {}
+    ) {
+        this.containerPorts = new Map(
+            app.options.dataSources.map((ds, i) => [ds as Newable<PostgresDataSource>, containers[i].getMappedPort(5432)])
+        );
+    }
+
+    private reApplyContainerPorts(): void {
+        for (const [ds, port] of this.containerPorts) {
+            const dataSource: PostgresDataSource = inject(ds);
+            (dataSource.options as OmitStrict<PostgresOptions, 'type'>) = { ...dataSource.options, port };
+        }
+    }
 
     async start(): Promise<string> {
         await this.app.start(0);
@@ -49,6 +75,47 @@ export class StartedTestServer {
         this.exitSpy.mockRestore();
         await Promise.all(this.containers.map(c => c.stop()));
     }
+
+    async reInit(
+        {
+            dataSources = this.app.options.dataSources as Newable<PostgresDataSource>[],
+            providers = this.app.options.providers,
+            plugins = defaultTestServerPlugins,
+            controllers = this.app.options.controllers,
+            websocketControllers = this.app.options.websocketControllers,
+            cronJobs = this.app.options.cronJobs,
+            version = this.app.options.version
+        }: StartTestServerOptions = {}
+    ): Promise<void> {
+        const logger: LoggerInterface = inject(ZIBRI_DI_TOKENS.LOGGER);
+        await logger.info('re initializes test server...');
+        const info: typeof logger.info = logger.info;
+        logger.info = noOp;
+        await this.app.shutdown();
+
+        // Reset singleton — every test file gets a clean container with no stale instances.
+        DiContainer['singleton'] = undefined;
+        GlobalRegistry['appData'].state = AppState.OFFLINE;
+
+        this.reApplyContainerPorts();
+
+        this.app = new ZibriApplication({
+            name: 'test',
+            version,
+            baseUrl: 'http://localhost:3000',
+            controllers,
+            websocketControllers,
+            dataSources,
+            providers,
+            plugins,
+            cronJobs
+        });
+
+        await this.app.init(H);
+
+        logger.info = info;
+        await logger.info('test server re initialized');
+    }
 }
 
 export async function startTestServer(
@@ -56,7 +123,10 @@ export async function startTestServer(
         dataSources = [createTestDataSource()],
         providers = defaultTestServerProviders,
         plugins = defaultTestServerPlugins,
-        controllers = []
+        controllers = [],
+        websocketControllers = [],
+        cronJobs = [],
+        version = '1.0.0'
     }: StartTestServerOptions = {}
 ): Promise<StartedTestServer> {
     // Reset singleton — every test file gets a clean container with no stale instances.
@@ -69,8 +139,7 @@ export async function startTestServer(
             .withUsername(dataSource.options.username ?? 'postgres')
             .withPassword(dataSource.options.password?.toString() ?? 'password')
             .start();
-        // eslint-disable-next-line typescript/no-unnecessary-type-assertion
-        (dataSource.options as PostgresOptions) = {
+        (dataSource.options as OmitStrict<PostgresOptions, 'type' | 'entities'>) = {
             ...dataSource.options,
             port: container.getMappedPort(5432)
         };
@@ -78,7 +147,7 @@ export async function startTestServer(
     }));
 
     const logger: LoggerInterface = inject(ZIBRI_DI_TOKENS.LOGGER);
-    await logger.info('starts up test server...');
+    await logger.info('initializes test server...');
     const info: typeof logger.info = logger.info;
     logger.info = noOp;
 
@@ -87,19 +156,20 @@ export async function startTestServer(
 
     const app: ZibriApplication = new ZibriApplication({
         name: 'test',
-        version: '0.0.1',
+        version,
         baseUrl: 'http://localhost:3000',
         controllers,
-        websocketControllers: [],
+        websocketControllers,
         dataSources,
         providers,
-        plugins
+        plugins,
+        cronJobs
     });
 
     await app.init(H);
 
     logger.info = info;
-    await logger.info('test server started');
+    await logger.info('test server initialized');
 
     return new StartedTestServer(app, containers);
 }

package/src/__testing__/test-server/user-repository.ts

@@ -1,6 +1,7 @@
 import { UserRepo } from '../../auth/decorators/user-repo.decorator';
 import { JwtCredentials } from '../../auth/strategies/jwt/jwt-credentials.model';
 import { UserRepositoryInterface } from '../../auth/user/user-repository.interface';
+import { getDefaultBeforeReturnHook, getDefaultBeforeSaveHook } from '../../data-source/hooks/hooks.default';
 import { Repository } from '../../data-source/repository';
 import { InjectRepository } from '../../di/decorators/inject-repository.decorator';
 import { Inject } from '../../di/decorators/inject.decorator';
@@ -18,10 +19,10 @@ export class DefaultTestServerUserRepository extends Repository<JwtUser>
         repo: Repository<JwtUser>,
         @Inject(ZIBRI_DI_TOKENS.LOGGER)
         logger: LoggerInterface,
-        @InjectRepository(JwtUser)
+        @InjectRepository(JwtCredentials)
         private readonly credentialsRepository: Repository<JwtCredentials>
     ) {
-        super(JwtUser, repo, logger, repo.dataSource);
+        super(JwtUser, repo, logger, repo.dataSource, getDefaultBeforeSaveHook(), getDefaultBeforeReturnHook());
     }
 
     async findByEmail(email: string): Promise<JwtUser> {
@@ -29,6 +30,6 @@ export class DefaultTestServerUserRepository extends Repository<JwtUser>
     }
 
     async resolveCredentialsFor(user: JwtUser): Promise<JwtCredentials> {
-        return this.credentialsRepository.findOne({ where: { userId: user.id } });
+        return await this.credentialsRepository.findOne({ where: { userId: user.id } });
     }
 }

package/src/application-options.model.ts

@@ -8,7 +8,7 @@ import { BodyParserInterface } from './parsing/body-parser.interface';
 import { ZibriPlugin } from './plugin/plugin.model';
 import { DeepPartial } from './types/deep-partial.type';
 import { Newable } from './types/newable.type';
-import { Version } from './types/version.type';
+import { SemVerVersion } from './utilities/sem-ver.utilities';
 
 /**
  * Configuration options for strict transport security / hsts.
@@ -61,7 +61,7 @@ export type ZibriApplicationOptions = {
      *
      * Is also used by migrations by default.
      */
-    version: Version,
+    version: SemVerVersion,
     /**
      * The controllers to register in the app.
      */

package/src/application.ts

@@ -240,7 +240,10 @@ export class ZibriApplication {
                 for (const [signal, handler] of this.signalHandlers) {
                     process.off(signal, handler);
                 }
-                process.exit(0);
+                if (signal != undefined) {
+                    process.exit(0);
+                }
+                return;
             }
             case AppState.INITIALIZED:
             case AppState.STARTED: {
@@ -256,7 +259,10 @@ export class ZibriApplication {
                 await this.onAppShutdown(injectables, signal);
                 await this.afterAppShutdown(injectables, signal);
 
-                process.exit(0);
+                if (signal != undefined) {
+                    process.exit(0);
+                }
+                return;
             }
         }
     }
@@ -422,7 +428,6 @@ export class ZibriApplication {
             }
         };
         for (const plugin of this.providedOptions.plugins ?? []) {
-            // TODO: handle order of plugin initialization so that everything is available for DI inside the plugin constructor.
             res.authStrategies = [...plugin.authStrategies, ...res.authStrategies];
             res.bodyParsers = [...plugin.bodyParsers, ...res.bodyParsers];
             res.controllers = [...plugin.controllers, ...res.controllers];

package/src/assets/asset.service.ts

@@ -58,7 +58,9 @@ export class AssetService implements AssetServiceInterface, OnAppInit {
         await inject(ZIBRI_DI_TOKENS.ROUTER).registerRoute({
             httpMethod: HttpMethod.GET,
             route: '/favicon.ico',
-            handler: () => FileResponse.fromPath(FsUtilities.getPath(this.publicAssetsPath, 'favicon.png'))
+            handler: () => FileResponse.fromPath(FsUtilities.getPath(this.publicAssetsPath, 'favicon.png')),
+            versions: 'all',
+            openApi: { useInOpenApi: false }
         });
 
     }

package/src/auth/2fa/methods/otp/otp-credentials.model.ts

@@ -27,7 +27,7 @@ export class OtpCredentials extends BaseEntity {
      * The two factor url that is needed to display a qr code.
      */
     @Property.string({ required: false })
-    qrCodeUrl: string | undefined;
+    qrCodeUrl: string | undefined | null;
 }
 
 /**

package/src/auth/2fa/methods/otp/otp.two-factor-method.ts

@@ -84,7 +84,7 @@ export class OtpTwoFactorMethod implements TwoFactorMethod<never, OtpConfirmRegi
     }
 
     private extractTokenFromRequestContext(context: HttpRequestContext | WebsocketRequestContext): string {
-        const code: string | undefined = context.request.headers[this.otpHeader];
+        const code: string | undefined = context.request.headers?.[this.otpHeader];
         if (!code) {
             throw new UnauthorizedError(`"${this.otpHeader}" header not found`);
         }

package/src/auth/2fa/two-factor.service.test.ts

@@ -0,0 +1,151 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from '@jest/globals';
+import { TOTP } from 'otpauth';
+
+import { OtpCredentials } from './methods/otp/otp-credentials.model';
+import { TwoFactorServiceInterface } from './two-factor-service.interface';
+import { createTestDataSource, defaultTestServerEntities } from '../../__testing__/test-server/create-test-data-source.function';
+import { startTestServer, StartedTestServer } from '../../__testing__/test-server/start-test-server.function';
+import { HttpRequestContext } from '../../context/request/http-request.context';
+import { RequestContextToken } from '../../context/request/request-context-token.model';
+import { PostgresDataSource } from '../../data-source/data-sources/postgres-typeorm-data-source.model';
+import { Repository } from '../../data-source/repository';
+import { repositoryTokenFor } from '../../di/decorators/inject-repository.decorator';
+import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
+import { inject } from '../../di/inject.function';
+import { BaseUserEntity } from '../models/base-user.model';
+import { OtpConfirmRegisterData, OtpTwoFactorMethod } from './methods/otp/otp.two-factor-method';
+import { Entity } from '../../entity/decorators/entity.decorator';
+import { Newable } from '../../types/newable.type';
+
+enum TestRole {
+    USER = 'user'
+}
+
+@Entity()
+class User extends BaseUserEntity(TestRole) {}
+
+let server: StartedTestServer;
+let twoFactorService: TwoFactorServiceInterface;
+let otpMethod: OtpTwoFactorMethod;
+let userRepo: Repository<User>;
+let otpCredentialsRepo: Repository<OtpCredentials>;
+let otpHeader: string; // injected value of ZIBRI_DI_TOKENS.OTP_HEADER
+let otpLength: number;
+
+describe('TwoFactorService (contract via OTP method)', () => {
+    beforeAll(async () => {
+        const dataSourceClass: Newable<PostgresDataSource> = createTestDataSource({
+            entities: [...defaultTestServerEntities, User]
+        });
+        server = await startTestServer({ dataSources: [dataSourceClass] });
+
+        twoFactorService = inject(ZIBRI_DI_TOKENS.TWO_FACTOR_SERVICE);
+        otpMethod = inject(OtpTwoFactorMethod);
+        userRepo = inject(repositoryTokenFor(User));
+        otpCredentialsRepo = inject(repositoryTokenFor(OtpCredentials));
+        otpHeader = inject(ZIBRI_DI_TOKENS.OTP_HEADER);
+        otpLength = inject(ZIBRI_DI_TOKENS.OTP_LENGTH);
+    }, 15000);
+
+    afterAll(async () => {
+        await server.shutdown();
+    });
+
+    let user: User;
+
+    beforeEach(async () => {
+        // start fresh every test
+        await otpCredentialsRepo.deleteAll({});
+        await userRepo.deleteAll({});
+        user = await userRepo.create({ email: '2fa-test@example.com', roles: [TestRole.USER] });
+    });
+
+    it('requestRegister should create an unconfirmed credential', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        expect(credentials).toHaveLength(1);
+        expect(credentials[0].secret).toBeTruthy();
+        expect(credentials[0].confirmed).toBe(false);
+    });
+
+    it('confirmRegister with a valid token should mark the credential as confirmed', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        const secret: string = credentials[0].secret;
+
+        const validToken: string = new TOTP({ secret }).generate();
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: validToken
+        } as OtpConfirmRegisterData);
+
+        const updated: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        expect(updated[0].confirmed).toBe(true);
+    });
+
+    it('confirmRegister with an invalid token should throw', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        await expect(
+            twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+                token: '000000'.slice(0, otpLength)
+            } as OtpConfirmRegisterData)
+        ).rejects.toThrow('The provided two factor code is invalid.');
+    });
+
+    it('has2fa should return true when a valid OTP header is present', async () => {
+        // register & confirm
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        const validToken: string = new TOTP({ secret: credentials[0].secret }).generate();
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: validToken
+        } as OtpConfirmRegisterData);
+
+        const context: HttpRequestContext = {
+            request: { headers: { [otpHeader]: validToken } },
+            // eslint-disable-next-line unusedImports/no-unused-vars
+            has: <T>(token: RequestContextToken<T>) => false
+        } as HttpRequestContext;
+
+        const result: boolean = await twoFactorService.has2fa(user, context);
+        expect(result).toBe(true);
+    });
+
+    it('has2fa should return false when the token is invalid', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        const validToken: string = new TOTP({ secret: credentials[0].secret }).generate();
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: validToken
+        } as OtpConfirmRegisterData);
+
+        const context: HttpRequestContext = {
+            request: { headers: { [otpHeader]: '000000'.slice(0, otpLength) } },
+            // eslint-disable-next-line unusedImports/no-unused-vars
+            has: <T>(token: RequestContextToken<T>) => false
+        } as HttpRequestContext;
+
+        const result: boolean = await twoFactorService.has2fa(user, context);
+        expect(result).toBe(false);
+    });
+
+    it('unregister should delete all credentials and make has2fa false', async () => {
+        await twoFactorService.requestRegisterTwoFactorMethodForUser(user, otpMethod, undefined as never);
+        const credentials: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        await twoFactorService.confirmRegisterTwoFactorMethodForUser(user, otpMethod, {
+            token: new TOTP({ secret: credentials[0].secret }).generate()
+        } as OtpConfirmRegisterData);
+
+        await twoFactorService.unregisterTwoFactorMethodForUser(user, otpMethod);
+
+        const remaining: OtpCredentials[] = await otpCredentialsRepo.findAll({ where: { userId: user.id } });
+        expect(remaining).toHaveLength(0);
+
+        const context: HttpRequestContext = {
+            request: { headers: { [otpHeader]: 'does-not-matter' } },
+            // eslint-disable-next-line unusedImports/no-unused-vars
+            has: <T>(token: RequestContextToken<T>) => false
+        } as HttpRequestContext;
+        const result: boolean = await twoFactorService.has2fa(user, context);
+        expect(result).toBe(false);
+    });
+});