2013-11-13 19:49:08 +00:00
|
|
|
var loopback = require('../');
|
2014-11-14 09:37:22 +00:00
|
|
|
var extend = require('util')._extend;
|
2013-11-13 19:49:08 +00:00
|
|
|
var Token = loopback.AccessToken.extend('MyToken');
|
2013-11-15 04:19:46 +00:00
|
|
|
var ACL = loopback.ACL;
|
2013-11-13 19:49:08 +00:00
|
|
|
|
2013-11-14 23:27:36 +00:00
|
|
|
describe('loopback.token(options)', function() {
|
2013-11-13 19:49:08 +00:00
|
|
|
beforeEach(createTestingToken);
|
2013-11-14 23:27:36 +00:00
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('should populate req.token from the query string', function(done) {
|
2013-11-14 23:27:36 +00:00
|
|
|
createTestAppAndRequest(this.token, done)
|
2013-11-13 19:49:08 +00:00
|
|
|
.get('/?access_token=' + this.token.id)
|
|
|
|
.expect(200)
|
|
|
|
.end(done);
|
|
|
|
});
|
2013-11-14 23:27:36 +00:00
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('should populate req.token from an authorization header', function(done) {
|
2014-07-02 16:02:13 +00:00
|
|
|
createTestAppAndRequest(this.token, done)
|
|
|
|
.get('/')
|
|
|
|
.set('authorization', this.token.id)
|
|
|
|
.expect(200)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('should populate req.token from an X-Access-Token header', function(done) {
|
2014-07-02 16:02:13 +00:00
|
|
|
createTestAppAndRequest(this.token, done)
|
|
|
|
.get('/')
|
|
|
|
.set('X-Access-Token', this.token.id)
|
|
|
|
.expect(200)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('should populate req.token from an authorization header with bearer token', function(done) {
|
2014-07-02 16:02:13 +00:00
|
|
|
var token = this.token.id;
|
2014-11-21 02:35:36 +00:00
|
|
|
token = 'Bearer ' + new Buffer(token).toString('base64');
|
2013-11-14 23:27:36 +00:00
|
|
|
createTestAppAndRequest(this.token, done)
|
|
|
|
.get('/')
|
2015-01-14 21:31:30 +00:00
|
|
|
.set('authorization', token)
|
2013-11-14 23:27:36 +00:00
|
|
|
.expect(200)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
|
2015-01-14 22:10:20 +00:00
|
|
|
describe('populating req.toen from HTTP Basic Auth formatted authorization header', function() {
|
|
|
|
it('parses "standalone-token"', function(done) {
|
|
|
|
var token = this.token.id;
|
|
|
|
token = 'Basic ' + new Buffer(token).toString('base64');
|
|
|
|
createTestAppAndRequest(this.token, done)
|
|
|
|
.get('/')
|
|
|
|
.set('authorization', this.token.id)
|
|
|
|
.expect(200)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
|
|
|
|
it('parses "token-and-empty-password:"', function(done) {
|
|
|
|
var token = this.token.id + ':';
|
|
|
|
token = 'Basic ' + new Buffer(token).toString('base64');
|
|
|
|
createTestAppAndRequest(this.token, done)
|
|
|
|
.get('/')
|
|
|
|
.set('authorization', this.token.id)
|
|
|
|
.expect(200)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
|
|
|
|
it('parses "ignored-user:token-is-password"', function(done) {
|
|
|
|
var token = 'username:' + this.token.id;
|
|
|
|
token = 'Basic ' + new Buffer(token).toString('base64');
|
|
|
|
createTestAppAndRequest(this.token, done)
|
|
|
|
.get('/')
|
|
|
|
.set('authorization', this.token.id)
|
|
|
|
.expect(200)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
|
|
|
|
it('parses "token-is-username:ignored-password"', function(done) {
|
|
|
|
var token = this.token.id + ':password';
|
|
|
|
token = 'Basic ' + new Buffer(token).toString('base64');
|
|
|
|
createTestAppAndRequest(this.token, done)
|
|
|
|
.get('/')
|
|
|
|
.set('authorization', this.token.id)
|
|
|
|
.expect(200)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
});
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('should populate req.token from a secure cookie', function(done) {
|
2013-11-14 23:27:36 +00:00
|
|
|
var app = createTestApp(this.token, done);
|
|
|
|
|
|
|
|
request(app)
|
|
|
|
.get('/token')
|
|
|
|
.end(function(err, res) {
|
|
|
|
request(app)
|
|
|
|
.get('/')
|
|
|
|
.set('Cookie', res.header['set-cookie'])
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
});
|
2014-02-04 15:17:32 +00:00
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('should populate req.token from a header or a secure cookie', function(done) {
|
2014-07-02 16:02:13 +00:00
|
|
|
var app = createTestApp(this.token, done);
|
|
|
|
var id = this.token.id;
|
|
|
|
request(app)
|
|
|
|
.get('/token')
|
|
|
|
.end(function(err, res) {
|
|
|
|
request(app)
|
|
|
|
.get('/')
|
|
|
|
.set('authorization', id)
|
|
|
|
.set('Cookie', res.header['set-cookie'])
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
});
|
|
|
|
|
2014-02-04 15:17:32 +00:00
|
|
|
it('should skip when req.token is already present', function(done) {
|
|
|
|
var tokenStub = { id: 'stub id' };
|
|
|
|
app.use(function(req, res, next) {
|
|
|
|
req.accessToken = tokenStub;
|
|
|
|
next();
|
|
|
|
});
|
|
|
|
app.use(loopback.token({ model: Token }));
|
|
|
|
app.get('/', function(req, res, next) {
|
|
|
|
res.send(req.accessToken);
|
|
|
|
});
|
|
|
|
|
|
|
|
request(app).get('/')
|
|
|
|
.set('Authorization', this.token.id)
|
|
|
|
.expect(200)
|
|
|
|
.end(function(err, res) {
|
|
|
|
if (err) return done(err);
|
|
|
|
expect(res.body).to.eql(tokenStub);
|
|
|
|
done();
|
|
|
|
});
|
|
|
|
});
|
2013-11-13 19:49:08 +00:00
|
|
|
});
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
describe('AccessToken', function() {
|
2013-11-15 02:34:51 +00:00
|
|
|
beforeEach(createTestingToken);
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('should auto-generate id', function() {
|
2013-11-15 02:34:51 +00:00
|
|
|
assert(this.token.id);
|
|
|
|
assert.equal(this.token.id.length, 64);
|
|
|
|
});
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('should auto-generate created date', function() {
|
2013-11-15 02:34:51 +00:00
|
|
|
assert(this.token.created);
|
|
|
|
assert(Object.prototype.toString.call(this.token.created), '[object Date]');
|
|
|
|
});
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('should be validateable', function(done) {
|
2013-11-15 02:34:51 +00:00
|
|
|
this.token.validate(function(err, isValid) {
|
|
|
|
assert(isValid);
|
|
|
|
done();
|
|
|
|
});
|
|
|
|
});
|
2014-11-14 09:37:22 +00:00
|
|
|
|
|
|
|
describe('.findForRequest()', function() {
|
|
|
|
beforeEach(createTestingToken);
|
|
|
|
|
|
|
|
it('supports two-arg variant with no options', function(done) {
|
|
|
|
var expectedTokenId = this.token.id;
|
|
|
|
var req = mockRequest({
|
|
|
|
headers: { 'authorization': expectedTokenId }
|
|
|
|
});
|
|
|
|
|
|
|
|
Token.findForRequest(req, function(err, token) {
|
|
|
|
if (err) return done(err);
|
|
|
|
expect(token.id).to.eql(expectedTokenId);
|
|
|
|
done();
|
|
|
|
});
|
|
|
|
});
|
|
|
|
|
|
|
|
function mockRequest(opts) {
|
|
|
|
return extend(
|
|
|
|
{
|
|
|
|
method: 'GET',
|
|
|
|
url: '/a-test-path',
|
|
|
|
headers: {},
|
|
|
|
_params: {},
|
|
|
|
|
|
|
|
// express helpers
|
|
|
|
param: function(name) { return this._params[name]; },
|
|
|
|
header: function(name) { return this.headers[name]; }
|
|
|
|
},
|
|
|
|
opts);
|
|
|
|
}
|
|
|
|
});
|
2013-11-15 02:34:51 +00:00
|
|
|
});
|
|
|
|
|
2013-11-15 04:19:46 +00:00
|
|
|
describe('app.enableAuth()', function() {
|
|
|
|
beforeEach(createTestingToken);
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('prevents remote call with 401 status on denied ACL', function(done) {
|
2013-11-15 04:19:46 +00:00
|
|
|
createTestAppAndRequest(this.token, done)
|
|
|
|
.del('/tests/123')
|
|
|
|
.expect(401)
|
|
|
|
.set('authorization', this.token.id)
|
|
|
|
.end(done);
|
|
|
|
});
|
2014-06-06 01:53:30 +00:00
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('prevent remote call with app setting status on denied ACL', function(done) {
|
2014-06-06 01:53:30 +00:00
|
|
|
createTestAppAndRequest(this.token, {app:{aclErrorStatus:403}}, done)
|
|
|
|
.del('/tests/123')
|
|
|
|
.expect(403)
|
|
|
|
.set('authorization', this.token.id)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('prevent remote call with app setting status on denied ACL', function(done) {
|
2014-06-06 01:53:30 +00:00
|
|
|
createTestAppAndRequest(this.token, {model:{aclErrorStatus:404}}, done)
|
|
|
|
.del('/tests/123')
|
|
|
|
.expect(404)
|
|
|
|
.set('authorization', this.token.id)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
it('prevent remote call if the accessToken is missing and required', function(done) {
|
2014-06-06 01:53:30 +00:00
|
|
|
createTestAppAndRequest(null, done)
|
|
|
|
.del('/tests/123')
|
|
|
|
.expect(401)
|
|
|
|
.set('authorization', null)
|
|
|
|
.end(done);
|
|
|
|
});
|
|
|
|
|
2014-11-10 17:37:35 +00:00
|
|
|
it('stores token in the context', function(done) {
|
|
|
|
var TestModel = loopback.createModel('TestModel', { base: 'Model' });
|
|
|
|
TestModel.getToken = function(cb) {
|
|
|
|
cb(null, loopback.getCurrentContext().get('accessToken') || null);
|
|
|
|
};
|
|
|
|
TestModel.remoteMethod('getToken', {
|
|
|
|
returns: { arg: 'token', type: 'object' },
|
|
|
|
http: { verb: 'GET', path: '/token' }
|
|
|
|
});
|
|
|
|
|
|
|
|
var app = loopback();
|
|
|
|
app.model(TestModel, { dataSource: null });
|
|
|
|
|
|
|
|
app.enableAuth();
|
|
|
|
app.use(loopback.context());
|
|
|
|
app.use(loopback.token({ model: Token }));
|
|
|
|
app.use(loopback.rest());
|
|
|
|
|
|
|
|
var token = this.token;
|
|
|
|
request(app)
|
|
|
|
.get('/TestModels/token?_format=json')
|
|
|
|
.set('authorization', token.id)
|
|
|
|
.expect(200)
|
|
|
|
.expect('Content-Type', /json/)
|
|
|
|
.end(function(err, res) {
|
|
|
|
if (err) return done(err);
|
|
|
|
expect(res.body.token.id).to.eql(token.id);
|
|
|
|
done();
|
|
|
|
});
|
|
|
|
});
|
2013-11-15 04:19:46 +00:00
|
|
|
});
|
|
|
|
|
2013-11-13 19:49:08 +00:00
|
|
|
function createTestingToken(done) {
|
|
|
|
var test = this;
|
2014-11-21 02:35:36 +00:00
|
|
|
Token.create({}, function(err, token) {
|
|
|
|
if (err) return done(err);
|
2013-11-13 19:49:08 +00:00
|
|
|
test.token = token;
|
|
|
|
done();
|
|
|
|
});
|
2013-11-14 21:01:47 +00:00
|
|
|
}
|
2013-11-14 23:27:36 +00:00
|
|
|
|
2014-06-06 01:53:30 +00:00
|
|
|
function createTestAppAndRequest(testToken, settings, done) {
|
|
|
|
var app = createTestApp(testToken, settings, done);
|
2013-11-14 23:27:36 +00:00
|
|
|
return request(app);
|
|
|
|
}
|
|
|
|
|
2014-06-06 01:53:30 +00:00
|
|
|
function createTestApp(testToken, settings, done) {
|
2014-11-21 02:35:36 +00:00
|
|
|
done = arguments[arguments.length - 1];
|
|
|
|
if (settings == done) settings = {};
|
2014-06-06 01:53:30 +00:00
|
|
|
settings = settings || {};
|
|
|
|
|
|
|
|
var appSettings = settings.app || {};
|
|
|
|
var modelSettings = settings.model || {};
|
|
|
|
|
2013-11-14 23:27:36 +00:00
|
|
|
var app = loopback();
|
|
|
|
|
|
|
|
app.use(loopback.cookieParser('secret'));
|
|
|
|
app.use(loopback.token({model: Token}));
|
|
|
|
app.get('/token', function(req, res) {
|
|
|
|
res.cookie('authorization', testToken.id, {signed: true});
|
|
|
|
res.end();
|
|
|
|
});
|
2014-11-21 02:35:36 +00:00
|
|
|
app.get('/', function(req, res) {
|
2013-11-14 23:27:36 +00:00
|
|
|
try {
|
|
|
|
assert(req.accessToken, 'req should have accessToken');
|
|
|
|
assert(req.accessToken.id === testToken.id);
|
2014-11-21 02:35:36 +00:00
|
|
|
} catch (e) {
|
2013-11-14 23:27:36 +00:00
|
|
|
return done(e);
|
|
|
|
}
|
|
|
|
res.send('ok');
|
|
|
|
});
|
2013-11-15 04:19:46 +00:00
|
|
|
app.use(loopback.rest());
|
|
|
|
app.enableAuth();
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
Object.keys(appSettings).forEach(function(key) {
|
2014-06-06 01:53:30 +00:00
|
|
|
app.set(key, appSettings[key]);
|
|
|
|
});
|
|
|
|
|
|
|
|
var modelOptions = {
|
2013-11-15 04:19:46 +00:00
|
|
|
acls: [
|
|
|
|
{
|
2014-11-21 01:46:21 +00:00
|
|
|
principalType: 'ROLE',
|
|
|
|
principalId: '$everyone',
|
2013-11-15 04:19:46 +00:00
|
|
|
accessType: ACL.ALL,
|
|
|
|
permission: ACL.DENY,
|
2014-07-16 16:09:07 +00:00
|
|
|
property: 'deleteById'
|
2013-11-15 04:19:46 +00:00
|
|
|
}
|
|
|
|
]
|
2014-06-06 01:53:30 +00:00
|
|
|
};
|
|
|
|
|
2014-11-21 02:35:36 +00:00
|
|
|
Object.keys(modelSettings).forEach(function(key) {
|
2014-06-06 01:53:30 +00:00
|
|
|
modelOptions[key] = modelSettings[key];
|
2013-11-15 04:19:46 +00:00
|
|
|
});
|
|
|
|
|
2014-06-16 08:20:22 +00:00
|
|
|
var TestModel = loopback.PersistedModel.extend('test', {}, modelOptions);
|
2014-06-06 01:53:30 +00:00
|
|
|
|
2013-11-15 04:19:46 +00:00
|
|
|
TestModel.attachTo(loopback.memory());
|
|
|
|
app.model(TestModel);
|
2013-11-14 23:27:36 +00:00
|
|
|
|
|
|
|
return app;
|
|
|
|
}
|