verdnatura-mirror
/
loopback
mirror of https://github.com/strongloop/loopback.git
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
loopback/test/user.test.js

3156 lines
101 KiB
JavaScript
Raw Blame History

// Copyright IBM Corp. 2013,2018. All Rights Reserved.
// Node module: loopback
// This file is licensed under the MIT License.
// License text available at https://opensource.org/licenses/MIT
'use strict';
var assert = require('assert');
var expect = require('./helpers/expect');
var request = require('supertest');
var loopback = require('../');
var async = require('async');
var url = require('url');
var extend = require('util')._extend;
const Promise = require('bluebird');
const waitForEvent = require('./helpers/wait-for-event');
var User, AccessToken;
describe('User', function() {
this.timeout(10000);
var validCredentialsEmail = 'foo@bar.com';
var validCredentials = {email: validCredentialsEmail, password: 'bar'};
var validCredentialsEmailVerified = {
email: 'foo1@bar.com', password: 'bar1', emailVerified: true};
var validCredentialsEmailVerifiedOverREST = {
email: 'foo2@bar.com', password: 'bar2', emailVerified: true};
var validCredentialsWithRealm = {
email: 'foo3@bar.com', password: 'bar', realm: 'foobar'};
var validCredentialsWithTTL = {email: 'foo@bar.com', password: 'bar', ttl: 3600};
var validCredentialsWithTTLAndScope = {
email: 'foo@bar.com', password: 'bar', ttl: 3600, scope: 'all'};
var validMixedCaseEmailCredentials = {email: 'Foo@bar.com', password: 'bar'};
var invalidCredentials = {email: 'foo1@bar.com', password: 'invalid'};
var incompleteCredentials = {password: 'bar1'};
var validCredentialsUser, validCredentialsEmailVerifiedUser, user;
// Create a local app variable to prevent clashes with the global
// variable shared by all tests. While this should not be necessary if
// the tests were written correctly, it turns out that's not the case :(
var app = null;
beforeEach(function setupAppAndModels() {
// override the global app object provided by test/support.js
// and create a local one that does not share state with other tests
app = loopback({localRegistry: true, loadBuiltinModels: true});
app.set('remoting', {errorHandler: {debug: true, log: false}});
app.dataSource('db', {connector: 'memory'});
// setup Email model, it's needed by User tests
app.dataSource('email', {
connector: loopback.Mail,
transports: [{type: 'STUB'}],
});
var Email = app.registry.getModel('Email');
app.model(Email, {dataSource: 'email'});
// attach User and related models
User = app.registry.createModel({
name: 'TestUser',
base: 'User',
properties: {
// Use a custom id property to verify that User methods
// are correctly looking up the primary key
pk: {type: 'String', defaultFn: 'guid', id: true},
},
http: {path: 'test-users'},
// forceId is set to false for the purpose of updating the same affected user within the
// `Email Update` test cases.
forceId: false,
// Speed up the password hashing algorithm for tests
saltWorkFactor: 4,
});
app.model(User, {dataSource: 'db'});
AccessToken = app.registry.getModel('AccessToken');
app.model(AccessToken, {dataSource: 'db'});
User.email = Email;
// Update the AccessToken relation to use the subclass of User
AccessToken.belongsTo(User, {as: 'user', foreignKey: 'userId'});
User.hasMany(AccessToken, {as: 'accessTokens', foreignKey: 'userId'});
// Speed up the password hashing algorithm
// for tests using the built-in User model
User.settings.saltWorkFactor = 4;
// allow many User.afterRemote's to be called
User.setMaxListeners(0);
app.enableAuth({dataSource: 'db'});
app.use(loopback.token({model: AccessToken}));
app.use(loopback.rest());
// create 2 users: with and without verified email
return Promise.map(
[validCredentials, validCredentialsEmailVerified],
credentials => User.create(credentials)
).then(users => {
validCredentialsUser = user = users[0];
validCredentialsEmailVerifiedUser = users[1];
});
});
describe('User.create', function() {
it('Create a new user', function(done) {
User.create({email: 'f@b.com', password: 'bar'}, function(err, user) {
assert(!err);
assert(user.pk);
assert(user.email);
done();
});
});
it('Create a new user (email case-sensitivity off)', function(done) {
User.settings.caseSensitiveEmail = false;
User.create({email: 'F@b.com', password: 'bar'}, function(err, user) {
if (err) return done(err);
assert(user.pk);
assert.equal(user.email, user.email.toLowerCase());
done();
});
});
it('Create a new user (email case-sensitive)', function(done) {
User.create({email: 'F@b.com', password: 'bar'}, function(err, user) {
if (err) return done(err);
assert(user.pk);
assert(user.email);
assert.notEqual(user.email, user.email.toLowerCase());
done();
});
});
it('fails when the required email is missing (case-sensitivity on)', () => {
User.create({password: '123'})
.then(
success => { throw new Error('create should have failed'); },
err => {
expect(err.name).to.equal('ValidationError');
expect(err.statusCode).to.equal(422);
expect(err.details.context).to.equal(User.modelName);
expect(err.details.codes.email).to.deep.equal(['presence']);
}
);
});
it('fails when the required email is missing (case-sensitivity off)', () => {
User.settings.caseSensitiveEmail = false;
User.create({email: undefined, password: '123'})
.then(
success => { throw new Error('create should have failed'); },
err => {
expect(err.name).to.equal('ValidationError');
expect(err.statusCode).to.equal(422);
expect(err.details.context).to.equal(User.modelName);
expect(err.details.codes.email).to.deep.equal(['presence']);
}
);
});
// will change in future versions where password will be optional by default
it('Password is required', function(done) {
var u = new User({email: '123@456.com'});
User.create({email: 'c@d.com'}, function(err) {
assert(err);
done();
});
});
it('Requires a valid email', function(done) {
User.create({email: 'foo@', password: '123'}, function(err) {
assert(err);
assert.equal(err.name, 'ValidationError');
assert.equal(err.statusCode, 422);
assert.equal(err.details.context, User.modelName);
assert.deepEqual(err.details.codes.email, ['custom.email']);
done();
});
});
it('allows TLD domains in email', function() {
return User.create({
email: 'local@com',
password: '123',
});
});
it('Requires a unique email', function(done) {
User.create({email: 'a@b.com', password: 'foobar'}, function() {
User.create({email: 'a@b.com', password: 'batbaz'}, function(err) {
assert(err, 'should error because the email is not unique!');
done();
});
});
});
it('Requires a unique email (email case-sensitivity off)', function(done) {
User.settings.caseSensitiveEmail = false;
User.create({email: 'A@b.com', password: 'foobar'}, function(err) {
if (err) return done(err);
User.create({email: 'a@b.com', password: 'batbaz'}, function(err) {
assert(err, 'should error because the email is not unique!');
done();
});
});
});
it('Requires a unique email (email case-sensitive)', function(done) {
User.create({email: 'A@b.com', password: 'foobar'}, function(err, user1) {
User.create({email: 'a@b.com', password: 'batbaz'}, function(err, user2) {
if (err) return done(err);
assert.notEqual(user1.email, user2.email);
done();
});
});
});
it('Requires a unique username', function(done) {
User.create({email: 'a@b.com', username: 'abc', password: 'foobar'}, function() {
User.create({email: 'b@b.com', username: 'abc', password: 'batbaz'}, function(err) {
assert(err, 'should error because the username is not unique!');
done();
});
});
});
it('Requires a password to login with basic auth', function(done) {
User.create({email: 'b@c.com'}, function(err) {
User.login({email: 'b@c.com'}, function(err, accessToken) {
assert(!accessToken, 'should not create a accessToken without a valid password');
assert(err, 'should not login without a password');
assert.equal(err.code, 'LOGIN_FAILED');
done();
});
});
});
it('Hashes the given password', function() {
var u = new User({username: 'foo', password: 'bar'});
assert(u.password !== 'bar');
});
it('does not hash the password if it\'s already hashed', function() {
var u1 = new User({username: 'foo', password: 'bar'});
assert(u1.password !== 'bar');
var u2 = new User({username: 'foo', password: u1.password});
assert(u2.password === u1.password);
});
it('invalidates the user\'s accessToken when the user is deleted By id', function(done) {
var usersId;
async.series([
function(next) {
User.create({email: 'b@c.com', password: 'bar'}, function(err, user) {
usersId = user.pk;
next(err);
});
},
function(next) {
User.login({email: 'b@c.com', password: 'bar'}, function(err, accessToken) {
if (err) return next(err);
assert(accessToken.userId);
next();
});
},
function(next) {
User.deleteById(usersId, function(err) {
next(err);
});
},
function(next) {
User.findById(usersId, function(err, userFound) {
if (err) return next(err);
expect(userFound).to.equal(null);
AccessToken.find({where: {userId: usersId}}, function(err, tokens) {
if (err) return next(err);
expect(tokens.length).to.equal(0);
next();
});
});
},
], function(err) {
if (err) return done(err);
done();
});
});
it('skips token invalidation when the relation is not configured', () => {
const app = loopback({localRegistry: true, loadBuiltinModels: true});
app.dataSource('db', {connector: 'memory'});
const PrivateUser = app.registry.createModel({
name: 'PrivateUser',
base: 'User',
// Speed up the password hashing algorithm for tests
saltWorkFactor: 4,
});
app.model(PrivateUser, {dataSource: 'db'});
return PrivateUser.create({email: 'private@example.com', password: 'pass'})
.then(u => PrivateUser.deleteById(u.id));
// the test passed when the operation did not crash
});
it('invalidates the user\'s accessToken when the user is deleted all', function(done) {
var userIds = [];
var users;
async.series([
function(next) {
User.create([
{name: 'myname', email: 'b@c.com', password: 'bar'},
{name: 'myname', email: 'd@c.com', password: 'bar'},
], function(err, createdUsers) {
users = createdUsers;
userIds = createdUsers.map(function(u) {
return u.pk;
});
next(err);
});
},
function(next) {
User.login({email: 'b@c.com', password: 'bar'}, function(err, accessToken) {
if (err) return next(err);
assertGoodToken(accessToken, users[0]);
next();
});
},
function(next) {
User.login({email: 'd@c.com', password: 'bar'}, function(err, accessToken) {
if (err) return next(err);
assertGoodToken(accessToken, users[1]);
next();
});
},
function(next) {
User.deleteAll({name: 'myname'}, function(err, user) {
next(err);
});
},
function(next) {
User.find({where: {name: 'myname'}}, function(err, userFound) {
if (err) return next(err);
expect(userFound.length).to.equal(0);
AccessToken.find({where: {userId: {inq: userIds}}}, function(err, tokens) {
if (err) return next(err);
expect(tokens.length).to.equal(0);
next();
});
});
},
], function(err) {
if (err) return done(err);
done();
});
});
describe('custom password hash', function() {
var defaultHashPassword, defaultValidatePassword;
beforeEach(function() {
defaultHashPassword = User.hashPassword;
defaultValidatePassword = User.validatePassword;
User.hashPassword = function(plain) {
return plain.toUpperCase();
};
User.validatePassword = function(plain) {
if (!plain || plain.length < 3) {
throw new Error('Password must have at least 3 chars');
}
return true;
};
});
afterEach(function() {
User.hashPassword = defaultHashPassword;
User.validatePassword = defaultValidatePassword;
});
it('Reports invalid password', function() {
try {
var u = new User({username: 'foo', password: 'aa'});
assert(false, 'Error should have been thrown');
} catch (e) {
// Ignore
}
});
it('Hashes the given password', function() {
var u = new User({username: 'foo', password: 'bar'});
assert(u.password === 'BAR');
});
});
it('Create a user over REST should remove emailVerified property', function(done) {
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send(validCredentialsEmailVerifiedOverREST)
.end(function(err, res) {
if (err) return done(err);
assert(!res.body.emailVerified);
done();
});
});
});
describe('Password length validation', function() {
var pass72Char = new Array(70).join('a') + '012';
var pass73Char = pass72Char + '3';
var passTooLong = pass72Char + 'WXYZ1234';
it('rejects empty passwords creation', function(done) {
User.create({email: 'b@c.com', password: ''}, function(err) {
expect(err.code).to.equal('INVALID_PASSWORD');
expect(err.statusCode).to.equal(422);
done();
});
});
it('rejects updating with empty password', function(done) {
User.create({email: 'blank@c.com', password: pass72Char}, function(err, userCreated) {
if (err) return done(err);
userCreated.updateAttribute('password', '', function(err, userUpdated) {
expect(err.code).to.equal('INVALID_PASSWORD');
expect(err.statusCode).to.equal(422);
done();
});
});
});
it('rejects updating with empty password using replaceAttributes', function(done) {
User.create({email: 'b@example.com', password: pass72Char}, function(err, userCreated) {
if (err) return done(err);
userCreated.replaceAttributes({'password': ''}, function(err, userUpdated) {
expect(err.code).to.equal('INVALID_PASSWORD');
expect(err.statusCode).to.equal(422);
done();
});
});
});
it('rejects updating with empty password using updateOrCreate', function(done) {
User.create({email: 'b@example.com', password: pass72Char}, function(err, userCreated) {
if (err) return done(err);
User.updateOrCreate({id: userCreated.id, 'password': ''}, function(err, userUpdated) {
expect(err.code).to.equal('INVALID_PASSWORD');
expect(err.statusCode).to.equal(422);
done();
});
});
});
it('rejects updating with empty password using updateAll', function(done) {
User.create({email: 'b@example.com', password: pass72Char}, function(err, userCreated) {
if (err) return done(err);
User.updateAll({where: {id: userCreated.id}}, {'password': ''}, function(err, userUpdated) {
expect(err.code).to.equal('INVALID_PASSWORD');
expect(err.statusCode).to.equal(422);
done();
});
});
});
it('rejects passwords longer than 72 characters', function(done) {
User.create({email: 'b@c.com', password: pass73Char}, function(err) {
expect(err.code).to.equal('PASSWORD_TOO_LONG');
expect(err.statusCode).to.equal(422);
done();
});
});
it('rejects a new user with password longer than 72 characters', function(done) {
try {
var u = new User({username: 'foo', password: pass73Char});
assert(false, 'Error should have been thrown');
} catch (e) {
expect(e).to.match(/password entered was too long/);
done();
}
});
it('accepts passwords that are exactly 72 characters long', function(done) {
User.create({email: 'b@c.com', password: pass72Char}, function(err, user) {
if (err) return done(err);
User.findById(user.pk, function(err, userFound) {
if (err) return done(err);
assert(userFound);
done();
});
});
});
it('allows login with password exactly 72 characters long', function(done) {
User.create({email: 'b@c.com', password: pass72Char}, function(err, user) {
if (err) return done(err);
User.login({email: 'b@c.com', password: pass72Char}, function(err, accessToken) {
if (err) return done(err);
assertGoodToken(accessToken, user);
done();
});
});
});
it('rejects password reset when password is more than 72 chars', function(done) {
User.create({email: 'b@c.com', password: pass72Char}, function(err) {
if (err) return done(err);
User.resetPassword({email: 'b@c.com', password: pass73Char}, function(err) {
assert(err);
expect(err).to.match(/password entered was too long/);
done();
});
});
});
it('rejects changePassword when new password is longer than 72 chars', function() {
return User.create({email: 'test@example.com', password: pass72Char})
.then(u => u.changePassword(pass72Char, pass73Char))
.then(
success => { throw new Error('changePassword should have failed'); },
err => {
expect(err.message).to.match(/password entered was too long/);
// workaround for chai problem
// object tested must be an array, an object, or a string,
// but error given
const props = Object.assign({}, err);
expect(props).to.contain({
code: 'PASSWORD_TOO_LONG',
statusCode: 422,
});
}
);
});
it('rejects setPassword when new password is longer than 72 chars', function() {
return User.create({email: 'test@example.com', password: pass72Char})
.then(u => u.setPassword(pass73Char))
.then(
success => { throw new Error('setPassword should have failed'); },
err => {
expect(err.message).to.match(/password entered was too long/);
// workaround for chai problem
// object tested must be an array, an object, or a string,
// but error given
const props = Object.assign({}, err);
expect(props).to.contain({
code: 'PASSWORD_TOO_LONG',
statusCode: 422,
});
}
);
});
});
describe('Access-hook for queries with email NOT case-sensitive', function() {
it('Should not throw an error if the query does not contain {where: }', function(done) {
User.find({}, function(err) {
if (err) done(err);
done();
});
});
it('Should be able to find lowercase email with mixed-case email query', function(done) {
User.settings.caseSensitiveEmail = false;
User.find({where: {email: validMixedCaseEmailCredentials.email}}, function(err, result) {
if (err) done(err);
assert(result[0], 'The query did not find the user');
assert.equal(result[0].email, validCredentialsEmail);
done();
});
});
it('Should be able to use query filters (email case-sensitivity off)', function(done) {
User.settings.caseSensitiveEmail = false;
var insensitiveUser = {email: 'insensitive@example.com', password: 'abc'};
User.create(insensitiveUser, function(err, user) {
User.find({where: {email:
{inq: [insensitiveUser.email]},
}}, function(err, result) {
if (err) done(err);
assert(result[0], 'The query did not find the user');
assert.equal(result[0].email, insensitiveUser.email);
done();
});
});
});
it('Should be able to use query filters (email case-sensitivity on)', function(done) {
User.settings.caseSensitiveEmail = true;
var sensitiveUser = {email: 'senSiTive@example.com', password: 'abc'};
User.create(sensitiveUser, function(err, user) {
User.find({where: {email:
{inq: [sensitiveUser.email]},
}}, function(err, result) {
if (err) done(err);
assert(result[0], 'The query did not find the user');
assert.equal(result[0].email, sensitiveUser.email);
done();
});
});
});
});
describe('User.login', function() {
it('Login a user by providing credentials', function(done) {
User.login(validCredentials, function(err, accessToken) {
assertGoodToken(accessToken, validCredentialsUser);
done();
});
});
it('Login a user by providing email credentials (email case-sensitivity off)', function(done) {
User.settings.caseSensitiveEmail = false;
User.login(validMixedCaseEmailCredentials, function(err, accessToken) {
assertGoodToken(accessToken, validCredentialsUser);
done();
});
});
it('Try to login with invalid email case', function(done) {
User.login(validMixedCaseEmailCredentials, function(err, accessToken) {
assert(err);
done();
});
});
it('Login a user by providing credentials with TTL', function(done) {
User.login(validCredentialsWithTTL, function(err, accessToken) {
assertGoodToken(accessToken, validCredentialsUser);
assert.equal(accessToken.ttl, validCredentialsWithTTL.ttl);
done();
});
});
it('honors default `createAccessToken` implementation', function(done) {
User.login(validCredentialsWithTTL, function(err, accessToken) {
assert(accessToken.userId);
assert(accessToken.id);
User.findById(accessToken.userId, function(err, user) {
user.createAccessToken(120, function(err, accessToken) {
assertGoodToken(accessToken, validCredentialsUser);
assert.equal(accessToken.ttl, 120);
done();
});
});
});
});
it('honors default `createAccessToken` implementation - promise variant', function(done) {
User.login(validCredentialsWithTTL, function(err, accessToken) {
assert(accessToken.userId);
assert(accessToken.id);
User.findById(accessToken.userId, function(err, user) {
user.createAccessToken(120)
.then(function(accessToken) {
assertGoodToken(accessToken, validCredentialsUser);
assert.equal(accessToken.ttl, 120);
done();
})
.catch(function(err) {
done(err);
});
});
});
});
it('Login a user using a custom createAccessToken', function(done) {
var createToken = User.prototype.createAccessToken; // Save the original method
// Override createAccessToken
User.prototype.createAccessToken = function(ttl, cb) {
// Reduce the ttl by half for testing purpose
this.accessTokens.create({ttl: ttl / 2}, cb);
};
User.login(validCredentialsWithTTL, function(err, accessToken) {
assertGoodToken(accessToken, validCredentialsUser);
assert.equal(accessToken.ttl, 1800);
User.findById(accessToken.userId, function(err, user) {
user.createAccessToken(120, function(err, accessToken) {
assertGoodToken(accessToken, validCredentialsUser);
assert.equal(accessToken.ttl, 60);
// Restore create access token
User.prototype.createAccessToken = createToken;
done();
});
});
});
});
it('Login a user using a custom createAccessToken with options',
function(done) {
var createToken = User.prototype.createAccessToken; // Save the original method
// Override createAccessToken
User.prototype.createAccessToken = function(ttl, options, cb) {
// Reduce the ttl by half for testing purpose
this.accessTokens.create({ttl: ttl / 2, scopes: [options.scope]}, cb);
};
User.login(validCredentialsWithTTLAndScope, function(err, accessToken) {
assertGoodToken(accessToken, validCredentialsUser);
assert.equal(accessToken.ttl, 1800);
assert.deepEqual(accessToken.scopes, ['all']);
User.findById(accessToken.userId, function(err, user) {
user.createAccessToken(120, {scope: 'default'}, function(err, accessToken) {
assertGoodToken(accessToken, validCredentialsUser);
assert.equal(accessToken.ttl, 60);
assert.deepEqual(accessToken.scopes, ['default']);
// Restore create access token
User.prototype.createAccessToken = createToken;
done();
});
});
});
});
it('Login should only allow correct credentials', function(done) {
User.login(invalidCredentials, function(err, accessToken) {
assert(err);
assert.equal(err.code, 'LOGIN_FAILED');
assert(!accessToken);
done();
});
});
it('Login should only allow correct credentials - promise variant', function(done) {
User.login(invalidCredentials)
.then(function(accessToken) {
expect(accessToken, 'accessToken').to.not.exist();
done();
})
.catch(function(err) {
expect(err, 'err').to.exist();
expect(err).to.have.property('code', 'LOGIN_FAILED');
done();
});
});
it('Login a user providing incomplete credentials', function(done) {
User.login(incompleteCredentials, function(err, accessToken) {
expect(err, 'err').to.exist();
expect(err).to.have.property('code', 'USERNAME_EMAIL_REQUIRED');
done();
});
});
it('Login a user providing incomplete credentials - promise variant', function(done) {
User.login(incompleteCredentials)
.then(function(accessToken) {
expect(accessToken, 'accessToken').to.not.exist();
done();
})
.catch(function(err) {
expect(err, 'err').to.exist();
expect(err).to.have.property('code', 'USERNAME_EMAIL_REQUIRED');
done();
});
});
it('Login a user over REST by providing credentials', function(done) {
request(app)
.post('/test-users/login')
.expect('Content-Type', /json/)
.expect(200)
.send(validCredentials)
.end(function(err, res) {
if (err) return done(err);
var accessToken = res.body;
assertGoodToken(accessToken, validCredentialsUser);
assert(accessToken.user === undefined);
done();
});
});
it('Login a user over REST by providing invalid credentials', function(done) {
request(app)
.post('/test-users/login')
.expect('Content-Type', /json/)
.expect(401)
.send(invalidCredentials)
.end(function(err, res) {
if (err) return done(err);
var errorResponse = res.body.error;
assert.equal(errorResponse.code, 'LOGIN_FAILED');
done();
});
});
it('Login a user over REST by providing incomplete credentials', function(done) {
request(app)
.post('/test-users/login')
.expect('Content-Type', /json/)
.expect(400)
.send(incompleteCredentials)
.end(function(err, res) {
if (err) return done(err);
var errorResponse = res.body.error;
assert.equal(errorResponse.code, 'USERNAME_EMAIL_REQUIRED');
done();
});
});
it('Login a user over REST with the wrong Content-Type', function(done) {
request(app)
.post('/test-users/login')
.set('Content-Type', null)
.expect('Content-Type', /json/)
.expect(400)
.send(JSON.stringify(validCredentials))
.end(function(err, res) {
if (err) return done(err);
var errorResponse = res.body.error;
assert.equal(errorResponse.code, 'USERNAME_EMAIL_REQUIRED');
done();
});
});
it('Returns current user when `include` is `USER`', function(done) {
request(app)
.post('/test-users/login?include=USER')
.send(validCredentials)
.expect(200)
.expect('Content-Type', /json/)
.end(function(err, res) {
if (err) return done(err);
var token = res.body;
expect(token.user, 'body.user').to.not.equal(undefined);
expect(token.user, 'body.user')
.to.have.property('email', validCredentials.email);
done();
});
});
it('should handle multiple `include`', function(done) {
request(app)
.post('/test-users/login?include=USER&include=Post')
.send(validCredentials)
.expect(200)
.expect('Content-Type', /json/)
.end(function(err, res) {
if (err) return done(err);
var token = res.body;
expect(token.user, 'body.user').to.not.equal(undefined);
expect(token.user, 'body.user')
.to.have.property('email', validCredentials.email);
done();
});
});
it('allows login with password too long but created in old LB version',
function(done) {
var bcrypt = require('bcryptjs');
var longPassword = new Array(80).join('a');
var oldHash = bcrypt.hashSync(longPassword, bcrypt.genSaltSync(1));
User.create({email: 'b@c.com', password: oldHash}, function(err) {
if (err) return done(err);
User.login({email: 'b@c.com', password: longPassword}, function(err, accessToken) {
if (err) return done(err);
assert(accessToken.id);
// we are logged in, the test passed
done();
});
});
});
});
function assertGoodToken(accessToken, user) {
if (accessToken instanceof AccessToken) {
accessToken = accessToken.toJSON();
}
expect(accessToken).to.have.property('userId', user.pk);
assert(accessToken.id);
assert.equal(accessToken.id.length, 64);
}
describe('User.login requiring email verification', function() {
beforeEach(function() {
User.settings.emailVerificationRequired = true;
});
afterEach(function() {
User.settings.emailVerificationRequired = false;
});
it('requires valid and complete credentials for email verification', function(done) {
User.login({email: validCredentialsEmail}, function(err, accessToken) {
// strongloop/loopback#931
// error message should be "login failed"
// and not "login failed as the email has not been verified"
assert(err && !/verified/.test(err.message),
'expecting "login failed" error message, received: "' + err.message + '"');
assert.equal(err.code, 'LOGIN_FAILED');
// as login is failing because of invalid credentials it should to return
// the user id in the error message
assert.equal(err.details, undefined);
done();
});
});
it('requires valid and complete credentials for email verification - promise variant',
function(done) {
User.login({email: validCredentialsEmail})
.then(function(accessToken) {
done();
})
.catch(function(err) {
// strongloop/loopback#931
// error message should be "login failed" and not "login failed as the email has not been verified"
assert(err && !/verified/.test(err.message),
'expecting "login failed" error message, received: "' + err.message + '"');
assert.equal(err.code, 'LOGIN_FAILED');
assert.equal(err.details, undefined);
done();
});
});
it('does not login a user with unverified email but provides userId', function() {
return User.login(validCredentials).then(
function(user) {
throw new Error('User.login() should have failed');
},
function(err, accessToken) {
err = Object.assign({}, err);
expect(err).to.eql({
statusCode: 401,
code: 'LOGIN_FAILED_EMAIL_NOT_VERIFIED',
details: {
userId: validCredentialsUser.pk,
},
});
}
);
});
it('login a user with verified email', function(done) {
User.login(validCredentialsEmailVerified, function(err, accessToken) {
assertGoodToken(accessToken, validCredentialsEmailVerifiedUser);
done();
});
});
it('login a user with verified email - promise variant', function(done) {
User.login(validCredentialsEmailVerified)
.then(function(accessToken) {
assertGoodToken(accessToken, validCredentialsEmailVerifiedUser);
done();
})
.catch(function(err) {
done(err);
});
});
it('login a user over REST when email verification is required', function(done) {
request(app)
.post('/test-users/login')
.expect('Content-Type', /json/)
.expect(200)
.send(validCredentialsEmailVerified)
.end(function(err, res) {
if (err) return done(err);
var accessToken = res.body;
assertGoodToken(accessToken, validCredentialsEmailVerifiedUser);
assert(accessToken.user === undefined);
done();
});
});
it('login user over REST require complete and valid credentials ' +
'for email verification error message',
function(done) {
request(app)
.post('/test-users/login')
.expect('Content-Type', /json/)
.expect(401)
.send({email: validCredentialsEmail})
.end(function(err, res) {
if (err) return done(err);
// strongloop/loopback#931
// error message should be "login failed"
// and not "login failed as the email has not been verified"
var errorResponse = res.body.error;
assert(errorResponse && !/verified/.test(errorResponse.message),
'expecting "login failed" error message, received: "' + errorResponse.message + '"');
assert.equal(errorResponse.code, 'LOGIN_FAILED');
done();
});
});
it('login a user over REST without email verification when it is required', function(done) {
// make sure the app is configured in production mode
app.set('remoting', {errorHandler: {debug: false, log: false}});
request(app)
.post('/test-users/login')
.expect('Content-Type', /json/)
.expect(401)
.send(validCredentials)
.end(function(err, res) {
if (err) return done(err);
var errorResponse = res.body.error;
// extracting code and details error response
let errorExcerpts = {
code: errorResponse.code,
details: errorResponse.details,
};
expect(errorExcerpts).to.eql({
code: 'LOGIN_FAILED_EMAIL_NOT_VERIFIED',
details: {
userId: validCredentialsUser.pk,
},
});
done();
});
});
});
describe('User.login requiring realm', function() {
var User, AccessToken;
beforeEach(function() {
User = app.registry.createModel('RealmUser', {}, {
base: 'TestUser',
realmRequired: true,
realmDelimiter: ':',
});
AccessToken = app.registry.createModel('RealmAccessToken', {}, {
base: 'AccessToken',
});
app.model(AccessToken, {dataSource: 'db'});
app.model(User, {dataSource: 'db'});
// Update the AccessToken relation to use the subclass of User
AccessToken.belongsTo(User, {as: 'user', foreignKey: 'userId'});
User.hasMany(AccessToken, {as: 'accessTokens', foreignKey: 'userId'});
// allow many User.afterRemote's to be called
User.setMaxListeners(0);
});
var realm1User = {
realm: 'realm1',
username: 'foo100',
email: 'foo100@bar.com',
password: 'pass100',
};
var realm2User = {
realm: 'realm2',
username: 'foo100',
email: 'foo100@bar.com',
password: 'pass200',
};
var credentialWithoutRealm = {
username: 'foo100',
email: 'foo100@bar.com',
password: 'pass100',
};
var credentialWithBadPass = {
realm: 'realm1',
username: 'foo100',
email: 'foo100@bar.com',
password: 'pass001',
};
var credentialWithBadRealm = {
realm: 'realm3',
username: 'foo100',
email: 'foo100@bar.com',
password: 'pass100',
};
var credentialWithRealm = {
realm: 'realm1',
username: 'foo100',
password: 'pass100',
};
var credentialRealmInUsername = {
username: 'realm1:foo100',
password: 'pass100',
};
var credentialRealmInEmail = {
email: 'realm1:foo100@bar.com',
password: 'pass100',
};
var user1 = null;
beforeEach(function(done) {
User.create(realm1User, function(err, u) {
if (err) return done(err);
user1 = u;
User.create(realm2User, done);
});
});
it('honors unique email for realm', function(done) {
User.create(realm1User, function(err, u) {
assert(err);
assert(err.message.match(/User already exists/) &&
err.message.match(/Email already exists/));
done();
});
});
it('rejects a user by without realm', function(done) {
User.login(credentialWithoutRealm, function(err, accessToken) {
assert(err);
assert.equal(err.code, 'REALM_REQUIRED');
done();
});
});
it('rejects a user by with bad realm', function(done) {
User.login(credentialWithBadRealm, function(err, accessToken) {
assert(err);
assert.equal(err.code, 'LOGIN_FAILED');
done();
});
});
it('rejects a user by with bad pass', function(done) {
User.login(credentialWithBadPass, function(err, accessToken) {
assert(err);
assert.equal(err.code, 'LOGIN_FAILED');
done();
});
});
it('logs in a user by with realm', function(done) {
User.login(credentialWithRealm, function(err, accessToken) {
assertGoodToken(accessToken, user1);
done();
});
});
it('logs in a user by with realm in username', function(done) {
User.login(credentialRealmInUsername, function(err, accessToken) {
assertGoodToken(accessToken, user1);
done();
});
});
it('logs in a user by with realm in email', function(done) {
User.login(credentialRealmInEmail, function(err, accessToken) {
assertGoodToken(accessToken, user1);
done();
});
});
describe('User.login with realmRequired but no realmDelimiter', function() {
beforeEach(function() {
User.settings.realmDelimiter = undefined;
});
afterEach(function() {
User.settings.realmDelimiter = ':';
});
it('logs in a user by with realm', function(done) {
User.login(credentialWithRealm, function(err, accessToken) {
assertGoodToken(accessToken, user1);
done();
});
});
it('rejects a user by with realm in email if realmDelimiter is not set',
function(done) {
User.login(credentialRealmInEmail, function(err, accessToken) {
assert(err);
assert.equal(err.code, 'REALM_REQUIRED');
done();
});
});
});
});
describe('User.logout', function() {
it('Logout a user by providing the current accessToken id (using node)', function(done) {
login(logout);
function login(fn) {
User.login(validCredentials, fn);
}
function logout(err, accessToken) {
User.logout(accessToken.id, verify(accessToken.id, done));
}
});
it('Logout a user by providing the current accessToken id (using node) - promise variant',
function(done) {
login(logout);
function login(fn) {
User.login(validCredentials, fn);
}
function logout(err, accessToken) {
User.logout(accessToken.id)
.then(function() {
verify(accessToken.id, done);
})
.catch(done(err));
}
});
it('Logout a user by providing the current accessToken id (over rest)', function(done) {
login(logout);
function login(fn) {
request(app)
.post('/test-users/login')
.expect('Content-Type', /json/)
.expect(200)
.send(validCredentials)
.end(function(err, res) {
if (err) return done(err);
var accessToken = res.body;
assertGoodToken(accessToken, validCredentialsUser);
fn(null, accessToken.id);
});
}
function logout(err, token) {
request(app)
.post('/test-users/logout')
.set('Authorization', token)
.expect(204)
.end(verify(token, done));
}
});
it('fails when accessToken is not provided', function(done) {
User.logout(undefined, function(err) {
expect(err).to.have.property('message');
expect(err).to.have.property('statusCode', 401);
done();
});
});
it('fails when accessToken is not found', function(done) {
User.logout('expired-access-token', function(err) {
expect(err).to.have.property('message');
expect(err).to.have.property('statusCode', 401);
done();
});
});
function verify(token, done) {
assert(token);
return function(err) {
if (err) return done(err);
AccessToken.findById(token, function(err, accessToken) {
assert(!accessToken, 'accessToken should not exist after logging out');
done(err);
});
};
}
});
describe('user.hasPassword(plain, fn)', function() {
it('Determine if the password matches the stored password', function(done) {
var u = new User({username: 'foo', password: 'bar'});
u.hasPassword('bar', function(err, isMatch) {
assert(isMatch, 'password doesnt match');
done();
});
});
it('Determine if the password matches the stored password - promise variant', function(done) {
var u = new User({username: 'foo', password: 'bar'});
u.hasPassword('bar')
.then(function(isMatch) {
assert(isMatch, 'password doesnt match');
done();
})
.catch(function(err) {
done(err);
});
});
it('should match a password when saved', function(done) {
var u = new User({username: 'a', password: 'b', email: 'z@z.net'});
u.save(function(err, user) {
User.findById(user.pk, function(err, uu) {
uu.hasPassword('b', function(err, isMatch) {
assert(isMatch);
done();
});
});
});
});
it('should match a password after it is changed', function(done) {
User.create({email: 'foo@baz.net', username: 'bat', password: 'baz'}, function(err, user) {
User.findById(user.pk, function(err, foundUser) {
assert(foundUser);
foundUser.hasPassword('baz', function(err, isMatch) {
assert(isMatch);
foundUser.password = 'baz2';
foundUser.save(function(err, updatedUser) {
updatedUser.hasPassword('baz2', function(err, isMatch) {
assert(isMatch);
User.findById(user.pk, function(err, uu) {
uu.hasPassword('baz2', function(err, isMatch) {
assert(isMatch);
done();
});
});
});
});
});
});
});
});
});
describe('User.changePassword()', () => {
let userId, currentPassword;
beforeEach(givenUserIdAndPassword);
it('changes the password - callback-style', done => {
User.changePassword(userId, currentPassword, 'new password', (err) => {
if (err) return done(err);
expect(arguments.length, 'changePassword callback arguments length')
.to.be.at.most(1);
User.findById(userId, (err, user) => {
if (err) return done(err);
user.hasPassword('new password', (err, isMatch) => {
if (err) return done(err);
expect(isMatch, 'user has new password').to.be.true();
done();
});
});
});
});
it('changes the password - Promise-style', () => {
return User.changePassword(userId, currentPassword, 'new password')
.then(() => {
expect(arguments.length, 'changePassword promise resolution')
.to.equal(0);
return User.findById(userId);
})
.then(user => {
return user.hasPassword('new password');
})
.then(isMatch => {
expect(isMatch, 'user has new password').to.be.true();
});
});
it('changes the password - instance method', () => {
return validCredentialsUser.changePassword(currentPassword, 'new password')
.then(() => {
expect(arguments.length, 'changePassword promise resolution')
.to.equal(0);
return User.findById(userId);
})
.then(user => {
return user.hasPassword('new password');
})
.then(isMatch => {
expect(isMatch, 'user has new password').to.be.true();
});
});
it('fails when current password does not match', () => {
return User.changePassword(userId, 'bad password', 'new password').then(
success => { throw new Error('changePassword should have failed'); },
err => {
// workaround for chai problem
// object tested must be an array, an object,
// or a string, but error given
const props = Object.assign({}, err);
expect(props).to.contain({
code: 'INVALID_PASSWORD',
statusCode: 400,
});
}
);
});
it('fails with 401 for unknown user id', () => {
return User.changePassword('unknown-id', 'pass', 'pass').then(
success => { throw new Error('changePassword should have failed'); },
err => {
// workaround for chai problem
// object tested must be an array, an object, or a string,
// but error given
const props = Object.assign({}, err);
expect(props).to.contain({
code: 'USER_NOT_FOUND',
statusCode: 401,
});
}
);
});
it('forwards the "options" argument', () => {
const options = {testFlag: true};
const observedOptions = [];
saveObservedOptionsForHook('access');
saveObservedOptionsForHook('before save');
return User.changePassword(userId, currentPassword, 'new', options)
.then(() => expect(observedOptions).to.eql([
// findById
{hook: 'access', testFlag: true},
// "before save" hook prepareForTokenInvalidation
{hook: 'access', setPassword: true, testFlag: true},
// updateAttributes
{hook: 'before save', setPassword: true, testFlag: true},
// validate uniqueness of User.email
{hook: 'access', setPassword: true, testFlag: true},
]));
function saveObservedOptionsForHook(name) {
User.observe(name, (ctx, next) => {
observedOptions.push(Object.assign({hook: name}, ctx.options));
next();
});
}
});
function givenUserIdAndPassword() {
userId = validCredentialsUser.id;
currentPassword = validCredentials.password;
}
});
describe('User.setPassword()', () => {
let userId;
beforeEach(givenUserId);
it('changes the password - callback-style', done => {
User.setPassword(userId, 'new password', (err) => {
if (err) return done(err);
expect(arguments.length, 'changePassword callback arguments length')
.to.be.at.most(1);
User.findById(userId, (err, user) => {
if (err) return done(err);
user.hasPassword('new password', (err, isMatch) => {
if (err) return done(err);
expect(isMatch, 'user has new password').to.be.true();
done();
});
});
});
});
it('changes the password - Promise-style', () => {
return User.setPassword(userId, 'new password')
.then(() => {
expect(arguments.length, 'changePassword promise resolution')
.to.equal(0);
return User.findById(userId);
})
.then(user => {
return user.hasPassword('new password');
})
.then(isMatch => {
expect(isMatch, 'user has new password').to.be.true();
});
});
it('fails with 401 for unknown users', () => {
return User.setPassword('unknown-id', 'pass').then(
success => { throw new Error('setPassword should have failed'); },
err => {
// workaround for chai problem
// object tested must be an array, an object, or a string,
// but error given
const props = Object.assign({}, err);
expect(props).to.contain({
code: 'USER_NOT_FOUND',
statusCode: 401,
});
}
);
});
it('forwards the "options" argument', () => {
const options = {testFlag: true};
const observedOptions = [];
saveObservedOptionsForHook('access');
saveObservedOptionsForHook('before save');
return User.setPassword(userId, 'new', options)
.then(() => expect(observedOptions).to.eql([
// findById
{hook: 'access', testFlag: true},
// "before save" hook prepareForTokenInvalidation
{hook: 'access', setPassword: true, testFlag: true},
// updateAttributes
{hook: 'before save', setPassword: true, testFlag: true},
// validate uniqueness of User.email
{hook: 'access', setPassword: true, testFlag: true},
]));
function saveObservedOptionsForHook(name) {
User.observe(name, (ctx, next) => {
observedOptions.push(Object.assign({hook: name}, ctx.options));
next();
});
}
});
function givenUserId() {
userId = validCredentialsUser.id;
}
});
describe('Identity verification', function() {
describe('user.verify(verifyOptions, options, cb)', function() {
const ctxOptions = {testFlag: true};
let verifyOptions;
beforeEach(function() {
// reset verifyOptions before each test
verifyOptions = {
type: 'email',
from: 'noreply@example.org',
};
});
describe('User.getVerifyOptions()', function() {
it('returns default verify options', function(done) {
const verifyOptions = User.getVerifyOptions();
expect(verifyOptions).to.eql({
type: 'email',
from: 'noreply@example.com',
});
done();
});
it('handles custom verify options defined via model.settings', function(done) {
User.settings.verifyOptions = {
type: 'email',
from: 'test@example.com',
};
const verifyOptions = User.getVerifyOptions();
expect(verifyOptions).to.eql(User.settings.verifyOptions);
done();
});
it('returns same verifyOptions after verify user model', () => {
const defaultOptions = {
type: 'email',
from: 'test@example.com',
};
var verifyOptions = Object.assign({}, defaultOptions);
const user = new User({
email: 'example@example.com',
password: 'pass',
verificationToken: 'example-token',
});
return user
.verify(verifyOptions)
.then(res => expect(verifyOptions).to.eql(defaultOptions));
});
it('getVerifyOptions() always returns the same', () => {
const defaultOptions = {
type: 'email',
from: 'test@example.com',
};
User.settings.verifyOptions = Object.assign({}, defaultOptions);
var verifyOptions = User.getVerifyOptions();
verifyOptions.from = 'newTest@example.com';
verifyOptions.test = 'test';
expect(User.getVerifyOptions()).to.eql(defaultOptions);
});
it('can be extended by user', function(done) {
User.getVerifyOptions = function() {
const base = User.base.getVerifyOptions();
return Object.assign({}, base, {
redirect: '/redirect',
});
};
const verifyOptions = User.getVerifyOptions();
expect(verifyOptions).to.eql({
type: 'email',
from: 'noreply@example.com',
redirect: '/redirect',
});
done();
});
});
it('verifies a user\'s email address', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
user.verify(verifyOptions, function(err, result) {
assert(result.email);
assert(result.email.response);
assert(result.token);
var msg = result.email.response.toString('utf-8');
assert(~msg.indexOf('/api/test-users/confirm'));
assert(~msg.indexOf('To: bar@bat.com'));
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
});
it('verifies a user\'s email address - promise variant', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
user.verify(verifyOptions)
.then(function(result) {
assert(result.email);
assert(result.email.response);
assert(result.token);
var msg = result.email.response.toString('utf-8');
assert(~msg.indexOf('/api/test-users/confirm'));
assert(~msg.indexOf('To: bar@bat.com'));
done();
})
.catch(function(err) {
done(err);
});
});
request(app)
.post('/test-users')
.send({email: 'bar@bat.com', password: 'bar'})
.expect('Content-Type', /json/)
.expect(200)
.end(function(err, res) {
if (err) return done(err);
});
});
it('verifies a user\'s email address with custom header', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
verifyOptions.headers = {'message-id': 'custom-header-value'};
user.verify(verifyOptions, function(err, result) {
assert(result.email);
assert.equal(result.email.messageId, 'custom-header-value');
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
});
it('verifies a user\'s email address with custom template function', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
verifyOptions.templateFn = function(verifyOptions, cb) {
cb(null, 'custom template - verify url: ' + verifyOptions.verifyHref);
};
user.verify(verifyOptions, function(err, result) {
assert(result.email);
assert(result.email.response);
assert(result.token);
var msg = result.email.response.toString('utf-8');
assert(~msg.indexOf('/api/test-users/confirm'));
assert(~msg.indexOf('custom template'));
assert(~msg.indexOf('To: bar@bat.com'));
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
});
it('converts uid value to string', function(done) {
const idString = '58be263abc88dd483956030a';
let actualVerifyHref;
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
verifyOptions.templateFn = function(verifyOptions, cb) {
actualVerifyHref = verifyOptions.verifyHref;
cb(null, 'dummy body');
};
// replace the string id with an object
// TODO: find a better way to do this
Object.defineProperty(user, 'pk', {
get: function() { return this.__data.pk; },
set: function(value) { this.__data.pk = value; },
});
user.pk = {toString: function() { return idString; }};
user.verify(verifyOptions, function(err, result) {
expect(result.uid).to.exist().and.be.an('object');
expect(result.uid.toString()).to.equal(idString);
const parsed = url.parse(actualVerifyHref, true);
expect(parsed.query.uid, 'uid query field').to.eql(idString);
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar', pk: idString})
.end(function(err, res) {
if (err) return done(err);
});
});
it('verifies a user\'s email address with custom token generator', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
verifyOptions.generateVerificationToken = function(user, cb) {
assert(user);
assert.equal(user.email, 'bar@bat.com');
assert(cb);
assert.equal(typeof cb, 'function');
// let's ensure async execution works on this one
process.nextTick(function() {
cb(null, 'token-123456');
});
};
user.verify(verifyOptions, function(err, result) {
assert(result.email);
assert(result.email.response);
assert(result.token);
assert.equal(result.token, 'token-123456');
var msg = result.email.response.toString('utf-8');
assert(~msg.indexOf('token-123456'));
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
});
it('fails if custom token generator returns error', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
verifyOptions.generateVerificationToken = function(user, cb) {
// let's ensure async execution works on this one
process.nextTick(function() {
cb(new Error('Fake error'));
});
};
user.verify(verifyOptions, function(err, result) {
assert(err);
assert.equal(err.message, 'Fake error');
assert.equal(result, undefined);
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
});
describe('Verification link port-squashing', function() {
it('does not squash non-80 ports for HTTP links', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
Object.assign(verifyOptions, {
host: 'myapp.org',
port: 3000,
});
user.verify(verifyOptions, function(err, result) {
var msg = result.email.response.toString('utf-8');
assert(~msg.indexOf('http://myapp.org:3000/'));
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
});
it('squashes port 80 for HTTP links', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
Object.assign(verifyOptions, {
host: 'myapp.org',
port: 80,
});
user.verify(verifyOptions, function(err, result) {
var msg = result.email.response.toString('utf-8');
assert(~msg.indexOf('http://myapp.org/'));
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
});
it('does not squash non-443 ports for HTTPS links', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
Object.assign(verifyOptions, {
host: 'myapp.org',
port: 3000,
protocol: 'https',
});
user.verify(verifyOptions, function(err, result) {
var msg = result.email.response.toString('utf-8');
assert(~msg.indexOf('https://myapp.org:3000/'));
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
});
it('squashes port 443 for HTTPS links', function(done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
Object.assign(verifyOptions, {
host: 'myapp.org',
protocol: 'https',
port: 443,
});
user.verify(verifyOptions, function(err, result) {
var msg = result.email.response.toString('utf-8');
assert(~msg.indexOf('https://myapp.org/'));
done();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
});
});
it('hides verification tokens from user JSON', function(done) {
var user = new User({
email: 'bar@bat.com',
password: 'bar',
verificationToken: 'a-token',
});
var data = user.toJSON();
assert(!('verificationToken' in data));
done();
});
it('squashes "//" when restApiRoot is "/"', function(done) {
var emailBody;
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
Object.assign(verifyOptions, {
host: 'myapp.org',
port: 3000,
restApiRoot: '/',
});
user.verify(verifyOptions, function(err, result) {
if (err) return next(err);
emailBody = result.email.response.toString('utf-8');
next();
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(200)
.send({email: 'user@example.com', password: 'pass'})
.end(function(err, res) {
if (err) return done(err);
expect(emailBody)
.to.contain('http://myapp.org:3000/test-users/confirm');
done();
});
});
it('removes "verifyOptions.template" from Email payload', function() {
var MailerMock = {
send: function(verifyOptions, cb) { cb(null, verifyOptions); },
};
verifyOptions.mailer = MailerMock;
return user.verify(verifyOptions)
.then(function(result) {
expect(result.email).to.not.have.property('template');
});
});
it('allows hash fragment in redirectUrl', function() {
let actualVerifyHref;
Object.assign(verifyOptions, {
redirect: '#/some-path?a=1&b=2',
templateFn: (verifyOptions, cb) => {
actualVerifyHref = verifyOptions.verifyHref;
cb(null, 'dummy body');
},
});
return user.verify(verifyOptions)
.then(() => actualVerifyHref)
.then(verifyHref => {
var parsed = url.parse(verifyHref, true);
expect(parsed.query.redirect, 'redirect query')
.to.equal('#/some-path?a=1&b=2');
});
});
it('verifies that verifyOptions.templateFn receives verifyOptions.verificationToken',
function() {
let actualVerificationToken;
Object.assign(verifyOptions, {
redirect: '#/some-path?a=1&b=2',
templateFn: (verifyOptions, cb) => {
actualVerificationToken = verifyOptions.verificationToken;
cb(null, 'dummy body');
},
});
return user.verify(verifyOptions)
.then(() => actualVerificationToken)
.then(token => {
expect(token).to.exist();
});
});
it('forwards the "options" argument to user.save() ' +
'when adding verification token', function() {
let onBeforeSaveCtx = {};
// before save operation hook to capture remote ctx when saving
// verification token in user instance
User.observe('before save', function(ctx, next) {
onBeforeSaveCtx = ctx || {};
next();
});
return user.verify(verifyOptions, ctxOptions)
.then(() => {
// not checking equality since other properties are added by user.save()
expect(onBeforeSaveCtx.options).to.contain({testFlag: true});
});
});
it('forwards the "options" argument to a custom templateFn function', function() {
let templateFnOptions;
// custom templateFn function accepting the options argument
verifyOptions.templateFn = (verifyOptions, options, cb) => {
templateFnOptions = options;
cb(null, 'dummy body');
};
return user.verify(verifyOptions, ctxOptions)
.then(() => {
// not checking equality since other properties are added by user.save()
expect(templateFnOptions).to.contain({testFlag: true});
});
});
it('forwards the "options" argment to a custom token generator function', function() {
let generateTokenOptions;
// custom generateVerificationToken function accepting the options argument
verifyOptions.generateVerificationToken = (user, options, cb) => {
generateTokenOptions = options;
cb(null, 'dummy token');
};
return user.verify(verifyOptions, ctxOptions)
.then(() => {
// not checking equality since other properties are added by user.save()
expect(generateTokenOptions).to.contain({testFlag: true});
});
});
it('forwards the "options" argument to a custom mailer function', function() {
let mailerOptions;
// custom mailer function accepting the options argument
const mailer = function() {};
mailer.send = function(verifyOptions, options, cb) {
mailerOptions = options;
cb(null, 'dummy result');
};
verifyOptions.mailer = mailer;
return user.verify(verifyOptions, ctxOptions)
.then(() => {
// not checking equality since other properties are added by user.save()
expect(mailerOptions).to.contain({testFlag: true});
});
});
it('handles the case when remote method "confirm" is disabled', () => {
let actualVerifyHref;
const VERIFY_HREF = 'http://example.com/a-verify-url';
Object.assign(verifyOptions, {
verifyHref: VERIFY_HREF,
templateFn: (options, cb) => {
actualVerifyHref = options.verifyHref;
cb(null, 'dummy body');
},
});
User.disableRemoteMethodByName('confirm');
return user.verify(verifyOptions)
.then(() => {
expect(actualVerifyHref.substring(0, VERIFY_HREF.length + 1))
.to.equal(`${VERIFY_HREF}?`);
});
});
function givenUser() {
return User.create({email: 'test@example.com', password: 'pass'})
.then(u => user = u);
}
it('is called over REST method /User/:id/verify', function() {
return User.create({email: 'bar@bat.com', password: 'bar'})
.then(user => {
return request(app)
.post('/test-users/' + user.pk + '/verify')
.expect('Content-Type', /json/)
// we already tested before that User.verify(id) works correctly
// having the remote method returning 204 is enough to make sure
// User.verify() was called successfully
.expect(204);
});
});
it('fails over REST method /User/:id/verify with invalid user id', function() {
return request(app)
.post('/test-users/' + 'invalid-id' + '/verify')
.expect('Content-Type', /json/)
.expect(404);
});
});
describe('User.confirm(options, fn)', function() {
var verifyOptions;
function testConfirm(testFunc, done) {
User.afterRemote('create', function(ctx, user, next) {
assert(user, 'afterRemote should include result');
verifyOptions = {
type: 'email',
to: user.email,
from: 'noreply@myapp.org',
redirect: 'http://foo.com/bar',
protocol: ctx.req.protocol,
host: ctx.req.get('host'),
};
user.verify(verifyOptions, function(err, result) {
if (err) return done(err);
testFunc(result, done);
});
});
request(app)
.post('/test-users')
.expect('Content-Type', /json/)
.expect(302)
.send({email: 'bar@bat.com', password: 'bar'})
.end(function(err, res) {
if (err) return done(err);
});
}
it('Confirm a user verification', function(done) {
testConfirm(function(result, done) {
request(app)
.get('/test-users/confirm?uid=' + (result.uid) +
'&token=' + encodeURIComponent(result.token) +
'&redirect=' + encodeURIComponent(verifyOptions.redirect))
.expect(302)
.end(function(err, res) {
if (err) return done(err);
done();
});
}, done);
});
it('sets verificationToken to null after confirmation', function(done) {
testConfirm(function(result, done) {
User.confirm(result.uid, result.token, false, function(err) {
if (err) return done(err);
// Verify by loading user data stored in the datasource
User.findById(result.uid, function(err, user) {
if (err) return done(err);
expect(user).to.have.property('verificationToken', null);
done();
});
});
}, done);
});
it('Should report 302 when redirect url is set', function(done) {
testConfirm(function(result, done) {
request(app)
.get('/test-users/confirm?uid=' + (result.uid) +
'&token=' + encodeURIComponent(result.token) +
'&redirect=http://foo.com/bar')
.expect(302)
.expect('Location', 'http://foo.com/bar')
.end(done);
}, done);
});
it('Should report 204 when redirect url is not set', function(done) {
testConfirm(function(result, done) {
request(app)
.get('/test-users/confirm?uid=' + (result.uid) +
'&token=' + encodeURIComponent(result.token))
.expect(204)
.end(done);
}, done);
});
it('Report error for invalid user id during verification', function(done) {
testConfirm(function(result, done) {
request(app)
.get('/test-users/confirm?uid=' + (result.uid + '_invalid') +
'&token=' + encodeURIComponent(result.token) +
'&redirect=' + encodeURIComponent(verifyOptions.redirect))
.expect(404)
.end(function(err, res) {
if (err) return done(err);
var errorResponse = res.body.error;
assert(errorResponse);
assert.equal(errorResponse.code, 'USER_NOT_FOUND');
done();
});
}, done);
});
it('Report error for invalid token during verification', function(done) {
testConfirm(function(result, done) {
request(app)
.get('/test-users/confirm?uid=' + result.uid +
'&token=' + encodeURIComponent(result.token) + '_invalid' +
'&redirect=' + encodeURIComponent(verifyOptions.redirect))
.expect(400)
.end(function(err, res) {
if (err) return done(err);
var errorResponse = res.body.error;
assert(errorResponse);
assert.equal(errorResponse.code, 'INVALID_TOKEN');
done();
});
}, done);
});
});
});
describe('Password Reset', function() {
describe('User.resetPassword(options, cb)', function() {
var options = {
email: 'foo@bar.com',
redirect: 'http://foobar.com/reset-password',
};
it('Requires email address to reset password', function(done) {
User.resetPassword({ }, function(err) {
assert(err);
assert.equal(err.code, 'EMAIL_REQUIRED');
done();
});
});
it('Requires email address to reset password - promise variant', function(done) {
User.resetPassword({ })
.then(function() {
throw new Error('Error should NOT be thrown');
})
.catch(function(err) {
assert(err);
assert.equal(err.code, 'EMAIL_REQUIRED');
done();
});
});
it('Reports when email is not found', function(done) {
User.resetPassword({email: 'unknown@email.com'}, function(err) {
assert(err);
assert.equal(err.code, 'EMAIL_NOT_FOUND');
assert.equal(err.statusCode, 404);
done();
});
});
it('Checks that options exist', function(done) {
var calledBack = false;
User.resetPassword(options, function() {
calledBack = true;
});
User.once('resetPasswordRequest', function(info) {
assert(info.options);
assert.equal(info.options, options);
assert(calledBack);
done();
});
});
it('Creates a temp accessToken to allow a user to change password', function(done) {
var calledBack = false;
User.resetPassword({
email: options.email,
}, function() {
calledBack = true;
});
User.once('resetPasswordRequest', function(info) {
assert(info.email);
assert(info.accessToken);
assert(info.accessToken.id);
assert.equal(info.accessToken.ttl / 60, 15);
assert(calledBack);
info.accessToken.user(function(err, user) {
if (err) return done(err);
assert.equal(user.email, options.email);
done();
});
});
});
it('calls createAccessToken() to create the token', function(done) {
User.prototype.createAccessToken = function(ttl, cb) {
cb(null, new AccessToken({id: 'custom-token'}));
};
User.resetPassword({email: options.email}, function() {});
User.once('resetPasswordRequest', function(info) {
expect(info.accessToken.id).to.equal('custom-token');
done();
});
});
it('Password reset over REST rejected without email address', function(done) {
request(app)
.post('/test-users/reset')
.expect('Content-Type', /json/)
.expect(400)
.send({ })
.end(function(err, res) {
if (err) return done(err);
var errorResponse = res.body.error;
assert(errorResponse);
assert.equal(errorResponse.code, 'EMAIL_REQUIRED');
done();
});
});
it('Password reset over REST requires email address', function(done) {
request(app)
.post('/test-users/reset')
.expect('Content-Type', /json/)
.expect(204)
.send({email: options.email})
.end(function(err, res) {
if (err) return done(err);
assert.deepEqual(res.body, '');
done();
});
});
it('creates token that allows patching User with new password', () => {
return triggerPasswordReset(options.email)
.then(info => {
// Make a REST request to change the password
return request(app)
.patch(`/test-users/${info.user.id}`)
.set('Authorization', info.accessToken.id)
.send({password: 'new-pass'})
.expect(200);
})
.then(() => {
// Call login to verify the password was changed
const credentials = {email: options.email, password: 'new-pass'};
return User.login(credentials);
});
});
it('creates token that allows calling other endpoints too', () => {
// Setup a test method that can be executed by $owner only
User.prototype.testMethod = function(cb) { cb(null, 'ok'); };
User.remoteMethod('prototype.testMethod', {
returns: {arg: 'status', type: 'string'},
http: {verb: 'get', path: '/test'},
});
User.settings.acls.push({
principalType: 'ROLE',
principalId: '$owner',
permission: 'ALLOW',
property: 'testMethod',
});
return triggerPasswordReset(options.email)
.then(info => request(app)
.get(`/test-users/${info.user.id}/test`)
.set('Authorization', info.accessToken.id)
.expect(200));
});
describe('User.resetPassword(options, cb) requiring realm', function() {
var realmUser;
beforeEach(function(done) {
User.create(validCredentialsWithRealm, function(err, u) {
if (err) return done(err);
realmUser = u;
done();
});
});
it('Reports when email is not found in realm', function(done) {
User.resetPassword({
email: realmUser.email,
realm: 'unknown',
}, function(err) {
assert(err);
assert.equal(err.code, 'EMAIL_NOT_FOUND');
assert.equal(err.statusCode, 404);
done();
});
});
it('Creates a temp accessToken to allow user in realm to change password', function(done) {
var calledBack = false;
User.resetPassword({
email: realmUser.email,
realm: realmUser.realm,
}, function() {
calledBack = true;
});
User.once('resetPasswordRequest', function(info) {
assert(info.email);
assert(info.accessToken);
assert(info.accessToken.id);
assert.equal(info.accessToken.ttl / 60, 15);
assert(calledBack);
info.accessToken.user(function(err, user) {
if (err) return done(err);
assert.equal(user.email, realmUser.email);
done();
});
});
});
});
});
});
describe('AccessToken (session) invalidation', function() {
var user, originalUserToken1, originalUserToken2, newUserCreated;
var currentEmailCredentials = {email: 'original@example.com', password: 'bar'};
var updatedEmailCredentials = {email: 'updated@example.com', password: 'bar'};
var newUserCred = {email: 'newuser@example.com', password: 'newpass'};
beforeEach('create user then login', function createAndLogin(done) {
async.series([
function createUserWithOriginalEmail(next) {
User.create(currentEmailCredentials, function(err, userCreated) {
if (err) return next(err);
user = userCreated;
next();
});
},
function firstLoginWithOriginalEmail(next) {
User.login(currentEmailCredentials, function(err, accessToken1) {
if (err) return next(err);
assert(accessToken1.userId);
originalUserToken1 = accessToken1;
next();
});
},
function secondLoginWithOriginalEmail(next) {
User.login(currentEmailCredentials, function(err, accessToken2) {
if (err) return next(err);
assert(accessToken2.userId);
originalUserToken2 = accessToken2;
next();
});
},
], done);
});
it('invalidates sessions when email is changed using `updateAttributes`', function(done) {
user.updateAttributes(
{email: updatedEmailCredentials.email},
function(err, userInstance) {
if (err) return done(err);
assertNoAccessTokens(done);
}
);
});
it('invalidates sessions after `replaceAttributes`', function(done) {
// The way how the invalidation is implemented now, all sessions
// are invalidated on a full replace
user.replaceAttributes(currentEmailCredentials, function(err, userInstance) {
if (err) return done(err);
assertNoAccessTokens(done);
});
});
it('invalidates sessions when email is changed using `updateOrCreate`', function(done) {
User.updateOrCreate({
pk: user.pk,
email: updatedEmailCredentials.email,
}, function(err, userInstance) {
if (err) return done(err);
assertNoAccessTokens(done);
});
});
it('invalidates sessions after `replaceById`', function(done) {
// The way how the invalidation is implemented now, all sessions
// are invalidated on a full replace
User.replaceById(user.pk, currentEmailCredentials, function(err, userInstance) {
if (err) return done(err);
assertNoAccessTokens(done);
});
});
it('invalidates sessions after `replaceOrCreate`', function(done) {
// The way how the invalidation is implemented now, all sessions
// are invalidated on a full replace
User.replaceOrCreate({
pk: user.pk,
email: currentEmailCredentials.email,
password: currentEmailCredentials.password,
}, function(err, userInstance) {
if (err) return done(err);
assertNoAccessTokens(done);
});
});
it('keeps sessions AS IS if firstName is added using `updateAttributes`', function(done) {
user.updateAttributes({'firstName': 'Janny'}, function(err, userInstance) {
if (err) return done(err);
assertPreservedTokens(done);
});
});
it('keeps sessions AS IS when calling save() with no changes', function(done) {
user.save(function(err) {
if (err) return done(err);
assertPreservedTokens(done);
});
});
it('keeps sessions AS IS if firstName is added using `updateOrCreate`', function(done) {
User.updateOrCreate({
pk: user.pk,
firstName: 'Loay',
email: currentEmailCredentials.email,
}, function(err, userInstance) {
if (err) return done(err);
assertPreservedTokens(done);
});
});
it('keeps sessions AS IS if a new user is created using `create`', function(done) {
async.series([
function(next) {
User.create(newUserCred, function(err, newUserInstance) {
if (err) return done(err);
newUserCreated = newUserInstance;
next();
});
},
function(next) {
User.login(newUserCred, function(err, newAccessToken) {
if (err) return done(err);
assert(newAccessToken.id);
assertPreservedTokens(next);
});
},
], done);
});
it('keeps sessions AS IS if a new user is created using `updateOrCreate`', function(done) {
async.series([
function(next) {
User.create(newUserCred, function(err, newUserInstance2) {
if (err) return done(err);
newUserCreated = newUserInstance2;
next();
});
},
function(next) {
User.login(newUserCred, function(err, newAccessToken2) {
if (err) return done(err);
assert(newAccessToken2.id);
assertPreservedTokens(next);
});
},
], done);
});
it('keeps sessions AS IS if non-email property is changed using updateAll', function(done) {
var userPartial;
async.series([
function createPartialUser(next) {
User.create(
{email: 'partial@example.com', password: 'pass1', age: 25},
function(err, partialInstance) {
if (err) return next(err);
userPartial = partialInstance;
next();
}
);
},
function loginPartiallUser(next) {
User.login({email: 'partial@example.com', password: 'pass1'}, function(err, ats) {
if (err) return next(err);
next();
});
},
function updatePartialUser(next) {
User.updateAll(
{pk: userPartial.pk},
{age: userPartial.age + 1},
function(err, info) {
if (err) return next(err);
next();
}
);
},
function verifyTokensOfPartialUser(next) {
AccessToken.find({where: {userId: userPartial.pk}}, function(err, tokens1) {
if (err) return next(err);
expect(tokens1.length).to.equal(1);
next();
});
},
], done);
});
it('preserves other users\' sessions if their email is untouched', function(done) {
var user1, user2, user3;
async.series([
function(next) {
User.create({email: 'user1@example.com', password: 'u1pass'}, function(err, u1) {
if (err) return done(err);
User.create({email: 'user2@example.com', password: 'u2pass'}, function(err, u2) {
if (err) return done(err);
User.create({email: 'user3@example.com', password: 'u3pass'}, function(err, u3) {
if (err) return done(err);
user1 = u1;
user2 = u2;
user3 = u3;
next();
});
});
});
},
function(next) {
User.login(
{email: 'user1@example.com', password: 'u1pass'},
function(err, accessToken1) {
if (err) return next(err);
User.login(
{email: 'user2@example.com', password: 'u2pass'},
function(err, accessToken2) {
if (err) return next(err);
User.login({email: 'user3@example.com', password: 'u3pass'},
function(err, accessToken3) {
if (err) return next(err);
next();
});
}
);
}
);
},
function(next) {
user2.updateAttribute('email', 'user2Update@b.com', function(err, userInstance) {
if (err) return next(err);
assert.equal(userInstance.email, 'user2Update@b.com');
next();
});
},
function(next) {
AccessToken.find({where: {userId: user1.pk}}, function(err, tokens1) {
if (err) return next(err);
AccessToken.find({where: {userId: user2.pk}}, function(err, tokens2) {
if (err) return next(err);
AccessToken.find({where: {userId: user3.pk}}, function(err, tokens3) {
if (err) return next(err);
expect(tokens1.length).to.equal(1);
expect(tokens2.length).to.equal(0);
expect(tokens3.length).to.equal(1);
next();
});
});
});
},
], done);
});
it('invalidates correct sessions after changing email using updateAll', function(done) {
var userSpecial, userNormal;
async.series([
function createSpecialUser(next) {
User.create(
{email: 'special@example.com', password: 'pass1', name: 'Special'},
function(err, specialInstance) {
if (err) return next(err);
userSpecial = specialInstance;
next();
}
);
},
function loginSpecialUser(next) {
User.login({email: 'special@example.com', password: 'pass1'}, function(err, ats) {
if (err) return next(err);
next();
});
},
function updateSpecialUser(next) {
User.updateAll(
{name: 'Special'},
{email: 'superspecial@example.com'}, function(err, info) {
if (err) return next(err);
next();
}
);
},
function verifyTokensOfSpecialUser(next) {
AccessToken.find({where: {userId: userSpecial.pk}}, function(err, tokens1) {
if (err) return done(err);
expect(tokens1.length, 'tokens - special user tokens').to.equal(0);
next();
});
},
assertPreservedTokens,
], done);
});
it('invalidates session when password is reset', function(done) {
user.updateAttribute('password', 'newPass', function(err, user2) {
if (err) return done(err);
assertNoAccessTokens(done);
});
});
it('preserves current session', function(done) {
var options = {accessToken: originalUserToken1};
user.updateAttribute('email', 'new@example.com', options, function(err) {
if (err) return done(err);
AccessToken.find({where: {userId: user.pk}}, function(err, tokens) {
if (err) return done(err);
var tokenIds = tokens.map(function(t) { return t.id; });
expect(tokenIds).to.eql([originalUserToken1.id]);
done();
});
});
});
it('forwards the "options" argument', function(done) {
var options = {testFlag: true};
var observedOptions = [];
saveObservedOptionsForHook('access', User);
saveObservedOptionsForHook('before delete', AccessToken);
user.updateAttribute('password', 'newPass', options, function(err, updated) {
if (err) return done(err);
expect(observedOptions).to.eql([
// prepareForTokenInvalidation - load current instance data
{hook: 'access', testFlag: true},
// validate uniqueness of User.email
{hook: 'access', testFlag: true},
// _invalidateAccessTokensOfUsers - deleteAll
{hook: 'before delete', testFlag: true},
]);
done();
});
function saveObservedOptionsForHook(name, model) {
model.observe(name, function(ctx, next) {
observedOptions.push(extend({hook: name}, ctx.options));
next();
});
}
});
it('preserves other user sessions if their password is untouched', function(done) {
var user1, user2, user1Token;
async.series([
function(next) {
User.create({email: 'user1@example.com', password: 'u1pass'}, function(err, u1) {
if (err) return done(err);
User.create({email: 'user2@example.com', password: 'u2pass'}, function(err, u2) {
if (err) return done(err);
user1 = u1;
user2 = u2;
next();
});
});
},
function(next) {
User.login({email: 'user1@example.com', password: 'u1pass'}, function(err, at1) {
User.login({email: 'user2@example.com', password: 'u2pass'}, function(err, at2) {
assert(at1.userId);
assert(at2.userId);
user1Token = at1.id;
next();
});
});
},
function(next) {
user2.updateAttribute('password', 'newPass', function(err, user2Instance) {
if (err) return next(err);
assert(user2Instance);
next();
});
},
function(next) {
AccessToken.find({where: {userId: user1.pk}}, function(err, tokens1) {
if (err) return next(err);
AccessToken.find({where: {userId: user2.pk}}, function(err, tokens2) {
if (err) return next(err);
expect(tokens1.length).to.equal(1);
expect(tokens2.length).to.equal(0);
assert.equal(tokens1[0].id, user1Token);
next();
});
});
},
], function(err) {
done();
});
});
// See https://github.com/strongloop/loopback/issues/3215
it('handles subclassed user with no accessToken relation', () => {
// setup a new LoopBack app, we don't want to use shared models
app = loopback({localRegistry: true, loadBuiltinModels: true});
app.set('_verifyAuthModelRelations', false);
app.set('remoting', {errorHandler: {debug: true, log: false}});
app.dataSource('db', {connector: 'memory'});
const User = app.registry.createModel({
name: 'user',
base: 'User',
});
app.model(User, {dataSource: 'db'});
app.enableAuth({dataSource: 'db'});
expect(app.models.User.modelName).to.eql('user');
return User.create(validCredentials)
.then(u => {
u.email = 'updated@example.com';
return u.save();
// the test passes when save() does not throw any error
});
});
function assertPreservedTokens(done) {
AccessToken.find({where: {userId: user.pk}}, function(err, tokens) {
if (err) return done(err);
var actualIds = tokens.map(function(t) { return t.id; });
actualIds.sort();
var expectedIds = [originalUserToken1.id, originalUserToken2.id];
expectedIds.sort();
expect(actualIds).to.eql(expectedIds);
done();
});
};
function assertNoAccessTokens(done) {
AccessToken.find({where: {userId: user.pk}}, function(err, tokens) {
if (err) return done(err);
expect(tokens.length).to.equal(0);
done();
});
}
});
describe('Verification after updating email', function() {
var NEW_EMAIL = 'updated@example.com';
var userInstance;
beforeEach(createOriginalUser);
it('sets verification to false after email update if verification is required',
function(done) {
User.settings.emailVerificationRequired = true;
async.series([
function updateUser(next) {
userInstance.updateAttribute('email', NEW_EMAIL, function(err, info) {
if (err) return next(err);
assert.equal(info.email, NEW_EMAIL);
next();
});
},
function findUser(next) {
User.findById(userInstance.pk, function(err, info) {
if (err) return next(err);
assert.equal(info.email, NEW_EMAIL);
assert.equal(info.emailVerified, false);
next();
});
},
], done);
});
it('leaves verification as is after email update if verification is not required',
function(done) {
User.settings.emailVerificationRequired = false;
async.series([
function updateUser(next) {
userInstance.updateAttribute('email', NEW_EMAIL, function(err, info) {
if (err) return next(err);
assert.equal(info.email, NEW_EMAIL);
next();
});
},
function findUser(next) {
User.findById(userInstance.pk, function(err, info) {
if (err) return next(err);
assert.equal(info.email, NEW_EMAIL);
assert.equal(info.emailVerified, true);
next();
});
},
], done);
});
it('should not set verification to false after something other than email is updated',
function(done) {
User.settings.emailVerificationRequired = true;
async.series([
function updateUser(next) {
userInstance.updateAttribute('realm', 'test', function(err, info) {
if (err) return next(err);
assert.equal(info.realm, 'test');
next();
});
},
function findUser(next) {
User.findById(userInstance.pk, function(err, info) {
if (err) return next(err);
assert.equal(info.realm, 'test');
assert.equal(info.emailVerified, true);
next();
});
},
], done);
});
function createOriginalUser(done) {
var userData = {
email: 'original@example.com',
password: 'bar',
emailVerified: true,
};
User.create(userData, function(err, instance) {
if (err) return done(err);
userInstance = instance;
done();
});
}
});
describe('password reset with/without email verification', function() {
it('allows resetPassword by email if email verification is required and done',
function(done) {
User.settings.emailVerificationRequired = true;
var email = validCredentialsEmailVerified.email;
User.resetPassword({email: email}, function(err, info) {
if (err) return done(err);
done();
});
});
it('disallows resetPassword by email if email verification is required and not done',
function(done) {
User.settings.emailVerificationRequired = true;
var email = validCredentialsEmail;
User.resetPassword({email: email}, function(err) {
assert(err);
assert.equal(err.code, 'RESET_FAILED_EMAIL_NOT_VERIFIED');
assert.equal(err.statusCode, 401);
done();
});
});
it('allows resetPassword by email if email verification is not required',
function(done) {
User.settings.emailVerificationRequired = false;
var email = validCredentialsEmail;
User.resetPassword({email: email}, function(err) {
if (err) return done(err);
done();
});
});
});
describe('ctor', function() {
it('exports default Email model', function() {
expect(User.email, 'User.email').to.be.a('function');
expect(User.email.modelName, 'modelName').to.eql('Email');
});
it('exports default AccessToken model', function() {
expect(User.accessToken, 'User.accessToken').to.be.a('function');
expect(User.accessToken.modelName, 'modelName').to.eql('AccessToken');
});
});
describe('ttl', function() {
var User2;
beforeEach(function() {
User2 = loopback.User.extend('User2', {}, {ttl: 10});
});
it('should override ttl setting in based User model', function() {
expect(User2.settings.ttl).to.equal(10);
});
});
function triggerPasswordReset(email) {
return Promise.all([
User.resetPassword({email: email}),
waitForEvent(User, 'resetPasswordRequest'),
])
.spread((reset, info) => info);
}
});
Reference in New Issue View Git Blame Copy Permalink