Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add authentication middleware to feed-discovery, refactor and update test coverage to 100% #2136

Merged
merged 2 commits into from
Apr 13, 2021

Conversation

humphd
Copy link
Contributor

@humphd humphd commented Apr 12, 2021

I've updated the feed-parser service to require a user to be authenticated. I think it's a bit of a security risk to leave this open on the internet for anyone to hit, since it will download code from any URL you give it. Now you need to login first, but then any Seneca/Telescope user can do it (e.g., during signup).

Writing the code, I had to adjust a few things:

  • rename lib -> middleware
  • rework the middleware so that all functions return a middleware function (more standard way that we're doing this through the rest of the code)
  • update the middleware tests to not need supertest
  • added more test cases to get test coverage to 100% (woo!)
  • updated all route tests to use a service token.

@humphd humphd requested a review from tonyvugithub April 12, 2021 22:42
@humphd humphd self-assigned this Apr 12, 2021
@humphd humphd added area: microservices area: satellite Issues related to the Satellite microservice project type: security Security concerns type: test Creation and development of test labels Apr 12, 2021
@humphd humphd force-pushed the authorize-feed-parser branch from f23c3d3 to 397a422 Compare April 12, 2021 22:48
expect(res.status).toBe(200);
expect(res.body).toEqual(result);
done();
});

it('should return 401 if no authorization token is included in headers', async (done) => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@humphd
Copy link
Contributor Author

humphd commented Apr 12, 2021

I can't seem to get CI to pass, it's failing with this bizarre error:

FAIL src/api/users/test/e2e/users.test.js
  ● Test suite failed to run

    Cannot find module '@firebase/app-exp' from 'src/api/users/node_modules/firebase/node_modules/@firebase/database/dist/index.node.cjs.js'

    Require stack:
      src/api/users/node_modules/firebase/node_modules/@firebase/database/dist/index.node.cjs.js
      src/api/users/node_modules/firebase/dist/index.node.cjs.js
      src/api/users/node_modules/@firebase/rules-unit-testing/dist/index.cjs.js
      src/api/users/test/e2e/users.test.js

      at Resolver.resolveModule (node_modules/jest-resolve/build/index.js:306:11)
      at Object.<anonymous> (src/api/users/node_modules/firebase/node_modules/@firebase/database/dist/index.node.cjs.js:8:14)

This is unrelated to what I'm touching, so I have no idea what's happening. I wonder if it's npm cache on GitHub's side? I'll try re-triggering again in a bit, see if it sorts itself out.

@humphd humphd changed the title Add authentication middleware to feed-parser, refator and update test coverage to 100% Add authentication middleware to feed-discovery, refator and update test coverage to 100% Apr 13, 2021
@birtony birtony changed the title Add authentication middleware to feed-discovery, refator and update test coverage to 100% Add authentication middleware to feed-discovery, refactor and update test coverage to 100% Apr 13, 2021
@humphd humphd force-pushed the authorize-feed-parser branch from e658bb6 to 977a412 Compare April 13, 2021 15:02
@humphd humphd requested a review from PedroFonsecaDEV April 13, 2021 15:27
@humphd humphd merged commit 1e92190 into Seneca-CDOT:master Apr 13, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: microservices area: satellite Issues related to the Satellite microservice project type: security Security concerns type: test Creation and development of test
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants