-
Notifications
You must be signed in to change notification settings - Fork 37
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(cms): fix cms login errors on mongodb and postgresql (#104)
fix #98
- Loading branch information
Showing
15 changed files
with
234 additions
and
48 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,175 @@ | ||
| import { cms } from '@tensei/cms' | ||
| import SupertestSession from 'supertest-session' | ||
| import Supertest, { SuperTest as SI } from 'supertest' | ||
| import { setup, fakeUser, setupFakeMailer, getFakeMailer } from './setup' | ||
|
|
||
| export const getCmsCsrfToken = async (client: SI<any>): Promise<string> => { | ||
| const response = await client.get(`/cms/api/csrf`) | ||
|
|
||
| return response.headers['set-cookie'][0].split(';')[0].split('=')[1] | ||
| } | ||
|
|
||
| test('can passwordlessly register a new administrator user', async () => { | ||
| const mailerMock = getFakeMailer() | ||
|
|
||
| const email = fakeUser().email | ||
|
|
||
| const { | ||
| app, | ||
| ctx: { | ||
| orm: { em } | ||
| } | ||
| } = await setup([cms().plugin(), setupFakeMailer(mailerMock)], false) | ||
|
|
||
| const client = (SupertestSession(app) as unknown) as SI<any> | ||
|
|
||
| const csrf = await getCmsCsrfToken(client) | ||
|
|
||
| // Clear all existing administrators and passwordless tokens. | ||
| await em.nativeDelete('AdminToken', {}) | ||
| await em.nativeDelete('AdminUser', {}) | ||
|
|
||
| const response = await client | ||
| .post('/cms/api/passwordless/email/register') | ||
| .set('X-XSRF-TOKEN', csrf) | ||
| .send({ | ||
| }) | ||
|
|
||
| expect(response.status).toBe(204) | ||
|
|
||
| const [{ token }] = await em.find<{ | ||
| token: string | ||
| }>('AdminToken', {}) | ||
|
|
||
| const loginResponse = await client.get( | ||
| `/cms/api/passwordless/token/${token}` | ||
| ) | ||
|
|
||
| expect(loginResponse.status).toBe(302) | ||
| expect(loginResponse.headers['location']).toBe('/cms') | ||
| }) | ||
|
|
||
| test('cannot register another administrator if a super admin already exists', async () => { | ||
| const mailerMock = getFakeMailer() | ||
|
|
||
| const email = fakeUser().email | ||
|
|
||
| const { | ||
| app, | ||
| ctx: { | ||
| orm: { em } | ||
| } | ||
| } = await setup([cms().plugin(), setupFakeMailer(mailerMock)], false) | ||
|
|
||
| const client = (SupertestSession(app) as unknown) as SI<any> | ||
|
|
||
| const csrf = await getCmsCsrfToken(client) | ||
|
|
||
| // Clear all existing administrators and passwordless tokens. | ||
| await em.nativeDelete('AdminToken', {}) | ||
| await em.nativeDelete('AdminUser', {}) | ||
|
|
||
| await client | ||
| .post('/cms/api/passwordless/email/register') | ||
| .set('X-XSRF-TOKEN', csrf) | ||
| .send({ | ||
| }) | ||
| // attempt to register an administrator again | ||
| const response = await client | ||
| .post('/cms/api/passwordless/email/register') | ||
| .set('X-XSRF-TOKEN', csrf) | ||
| .send({ | ||
| }) | ||
|
|
||
| expect(response.status).toBe(400) | ||
| expect(response.body.message).toBe('Unauthorized.') | ||
| }) | ||
|
|
||
| test('can passwordlessly login an existing administrator user', async () => { | ||
| const mailerMock = getFakeMailer() | ||
|
|
||
| const email = fakeUser().email | ||
|
|
||
| const { | ||
| app, | ||
| ctx: { | ||
| orm: { em } | ||
| } | ||
| } = await setup([cms().plugin(), setupFakeMailer(mailerMock)], false) | ||
|
|
||
| const client = (SupertestSession(app) as unknown) as SI<any> | ||
|
|
||
| const csrf = await getCmsCsrfToken(client) | ||
|
|
||
| // Clear all existing administrators and passwordless tokens. | ||
| await em.nativeDelete('AdminToken', {}) | ||
| await em.nativeDelete('AdminUser', {}) | ||
|
|
||
| await client | ||
| .post('/cms/api/passwordless/email/register') | ||
| .set('X-XSRF-TOKEN', csrf) | ||
| .send({ | ||
| }) | ||
|
|
||
| // clear registration token | ||
| await em.nativeDelete('AdminToken', {}) | ||
|
|
||
| const response = await client | ||
| .post('/cms/api/passwordless/email/login') | ||
| .set('X-XSRF-TOKEN', csrf) | ||
| .send({ | ||
| }) | ||
|
|
||
| const [{ token }] = await em.find<{ | ||
| token: string | ||
| }>('AdminToken', {}) | ||
|
|
||
| const loginResponse = await client.get( | ||
| `/cms/api/passwordless/token/${token}` | ||
| ) | ||
|
|
||
| expect(loginResponse.status).toBe(302) | ||
| expect(loginResponse.headers['location']).toBe('/cms') | ||
| }) | ||
|
|
||
| test('redirects user to login when token is invalid or malformed', async () => { | ||
| const mailerMock = getFakeMailer() | ||
|
|
||
| const email = fakeUser().email | ||
|
|
||
| const { | ||
| app, | ||
| ctx: { | ||
| orm: { em } | ||
| } | ||
| } = await setup([cms().plugin(), setupFakeMailer(mailerMock)], false) | ||
|
|
||
| const client = (SupertestSession(app) as unknown) as SI<any> | ||
|
|
||
| const csrf = await getCmsCsrfToken(client) | ||
|
|
||
| // Clear all existing administrators and passwordless tokens. | ||
| await em.nativeDelete('AdminToken', {}) | ||
| await em.nativeDelete('AdminUser', {}) | ||
|
|
||
| await client | ||
| .post('/cms/api/passwordless/email/register') | ||
| .set('X-XSRF-TOKEN', csrf) | ||
| .send({ | ||
| }) | ||
|
|
||
| const loginResponse = await client.get( | ||
| `/cms/api/passwordless/token/WRONG_TOKEN` | ||
| ) | ||
|
|
||
| expect(loginResponse.status).toBe(302) | ||
| expect(loginResponse.headers['location']).toBe( | ||
| '/cms/auth/login?error=Your%20login%20credentials%20are%20invalid.%20Please%20try%20again.' | ||
| ) | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| export * from '../../../helpers' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters