budibase/packages/server/tests/authenticate.js

const statusCodes = require("../utilities/statusCodes")
const { readFile } = require("fs-extra")
const { timeout } = require("./helpers")

module.exports = (app, appName, userName) => {
  const credentials = app.credentials[userName]

  it("should return unauthorized if username is incorrect", async () => {
    await app
      .post(`/${appName}/api/authenticate`, {
        username: "unknownuser",
        password: credentials.password,
      })
      .expect(statusCodes.UNAUTHORIZED)
  })

  it("should return unauthorized if password is incorrect", async () => {
    await app
      .post(`/${appName}/api/authenticate`, {
        username: credentials.username,
        password: "incorrect_password",
      })
      .expect(statusCodes.UNAUTHORIZED)
  })

  it("should not get cookie when unauthorized", async () => {
    const response = await app.post(`/${appName}/api/authenticate`, {
      username: credentials.username,
      password: "incorrect_password",
    })

    expect(response.header["set-cookie"]).toBeUndefined()
  })

  it("should return ok correct username and password supplied", async () => {
    const response = await app
      .post(`/${appName}/api/authenticate`, {
        username: credentials.username,
        password: credentials.password,
      })
      .expect(statusCodes.OK)

    credentials.cookie = response.header["set-cookie"]
  })

  const testUserName = appName + "_test_user"
  let testPassword = "test_user_password"
  it("should be able to create new user with authenticated cookie", async () => {
    await app
      .post(`/${appName}/api/createUser`, {
        user: {
          name: testUserName,
          accessLevels: ["owner"],
          enabled: true,
        },
        password: testPassword,
      })
      .set("cookie", credentials.cookie)
      .expect(statusCodes.OK)
  })

  let newUserCookie
  it("should be able to authenticate with new user", async () => {
    const responseNewUser = await app
      .post(`/${appName}/api/authenticate`, {
        username: testUserName,
        password: testPassword,
      })
      .expect(statusCodes.OK)

    newUserCookie = responseNewUser.header["set-cookie"]

    expect(newUserCookie).toBeDefined()
    expect(newUserCookie).not.toEqual(credentials.cookie)

    app
      .get("/_master/api/users/")
      .set("cookie", newUserCookie)
      .expect(statusCodes.OK)
  })

  it("should not be able to perform requests when user is disabled", async () => {
    //HERE
    await app
      .post(`/${appName}/api/disableUser`, {
        username: testUserName,
      })
      .set("cookie", credentials.cookie)
      .expect(statusCodes.OK)

    await app
      .get(`/${appName}/api/users`)
      .set("cookie", newUserCookie)
      .expect(statusCodes.UNAUTHORIZED)

    await app
      .post(`/${appName}/api/authenticate`, {
        username: testUserName,
        password: testPassword,
      })
      .expect(statusCodes.UNAUTHORIZED)
  })

  it("should not be able to re-authenticate when user is disabled", async () => {
    await app
      .post(`/${appName}/api/authenticate`, {
        username: testUserName,
        password: testPassword,
      })
      .expect(statusCodes.UNAUTHORIZED)
  })

  it("should be able with re-authenticate when user is enabled again", async () => {
    await app
      .post(`/${appName}/api/enableUser`, {
        username: testUserName,
      })
      .set("cookie", credentials.cookie)
      .expect(statusCodes.OK)

    await app
      .post(`/${appName}/api/authenticate`, {
        username: testUserName,
        password: testPassword,
      })
      .expect(statusCodes.OK)
  })

  let testUserTempCode
  it("should be able to reset password with temporary access", async () => {
    await app
      .post(`/${appName}/api/createTemporaryAccess`, {
        username: testUserName,
      })
      .expect(statusCodes.OK)

    testPassword = "test_user_new_password"

    // the behaviour that creates the below file is async,
    /// to this timeout is giving it a change to work its magic
    await timeout(10)

    const testUserTempCode = await readFile(
      `./tests/.data/tempaccess${testUserName}`,
      "utf8"
    )

    await app
      .post(`/${appName}/api/setPasswordFromTemporaryCode`, {
        username: testUserName,
        tempCode: testUserTempCode,
        newPassword: testPassword,
      })
      .expect(statusCodes.OK)

    await app
      .post(`/${appName}/api/authenticate`, {
        username: testUserName,
        password: testPassword,
      })
      .expect(statusCodes.OK)
  })

  it("should not be able to set password with used temp code", async () => {
    await app
      .post(`/${appName}/api/setPasswordFromTemporaryCode`, {
        username: testUserName,
        tempCode: testUserTempCode,
        newPassword: "whatever",
      })
      .expect(statusCodes.OK)

    await app
      .post(`/${appName}/api/authenticate`, {
        username: testUserName,
        password: "whatever",
      })
      .expect(statusCodes.UNAUTHORIZED)

    await app
      .post(`/${appName}/api/authenticate`, {
        username: testUserName,
        password: testPassword,
      })
      .expect(statusCodes.OK)
  })
}