budibase/packages/core/test/authApi.changePassword.spec.js

import {
  setupApphierarchy,
  validUser,
  basicAppHierarchyCreator_WithFields,
} from "./specHelpers"
import {
  parseTemporaryCode,
  userAuthFile,
  USERS_LIST_FILE,
  getUserByName,
} from "../src/authApi/authCommon"

describe("authApi > changeMyPassword", () => {
  it("should be able to authenticate after a change", async () => {
    const { authApi, app } = await setupApphierarchy(
      basicAppHierarchyCreator_WithFields
    )
    const u = await validUser(app, authApi, "firstpassword")
    const firstPasswordCheck = await authApi.authenticate(
      u.name,
      "firstpassword"
    )
    expect(firstPasswordCheck).not.toBeNull()
    const changeResult = await authApi.changeMyPassword(
      "firstpassword",
      "secondpassword"
    )
    expect(changeResult).toBe(true)
    const firstPasswordReCheck = await authApi.authenticate(
      u.name,
      "firstpassword"
    )
    expect(firstPasswordReCheck).toBeNull()
    const secondPasswordCheck = await authApi.authenticate(
      u.name,
      "secondpassword"
    )
    expect(secondPasswordCheck).not.toBeNull()
  })

  it("should not change password if current password is incorrect", async () => {
    const { authApi, app } = await setupApphierarchy(
      basicAppHierarchyCreator_WithFields
    )
    const u = await validUser(app, authApi, "firstpassword")
    const changeResult = await authApi.changeMyPassword(
      "not-firstpassword",
      "secondpassword"
    )
    expect(changeResult).toBe(false)
    const secondPasswordCheck = await authApi.authenticate(
      u.name,
      "secondpassword"
    )
    expect(secondPasswordCheck).toBeNull()
  })

  it("should be allowed with no permissions", async () => {
    const { authApi, app } = await setupApphierarchy(
      basicAppHierarchyCreator_WithFields
    )
    const u = await validUser(app, authApi, "firstpassword")
    app.withNoPermissions()
    await authApi.changeMyPassword("firstpassword", "secondpassword")
  })
})

describe("authApi > resetPasswordFlow", () => {
  it("should successfully set password from temporary access", async () => {
    const { authApi, app } = await setupApphierarchy(
      basicAppHierarchyCreator_WithFields
    )
    const u = await validUser(app, authApi, "firstpassword")

    const tempCode = await authApi.createTemporaryAccess(u.name)

    const result = await authApi.setPasswordFromTemporaryCode(
      tempCode,
      "secondpassword"
    )
    expect(result).toBe(true)
    const secondPasswordCheck = await authApi.authenticate(
      u.name,
      "secondpassword"
    )
    expect(secondPasswordCheck).not.toBeNull()
  })

  it("should not set password when temporary access expired", async () => {
    const { authApi, app } = await setupApphierarchy(
      basicAppHierarchyCreator_WithFields
    )
    const u = await validUser(app, authApi, "firstpassword")

    const tempCode = await authApi.createTemporaryAccess(u.name)

    const userAuth = await app.datastore.loadJson(userAuthFile(u.name))
    userAuth.temporaryAccessExpiryEpoch = 0
    await app.datastore.updateJson(userAuthFile(u.name), userAuth)
    const result = await authApi.setPasswordFromTemporaryCode(
      tempCode,
      "secondpassword"
    )
    expect(result).toBe(false)
    const secondPasswordCheck = await authApi.authenticate(
      u.name,
      "secondpassword"
    )
    expect(secondPasswordCheck).toBeNull()
  })

  it("should still be able to authenticate with password when temp access is set", async () => {
    const { authApi, app } = await setupApphierarchy(
      basicAppHierarchyCreator_WithFields
    )
    const u = await validUser(app, authApi, "firstpassword")

    await authApi.createTemporaryAccess(u.name)

    const secondPasswordCheck = await authApi.authenticate(
      u.name,
      "firstpassword"
    )
    expect(secondPasswordCheck).not.toBeNull()
  })
})

describe("authApi > createTemporaryAccess", () => {
  it("should set users accessId annd userAuth hash and expiry", async () => {
    const { authApi, app } = await setupApphierarchy(
      basicAppHierarchyCreator_WithFields
    )
    const u = await validUser(app, authApi, "firstpassword")

    const tempCode = await authApi.createTemporaryAccess(u.name)
    const tempInfo = parseTemporaryCode(tempCode)

    const userAuth = await app.datastore.loadJson(userAuthFile(u.name))

    const currentTime = await app.getEpochTime()
    expect(
      app.crypto.verify(userAuth.temporaryAccessHash, tempInfo.code)
    ).toBeTruthy()
    expect(userAuth.temporaryAccessExpiryEpoch).toBeGreaterThan(currentTime)

    const users = await app.datastore.loadJson(USERS_LIST_FILE)
    const user = getUserByName(users, u.name)

    expect(user.temporaryAccessId).toBe(tempInfo.id)
  })

  it("should be allowed with no permissions", async () => {
    const { authApi, app } = await setupApphierarchy(
      basicAppHierarchyCreator_WithFields
    )
    const u = await validUser(app, authApi, "firstpassword")
    app.withNoPermissions()
    await authApi.createTemporaryAccess(u.name)
  })
})