Paddy
7aac07a013
Introduces src/models/admin/, a dedicated identity and permissions module on its own nachklang_admin database, and the shared authenticator that feedback and tickets will move onto in the cutover step. Nothing swaps over yet: feedback.auth.ts and tickets.auth.ts still authenticate against the legacy calendar sessions, so production behaviour is unchanged. - better-auth 1.7 mounted at /admin/auth/*, sessions as httpOnly cookies scoped to .nachklang.art so one sign-in covers every *.nachklang.art app. - Accounts are invite-only: public sign-up is disabled, and the invitations plugin is the only code that creates users. Tokens are stored as SHA-256 hashes and travel in the request body, never in a URL. - Per-app permissions in user_app_permissions; requireAppAccess(app) queries the database on every request (no cookie cache) so disabling a user or revoking a session takes effect immediately. - ADMIN_BOOTSTRAP_EMAIL guarantees a way in on an empty database, idempotently and without crashing the API if the database is unreachable at boot. - Guards prevent an admin from removing their own admin permission, disabling themselves, or stripping the last active admin. The admin pool uses the callback-style mysql2, not mysql2/promise: Kysely's MysqlDialect drives the pool with callbacks, and the promise wrapper ignores them, so every query hangs silently. Only the integration tests caught this. Schema in sql/admin/001_init.sql, derived from getAuthTables() on the installed better-auth rather than the published CLI, which lags the library and omits account.issuer. app.ts is split into src/app.factory.ts so the integration tests drive the real middleware order rather than a copy of it. Tests: 131 unit, plus 41 integration tests against a throwaway MariaDB started by test/integration/setup.ts (docker or podman). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
72 lines
2.6 KiB
TypeScript
72 lines
2.6 KiB
TypeScript
import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
|
|
|
|
vi.mock('../../src/common/common.mail.js', () => ({
|
|
MailService: {sendMail: vi.fn()}
|
|
}));
|
|
vi.mock('../../src/models/admin/admin.config.js', () => ({
|
|
ADMIN_APP_URL: 'https://admin.nachklang.art'
|
|
}));
|
|
|
|
import {MailService} from '../../src/common/common.mail.js';
|
|
import {sendInvitationMail, sendPasswordResetMail} from '../../src/models/admin/admin.mail.js';
|
|
|
|
const sendMail = MailService.sendMail as Mock;
|
|
|
|
beforeEach(() => {
|
|
sendMail.mockReset();
|
|
sendMail.mockResolvedValue(true);
|
|
});
|
|
|
|
describe('sendInvitationMail', () => {
|
|
it('points at the admin app and carries the token in the query string', async () => {
|
|
await sendInvitationMail('a@nachklang.art', 'Anna', 'tok-en_123', new Date('2026-09-12T10:00:00Z'));
|
|
|
|
const [to, subject, text, options] = sendMail.mock.calls[0];
|
|
expect(to).toBe('a@nachklang.art');
|
|
expect(subject).toBeTruthy();
|
|
expect(text).toContain('https://admin.nachklang.art/accept-invite?token=tok-en_123');
|
|
expect(options.html).toContain('https://admin.nachklang.art/accept-invite?token=tok-en_123');
|
|
});
|
|
|
|
it('url-encodes a token containing url-significant characters', async () => {
|
|
await sendInvitationMail('a@nachklang.art', 'Anna', 'a+b/c=d', new Date());
|
|
|
|
const [, , text] = sendMail.mock.calls[0];
|
|
expect(text).toContain('token=a%2Bb%2Fc%3Dd');
|
|
});
|
|
|
|
it('sends both a text and an html part', async () => {
|
|
await sendInvitationMail('a@nachklang.art', 'Anna', 'tok', new Date());
|
|
|
|
const [, , text, options] = sendMail.mock.calls[0];
|
|
expect(text.length).toBeGreaterThan(0);
|
|
expect(options.html).toContain('<html');
|
|
});
|
|
|
|
it('escapes a name that contains html', async () => {
|
|
await sendInvitationMail('a@nachklang.art', '<script>alert(1)</script>', 'tok', new Date());
|
|
|
|
const [, , , options] = sendMail.mock.calls[0];
|
|
expect(options.html).not.toContain('<script>');
|
|
expect(options.html).toContain('<script>');
|
|
});
|
|
|
|
it('reports a delivery failure to the caller rather than throwing', async () => {
|
|
sendMail.mockResolvedValue(false);
|
|
|
|
await expect(sendInvitationMail('a@nachklang.art', 'Anna', 'tok', new Date())).resolves.toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('sendPasswordResetMail', () => {
|
|
it('uses the url better-auth generated, unchanged', async () => {
|
|
const url = 'https://api.nachklang.art/admin/auth/reset-password/abc?callbackURL=x';
|
|
|
|
await sendPasswordResetMail('a@nachklang.art', 'Anna', url);
|
|
|
|
const [, , text, options] = sendMail.mock.calls[0];
|
|
expect(text).toContain(url);
|
|
expect(options.html).toContain('https://api.nachklang.art/admin/auth/reset-password/abc');
|
|
});
|
|
});
|