Paddy
3ea9e630ed
Prep PR for the admin auth module (docs/plan-admin-auth.md step 1).
better-auth 1.7 ships ESM only, so the API moves off CommonJS:
- "type": "module", module nodenext, target ES2024, .js suffixes on all
relative imports, require('mariadb'|'cors') replaced by imports, and
export= packages (winston, app-root-path, bcrypt) consumed via default
imports. The logger now uses appRoot.path explicitly.
- TypeScript 5.9, @types/node 26, tslint removed. Node 26 pinned via
engines and .nvmrc (Plesk runs 26).
- Jest 28 + ts-jest replaced by vitest 5. Eight test files depend on
hoisted module mocks with static imports and resetModules + require,
which Jest's ESM mode does not support; vitest keeps them nearly
verbatim. Coverage via @vitest/coverage-v8 (lcov), Sonar generic report
via vitest-sonar-reporter, so sonar-project.properties is unchanged.
vitest.config.ts sets FEEDBACK_IP_SALT so the suite passes without a
local .env.
- dotenv 8 -> 16 and axios 0.24 -> 1.x: their old typings are not
resolvable under nodenext.
- autoCommit: false dropped from the pool configs; it is not a mariadb
connector option and was silently ignored.
tsc clean, 96/96 tests green, compiled app boots and serves /, /docs and
CORS under Node ESM.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
89 lines
3.4 KiB
TypeScript
89 lines
3.4 KiB
TypeScript
import {vi, describe, it, expect, beforeEach, type Mock} from 'vitest';
|
|
import {Request, Response} from 'express';
|
|
|
|
vi.mock('../../src/models/calendar/users/users.service.js', () => ({
|
|
checkSession: vi.fn()
|
|
}));
|
|
|
|
import * as UserService from '../../src/models/calendar/users/users.service.js';
|
|
import {requireAdminAuth, sessionHeaderAuthenticator} from '../../src/models/feedback/feedback.auth.js';
|
|
|
|
const mockCheckSession = UserService.checkSession as Mock;
|
|
|
|
const makeReq = (headers: Record<string, string>): Request => {
|
|
return {
|
|
header: (name: string) => headers[name],
|
|
ip: '203.0.113.42'
|
|
} as unknown as Request;
|
|
};
|
|
|
|
const makeRes = (): Response => {
|
|
const res: any = {};
|
|
res.status = vi.fn().mockReturnValue(res);
|
|
res.send = vi.fn().mockReturnValue(res);
|
|
res.locals = {};
|
|
return res as Response;
|
|
};
|
|
|
|
describe('sessionHeaderAuthenticator', () => {
|
|
beforeEach(() => mockCheckSession.mockReset());
|
|
|
|
it('returns null when headers are missing', async () => {
|
|
const identity = await sessionHeaderAuthenticator(makeReq({}));
|
|
expect(identity).toBeNull();
|
|
expect(mockCheckSession).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('returns null when checkSession finds no user', async () => {
|
|
mockCheckSession.mockResolvedValue(null);
|
|
const identity = await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'}));
|
|
expect(identity).toBeNull();
|
|
});
|
|
|
|
it('returns null for a valid session on an inactive account', async () => {
|
|
mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'A', isActive: false});
|
|
const identity = await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'}));
|
|
expect(identity).toBeNull();
|
|
});
|
|
|
|
it('returns the identity for a valid session on an active account', async () => {
|
|
mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'Anna Admin', isActive: true});
|
|
const identity = await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'}));
|
|
expect(identity).toEqual({id: '1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
|
|
});
|
|
|
|
it('passes the session id and key from headers through to checkSession, never from query params', async () => {
|
|
mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'A', isActive: true});
|
|
await sessionHeaderAuthenticator(makeReq({'X-Session-Id': '42', 'X-Session-Key': 'sekret'}));
|
|
expect(mockCheckSession).toHaveBeenCalledWith('42', 'sekret', '203.0.113.42');
|
|
});
|
|
});
|
|
|
|
describe('requireAdminAuth', () => {
|
|
beforeEach(() => mockCheckSession.mockReset());
|
|
|
|
it('responds 401 and does not call next() when unauthenticated', async () => {
|
|
mockCheckSession.mockResolvedValue(null);
|
|
const req = makeReq({});
|
|
const res = makeRes();
|
|
const next = vi.fn();
|
|
|
|
await requireAdminAuth(req, res, next);
|
|
|
|
expect(res.status).toHaveBeenCalledWith(401);
|
|
expect(next).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('sets res.locals.admin and calls next() when authenticated', async () => {
|
|
mockCheckSession.mockResolvedValue({userId: 1, email: 'a@nachklang.art', fullName: 'Anna Admin', isActive: true});
|
|
const req = makeReq({'X-Session-Id': '1', 'X-Session-Key': 'k'});
|
|
const res = makeRes();
|
|
const next = vi.fn();
|
|
|
|
await requireAdminAuth(req, res, next);
|
|
|
|
expect(next).toHaveBeenCalled();
|
|
expect(res.locals.admin).toEqual({id: '1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
|
|
});
|
|
});
|