test(server): auth tests (#6135)

packages/backend/server/tests/auth/controller.spec.ts

@@ -0,0 +1,164 @@
+import { HttpStatus, INestApplication } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
+import ava, { TestFn } from 'ava';
+import Sinon from 'sinon';
+import request from 'supertest';
+
+import { AuthModule, CurrentUser } from '../../src/core/auth';
+import { AuthService } from '../../src/core/auth/service';
+import { FeatureModule } from '../../src/core/features';
+import { UserModule, UserService } from '../../src/core/user';
+import { MailService } from '../../src/fundamentals';
+import { createTestingApp, getSession, sessionCookie } from '../utils';
+
+const test = ava as TestFn<{
+  auth: AuthService;
+  user: UserService;
+  u1: CurrentUser;
+  db: PrismaClient;
+  mailer: Sinon.SinonStubbedInstance<MailService>;
+  app: INestApplication;
+}>;
+
+test.beforeEach(async t => {
+  const { app } = await createTestingApp({
+    imports: [FeatureModule, UserModule, AuthModule],
+    tapModule: m => {
+      m.overrideProvider(MailService).useValue(
+        Sinon.createStubInstance(MailService)
+      );
+    },
+  });
+
+  t.context.auth = app.get(AuthService);
+  t.context.user = app.get(UserService);
+  t.context.db = app.get(PrismaClient);
+  t.context.mailer = app.get(MailService);
+  t.context.app = app;
+
+  t.context.u1 = await t.context.auth.signUp('u1', 'u1@affine.pro', '1');
+});
+
+test.afterEach.always(async t => {
+  await t.context.app.close();
+});
+
+test('should be able to sign in with credential', async t => {
+  const { app, u1 } = t.context;
+
+  const res = await request(app.getHttpServer())
+    .post('/api/auth/sign-in')
+    .send({ email: u1.email, password: '1' })
+    .expect(200);
+
+  const session = await getSession(app, res);
+  t.is(session.user!.id, u1.id);
+});
+
+test('should be able to sign in with email', async t => {
+  const { app, u1, mailer } = t.context;
+
+  // @ts-expect-error mock
+  mailer.sendSignInMail.resolves({ rejected: [] });
+
+  const res = await request(app.getHttpServer())
+    .post('/api/auth/sign-in')
+    .send({ email: u1.email })
+    .expect(200);
+
+  t.is(res.body.email, u1.email);
+  t.true(mailer.sendSignInMail.calledOnce);
+
+  let [signInLink] = mailer.sendSignInMail.firstCall.args;
+  const url = new URL(signInLink);
+  signInLink = url.pathname + url.search;
+
+  const signInRes = await request(app.getHttpServer())
+    .get(signInLink)
+    .expect(302);
+
+  const session = await getSession(app, signInRes);
+  t.is(session.user!.id, u1.id);
+});
+
+test('should be able to sign up with email', async t => {
+  const { app, mailer } = t.context;
+
+  // @ts-expect-error mock
+  mailer.sendSignUpMail.resolves({ rejected: [] });
+
+  const res = await request(app.getHttpServer())
+    .post('/api/auth/sign-in')
+    .send({ email: 'u2@affine.pro' })
+    .expect(200);
+
+  t.is(res.body.email, 'u2@affine.pro');
+  t.true(mailer.sendSignUpMail.calledOnce);
+
+  let [signUpLink] = mailer.sendSignUpMail.firstCall.args;
+  const url = new URL(signUpLink);
+  signUpLink = url.pathname + url.search;
+
+  const signInRes = await request(app.getHttpServer())
+    .get(signUpLink)
+    .expect(302);
+
+  const session = await getSession(app, signInRes);
+  t.is(session.user!.email, 'u2@affine.pro');
+});
+
+test('should not be able to sign in if email is invalid', async t => {
+  const { app } = t.context;
+
+  const res = await request(app.getHttpServer())
+    .post('/api/auth/sign-in')
+    .send({ email: '' })
+    .expect(400);
+
+  t.is(res.body.message, 'Invalid email address');
+});
+
+test('should not be able to sign in if forbidden', async t => {
+  const { app, auth, u1, mailer } = t.context;
+
+  const canSignInStub = Sinon.stub(auth, 'canSignIn').resolves(false);
+
+  await request(app.getHttpServer())
+    .post('/api/auth/sign-in')
+    .send({ email: u1.email })
+    .expect(HttpStatus.PAYMENT_REQUIRED);
+
+  t.true(mailer.sendSignInMail.notCalled);
+
+  canSignInStub.restore();
+});
+
+test('should be able to sign out', async t => {
+  const { app, u1 } = t.context;
+
+  const signInRes = await request(app.getHttpServer())
+    .post('/api/auth/sign-in')
+    .send({ email: u1.email, password: '1' })
+    .expect(200);
+
+  const cookie = sessionCookie(signInRes.headers);
+
+  await request(app.getHttpServer())
+    .get('/api/auth/sign-out')
+    .set('cookie', cookie)
+    .expect(200);
+
+  const session = await getSession(app, signInRes);
+
+  t.falsy(session.user);
+});
+
+test('should not be able to sign out if not signed in', async t => {
+  const { app } = t.context;
+
+  await request(app.getHttpServer())
+    .get('/api/auth/sign-out')
+    .expect(HttpStatus.UNAUTHORIZED);
+
+  t.assert(true);
+});

packages/backend/server/tests/auth/guard.spec.ts

@@ -0,0 +1,131 @@
+import { Controller, Get, HttpStatus, INestApplication } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
+import ava, { TestFn } from 'ava';
+import Sinon from 'sinon';
+import request from 'supertest';
+
+import {
+  AuthGuard,
+  AuthModule,
+  CurrentUser,
+  Public,
+} from '../../src/core/auth';
+import { AuthService } from '../../src/core/auth/service';
+import { createTestingApp } from '../utils';
+
+@Controller('/')
+class TestController {
+  @Public()
+  @Get('/public')
+  home(@CurrentUser() user?: CurrentUser) {
+    return { user };
+  }
+
+  @Get('/private')
+  private(@CurrentUser() user: CurrentUser) {
+    return { user };
+  }
+}
+
+const test = ava as TestFn<{
+  app: INestApplication;
+  auth: Sinon.SinonStubbedInstance<AuthService>;
+}>;
+
+test.beforeEach(async t => {
+  const { app } = await createTestingApp({
+    imports: [AuthModule],
+    providers: [
+      {
+        provide: APP_GUARD,
+        useClass: AuthGuard,
+      },
+    ],
+    controllers: [TestController],
+    tapModule: m => {
+      m.overrideProvider(AuthService).useValue(
+        Sinon.createStubInstance(AuthService)
+      );
+    },
+  });
+
+  t.context.auth = app.get(AuthService);
+  t.context.app = app;
+});
+
+test.afterEach.always(async t => {
+  await t.context.app.close();
+});
+
+test('should be able to visit public api if not signed in', async t => {
+  const { app } = t.context;
+
+  const res = await request(app.getHttpServer()).get('/public').expect(200);
+
+  t.is(res.body.user, undefined);
+});
+
+test('should be able to visit public api if signed in', async t => {
+  const { app, auth } = t.context;
+
+  // @ts-expect-error mock
+  auth.getUser.resolves({ id: '1' });
+
+  const res = await request(app.getHttpServer())
+    .get('/public')
+    .set('Cookie', 'sid=1')
+    .expect(HttpStatus.OK);
+
+  t.is(res.body.user.id, '1');
+});
+
+test('should not be able to visit private api if not signed in', async t => {
+  const { app } = t.context;
+
+  await request(app.getHttpServer())
+    .get('/private')
+    .expect(HttpStatus.UNAUTHORIZED)
+    .expect({
+      statusCode: 401,
+      message: 'You are not signed in.',
+      error: 'Unauthorized',
+    });
+
+  t.assert(true);
+});
+
+test('should be able to visit private api if signed in', async t => {
+  const { app, auth } = t.context;
+
+  // @ts-expect-error mock
+  auth.getUser.resolves({ id: '1' });
+
+  const res = await request(app.getHttpServer())
+    .get('/private')
+    .set('Cookie', 'sid=1')
+    .expect(HttpStatus.OK);
+
+  t.is(res.body.user.id, '1');
+});
+
+test('should be able to parse session cookie', async t => {
+  const { app, auth } = t.context;
+
+  await request(app.getHttpServer())
+    .get('/public')
+    .set('cookie', 'sid=1')
+    .expect(200);
+
+  t.deepEqual(auth.getUser.firstCall.args, ['1', 0]);
+});
+
+test('should be able to parse bearer token', async t => {
+  const { app, auth } = t.context;
+
+  await request(app.getHttpServer())
+    .get('/public')
+    .auth('1', { type: 'bearer' })
+    .expect(200);
+
+  t.deepEqual(auth.getUser.firstCall.args, ['1', 0]);
+});

packages/backend/server/tests/auth/service.spec.ts

@@ -0,0 +1,219 @@
+import { TestingModule } from '@nestjs/testing';
+import { PrismaClient } from '@prisma/client';
+import ava, { TestFn } from 'ava';
+
+import { CurrentUser } from '../../src/core/auth';
+import { AuthService, parseAuthUserSeqNum } from '../../src/core/auth/service';
+import { FeatureModule } from '../../src/core/features';
+import { UserModule, UserService } from '../../src/core/user';
+import { createTestingModule } from '../utils';
+
+const test = ava as TestFn<{
+  auth: AuthService;
+  user: UserService;
+  u1: CurrentUser;
+  db: PrismaClient;
+  m: TestingModule;
+}>;
+
+test.beforeEach(async t => {
+  const m = await createTestingModule({
+    imports: [FeatureModule, UserModule],
+    providers: [AuthService],
+  });
+
+  t.context.auth = m.get(AuthService);
+  t.context.user = m.get(UserService);
+  t.context.db = m.get(PrismaClient);
+  t.context.m = m;
+
+  t.context.u1 = await t.context.auth.signUp('u1', 'u1@affine.pro', '1');
+});
+
+test.afterEach.always(async t => {
+  await t.context.m.close();
+});
+
+test('should be able to parse auth user seq num', t => {
+  t.deepEqual(
+    [
+      '1',
+      '2',
+      3,
+      -3,
+      '-4',
+      '1.1',
+      'str',
+      '1111111111111111111111111111111111111111111',
+    ].map(parseAuthUserSeqNum),
+    [1, 2, 3, 0, 0, 0, 0, 0]
+  );
+});
+
+test('should be able to sign up', async t => {
+  const { auth } = t.context;
+  const u2 = await auth.signUp('u2', 'u2@affine.pro', '1');
+
+  t.is(u2.email, 'u2@affine.pro');
+
+  const signedU2 = await auth.signIn(u2.email, '1');
+
+  t.is(u2.email, signedU2.email);
+});
+
+test('should throw if email duplicated', async t => {
+  const { auth } = t.context;
+
+  await t.throwsAsync(() => auth.signUp('u1', 'u1@affine.pro', '1'), {
+    message: 'Email was taken',
+  });
+});
+
+test('should be able to sign in', async t => {
+  const { auth } = t.context;
+
+  const signedInUser = await auth.signIn('u1@affine.pro', '1');
+
+  t.is(signedInUser.email, 'u1@affine.pro');
+});
+
+test('should throw if user not found', async t => {
+  const { auth } = t.context;
+
+  await t.throwsAsync(() => auth.signIn('u2@affine.pro', '1'), {
+    message: 'Invalid sign in credentials',
+  });
+});
+
+test('should throw if password not set', async t => {
+  const { user, auth } = t.context;
+
+  await user.createUser({
+    email: 'u2@affine.pro',
+    name: 'u2',
+  });
+
+  await t.throwsAsync(() => auth.signIn('u2@affine.pro', '1'), {
+    message: 'User Password is not set. Should login through email link.',
+  });
+});
+
+test('should throw if password not match', async t => {
+  const { auth } = t.context;
+
+  await t.throwsAsync(() => auth.signIn('u1@affine.pro', '2'), {
+    message: 'Invalid sign in credentials',
+  });
+});
+
+test('should be able to change password', async t => {
+  const { auth, u1 } = t.context;
+
+  let signedInU1 = await auth.signIn('u1@affine.pro', '1');
+  t.is(signedInU1.email, u1.email);
+
+  await auth.changePassword(u1.id, '2');
+
+  await t.throwsAsync(
+    () => auth.signIn('u1@affine.pro', '1' /* old password */),
+    {
+      message: 'Invalid sign in credentials',
+    }
+  );
+
+  signedInU1 = await auth.signIn('u1@affine.pro', '2');
+  t.is(signedInU1.email, u1.email);
+});
+
+test('should be able to change email', async t => {
+  const { auth, u1 } = t.context;
+
+  let signedInU1 = await auth.signIn('u1@affine.pro', '1');
+  t.is(signedInU1.email, u1.email);
+
+  await auth.changeEmail(u1.id, 'u2@affine.pro');
+
+  await t.throwsAsync(() => auth.signIn('u1@affine.pro' /* old email */, '1'), {
+    message: 'Invalid sign in credentials',
+  });
+
+  signedInU1 = await auth.signIn('u2@affine.pro', '1');
+  t.is(signedInU1.email, 'u2@affine.pro');
+});
+
+// Tests for Session
+test('should be able to create user session', async t => {
+  const { auth, u1 } = t.context;
+
+  const session = await auth.createUserSession(u1);
+
+  t.is(session.userId, u1.id);
+});
+
+test('should be able to get user from session', async t => {
+  const { auth, u1 } = t.context;
+
+  const session = await auth.createUserSession(u1);
+
+  const user = await auth.getUser(session.sessionId);
+
+  t.not(user, null);
+  t.is(user!.id, u1.id);
+});
+
+test('should be able to sign out session', async t => {
+  const { auth, u1 } = t.context;
+
+  const session = await auth.createUserSession(u1);
+
+  const signedOutSession = await auth.signOut(session.sessionId);
+
+  t.is(signedOutSession, null);
+});
+
+// Tests for Multi-Accounts Session
+test('should be able to sign in different user in a same session', async t => {
+  const { auth, u1 } = t.context;
+
+  const u2 = await auth.signUp('u2', 'u2@affine.pro', '1');
+
+  const session = await auth.createUserSession(u1);
+  await auth.createUserSession(u2, session.sessionId);
+
+  const [signedU1, signedU2] = await auth.getUserList(session.sessionId);
+
+  t.not(signedU1, null);
+  t.not(signedU2, null);
+  t.is(signedU1!.id, u1.id);
+  t.is(signedU2!.id, u2.id);
+});
+
+test('should be able to signout multi accounts session', async t => {
+  const { auth, u1 } = t.context;
+
+  const u2 = await auth.signUp('u2', 'u2@affine.pro', '1');
+
+  const session = await auth.createUserSession(u1);
+  await auth.createUserSession(u2, session.sessionId);
+
+  // sign out user at seq(0)
+  let signedOutSession = await auth.signOut(session.sessionId);
+
+  t.not(signedOutSession, null);
+
+  const signedU2 = await auth.getUser(session.sessionId, 0);
+  const noUser = await auth.getUser(session.sessionId, 1);
+
+  t.is(noUser, null);
+  t.not(signedU2, null);
+
+  t.is(signedU2!.id, u2.id);
+
+  // sign out user at seq(0)
+  signedOutSession = await auth.signOut(session.sessionId);
+
+  t.is(signedOutSession, null);
+
+  const noUser2 = await auth.getUser(session.sessionId, 0);
+  t.is(noUser2, null);
+});

packages/backend/server/tests/auth/token.spec.ts

@@ -0,0 +1,93 @@
+import { TestingModule } from '@nestjs/testing';
+import { PrismaClient } from '@prisma/client';
+import ava, { TestFn } from 'ava';
+
+import { TokenService, TokenType } from '../../src/core/auth';
+import { createTestingModule } from '../utils';
+
+const test = ava as TestFn<{
+  ts: TokenService;
+  m: TestingModule;
+}>;
+
+test.beforeEach(async t => {
+  const m = await createTestingModule({
+    providers: [TokenService],
+  });
+
+  t.context.ts = m.get(TokenService);
+  t.context.m = m;
+});
+
+test.afterEach.always(async t => {
+  await t.context.m.close();
+});
+
+test('should be able to create token', async t => {
+  const { ts } = t.context;
+  const token = await ts.createToken(TokenType.SignIn, 'user@affine.pro');
+
+  t.truthy(
+    await ts.verifyToken(TokenType.SignIn, token, {
+      credential: 'user@affine.pro',
+    })
+  );
+});
+
+test('should fail the verification if the token is invalid', async t => {
+  const { ts } = t.context;
+
+  const token = await ts.createToken(TokenType.SignIn, 'user@affine.pro');
+
+  // wrong type
+  t.falsy(
+    await ts.verifyToken(TokenType.ChangeEmail, token, {
+      credential: 'user@affine.pro',
+    })
+  );
+
+  // no credential
+  t.falsy(await ts.verifyToken(TokenType.SignIn, token));
+
+  // wrong credential
+  t.falsy(
+    await ts.verifyToken(TokenType.SignIn, token, {
+      credential: 'wrong@affine.pro',
+    })
+  );
+});
+
+test('should fail if the token expired', async t => {
+  const { ts } = t.context;
+  const token = await ts.createToken(TokenType.SignIn, 'user@affine.pro');
+
+  await t.context.m.get(PrismaClient).verificationToken.updateMany({
+    data: {
+      expiresAt: new Date(Date.now() - 1000),
+    },
+  });
+
+  t.falsy(
+    await ts.verifyToken(TokenType.SignIn, token, {
+      credential: 'user@affine.pro',
+    })
+  );
+});
+
+test('should be able to verify only once', async t => {
+  const { ts } = t.context;
+  const token = await ts.createToken(TokenType.SignIn, 'user@affine.pro');
+
+  t.truthy(
+    await ts.verifyToken(TokenType.SignIn, token, {
+      credential: 'user@affine.pro',
+    })
+  );
+
+  // will be invalid after the first time of verification
+  t.falsy(
+    await ts.verifyToken(TokenType.SignIn, token, {
+      credential: 'user@affine.pro',
+    })
+  );
+});