mirror of
https://github.com/penpot/penpot.git
synced 2026-05-10 18:48:23 +00:00
1094 lines
43 KiB
Clojure
1094 lines
43 KiB
Clojure
;; This Source Code Form is subject to the terms of the Mozilla Public
|
|
;; License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
;;
|
|
;; Copyright (c) KALEIDOS INC
|
|
|
|
(ns backend-tests.rpc-profile-test
|
|
(:require
|
|
[app.common.time :as ct]
|
|
[app.common.uuid :as uuid]
|
|
[app.config :as cf]
|
|
[app.db :as db]
|
|
[app.email.blacklist :as email.blacklist]
|
|
[app.email.whitelist :as email.whitelist]
|
|
[app.rpc :as-alias rpc]
|
|
[app.rpc.commands.profile :as profile]
|
|
[app.tokens :as tokens]
|
|
[backend-tests.helpers :as th]
|
|
[clojure.java.io :as io]
|
|
[clojure.test :as t]
|
|
[cuerdas.core :as str]
|
|
[datoteka.fs :as fs]
|
|
[mockery.core :refer [with-mocks]]))
|
|
|
|
;; TODO: profile deletion with teams
|
|
;; TODO: profile deletion with owner teams
|
|
|
|
(t/use-fixtures :once th/state-init)
|
|
(t/use-fixtures :each th/database-reset)
|
|
|
|
|
|
(t/deftest clean-email
|
|
(t/is "foo@example.com" (profile/clean-email "mailto:foo@example.com"))
|
|
(t/is "foo@example.com" (profile/clean-email "mailto:<foo@example.com>"))
|
|
(t/is "foo@example.com" (profile/clean-email "<foo@example.com>"))
|
|
(t/is "foo@example.com" (profile/clean-email "foo@example.com>"))
|
|
(t/is "foo@example.com" (profile/clean-email "<foo@example.com")))
|
|
|
|
;; Test with wrong credentials
|
|
(t/deftest profile-login-failed-1
|
|
(let [profile (th/create-profile* 1)
|
|
data {::th/type :login-with-password
|
|
:email "profile1.test@nodomain.com"
|
|
:password "foobar"}
|
|
out (th/command! data)]
|
|
|
|
#_(th/print-result! out)
|
|
(let [error (:error out)]
|
|
(t/is (th/ex-info? error))
|
|
(t/is (th/ex-of-type? error :validation))
|
|
(t/is (th/ex-of-code? error :wrong-credentials)))))
|
|
|
|
;; Test with good credentials but profile not activated.
|
|
(t/deftest profile-login-failed-2
|
|
(let [profile (th/create-profile* 1)
|
|
data {::th/type :login-with-password
|
|
:email "profile1.test@nodomain.com"
|
|
:password "123123"}
|
|
out (th/command! data)]
|
|
;; (th/print-result! out)
|
|
(let [error (:error out)]
|
|
(t/is (th/ex-info? error))
|
|
(t/is (th/ex-of-type? error :validation))
|
|
(t/is (th/ex-of-code? error :wrong-credentials)))))
|
|
|
|
;; Test with good credentials but profile already activated
|
|
(t/deftest profile-login-success
|
|
(let [profile (th/create-profile* 1 {:is-active true})
|
|
data {::th/type :login-with-password
|
|
:email "profile1.test@nodomain.com"
|
|
:password "123123"}
|
|
out (th/command! data)]
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= (:id profile) (get-in out [:result :id])))))
|
|
|
|
(t/deftest profile-query-and-manipulation
|
|
(let [profile (th/create-profile* 1)]
|
|
(t/testing "query profile"
|
|
(let [data {::th/type :get-profile
|
|
::rpc/profile-id (:id profile)}
|
|
out (th/command! data)]
|
|
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:error out)))
|
|
|
|
(let [result (:result out)]
|
|
(t/is (= "Profile 1" (:fullname result)))
|
|
(t/is (= "profile1.test@nodomain.com" (:email result)))
|
|
(t/is (not (contains? result :password))))))
|
|
|
|
(t/testing "update profile"
|
|
(let [data (assoc profile
|
|
::th/type :update-profile
|
|
::rpc/profile-id (:id profile)
|
|
:fullname "Full Name"
|
|
:lang "en"
|
|
:theme "dark")
|
|
out (th/command! data)]
|
|
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:error out)))
|
|
(t/is (map? (:result out)))))
|
|
|
|
(t/testing "query profile after update"
|
|
(let [data {::th/type :get-profile
|
|
::rpc/profile-id (:id profile)}
|
|
out (th/command! data)]
|
|
|
|
#_(th/print-result! out)
|
|
(t/is (nil? (:error out)))
|
|
|
|
(let [result (:result out)]
|
|
(t/is (= "Full Name" (:fullname result)))
|
|
(t/is (= "en" (:lang result)))
|
|
(t/is (= "dark" (:theme result))))))
|
|
|
|
(t/testing "update photo"
|
|
(let [data {::th/type :update-profile-photo
|
|
::rpc/profile-id (:id profile)
|
|
:file {:filename "sample.jpg"
|
|
:size 123123
|
|
:path (th/tempfile "backend_tests/test_files/sample.jpg")
|
|
:mtype "image/jpeg"}}
|
|
out (th/command! data)]
|
|
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:error out)))))
|
|
|
|
(t/testing "delete photo clears photo-id"
|
|
(let [data {::th/type :delete-profile-photo
|
|
::rpc/profile-id (:id profile)}
|
|
out (th/command! data)]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (nil? (:result out))))
|
|
|
|
(let [data {::th/type :get-profile
|
|
::rpc/profile-id (:id profile)}
|
|
out (th/command! data)]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (nil? (:photo-id (:result out))))))))
|
|
|
|
(t/deftest profile-deletion-1
|
|
(let [prof (th/create-profile* 1)
|
|
file (th/create-file* 1 {:profile-id (:id prof)
|
|
:project-id (:default-project-id prof)
|
|
:is-shared false})]
|
|
|
|
;; profile is not deleted because it does not meet all
|
|
;; conditions to be deleted.
|
|
(let [result (th/run-task! :objects-gc {:min-age 0})]
|
|
(t/is (= 0 (:processed result))))
|
|
|
|
;; Request profile to be deleted
|
|
(let [params {::th/type :delete-profile
|
|
::rpc/profile-id (:id prof)}
|
|
out (th/command! params)]
|
|
(t/is (nil? (:error out))))
|
|
|
|
;; query files after profile soft deletion
|
|
(let [params {::th/type :get-project-files
|
|
::rpc/profile-id (:id prof)
|
|
:project-id (:default-project-id prof)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= 1 (count (:result out)))))
|
|
|
|
(th/run-pending-tasks!)
|
|
|
|
(let [row (th/db-get :team
|
|
{:id (:default-team-id prof)}
|
|
{::db/remove-deleted false})]
|
|
(t/is (ct/inst? (:deleted-at row))))
|
|
|
|
;; execute permanent deletion task
|
|
(let [result (th/run-task! :objects-gc {:min-age 0})]
|
|
(t/is (= 6 (:processed result))))
|
|
|
|
(let [row (th/db-get :team
|
|
{:id (:default-team-id prof)}
|
|
{::db/remove-deleted false})]
|
|
(t/is (nil? row)))
|
|
|
|
;; query profile after delete
|
|
(let [params {::th/type :get-profile
|
|
::rpc/profile-id (:id prof)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
(let [result (:result out)]
|
|
(t/is (= uuid/zero (:id result)))))))
|
|
|
|
(t/deftest profile-deletion-2
|
|
(let [prof1 (th/create-profile* 1)
|
|
prof2 (th/create-profile* 2)
|
|
file1 (th/create-file* 1 {:profile-id (:id prof1)
|
|
:project-id (:default-project-id prof1)
|
|
:is-shared false})
|
|
team1 (th/create-team* 1 {:profile-id (:id prof1)})
|
|
|
|
role1 (th/create-team-role* {:team-id (:id team1)
|
|
:profile-id (:id prof2)
|
|
|
|
:role :editor})]
|
|
;; Assert all roles for team
|
|
(let [roles (th/db-query :team-profile-rel {:team-id (:id team1)})]
|
|
(t/is (= 2 (count roles))))
|
|
|
|
;; Request profile to be deleted
|
|
(let [params {::th/type :delete-profile
|
|
::rpc/profile-id (:id prof1)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
|
|
(let [error (:error out)
|
|
edata (ex-data error)]
|
|
(t/is (th/ex-info? error))
|
|
(t/is (= (:type edata) :validation))
|
|
(t/is (= (:code edata) :owner-teams-with-people)))
|
|
|
|
(let [params {::th/type :delete-team
|
|
::rpc/profile-id (:id prof1)
|
|
:id (:id team1)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
|
|
(let [team (th/db-get :team {:id (:id team1)} {::db/remove-deleted false})]
|
|
(t/is (ct/inst? (:deleted-at team)))))
|
|
|
|
;; Request profile to be deleted
|
|
(let [params {::th/type :delete-profile
|
|
::rpc/profile-id (:id prof1)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:result out)))
|
|
(t/is (nil? (:error out)))))))
|
|
|
|
(t/deftest profile-deletion-3
|
|
(let [prof1 (th/create-profile* 1)
|
|
prof2 (th/create-profile* 2)
|
|
prof3 (th/create-profile* 3)
|
|
file1 (th/create-file* 1 {:profile-id (:id prof1)
|
|
:project-id (:default-project-id prof1)
|
|
:is-shared false})
|
|
team1 (th/create-team* 1 {:profile-id (:id prof1)})
|
|
|
|
role1 (th/create-team-role* {:team-id (:id team1)
|
|
:profile-id (:id prof2)
|
|
:role :editor})
|
|
role2 (th/create-team-role* {:team-id (:id team1)
|
|
:profile-id (:id prof3)
|
|
:role :editor})]
|
|
|
|
;; Assert all roles for team
|
|
(let [roles (th/db-query :team-profile-rel {:team-id (:id team1)})]
|
|
(t/is (= 3 (count roles))))
|
|
|
|
;; Request profile to be deleted (it should fail)
|
|
(let [params {::th/type :delete-profile
|
|
::rpc/profile-id (:id prof1)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
|
|
(let [error (:error out)
|
|
edata (ex-data error)]
|
|
(t/is (th/ex-info? error))
|
|
(t/is (= (:type edata) :validation))
|
|
(t/is (= (:code edata) :owner-teams-with-people))))
|
|
|
|
;; Leave team by role 1
|
|
(let [params {::th/type :leave-team
|
|
::rpc/profile-id (:id prof2)
|
|
:id (:id team1)}
|
|
out (th/command! params)]
|
|
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:result out)))
|
|
(t/is (nil? (:error out))))
|
|
|
|
;; Request profile to be deleted (it should fail)
|
|
(let [params {::th/type :delete-profile
|
|
::rpc/profile-id (:id prof1)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
(let [error (:error out)
|
|
edata (ex-data error)]
|
|
(t/is (th/ex-info? error))
|
|
(t/is (= (:type edata) :validation))
|
|
(t/is (= (:code edata) :owner-teams-with-people))))
|
|
|
|
;; Leave team by role 0 (the default) and reassing owner to role 3
|
|
;; without reassinging it (should fail)
|
|
(let [params {::th/type :leave-team
|
|
::rpc/profile-id (:id prof1)
|
|
;; :reassign-to (:id prof3)
|
|
:id (:id team1)}
|
|
out (th/command! params)]
|
|
|
|
;; (th/print-result! out)
|
|
|
|
(let [error (:error out)
|
|
edata (ex-data error)]
|
|
(t/is (th/ex-info? error))
|
|
(t/is (= (:type edata) :validation))
|
|
(t/is (= (:code edata) :owner-cant-leave-team))))
|
|
|
|
;; Leave team by role 0 (the default) and reassing owner to role 3
|
|
(let [params {::th/type :leave-team
|
|
::rpc/profile-id (:id prof1)
|
|
:reassign-to (:id prof3)
|
|
:id (:id team1)}
|
|
out (th/command! params)]
|
|
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:result out)))
|
|
(t/is (nil? (:error out))))
|
|
|
|
;; Request profile to be deleted
|
|
(let [params {::th/type :delete-profile
|
|
::rpc/profile-id (:id prof1)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
|
|
(t/is (nil? (:result out)))
|
|
(t/is (nil? (:error out))))
|
|
|
|
;; query files after profile soft deletion
|
|
(let [params {::th/type :get-project-files
|
|
::rpc/profile-id (:id prof1)
|
|
:project-id (:default-project-id prof1)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= 1 (count (:result out)))))
|
|
|
|
(th/run-pending-tasks!)
|
|
|
|
;; execute permanent deletion task
|
|
(let [result (th/run-task! :objects-gc {:min-age 0})]
|
|
(t/is (= 6 (:processed result))))
|
|
|
|
(let [row (th/db-get :team
|
|
{:id (:default-team-id prof1)}
|
|
{::db/remove-deleted false})]
|
|
(t/is (nil? row)))
|
|
|
|
;; query profile after delete
|
|
(let [params {::th/type :get-profile
|
|
::rpc/profile-id (:id prof1)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
(let [result (:result out)]
|
|
(t/is (= uuid/zero (:id result)))))))
|
|
|
|
|
|
(t/deftest profile-deletion-4
|
|
(let [prof1 (th/create-profile* 1)
|
|
file1 (th/create-file* 1 {:profile-id (:id prof1)
|
|
:project-id (:default-project-id prof1)
|
|
:is-shared false})
|
|
team1 (th/create-team* 1 {:profile-id (:id prof1)})
|
|
team2 (th/create-team* 2 {:profile-id (:id prof1)})]
|
|
|
|
;; Request profile to be deleted
|
|
(let [params {::th/type :delete-profile
|
|
::rpc/profile-id (:id prof1)}
|
|
out (th/command! params)]
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:result out)))
|
|
(t/is (nil? (:error out))))
|
|
|
|
(th/run-pending-tasks!)
|
|
|
|
(let [rows (th/db-exec! ["select id,name,deleted_at from team where deleted_at is not null"])]
|
|
(t/is (= 3 (count rows))))
|
|
|
|
;; execute permanent deletion task
|
|
(let [result (th/run-task! :objects-gc {:min-age 0})]
|
|
(t/is (= 10 (:processed result))))))
|
|
|
|
|
|
(t/deftest email-blacklist-1
|
|
(t/is (false? (email.blacklist/enabled? th/*system*)))
|
|
(t/is (true? (email.blacklist/enabled? (assoc th/*system* :app.email/blacklist []))))
|
|
(t/is (true? (email.blacklist/contains? (assoc th/*system* :app.email/blacklist #{"foo.com"}) "AA@FOO.COM"))))
|
|
|
|
(t/deftest email-whitelist-1
|
|
(t/is (false? (email.whitelist/enabled? th/*system*)))
|
|
(t/is (true? (email.whitelist/enabled? (assoc th/*system* :app.email/whitelist []))))
|
|
(t/is (true? (email.whitelist/contains? (assoc th/*system* :app.email/whitelist #{"foo.com"}) "AA@FOO.COM"))))
|
|
|
|
(t/deftest prepare-register-and-register-profile-1
|
|
(let [data {::th/type :prepare-register-profile
|
|
:email "user@example.com"
|
|
:fullname "foobar"
|
|
:password "foobar"
|
|
:utm_campaign "utma"
|
|
:mtm_campaign "mtma"}
|
|
out (th/command! data)
|
|
token (get-in out [:result :token])]
|
|
(t/is (string? token))
|
|
|
|
;; try register without token
|
|
(let [data {::th/type :register-profile}
|
|
out (th/command! data)]
|
|
;; (th/print-result! out)
|
|
(let [error (:error out)]
|
|
(t/is (th/ex-info? error))
|
|
(t/is (th/ex-of-type? error :validation))
|
|
(t/is (th/ex-of-code? error :params-validation))))
|
|
|
|
;; try correct register
|
|
(let [data {::th/type :register-profile
|
|
:token token}
|
|
out (th/command! data)]
|
|
(t/is (nil? (:error out))))
|
|
|
|
(let [profile (some-> (th/db-get :profile {:email "user@example.com"})
|
|
(profile/decode-row))]
|
|
(t/is (= "penpot" (:auth-backend profile)))
|
|
(t/is (= "foobar" (:fullname profile)))
|
|
(t/is (false? (:is-active profile)))
|
|
(t/is (uuid? (:default-team-id profile)))
|
|
(t/is (uuid? (:default-project-id profile)))
|
|
|
|
(let [props (:props profile)]
|
|
(t/is (= "utma" (:penpot/utm-campaign props)))
|
|
(t/is (= "mtma" (:penpot/mtm-campaign props)))))))
|
|
|
|
(t/deftest prepare-register-and-register-profile-2
|
|
(with-mocks [mock {:target 'app.email/send! :return nil}]
|
|
(let [current-token (atom nil)]
|
|
;; PREPARE REGISTER
|
|
(let [data {::th/type :prepare-register-profile
|
|
:email "hello@example.com"
|
|
:fullname "foobar"
|
|
:password "foobar"}
|
|
out (th/command! data)
|
|
token (get-in out [:result :token])]
|
|
(t/is (th/success? out))
|
|
(reset! current-token token))
|
|
|
|
;; DO REGISTRATION
|
|
(let [data {::th/type :register-profile
|
|
:token @current-token}
|
|
out (th/command! data)]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= 1 (:call-count @mock))))
|
|
|
|
(th/reset-mock! mock)
|
|
|
|
;; PREPARE REGISTER: second attempt
|
|
(let [data {::th/type :prepare-register-profile
|
|
:email "hello@example.com"
|
|
:fullname "foobar"
|
|
:password "foobar"}
|
|
out (th/command! data)
|
|
token (get-in out [:result :token])]
|
|
(t/is (th/success? out))
|
|
(reset! current-token token))
|
|
|
|
;; DO REGISTRATION: second attempt
|
|
(let [data {::th/type :register-profile
|
|
:token @current-token
|
|
:fullname "foobar"
|
|
:accept-terms-and-privacy true
|
|
:accept-newsletter-subscription true}
|
|
out (th/command! data)]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= 0 (:call-count @mock))))
|
|
|
|
(with-mocks [_ {:target 'app.rpc.commands.auth/elapsed-verify-threshold?
|
|
:return true}]
|
|
;; DO REGISTRATION: third attempt
|
|
(let [data {::th/type :register-profile
|
|
:token @current-token
|
|
:fullname "foobar"
|
|
:accept-terms-and-privacy true
|
|
:accept-newsletter-subscription true}
|
|
out (th/command! data)]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= 1 (:call-count @mock))))))))
|
|
|
|
(t/deftest prepare-register-and-register-profile-3
|
|
(with-mocks [mock {:target 'app.email/send! :return nil}]
|
|
(let [current-token (atom nil)]
|
|
;; PREPARE REGISTER
|
|
(let [data {::th/type :prepare-register-profile
|
|
:email "hello@example.com"
|
|
:fullname "foobar"
|
|
:password "foobar"}
|
|
out (th/command! data)
|
|
token (get-in out [:result :token])]
|
|
(t/is (th/success? out))
|
|
(reset! current-token token))
|
|
|
|
;; DO REGISTRATION
|
|
(let [data {::th/type :register-profile
|
|
:token @current-token}
|
|
out (th/command! data)]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= 1 (:call-count @mock))))
|
|
|
|
(th/reset-mock! mock)
|
|
|
|
(th/db-update! :profile
|
|
{:is-blocked true}
|
|
{:email "hello@example.com"})
|
|
|
|
;; PREPARE REGISTER: second attempt
|
|
(let [data {::th/type :prepare-register-profile
|
|
:email "hello@example.com"
|
|
:fullname "foobar"
|
|
:password "foobar"}
|
|
out (th/command! data)
|
|
token (get-in out [:result :token])]
|
|
(t/is (th/success? out))
|
|
(reset! current-token token))
|
|
|
|
(with-mocks [_ {:target 'app.rpc.commands.auth/elapsed-verify-threshold?
|
|
:return true}]
|
|
;; DO REGISTRATION: second attempt
|
|
(let [data {::th/type :register-profile
|
|
:token @current-token}
|
|
out (th/command! data)]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (= 0 (:call-count @mock))))))))
|
|
|
|
(t/deftest prepare-and-register-with-invitation-and-enabled-registration-1
|
|
;; With email-verification ENABLED (the default), a brand-new
|
|
;; profile created via the invitation flow is NOT active yet, so
|
|
;; `register-profile` must NOT mint a session and must NOT echo
|
|
;; back the invitation token. Instead it must dispatch the
|
|
;; verify-email mail with the invitation token EMBEDDED into the
|
|
;; verify-email JWE (so the team-invitation flow can resume after
|
|
;; the user clicks the email link).
|
|
(with-mocks [mock {:target 'app.email/send! :return nil}]
|
|
(let [itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email "user@example.com"})
|
|
prep-data {::th/type :prepare-register-profile
|
|
:invitation-token itoken
|
|
:fullname "foobar"
|
|
:email "user@example.com"
|
|
:password "foobar"}
|
|
|
|
{prep-result :result prep-error :error} (th/command! prep-data)]
|
|
(t/is (nil? prep-error))
|
|
(t/is (map? prep-result))
|
|
(t/is (string? (:token prep-result)))
|
|
|
|
(let [reg-data {::th/type :register-profile
|
|
:token (:token prep-result)}
|
|
|
|
{reg-result :result reg-error :error} (th/command! reg-data)
|
|
mdata (meta reg-result)]
|
|
(t/is (nil? reg-error))
|
|
(t/is (map? reg-result))
|
|
|
|
;; No invitation token echoed back, no session minted.
|
|
(t/is (nil? (:invitation-token reg-result)))
|
|
(t/is (empty? (:app.rpc/response-transform-fns mdata)))
|
|
|
|
;; The verify-email mail was dispatched, and its token claims
|
|
;; carry the invitation-token through to the verification step.
|
|
(t/is (= 1 (:call-count @mock)))
|
|
(let [send-args (-> @mock :call-args)
|
|
email-token (->> send-args (some (fn [m] (when (map? m) (:token m)))))
|
|
vclaims (tokens/decode th/*system* email-token)]
|
|
(t/is (= :verify-email (:iss vclaims)))
|
|
(t/is (= itoken (:invitation-token vclaims))))))))
|
|
|
|
(t/deftest prepare-and-register-with-invitation-and-enabled-registration-1b
|
|
;; With email-verification DISABLED, the brand-new profile is
|
|
;; immediately active, so `register-profile` mints a session and
|
|
;; returns the regenerated invitation token in the body — the
|
|
;; frontend then redirects to :auth-verify-token to complete the
|
|
;; team-invitation flow.
|
|
(with-redefs [app.config/flags #{:registration :login-with-password}]
|
|
(let [itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email "user@example.com"})
|
|
prep-data {::th/type :prepare-register-profile
|
|
:invitation-token itoken
|
|
:fullname "foobar"
|
|
:email "user@example.com"
|
|
:password "foobar"}
|
|
|
|
{prep-result :result prep-error :error} (th/command! prep-data)]
|
|
(t/is (nil? prep-error))
|
|
(t/is (string? (:token prep-result)))
|
|
|
|
(let [reg-data {::th/type :register-profile
|
|
:token (:token prep-result)}
|
|
|
|
{reg-result :result reg-error :error} (th/command! reg-data)
|
|
mdata (meta reg-result)]
|
|
(t/is (nil? reg-error))
|
|
(t/is (map? reg-result))
|
|
|
|
;; Active branch: invitation-token is echoed back and a session
|
|
;; is minted via `session/create-fn`.
|
|
(t/is (string? (:invitation-token reg-result)))
|
|
(t/is (seq (:app.rpc/response-transform-fns mdata)))
|
|
(t/is (= "accept-invitation"
|
|
(get-in mdata [:app.loggers.audit/context :action])))))))
|
|
|
|
(t/deftest prepare-and-register-with-invitation-and-enabled-registration-2
|
|
(let [itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email "user2@example.com"})
|
|
|
|
data {::th/type :prepare-register-profile
|
|
:invitation-token itoken
|
|
:email "user@example.com"
|
|
:fullname "foobar"
|
|
:password "foobar"}
|
|
out (th/command! data)]
|
|
|
|
(t/is (not (th/success? out)))
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :restriction (:type edata)))
|
|
(t/is (= :email-does-not-match-invitation (:code edata))))))
|
|
|
|
(t/deftest prepare-and-register-with-invitation-and-disabled-registration-1
|
|
(with-redefs [app.config/flags [:disable-registration]]
|
|
(let [itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email "user@example.com"})
|
|
data {::th/type :prepare-register-profile
|
|
:invitation-token itoken
|
|
:fullname "foobar"
|
|
:email "user@example.com"
|
|
:password "foobar"}
|
|
out (th/command! data)]
|
|
|
|
(t/is (not (th/success? out)))
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :restriction (:type edata)))
|
|
(t/is (= :registration-disabled (:code edata)))))))
|
|
|
|
(t/deftest prepare-and-register-with-invitation-and-disabled-registration-2
|
|
(with-redefs [app.config/flags [:disable-registration]]
|
|
(let [itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email "user2@example.com"})
|
|
|
|
data {::th/type :prepare-register-profile
|
|
:invitation-token itoken
|
|
:email "user@example.com"
|
|
:fullname "foobar"
|
|
:password "foobar"}
|
|
out (th/command! data)]
|
|
|
|
(t/is (not (th/success? out)))
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :restriction (:type edata)))
|
|
(t/is (= :registration-disabled (:code edata)))))))
|
|
|
|
(t/deftest prepare-and-register-with-invitation-and-disabled-login-with-password
|
|
(with-redefs [app.config/flags [:disable-login-with-password]]
|
|
(let [itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email "user2@example.com"})
|
|
|
|
data {::th/type :prepare-register-profile
|
|
:invitation-token itoken
|
|
:fullname "foobar"
|
|
:email "user@example.com"
|
|
:password "foobar"}
|
|
out (th/command! data)]
|
|
|
|
(t/is (not (th/success? out)))
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :restriction (:type edata)))
|
|
(t/is (= :registration-disabled (:code edata)))))))
|
|
|
|
(t/deftest prepare-register-with-registration-disabled
|
|
(with-redefs [app.config/flags #{}]
|
|
(let [data {::th/type :prepare-register-profile
|
|
:fullname "foobar"
|
|
:email "user@example.com"
|
|
:password "foobar"}
|
|
out (th/command! data)]
|
|
|
|
(t/is (not (th/success? out)))
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :restriction (:type edata)))
|
|
(t/is (= :registration-disabled (:code edata)))))))
|
|
|
|
(t/deftest prepare-register-with-existing-user
|
|
(let [profile (th/create-profile* 1)
|
|
data {::th/type :prepare-register-profile
|
|
:fullname "foobar"
|
|
:email (:email profile)
|
|
:password "foobar"}
|
|
out (th/command! data)]
|
|
;; (th/print-result! out)
|
|
(t/is (th/success? out))
|
|
(let [result (:result out)]
|
|
(t/is (contains? result :token)))))
|
|
|
|
(t/deftest prepare-register-profile-with-bounced-email
|
|
|
|
(let [pool (:app.db/pool th/*system*)
|
|
data {::th/type :prepare-register-profile
|
|
:fullname "foobar"
|
|
:email "user@example.com"
|
|
:password "foobar"}]
|
|
|
|
(th/create-global-complaint-for pool {:type :bounce :email "user@example.com"})
|
|
|
|
(let [out (th/command! data)]
|
|
(t/is (not (th/success? out)))
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :restriction (:type edata)))
|
|
(t/is (= :email-has-permanent-bounces (:code edata)))))))
|
|
|
|
(t/deftest register-profile-with-complained-email
|
|
(let [pool (:app.db/pool th/*system*)
|
|
data {::th/type :prepare-register-profile
|
|
:fullname "foobar"
|
|
:email "user@example.com"
|
|
:password "foobar"}]
|
|
|
|
(th/create-global-complaint-for pool {:type :complaint :email "user@example.com"})
|
|
|
|
(let [out (th/command! data)]
|
|
(t/is (not (th/success? out)))
|
|
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :restriction (:type edata)))
|
|
(t/is (= :email-has-complaints (:code edata)))))))
|
|
|
|
(t/deftest register-profile-with-email-as-password
|
|
(let [data {::th/type :prepare-register-profile
|
|
:fullname "foobar"
|
|
:email "user@example.com"
|
|
:password "USER@example.com"}
|
|
out (th/command! data)]
|
|
|
|
(t/is (not (th/success? out)))
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :validation (:type edata)))
|
|
(t/is (= :email-as-password (:code edata))))))
|
|
|
|
(t/deftest prepare-register-rejects-active-profile-email
|
|
;; SECURITY: `prepare-register` must reject any attempt to prepare a
|
|
;; registration for an email that already belongs to an *active*
|
|
;; profile, regardless of whether an invitation token is supplied.
|
|
;; Active profiles must use the standard login flow.
|
|
(let [_victim (th/create-profile* 1 {:is-active true
|
|
:email "victim@corp.tld"})]
|
|
|
|
;; Without invitation token.
|
|
(let [out (th/command! {::th/type :prepare-register-profile
|
|
:fullname "Mallory"
|
|
:email "victim@corp.tld"
|
|
:password "Whatever1!"})]
|
|
(t/is (not (th/success? out)))
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :validation (:type edata)))
|
|
(t/is (= :email-already-exists (:code edata)))))
|
|
|
|
;; With invitation token (the GHSA-4937-35vc-hqjj exploit shape).
|
|
(let [itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email "victim@corp.tld"})
|
|
out (th/command! {::th/type :prepare-register-profile
|
|
:invitation-token itoken
|
|
:fullname "Mallory"
|
|
:email "victim@corp.tld"
|
|
:password "Whatever1!"})]
|
|
(t/is (not (th/success? out)))
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :validation (:type edata)))
|
|
(t/is (= :email-already-exists (:code edata)))))))
|
|
|
|
(t/deftest prepare-register-must-not-leak-existing-profile-id
|
|
;; Victim is a pre-existing profile that has not yet activated (e.g.
|
|
;; freshly registered, has not clicked the email verification link).
|
|
;; `prepare-register` allows the call (no active profile exists), but
|
|
;; the issued JWE must NOT carry the existing profile's id.
|
|
(let [_victim (th/create-profile* 1 {:is-active false
|
|
:email "victim@corp.tld"})
|
|
|
|
;; Attacker holds a cryptographically valid `:team-invitation` JWE
|
|
;; for the victim's email. (In a real exploit this is obtained
|
|
;; from `create-team-invitations` or `get-team-invitation-token`
|
|
;; on a team the attacker owns.)
|
|
itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email "victim@corp.tld"})
|
|
|
|
;; Anonymous request — no ::rpc/profile-id.
|
|
data {::th/type :prepare-register-profile
|
|
:invitation-token itoken
|
|
:fullname "Mallory"
|
|
:email "victim@corp.tld"
|
|
:password "Whatever1!"}
|
|
|
|
out (th/command! data)]
|
|
|
|
;; The current behaviour either returns a token or rejects the request;
|
|
;; what MUST hold is that the issued prepared-register JWE does not
|
|
;; carry the victim's profile id.
|
|
(t/is (th/success? out))
|
|
|
|
(let [token (-> out :result :token)
|
|
claims (tokens/decode th/*system* token)]
|
|
(t/is (= :prepared-register (:iss claims)))
|
|
;; This is the root-cause assertion: an anonymous prepare-register
|
|
;; call must NEVER embed an existing profile's id.
|
|
(t/is (nil? (:profile-id claims))
|
|
"prepare-register must not embed existing profile id of an anonymous caller"))))
|
|
|
|
(t/deftest register-profile-with-invitation-must-not-take-over-existing-account
|
|
(with-mocks [_mock {:target 'app.email/send! :return nil}]
|
|
(let [;; Victim profile exists but is not yet active (e.g. registered
|
|
;; but has not clicked the verification link). This is the
|
|
;; remaining attack surface after fix 1b: `prepare-register`
|
|
;; will not reject this case, so the `register-profile` path
|
|
;; must enforce the security invariants on its own.
|
|
victim (th/create-profile* 1 {:is-active false
|
|
:email "victim@corp.tld"})
|
|
|
|
;; Attacker mints a valid `:team-invitation` JWE for the victim's
|
|
;; email. No member-id is included (matches what an attacker
|
|
;; obtains via `create-team-invitations` against their own team
|
|
;; before the victim has joined).
|
|
itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email "victim@corp.tld"})
|
|
|
|
;; Step 1 (anonymous): prepare-register-profile with the victim's
|
|
;; email + the invitation token.
|
|
prep-out (th/command! {::th/type :prepare-register-profile
|
|
:invitation-token itoken
|
|
:fullname "Mallory"
|
|
:email "victim@corp.tld"
|
|
:password "Whatever1!"})
|
|
|
|
rtoken (-> prep-out :result :token)
|
|
|
|
;; Step 2 (anonymous): register-profile with the prepared token.
|
|
reg-out (th/command! {::th/type :register-profile
|
|
:token rtoken})
|
|
|
|
result (:result reg-out)
|
|
mdata (meta result)]
|
|
|
|
;; The first call may succeed; the issue is what the second call
|
|
;; produces. We assert the security invariants on its result.
|
|
(t/is (th/success? prep-out))
|
|
|
|
;; INVARIANT 1: register-profile must NOT install a session for the
|
|
;; victim. `session/create-fn` is wired via
|
|
;; `rph/with-transform`, which appends to
|
|
;; `:app.rpc/response-transform-fns`. If that vector is non-empty
|
|
;; for an anonymous register that targets an EXISTING profile, the
|
|
;; server is about to mint an `auth-token` cookie bound to the
|
|
;; victim — i.e. account takeover.
|
|
(t/is (empty? (:app.rpc/response-transform-fns mdata))
|
|
"register-profile must not create a session for an existing victim profile")
|
|
|
|
;; INVARIANT 2: register-profile must NOT echo back an invitation
|
|
;; token that authenticates as the victim. When the response
|
|
;; contains both `:id` matching the victim and `:invitation-token`,
|
|
;; the frontend treats the user as logged-in for that profile.
|
|
(when (and (map? result)
|
|
(= (:id victim) (:id result)))
|
|
(t/is (not (contains? result :invitation-token))
|
|
"register-profile must not return an invitation-token bound to an existing victim profile"))
|
|
|
|
;; INVARIANT 3: the server must NOT have taken the
|
|
;; "accept-invitation" branch (which is the one that mints a
|
|
;; session). For an existing victim profile, the operation
|
|
;; should fall through to the harmless "repeated registry" path.
|
|
(t/is (not= "accept-invitation"
|
|
(get-in mdata [:app.loggers.audit/context :action]))
|
|
"register-profile must not run the accept-invitation branch for an existing victim profile")
|
|
;; The victim must remain inactive: nothing in this anonymous
|
|
;; flow should have flipped `is-active` to true.
|
|
(let [reloaded (th/db-get :profile {:id (:id victim)})]
|
|
(t/is (false? (:is-active reloaded))
|
|
"register-profile must not activate the victim profile")))))
|
|
|
|
(t/deftest verify-email-with-invitation-token-propagates-it
|
|
;; A `:verify-email` JWE that carries `:invitation-token` (as
|
|
;; produced by `register-profile` for the not-active+invitation
|
|
;; case) must propagate that token through the verify-token RPC
|
|
;; result so the frontend can resume the team-invitation flow.
|
|
(let [profile (th/create-profile* 1 {:is-active false})
|
|
itoken (tokens/generate th/*system*
|
|
{:iss :team-invitation
|
|
:exp (ct/in-future "48h")
|
|
:role :editor
|
|
:team-id uuid/zero
|
|
:member-email (:email profile)})
|
|
vtoken (tokens/generate th/*system*
|
|
{:iss :verify-email
|
|
:exp (ct/in-future "72h")
|
|
:profile-id (:id profile)
|
|
:email (:email profile)
|
|
:invitation-token itoken})
|
|
|
|
out (th/command! {::th/type :verify-token
|
|
:token vtoken})
|
|
result (:result out)]
|
|
|
|
(t/is (th/success? out))
|
|
(t/is (= :verify-email (:iss result)))
|
|
(t/is (= itoken (:invitation-token result))
|
|
"verify-token must echo back the invitation-token from the verify-email JWE")
|
|
|
|
;; And the profile must now be active.
|
|
(let [reloaded (th/db-get :profile {:id (:id profile)})]
|
|
(t/is (true? (:is-active reloaded))))))
|
|
|
|
(t/deftest email-change-request
|
|
(with-mocks [mock {:target 'app.email/send! :return nil}]
|
|
(let [profile (th/create-profile* 1)
|
|
pool (:app.db/pool th/*system*)
|
|
data {::th/type :request-email-change
|
|
::rpc/profile-id (:id profile)
|
|
:email "user1@example.com"}]
|
|
|
|
;; without complaints
|
|
(let [out (th/command! data)]
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:result out)))
|
|
(let [mock @mock]
|
|
(t/is (= 1 (:call-count mock)))
|
|
(t/is (true? (:called? mock)))))
|
|
|
|
;; with complaints
|
|
(th/create-global-complaint-for pool {:type :complaint :email (:email data)})
|
|
(let [out (th/command! data)]
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:result out)))
|
|
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :restriction (:type edata)))
|
|
(t/is (= :email-has-complaints (:code edata))))
|
|
|
|
(t/is (= 1 (:call-count @mock))))
|
|
|
|
;; with bounces
|
|
(th/create-global-complaint-for pool {:type :bounce :email (:email data)})
|
|
(let [out (th/command! data)]
|
|
;; (th/print-result! out)
|
|
|
|
(let [edata (-> out :error ex-data)]
|
|
(t/is (= :restriction (:type edata)))
|
|
(t/is (= :email-has-permanent-bounces (:code edata))))
|
|
|
|
(t/is (= 1 (:call-count @mock)))))))
|
|
|
|
|
|
(t/deftest email-change-request-without-smtp
|
|
(with-mocks [mock {:target 'app.email/send! :return nil}]
|
|
(with-redefs [app.config/flags #{}]
|
|
(let [profile (th/create-profile* 1)
|
|
pool (:app.db/pool th/*system*)
|
|
data {::th/type :request-email-change
|
|
::rpc/profile-id (:id profile)
|
|
:email "user1@example.com"}
|
|
out (th/command! data)]
|
|
|
|
;; (th/print-result! out)
|
|
(t/is (false? (:called? @mock)))
|
|
(let [res (:result out)]
|
|
(t/is (= {:changed true} res)))))))
|
|
|
|
|
|
(t/deftest request-profile-recovery
|
|
(with-mocks [mock {:target 'app.email/send! :return nil}]
|
|
(let [profile1 (th/create-profile* 1 {:is-active false})
|
|
profile2 (th/create-profile* 2 {:is-active true})
|
|
pool (:app.db/pool th/*system*)
|
|
data {::th/type :request-profile-recovery}]
|
|
|
|
;; with invalid email
|
|
(let [data (assoc data :email "foo@bar.com")
|
|
out (th/command! data)]
|
|
(t/is (nil? (:result out)))
|
|
(t/is (= 0 (:call-count @mock))))
|
|
|
|
;; with valid email inactive user
|
|
(let [data (assoc data :email (:email profile1))
|
|
out (th/command! data)]
|
|
(t/is (= 0 (:call-count @mock)))
|
|
(t/is (nil? (:result out)))
|
|
(t/is (nil? (:error out))))
|
|
|
|
(with-mocks [_ {:target 'app.rpc.commands.auth/elapsed-verify-threshold?
|
|
:return true}]
|
|
;; with valid email inactive user
|
|
(let [data (assoc data :email (:email profile1))
|
|
out (th/command! data)]
|
|
(t/is (= 1 (:call-count @mock)))
|
|
(t/is (nil? (:result out)))
|
|
(t/is (nil? (:error out)))))
|
|
|
|
(th/reset-mock! mock)
|
|
|
|
;; with valid email and active user
|
|
(with-mocks [_ {:target 'app.rpc.commands.auth/elapsed-verify-threshold?
|
|
:return true}]
|
|
(let [data (assoc data :email (:email profile2))
|
|
out (th/command! data)]
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:result out)))
|
|
(t/is (= 1 (:call-count @mock))))
|
|
|
|
;; with valid email and active user with global complaints
|
|
(th/create-global-complaint-for pool {:type :complaint :email (:email profile2)})
|
|
(let [data (assoc data :email (:email profile2))
|
|
out (th/command! data)]
|
|
;; (th/print-result! out)
|
|
(t/is (nil? (:result out)))
|
|
(t/is (= 1 (:call-count @mock))))
|
|
|
|
;; with valid email and active user with global bounce
|
|
(th/create-global-complaint-for pool {:type :bounce :email (:email profile2)})
|
|
(let [data (assoc data :email (:email profile2))
|
|
out (th/command! data)]
|
|
(t/is (nil? (:result out)))
|
|
(t/is (nil? (:error out)))
|
|
;; (th/print-result! out)
|
|
(t/is (= 1 (:call-count @mock))))))))
|
|
|
|
|
|
(t/deftest update-profile-password
|
|
(let [profile (th/create-profile* 1)
|
|
data {::th/type :update-profile-password
|
|
::rpc/profile-id (:id profile)
|
|
:old-password "123123"
|
|
:password "foobarfoobar"}
|
|
out (th/command! data)]
|
|
(t/is (nil? (:error out)))
|
|
(t/is (nil? (:result out)))))
|
|
|
|
|
|
(t/deftest update-profile-password-bad-old-password
|
|
(let [profile (th/create-profile* 1)
|
|
data {::th/type :update-profile-password
|
|
::rpc/profile-id (:id profile)
|
|
:old-password "badpassword"
|
|
:password "foobarfoobar"}
|
|
{:keys [result error] :as out} (th/command! data)]
|
|
(t/is (th/ex-info? error))
|
|
(t/is (th/ex-of-type? error :validation))
|
|
(t/is (th/ex-of-code? error :old-password-not-match))))
|
|
|
|
|
|
(t/deftest update-profile-password-email-as-password
|
|
(let [profile (th/create-profile* 1)
|
|
data {::th/type :update-profile-password
|
|
::rpc/profile-id (:id profile)
|
|
:old-password "123123"
|
|
:password "profile1.test@nodomain.com"}
|
|
{:keys [result error] :as out} (th/command! data)]
|
|
(t/is (th/ex-info? error))
|
|
(t/is (th/ex-of-type? error :validation))
|
|
(t/is (th/ex-of-code? error :email-as-password))))
|