103 lines
5.2 KiB
JavaScript
103 lines
5.2 KiB
JavaScript
import { test, after } from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import { startAppwriteMock } from './support/appwriteMock.js'
|
|
import { startFakeStripe } from './support/fakeStripe.js'
|
|
import { useTestEnv } from './support/testEnv.js'
|
|
|
|
// Portal-Login: Kunden wie bisher; Mitarbeiter (mit oder ohne 2FA) arbeiten im Ticketsystem (Etappe 4)
|
|
const aw = await startAppwriteMock()
|
|
const st = await startFakeStripe()
|
|
useTestEnv({ appwriteUrl: aw.url, stripeUrl: st.url })
|
|
const { config } = await import('../server/config.js')
|
|
const { startTestApp, post, rawGet, sessionCookie } = await import('./support/testApp.js')
|
|
const { viewAsCookie } = await import('./support/fixtures.js')
|
|
const { default: authRoutes } = await import('../server/routes/auth.js')
|
|
const app = await startTestApp({ '/api/auth': authRoutes })
|
|
after(() => Promise.all([app.close(), aw.close(), st.close()]))
|
|
|
|
aw.addUser({ $id: 'u_kunde', email: 'kunde@example.invalid', password: 'kunde-kunde' })
|
|
aw.addUser({ $id: 'u_ohne', email: 'justin@webklar.com', password: 'ohne-ohne-ohne' })
|
|
aw.addUser({ $id: 'u_mfa', email: 'kenso@webklar.com', password: 'mit-mit-mit', mfa: true, emailVerification: true, labels: ['admin'] })
|
|
aw.addUser({ $id: 'u_label', email: 'label@webklar.com', password: 'label-label', labels: ['admin'] })
|
|
aw.seed('customers', { $id: 'c1', appwriteUserId: 'u_kunde', email: 'kunde@example.invalid', name: 'Kunde', customerStatus: 'active', portalAccessEnabled: true })
|
|
aw.seed('customerPortalAccess', { $id: 'pa1', customerId: 'c1', enabled: true })
|
|
aw.seed('employees', { $id: 'e1', userId: 'u_ohne', displayName: 'Justin', email: 'justin@webklar.com' })
|
|
aw.seed('employees', { $id: 'e2', userId: 'u_mfa', displayName: 'Kenso', email: 'kenso@webklar.com' })
|
|
|
|
const SESSION = config.cookieName
|
|
const STAFF_BLOCKED = { error: 'Mitarbeiter arbeiten im Ticketsystem.', ticketUrl: 'https://ticket.webklar.com' }
|
|
const setCookies = (res) => res.headers.getSetCookie()
|
|
const cleared = (c) => /Expires=Thu, 01 Jan 1970/.test(c)
|
|
const liveCookies = (res, name) => setCookies(res).filter((c) => c.startsWith(`${name}=`) && !cleared(c))
|
|
const clears = (res, name) => setCookies(res).some((c) => c.startsWith(`${name}=`) && cleared(c))
|
|
const login = (email, password) => post('/api/auth/login', { email, password })
|
|
|
|
test('Kunde meldet sich weiter normal an', async () => {
|
|
const before = aw.sessionDeletes()
|
|
const res = await login('kunde@example.invalid', 'kunde-kunde')
|
|
assert.equal(res.status, 200)
|
|
assert.equal(res.body.role, 'customer')
|
|
assert.equal(liveCookies(res, SESSION).length, 1)
|
|
assert.equal(aw.sessionDeletes(), before)
|
|
})
|
|
|
|
test('Mitarbeiter ohne 2FA: 403 mit Link ins Ticketsystem, keine Sitzung, Appwrite-Sitzung beendet', async () => {
|
|
const before = aw.sessionDeletes()
|
|
const res = await login('justin@webklar.com', 'ohne-ohne-ohne')
|
|
assert.equal(res.status, 403)
|
|
assert.deepEqual(res.body, STAFF_BLOCKED)
|
|
assert.equal(liveCookies(res, SESSION).length, 0)
|
|
assert.equal(liveCookies(res, 'preview_session').length, 0)
|
|
assert.equal(aw.sessionDeletes(), before + 1)
|
|
})
|
|
|
|
test('Mitarbeiter mit 2FA: dieselbe Antwort, keine Code-Mail', async () => {
|
|
const before = aw.sessionDeletes()
|
|
const res = await login('kenso@webklar.com', 'mit-mit-mit')
|
|
assert.equal(res.status, 403)
|
|
assert.deepEqual(res.body, STAFF_BLOCKED)
|
|
assert.equal(setCookies(res).filter((c) => !cleared(c)).length, 0)
|
|
assert.equal(aw.mailsSent('u_mfa'), 0)
|
|
assert.equal(aw.sessionDeletes(), before + 1)
|
|
})
|
|
|
|
test('Nur Label admin (ohne employees-Eintrag): ebenfalls gesperrt', async () => {
|
|
const res = await login('label@webklar.com', 'label-label')
|
|
assert.equal(res.status, 403)
|
|
assert.deepEqual(res.body, STAFF_BLOCKED)
|
|
assert.equal(liveCookies(res, SESSION).length, 0)
|
|
})
|
|
|
|
test('Konto-Abruf gestoert: Mitarbeiter bleibt gesperrt (employees-Treffer)', async () => {
|
|
aw.failUserLookups(true)
|
|
try {
|
|
const res = await login('kenso@webklar.com', 'mit-mit-mit')
|
|
assert.equal(res.status, 403)
|
|
assert.deepEqual(res.body, STAFF_BLOCKED)
|
|
assert.equal(liveCookies(res, SESSION).length, 0)
|
|
} finally {
|
|
aw.failUserLookups(false)
|
|
}
|
|
})
|
|
|
|
test('/me mit alter Mitarbeiter-Sitzung: reason staff, Weiterleitung, Cookies geloescht', async () => {
|
|
const res = await rawGet('/api/auth/me', { cookie: sessionCookie({ role: 'admin', appwriteUserId: 'u_mfa', name: 'Kenso', email: 'kenso@webklar.com' }) })
|
|
assert.equal(res.status, 200)
|
|
assert.deepEqual(res.body, { authenticated: false, reason: 'staff', redirect: 'https://ticket.webklar.com' })
|
|
assert.ok(clears(res, SESSION))
|
|
assert.ok(clears(res, 'preview_session'))
|
|
assert.equal(liveCookies(res, 'preview_session').length, 0)
|
|
})
|
|
|
|
test('/me mit Alt-Ansicht (viewAs ohne viewId): ebenso reason staff', async () => {
|
|
const res = await rawGet('/api/auth/me', { cookie: viewAsCookie('c1') })
|
|
assert.deepEqual(res.body, { authenticated: false, reason: 'staff', redirect: 'https://ticket.webklar.com' })
|
|
assert.ok(clears(res, SESSION))
|
|
})
|
|
|
|
test('/login/mfa, /login/mfa/resend und /staff-switch gibt es nicht mehr (404)', async () => {
|
|
assert.equal((await post('/api/auth/login/mfa', { otp: '123456' })).status, 404)
|
|
assert.equal((await post('/api/auth/login/mfa/resend', {})).status, 404)
|
|
assert.equal((await rawGet('/api/auth/staff-switch?token=abc')).status, 404)
|
|
})
|