|
@@ -21,6 +21,10 @@ describe "AuthenticationController", ->
|
|
|
"../User/UserHandler": @UserHandler = {setupLoginData:sinon.stub()}
|
|
"../User/UserHandler": @UserHandler = {setupLoginData:sinon.stub()}
|
|
|
"logger-sharelatex": @logger = { log: sinon.stub(), error: sinon.stub() }
|
|
"logger-sharelatex": @logger = { log: sinon.stub(), error: sinon.stub() }
|
|
|
"settings-sharelatex": {}
|
|
"settings-sharelatex": {}
|
|
|
|
|
+ "../User/UserSessionsManager": @UserSessionsManager =
|
|
|
|
|
+ trackSession: sinon.stub()
|
|
|
|
|
+ untrackSession: sinon.stub()
|
|
|
|
|
+ revokeAllUserSessions: sinon.stub().callsArgWith(1, null)
|
|
|
@user =
|
|
@user =
|
|
|
_id: ObjectId()
|
|
_id: ObjectId()
|
|
|
email: @email = "USER@example.com"
|
|
email: @email = "USER@example.com"
|
|
@@ -57,7 +61,7 @@ describe "AuthenticationController", ->
|
|
|
@res.statusCode.should.equal 429
|
|
@res.statusCode.should.equal 429
|
|
|
done()
|
|
done()
|
|
|
@AuthenticationController.login(@req, @res)
|
|
@AuthenticationController.login(@req, @res)
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
describe 'when the user is authenticated', ->
|
|
describe 'when the user is authenticated', ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@LoginRateLimiter.processLoginRequest.callsArgWith(1, null, true)
|
|
@LoginRateLimiter.processLoginRequest.callsArgWith(1, null, true)
|
|
@@ -76,7 +80,7 @@ describe "AuthenticationController", ->
|
|
|
@AuthenticationController.establishUserSession
|
|
@AuthenticationController.establishUserSession
|
|
|
.calledWith(@req, @user)
|
|
.calledWith(@req, @user)
|
|
|
.should.equal true
|
|
.should.equal true
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should set res.session.justLoggedIn", ->
|
|
it "should set res.session.justLoggedIn", ->
|
|
|
@req.session.justLoggedIn.should.equal true
|
|
@req.session.justLoggedIn.should.equal true
|
|
|
|
|
|
|
@@ -95,7 +99,7 @@ describe "AuthenticationController", ->
|
|
|
@logger.log
|
|
@logger.log
|
|
|
.calledWith(email: @email.toLowerCase(), user_id: @user._id.toString(), "successful log in")
|
|
.calledWith(email: @email.toLowerCase(), user_id: @user._id.toString(), "successful log in")
|
|
|
.should.equal true
|
|
.should.equal true
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
|
|
|
|
|
describe 'when the user is not authenticated', ->
|
|
describe 'when the user is not authenticated', ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
@@ -112,7 +116,7 @@ describe "AuthenticationController", ->
|
|
|
|
|
|
|
|
it "should not establish a session", ->
|
|
it "should not establish a session", ->
|
|
|
@AuthenticationController.establishUserSession.called.should.equal false
|
|
@AuthenticationController.establishUserSession.called.should.equal false
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should not setup the user data in the background", ->
|
|
it "should not setup the user data in the background", ->
|
|
|
@UserHandler.setupLoginData.called.should.equal false
|
|
@UserHandler.setupLoginData.called.should.equal false
|
|
|
|
|
|
|
@@ -137,12 +141,12 @@ describe "AuthenticationController", ->
|
|
|
describe "getLoggedInUserId", ->
|
|
describe "getLoggedInUserId", ->
|
|
|
|
|
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
- @req =
|
|
|
|
|
|
|
+ @req =
|
|
|
session :{}
|
|
session :{}
|
|
|
|
|
|
|
|
it "should return the user id from the session", (done)->
|
|
it "should return the user id from the session", (done)->
|
|
|
@user_id = "2134"
|
|
@user_id = "2134"
|
|
|
- @req.session.user =
|
|
|
|
|
|
|
+ @req.session.user =
|
|
|
_id:@user_id
|
|
_id:@user_id
|
|
|
@AuthenticationController.getLoggedInUserId @req, (err, user_id)=>
|
|
@AuthenticationController.getLoggedInUserId @req, (err, user_id)=>
|
|
|
expect(user_id).to.equal @user_id
|
|
expect(user_id).to.equal @user_id
|
|
@@ -168,7 +172,7 @@ describe "AuthenticationController", ->
|
|
|
describe "getLoggedInUser", ->
|
|
describe "getLoggedInUser", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@UserGetter.getUser = sinon.stub().callsArgWith(1, null, @user)
|
|
@UserGetter.getUser = sinon.stub().callsArgWith(1, null, @user)
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
describe "with an established session", ->
|
|
describe "with an established session", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@req.session =
|
|
@req.session =
|
|
@@ -189,7 +193,7 @@ describe "AuthenticationController", ->
|
|
|
_id: "user-id-123"
|
|
_id: "user-id-123"
|
|
|
email: "user@sharelatex.com"
|
|
email: "user@sharelatex.com"
|
|
|
@middleware = @AuthenticationController.requireLogin()
|
|
@middleware = @AuthenticationController.requireLogin()
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
describe "when the user is logged in", ->
|
|
describe "when the user is logged in", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@req.session =
|
|
@req.session =
|
|
@@ -219,13 +223,13 @@ describe "AuthenticationController", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@req.headers = {}
|
|
@req.headers = {}
|
|
|
@AuthenticationController.httpAuth = sinon.stub()
|
|
@AuthenticationController.httpAuth = sinon.stub()
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
describe "with white listed url", ->
|
|
describe "with white listed url", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@AuthenticationController.addEndpointToLoginWhitelist "/login"
|
|
@AuthenticationController.addEndpointToLoginWhitelist "/login"
|
|
|
@req._parsedUrl.pathname = "/login"
|
|
@req._parsedUrl.pathname = "/login"
|
|
|
@AuthenticationController.requireGlobalLogin @req, @res, @next
|
|
@AuthenticationController.requireGlobalLogin @req, @res, @next
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should call next() directly", ->
|
|
it "should call next() directly", ->
|
|
|
@next.called.should.equal true
|
|
@next.called.should.equal true
|
|
|
|
|
|
|
@@ -235,9 +239,9 @@ describe "AuthenticationController", ->
|
|
|
@req._parsedUrl.pathname = "/login"
|
|
@req._parsedUrl.pathname = "/login"
|
|
|
@req.url = "/login?query=something"
|
|
@req.url = "/login?query=something"
|
|
|
@AuthenticationController.requireGlobalLogin @req, @res, @next
|
|
@AuthenticationController.requireGlobalLogin @req, @res, @next
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should call next() directly", ->
|
|
it "should call next() directly", ->
|
|
|
- @next.called.should.equal true
|
|
|
|
|
|
|
+ @next.called.should.equal true
|
|
|
|
|
|
|
|
describe "with http auth", ->
|
|
describe "with http auth", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
@@ -248,20 +252,20 @@ describe "AuthenticationController", ->
|
|
|
@AuthenticationController.httpAuth
|
|
@AuthenticationController.httpAuth
|
|
|
.calledWith(@req, @res, @next)
|
|
.calledWith(@req, @res, @next)
|
|
|
.should.equal true
|
|
.should.equal true
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
describe "with a user session", ->
|
|
describe "with a user session", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@req.session =
|
|
@req.session =
|
|
|
user: {"mock": "user"}
|
|
user: {"mock": "user"}
|
|
|
@AuthenticationController.requireGlobalLogin @req, @res, @next
|
|
@AuthenticationController.requireGlobalLogin @req, @res, @next
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should call next() directly", ->
|
|
it "should call next() directly", ->
|
|
|
@next.called.should.equal true
|
|
@next.called.should.equal true
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
describe "with no login credentials", ->
|
|
describe "with no login credentials", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@AuthenticationController.requireGlobalLogin @req, @res, @next
|
|
@AuthenticationController.requireGlobalLogin @req, @res, @next
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should redirect to the /login page", ->
|
|
it "should redirect to the /login page", ->
|
|
|
@res.redirectedTo.should.equal "/login"
|
|
@res.redirectedTo.should.equal "/login"
|
|
|
|
|
|
|
@@ -274,7 +278,7 @@ describe "AuthenticationController", ->
|
|
|
@req.query = {}
|
|
@req.query = {}
|
|
|
|
|
|
|
|
describe "they have come directly to the url", ->
|
|
describe "they have come directly to the url", ->
|
|
|
- beforeEach ->
|
|
|
|
|
|
|
+ beforeEach ->
|
|
|
@req.query = {}
|
|
@req.query = {}
|
|
|
@middleware(@req, @res, @next)
|
|
@middleware(@req, @res, @next)
|
|
|
|
|
|
|
@@ -284,7 +288,7 @@ describe "AuthenticationController", ->
|
|
|
|
|
|
|
|
describe "they have come via a templates link", ->
|
|
describe "they have come via a templates link", ->
|
|
|
|
|
|
|
|
- beforeEach ->
|
|
|
|
|
|
|
+ beforeEach ->
|
|
|
@req.query.zipUrl = "something"
|
|
@req.query.zipUrl = "something"
|
|
|
@middleware(@req, @res, @next)
|
|
@middleware(@req, @res, @next)
|
|
|
|
|
|
|
@@ -293,8 +297,8 @@ describe "AuthenticationController", ->
|
|
|
@AuthenticationController._redirectToLoginPage.calledWith(@req, @res).should.equal false
|
|
@AuthenticationController._redirectToLoginPage.calledWith(@req, @res).should.equal false
|
|
|
|
|
|
|
|
describe "they have been invited to a project", ->
|
|
describe "they have been invited to a project", ->
|
|
|
-
|
|
|
|
|
- beforeEach ->
|
|
|
|
|
|
|
+
|
|
|
|
|
+ beforeEach ->
|
|
|
@req.query.project_name = "something"
|
|
@req.query.project_name = "something"
|
|
|
@middleware(@req, @res, @next)
|
|
@middleware(@req, @res, @next)
|
|
|
|
|
|
|
@@ -333,7 +337,7 @@ describe "AuthenticationController", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@UserUpdater.updateUser = sinon.stub().callsArg(2)
|
|
@UserUpdater.updateUser = sinon.stub().callsArg(2)
|
|
|
@AuthenticationController._recordSuccessfulLogin(@user._id, @callback)
|
|
@AuthenticationController._recordSuccessfulLogin(@user._id, @callback)
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should increment the user.login.success metric", ->
|
|
it "should increment the user.login.success metric", ->
|
|
|
@Metrics.inc
|
|
@Metrics.inc
|
|
|
.calledWith("user.login.success")
|
|
.calledWith("user.login.success")
|
|
@@ -349,7 +353,7 @@ describe "AuthenticationController", ->
|
|
|
describe "_recordFailedLogin", ->
|
|
describe "_recordFailedLogin", ->
|
|
|
beforeEach ->
|
|
beforeEach ->
|
|
|
@AuthenticationController._recordFailedLogin(@callback)
|
|
@AuthenticationController._recordFailedLogin(@callback)
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should increment the user.login.failed metric", ->
|
|
it "should increment the user.login.failed metric", ->
|
|
|
@Metrics.inc
|
|
@Metrics.inc
|
|
|
.calledWith("user.login.failed")
|
|
.calledWith("user.login.failed")
|
|
@@ -374,13 +378,12 @@ describe "AuthenticationController", ->
|
|
|
@req.session.user.last_name.should.equal @user.last_name
|
|
@req.session.user.last_name.should.equal @user.last_name
|
|
|
@req.session.user.referal_id.should.equal @user.referal_id
|
|
@req.session.user.referal_id.should.equal @user.referal_id
|
|
|
@req.session.user.isAdmin.should.equal @user.isAdmin
|
|
@req.session.user.isAdmin.should.equal @user.isAdmin
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should destroy the session", ->
|
|
it "should destroy the session", ->
|
|
|
@req.session.destroy.called.should.equal true
|
|
@req.session.destroy.called.should.equal true
|
|
|
-
|
|
|
|
|
|
|
+
|
|
|
it "should regenerate the session to protect against session fixation", ->
|
|
it "should regenerate the session to protect against session fixation", ->
|
|
|
@req.sessionStore.generate.calledWith(@req).should.equal true
|
|
@req.sessionStore.generate.calledWith(@req).should.equal true
|
|
|
|
|
|
|
|
it "should return the callback", ->
|
|
it "should return the callback", ->
|
|
|
@callback.called.should.equal true
|
|
@callback.called.should.equal true
|
|
|
-
|
|
|