Overleaf/services/web/test/unit/src/User/UserRegistrationHandlerTests.js

const SandboxedModule = require('sandboxed-module')
const assert = require('assert')
const path = require('path')
const modulePath = path.join(
  __dirname,
  '../../../../app/src/Features/User/UserRegistrationHandler'
)
const sinon = require('sinon')
const { expect } = require('chai')
const EmailHelper = require('../../../../app/src/Features/Helpers/EmailHelper')

describe('UserRegistrationHandler', function () {
  beforeEach(function () {
    this.analyticsId = '123456'
    this.user = {
      _id: (this.user_id = '31j2lk21kjl'),
      analyticsId: this.analyticsId,
    }
    this.User = {
      updateOne: sinon.stub().returns({ exec: sinon.stub().resolves() }),
    }
    this.UserGetter = {
      promises: {
        getUserByAnyEmail: sinon.stub(),
      },
    }
    this.UserCreator = {
      promises: {
        createNewUser: sinon.stub().resolves(this.user),
      },
    }
    this.AuthenticationManager = {
      validateEmail: sinon.stub().returns(null),
      validatePassword: sinon.stub().returns(null),
      promises: {
        setUserPassword: sinon.stub().resolves(this.user),
      },
    }
    this.NewsLetterManager = {
      subscribe: sinon.stub(),
    }
    this.EmailHandler = {
      promises: { sendEmail: sinon.stub().resolves() },
    }
    this.OneTimeTokenHandler = { promises: { getNewToken: sinon.stub() } }
    this.handler = SandboxedModule.require(modulePath, {
      requires: {
        '../../models/User': { User: this.User },
        './UserGetter': this.UserGetter,
        './UserCreator': this.UserCreator,
        '../Authentication/AuthenticationManager': this.AuthenticationManager,
        '../Newsletter/NewsletterManager': this.NewsLetterManager,
        crypto: (this.crypto = {}),
        '../Email/EmailHandler': this.EmailHandler,
        '../Security/OneTimeTokenHandler': this.OneTimeTokenHandler,
        '../Analytics/AnalyticsManager': (this.AnalyticsManager = {
          recordEventForUser: sinon.stub(),
          setUserPropertyForUser: sinon.stub(),
          identifyUser: sinon.stub(),
        }),
        '@overleaf/settings': (this.settings = {
          siteUrl: 'http://sl.example.com',
        }),
        '../Helpers/EmailHelper': EmailHelper,
      },
    })

    this.passingRequest = {
      email: 'something@email.com',
      password: '123',
      analyticsId: this.analyticsId,
    }
  })

  describe('validate Register Request', function () {
    it('allows passing validation through', function () {
      const result = this.handler.promises._registrationRequestIsValid(
        this.passingRequest
      )
      result.should.equal(true)
    })

    describe('failing email validation', function () {
      beforeEach(function () {
        this.AuthenticationManager.validateEmail.returns({
          message: 'email not set',
        })
      })

      it('does not allow through', function () {
        const result = this.handler.promises._registrationRequestIsValid(
          this.passingRequest
        )
        return result.should.equal(false)
      })
    })

    describe('failing password validation', function () {
      beforeEach(function () {
        this.AuthenticationManager.validatePassword.returns({
          message: 'password is too short',
        })
      })

      it('does not allow through', function () {
        const result = this.handler.promises._registrationRequestIsValid(
          this.passingRequest
        )
        result.should.equal(false)
      })
    })
  })

  describe('registerNewUser', function () {
    describe('holdingAccount', function (done) {
      beforeEach(function () {
        this.user.holdingAccount = true
        this.handler.promises._registrationRequestIsValid = sinon
          .stub()
          .returns(true)
        this.UserGetter.promises.getUserByAnyEmail.resolves(this.user)
      })

      it('should not create a new user if there is a holding account there', async function () {
        await this.handler.promises.registerNewUser(this.passingRequest)
        this.UserCreator.promises.createNewUser.called.should.equal(false)
      })

      it('should set holding account to false', async function () {
        await this.handler.promises.registerNewUser(this.passingRequest)
        const update = this.User.updateOne.args[0]
        assert.deepEqual(update[0], { _id: this.user._id })
        assert.deepEqual(update[1], { $set: { holdingAccount: false } })
      })
    })

    describe('invalidRequest', function () {
      it('should not create a new user if the the request is not valid', async function () {
        this.handler.promises._registrationRequestIsValid = sinon
          .stub()
          .returns(false)
        expect(this.handler.promises.registerNewUser(this.passingRequest)).to.be
          .rejected
        this.UserCreator.promises.createNewUser.called.should.equal(false)
      })

      it('should return email registered in the error if there is a non holdingAccount there', async function () {
        this.UserGetter.promises.getUserByAnyEmail.resolves(
          (this.user = { holdingAccount: false })
        )
        expect(
          this.handler.promises.registerNewUser(this.passingRequest)
        ).to.be.rejectedWith('EmailAlreadyRegistered')
      })
    })

    describe('validRequest', function () {
      beforeEach(function () {
        this.handler.promises._registrationRequestIsValid = sinon
          .stub()
          .returns(true)
        this.UserGetter.promises.getUserByAnyEmail.resolves()
      })

      it('should create a new user', async function () {
        await this.handler.promises.registerNewUser(this.passingRequest)
        sinon.assert.calledWith(this.UserCreator.promises.createNewUser, {
          email: this.passingRequest.email,
          holdingAccount: false,
          first_name: this.passingRequest.first_name,
          last_name: this.passingRequest.last_name,
          analyticsId: this.user.analyticsId,
        })
      })

      it('lower case email', async function () {
        this.passingRequest.email = 'soMe@eMail.cOm'
        await this.handler.promises.registerNewUser(this.passingRequest)
        this.UserCreator.promises.createNewUser.args[0][0].email.should.equal(
          'some@email.com'
        )
      })

      it('trim white space from email', async function () {
        this.passingRequest.email = ' some@email.com '
        await this.handler.promises.registerNewUser(this.passingRequest)
        this.UserCreator.promises.createNewUser.args[0][0].email.should.equal(
          'some@email.com'
        )
      })

      it('should set the password', async function () {
        await this.handler.promises.registerNewUser(this.passingRequest)
        this.AuthenticationManager.promises.setUserPassword
          .calledWith(this.user, this.passingRequest.password)
          .should.equal(true)
      })

      it('should add the user to the newsletter if accepted terms', async function () {
        this.passingRequest.subscribeToNewsletter = 'true'
        await this.handler.promises.registerNewUser(this.passingRequest)
        this.NewsLetterManager.subscribe
          .calledWith(this.user)
          .should.equal(true)
      })

      it('should not add the user to the newsletter if not accepted terms', async function () {
        await this.handler.promises.registerNewUser(this.passingRequest)
        this.NewsLetterManager.subscribe
          .calledWith(this.user)
          .should.equal(false)
      })
    })
  })

  describe('registerNewUserAndSendActivationEmail', function () {
    beforeEach(function () {
      this.email = 'Email@example.com'
      this.crypto.randomBytes = sinon.stub().returns({
        toString: () => {
          return (this.password = 'mock-password')
        },
      })
      this.OneTimeTokenHandler.promises.getNewToken.resolves(
        (this.token = 'mock-token')
      )
      this.handler.promises.registerNewUser = sinon.stub()
    })

    describe('with a new user', function () {
      beforeEach(async function () {
        this.user.email = this.email.toLowerCase()
        this.handler.promises.registerNewUser.resolves(this.user)
        this.result =
          await this.handler.promises.registerNewUserAndSendActivationEmail(
            this.email
          )
      })

      it('should ask the UserRegistrationHandler to register user', function () {
        sinon.assert.calledWith(this.handler.promises.registerNewUser, {
          email: this.email,
          password: this.password,
        })
      })

      it('should generate a new password reset token', function () {
        const data = {
          user_id: this.user._id.toString(),
          email: this.user.email,
        }
        this.OneTimeTokenHandler.promises.getNewToken
          .calledWith('password', data, { expiresIn: 7 * 24 * 60 * 60 })
          .should.equal(true)
      })

      it('should send a registered email', function () {
        this.EmailHandler.promises.sendEmail
          .calledWith('registered', {
            to: this.user.email,
            setNewPasswordUrl: `${this.settings.siteUrl}/user/activate?token=${this.token}&user_id=${this.user_id}`,
          })
          .should.equal(true)
      })

      it('should return the user and new password url', function () {
        const { user, setNewPasswordUrl } = this.result
        expect(user).to.deep.equal(this.user)
        expect(setNewPasswordUrl).to.equal(
          `${this.settings.siteUrl}/user/activate?token=${this.token}&user_id=${this.user_id}`
        )
      })
    })

    describe('with a user that already exists', function () {
      beforeEach(async function () {
        this.handler.promises.registerNewUser.rejects(
          new Error('EmailAlreadyRegistered')
        )
        this.UserGetter.promises.getUserByAnyEmail.resolves(this.user)
        await this.handler.promises.registerNewUserAndSendActivationEmail(
          this.email
        )
      })

      it('should still generate a new password token and email', function () {
        this.OneTimeTokenHandler.promises.getNewToken.called.should.equal(true)
        this.EmailHandler.promises.sendEmail.called.should.equal(true)
      })
    })
  })
})