52 lines
1.9 KiB
JavaScript
52 lines
1.9 KiB
JavaScript
const { test } = require('node:test');
|
|
const assert = require('node:assert');
|
|
const fs = require('fs');
|
|
const os = require('os');
|
|
const path = require('path');
|
|
|
|
process.env.DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dp-auth-'));
|
|
const { db } = require('./db');
|
|
const { normalizeEmail, hashToken, createLoginToken, consumeLoginToken } = require('./auth');
|
|
|
|
function makeUser(email = 'a@b.de', isAdmin = 0) {
|
|
const info = db.prepare('INSERT INTO users (email,is_admin,created_at) VALUES (?,?,?)')
|
|
.run(email, isAdmin, new Date().toISOString());
|
|
return Number(info.lastInsertRowid);
|
|
}
|
|
|
|
test('normalizeEmail: lowercase + trim', () => {
|
|
assert.strictEqual(normalizeEmail(' Foo@Bar.DE '), 'foo@bar.de');
|
|
});
|
|
|
|
test('createLoginToken speichert nur Hash; consume liefert Nutzer genau einmal', () => {
|
|
const uid = makeUser('roundtrip@x.de', 1);
|
|
const raw = createLoginToken(uid);
|
|
|
|
// Rohwert darf NICHT als token_hash in der DB liegen
|
|
assert.strictEqual(
|
|
db.prepare('SELECT 1 FROM login_tokens WHERE token_hash = ?').get(raw),
|
|
undefined,
|
|
'Rohtoken darf nicht als token_hash gespeichert sein'
|
|
);
|
|
assert.ok(
|
|
db.prepare('SELECT 1 FROM login_tokens WHERE token_hash = ?').get(hashToken(raw)),
|
|
'Hash muss gespeichert sein'
|
|
);
|
|
|
|
assert.deepStrictEqual(consumeLoginToken(raw), { userId: uid, email: 'roundtrip@x.de', isAdmin: true });
|
|
assert.strictEqual(consumeLoginToken(raw), null, 'zweite Einlösung → null');
|
|
});
|
|
|
|
test('abgelaufener Token → null', () => {
|
|
const uid = makeUser('expired@x.de');
|
|
const raw = 'deadbeef'.repeat(8);
|
|
db.prepare('INSERT INTO login_tokens (token_hash, user_id, expires_at) VALUES (?,?,?)')
|
|
.run(hashToken(raw), uid, '2000-01-01T00:00:00.000Z');
|
|
assert.strictEqual(consumeLoginToken(raw), null);
|
|
});
|
|
|
|
test('nicht-Admin: isAdmin === false', () => {
|
|
const uid = makeUser('plain@x.de', 0);
|
|
const raw = createLoginToken(uid);
|
|
assert.strictEqual(consumeLoginToken(raw).isAdmin, false);
|
|
});
|