mirror of
https://github.com/penpot/penpot.git
synced 2026-09-23 12:55:06 -04:00
Andrey Antukh
2255266d45
* ✨ Enable closed schemas for RPC methods
* 🐛 Fix duplicate make-dummy-request test helper definition
The branch added a variadic DummyRequest/make-dummy-request pair but
left the pre-existing single-arg definition in place. Because it was
loaded last, zero-arg (make-dummy-request) calls added by
prepare-rpc-params and rpc-nitrate-test threw ArityException, which
broke 384 tests and caused 14 downstream assertion failures.
Remove the stale duplicate so the variadic definition is the only
one, and drop the now-unused yrq alias and duplicate yres alias.
AI-assisted-by: deepseek-v4.1-flash
* ✨ Add focused tests for make-dummy-request helper
Pin the call contract of make-dummy-request, which the suite uses
in three styles: no arguments, a single options map, and keyword
arguments. The helper's redefinition shadowing in 8ca95adb98 was
only caught by a full-suite run with hundreds of unrelated errors;
these tests fail locally in a focused --focus run.
Cover the zero-arg defaults, map and keyword overrides, the
:body-bytes -> ByteArrayInputStream wrapping, :body-stream
precedence, and cookie readback. Also clarify the docstring to
list all supported call styles.
AI-assisted-by: deepseek-v4.1-flash
* 🚑 Prevent RPC client params from overriding auth context
Strip qualified keys from decoded request params before merging
them with the server-built auth context, so transit bodies can
no longer override ::profile-id, ::auth-type or ::token-perms.
Adds a regression test proving the override and the fix.
AI-assisted-by: muse-spark-1.3-contributor
* 📚 Merge backend subtleties memories under generic name
Rename rpc-db-worker-subtleties to subtleties and fold in
http-storage-filedata-subtleties, so the name no longer
enumerates topics. Update all mem: references accordingly.
AI-assisted-by: muse-spark-1.3-contributor
* ✨ Add realistic tests for RPC auth override
Cover the transit wire vector and the real wrapped :get-profile
method with two database profiles, proving a session cannot read
another profile by smuggling :app.rpc/profile-id in the body.
AI-assisted-by: muse-spark-1.3-contributor
* ✨ Add e2e test for RPC auth context override
Parametrize rpcPost with contentType, accept and query so e2e
can send hand-written transit bodies without new dependencies.
The new test proves a transit-smuggled :app.rpc/profile-id no
longer overrides the session in get-profile. Also fix the demo
email assertion in auth-flow to the current uuid format.
AI-assisted-by: muse-spark-1.3-contributor
79 lines
2.7 KiB
JavaScript
79 lines
2.7 KiB
JavaScript
import { describe, it } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import {
|
|
createDemoProfile,
|
|
login,
|
|
setupTestProfile,
|
|
} from "./helpers/auth.mjs";
|
|
import { rpcPost } from "./helpers/client.mjs";
|
|
|
|
describe("auth flow", () => {
|
|
it("creates a demo profile", async () => {
|
|
const { email, password } = await createDemoProfile();
|
|
assert.match(email, /^demo-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}@demo\.example\.com$/);
|
|
assert.ok(password.length > 0);
|
|
});
|
|
|
|
it("logs in with valid credentials", async () => {
|
|
const { email, password } = await createDemoProfile();
|
|
const { profile, cookie } = await login(email, password);
|
|
|
|
assert.equal(profile.email, email);
|
|
assert.equal(profile.isDemo, true);
|
|
assert.ok(profile.id, "profile should have id");
|
|
assert.ok(profile.defaultProjectId, "profile should have defaultProjectId");
|
|
assert.ok(profile.defaultTeamId, "profile should have defaultTeamId");
|
|
assert.ok(cookie, "cookie should be set");
|
|
});
|
|
|
|
it("login sets session cookie", async () => {
|
|
const { email, password } = await createDemoProfile();
|
|
const { cookie } = await login(email, password);
|
|
assert.ok(cookie, "auth-token cookie should be extracted");
|
|
assert.ok(cookie.length > 10, "cookie should have meaningful length");
|
|
});
|
|
|
|
it("login fails with wrong password", async () => {
|
|
const { email } = await createDemoProfile();
|
|
try {
|
|
await login(email, "wrong-password");
|
|
assert.fail("should have thrown");
|
|
} catch (e) {
|
|
assert.ok(e.message.includes("Login failed"));
|
|
}
|
|
});
|
|
|
|
it("login fails with non-existent email", async () => {
|
|
try {
|
|
await login("nonexistent@example.com", "some-password");
|
|
assert.fail("should have thrown");
|
|
} catch (e) {
|
|
assert.ok(e.message.includes("Login failed"));
|
|
}
|
|
});
|
|
|
|
it("authenticated RPC with cookie", async () => {
|
|
const { profile, cookie } = await setupTestProfile();
|
|
const res = await rpcPost("get-profile", {}, { cookieToken: cookie });
|
|
assert.equal(res.status, 200);
|
|
assert.equal(res.body.id, profile.id);
|
|
assert.equal(res.body.email, profile.email);
|
|
});
|
|
|
|
it("unauthenticated RPC returns anonymous profile", async () => {
|
|
const res = await rpcPost("get-profile", {});
|
|
assert.equal(res.status, 200);
|
|
// Anonymous profile has uuid/zero as id
|
|
assert.equal(res.body.id, "00000000-0000-0000-0000-000000000000");
|
|
});
|
|
|
|
it("setupTestProfile returns all fields", async () => {
|
|
const { profile, cookie, email, password } = await setupTestProfile();
|
|
assert.ok(profile.id);
|
|
assert.ok(profile.defaultProjectId);
|
|
assert.ok(cookie);
|
|
assert.ok(email);
|
|
assert.ok(password);
|
|
});
|
|
});
|