|
| 1 | +import { vi } from 'vitest'; |
| 2 | +import { of } from 'rxjs'; |
| 3 | +import { CouchService } from './couchdb.service'; |
| 4 | +import { StateService } from './state.service'; |
| 5 | +import { UserService } from './user.service'; |
| 6 | + |
| 7 | +describe('UserService', () => { |
| 8 | + let service: UserService; |
| 9 | + let couchService: { put: ReturnType<typeof vi.fn>, get: ReturnType<typeof vi.fn> }; |
| 10 | + |
| 11 | + const adminCredentials = { derived_key: 'admin-key', salt: 'admin-salt', iterations: 10 }; |
| 12 | + const putBody = () => couchService.put.mock.calls[0][1]; |
| 13 | + |
| 14 | + beforeEach(() => { |
| 15 | + couchService = { |
| 16 | + put: vi.fn(() => of({ ok: true })), |
| 17 | + get: vi.fn(() => of({ _id: 'org.couchdb.user:admin', name: 'admin', roles: [] })) |
| 18 | + }; |
| 19 | + service = new UserService( |
| 20 | + couchService as any as CouchService, |
| 21 | + { configuration: { _id: 'configuration', adminName: 'other@local', code: 'local' }, requestData: vi.fn() } as any as StateService |
| 22 | + ); |
| 23 | + service.set({ _id: 'org.couchdb.user:admin', name: 'admin', roles: [ 'manager' ] }); |
| 24 | + service.credentials = adminCredentials; |
| 25 | + }); |
| 26 | + |
| 27 | + afterEach(() => { |
| 28 | + vi.restoreAllMocks(); |
| 29 | + }); |
| 30 | + |
| 31 | + describe('updateUser', () => { |
| 32 | + // TEMP NOTE (for review, strip before merge): this is the lockout described in |
| 33 | + // user.service.ts. The profile view strips credential fields before handing a doc to a |
| 34 | + // caller, so an admin editing that copy used to write their own password hash onto it. |
| 35 | + it('does not fall back to the editor credentials when saving another user', () => { |
| 36 | + service.updateUser({ _id: 'org.couchdb.user:ann', name: 'ann', roles: [] }).subscribe(); |
| 37 | + |
| 38 | + expect(putBody().derived_key).toBeUndefined(); |
| 39 | + expect(putBody().salt).toBeUndefined(); |
| 40 | + }); |
| 41 | + |
| 42 | + it('keeps the credential fallback for the logged in user own doc', () => { |
| 43 | + service.updateUser({ _id: 'org.couchdb.user:admin', name: 'admin', roles: [] }).subscribe(); |
| 44 | + |
| 45 | + expect(putBody().derived_key).toBe('admin-key'); |
| 46 | + }); |
| 47 | + |
| 48 | + it('prefers the credentials already on the doc over the fallback', () => { |
| 49 | + service.updateUser({ _id: 'org.couchdb.user:admin', name: 'admin', roles: [], derived_key: 'own-key' }).subscribe(); |
| 50 | + |
| 51 | + expect(putBody().derived_key).toBe('own-key'); |
| 52 | + }); |
| 53 | + |
| 54 | + it('strips underscore prefixed roles and writes to the user document id', () => { |
| 55 | + service.updateUser({ _id: 'org.couchdb.user:ann', name: 'ann', roles: [ '_admin', 'learner' ] }).subscribe(); |
| 56 | + |
| 57 | + expect(couchService.put.mock.calls[0][0]).toBe('_users/org.couchdb.user:ann'); |
| 58 | + expect(putBody().roles).toEqual([ 'learner' ]); |
| 59 | + }); |
| 60 | + }); |
| 61 | + |
| 62 | +}); |
0 commit comments