92 lines
2.8 KiB
JavaScript
92 lines
2.8 KiB
JavaScript
'use strict';
|
|
|
|
const { TEST_CREDS, login, request, app } = require('./setup');
|
|
|
|
// Target an existing user that is NOT the admin (wmantly is always present in the test LDAP)
|
|
const TARGET_UID = 'wmantly';
|
|
|
|
let token;
|
|
|
|
beforeAll(async () => {
|
|
token = await login();
|
|
// Clean up any leftover impersonation from a previous run
|
|
await request(app).delete(`/api/auth/impersonate/${TARGET_UID}`).set('auth-token', token);
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await request(app).delete(`/api/auth/impersonate/${TARGET_UID}`).set('auth-token', token);
|
|
});
|
|
|
|
describe('Impersonation — POST /api/auth/impersonate/:uid', () => {
|
|
test('requires auth — 401 without token', async () => {
|
|
const res = await request(app).post(`/api/auth/impersonate/${TARGET_UID}`);
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
test('admin can create impersonation and receives temp credentials', async () => {
|
|
const res = await request(app)
|
|
.post(`/api/auth/impersonate/${TARGET_UID}`)
|
|
.set('auth-token', token);
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body).toHaveProperty('uid', TARGET_UID);
|
|
expect(res.body).toHaveProperty('temp_password');
|
|
expect(res.body).toHaveProperty('expires_at');
|
|
expect(typeof res.body.temp_password).toBe('string');
|
|
expect(res.body.temp_password.length).toBeGreaterThan(8);
|
|
});
|
|
|
|
test('temp password works for LDAP login', async () => {
|
|
// Create fresh impersonation to get the temp password
|
|
const impRes = await request(app)
|
|
.post(`/api/auth/impersonate/${TARGET_UID}`)
|
|
.set('auth-token', token);
|
|
|
|
const tempPassword = impRes.body.temp_password;
|
|
|
|
const loginRes = await request(app)
|
|
.post('/api/auth/login')
|
|
.send({ uid: TARGET_UID, password: tempPassword });
|
|
|
|
expect(loginRes.status).toBe(200);
|
|
expect(loginRes.body).toHaveProperty('token');
|
|
});
|
|
|
|
test('rejects unknown uid', async () => {
|
|
const res = await request(app)
|
|
.post('/api/auth/impersonate/no_such_user_xyz')
|
|
.set('auth-token', token);
|
|
|
|
expect(res.status).toBeGreaterThanOrEqual(400);
|
|
});
|
|
});
|
|
|
|
describe('Impersonation — DELETE /api/auth/impersonate/:uid', () => {
|
|
test('admin can revoke impersonation', async () => {
|
|
const res = await request(app)
|
|
.delete(`/api/auth/impersonate/${TARGET_UID}`)
|
|
.set('auth-token', token);
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body).toHaveProperty('message');
|
|
});
|
|
|
|
test('temp password no longer works after revocation', async () => {
|
|
// Create a fresh one, capture the password, revoke, then try login
|
|
const impRes = await request(app)
|
|
.post(`/api/auth/impersonate/${TARGET_UID}`)
|
|
.set('auth-token', token);
|
|
const tempPassword = impRes.body.temp_password;
|
|
|
|
await request(app)
|
|
.delete(`/api/auth/impersonate/${TARGET_UID}`)
|
|
.set('auth-token', token);
|
|
|
|
const loginRes = await request(app)
|
|
.post('/api/auth/login')
|
|
.send({ uid: TARGET_UID, password: tempPassword });
|
|
|
|
expect(loginRes.status).toBe(401);
|
|
});
|
|
});
|