pippinmole/ghost

public

Source code of Ghost - On Ghost

api: serialize refresh and revoke per grant, hide expired refresh tokens, refuse non-string token fields547d83e2 days ago305 lines · 21.9 KB

1	import { type Database, schema } from '@ghost/db';
2	import type { INestApplication
3	import { AuthService }
4	import { eq }
5	import request from 'supertest
6	import { afterAll, beforeAll
7
8	import { DATABASE }
9	import type { Auth
10	import { hasBackends, scopedKey
11
12	const GH = '
13	const DEVICE_GRANT = '
14
15	describe.skipIf(!hasBackends
16	let app:
17	let db:
18	let owner:
19	let other:
20	const stamp =
21	const api =
22	const create =
23
24	beforeAll(async ()
25	({ app }
26	db = app.
27	owner = await
28	other = await
29	});
30
31	afterAll(async ()
32	await app?.close
33	});
34
35	it('shows the client secret once, on create, and never on read',
36	const created =
37	expect(created.body
38	expect(created.body
39	expect(created.body
40
41	const one =
42	expect(one.body
43	expect(one.body
44	const list =
45	expect(list.body
46	expect(JSON.stringify
47
48	const [row]
49	expect(row?.clientSecret
50	expect(row?.clientSecret
51	});
52
53	it('updates an app and turns its device flow on',
54	const { body
55	const updated =
56	expect(updated.body
57	await api().post
58
59	const enabled =
60	expect(enabled.body
61	});
62
63	it('rotates the secret, replacing the stored one',
64	const { body
65	const before =
66	const rotated =
67	expect(rotated.body
68	expect(rotated.body
69	const after =
70	expect(after[0]
71	});
72
73	it("hides another user's app behind 404",
74	const { body
75	await api().get
76	await api().patch
77	await api().post
78	await api().delete
79	const list =
80	expect(list.body
81	});
82
83	it('refuses to change gh',
84	await api().patch
85	await api().post
86	await api().delete
87	const [row]
88	expect(row?.name
89	});
90
91	it('deletes an app with the keys it minted for every user, and nothing else',
92	const { body
93	const auth =
94	await auth(owner
95	await auth(other
96	await auth(owner
97	await api().delete
98	await api().get
99	const keys =
100	const ids =
101	expect(ids).not
102	expect(ids).not
103	expect(ids).toContain
104	});
105
106	it('keeps a description and several callbacks, production and local alike',
107	const callbackUrls =
108	const { body
109	expect(body).toMatchObject
110	const updated =
111	expect(updated.body
112	const described =
113	expect(described.body
114	});
115
116	it('refuses an empty, oversized or partly invalid callback list',
117	await create(owner
118	await create(owner
119	await create(owner
120	});
121
122	it('sets and removes a logo, which the consent page sees',
123	const { body
124	const png =
125	const uploaded =
126	expect(uploaded.body
127	const described =
128	expect(described.body
129	await api().put
130	await api().put
131	await api().delete
132	expect((await api
133	});
134
135	it('marks gh verified, and no owner can mark their own app',
136	const gh =
137	expect(gh.body
138	const { body
139	await api().patch
140	const described =
141	expect(described.body
142	});
143
144	it('accepts only an https or localhost callback',
145	await create(owner
146	await create(owner
147	await create(owner
148	await create(owner
149	});
150
151	it('turns expiring user tokens on and off, off by default',
152	const { body
153	expect(body.expireUserTokens
154	const on =
155	expect(on.body
156	const off =
157	expect(off.body
158	const created =
159	expect(created.body
160	await api().patch
161	await api().patch
162	});
163
164	it('refuses an API key of any scope',
165	const key =
166	await api().get
167	await api().get
168	});
169
170	describe('authorized apps',
171	const key =
172	db.insert(schema
173	const ids =
174
175	it('lists the apps holding a key for me, with their scopes',
176	const a =
177	await key(`la1
178	await key(`la2
179	const list =
180	const entry =
181	expect(entry).toMatchObject
182	expect(entry.authorizedAt
183	const theirs =
184	expect(theirs.body
185	});
186
187	it("revokes only my keys for that app, and its consent",
188	const a =
189	const b =
190	await key(`ra-mine
191	await key(`ra-theirs
192	await key(`rb-mine
193	await key(`r-ui
194	await db.insert
195
196	await api().delete
197	const left =
198	expect(left).not
199	expect(left).toEqual
200	expect(await db
201	await api().delete
202	});
203
204	it('keeps an app whose key expired but whose refresh token lives, and revoking it deletes the refresh token',
205	const a =
206	await db.insert
207	const list =
208	expect(list.body
209	await api().delete
210	expect(await db
211	await api().delete
212	});
213
214	it('drops an app once its last refresh token has expired',
215	const a =
216	await db.insert
217	const list =
218	expect(list.body
219	});
220
221	it('merges the scopes of keys and refresh tokens into one entry',
222	const a =
223	await key(`mk
224	await db.insert
225	const list =
226	expect(list.body
227	});
228
229	it('shows gh after the device flow, and revoking it locks gh out',
230	const form =
231	const code =
232	await api().get
233	await api().post
234	const token =
235	await api().get
236
237	const list =
238	expect(list.body
239	await api().delete
240	await api().get
241	});
242	});
243
244	describe('organization apps',
245	const auth =
246	const org =
247	let organizationId:
248	let admin:
249	let member:
250	const createFor =
251
252	beforeAll(async ()
253	admin = await
254	member = await
255	organizationId = (await
256	await auth().addMember
257	await auth().addMember
258	});
259
260	it('files the app under the organization, not the user who made it',
261	const { body
262	expect(body.clientSecret
263	const [row]
264	expect(row).toEqual
265
266	const listed =
267	expect(listed.body
268	const mine =
269	expect(mine.body
270	const described =
271	expect(described.body
272	});
273
274	it('lets any admin manage it, through the same routes as a personal app',
275	const { body
276	await api().get
277	const updated =
278	expect(updated.body
279	const rotated =
280	expect(rotated.body
281	await api().delete
282	await api().get
283	});
284
285	it('keeps members below admin and outsiders out',
286	const { body
287	await createFor(member
288	await api().get
289	await api().patch
290	await api().post
291	await api().delete
292	await createFor(other
293	});
294
295	it('goes, with the keys it minted, when the organization is deleted',
296	const slug =
297	const gone =
298	const { body
299	await db.insert
300	await auth().deleteOrganization
301	expect(await db
302	expect(await db
303	});
304	});
305	});