Public: anyone can read this; the crew can change it.
A test pins linking an edge login: a malformed login is refused, and a login another account holds is never moved #7139
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/7131-a-test-pins-linking-an-edge-login-a-malf → main 1 commit fork
1 file
changed +79
−0
test/edge-link-refusals.test.ts added +79
| @@ -0,0 +1,79 @@ | ||
| 1 | import { afterAll, beforeAll, describe, expect, test } from "bun:test"; | |
| 2 | import { mkdtemp, rm } from "node:fs/promises"; | |
| 3 | import { tmpdir } from "node:os"; | |
| 4 | import { join } from "node:path"; | |
| 5 | import { createApp, type App } from "../src/app.ts"; | |
| 6 | import { serve, type Servers } from "../src/http/server.ts"; | |
| 7 | import { createUser, type User } from "../src/core/users.ts"; | |
| 8 | import { linkEdgeLogin, linkedLogin } from "../src/core/edge_links.ts"; | |
| 9 | ||
| 10 | const TOKEN = "edge-secret-0123456789"; | |
| 11 | ||
| 12 | describe("linkEdgeLogin refusals", () => { | |
| 13 | let dataDir: string; | |
| 14 | let app: App; | |
| 15 | let servers: Servers; | |
| 16 | let alice: User; | |
| 17 | let bob: User; | |
| 18 | const mk = async (username: string): Promise<User> => { | |
| 19 | const made = await createUser(app.db, { origin: "edge", username, email: `${username}@forge.example` }); | |
| 20 | if (!made.ok) throw new Error(made.error); | |
| 21 | return made.value; | |
| 22 | }; | |
| 23 | const whoAmI = async (login: string): Promise<string | undefined> => { | |
| 24 | const res = await fetch(`${servers.url}/api/v1/user`, { headers: { "x-plat-user": login, "x-plat-edge-token": TOKEN } }); | |
| 25 | return res.status === 200 ? ((await res.json()) as { username: string }).username : undefined; | |
| 26 | }; | |
| 27 | ||
| 28 | beforeAll(async () => { | |
| 29 | dataDir = await mkdtemp(join(tmpdir(), "forge-edgelink-refusals-")); | |
| 30 | app = createApp({ dataDir, port: 0, url: "https://forge.example", edgeToken: TOKEN }); | |
| 31 | servers = await serve(app); | |
| 32 | alice = await mk("alice"); | |
| 33 | bob = await mk("bob"); | |
| 34 | }); | |
| 35 | ||
| 36 | afterAll(async () => { | |
| 37 | servers.stop(); | |
| 38 | app.close(); | |
| 39 | await rm(dataDir, { recursive: true, force: true }); | |
| 40 | }); | |
| 41 | ||
| 42 | test("alice links alice-gh and an edge sign-in as alice-gh reaches alice", async () => { | |
| 43 | expect(await whoAmI("alice-gh")).toBeUndefined(); | |
| 44 | expect(linkEdgeLogin(app.db, alice, "alice-gh")).toEqual({ ok: true, value: "linked" }); | |
| 45 | expect(await whoAmI("alice-gh")).toBe("alice"); | |
| 46 | }); | |
| 47 | ||
| 48 | test("bob linking alice-gh is login_taken and the sign-in still reaches alice", async () => { | |
| 49 | const res = linkEdgeLogin(app.db, bob, "alice-gh"); | |
| 50 | expect(res.ok).toBe(false); | |
| 51 | if (!res.ok) expect(res.error).toBe("login_taken"); | |
| 52 | expect(linkedLogin(app.db, bob.id)).toBeUndefined(); | |
| 53 | expect(await whoAmI("alice-gh")).toBe("alice"); | |
| 54 | }); | |
| 55 | ||
| 56 | test.each([ | |
| 57 | ["a leading dash", "-x"], | |
| 58 | ["65 characters", "a".repeat(65)], | |
| 59 | ["a space", "has space"], | |
| 60 | ["a slash", "has/slash"], | |
| 61 | ])("%s is invalid_login", (_name, login) => { | |
| 62 | const res = linkEdgeLogin(app.db, bob, login); | |
| 63 | expect(res.ok).toBe(false); | |
| 64 | if (!res.ok) expect(res.error).toBe("invalid_login"); | |
| 65 | expect(linkedLogin(app.db, bob.id)).toBeUndefined(); | |
| 66 | }); | |
| 67 | ||
| 68 | test("a login of 64 characters is accepted", () => { | |
| 69 | expect(linkEdgeLogin(app.db, bob, "b".repeat(64)).ok).toBe(true); | |
| 70 | }); | |
| 71 | ||
| 72 | test("linking the same login again as alice is a no-op", async () => { | |
| 73 | expect(linkEdgeLogin(app.db, alice, "alice-gh")).toEqual({ ok: true, value: "linked" }); | |
| 74 | expect(linkedLogin(app.db, alice.id)).toBe("alice-gh"); | |
| 75 | const rows = app.db.query<{ n: number }, [string]>("SELECT count(*) AS n FROM edge_link WHERE user_id = ?").get(alice.id); | |
| 76 | expect(rows?.n).toBe(1); | |
| 77 | expect(await whoAmI("alice-gh")).toBe("alice"); | |
| 78 | }); | |
| 79 | }); |
new above
offline