81 lines
3.6 KiB
TypeScript
81 lines
3.6 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from 'vitest';
|
||
import { WrongCredentialsError } from '../../src/core/store/AuthStore';
|
||
import { HttpAuthStore } from '../../src/core/store/HttpAuthStore';
|
||
import { loginError, loginProblem } from '../../src/editor/auth/loginRules';
|
||
|
||
/** What the firewall in front of the live site answers instead of any non-2xx (measured for #177). */
|
||
const FIREWALL_418 = '<html><head><title>Status Code 418</title></head><body></body></html>';
|
||
|
||
function stubFetch(body: BodyInit | null, init: ResponseInit) {
|
||
const mock = vi.fn<typeof fetch>(() => Promise.resolve(new Response(body, init)));
|
||
vi.stubGlobal('fetch', mock);
|
||
return mock;
|
||
}
|
||
|
||
afterEach(() => {
|
||
vi.unstubAllGlobals();
|
||
});
|
||
|
||
describe('HttpAuthStore', () => {
|
||
it('reads who is signed in, null included', async () => {
|
||
stubFetch(JSON.stringify({ user: 'e2e' }), { status: 200 });
|
||
await expect(new HttpAuthStore('/api').session()).resolves.toBe('e2e');
|
||
|
||
stubFetch(JSON.stringify({ user: null }), { status: 200 });
|
||
await expect(new HttpAuthStore('/api').session()).resolves.toBeNull();
|
||
});
|
||
|
||
it('sends the pair as JSON and answers with the name the server confirms', async () => {
|
||
const mock = stubFetch(JSON.stringify({ user: 'user' }), { status: 200 });
|
||
await expect(new HttpAuthStore('/api').logIn('user', 'secret')).resolves.toBe('user');
|
||
const [url, init] = mock.mock.calls[0]!;
|
||
expect(url as string).toContain('r=auth%2Flogin');
|
||
expect(init?.method).toBe('POST');
|
||
expect(JSON.parse(init?.body as string)).toEqual({ username: 'user', password: 'secret' });
|
||
});
|
||
|
||
it('tells a wrong pair apart from a server that is not there', async () => {
|
||
stubFetch(JSON.stringify({ error: 'Wrong user name or password' }), { status: 401 });
|
||
await expect(new HttpAuthStore('/api').logIn('user', 'nope')).rejects.toBeInstanceOf(
|
||
WrongCredentialsError,
|
||
);
|
||
|
||
stubFetch(JSON.stringify({ error: 'boom' }), { status: 500 });
|
||
const failure = new HttpAuthStore('/api').logIn('user', 'secret');
|
||
await expect(failure).rejects.not.toBeInstanceOf(WrongCredentialsError);
|
||
await expect(failure).rejects.toThrow(/boom \(500\)/);
|
||
});
|
||
|
||
// The firewall in front of nockal.com used to answer every non-2xx with this page; since
|
||
// 2026-09-20 it hands the API's own status through. The rule stays: only a 401 from the API
|
||
// means a wrong pair, anything a box in between makes up does not.
|
||
it('does not mistake a proxy’s own page for a wrong password', async () => {
|
||
stubFetch(FIREWALL_418, { status: 418 });
|
||
const failure = new HttpAuthStore('/api').logIn('user', 'secret');
|
||
await expect(failure).rejects.not.toBeInstanceOf(WrongCredentialsError);
|
||
await expect(failure).rejects.toThrow(/418/);
|
||
});
|
||
|
||
it('signs out without a body', async () => {
|
||
const mock = stubFetch(null, { status: 204 });
|
||
await expect(new HttpAuthStore('/api').logOut()).resolves.toBeUndefined();
|
||
expect(mock.mock.calls[0]?.[1]?.method).toBe('POST');
|
||
});
|
||
});
|
||
|
||
describe('the rules of the sign-in form', () => {
|
||
it('asks for what is missing, user name first', () => {
|
||
expect(loginProblem('', '')).toBe('Enter your user name');
|
||
expect(loginProblem(' ', 'secret')).toBe('Enter your user name');
|
||
expect(loginProblem('user', '')).toBe('Enter your password');
|
||
expect(loginProblem('user', 'secret')).toBeNull();
|
||
});
|
||
|
||
it('says a wrong pair plainly and names the cause of anything else', () => {
|
||
expect(loginError(new WrongCredentialsError(), true)).toBe('Wrong user name or password');
|
||
expect(loginError(new Error('Server unavailable (503)'), false)).toBe(
|
||
'Could not sign in: Server unavailable (503)',
|
||
);
|
||
});
|
||
});
|