@@ -9,14 +9,13 @@ function createUser() {
|
||||
objectId: '1234567890',
|
||||
username: 'hello',
|
||||
password: 'pass',
|
||||
_session_token: sessionToken
|
||||
}
|
||||
_session_token: sessionToken,
|
||||
};
|
||||
return config.database.create('_User', user);
|
||||
}
|
||||
|
||||
describe_only_db('mongo')('revocable sessions', () => {
|
||||
|
||||
beforeEach((done) => {
|
||||
beforeEach(done => {
|
||||
// Create 1 user with the legacy
|
||||
createUser().then(done);
|
||||
});
|
||||
@@ -25,48 +24,71 @@ describe_only_db('mongo')('revocable sessions', () => {
|
||||
const user = Parse.Object.fromJSON({
|
||||
className: '_User',
|
||||
objectId: '1234567890',
|
||||
sessionToken: sessionToken
|
||||
});
|
||||
user._upgradeToRevocableSession().then((res) => {
|
||||
expect(res.getSessionToken().indexOf('r:')).toBe(0);
|
||||
const config = Config.get(Parse.applicationId);
|
||||
// use direct access to the DB to make sure we're not
|
||||
// getting the session token stripped
|
||||
return config.database.loadSchema().then(schemaController => {
|
||||
return schemaController.getOneSchema('_User', true)
|
||||
}).then((schema) => {
|
||||
return config.database.adapter.find('_User', schema, {objectId: '1234567890'}, {})
|
||||
}).then((results) => {
|
||||
expect(results.length).toBe(1);
|
||||
expect(results[0].sessionToken).toBeUndefined();
|
||||
});
|
||||
}).then(() => {
|
||||
done();
|
||||
}, (err) => {
|
||||
jfail(err);
|
||||
done();
|
||||
sessionToken: sessionToken,
|
||||
});
|
||||
user
|
||||
._upgradeToRevocableSession()
|
||||
.then(res => {
|
||||
expect(res.getSessionToken().indexOf('r:')).toBe(0);
|
||||
const config = Config.get(Parse.applicationId);
|
||||
// use direct access to the DB to make sure we're not
|
||||
// getting the session token stripped
|
||||
return config.database
|
||||
.loadSchema()
|
||||
.then(schemaController => {
|
||||
return schemaController.getOneSchema('_User', true);
|
||||
})
|
||||
.then(schema => {
|
||||
return config.database.adapter.find(
|
||||
'_User',
|
||||
schema,
|
||||
{ objectId: '1234567890' },
|
||||
{}
|
||||
);
|
||||
})
|
||||
.then(results => {
|
||||
expect(results.length).toBe(1);
|
||||
expect(results[0].sessionToken).toBeUndefined();
|
||||
});
|
||||
})
|
||||
.then(
|
||||
() => {
|
||||
done();
|
||||
},
|
||||
err => {
|
||||
jfail(err);
|
||||
done();
|
||||
}
|
||||
);
|
||||
});
|
||||
|
||||
it('should be able to become with revocable session token', done => {
|
||||
const user = Parse.Object.fromJSON({
|
||||
className: '_User',
|
||||
objectId: '1234567890',
|
||||
sessionToken: sessionToken
|
||||
});
|
||||
user._upgradeToRevocableSession().then((res) => {
|
||||
expect(res.getSessionToken().indexOf('r:')).toBe(0);
|
||||
return Parse.User.logOut().then(() => {
|
||||
return Parse.User.become(res.getSessionToken())
|
||||
}).then((user) => {
|
||||
expect(user.id).toEqual('1234567890');
|
||||
});
|
||||
}).then(() => {
|
||||
done();
|
||||
}, (err) => {
|
||||
jfail(err);
|
||||
done();
|
||||
sessionToken: sessionToken,
|
||||
});
|
||||
user
|
||||
._upgradeToRevocableSession()
|
||||
.then(res => {
|
||||
expect(res.getSessionToken().indexOf('r:')).toBe(0);
|
||||
return Parse.User.logOut()
|
||||
.then(() => {
|
||||
return Parse.User.become(res.getSessionToken());
|
||||
})
|
||||
.then(user => {
|
||||
expect(user.id).toEqual('1234567890');
|
||||
});
|
||||
})
|
||||
.then(
|
||||
() => {
|
||||
done();
|
||||
},
|
||||
err => {
|
||||
jfail(err);
|
||||
done();
|
||||
}
|
||||
);
|
||||
});
|
||||
|
||||
it('should not upgrade bad legacy session token', done => {
|
||||
@@ -75,19 +97,24 @@ describe_only_db('mongo')('revocable sessions', () => {
|
||||
headers: {
|
||||
'X-Parse-Application-Id': Parse.applicationId,
|
||||
'X-Parse-Rest-API-Key': 'rest',
|
||||
'X-Parse-Session-Token': 'badSessionToken'
|
||||
'X-Parse-Session-Token': 'badSessionToken',
|
||||
},
|
||||
json: true
|
||||
}).then(() => {
|
||||
fail('should not be able to upgrade a bad token');
|
||||
}, (response) => {
|
||||
expect(response.statusCode).toBe(400);
|
||||
expect(response.error).not.toBeUndefined();
|
||||
expect(response.error.code).toBe(Parse.Error.INVALID_SESSION_TOKEN);
|
||||
expect(response.error.error).toEqual('invalid legacy session token');
|
||||
}).then(() => {
|
||||
done();
|
||||
});
|
||||
json: true,
|
||||
})
|
||||
.then(
|
||||
() => {
|
||||
fail('should not be able to upgrade a bad token');
|
||||
},
|
||||
response => {
|
||||
expect(response.statusCode).toBe(400);
|
||||
expect(response.error).not.toBeUndefined();
|
||||
expect(response.error.code).toBe(Parse.Error.INVALID_SESSION_TOKEN);
|
||||
expect(response.error.error).toEqual('invalid legacy session token');
|
||||
}
|
||||
)
|
||||
.then(() => {
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('should not crash without session token #2720', done => {
|
||||
@@ -95,18 +122,23 @@ describe_only_db('mongo')('revocable sessions', () => {
|
||||
url: Parse.serverURL + '/upgradeToRevocableSession',
|
||||
headers: {
|
||||
'X-Parse-Application-Id': Parse.applicationId,
|
||||
'X-Parse-Rest-API-Key': 'rest'
|
||||
'X-Parse-Rest-API-Key': 'rest',
|
||||
},
|
||||
json: true
|
||||
}).then(() => {
|
||||
fail('should not be able to upgrade a bad token');
|
||||
}, (response) => {
|
||||
expect(response.statusCode).toBe(404);
|
||||
expect(response.error).not.toBeUndefined();
|
||||
expect(response.error.code).toBe(Parse.Error.OBJECT_NOT_FOUND);
|
||||
expect(response.error.error).toEqual('invalid session');
|
||||
}).then(() => {
|
||||
done();
|
||||
});
|
||||
json: true,
|
||||
})
|
||||
.then(
|
||||
() => {
|
||||
fail('should not be able to upgrade a bad token');
|
||||
},
|
||||
response => {
|
||||
expect(response.statusCode).toBe(404);
|
||||
expect(response.error).not.toBeUndefined();
|
||||
expect(response.error.code).toBe(Parse.Error.OBJECT_NOT_FOUND);
|
||||
expect(response.error.error).toEqual('invalid session');
|
||||
}
|
||||
)
|
||||
.then(() => {
|
||||
done();
|
||||
});
|
||||
});
|
||||
})
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user