kami-parse-server/spec/ParseSession.spec.js

//
// Tests behavior of Parse Sessions
//

'use strict';
const request = require('../lib/request');

function setupTestUsers() {
  const acl = new Parse.ACL();
  acl.setPublicReadAccess(true);
  const user1 = new Parse.User();
  const user2 = new Parse.User();
  const user3 = new Parse.User();

  user1.set('username', 'testuser_1');
  user2.set('username', 'testuser_2');
  user3.set('username', 'testuser_3');

  user1.set('password', 'password');
  user2.set('password', 'password');
  user3.set('password', 'password');

  user1.setACL(acl);
  user2.setACL(acl);
  user3.setACL(acl);

  return user1
    .signUp()
    .then(() => {
      return user2.signUp();
    })
    .then(() => {
      return user3.signUp();
    });
}

describe('Parse.Session', () => {
  // multiple sessions with masterKey + sessionToken
  it('should retain original sessionTokens with masterKey & sessionToken set', done => {
    setupTestUsers()
      .then(user => {
        const query = new Parse.Query(Parse.Session);
        return query.find({
          useMasterKey: true,
          sessionToken: user.get('sessionToken'),
        });
      })
      .then(results => {
        const foundKeys = [];
        expect(results.length).toBe(3);
        for (const key in results) {
          const sessionToken = results[key].get('sessionToken');
          if (foundKeys[sessionToken]) {
            fail('Duplicate session token present in response');
            break;
          }
          foundKeys[sessionToken] = 1;
        }
        done();
      })
      .catch(err => {
        fail(err);
      });
  });

  // single session returned, with just one sessionToken
  it('should retain original sessionTokens with just sessionToken set', done => {
    let knownSessionToken;
    setupTestUsers()
      .then(user => {
        knownSessionToken = user.get('sessionToken');
        const query = new Parse.Query(Parse.Session);
        return query.find({
          sessionToken: knownSessionToken,
        });
      })
      .then(results => {
        expect(results.length).toBe(1);
        const sessionToken = results[0].get('sessionToken');
        expect(sessionToken).toBe(knownSessionToken);
        done();
      })
      .catch(err => {
        fail(err);
      });
  });

  // multiple users with masterKey + sessionToken
  it('token on users should retain original sessionTokens with masterKey & sessionToken set', done => {
    setupTestUsers()
      .then(user => {
        const query = new Parse.Query(Parse.User);
        return query.find({
          useMasterKey: true,
          sessionToken: user.get('sessionToken'),
        });
      })
      .then(results => {
        const foundKeys = [];
        expect(results.length).toBe(3);
        for (const key in results) {
          const sessionToken = results[key].get('sessionToken');
          if (foundKeys[sessionToken] && sessionToken !== undefined) {
            fail('Duplicate session token present in response');
            break;
          }
          foundKeys[sessionToken] = 1;
        }
        done();
      })
      .catch(err => {
        fail(err);
      });
  });

  // multiple users with just sessionToken
  it('token on users should retain original sessionTokens with just sessionToken set', done => {
    let knownSessionToken;
    setupTestUsers()
      .then(user => {
        knownSessionToken = user.get('sessionToken');
        const query = new Parse.Query(Parse.User);
        return query.find({
          sessionToken: knownSessionToken,
        });
      })
      .then(results => {
        const foundKeys = [];
        expect(results.length).toBe(3);
        for (const key in results) {
          const sessionToken = results[key].get('sessionToken');
          if (foundKeys[sessionToken] && sessionToken !== undefined) {
            fail('Duplicate session token present in response');
            break;
          }
          foundKeys[sessionToken] = 1;
        }

        done();
      })
      .catch(err => {
        fail(err);
      });
  });

  it('cannot edit session with known ID', async () => {
    await setupTestUsers();
    const [first, second] = await new Parse.Query(Parse.Session).find({ useMasterKey: true });
    const headers = {
      'X-Parse-Application-Id': 'test',
      'X-Parse-Rest-API-Key': 'rest',
      'X-Parse-Session-Token': second.get('sessionToken'),
      'Content-Type': 'application/json',
    };
    const firstUser = first.get('user').id;
    const secondUser = second.get('user').id;
    const e = await request({
      method: 'PUT',
      headers,
      url: `http://localhost:8378/1/sessions/${first.id}`,
      body: JSON.stringify({
        foo: 'bar',
        user: { __type: 'Pointer', className: '_User', objectId: secondUser },
      }),
    }).catch(e => e.data);
    expect(e.code).toBe(Parse.Error.OBJECT_NOT_FOUND);
    expect(e.error).toBe('Object not found.');
    await Parse.Object.fetchAll([first, second], { useMasterKey: true });
    expect(first.get('user').id).toBe(firstUser);
    expect(second.get('user').id).toBe(secondUser);
  });
});