145 lines
3.9 KiB
JavaScript
145 lines
3.9 KiB
JavaScript
const Config = require('../lib/Config');
|
|
const sessionToken = 'legacySessionToken';
|
|
const rp = require('request-promise');
|
|
const Parse = require('parse/node');
|
|
|
|
function createUser() {
|
|
const config = Config.get(Parse.applicationId);
|
|
const user = {
|
|
objectId: '1234567890',
|
|
username: 'hello',
|
|
password: 'pass',
|
|
_session_token: sessionToken,
|
|
};
|
|
return config.database.create('_User', user);
|
|
}
|
|
|
|
describe_only_db('mongo')('revocable sessions', () => {
|
|
beforeEach(done => {
|
|
// Create 1 user with the legacy
|
|
createUser().then(done);
|
|
});
|
|
|
|
it('should upgrade legacy session token', done => {
|
|
const user = Parse.Object.fromJSON({
|
|
className: '_User',
|
|
objectId: '1234567890',
|
|
sessionToken: sessionToken,
|
|
});
|
|
user
|
|
._upgradeToRevocableSession()
|
|
.then(res => {
|
|
expect(res.getSessionToken().indexOf('r:')).toBe(0);
|
|
const config = Config.get(Parse.applicationId);
|
|
// use direct access to the DB to make sure we're not
|
|
// getting the session token stripped
|
|
return config.database
|
|
.loadSchema()
|
|
.then(schemaController => {
|
|
return schemaController.getOneSchema('_User', true);
|
|
})
|
|
.then(schema => {
|
|
return config.database.adapter.find(
|
|
'_User',
|
|
schema,
|
|
{ objectId: '1234567890' },
|
|
{}
|
|
);
|
|
})
|
|
.then(results => {
|
|
expect(results.length).toBe(1);
|
|
expect(results[0].sessionToken).toBeUndefined();
|
|
});
|
|
})
|
|
.then(
|
|
() => {
|
|
done();
|
|
},
|
|
err => {
|
|
jfail(err);
|
|
done();
|
|
}
|
|
);
|
|
});
|
|
|
|
it('should be able to become with revocable session token', done => {
|
|
const user = Parse.Object.fromJSON({
|
|
className: '_User',
|
|
objectId: '1234567890',
|
|
sessionToken: sessionToken,
|
|
});
|
|
user
|
|
._upgradeToRevocableSession()
|
|
.then(res => {
|
|
expect(res.getSessionToken().indexOf('r:')).toBe(0);
|
|
return Parse.User.logOut()
|
|
.then(() => {
|
|
return Parse.User.become(res.getSessionToken());
|
|
})
|
|
.then(user => {
|
|
expect(user.id).toEqual('1234567890');
|
|
});
|
|
})
|
|
.then(
|
|
() => {
|
|
done();
|
|
},
|
|
err => {
|
|
jfail(err);
|
|
done();
|
|
}
|
|
);
|
|
});
|
|
|
|
it('should not upgrade bad legacy session token', done => {
|
|
rp.post({
|
|
url: Parse.serverURL + '/upgradeToRevocableSession',
|
|
headers: {
|
|
'X-Parse-Application-Id': Parse.applicationId,
|
|
'X-Parse-Rest-API-Key': 'rest',
|
|
'X-Parse-Session-Token': 'badSessionToken',
|
|
},
|
|
json: true,
|
|
})
|
|
.then(
|
|
() => {
|
|
fail('should not be able to upgrade a bad token');
|
|
},
|
|
response => {
|
|
expect(response.statusCode).toBe(400);
|
|
expect(response.error).not.toBeUndefined();
|
|
expect(response.error.code).toBe(Parse.Error.INVALID_SESSION_TOKEN);
|
|
expect(response.error.error).toEqual('invalid legacy session token');
|
|
}
|
|
)
|
|
.then(() => {
|
|
done();
|
|
});
|
|
});
|
|
|
|
it('should not crash without session token #2720', done => {
|
|
rp.post({
|
|
url: Parse.serverURL + '/upgradeToRevocableSession',
|
|
headers: {
|
|
'X-Parse-Application-Id': Parse.applicationId,
|
|
'X-Parse-Rest-API-Key': 'rest',
|
|
},
|
|
json: true,
|
|
})
|
|
.then(
|
|
() => {
|
|
fail('should not be able to upgrade a bad token');
|
|
},
|
|
response => {
|
|
expect(response.statusCode).toBe(404);
|
|
expect(response.error).not.toBeUndefined();
|
|
expect(response.error.code).toBe(Parse.Error.OBJECT_NOT_FOUND);
|
|
expect(response.error.error).toEqual('invalid session');
|
|
}
|
|
)
|
|
.then(() => {
|
|
done();
|
|
});
|
|
});
|
|
});
|