openhim-core

should = require 'should' request = require 'supertest' server = require '../../lib/server' contact = require '../../lib/contact' User = require('../../lib/model/users').User testUtils = require "../testUtils" auth = require("../testUtils").auth sinon = require "sinon" moment = require 'moment' describe 'API Integration Tests', -> describe 'Users REST Api testing', -> user1 = new User firstname: 'Ryan' surname: 'Chrichton' email: 'r..@jembi.org' passwordAlgorithm: 'sha512' passwordHash: '796a5a8e-4e44-4d9f-9e04-c27ec6374ffa' passwordSalt: 'bf93caba-6eec-4c0c-a1a3-d968a7533fd7' groups: [ 'admin', 'RHIE' ] user2 = new User firstname: 'Bill' surname: 'Murray' email: 'bfm@crazy.net' passwordAlgorithm: 'sha512' passwordHash: '3cc90918-7044-4e55-b61d-92ae73cb261e' passwordSalt: '22a61686-66f6-483c-a524-185aac251fb0' groups: [ 'HISP' ] newUser = new User firstname: 'Jane' surname: 'Doe' email: 'jane@doe.net' token: 'l9Q87x4b0OXHM9eaUBHIv59co5NZG1bM' tokenType: 'newUser' locked: true expiry: moment().add(2, 'days').utc().format() groups: [ 'HISP' ] newUserExpired = new User firstname: 'John' surname: 'Smith' email: 'john@smith.net' token: 'hS40KZItS7y9vqqEGhE6ARXtAA3wNhCg' tokenType: 'newUser' locked: true expiry: moment().subtract(2, 'days').utc().format() groups: [ 'HISP' ] authDetails = {} before (done) -> user1.save -> user2.save -> newUser.save -> newUserExpired.save -> auth.setupTestUsers (err) -> server.start apiPort: 8080, -> done() after (done) -> User.remove {}, -> auth.cleanupTestUsers (err) -> server.stop -> done() beforeEach -> authDetails = auth.getAuthDetails() describe '*authenticate(email)', -> it 'should return the requested users salt', (done) -> request("https://localhost:8080") .get("/authenticate/bfm@crazy.net") .set("auth-username", testUtils.rootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .expect(200) .end (err, res) -> if err done err else res.body.salt.should.eql '22a61686-66f6-483c-a524-185aac251fb0' should.exist(res.body.ts) done() describe '*userPasswordResetRequest(email)', -> it 'should return 403 when requesting root@openhim.org password reset', (done) -> request("https://localhost:8080") .get("/password-reset-request/root@openhim.org") .expect(403) .end (err, res) -> if err done err else done() it 'should update the user with a token and send reset email', (done) -> stubContact = sinon.stub(contact, 'sendEmail') stubContact.yields(null) request("https://localhost:8080") .get("/password-reset-request/r..@jembi.org") .expect(201) .end (err, res) -> if err done err else User.findOne { email: "r..@jembi.org" }, (err, user) -> user.should.have.property "firstname", "Ryan" user.should.have.property "surname", "Chrichton" user.should.have.property "token" user.should.have.property "tokenType", 'existingUser' user.should.have.property "expiry" stubContact.restore() done() it 'should update the user with a token get a 500 error when nodemailer fails', (done) -> stubContact = sinon.stub(contact, 'sendEmail') stubContact.yields('An error occurred trying to send the email.') request("https://localhost:8080") .get("/password-reset-request/r..@jembi.org") .expect(500) .end (err, res) -> stubContact.restore() if err done err else done() it 'should return a not found error', (done) -> request("https://localhost:8080") .get("/password-reset-request/test@jembi.org") .expect(404) .end (err, res) -> if err done err else done() describe '*getUserByToken(token)', -> it 'should return a users details (basic details)', (done) -> request("https://localhost:8080") .get("/token/l9Q87x4b0OXHM9eaUBHIv59co5NZG1bM") .expect(200) .end (err, res) -> if err done err else res.body.email.should.eql 'jane@doe.net' res.body.firstname.should.eql 'Jane' res.body.surname.should.eql 'Doe' res.body.token.should.eql 'l9Q87x4b0OXHM9eaUBHIv59co5NZG1bM' res.body.tokenType.should.eql 'newUser' res.body.locked.should.eql true should.exist(res.body.expiry) should.not.exist(res.body.passwordAlgorithm) should.not.exist(res.body.passwordHash) should.not.exist(res.body.passwordSalt) should.not.exist(res.body.groups) done() it 'should return a not found error', (done) -> request("https://localhost:8080") .get("/token/hSas987asdS7y9vqqKJHDSoARXtA098g") .expect(404) .end (err, res) -> if err done err else done() it 'should return a expired token error', (done) -> request("https://localhost:8080") .get("/token/hS40KZItS7y9vqqEGhE6ARXtAA3wNhCg") .expect(410) .end (err, res) -> if err done err else done() describe '*updateUserByToken(token)', -> it 'should update a user by the supplied token', (done) -> updates = firstname: 'Jane Sally' surname: 'Doe' msisdn: '27123456789' passwordAlgorithm: 'sha256' passwordHash: 'af200ab5-4227-4840-97d1-92ba91206499' passwordSalt: 'eca7205c-2129-4558-85da-45845d17bd5f' request("https://localhost:8080") .put("/token/l9Q87x4b0OXHM9eaUBHIv59co5NZG1bM") .send(updates) .expect(200) .end (err, res) -> if err done err else User.findOne { email: "jane@doe.net" }, (err, user) -> user.should.have.property "firstname", "Jane Sally" user.should.have.property "surname", "Doe" user.should.have.property "passwordHash", "af200ab5-4227-4840-97d1-92ba91206499" user.should.have.property "passwordSalt", "eca7205c-2129-4558-85da-45845d17bd5f" user.should.have.property "token", null user.should.have.property "tokenType", null user.should.have.property "locked", false user.should.have.property "expiry", null done() it 'should prevent an update with an expired token (expired token)', (done) -> updates = firstname: 'Peter' surname: 'smith' msisdn: '27123456789' passwordAlgorithm: 'sha256' passwordHash: 'af200ab5-4227-4840-97d1-92ba91206499' passwordSalt: 'eca7205c-2129-4558-85da-45845d17bd5f' request("https://localhost:8080") .put("/token/hS40KZItS7y9vqqEGhE6ARXtAA3wNhCg") .send(updates) .expect(410) .end (err, res) -> if err done err else done() describe '*getUsers()', -> it 'should fetch all users', (done) -> request("https://localhost:8080") .get("/users") .set("auth-username", testUtils.rootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .expect(200) .end (err, res) -> if err done err else # user1, user2, newUser, newUserExpired, + the 2 API test users and the root user res.body.length.should.be.eql(7); done() it 'should not allow non admin user to fetch all users', (done) -> request("https://localhost:8080") .get("/users") .set("auth-username", testUtils.nonRootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .expect(403) .end (err, res) -> if err done err else done() describe '*addUser()', -> it 'should add a new user', (done) -> newUser = firstname: 'Bill' surname: 'Newman' email: 'bill@newman.com' passwordAlgorithm: 'sha256' passwordHash: 'af200ab5-4227-4840-97d1-92ba91206499' passwordSalt: 'eca7205c-2129-4558-85da-45845d17bd5f' groups: [ 'HISP' ] request("https://localhost:8080") .post("/users") .set("auth-username", testUtils.rootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .send(newUser) .expect(201) .end (err, res) -> if err done err else User.findOne { email: 'bill@newman.com' }, (err, user) -> user.should.have.property 'firstname', 'Bill' user.should.have.property 'surname', 'Newman' user.groups.should.have.length 1 user.should.have.property 'token' user.should.have.property 'tokenType', 'newUser' user.should.have.property 'locked', true user.should.have.property 'expiry' done() it 'should not allow a non admin user to add a user', (done) -> newUser = {} request("https://localhost:8080") .post("/users") .set("auth-username", testUtils.nonRootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .send(newUser) .expect(403) .end (err, res) -> if err done err else done() describe '*findUserByUsername(email)', -> it 'should find a user by their email address', (done) -> request("https://localhost:8080") .get("/users/r..@jembi.org") .set("auth-username", testUtils.rootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .expect(200) .end (err, res) -> if err done err else res.body.should.have.property "surname", "Chrichton" res.body.should.have.property "email", "r..@jembi.org" res.body.groups.should.have.length 2 done() it 'should not allow a non admin user to find a user to email', (done) -> request("https://localhost:8080") .get("/users/r..@jembi.org") .set("auth-username", testUtils.nonRootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .expect(403) .end (err, res) -> if err done err else done() it 'should always allow a user to fetch their own details', (done) -> request("https://localhost:8080") .get("/users/" + testUtils.nonRootUser.email) .set("auth-username", testUtils.nonRootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .expect(200) .end (err, res) -> if err done err else res.body.should.have.property "firstname", "Non" res.body.should.have.property "surname", "Root" res.body.should.have.property "email", "nonroot@jembi.org" res.body.groups.should.have.length 2 done() describe '*updateUser(email)', -> it 'should update a specific user by email', (done) -> updates = _id: "thisShouldBeIgnored" surname: 'Crichton' email: 'rg..@jembi.org' groups: [ 'admin', 'RHIE', 'HISP' ] request("https://localhost:8080") .put("/users/r..@jembi.org") .set("auth-username", testUtils.rootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .send(updates) .expect(200) .end (err, res) -> if err done err else User.findOne { email: "rg..@jembi.org" }, (err, user) -> user.should.have.property "surname", "Crichton" user.should.have.property "email", "rg..@jembi.org" user.groups.should.have.length 3 done() it 'should not allow non admin users to update a user', (done) -> updates = {} request("https://localhost:8080") .put("/users/r..@jembi.org") .set("auth-username", testUtils.nonRootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .send(updates) .expect(403) .end (err, res) -> if err done err else done() it 'should always allow a user to update their own details', (done) -> updates = _id: "thisShouldBeIgnored" surname: 'Root-updated' request("https://localhost:8080") .put("/users/" + testUtils.nonRootUser.email) .set("auth-username", testUtils.nonRootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .send(updates) .expect(200) .end (err, res) -> if err done err else User.findOne { email: testUtils.nonRootUser.email }, (err, user) -> user.should.have.property "surname", "Root-updated" done() it 'should NOT allow a non-admin user to update their groups', (done) -> updates = _id: "thisShouldBeIgnored" groups: [ "admin" ] request("https://localhost:8080") .put("/users/" + testUtils.nonRootUser.email) .set("auth-username", testUtils.nonRootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .send(updates) .expect(200) .end (err, res) -> if err done err else User.findOne { email: testUtils.nonRootUser.email }, (err, user) -> user.groups.should.be.length 2 user.groups.should.not.containEql "admin" done() describe '*removeUser(email)', -> it 'should remove a specific user by email', (done) -> request("https://localhost:8080") .del("/users/bfm@crazy.net") .set("auth-username", testUtils.rootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .expect(200) .end (err, res) -> if err done err else User.find { name: "bfm@crazy.net" }, (err, users) -> users.should.have.length 0 done() it 'should not allow a non admin user to remove a user', (done) -> request("https://localhost:8080") .del("/users/bfm@crazy.net") .set("auth-username", testUtils.nonRootUser.email) .set("auth-ts", authDetails.authTS) .set("auth-salt", authDetails.authSalt) .set("auth-token", authDetails.authToken) .expect(403) .end (err, res) -> if err done err else done()