|
| 1 | +// @vitest-environment jsdom |
| 2 | +import { randomBytes } from "node:crypto"; |
| 3 | +import { generateJWT } from "@trigger.dev/core/v3/jwt"; |
| 4 | +import { expect, it } from "vitest"; |
| 5 | +import { getTestServer } from "./helpers/sharedTestServer"; |
| 6 | +import { seedTestUser } from "./helpers/seedTestSession"; |
| 7 | + |
| 8 | +// Must match the webapp test container's SESSION_SECRET. |
| 9 | +const SESSION_SECRET = "test-session-secret-for-e2e-tests"; |
| 10 | +const CONFIRM_PATH = "/account/email/confirm"; |
| 11 | + |
| 12 | +async function pendingChange(expirationTime = "1h") { |
| 13 | + const { prisma } = getTestServer(); |
| 14 | + const user = await seedTestUser(prisma); |
| 15 | + const email = `new-${randomBytes(6).toString("hex")}@test.local`; |
| 16 | + await prisma.user.update({ where: { id: user.id }, data: { pendingEmail: email } }); |
| 17 | + const jwt = await generateJWT({ |
| 18 | + secretKey: SESSION_SECRET, |
| 19 | + payload: { kind: "email_change", sub: user.id, email }, |
| 20 | + expirationTime, |
| 21 | + }); |
| 22 | + return { user, email, token: `tr_ecc_${jwt}` }; |
| 23 | +} |
| 24 | + |
| 25 | +async function openConfirmation(token: string) { |
| 26 | + const { webapp } = getTestServer(); |
| 27 | + const landing = await webapp.fetch(`${CONFIRM_PATH}?token=${encodeURIComponent(token)}`, { |
| 28 | + redirect: "manual", |
| 29 | + }); |
| 30 | + expect(landing.status).toBe(302); |
| 31 | + expect(landing.headers.get("location")).toBe(CONFIRM_PATH); |
| 32 | + expect(landing.headers.get("referrer-policy")).toBe("no-referrer"); |
| 33 | + const cookie = landing.headers.get("set-cookie")?.split(";")[0] ?? ""; |
| 34 | + const page = await webapp.fetch(CONFIRM_PATH, { |
| 35 | + headers: { Cookie: cookie }, |
| 36 | + redirect: "manual", |
| 37 | + }); |
| 38 | + expect(page.status).toBe(200); |
| 39 | + return { page, cookie }; |
| 40 | +} |
| 41 | + |
| 42 | +it("redirects off the token URL and confirms only when the rendered form is submitted", async () => { |
| 43 | + const { prisma } = getTestServer(); |
| 44 | + const { user, email, token } = await pendingChange(); |
| 45 | + const { page, cookie } = await openConfirmation(token); |
| 46 | + const document = new DOMParser().parseFromString(await page.text(), "text/html"); |
| 47 | + expect(document.body.textContent).toContain(email); |
| 48 | + const input = document.querySelector<HTMLInputElement>('input[name="token"]'); |
| 49 | + const form = input?.form; |
| 50 | + if (!form) throw new Error("No confirmation form rendered"); |
| 51 | + expect(form.method).toBe("post"); |
| 52 | + const action = new URL(form.getAttribute("action") || page.url, page.url); |
| 53 | + expect(action.search).toBe(""); |
| 54 | + expect(await prisma.user.findFirstOrThrow({ where: { id: user.id } })).toMatchObject({ |
| 55 | + email: user.email, |
| 56 | + pendingEmail: email, |
| 57 | + }); |
| 58 | + |
| 59 | + const body = new URLSearchParams(); |
| 60 | + for (const [name, value] of new FormData(form)) { |
| 61 | + if (typeof value === "string") body.append(name, value); |
| 62 | + } |
| 63 | + const response = await fetch(action, { |
| 64 | + method: form.method, |
| 65 | + headers: { Cookie: cookie }, |
| 66 | + body, |
| 67 | + redirect: "manual", |
| 68 | + }); |
| 69 | + expect(response.status).toBe(302); |
| 70 | + expect(response.headers.get("location")).toBe("/login"); |
| 71 | + expect(await prisma.user.findFirstOrThrow({ where: { id: user.id } })).toMatchObject({ |
| 72 | + email, |
| 73 | + pendingEmail: null, |
| 74 | + }); |
| 75 | +}); |
| 76 | + |
| 77 | +it("does not accept a confirmation token from the URL instead of the POST body", async () => { |
| 78 | + const { prisma, webapp } = getTestServer(); |
| 79 | + const { user, email, token } = await pendingChange(); |
| 80 | + const response = await webapp.fetch(`${CONFIRM_PATH}?token=${encodeURIComponent(token)}`, { |
| 81 | + method: "POST", |
| 82 | + body: new URLSearchParams(), |
| 83 | + redirect: "manual", |
| 84 | + }); |
| 85 | + expect(response.status).toBe(302); |
| 86 | + expect(await prisma.user.findFirstOrThrow({ where: { id: user.id } })).toMatchObject({ |
| 87 | + email: user.email, |
| 88 | + pendingEmail: email, |
| 89 | + }); |
| 90 | +}); |
| 91 | + |
| 92 | +it("shows an error without a confirmation form for invalid or expired links", async () => { |
| 93 | + const { token } = await pendingChange("-1h"); |
| 94 | + for (const invalidToken of ["invalid", token]) { |
| 95 | + const { page } = await openConfirmation(invalidToken); |
| 96 | + const document = new DOMParser().parseFromString(await page.text(), "text/html"); |
| 97 | + expect(document.body.textContent).toContain("invalid or has expired"); |
| 98 | + expect(document.querySelector('input[name="token"]')).toBeNull(); |
| 99 | + expect(document.querySelector('button[type="submit"]')).toBeNull(); |
| 100 | + } |
| 101 | +}); |
0 commit comments