From 5f5fc754b081f7887224f9a8f89add2a6530aa03 Mon Sep 17 00:00:00 2001 From: Victor Piousbox Date: Mon, 21 Mar 2016 05:48:37 +0000 Subject: [PATCH 1/2] local login test --- .../user/auth/POST-login-local.test.js | 69 +++++++++++++++++++ website/src/controllers/api-v3/auth.js | 5 +- 2 files changed, 71 insertions(+), 3 deletions(-) create mode 100644 test/api/v3/integration/user/auth/POST-login-local.test.js diff --git a/test/api/v3/integration/user/auth/POST-login-local.test.js b/test/api/v3/integration/user/auth/POST-login-local.test.js new file mode 100644 index 0000000000..0938ecbb6f --- /dev/null +++ b/test/api/v3/integration/user/auth/POST-login-local.test.js @@ -0,0 +1,69 @@ +import { + generateUser, + requester, + translate as t, +} from '../../../../../helpers/api-integration/v3'; + +describe('POST /user/auth/local/login', () => { + let api; + let user; + let endpoint = '/user/auth/local/login'; + let password = 'password'; + beforeEach(async () => { + api = requester(); + user = await generateUser(); + }); + it('success with username', async () => { + let response = await api.post(endpoint, { + username: user.auth.local.username, + password, + }); + expect(response.apiToken).to.eql(user.apiToken); + }); + it('success with email', async () => { + let response = await api.post(endpoint, { + username: user.auth.local.email, + password, + }); + expect(response.apiToken).to.eql(user.apiToken); + }); + it('user is blocked', async () => { + await user.update({ 'auth.blocked': 1 }); + expect(api.post(endpoint, { + username: user.auth.local.username, + password, + })).to.eventually.be.rejected.and.eql({ + code: 400, + error: 'NotAuthorized', + message: t('accountSuspended', { userId: user._id }), + }); + }); + it('wrong password', async () => { + expect(api.post(endpoint, { + username: user.auth.local.username, + password: 'wrong-password', + })).to.eventually.be.rejected.and.eql({ + code: 400, + error: 'NotAuthorized', + message: t('wrongPassword'), + }); + }); + it('missing username', async () => { + expect(api.post(endpoint, { + password: 'wrong-password', + })).to.eventually.be.rejected.and.eql({ + code: 400, + error: 'NotAuthorized', + message: t('missingUsername'), + }); + }); + it('missing password', async () => { + expect(api.post(endpoint, { + username: user.auth.local.username, + })).to.eventually.be.rejected.and.eql({ + code: 400, + error: 'NotAuthorized', + message: t('missingPassword'), + }); + }); +}); diff --git a/website/src/controllers/api-v3/auth.js b/website/src/controllers/api-v3/auth.js index 875d8672ca..75a077c15f 100644 --- a/website/src/controllers/api-v3/auth.js +++ b/website/src/controllers/api-v3/auth.js @@ -179,7 +179,7 @@ function _loginRes (user, req, res) { api.loginLocal = { method: 'POST', url: '/user/auth/local/login', - middlewares: [cron], + middlewares: [], async handler (req, res) { req.checkBody({ username: { @@ -191,7 +191,6 @@ api.loginLocal = { errorMessage: res.t('missingPassword'), }, }); - let validationErrors = req.validationErrors(); if (validationErrors) throw validationErrors; @@ -210,7 +209,7 @@ api.loginLocal = { let user = await User.findOne(login, {auth: 1, apiToken: 1}).exec(); // TODO place back long error message return res.json(401, {err:"Uh-oh - your username or password is incorrect.\n- Make sure your username or email is typed correctly.\n- You may have signed up with Facebook, not email. Double-check by trying Facebook login.\n- If you forgot your password, click \"Forgot Password\"."}); - let isValidPassword = user && user.auth.local.hashed_password !== passwordUtils.encrypt(req.body.password, user.auth.local.salt); + let isValidPassword = user && user.auth.local.hashed_password === passwordUtils.encrypt(req.body.password, user.auth.local.salt); if (!isValidPassword) throw new NotAuthorized(res.t('invalidLoginCredentials')); _loginRes(user, ...arguments); From ddbb8a1beb9da6e106c3b00e1ed15f993266f5be Mon Sep 17 00:00:00 2001 From: Victor Piousbox Date: Mon, 21 Mar 2016 21:10:17 +0000 Subject: [PATCH 2/2] invalid login credentials fixes --- common/locales/en/api-v3.json | 1 + .../user/auth/POST-login-local.test.js | 22 +++++++++---------- website/src/controllers/api-v3/auth.js | 5 +---- 3 files changed, 13 insertions(+), 15 deletions(-) diff --git a/common/locales/en/api-v3.json b/common/locales/en/api-v3.json index 9f48532913..b506ac00e6 100644 --- a/common/locales/en/api-v3.json +++ b/common/locales/en/api-v3.json @@ -12,6 +12,7 @@ "usernameTaken": "Username already taken.", "passwordConfirmationMatch": "Password confirmation doesn't match password.", "invalidLoginCredentials": "Incorrect username / email and / or password.", + "invalidLoginCredentialsLong": "Uh-oh - your username or password is incorrect.\n- Make sure your username or email is typed correctly.\n- You may have signed up with Facebook, not email. Double-check by trying Facebook login.\n- If you forgot your password, click \"Forgot Password\".", "invalidCredentials": "User not found with given auth credentials.", "accountSuspended": "Account has been suspended, please contact leslie@habitica.com with your UUID \"<%= userId %>\" for assistance.", "onlyFbSupported": "Only Facebook supported currently.", diff --git a/test/api/v3/integration/user/auth/POST-login-local.test.js b/test/api/v3/integration/user/auth/POST-login-local.test.js index 0938ecbb6f..571b23c3ea 100644 --- a/test/api/v3/integration/user/auth/POST-login-local.test.js +++ b/test/api/v3/integration/user/auth/POST-login-local.test.js @@ -29,41 +29,41 @@ describe('POST /user/auth/local/login', () => { }); it('user is blocked', async () => { await user.update({ 'auth.blocked': 1 }); - expect(api.post(endpoint, { + await expect(api.post(endpoint, { username: user.auth.local.username, password, })).to.eventually.be.rejected.and.eql({ - code: 400, + code: 401, error: 'NotAuthorized', message: t('accountSuspended', { userId: user._id }), }); }); it('wrong password', async () => { - expect(api.post(endpoint, { + await expect(api.post(endpoint, { username: user.auth.local.username, password: 'wrong-password', })).to.eventually.be.rejected.and.eql({ - code: 400, + code: 401, error: 'NotAuthorized', - message: t('wrongPassword'), + message: t('invalidLoginCredentialsLong'), }); }); it('missing username', async () => { - expect(api.post(endpoint, { + await expect(api.post(endpoint, { password: 'wrong-password', })).to.eventually.be.rejected.and.eql({ code: 400, - error: 'NotAuthorized', - message: t('missingUsername'), + error: 'BadRequest', + message: t('invalidReqParams'), }); }); it('missing password', async () => { - expect(api.post(endpoint, { + await expect(api.post(endpoint, { username: user.auth.local.username, })).to.eventually.be.rejected.and.eql({ code: 400, - error: 'NotAuthorized', - message: t('missingPassword'), + error: 'BadRequest', + message: t('invalidReqParams'), }); }); }); diff --git a/website/src/controllers/api-v3/auth.js b/website/src/controllers/api-v3/auth.js index 75a077c15f..322e602350 100644 --- a/website/src/controllers/api-v3/auth.js +++ b/website/src/controllers/api-v3/auth.js @@ -207,11 +207,8 @@ api.loginLocal = { } let user = await User.findOne(login, {auth: 1, apiToken: 1}).exec(); - - // TODO place back long error message return res.json(401, {err:"Uh-oh - your username or password is incorrect.\n- Make sure your username or email is typed correctly.\n- You may have signed up with Facebook, not email. Double-check by trying Facebook login.\n- If you forgot your password, click \"Forgot Password\"."}); let isValidPassword = user && user.auth.local.hashed_password === passwordUtils.encrypt(req.body.password, user.auth.local.salt); - - if (!isValidPassword) throw new NotAuthorized(res.t('invalidLoginCredentials')); + if (!isValidPassword) throw new NotAuthorized(res.t('invalidLoginCredentialsLong')); _loginRes(user, ...arguments); }, };