Merge pull request #15583 from HabitRPG/kalista/username-sanitize

Sanitize usernames come from social auth
2026-01-15 12:00:56 -06:00
parent 4767461c4f 215b26acac
commit ba9a1ab2a9
2 changed files with 64 additions and 3 deletions
@@ -65,6 +65,52 @@ describe('POST /user/auth/social', () => {
      await expect(getProperty('users', response.id, 'profile.name')).to.eventually.equal('a google user');
    });

+    it('includes sanitized version of provided username', async () => {
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+        username: 'Google User Name',
+      });
+
+      await expect(getProperty('users', response.id, 'auth.local.username')).to.eventually.equal('GoogleUserName');
+      await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.equal('googleusername');
+    });
+
+    it('generates a random username if provided username contains only disallowed characters', async () => {
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+        username: 'Áîüè',
+      });
+
+      await expect(getProperty('users', response.id, 'auth.local.username')).to.eventually.contain('hb-');
+      await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.contain('hb-');
+    });
+
+    it('generates a random username if provided username contains a disallowed word', async () => {
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+        username: 'i am a TESTPLACEHOLDERSLURWORDHERE',
+      });
+
+      await expect(getProperty('users', response.id, 'auth.local.username')).to.eventually.contain('hb-');
+      await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.contain('hb-');
+    });
+
+    it('generates a random username if sanitized username conflicts with an extant user', async () => {
+      user = await generateUser({ 'auth.local.username': 'GoogleUserName' });
+
+      const response = await api.post(endpoint, {
+        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase
+        network,
+        username: 'Google User Name',
+      });
+
+      await expect(getProperty('users', response.id, 'auth.local.username')).to.eventually.contain('hb-');
+      await expect(getProperty('users', response.id, 'auth.local.lowerCaseUsername')).to.eventually.contain('hb-');
+    });
+
    it('fails if allowRegister is false and user does not exist', async () => {
      await expect(api.post(endpoint, {
        authResponse: { access_token: randomAccessToken }, // eslint-disable-line camelcase