Claude
91c206bf76
Phase 5: the account-provisioning backend — link-only stays, plus hybrid self-signup, an admin email-invite tool, and site-side unlink. - uoLinkClient.createAccount / unlinkAccount (v2). Password is forwarded to the shard (hashed there) and never stored/logged; the end-user browser IP is passed for the shard's per-IP cap; actor is stamped server-side. - Hybrid signup: POST /player/shard/account provisions a game account (its own username + password) for the signed-in user and mirrors the link locally. Gated by the new game_account_signup setting AND the shard's own mode (mapped 403/409/ 429/400/503). Serves both self-serve signup and the invite-accept game step. - Email invites: user_invites table (sha256 token hash, single-use, expiring); invites model + admin CRUD (POST/GET/DELETE /admin/invites, admin-only) + mailer.sendInvite (falls back to returning the accept link if email is off); public token-gated accept (GET /auth/invite/:token, POST .../accept) creates the user at the invite's preset role and logs them in, bypassing the registration gate. Accept is race-safe (atomic single-use; rolls back the user if it loses). - Admin unlink: DELETE /admin/users/:id/shard/link/:account (admin-only) + local mirror drop; account.unlinked ingest reconciles the mirror when a player runs [unlink in game. account.audit / account.unlinked are logged (admin channel only — never on the public SSE allowlist). Tests: invites model (hashing, single-use, expiry, revoke) + account.* ingest reconcile/visibility. Full suite 193/193; swagger regenerated. Refs .plans/protocol2-integration.md (Phase 5). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
79 lines
3.3 KiB
JavaScript
79 lines
3.3 KiB
JavaScript
const { test, beforeEach, afterEach } = require('node:test')
|
|
const assert = require('node:assert/strict')
|
|
|
|
// Exercise invite create/lookup/single-use accept against an in-memory fake by
|
|
// monkeypatching the shared db module the model require()s. No DB.
|
|
const db = require('../src/model/invites/invites.db')
|
|
const invites = require('../src/model/invites/invites.model')
|
|
|
|
let rows
|
|
let nextId
|
|
const saved = {}
|
|
|
|
beforeEach(() => {
|
|
rows = []
|
|
nextId = 1
|
|
for (const k of ['insert', 'getById', 'findByTokenHash', 'markAccepted', 'revoke']) saved[k] = db[k]
|
|
db.insert = async ({ tokenHash, email, role, invitedBy, expiresAt }) => {
|
|
const id = nextId++
|
|
rows.push({ id, token_hash: tokenHash, email, role, status: 'pending', invited_by: invitedBy ?? null, accepted_user_id: null, expires_at: expiresAt, created_at: new Date(), accepted_at: null })
|
|
return id
|
|
}
|
|
db.getById = async (id) => rows.find((r) => r.id === id) || null
|
|
db.findByTokenHash = async (h) => rows.find((r) => r.token_hash === h) || null
|
|
db.markAccepted = async (id, userId) => {
|
|
const row = rows.find((r) => r.id === id && r.status === 'pending')
|
|
if (!row) return 0
|
|
row.status = 'accepted'
|
|
row.accepted_user_id = userId
|
|
return 1
|
|
}
|
|
db.revoke = async (id) => {
|
|
const row = rows.find((r) => r.id === id && r.status === 'pending')
|
|
if (!row) return 0
|
|
row.status = 'revoked'
|
|
return 1
|
|
}
|
|
})
|
|
|
|
afterEach(() => {
|
|
for (const k of Object.keys(saved)) db[k] = saved[k]
|
|
})
|
|
|
|
test('create stores only the token hash, never the plaintext token', async () => {
|
|
const { invite, token } = await invites.create({ email: 'a@b.com', role: 'player', invitedBy: 1 })
|
|
assert.ok(token && token.length >= 20)
|
|
assert.equal(rows[0].token_hash, invites.hashToken(token))
|
|
assert.notEqual(rows[0].token_hash, token) // hash, not the raw token
|
|
assert.equal(invite.email, 'a@b.com')
|
|
assert.equal(invite.role, 'player')
|
|
assert.equal(invite.status, 'pending')
|
|
})
|
|
|
|
test('findValidByToken resolves a pending token and rejects a wrong/used one', async () => {
|
|
const { token } = await invites.create({ email: 'a@b.com', role: 'moderator', invitedBy: 1 })
|
|
assert.ok(await invites.findValidByToken(token))
|
|
assert.equal(await invites.findValidByToken('not-a-real-token'), null)
|
|
})
|
|
|
|
test('accept is single-use — the second accept loses the race', async () => {
|
|
const { token } = await invites.create({ email: 'a@b.com', role: 'player', invitedBy: 1 })
|
|
const row = await invites.findValidByToken(token)
|
|
assert.equal(await invites.accept(row.id, 55), true)
|
|
assert.equal(await invites.accept(row.id, 66), false) // already consumed
|
|
assert.equal(await invites.findValidByToken(token), null) // no longer pending
|
|
})
|
|
|
|
test('an expired invite is not valid (exercises the expiry branch, not a bad token)', async () => {
|
|
const { token } = await invites.create({ email: 'a@b.com', role: 'player', invitedBy: 1, ttlDays: -1 })
|
|
// The token itself is correct and the row is pending — only expires_at rejects it.
|
|
assert.ok(rows[0] && rows[0].status === 'pending')
|
|
assert.equal(await invites.findValidByToken(token), null)
|
|
})
|
|
|
|
test('revoke makes a pending invite unusable', async () => {
|
|
const { invite, token } = await invites.create({ email: 'a@b.com', role: 'player', invitedBy: 1 })
|
|
assert.equal(await invites.revoke(invite.id), 1)
|
|
assert.equal(await invites.findValidByToken(token), null)
|
|
})
|