t5de-hub/apps/api/test/registration.test.ts

// Registration: open (new accounts can use the hub at once) or closed (they sign in, and wait for a moderator's
// approval); admins switch it in the console, and the environment gives the default.
import { afterAll, beforeAll, expect, test } from "bun:test";
import { openDatabase, type Database } from "@t5de/db";
import { createApp } from "../src/app";
import { createAuth } from "../src/auth";
import { ImvuClient } from "../src/imvu";
import { Settings } from "../src/settings";

const webURL = "http://web.test";
let db: Database;
let close: () => Promise<void>;
let base: string;
let stop: () => void;

beforeAll(async () => {
  ({ db, close } = await openDatabase("memory"));
  // Closed by default (as on staging), until an admin changes it.
  const settings = new Settings(db, { registration: "closed" });
  const auth = createAuth(db, { apiURL: "http://api.test", webURL, secret: "test-secret-test-secret-test-secret-1234", rateLimit: false, settings });
  const imvu = new ImvuClient("http://imvu.test", (async () => Response.json({ denormalized: {} })) as unknown as typeof fetch);
  const hub = createApp({ db, auth, imvu, webURL, settings });
  hub.app.listen({ port: 0, hostname: "127.0.0.1" });
  const server = hub.app.server as unknown as { port: number; stop: () => void };
  stop = () => server.stop();
  base = `http://127.0.0.1:${server.port}`;
});

afterAll(async () => {
  stop();
  await close();
});

async function call(cookie: { v: string }, method: string, path: string, body?: unknown) {
  const res = await fetch(base + path, {
    method,
    headers: { Origin: webURL, ...(body !== undefined ? { "Content-Type": "application/json" } : {}), ...(cookie.v ? { Cookie: cookie.v } : {}) },
    body: body !== undefined ? JSON.stringify(body) : undefined,
  });
  const set = res.headers.getSetCookie();
  if (set.length) cookie.v = set.map((c) => c.split(";")[0]).join("; ");
  const text = await res.text();
  return { status: res.status, json: text ? JSON.parse(text) : undefined };
}

async function signUp(name: string) {
  const cookie = { v: "" };
  expect((await call(cookie, "POST", "/api/auth/sign-up/email", { email: `${name}@example.test`, password: "a long password", name, username: name })).status).toBe(200);
  return cookie;
}

test("closed: new accounts wait for approval; the first one runs the hub", async () => {
  expect((await call({ v: "" }, "GET", "/api/v1/hub")).json).toEqual({ registration: "closed" });
  const admin = await signUp("ada");
  expect((await call(admin, "GET", "/api/v1/me")).json.person).toMatchObject({ role: "admin", approved: true });
  expect((await call(admin, "GET", "/api/v1/account")).status).toBe(200);

  const bo = await signUp("bo_");
  // Signed in, but nothing else.
  expect((await call(bo, "GET", "/api/v1/me")).json.person).toMatchObject({ role: "user", approved: false });
  expect(await call(bo, "GET", "/api/v1/account")).toMatchObject({ status: 403, json: { error: "awaiting_approval" } });
  expect((await call(bo, "POST", "/api/v1/account/links", { username: "someone" })).status).toBe(403);
  expect((await call(bo, "GET", "/api/v1/console")).status).toBe(403);

  // Moderators see who's waiting, and approve them.
  expect((await call(admin, "GET", "/api/v1/console")).json.counts.waiting).toBe(1);
  const waiting = (await call(admin, "GET", "/api/v1/console/people?waiting=true")).json.people;
  expect(waiting.map((p: any) => p.username)).toEqual(["bo_"]);
  expect((await call(admin, "POST", `/api/v1/console/people/${waiting[0].id}/approve`)).json.person.approved).toBe(true);
  expect((await call(bo, "GET", "/api/v1/account")).status).toBe(200);
  expect((await call(admin, "GET", "/api/v1/console/people?waiting=true")).json.people).toEqual([]);
  // An approved account can't be declined.
  expect((await call(admin, "POST", `/api/v1/console/people/${waiting[0].id}/decline`)).status).toBe(400);
});

test("declining deletes the account", async () => {
  const admin = { v: "" };
  await call(admin, "POST", "/api/auth/sign-in/username", { username: "ada", password: "a long password" });
  const cy = await signUp("cyd");
  const [p] = (await call(admin, "GET", "/api/v1/console/people?waiting=true")).json.people;
  expect(p.username).toBe("cyd");
  expect((await call(admin, "POST", `/api/v1/console/people/${p.id}/decline`)).status).toBe(200);
  expect((await call(cy, "GET", "/api/v1/me")).status).toBe(401);
  expect((await call({ v: "" }, "POST", "/api/auth/sign-in/username", { username: "cyd", password: "a long password" })).status).toBe(401);
});

test("only admins open or close registration", async () => {
  const admin = { v: "" };
  await call(admin, "POST", "/api/auth/sign-in/username", { username: "ada", password: "a long password" });
  const mod = await signUp("dot");
  const dot = (await call(admin, "GET", "/api/v1/console/people?waiting=true")).json.people[0];
  await call(admin, "POST", `/api/v1/console/people/${dot.id}/approve`);
  await call(admin, "POST", `/api/v1/console/people/${dot.id}/role`, { role: "moderator" });
  expect((await call(mod, "GET", "/api/v1/console/settings")).json).toEqual({ registration: "closed" });
  expect((await call(mod, "PUT", "/api/v1/console/settings", { registration: "open" })).status).toBe(403);

  expect((await call(admin, "PUT", "/api/v1/console/settings", { registration: "open" })).json).toEqual({ registration: "open" });
  expect((await call({ v: "" }, "GET", "/api/v1/hub")).json).toEqual({ registration: "open" });
  // Open: new accounts can use the hub at once.
  const eve = await signUp("eve");
  expect((await call(eve, "GET", "/api/v1/account")).status).toBe(200);
  const audit = (await call(admin, "GET", "/api/v1/console")).json.audit.map((e: any) => e.action);
  expect(audit).toContain("hub.registration");
});