1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
4 import { expect } from 'chai'
5 import { ServerConfig, User, UserRole } from '@shared/models'
13 loginUsingExternalToken,
16 setAccessTokensToServers,
22 } from '../../../shared/extra-utils'
23 import { cleanupTests, flushAndRunServer, ServerInfo, waitUntilLog } from '../../../shared/extra-utils/server/servers'
25 async function loginExternal (options: {
31 statusCodeExpected?: number
33 const res = await getExternalAuth({
34 url: options.server.url,
35 npmName: options.npmName,
37 authName: options.authName,
39 statusCodeExpected: options.statusCodeExpected || 302
42 if (res.status !== 302) return
44 const location = res.header.location
45 const { externalAuthToken } = decodeQueryString(location)
47 const resLogin = await loginUsingExternalToken(
50 externalAuthToken as string
56 describe('Test external auth plugins', function () {
57 let server: ServerInfo
59 let cyanAccessToken: string
60 let cyanRefreshToken: string
62 let kefkaAccessToken: string
63 let kefkaRefreshToken: string
65 let externalAuthToken: string
67 before(async function () {
70 server = await flushAndRunServer(1)
71 await setAccessTokensToServers([ server ])
73 for (const suffix of [ 'one', 'two' ]) {
76 accessToken: server.accessToken,
77 path: getPluginTestPath('-external-auth-' + suffix)
82 it('Should display the correct configuration', async function () {
83 const res = await getConfig(server.url)
85 const config: ServerConfig = res.body
87 const auths = config.plugin.registeredExternalAuths
88 expect(auths).to.have.lengthOf(3)
90 const auth2 = auths.find((a) => a.authName === 'external-auth-2')
91 expect(auth2).to.exist
92 expect(auth2.authDisplayName).to.equal('External Auth 2')
93 expect(auth2.npmName).to.equal('peertube-plugin-test-external-auth-one')
96 it('Should redirect for a Cyan login', async function () {
97 const res = await getExternalAuth({
99 npmName: 'test-external-auth-one',
101 authName: 'external-auth-1',
105 statusCodeExpected: 302
108 const location = res.header.location
109 expect(location.startsWith('/login?')).to.be.true
111 const searchParams = decodeQueryString(location)
113 expect(searchParams.externalAuthToken).to.exist
114 expect(searchParams.username).to.equal('cyan')
116 externalAuthToken = searchParams.externalAuthToken as string
119 it('Should reject auto external login with a missing or invalid token', async function () {
120 await loginUsingExternalToken(server, 'cyan', '', 400)
121 await loginUsingExternalToken(server, 'cyan', 'blabla', 400)
124 it('Should reject auto external login with a missing or invalid username', async function () {
125 await loginUsingExternalToken(server, '', externalAuthToken, 400)
126 await loginUsingExternalToken(server, '', externalAuthToken, 400)
129 it('Should reject auto external login with an expired token', async function () {
134 await loginUsingExternalToken(server, 'cyan', externalAuthToken, 400)
136 await waitUntilLog(server, 'expired external auth token')
139 it('Should auto login Cyan, create the user and use the token', async function () {
141 const res = await loginExternal({
143 npmName: 'test-external-auth-one',
144 authName: 'external-auth-1',
151 cyanAccessToken = res.access_token
152 cyanRefreshToken = res.refresh_token
156 const res = await getMyUserInformation(server.url, cyanAccessToken)
158 const body: User = res.body
159 expect(body.username).to.equal('cyan')
160 expect(body.account.displayName).to.equal('cyan')
161 expect(body.email).to.equal('cyan@example.com')
162 expect(body.role).to.equal(UserRole.USER)
166 it('Should auto login Kefka, create the user and use the token', async function () {
168 const res = await loginExternal({
170 npmName: 'test-external-auth-one',
171 authName: 'external-auth-2',
175 kefkaAccessToken = res.access_token
176 kefkaRefreshToken = res.refresh_token
180 const res = await getMyUserInformation(server.url, kefkaAccessToken)
182 const body: User = res.body
183 expect(body.username).to.equal('kefka')
184 expect(body.account.displayName).to.equal('Kefka Palazzo')
185 expect(body.email).to.equal('kefka@example.com')
186 expect(body.role).to.equal(UserRole.ADMINISTRATOR)
190 it('Should refresh Cyan token, but not Kefka token', async function () {
192 const resRefresh = await refreshToken(server, cyanRefreshToken)
193 cyanAccessToken = resRefresh.body.access_token
194 cyanRefreshToken = resRefresh.body.refresh_token
196 const res = await getMyUserInformation(server.url, cyanAccessToken)
197 const user: User = res.body
198 expect(user.username).to.equal('cyan')
202 await refreshToken(server, kefkaRefreshToken, 400)
206 it('Should update Cyan profile', async function () {
209 accessToken: cyanAccessToken,
210 displayName: 'Cyan Garamonde',
211 description: 'Retainer to the king of Doma'
214 const res = await getMyUserInformation(server.url, cyanAccessToken)
216 const body: User = res.body
217 expect(body.account.displayName).to.equal('Cyan Garamonde')
218 expect(body.account.description).to.equal('Retainer to the king of Doma')
221 it('Should logout Cyan', async function () {
222 await logout(server.url, cyanAccessToken)
225 it('Should have logged out Cyan', async function () {
226 await waitUntilLog(server, 'On logout cyan')
228 await getMyUserInformation(server.url, cyanAccessToken, 401)
231 it('Should login Cyan and keep the old existing profile', async function () {
233 const res = await loginExternal({
235 npmName: 'test-external-auth-one',
236 authName: 'external-auth-1',
243 cyanAccessToken = res.access_token
246 const res = await getMyUserInformation(server.url, cyanAccessToken)
248 const body: User = res.body
249 expect(body.username).to.equal('cyan')
250 expect(body.account.displayName).to.equal('Cyan Garamonde')
251 expect(body.account.description).to.equal('Retainer to the king of Doma')
252 expect(body.role).to.equal(UserRole.USER)
255 it('Should reject token of Kefka by the plugin hook', async function () {
260 await getMyUserInformation(server.url, kefkaAccessToken, 401)
263 it('Should unregister external-auth-2 and do not login existing Kefka', async function () {
264 await updatePluginSettings({
266 accessToken: server.accessToken,
267 npmName: 'peertube-plugin-test-external-auth-one',
268 settings: { disableKefka: true }
271 await userLogin(server, { username: 'kefka', password: 'fake' }, 400)
273 await loginExternal({
275 npmName: 'test-external-auth-one',
276 authName: 'external-auth-2',
281 statusCodeExpected: 404
285 it('Should have disabled this auth', async function () {
286 const res = await getConfig(server.url)
288 const config: ServerConfig = res.body
290 const auths = config.plugin.registeredExternalAuths
291 expect(auths).to.have.lengthOf(2)
293 const auth1 = auths.find(a => a.authName === 'external-auth-2')
294 expect(auth1).to.not.exist
297 it('Should uninstall the plugin one and do not login Cyan', async function () {
298 await uninstallPlugin({
300 accessToken: server.accessToken,
301 npmName: 'peertube-plugin-test-external-auth-one'
304 await loginExternal({
306 npmName: 'test-external-auth-one',
307 authName: 'external-auth-1',
312 statusCodeExpected: 404
316 it('Should display the correct configuration', async function () {
317 const res = await getConfig(server.url)
319 const config: ServerConfig = res.body
321 const auths = config.plugin.registeredExternalAuths
322 expect(auths).to.have.lengthOf(1)
324 const auth2 = auths.find((a) => a.authName === 'external-auth-2')
325 expect(auth2).to.not.exist
328 after(async function () {
329 await cleanupTests([ server ])