github/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2024-11-26 19:53:59 -05:00
Code Issues Projects Releases Packages Wiki Activity

Change createTokenForUser signature

Browse source 
user is now used instead of username

Signed-off-by: Yannick Bungers <git@innay.de>
This commit is contained in:
Yannick Bungers 2021-10-13 22:59:51 +02:00
parent d33cfa4541
commit 325e1893f8
3 changed files with 8 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/api/private/tokens/tokens.controller.ts
View file

@ -51,11 +51,7 @@ export class TokensController {
@Body('validUntil') validUntil: TimestampMillis, @Body('validUntil') validUntil: TimestampMillis,
@RequestUser() user: User, @RequestUser() user: User,
): Promise<AuthTokenWithSecretDto> { ): Promise<AuthTokenWithSecretDto> {
return await this.authService.createTokenForUser( return await this.authService.createTokenForUser(user, label, validUntil);
user.username,
label,
validUntil,
);
} }
@Delete('/:keyId') @Delete('/:keyId')

18
src/auth/auth.service.spec.ts
View file

@ -229,10 +229,7 @@ describe('AuthService', () => {
describe('works', () => { describe('works', () => {
const identifier = 'testIdentifier'; const identifier = 'testIdentifier';
it('with validUntil 0', async () => { it('with validUntil 0', async () => {
jest.spyOn(userRepo, 'findOne').mockResolvedValueOnce({ jest.spyOn(authTokenRepo, 'find').mockResolvedValueOnce([authToken]);
...user,
authTokens: [authToken],
});
jest jest
.spyOn(authTokenRepo, 'save') .spyOn(authTokenRepo, 'save')
.mockImplementationOnce( .mockImplementationOnce(
@ -241,11 +238,7 @@ describe('AuthService', () => {
return authTokenSaved; return authTokenSaved;
}, },
); );
const token = await service.createTokenForUser( const token = await service.createTokenForUser(user, identifier, 0);
user.username,
identifier,
0,
);
expect(token.label).toEqual(identifier); expect(token.label).toEqual(identifier);
expect( expect(
token.validUntil.getTime() - token.validUntil.getTime() -
@ -255,10 +248,7 @@ describe('AuthService', () => {
expect(token.secret.startsWith(token.keyId)).toBeTruthy(); expect(token.secret.startsWith(token.keyId)).toBeTruthy();
}); });
it('with validUntil not 0', async () => { it('with validUntil not 0', async () => {
jest.spyOn(userRepo, 'findOne').mockResolvedValueOnce({ jest.spyOn(authTokenRepo, 'find').mockResolvedValueOnce([authToken]);
...user,
authTokens: [authToken],
});
jest jest
.spyOn(authTokenRepo, 'save') .spyOn(authTokenRepo, 'save')
.mockImplementationOnce( .mockImplementationOnce(
@ -269,7 +259,7 @@ describe('AuthService', () => {
); );
const validUntil = new Date().getTime() + 30000; const validUntil = new Date().getTime() + 30000;
const token = await service.createTokenForUser( const token = await service.createTokenForUser(
user.username, user,
identifier, identifier,
validUntil, validUntil,
); );

8
src/auth/auth.service.ts
View file

@ -15,7 +15,6 @@ import {
TooManyTokensError, TooManyTokensError,
} from '../errors/errors'; } from '../errors/errors';
import { ConsoleLoggerService } from '../logger/console-logger.service'; import { ConsoleLoggerService } from '../logger/console-logger.service';
import { UserRelationEnum } from '../users/user-relation.enum';
import { User } from '../users/user.entity'; import { User } from '../users/user.entity';
import { UsersService } from '../users/users.service'; import { UsersService } from '../users/users.service';
import { import {
@ -58,13 +57,12 @@ export class AuthService {
} }
async createTokenForUser( async createTokenForUser(
username: string, user: User,
identifier: string, identifier: string,
validUntil: TimestampMillis, validUntil: TimestampMillis,
): Promise<AuthTokenWithSecretDto> { ): Promise<AuthTokenWithSecretDto> {
const user = await this.usersService.getUserByUsername(username, [ user.authTokens = await this.getTokensByUser(user);
UserRelationEnum.AUTHTOKENS,
]);
if (user.authTokens.length >= 200) { if (user.authTokens.length >= 200) {
// This is a very high ceiling unlikely to hinder legitimate usage, // This is a very high ceiling unlikely to hinder legitimate usage,
// but should prevent possible attack vectors // but should prevent possible attack vectors