Commit graph

50 commits

Author SHA1 Message Date
David Mehren
6cd3feb82c
refactor(history-entry): rename lastVisited
This is part of an effort to name all date attributes
consistently.

Signed-off-by: David Mehren <git@herrmehren.de>
2022-01-16 22:04:34 +01:00
David Mehren
b0e2987987
refactor(auth-token): rename lastUsed to lastUsedAt
This is part of an effort to name all date attributes
consistently.

Signed-off-by: David Mehren <git@herrmehren.de>
2022-01-16 21:52:15 +01:00
Erik Michelson
277e2fb1ca
feat(auth): password change requires old password
By checking the "old" password of the user prior to a password change, the
password change function is more secured against abuse.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
2021-12-28 01:46:40 +01:00
David Mehren
235e4f647c
refactor(note): lazy-load relations
Signed-off-by: David Mehren <git@herrmehren.de>
2021-11-30 16:46:07 +01:00
David Mehren
b4a65b47f0
fix(auth): use sha-512 for auth tokens
Bcrypt hashes are too slow to be validated on every request.
As our tokens are random and have a fixed length, it is reasonable
to use SHA-512 instead.

SHA-512 is recommended as cryptographically strong by the BSI:
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-1.pdf?__blob=publicationFile

Fixes https://github.com/hedgedoc/hedgedoc/issues/1881

Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-09 23:04:00 +01:00
Philip Molares
988909eb0b
test: fix note e2e test 'fails, when user can't read note'
Because the rejection now happens automatically in the permissions guard it now returns a 403 instead of 401

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-11-21 18:03:29 +01:00
David Mehren
b9d3c95d2d
fix(note): fix type for owner param
To make the create method easier to use in conjunction
with the authentication framework, this commit changes the type of
the `owner` parameter from `User | undefined` to `User | null`.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-11-14 21:44:59 +01:00
Philip Molares
ed5367d456
test(private-api): fix aliases expect
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-11-08 21:40:36 +01:00
David Mehren
0fc2b1309a
Add E2E tests for login and registration
Signed-off-by: David Mehren <git@herrmehren.de>
2021-10-21 19:51:42 +02:00
David Mehren
c02f845ecb
AuthController: Return 409 Conflict when user already exists
The previously used HTTP error 400 'Bad Request' is not really
applicable here, as the client did not send a malformed message.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-10-27 19:39:18 +02:00
David Mehren
9e2b9caca9
Update API routes in private API E2E tests
Signed-off-by: David Mehren <git@herrmehren.de>
2021-10-15 17:06:56 +02:00
David Mehren
1cc797f13d
Separate private and public API in TestSetup
Including both PublicApiModule and PrivateApiModule in the test setup
lead to the API routes overwriting each other.
This adds a router to separate the APIs as they are in the normal app.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-10-15 16:44:43 +02:00
David Mehren
474ca5deaf
Migrate private history API E2E test to global TestSetup
Signed-off-by: David Mehren <git@herrmehren.de>
2021-10-14 22:44:30 +02:00
David Mehren
6ee9589b2c
Migrate private me API E2E test to global TestSetup
Signed-off-by: David Mehren <git@herrmehren.de>
2021-10-14 22:01:18 +02:00
David Mehren
60bbe42447
Migrate private media API E2E test to global TestSetup
Signed-off-by: David Mehren <git@herrmehren.de>
2021-10-14 21:57:10 +02:00
David Mehren
86a910a9e8
Migrate private notes API E2E test to global TestSetup
Signed-off-by: David Mehren <git@herrmehren.de>
2021-10-14 21:45:13 +02:00
Alexandru Văleanu
32929c1e77
Add delete media in private API (#1736)
Adds the missing API route of deleting media in the private API.
2021-10-18 19:00:28 +01:00
Yannick Bungers
40103cb397
fix username spelling from userName
Signed-off-by: Yannick Bungers <git@innay.de>
2021-10-13 22:28:10 +02:00
Yannick Bungers
11ae7d133c
Fix tests with using sessions in e2e tests of private api
Signed-off-by: Yannick Bungers <git@innay.de>
2021-10-13 20:43:56 +02:00
Philip Molares
56eaddff8c
test: fix e2e tests to handle the new aliases
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-06-06 17:55:41 +02:00
Philip Molares
5bc1513bd8
feat: add auth e2e tests
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-09-02 23:41:32 +02:00
Abhilasha Sinha
f63a2b79b7
Add new API to purge note history #1064
Signed-off-by: Abhilasha Sinha <abhisinha662000@gmail.com>

Combine the describe block

Signed-off-by: Abhilasha Sinha <abhisinha662000@gmail.com>

Fix naming

Signed-off-by: Abhilasha Sinha <abhisinha662000@gmail.com>

Rename purgeRevision to purgeRevisions

Signed-off-by: Abhilasha Sinha <abhisinha662000@gmail.com>

Fix notes e2e test description

Signed-off-by: Abhilasha Sinha <abhisinha662000@gmail.com>

Add yarn.lock

Fix lint and format

Signed-off-by: Abhilasha Sinha <abhisinha662000@gmail.com>
2021-08-30 05:37:35 +05:30
David Mehren
fe26f1689c
MediaService: Refactor saveFile
The function now expects a `Note` object instead of a noteId
and a `User` instead of a username to
make it more consistent with other functions.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-29 22:28:21 +02:00
David Mehren
d2b60a316f
HistoryService: Refactor deleteHistoryEntry
The function now expects a `Note` object instead of a noteId to
make it more consistent with other functions.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-29 21:42:46 +02:00
David Mehren
3396d3e47d
UserService: Improve method naming
This renames `createOrUpdateHistoryEntry` to `updateHistoryEntryTimestamp`,
which reduces confusion with the similarly named
`updateHistoryEntry` function.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-29 21:19:53 +02:00
David Mehren
5ed2fae44e
Enforce import order with prettier
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-29 18:45:46 +02:00
David Mehren
a8d6b33139
[E2E tests] Don't use hardcoded service tokens
The DI tokens for services seem to have changed with NestJS 8.
As we can also use the class object instead of a hardcoded token,
this commit replaces the tokens accordingly.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-07-15 20:30:51 +02:00
Philip Molares
0f58757858
chore(test): Change test to work with publicId
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-05-16 22:46:02 +02:00
David Mehren
2e5d40432e
E2E Tests: Fix ESLint errors
Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-29 22:06:45 +02:00
Philip Molares
8186c96806
PrivateHistoryE2E: Extend POST /me/history
Test the correct behaviour in error cases

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-12 10:55:16 +02:00
David Mehren
6ee2ddead5
Use node12 TypeScript base config
TypeScript recommends using a base config from https://github.com/tsconfig/bases.

Using this config reduces compile times by ~30%
and the size of the dist folder by ~45%.
It also enables the recommended `esModuleInterop` option,
which necessitated some changes to imports.
See also https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#support-for-import-d-from-cjs-from-commonjs-modules-with---esmoduleinterop

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-29 22:47:18 +02:00
Philip Molares
bd4231c1c5
PrivateApi: Add option to keep media to DELETE /notes/{note}
This adds a body to the route DELETE /notes/{note} of the private api to specify if the associated media uploads of the note should be kept or deleted.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-01 01:22:34 +02:00
David Mehren
79065b8d3f
Media E2E tests: Add error handling for upload cleanup
Previously, `fs.rmdir` was called multiple times on the same path,
even when the path was already deleted.
This causes test failures in Node 16.

This commit extracts the cleanup code into a utility function
and ensures that no error is thrown when the given path is already deleted.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-22 21:29:23 +02:00
Philip Molares
1ed22ba4bf
PrivateE2EMe: Add E2E test for private api /me routes
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-20 19:01:04 +01:00
Philip Molares
697ca823d5
Logging: Remove NestConsoleLoggerService
This is not necessary anymore, because we can inject ConsoleLoggerService directly.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-02 19:08:30 +02:00
Philip Molares
c1d706b350
PrivateAPI: Add lastVisited to HistoryEntryImportDto
As the DTO is only for importing an existing history the lastVisited of those entries should also be posted.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-11 12:37:47 +02:00
Philip Molares
eeaa74b385
PrivateAPI: Add pinStatus to HistoryEntryImportDto
As the DTO is only for importing an existing history the pinStatus of those entries should also be posted.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-10 23:31:18 +02:00
Philip Molares
1154894876
PrivateAPI: Rename HistoryEntryCreationDto to HistoryEntryImportDto
As the DTO is used to import a whole list of history entries rather than creating a single history entry (there is no way of doing that at the moment)

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-10 23:26:58 +02:00
Philip Molares
ff44a6567e
Tests: Removed all eslint-disable lines
As we now disable what we don't need in the eslint config, we don't need this anymore.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-12 17:06:59 +02:00
Philip Molares
9f746cb05b
NotesE2EPrivate: Fix copy&paste error
Since large parts of this test were copied from the public api e2e test, somethings still used the public api e2e test files.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-31 22:44:46 +02:00
Philip Molares
17493a9007
MediaE2E: Fix typo in comments
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-31 22:43:13 +02:00
Philip Molares
be78b9a03d
E2ETests: Use recursive for 'uploads/' deletion.
This ensures the folder is always deleted, even if there are still files (from previous broken tests) in it.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-31 22:42:56 +02:00
Philip Molares
9b54733ed3
MediaE2E: Extract 'uploads' deletion
The deletion of upload was moved to beforeEach and afterEach block in the 'POST /media' > 'fails' tests.
The test if the folder was not created, because there was no file uploaded, now correctly expects the behaviour.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-31 22:41:38 +02:00
Philip Molares
4c02327546
MediaE2E: Add app.close() to afterAll
This terminates the app after all test have finished.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-31 22:36:14 +02:00
Philip Molares
e516612a73
PrivateE2EMedia: Add E2E test for private api /media routes
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-23 22:41:57 +01:00
Philip Molares
4a44f564a7
PrivateE2E: Add test fixtures for private api
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-24 11:14:48 +01:00
Philip Molares
6943399dcf
PrivateE2ENotes: Add E2E test for private api /notes routes
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-24 01:49:43 +01:00
Philip Molares
e3f1d1b0f4
Config: Create new config mocks for tests
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-01 21:12:48 +01:00
Philip Molares
c1a9eee6a4
Config: Move config mocks in own folder
To clean up the config folder, all mocks are now in it's own folder.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-01 21:12:01 +01:00
Philip Molares
3594d904f7
PrivateE2E: Add history test
Test the /me/history route in the private API.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-04 10:20:58 +01:00