forked from angular-app/angular-app
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsecurity.js
More file actions
171 lines (151 loc) · 4.02 KB
/
Copy pathsecurity.js
File metadata and controls
171 lines (151 loc) · 4.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
var rewire = require('rewire');
var security = rewire('../lib/security');
var config = {
dbUrl: 'https://api.mongolab.com/api/1/databases',
apiKey: '4fb51e55e4b02e56a67b0b66',
dbName: 'ascrum',
usersCollection: 'users'
};
function mockUpUser(isAdmin) {
return {
_id : { $oid: '1234567' },
email: 'email',
password: 'password',
firstName: 'firstName',
lastName: 'lastName',
admin: !!isAdmin
};
}
function mockUpPassport(test, authenticated) {
var spies = { };
security.__set__('passport', {
use: function(fn) {
spies.useCalled = true;
},
authenticate: function(strategy, callback) {
spies.authenticateCalled = true;
return function() { callback(); };
}
});
return spies;
}
function mockUpMongoStrategy(test) {
var strategy = function(dbUrl, apiKey, dbName, usersCollection) {
test.equal(dbUrl, config.dbUrl);
test.equal(apiKey, config.apiKey);
test.equal(dbName, config.dbName);
test.equal(usersCollection, config.usersCollection);
};
strategy.name = 'mongo';
security.__set__('MongoStrategy', strategy);
}
module.exports = {
initialize: function(test) {
mockUpMongoStrategy(test);
var passportSpy = mockUpPassport(test);
security.initialize(config.dbUrl, config.apiKey, config.dbName, config.usersCollection);
test.ok(passportSpy.useCalled);
test.done();
},
authenticationRequired: function(test) {
// Setup mocks
var req = {};
var res = {
send: function() { sendCalled = true; }
};
var nextCalled = false;
var sendCalled = false;
var next = function() { nextCalled = true; };
// Test when user is unauthenticated
req.isAuthenticated = function() { return false; };
security.authenticationRequired(req, res, next);
test.ok(sendCalled);
// Test when user is authenticated
req.isAuthenticated = function() { return true; };
security.authenticationRequired(req, res, next);
test.ok(nextCalled);
test.done();
},
adminRequired: function(test) {
// Setup mocks
var nextCalled = false;
var sendCalled = false;
var req = {};
var res = {
send: function(status) {
test.equal(status, 401);
sendCalled = true;
}
};
var next = function() {
nextCalled = true;
};
// Test when user is unauthenticated
req.user = null;
security.adminRequired(req, res, next);
test.ok(sendCalled);
// Test when user is authenticated but not admin
req.user = mockUpUser(false);
security.adminRequired(req, res, next);
test.ok(sendCalled);
// Test when user is admin
req.user = mockUpUser(true);
security.adminRequired(req, res, next);
test.ok(nextCalled);
test.done();
},
sendCurrentUser: function(test) {
var sendCalled = false;
var req = { user : mockUpUser(false) };
var res = {
json: function(status, userInfo) {
test.equal(status, 200);
test.equal(userInfo.user.id, req.user._id.$oid);
sendCalled = true;
},
end: function() {}
};
security.sendCurrentUser(req, res, null);
test.ok(sendCalled);
test.done();
},
login: function(test) {
var req = {};
var jsonCalled = false;
var res = {
json: function() { jsonCalled = true; }
};
var nextCalled = false;
var next = function() { nextCalled = true; };
var spies = mockUpPassport(test);
security.login(req, res, next);
test.ok(spies.authenticateCalled);
test.ok(jsonCalled);
test.done();
},
logoutPOST: function(test) {
var logoutCalled = false;
var req = {
method: 'POST',
logout: function() {
logoutCalled = true;
}
};
var redirectCalled = false;
var sendCalled = false;
var res = {
redirect: function() {
redirectCalled = true;
},
send: function() {
sendCalled = true;
}
};
// Test without POST
security.logout(req, res);
test.ok(logoutCalled);
test.ok(!redirectCalled);
test.ok(sendCalled);
test.done();
}
};