fix: close account authorization gaps (#755)

test/auth-utils.test.js

@@ -0,0 +1,56 @@
+const { expect } = require("chai");
+require("ts-node/register/transpile-only");
+
+const {
+  getLoginToken,
+  isDisabledAccount,
+} = require("../src/server/routes/auth-utils");
+
+describe("auth-utils.getLoginToken", function () {
+  it("accepts a bearer token", function () {
+    expect(
+      getLoginToken({ headers: { authorization: "Bearer secret" }, body: {} })
+    ).to.equal("secret");
+  });
+
+  it("accepts a token in the request body", function () {
+    expect(getLoginToken({ headers: {}, body: { token: "secret" } })).to.equal(
+      "secret"
+    );
+  });
+
+  it("does not inspect query-string credentials", function () {
+    expect(
+      getLoginToken({ headers: {}, body: {}, query: { token: "leaked" } })
+    ).to.equal(null);
+  });
+
+  it("rejects empty body tokens", function () {
+    expect(getLoginToken({ headers: {}, body: { token: "  " } })).to.equal(
+      null
+    );
+  });
+});
+
+describe("login-token route", function () {
+  it("only accepts POST requests", function () {
+    const { router } = require("../src/server/routes/connection");
+    const layer = router.stack.find(
+      (candidate) => candidate.route?.path === "/login-token"
+    );
+    expect(layer).to.not.equal(undefined);
+    expect(layer.route.methods).to.deep.equal({ post: true });
+  });
+});
+
+describe("auth-utils.isDisabledAccount", function () {
+  it("rejects banned and removed accounts", function () {
+    expect(isDisabledAccount("banned")).to.equal(true);
+    expect(isDisabledAccount("removed")).to.equal(true);
+  });
+
+  it("allows active and legacy accounts", function () {
+    expect(isDisabledAccount("active")).to.equal(false);
+    expect(isDisabledAccount(undefined)).to.equal(false);
+  });
+});

test/route-utils-auth.test.js

@@ -19,7 +19,7 @@ const Repository = require("../src/core/Repository").default;
  * model objects without a live DB.
  */
 
-function makeUser({ id, username, isAdmin = false } = {}) {
+function makeUser({ id, username, githubId, isAdmin = false } = {}) {
   const _id = id || new mongoose.Types.ObjectId();
   return new User(
     new UserModel({
@@ -28,6 +28,7 @@ function makeUser({ id, username, isAdmin = false } = {}) {
       username,
       isAdmin,
       accessTokens: { github: "tok" },
+      externalIDs: githubId ? { github: githubId } : {},
     })
   );
 }
@@ -105,6 +106,30 @@ describe("route-utils.isCoauthor", function () {
     expect(isCoauthor(repo, user)).to.equal(false);
   });
 
+  it("uses the immutable GitHub id when a coauthor id is present", function () {
+    const user = makeUser({ username: "renamed", githubId: "123" });
+    const repo = makeRepo({
+      coauthors: [{ username: "old-name", githubId: "123" }],
+    });
+    expect(isCoauthor(repo, user)).to.equal(true);
+  });
+
+  it("does not grant access from a recycled username", function () {
+    const user = makeUser({ username: "alice", githubId: "456" });
+    const repo = makeRepo({
+      coauthors: [{ username: "alice", githubId: "123" }],
+    });
+    expect(isCoauthor(repo, user)).to.equal(false);
+  });
+
+  it("matches by GitHub id even when the user has no username", function () {
+    const user = makeUser({ username: undefined, githubId: "123" });
+    const repo = makeRepo({
+      coauthors: [{ username: "old-name", githubId: "123" }],
+    });
+    expect(isCoauthor(repo, user)).to.equal(true);
+  });
+
   it("matches case-sensitively (alice !== Alice)", function () {
     const user = makeUser({ username: "alice" });
     const repo = makeRepo({ coauthors: [{ username: "Alice" }] });