test(auth): verify recovery endpoints over HTTP with real storage

apps/waterfall-wiki/tests/account-integration.ts

@@ -3,7 +3,7 @@ import { randomUUID } from 'node:crypto';
 import { db } from '../src/lib/db';
 import { hashPassword,newToken,tokenDigest } from '../src/lib/account-crypto';
 import { resetPassword,loginAccount,verifyAccount,currentAccount,logoutAccount,rateLimit } from '../src/lib/account';
-export async function verifyEmailAccounts() {
+export async function verifyEmailAccounts(base: string) {
  const id=randomUUID(), email=id+'@example.com', password='a secure test password';
  const request=(token:string)=>new Request('https://wiki.example',{headers:{cookie:'wiki_account='+token}});
  try {
@@ -31,6 +31,20 @@ export async function verifyEmailAccounts() {
   const wrongKind=newToken();await db().query("INSERT INTO account_tokens VALUES ($1,$2,'verify',now()+interval '30 minutes')",[tokenDigest(wrongKind),id]);
   assert.equal(await resetPassword(wrongKind,password),false,'Email verification cannot reset a password');
   assert.equal(await resetPassword(newToken(),'short'),false);
+  const post=(action:string,body:object,origin=process.env.ACCOUNT_PUBLIC_ORIGIN||base)=>fetch(base+'/api/account/'+action,{method:'POST',headers:{'Content-Type':'application/json',Origin:origin},body:JSON.stringify(body)});
+  assert.equal((await post('forgot',{email},'https://untrusted.invalid')).status,403,'Cross-origin recovery is rejected');
+  const unknown=await post('forgot',{email:randomUUID()+'@example.com'});
+  assert.equal(unknown.status,200,'Unknown email receives the same non-enumerating response without sending mail');
+  assert.match((await unknown.json()).message,/若该邮箱/);
+  const httpToken=newToken(),httpPassword='http replacement secure password';
+  const priorHttpSession=await loginAccount(email,replacement);assert.ok(priorHttpSession);
+  await db().query("INSERT INTO account_tokens VALUES ($1,$2,'reset',now()+interval '30 minutes')",[tokenDigest(httpToken),id]);
+  const changed=await post('reset',{token:httpToken,password:httpPassword});
+  assert.equal(changed.status,200);
+  assert.match(changed.headers.get('set-cookie')||'',/Max-Age=0/);
+  assert.equal(await currentAccount(request(priorHttpSession)),null);
+  assert.ok(await loginAccount(email,httpPassword),'HTTP recovery changes the stored password');
+  assert.equal((await post('reset',{token:httpToken,password:replacement})).status,400,'HTTP recovery rejects a consumed token');
   const key=randomUUID();assert.deepEqual(await Promise.all(Array.from({length:5},()=>rateLimit(key,3))).then(a=>a.sort()),[false,false,true,true,true]);
   await db().query('DELETE FROM account_limits WHERE key=$1',[tokenDigest(key)]);
  } finally {await db().query('DELETE FROM account_users WHERE id=$1',[id]);}

apps/waterfall-wiki/tests/integration.test.ts

@@ -42,7 +42,7 @@ test('real PostgreSQL + S3 notes, flat tags, resource sharing and video processi
   let ready=false;for(let i=0;i<60;i++){try{if((await fetch(base+'/api/health')).ok){ready=true;break;}}catch{}await setTimeout(250);}assert.ok(ready);
   for(const route of ['/','/images','/videos','/audio','/articles','/motion','/library/import','/tools/doodle','/tools/skills','/tools/skills/street-people','/tools/skills/shadow-puppet'])assert.equal((await fetch(base+route)).status,200,route);
   if(!external)await verifyBrandUI(base);
-  await verifyEmailAccounts();
+  await verifyEmailAccounts(base);
   await verifyCanvasWorkspace(base);
   if(process.env.VERIFY_CANVAS_UI==='1')await verifyCanvasAgentUI(base);
   await verifyGuidancePublishing(base);