Merge pull request #922 from bluewave-labs/feat/server-auth-controller-tests

Feat/server auth controller tests

Server/.gitignore

@@ -2,3 +2,5 @@ node_modules
 .env
 *.log
 *.sh
+.nyc_output
+coverage

Server/.mocharc.js

@@ -0,0 +1,8 @@
+module.exports = {
+  require: ["chai/register-expect.js"], // Include Chai's "expect" interface globally
+  spec: "tests/**/*.test.js", // Specify test files
+  timeout: 5000, // Set test-case timeout in milliseconds
+  recursive: true, // Include subdirectories
+  reporter: "spec", // Use the "spec" reporter
+  exit: true, // Force Mocha to quit after tests complete
+};

Server/.nycrc

@@ -0,0 +1,8 @@
+{
+  "all": true,
+  "include": ["**/*.js"],
+  "exclude": ["**/*.test.js"],
+  "reporter": ["html", "text", "lcov"],
+  "sourceMap": false,
+  "instrument": true
+}

Server/controllers/authController.js

@@ -141,7 +141,7 @@ const loginUser = async (req, res, next) => {
     delete userWithoutPassword.avatarImage;
 
     // Happy path, return token
-    const appSettings = req.settingsService.getSettings();
+    const appSettings = await req.settingsService.getSettings();
     const token = issueToken(userWithoutPassword, appSettings);
     // reset avatar image
     userWithoutPassword.avatarImage = user.avatarImage;
@@ -392,6 +392,7 @@ const deleteUser = async (req, res, next) => {
     const result = await req.db.getMonitorsByTeamId({
       params: { teamId: user.teamId },
     });
+
     if (user.role.includes("superadmin")) {
       //2.  Remove all jobs, delete checks and alerts
       result?.monitors.length > 0 &&
@@ -413,7 +414,6 @@ const deleteUser = async (req, res, next) => {
     }
     // 6. Delete the user by id
     await req.db.deleteUser(user._id);
-
     return res.status(200).json({
       success: true,
       msg: successMessages.AUTH_DELETE_USER,

Server/middleware/verifyJWT.js

@@ -1,10 +1,7 @@
 const jwt = require("jsonwebtoken");
-const logger = require("../utils/logger");
 const SERVICE_NAME = "verifyJWT";
 const TOKEN_PREFIX = "Bearer ";
 const { errorMessages } = require("../utils/messages");
-const { parse } = require("path");
-const User = require("../db/models/User");
 /**
  * Verifies the JWT token
  * @function

Server/package.json

@@ -4,7 +4,7 @@
   "description": "",
   "main": "index.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "nyc mocha",
     "dev": "nodemon index.js"
   },
   "keywords": [],
@@ -15,6 +15,7 @@
     "axios": "^1.7.2",
     "bcrypt": "^5.1.1",
     "bullmq": "5.7.15",
+    "chai": "5.1.1",
     "cors": "^2.8.5",
     "dotenv": "^16.4.5",
     "express": "^4.19.2",
@@ -24,6 +25,7 @@
     "jsonwebtoken": "9.0.2",
     "mailersend": "^2.2.0",
     "mjml": "^5.0.0-alpha.4",
+    "mocha": "10.7.3",
     "mongoose": "^8.3.3",
     "multer": "1.4.5-lts.1",
     "nodemailer": "^6.9.14",
@@ -34,6 +36,8 @@
     "winston": "^3.13.0"
   },
   "devDependencies": {
-    "nodemon": "3.1.0"
+    "nodemon": "3.1.0",
+    "nyc": "17.1.0",
+    "sinon": "19.0.2"
   }
 }

Server/tests/controllers/authController.test.js

@@ -0,0 +1,609 @@
+const {
+  registerUser,
+  loginUser,
+  editUser,
+  checkSuperadminExists,
+  requestRecovery,
+  validateRecovery,
+  resetPassword,
+  deleteUser,
+  getAllUsers,
+} = require("../../controllers/authController");
+const jwt = require("jsonwebtoken");
+const { errorMessages, successMessages } = require("../../utils/messages");
+const sinon = require("sinon");
+
+describe("Auth Controller - registerUser", () => {
+  // Set up test
+  beforeEach(() => {
+    req = {
+      db: {
+        checkSuperadmin: sinon.stub(),
+        getInviteTokenAndDelete: sinon.stub(),
+        updateAppSettings: sinon.stub(),
+        insertUser: sinon.stub(),
+      },
+      settingsService: {
+        getSettings: sinon.stub().resolves({
+          jwtSecret: "my_secret",
+        }),
+      },
+      emailService: {
+        buildAndSendEmail: sinon.stub().returns(Promise.resolve()),
+      },
+      file: {},
+    };
+    res = {
+      status: sinon.stub().returnsThis(),
+      json: sinon.stub(),
+    };
+    next = sinon.stub();
+  });
+
+  it("should register a valid user", async () => {
+    req.body = {
+      firstName: "John",
+      lastName: "Doe",
+      email: "john.doe@example.com",
+      password: "Uptime1!",
+      inviteToken: "someToken",
+      role: ["user"],
+      teamId: "123",
+    };
+    req.db.checkSuperadmin.resolves(false);
+    req.db.insertUser.resolves({
+      _id: "123",
+      _doc: {
+        firstName: "John",
+        lastName: "Doe",
+        email: "john.doe@example.com",
+      },
+    });
+
+    await registerUser(req, res, next);
+    expect(res.status.calledWith(200)).to.be.true;
+    expect(
+      res.json.calledWith(
+        sinon.match({
+          success: true,
+          msg: sinon.match.string,
+          data: {
+            user: sinon.match.object,
+            token: sinon.match.string,
+          },
+        })
+      )
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+  it("should reject a user with an invalid password", async () => {
+    req.body = {
+      firstName: "John",
+      lastName: "Doe",
+      email: "john.doe@example.com",
+      password: "bad_password",
+      inviteToken: "someToken",
+      role: ["user"],
+      teamId: "123",
+    };
+    await registerUser(req, res, next);
+    expect(next.firstCall.args[0]).to.be.an("error");
+    expect(next.firstCall.args[0].status).to.equal(422);
+  });
+  it("should reject a user with an invalid role", async () => {
+    req.body = {
+      firstName: "John",
+      lastName: "Doe",
+      email: "john.doe@example.com",
+      password: "Uptime1!",
+      inviteToken: "someToken",
+      role: ["superman"],
+      teamId: "123",
+    };
+    await registerUser(req, res, next);
+    expect(next.firstCall.args[0]).to.be.an("error");
+    expect(next.firstCall.args[0].status).to.equal(422);
+  });
+});
+
+describe("Auth Controller - loginUser", () => {
+  beforeEach(() => {
+    req = {
+      body: { email: "test@example.com", password: "Password123!" },
+      db: {
+        getUserByEmail: sinon.stub(),
+      },
+      settingsService: {
+        getSettings: sinon.stub().resolves({
+          jwtSecret: "my_secret",
+        }),
+      },
+    };
+    res = {
+      status: sinon.stub().returnsThis(),
+      json: sinon.stub(),
+    };
+    next = sinon.stub();
+    user = {
+      _doc: {
+        email: "test@example.com",
+      },
+      comparePassword: sinon.stub(),
+    };
+  });
+  it("should login user successfully", async () => {
+    req.db.getUserByEmail.resolves(user);
+    user.comparePassword.resolves(true);
+    await loginUser(req, res, next);
+    expect(res.status.calledWith(200)).to.be.true;
+    expect(
+      res.json.calledWith({
+        success: true,
+        msg: successMessages.AUTH_LOGIN_USER,
+        data: {
+          user: {
+            email: "test@example.com",
+            avatarImage: undefined,
+          },
+          token: sinon.match.string,
+        },
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+  it("should reject a user with an incorrect password", async () => {
+    req.body = {
+      email: "test@test.com",
+      password: "Password123!",
+    };
+    req.db.getUserByEmail.resolves(user);
+    user.comparePassword.resolves(false);
+    await loginUser(req, res, next);
+    expect(next.firstCall.args[0]).to.be.an("error");
+    expect(next.firstCall.args[0].message).to.equal(
+      errorMessages.AUTH_INCORRECT_PASSWORD
+    );
+  });
+});
+
+describe("Auth Controller - editUser", async () => {
+  beforeEach(() => {
+    req = {
+      params: { userId: "123" },
+      body: { password: "Password1!", newPassword: "Password2!" },
+      headers: { authorization: "Bearer token" },
+      user: { _id: "123" },
+      settingsService: {
+        getSettings: sinon.stub().returns({ jwtSecret: "my_secret" }),
+      },
+      db: {
+        getUserByEmail: sinon.stub(),
+        updateUser: sinon.stub(),
+      },
+    };
+    res = {
+      status: sinon.stub().returnsThis(),
+      json: sinon.stub(),
+    };
+    next = sinon.stub();
+  });
+
+  it("should edit a user if it receives a proper request", async () => {
+    sinon.stub(jwt, "verify").returns({ email: "test@example.com" });
+    const user = {
+      comparePassword: sinon.stub().resolves(true),
+    };
+    req.db.getUserByEmail.resolves(user);
+    req.db.updateUser.resolves({ email: "test@example.com" });
+
+    await editUser(req, res, next);
+
+    expect(req.db.getUserByEmail.calledOnce).to.be.true;
+    expect(req.db.updateUser.calledOnce).to.be.true;
+    expect(res.status.calledWith(200)).to.be.true;
+    expect(
+      res.json.calledWith({
+        success: true,
+        msg: successMessages.AUTH_UPDATE_USER,
+        data: { email: "test@example.com" },
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+
+  it("should reject an edit request if password format is incorrect", async () => {
+    req.body = { password: "bad_password", newPassword: "bad_password" };
+    const user = {
+      comparePassword: sinon.stub().resolves(true),
+    };
+    req.db.getUserByEmail.resolves(user);
+
+    await editUser(req, res, next);
+
+    expect(next.firstCall.args[0]).to.be.an("error");
+    expect(next.firstCall.args[0].status).to.equal(422);
+  });
+});
+
+describe("Auth Controller - checkSuperadminExists", async () => {
+  beforeEach(() => {
+    req = {
+      db: {
+        checkSuperadmin: sinon.stub(),
+      },
+    };
+    res = {
+      status: sinon.stub().returnsThis(),
+      json: sinon.stub(),
+    };
+    next = sinon.stub();
+  });
+
+  it("should return true if a superadmin exists", async () => {
+    req.db.checkSuperadmin.resolves(true);
+    await checkSuperadminExists(req, res, next);
+    expect(res.status.calledWith(200)).to.be.true;
+    expect(
+      res.json.calledWith({
+        success: true,
+        msg: successMessages.AUTH_SUPERADMIN_EXISTS,
+        data: true,
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+
+  it("should return false if a superadmin does not exist", async () => {
+    req.db.checkSuperadmin.resolves(false);
+    await checkSuperadminExists(req, res, next);
+    expect(res.status.calledWith(200)).to.be.true;
+    expect(
+      res.json.calledWith({
+        success: true,
+        msg: successMessages.AUTH_SUPERADMIN_EXISTS,
+        data: false,
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+});
+
+describe("Auth Controller - requestRecovery", async () => {
+  beforeEach(() => {
+    req = {
+      body: { email: "test@test.com" },
+      db: {
+        getUserByEmail: sinon.stub(),
+        requestRecoveryToken: sinon.stub(),
+      },
+      settingsService: {
+        getSettings: sinon.stub().returns({ clientHost: "http://localhost" }),
+      },
+      emailService: {
+        buildAndSendEmail: sinon.stub(),
+      },
+    };
+    res = {
+      status: sinon.stub().returnsThis(),
+      json: sinon.stub(),
+    };
+    next = sinon.stub();
+  });
+  it("should throw an error if the email is not provided", async () => {
+    req.body = {};
+    await requestRecovery(req, res, next);
+    expect(next.firstCall.args[0]).to.be.an("error");
+    expect(next.firstCall.args[0].status).to.equal(422);
+  });
+  it("should return a success message if the email is provided", async () => {
+    const user = { firstName: "John" };
+    const recoveryToken = { token: "recovery-token" };
+    const msgId = "message-id";
+    req.db.getUserByEmail.resolves(user);
+    req.db.requestRecoveryToken.resolves(recoveryToken);
+    req.emailService.buildAndSendEmail.resolves(msgId);
+    await requestRecovery(req, res, next);
+    expect(req.db.getUserByEmail.calledOnceWith("test@test.com")).to.be.true;
+    expect(req.db.requestRecoveryToken.calledOnceWith(req, res)).to.be.true;
+    expect(
+      req.emailService.buildAndSendEmail.calledOnceWith(
+        "passwordResetTemplate",
+        {
+          name: "John",
+          email: "test@test.com",
+          url: "http://localhost/set-new-password/recovery-token",
+        },
+        "test@test.com",
+        "Bluewave Uptime Password Reset"
+      )
+    ).to.be.true;
+    expect(res.status.calledOnceWith(200)).to.be.true;
+    expect(
+      res.json.calledOnceWith({
+        success: true,
+        msg: successMessages.AUTH_CREATE_RECOVERY_TOKEN,
+        data: msgId,
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+});
+
+describe("Auth Controller - validateRecovery", async () => {
+  beforeEach(() => {
+    req = {
+      body: { recoveryToken: "recovery-token" },
+      db: {
+        validateRecoveryToken: sinon.stub(),
+      },
+    };
+    res = {
+      status: sinon.stub().returnsThis(),
+      json: sinon.stub(),
+    };
+    next = sinon.stub();
+  });
+
+  it("should call next with a validation error if the token is invalid", async () => {
+    req = {
+      body: {},
+    };
+    await validateRecovery(req, res, next);
+    expect(next.firstCall.args[0]).to.be.an("error");
+    expect(next.firstCall.args[0].status).to.equal(422);
+  });
+
+  it("should return a success message if the token is valid", async () => {
+    req.db.validateRecoveryToken.resolves();
+    await validateRecovery(req, res, next);
+    expect(res.status.calledOnceWith(200)).to.be.true;
+    expect(
+      res.json.calledOnceWith({
+        success: true,
+        msg: successMessages.AUTH_VERIFY_RECOVERY_TOKEN,
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+});
+
+describe("Auth Controller - resetPassword", async () => {
+  beforeEach(() => {
+    req = {
+      body: {
+        recoveryToken: "recovery-token",
+        password: "Password1!",
+      },
+      db: {
+        resetPassword: sinon.stub(),
+      },
+      settingsService: {
+        getSettings: sinon.stub(),
+      },
+    };
+    res = {
+      status: sinon.stub().returnsThis(),
+      json: sinon.stub(),
+    };
+    next = sinon.stub();
+    newPasswordValidation = {
+      validateAsync: sinon.stub(),
+    };
+    handleValidationError = sinon.stub();
+    handleError = sinon.stub();
+    issueToken = sinon.stub();
+  });
+  it("should call next with a validation error if the password is invalid", async () => {
+    req.body = { password: "bad_password" };
+    await resetPassword(req, res, next);
+    expect(next.firstCall.args[0]).to.be.an("error");
+    expect(next.firstCall.args[0].status).to.equal(422);
+  });
+  it("should reset password successfully", async () => {
+    const user = { _doc: {} };
+    const appSettings = { jwtSecret: "my_secret" };
+    const token = "token";
+
+    newPasswordValidation.validateAsync.resolves();
+    req.db.resetPassword.resolves(user);
+    req.settingsService.getSettings.resolves(appSettings);
+    issueToken.returns(token);
+
+    await resetPassword(req, res, next);
+
+    expect(req.db.resetPassword.calledOnceWith(req, res)).to.be.true;
+    expect(req.settingsService.getSettings.calledOnce).to.be.true;
+    expect(res.status.calledOnceWith(200)).to.be.true;
+    expect(
+      res.json.calledOnceWith({
+        success: true,
+        msg: successMessages.AUTH_RESET_PASSWORD,
+        data: { user: sinon.match.object, token: sinon.match.string },
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+});
+
+describe("Auth Controller - deleteUser", async () => {
+  beforeEach(() => {
+    req = {
+      headers: {
+        authorization: "Bearer token",
+      },
+      db: {
+        getUserByEmail: sinon.stub(),
+        getMonitorsByTeamId: sinon.stub(),
+        deleteJob: sinon.stub(),
+        deleteChecks: sinon.stub(),
+        deletePageSpeedChecksByMonitorId: sinon.stub(),
+        deleteNotificationsByMonitorId: sinon.stub(),
+        deleteTeam: sinon.stub(),
+        deleteAllOtherUsers: sinon.stub(),
+        deleteMonitorsByUserId: sinon.stub(),
+        deleteUser: sinon.stub(),
+      },
+      jobQueue: {
+        deleteJob: sinon.stub(),
+      },
+    };
+    res = {
+      status: sinon.stub().returnsThis(),
+      json: sinon.stub(),
+    };
+    next = sinon.stub();
+
+    sinon.stub(jwt, "decode");
+
+    handleError = sinon.stub();
+  });
+
+  afterEach(() => {
+    sinon.restore();
+  });
+  it("should return 404 if user is not found", async () => {
+    jwt.decode.returns({ email: "test@example.com" });
+    req.db.getUserByEmail.resolves(null);
+
+    await deleteUser(req, res, next);
+
+    expect(req.db.getUserByEmail.calledOnceWith("test@example.com")).to.be.true;
+    expect(next.calledOnce).to.be.true;
+    expect(next.firstCall.args[0].message).to.equal(
+      errorMessages.DB_USER_NOT_FOUND
+    );
+    expect(res.status.notCalled).to.be.true;
+    expect(res.json.notCalled).to.be.true;
+  });
+
+  it("should delete user and associated data if user is superadmin", async () => {
+    const user = {
+      _id: "user_id",
+      email: "test@example.com",
+      role: ["superadmin"],
+      teamId: "team_id",
+    };
+    const monitors = [{ _id: "monitor_id" }];
+
+    jwt.decode.returns({ email: "test@example.com" });
+    req.db.getUserByEmail.resolves(user);
+    req.db.getMonitorsByTeamId.resolves({ monitors });
+
+    await deleteUser(req, res, next);
+
+    expect(req.db.getUserByEmail.calledOnceWith("test@example.com")).to.be.true;
+    expect(
+      req.db.getMonitorsByTeamId.calledOnceWith({
+        params: { teamId: "team_id" },
+      })
+    ).to.be.true;
+    expect(req.jobQueue.deleteJob.calledOnceWith(monitors[0])).to.be.true;
+    expect(req.db.deleteChecks.calledOnceWith("monitor_id")).to.be.true;
+    expect(req.db.deletePageSpeedChecksByMonitorId.calledOnceWith("monitor_id"))
+      .to.be.true;
+    expect(req.db.deleteNotificationsByMonitorId.calledOnceWith("monitor_id"))
+      .to.be.true;
+    expect(req.db.deleteTeam.calledOnceWith("team_id")).to.be.true;
+    expect(req.db.deleteAllOtherUsers.calledOnce).to.be.true;
+    expect(req.db.deleteMonitorsByUserId.calledOnceWith("user_id")).to.be.true;
+    expect(req.db.deleteUser.calledOnceWith("user_id")).to.be.true;
+    expect(res.status.calledOnceWith(200)).to.be.true;
+    expect(
+      res.json.calledOnceWith({
+        success: true,
+        msg: successMessages.AUTH_DELETE_USER,
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+
+  it("should delete user if user is not superadmin", async () => {
+    const user = {
+      _id: "user_id",
+      email: "test@example.com",
+      role: ["user"],
+      teamId: "team_id",
+    };
+
+    jwt.decode.returns({ email: "test@example.com" });
+    req.db.getUserByEmail.resolves(user);
+
+    await deleteUser(req, res, next);
+
+    expect(req.db.getUserByEmail.calledOnceWith("test@example.com")).to.be.true;
+    expect(
+      req.db.getMonitorsByTeamId.calledOnceWith({
+        params: { teamId: "team_id" },
+      })
+    ).to.be.true;
+    expect(req.db.deleteUser.calledOnceWith("user_id")).to.be.true;
+    expect(res.status.calledOnceWith(200)).to.be.true;
+    expect(
+      res.json.calledOnceWith({
+        success: true,
+        msg: successMessages.AUTH_DELETE_USER,
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+
+  it("should handle errors", async () => {
+    const error = new Error("Something went wrong");
+    const SERVICE_NAME = "AuthController";
+    jwt.decode.returns({ email: "test@example.com" });
+    req.db.getUserByEmail.rejects(error);
+    await deleteUser(req, res, next);
+    expect(next.calledOnce).to.be.true;
+    expect(next.firstCall.args[0].message).to.equal("Something went wrong");
+    expect(res.status.notCalled).to.be.true;
+    expect(res.json.notCalled).to.be.true;
+  });
+});
+
+describe("Auth Controller - getAllUsers", async () => {
+  beforeEach(() => {
+    req = {
+      db: {
+        getAllUsers: sinon.stub(),
+      },
+    };
+    res = {
+      status: sinon.stub().returnsThis(),
+      json: sinon.stub(),
+    };
+    next = sinon.stub();
+    handleError = sinon.stub();
+  });
+
+  afterEach(() => {
+    sinon.restore(); // Restore the original methods after each test
+  });
+
+  it("should return 200 and all users", async () => {
+    const allUsers = [{ id: 1, name: "John Doe" }];
+    req.db.getAllUsers.resolves(allUsers);
+
+    await getAllUsers(req, res, next);
+
+    expect(req.db.getAllUsers.calledOnce).to.be.true;
+    expect(res.status.calledOnceWith(200)).to.be.true;
+    expect(
+      res.json.calledOnceWith({
+        success: true,
+        msg: "Got all users",
+        data: allUsers,
+      })
+    ).to.be.true;
+    expect(next.notCalled).to.be.true;
+  });
+
+  it("should call next with error when an exception occurs", async () => {
+    const error = new Error("Something went wrong");
+    req.db.getAllUsers.rejects(error);
+    await getAllUsers(req, res, next);
+    expect(req.db.getAllUsers.calledOnce).to.be.true;
+    expect(next.calledOnce).to.be.true;
+    expect(res.status.notCalled).to.be.true;
+    expect(res.json.notCalled).to.be.true;
+  });
+});