package oltp
import "testing"
// An imported fossil user has no native verifier but CAN sign in, with
// the password their old server held. That is not an unclaimed invite:
// re-inviting it would hand an admin a link that sets the password of
// somebody who already has one (#319).
func TestAnImportedUserIsNotAnUnclaimedInvite(t *testing.T) {
db := testDB(t)
const code, login, pw = "abc123projectcode", "alice", "secretpw"
if _, _, err := db.ImportUsers("repo", code, []ImportedUser{
{Login: login, Caps: "ei", PWHash: legacySecret(code, login, pw)},
}); err != nil {
t.Fatal(err)
}
if a, _ := db.AccountByName(login); a.Pending {
t.Error("FAIL: AccountByName calls an imported user pending")
}
accts, _ := db.Accounts()
for _, a := range accts {
if a.Name == login && a.Pending {
t.Error("FAIL: Accounts calls an imported user pending")
}
}
if _, err := db.InviteAccount(login, "[email protected]", false); err == nil {
t.Error("FAIL: an imported user was re-invited")
}
if a, _ := db.AccountByName(login); a.Email == "[email protected]" {
t.Error("FAIL: the refused re-invite still set the address")
}
if _, ok := db.Authenticate(login, pw); !ok {
t.Fatal("FAIL: the imported user can no longer sign in")
}
}
// A reset an imported user redeems retires the fossil credential with
// the rest: the old password must not keep signing in — or, worse,
// overwrite the new one on the way through.
func TestARedeemedResetRetiresAnImportedCredential(t *testing.T) {
db := testDB(t)
const code, login, pw = "abc123projectcode", "alice", "secretpw"
if _, _, err := db.ImportUsers("repo", code, []ImportedUser{
{Login: login, Caps: "ei", PWHash: legacySecret(code, login, pw)},
}); err != nil {
t.Fatal(err)
}
token, err := db.ResetPassword(login)
if err != nil {
t.Fatalf("FAIL: an imported user cannot be sent a reset: %v", err)
}
if _, err := db.RedeemInvite(token, "a-chosen-password"); err != nil {
t.Fatal(err)
}
if _, ok := db.Authenticate(login, pw); ok {
t.Error("FAIL: the fossil password still signs in after a reset")
}
if _, ok := db.Authenticate(login, "a-chosen-password"); !ok {
t.Error("FAIL: the chosen password does not sign in")
}
}