Paul Nothaft
d9ad982373
The 3.97.0-beta.0 release PR (#899) failed its backend Tests job on slideshowPublic.test.js: bootCrmDb's full migration chain crossed the suite's explicit 30s beforeAll timeout argument on a slow runner. #860 raised the config default and the jest.setTimeout pins to 120s, but hook-ARGUMENT pins override the config default and were left behind — same time-bomb, different syntax. Every beforeAll that boots the migration chain and pinned 30s/60s is raised to 120000 (16 suites). Untouched on purpose: the three suites whose pinned hooks don't run migrations (webhookDelivery, imageProcessor.storage, storageBackend) and publicQuotes' 30s pin on the rate-limit lockout test — neither grows with the migration chain. No test logic changed. Co-authored-by: Paul Nothaft <paul@MacStudio-von-Paul.local>
83 lines
2.7 KiB
JavaScript
83 lines
2.7 KiB
JavaScript
/**
|
|
* CLI test for scripts/reset-admin-mfa.js — break-glass MFA reset (#738).
|
|
*
|
|
* Boots a temp-SQLite DB, seeds an admin with MFA fully enabled, then runs
|
|
* the script in a child process (--email <addr> --yes) pointed at the same
|
|
* DB file, and asserts the four MFA columns are zeroed. The script runs in
|
|
* its own process with its own knex connection; the parent connection is
|
|
* idle during the spawn so the SQLite write lock isn't contended.
|
|
*/
|
|
|
|
const path = require('path');
|
|
const { execFileSync } = require('child_process');
|
|
|
|
const { bootCrmDb } = require('./helpers/crmDb');
|
|
|
|
jest.setTimeout(120000);
|
|
|
|
let db;
|
|
let cleanup;
|
|
|
|
beforeAll(async () => {
|
|
({ db, cleanup } = await bootCrmDb());
|
|
}, 120000);
|
|
|
|
afterAll(async () => {
|
|
if (cleanup) await cleanup();
|
|
});
|
|
|
|
const SCRIPT = path.resolve(__dirname, '..', '..', 'scripts', 'reset-admin-mfa.js');
|
|
|
|
async function seedEnrolledAdmin(email) {
|
|
const inserted = await db('admin_users').insert({
|
|
username: email.split('@')[0],
|
|
email,
|
|
password_hash: 'x',
|
|
is_active: true,
|
|
two_factor_enabled: true,
|
|
two_factor_secret: 'iv.tag.ct',
|
|
two_factor_recovery_codes: JSON.stringify(['$2b$10$fakehashfakehashfakehashfa']),
|
|
two_factor_enrolled_at: new Date(),
|
|
created_at: new Date(),
|
|
}).returning('id');
|
|
return inserted[0]?.id ?? inserted[0];
|
|
}
|
|
|
|
it('zeroes the four MFA columns for the targeted admin', async () => {
|
|
const email = 'reset-me@example.com';
|
|
const id = await seedEnrolledAdmin(email);
|
|
|
|
execFileSync('node', [SCRIPT, '--email', email, '--yes'], {
|
|
env: {
|
|
...process.env,
|
|
NODE_ENV: 'test',
|
|
TEST_DATABASE_PATH: process.env.TEST_DATABASE_PATH,
|
|
},
|
|
stdio: 'pipe',
|
|
});
|
|
|
|
const row = await db('admin_users').where({ id }).first();
|
|
expect(Number(row.two_factor_enabled)).toBe(0);
|
|
expect(row.two_factor_secret).toBeNull();
|
|
expect(row.two_factor_recovery_codes).toBeNull();
|
|
expect(row.two_factor_enrolled_at).toBeNull();
|
|
});
|
|
|
|
it('leaves a different admin untouched', async () => {
|
|
const targetEmail = 'target@example.com';
|
|
const bystanderEmail = 'bystander@example.com';
|
|
const targetId = await seedEnrolledAdmin(targetEmail);
|
|
const bystanderId = await seedEnrolledAdmin(bystanderEmail);
|
|
|
|
execFileSync('node', [SCRIPT, '--email', targetEmail, '--yes'], {
|
|
env: { ...process.env, NODE_ENV: 'test', TEST_DATABASE_PATH: process.env.TEST_DATABASE_PATH },
|
|
stdio: 'pipe',
|
|
});
|
|
|
|
const target = await db('admin_users').where({ id: targetId }).first();
|
|
const bystander = await db('admin_users').where({ id: bystanderId }).first();
|
|
expect(Number(target.two_factor_enabled)).toBe(0);
|
|
expect(Number(bystander.two_factor_enabled)).toBe(1);
|
|
expect(bystander.two_factor_secret).toBe('iv.tag.ct');
|
|
});
|