| 1 | import { describe, it, expect, afterAll, beforeEach } from 'vitest'
|
| 2 | import request from 'supertest'
|
| 3 | import { createApp } from '@app/createApp'
|
| 4 | import { buildPrisma, cleanupTestDb, createTestUser } from '../test-helper'
|
| 5 |
|
| 6 | const app = createApp()
|
| 7 | const db = buildPrisma()
|
| 8 |
|
| 9 | afterAll(() => db.$disconnect())
|
| 10 | beforeEach(() => cleanupTestDb(db))
|
| 11 |
|
| 12 | async function seedResetToken(
|
| 13 | userId: number,
|
| 14 | overrides: { token?: string; expiresAt?: Date } = {}
|
| 15 | ) {
|
| 16 | return db.user.update({
|
| 17 | where: { id: userId },
|
| 18 | data: {
|
| 19 | passwordResetToken: overrides.token ?? 'reset-token-123',
|
| 20 | passwordResetExpires: overrides.expiresAt ?? new Date(Date.now() + 60 * 60 * 1000),
|
| 21 | },
|
| 22 | })
|
| 23 | }
|
| 24 |
|
| 25 | describe('POST /auth/reset-password', () => {
|
| 26 | it('replaces the password and clears the reset token', async () => {
|
| 27 | const user = await createTestUser(db, {
|
| 28 | email: 'reset@example.com',
|
| 29 | password: 'old-password',
|
| 30 | })
|
| 31 |
|
| 32 | await seedResetToken(user.id)
|
| 33 |
|
| 34 | const res = await request(app)
|
| 35 | .post('/auth/reset-password')
|
| 36 | .send({ token: 'reset-token-123', newPassword: 'brand-new-password' })
|
| 37 |
|
| 38 | expect(res.status).toBe(200)
|
| 39 | expect(res.body.success).toBe(true)
|
| 40 |
|
| 41 | const dbUser = await db.user.findUnique({ where: { id: user.id } })
|
| 42 | expect(dbUser!.passwordResetToken).toBeNull()
|
| 43 | expect(dbUser!.passwordResetExpires).toBeNull()
|
| 44 |
|
| 45 | const login = await request(app)
|
| 46 | .post('/auth/login')
|
| 47 | .send({ email: 'reset@example.com', password: 'brand-new-password' })
|
| 48 |
|
| 49 | expect(login.status).toBe(200)
|
| 50 |
|
| 51 | const oldLogin = await request(app)
|
| 52 | .post('/auth/login')
|
| 53 | .send({ email: 'reset@example.com', password: 'old-password' })
|
| 54 |
|
| 55 | expect(oldLogin.status).toBe(401)
|
| 56 | })
|
| 57 |
|
| 58 | it('returns 400 for an expired token', async () => {
|
| 59 | const user = await createTestUser(db, { email: 'expired@example.com' })
|
| 60 | await seedResetToken(user.id, {
|
| 61 | token: 'stale-token',
|
| 62 | expiresAt: new Date(Date.now() - 60 * 1000),
|
| 63 | })
|
| 64 |
|
| 65 | const res = await request(app)
|
| 66 | .post('/auth/reset-password')
|
| 67 | .send({ token: 'stale-token', newPassword: 'whatever-123' })
|
| 68 |
|
| 69 | expect(res.status).toBe(400)
|
| 70 | expect(res.body.error).toMatch(/token/i)
|
| 71 | })
|
| 72 |
|
| 73 | it('returns 400 for an unknown token', async () => {
|
| 74 | const res = await request(app)
|
| 75 | .post('/auth/reset-password')
|
| 76 | .send({ token: 'does-not-exist', newPassword: 'whatever-123' })
|
| 77 |
|
| 78 | expect(res.status).toBe(400)
|
| 79 | })
|
| 80 |
|
| 81 | it('returns 400 for a too-short password', async () => {
|
| 82 | const res = await request(app)
|
| 83 | .post('/auth/reset-password')
|
| 84 | .send({ token: 'reset-token-123', newPassword: '123' })
|
| 85 |
|
| 86 | expect(res.status).toBe(400)
|
| 87 | expect(res.body.fields).toBeTruthy()
|
| 88 | })
|
| 89 | })
|