Move old backend code to old_src folder

Signed-off-by: David Mehren <git@herrmehren.de>
2025-05-18 17:25:16 -04:00 · 2020-07-24 21:06:55 +02:00 · 2020-07-24 21:06:55 +02:00 · 7b9f9a487b
commit 7b9f9a487b
parent c42d2223e8
97 changed files with 7 additions and 7 deletions
--- a/old_src/test/auth.ts
+++ b/old_src/test/auth.ts
@ -0,0 +1,110 @@
+import assert from 'assert'
+import { ImportMock } from 'ts-mock-imports'
+import * as configModule from '../lib/config'
+import { DropboxMiddleware } from '../lib/web/auth/dropbox'
+import { EmailMiddleware } from '../lib/web/auth/email'
+import { FacebookMiddleware } from '../lib/web/auth/facebook'
+import { GithubMiddleware } from '../lib/web/auth/github'
+import { GitlabMiddleware } from '../lib/web/auth/gitlab'
+import { GoogleMiddleware } from '../lib/web/auth/google'
+import { LdapMiddleware } from '../lib/web/auth/ldap'
+import { OAuth2Middleware } from '../lib/web/auth/oauth2'
+import { OPenIDMiddleware } from '../lib/web/auth/openid'
+import { TwitterMiddleware } from '../lib/web/auth/twitter'
+
+describe('AuthMiddlewares', function () {
+  // We currently exclude the SAML Auth, because it needs a certificate file
+  const middlewareList = [{
+    name: 'Facebook',
+    middleware: FacebookMiddleware,
+    config: {
+      facebook: {
+        clientID: 'foobar',
+        clientSecret: 'foobar'
+      }
+    }
+  }, {
+    name: 'Twitter',
+    middleware: TwitterMiddleware,
+    config: {
+      twitter: {
+        consumerKey: 'foobar',
+        consumerSecret: 'foobar'
+      }
+    }
+  }, {
+    name: 'GitHub',
+    middleware: GithubMiddleware,
+    config: {
+      github: {
+        clientID: 'foobar',
+        clientSecret: 'foobar'
+      }
+    }
+  }, {
+    name: 'Gitlab',
+    middleware: GitlabMiddleware,
+    config: {
+      gitlab: {
+        clientID: 'foobar',
+        clientSecret: 'foobar'
+      }
+    }
+  }, {
+    name: 'Dropbox',
+    middleware: DropboxMiddleware,
+    config: {
+      dropbox: {
+        clientID: 'foobar',
+        clientSecret: 'foobar'
+      }
+    }
+  }, {
+    name: 'Google',
+    middleware: GoogleMiddleware,
+    config: {
+      google: {
+        clientID: 'foobar',
+        clientSecret: 'foobar'
+      }
+    }
+  }, {
+    name: 'LDAP',
+    middleware: LdapMiddleware,
+    config: {
+      ldap: {}
+    }
+  }, {
+    name: 'OAuth2',
+    middleware: OAuth2Middleware,
+    config: {
+      oauth2: {
+        clientID: 'foobar',
+        clientSecret: 'foobar',
+        authorizationURL: 'foobar',
+        tokenURL: 'foobar',
+        userProfileURL: 'foobar',
+        scope: 'foobar'
+      }
+    }
+  }, {
+    name: 'Email',
+    middleware: EmailMiddleware,
+    config: {}
+  }, {
+    name: 'OpenID',
+    middleware: OPenIDMiddleware,
+    config: {}
+  }]
+
+  middlewareList.forEach((middleware) => {
+    describe(middleware.name + 'Middleware', () => {
+      before(() => {
+        ImportMock.mockOther(configModule, 'config', middleware.config)
+      })
+      it('can be instantiated', () => {
+        assert.ok(middleware.middleware.getMiddleware())
+      })
+    })
+  })
+})
--- a/old_src/test/csp.ts
+++ b/old_src/test/csp.ts
@ -0,0 +1,109 @@
+/* eslint-env node, mocha */
+'use strict'
+
+import assert from 'assert'
+import crypto from 'crypto'
+import fs from 'fs'
+import path from 'path'
+import * as configModule from '../lib/config'
+import { ImportMock } from 'ts-mock-imports'
+
+describe('Content security policies', function () {
+  let defaultConfig, csp
+
+  before(function () {
+    csp = require('../lib/csp')
+  })
+
+  beforeEach(function () {
+    // Reset config to make sure we don't influence other tests
+    defaultConfig = {
+      csp: {
+        enable: true,
+        directives: {
+        },
+        addDefaults: true,
+        addDisqus: true,
+        addGoogleAnalytics: true,
+        upgradeInsecureRequests: 'auto',
+        reportURI: undefined
+      },
+      useCDN: true
+    }
+  })
+
+  // beginnging Tests
+  it('Disable CDN', function () {
+    const testconfig = defaultConfig
+    testconfig.useCDN = false
+    ImportMock.mockOther(configModule, 'config', testconfig)
+
+    assert(!csp.computeDirectives().scriptSrc.includes('https://cdnjs.cloudflare.com'))
+    assert(!csp.computeDirectives().scriptSrc.includes('https://cdn.mathjax.org'))
+    assert(!csp.computeDirectives().styleSrc.includes('https://cdnjs.cloudflare.com'))
+    assert(!csp.computeDirectives().styleSrc.includes('https://fonts.googleapis.com'))
+    assert(!csp.computeDirectives().fontSrc.includes('https://cdnjs.cloudflare.com'))
+    assert(!csp.computeDirectives().fontSrc.includes('https://fonts.gstatic.com'))
+  })
+
+  it('Disable Google Analytics', function () {
+    const testconfig = defaultConfig
+    testconfig.csp.addGoogleAnalytics = false
+    ImportMock.mockOther(configModule, 'config', testconfig)
+
+    assert(!csp.computeDirectives().scriptSrc.includes('https://www.google-analytics.com'))
+  })
+
+  it('Disable Disqus', function () {
+    const testconfig = defaultConfig
+    testconfig.csp.addDisqus = false
+    ImportMock.mockOther(configModule, 'config', testconfig)
+
+    assert(!csp.computeDirectives().scriptSrc.includes('https://disqus.com'))
+    assert(!csp.computeDirectives().scriptSrc.includes('https://*.disqus.com'))
+    assert(!csp.computeDirectives().scriptSrc.includes('https://*.disquscdn.com'))
+    assert(!csp.computeDirectives().styleSrc.includes('https://*.disquscdn.com'))
+    assert(!csp.computeDirectives().fontSrc.includes('https://*.disquscdn.com'))
+  })
+
+  it('Set ReportURI', function () {
+    const testconfig = defaultConfig
+    testconfig.csp.reportURI = 'https://example.com/reportURI'
+    ImportMock.mockOther(configModule, 'config', testconfig)
+
+    assert.strictEqual(csp.computeDirectives().reportUri, 'https://example.com/reportURI')
+  })
+
+  it('Set own directives', function () {
+    const testconfig = defaultConfig
+    ImportMock.mockOther(configModule, 'config', testconfig)
+    const unextendedCSP = csp.computeDirectives()
+    testconfig.csp.directives = {
+      defaultSrc: ['https://default.example.com'],
+      scriptSrc: ['https://script.example.com'],
+      imgSrc: ['https://img.example.com'],
+      styleSrc: ['https://style.example.com'],
+      fontSrc: ['https://font.example.com'],
+      objectSrc: ['https://object.example.com'],
+      mediaSrc: ['https://media.example.com'],
+      childSrc: ['https://child.example.com'],
+      connectSrc: ['https://connect.example.com']
+    }
+    ImportMock.mockOther(configModule, 'config', testconfig)
+
+    const variations = ['default', 'script', 'img', 'style', 'font', 'object', 'media', 'child', 'connect']
+
+    for (let i = 0; i < variations.length; i++) {
+      assert.strictEqual(csp.computeDirectives()[variations[i] + 'Src'].toString(), ['https://' + variations[i] + '.example.com'].concat(unextendedCSP[variations[i] + 'Src']).toString())
+    }
+  })
+
+  /*
+   * This test reminds us to update the CSP hash for the speaker notes
+   */
+  it('Unchanged hash for reveal.js speaker notes plugin', function () {
+    const hash = crypto.createHash('sha1')
+    hash.update(fs.readFileSync(path.join(process.cwd(), '/node_modules/reveal.js/plugin/notes/notes.html'), 'utf8'), 'utf8')
+    assert.strictEqual(hash.digest('hex'), 'd5d872ae49b5db27f638b152e6e528837204d380')
+  })
+})
--- a/old_src/test/letter-avatars.ts
+++ b/old_src/test/letter-avatars.ts
@ -0,0 +1,51 @@
+/* eslint-env node, mocha */
+
+'use strict'
+
+import { ImportMock } from 'ts-mock-imports'
+import * as configModule from '../lib/config'
+
+import assert from 'assert'
+import * as avatars from '../lib/letter-avatars'
+
+describe('generateAvatarURL() gravatar enabled', function () {
+  beforeEach(function () {
+    // Reset config to make sure we don't influence other tests
+    const testconfig = {
+      allowGravatar: true,
+      serverURL: 'http://localhost:3000',
+      port: 3000
+    }
+    ImportMock.mockOther(configModule, 'config', testconfig)
+  })
+
+  it('should return correct urls', function () {
+    assert.strictEqual(avatars.generateAvatarURL('Daan Sprenkels', 'hello@dsprenkels.com', true), 'https://cdn.libravatar.org/avatar/d41b5f3508cc3f31865566a47dd0336b?s=400')
+    assert.strictEqual(avatars.generateAvatarURL('Daan Sprenkels', 'hello@dsprenkels.com', false), 'https://cdn.libravatar.org/avatar/d41b5f3508cc3f31865566a47dd0336b?s=96')
+  })
+
+  it('should return correct urls for names with spaces', function () {
+    assert.strictEqual(avatars.generateAvatarURL('Daan Sprenkels'), 'http://localhost:3000/user/Daan%20Sprenkels/avatar.svg')
+  })
+})
+
+describe('generateAvatarURL() gravatar disabled', function () {
+  beforeEach(function () {
+    // Reset config to make sure we don't influence other tests
+    const testconfig = {
+      allowGravatar: false,
+      serverURL: 'http://localhost:3000',
+      port: 3000
+    }
+    ImportMock.mockOther(configModule, 'config', testconfig)
+  })
+
+  it('should return correct urls', function () {
+    assert.strictEqual(avatars.generateAvatarURL('Daan Sprenkels', 'hello@dsprenkels.com', true), 'http://localhost:3000/user/Daan%20Sprenkels/avatar.svg')
+    assert.strictEqual(avatars.generateAvatarURL('Daan Sprenkels', 'hello@dsprenkels.com', false), 'http://localhost:3000/user/Daan%20Sprenkels/avatar.svg')
+  })
+
+  it('should return correct urls for names with spaces', function () {
+    assert.strictEqual(avatars.generateAvatarURL('Daan Sprenkels'), 'http://localhost:3000/user/Daan%20Sprenkels/avatar.svg')
+  })
+})
--- a/old_src/test/user.ts
+++ b/old_src/test/user.ts
@ -0,0 +1,60 @@
+/* eslint-env node, mocha */
+
+import { User, sequelize } from '../lib/models'
+import assert = require('assert')
+
+describe('User Sequelize model', function () {
+  beforeEach(() => {
+    return sequelize.sync({ force: true })
+  })
+
+  it('stores a password hash on creation and verifies that password', function () {
+    const userData = {
+      password: 'test123'
+    }
+    const intentionallyInvalidPassword = 'stuff'
+
+    return User.create(userData).then(u => {
+      return Promise.all([
+        u.verifyPassword(userData.password).then(result => assert.strictEqual(result, true)),
+        u.verifyPassword(intentionallyInvalidPassword).then(result => assert.strictEqual(result, false))
+      ]).catch(e => assert.fail(e))
+    })
+  })
+
+  it('can cope with password stored in standard scrypt header format', function () {
+    const testKey = '736372797074000e00000008000000018c7b8c1ac273fd339badde759b3efc418bc61b776debd02dfe95989383cf9980ad21d2403dce33f4b551f5e98ce84edb792aee62600b1303ab8d4e6f0a53b0746e73193dbf557b888efc83a2d6a055a9'
+    const validPassword = 'test'
+    const intentionallyInvalidPassword = 'stuff'
+
+    const u = User.build()
+    u.setDataValue('password', testKey) // this circumvents the setter - which we don't need in this case!
+    return Promise.all([
+      u.verifyPassword(validPassword).then(result => assert.strictEqual(result, true)),
+      u.verifyPassword(intentionallyInvalidPassword).then(result => assert.strictEqual(result, false))
+    ]).catch(e => assert.fail(e))
+  })
+
+  it('deals with various characters correctly', function () {
+    const combinations = [
+      // ['correct password', 'scrypt syle hash']
+      ['test', '736372797074000e00000008000000018c7b8c1ac273fd339badde759b3efc418bc61b776debd02dfe95989383cf9980ad21d2403dce33f4b551f5e98ce84edb792aee62600b1303ab8d4e6f0a53b0746e73193dbf557b888efc83a2d6a055a9'],
+      ['ohai', '736372797074000e00000008000000010efec4e5ce6a5294491f1b1cccc38d3562f84844b9271aef635f8bc338cf4e0e0bac62ebb11379e85894c1f694e038fc39b087b4fdacd1280b50a7382d7ffbfc82f2190bef70d47708d2a94b75126294'],
+      ['my secret pw', '736372797074000f0000000800000001ffb4cd10a1dfe9e64c1e5416fd6d55b390b6822e78b46fd1f963fe9f317a1e05f9c5fee15e1f618286f4e38b55364ae1e7dc295c9dc33ee0f5712e86afe37e5784ff9c7cf84cf0e631dd11f84f3621e7'],
+      ['my secret pw', /* different hash! */ '736372797074000f0000000800000001f6083e9593365acd07550f7c72f19973fb7d52c3ef0a78026ff66c48ab14493843c642167b5e6b7f31927e8eeb912bc2639e41955fae15da5099998948cfeacd022f705624931c3b30104e6bb296b805'],
+      ['i am so extremely long, it\'s not even funny. Wait, you\'re still reading?', '736372797074000f00000008000000012d205f7bb529bb3a8b8bb25f5ab46197c7e9baf1aad64cf5e7b2584c84748cacf5e60631d58d21cb51fa34ea93b517e2fe2eb722931db5a70ff5a1330d821288ee7380c4136369f064b71b191a785a5b']
+    ]
+    const intentionallyInvalidPassword = 'stuff'
+
+    return Promise.all(combinations.map((combination, index) => {
+      const u = User.build()
+      u.setDataValue('password', combination[1])
+      return Promise.all([
+        u.verifyPassword(combination[0])
+          .then(result => assert.strictEqual(result, true, `password #${index} "${combination[0]}" should have been verified`)),
+        u.verifyPassword(intentionallyInvalidPassword)
+          .then(result => assert.strictEqual(result, false, `password #${index} "${combination[0]}" should NOT have been verified`))
+      ])
+    })).catch(e => assert.fail(e))
+  })
+})