feat: Update authentication middleware (#6447)

* authentication middleware update * disable customer authentication * call correct feature flag method * fix authentication middleware for store/customers * fix integration tests and add middleware for admin customers * update seeders * customer groups fix * add authentication middleware for all admin endpoints * Feat(medusa, user): require authentication for invite accept (#6448) * initial invite token validation for authentication invocation * remove invite auth * remove unused import * cleanup tests * refactor to auth instead of auth_user * pr feedback * update authenticatedRequest type * update store authenticated endpoints * update routes with type * fix build * fix build * fix build * use auth middleware for api-keys
2024-02-27 13:50:18 +08:00
parent 63aea44e06
commit 7bddb58542
94 changed files with 1177 additions and 509 deletions
@@ -0,0 +1,112 @@
+import { IAuthModuleService, IUserModuleService } from "@medusajs/types"
+import { initDb, useDb } from "../../../environment-helpers/use-db"
+
+import { AxiosInstance } from "axios"
+import { ModuleRegistrationName } from "@medusajs/modules-sdk"
+import { createAdminUser } from "../../helpers/create-admin-user"
+import { getContainer } from "../../../environment-helpers/use-container"
+import path from "path"
+import { startBootstrapApp } from "../../../environment-helpers/bootstrap-app"
+import { useApi } from "../../../environment-helpers/use-api"
+
+jest.setTimeout(50000)
+
+const env = { MEDUSA_FF_MEDUSA_V2: true }
+const adminHeaders = {
+  headers: { "x-medusa-access-token": "test_token" },
+}
+
+describe("GET /admin/invites/:id", () => {
+  let dbConnection
+  let appContainer
+  let shutdownServer
+  let userModuleService: IUserModuleService
+
+  beforeAll(async () => {
+    const cwd = path.resolve(path.join(__dirname, "..", ".."))
+    dbConnection = await initDb({ cwd, env } as any)
+    shutdownServer = await startBootstrapApp({ cwd, env })
+    appContainer = getContainer()
+    userModuleService = appContainer.resolve(ModuleRegistrationName.USER)
+  })
+
+  beforeEach(async () => {
+    await createAdminUser(dbConnection, adminHeaders)
+  })
+
+  afterAll(async () => {
+    const db = useDb()
+    await db.shutdown()
+    await shutdownServer()
+  })
+
+  afterEach(async () => {
+    const db = useDb()
+    await db.teardown()
+  })
+
+  it("should fail to accept an invite with an invalid invite token", async () => {
+    const api = useApi()! as AxiosInstance
+
+    const authResponse = await api.post(`/auth/admin/emailpass`, {
+      email: "potential_member@test.com",
+      password: "supersecret",
+    })
+
+    expect(authResponse.status).toEqual(200)
+    const token = authResponse.data.token
+
+    const acceptResponse = await api
+      .post(
+        `/admin/invites/accept?token=${"non-existing-token"}`,
+        {
+          first_name: "John",
+        },
+        {
+          headers: {
+            Authorization: `Bearer ${token}`,
+          },
+        }
+      )
+      .catch((e) => e)
+
+    expect(acceptResponse.response.status).toEqual(401)
+    expect(acceptResponse.response.data.message).toEqual("Unauthorized")
+  })
+
+  it("should accept an invite", async () => {
+    const invite = await userModuleService.createInvites({
+      email: "potential_member@test.com",
+    })
+
+    const api = useApi()! as AxiosInstance
+
+    const authResponse = await api.post(`/auth/admin/emailpass`, {
+      email: "potential_member@test.com",
+      password: "supersecret",
+    })
+
+    expect(authResponse.status).toEqual(200)
+    const token = authResponse.data.token
+
+    const acceptResponse = await api.post(
+      `/admin/invites/accept?token=${invite.token}`,
+      {
+        first_name: "John",
+      },
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+        },
+      }
+    )
+
+    expect(acceptResponse.status).toEqual(200)
+    expect(acceptResponse.data.user).toEqual(
+      expect.objectContaining({
+        email: "potential_member@test.com",
+        first_name: "John",
+      })
+    )
+  })
+})