72 lines
3.0 KiB
JavaScript
72 lines
3.0 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { readFile } from "node:fs/promises";
|
|
import { PGlite } from "../.data/sql-verification/node_modules/@electric-sql/pglite/dist/index.js";
|
|
const db = new PGlite();
|
|
try {
|
|
await db.exec(`create role anon; create role authenticated; create role service_role bypassrls;
|
|
create schema auth;
|
|
create function auth.uid() returns uuid language sql as $$ select nullif(current_setting('test.uid',true),'')::uuid $$;
|
|
create table auth.users(id uuid primary key,encrypted_password text,email text,email_confirmed_at timestamptz,is_anonymous boolean);
|
|
insert into auth.users values
|
|
('00000000-0000-4000-8000-000000000001','', 'legacy@example.com',now(),false),
|
|
('00000000-0000-4000-8000-000000000002','existing-hash','password@example.com',now(),false),
|
|
('00000000-0000-4000-8000-000000000003',null,'unverified@example.com',null,false),
|
|
('00000000-0000-4000-8000-000000000004',null,null,null,true);`);
|
|
await db.exec(
|
|
await readFile(
|
|
"supabase/migrations/20261007055439_legacy_password_claims.sql",
|
|
"utf8",
|
|
),
|
|
);
|
|
for (const role of ["anon", "authenticated"]) {
|
|
await db.exec(`set role ${role}`);
|
|
await assert.rejects(
|
|
db.query(
|
|
"select public.claim_legacy_password('00000000-0000-4000-8000-000000000001')",
|
|
),
|
|
/permission denied/,
|
|
);
|
|
await assert.rejects(
|
|
db.query(
|
|
"select public.legacy_password_needed('00000000-0000-4000-8000-000000000001')",
|
|
),
|
|
/permission denied/,
|
|
);
|
|
await db.exec("reset role");
|
|
}
|
|
await db.exec("set role service_role");
|
|
const call = async (fn, ending) =>
|
|
(
|
|
await db.query(
|
|
`select public.${fn}('00000000-0000-4000-8000-00000000000${ending}') as result`,
|
|
)
|
|
).rows[0].result;
|
|
assert.equal(await call("legacy_password_needed", 1), true);
|
|
for (const ending of [2, 3, 4, 5]) {
|
|
assert.equal(await call("legacy_password_needed", ending), false);
|
|
assert.equal(await call("claim_legacy_password", ending), false);
|
|
}
|
|
await db.exec(
|
|
"select set_config('test.uid','00000000-0000-4000-8000-000000000002',false)",
|
|
);
|
|
assert.equal(await call("claim_legacy_password", 1), false);
|
|
await db.exec("select set_config('test.uid','',false)");
|
|
assert.equal(await call("claim_legacy_password", 1), true);
|
|
assert.equal(await call("claim_legacy_password", 1), false);
|
|
assert.equal(await call("legacy_password_needed", 1), false);
|
|
const columns = (
|
|
await db.query(
|
|
"select column_name from information_schema.columns where table_schema='minegeo_private' and table_name='legacy_password_claims'",
|
|
)
|
|
).rows.map((r) => r.column_name);
|
|
assert.deepEqual(columns.sort(), ["claimed_at", "user_id"]);
|
|
console.log(
|
|
"Initial password SQL passed: verified legacy owners eligible once; existing passwords protected; anonymous, unverified and cross-account attempts denied; no password stored.",
|
|
);
|
|
} catch (error) {
|
|
console.error(error.message);
|
|
process.exitCode = 1;
|
|
} finally {
|
|
await db.close();
|
|
}
|