GeorgeandClaude Sonnet 5.5
079cedbaed
- POST /api/auth/login (U_WEB_USER/U_WEB_PASS de EmployeesInfo), logout y me. - Token opaco (32 bytes) en Authorization: Bearer; una sesión por usuario, timeout deslizante configurable (SESSION_TIMEOUT_MINUTES, 30 por defecto). - AuthGuard global con @Public(); /health/sap ahora exige sesión. - Usuario inexistente y contraseña errónea devuelven el mismo mensaje; comparación en tiempo constante; filtro OData escapado; se rechazan U_WEB_USER duplicados. - LoginAttemptsService: 429 tras 5 fallos por usuario o 20 por IP (15 min). - Tests unitarios y e2e con SAP simulado. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
85 lines
3.6 KiB
TypeScript
85 lines
3.6 KiB
TypeScript
import { Test } from '@nestjs/testing';
|
|
import type { INestApplication } from '@nestjs/common';
|
|
import request from 'supertest';
|
|
|
|
process.env.SAPB1_SL_URL ??= 'https://sap.invalid:50000/b1s/v1';
|
|
process.env.SAPB1_SL_COMPANYDB ??= 'DB';
|
|
process.env.SAPB1_SL_USER ??= 'u';
|
|
process.env.SAPB1_SL_PASSWORD ??= 'p';
|
|
|
|
const EMPLOYEES = [
|
|
{ EmployeeID: 7, FirstName: 'Ana', LastName: 'Pérez', Active: 'tYES', U_WEB_USER: 'ana', U_WEB_PASS: 'secreto' },
|
|
];
|
|
|
|
describe('Auth (e2e, SAP simulado)', () => {
|
|
let app: INestApplication;
|
|
|
|
beforeEach(async () => {
|
|
const { AppModule } = await import('../src/app.module.js');
|
|
const { SapClientService } = await import('../src/sap/sap-client.service.js');
|
|
const { SapSessionService } = await import('../src/sap/sap-session.service.js');
|
|
const moduleRef = await Test.createTestingModule({ imports: [AppModule] })
|
|
.overrideProvider(SapClientService)
|
|
.useValue({
|
|
get: async (_path: string, q: { $filter: string }) => ({
|
|
data: { value: q.$filter === "U_WEB_USER eq 'ana'" ? EMPLOYEES : [] },
|
|
}),
|
|
})
|
|
.overrideProvider(SapSessionService)
|
|
.useValue({ getSession: async () => ({}), status: () => ({ connected: true }), onModuleDestroy: () => undefined })
|
|
.compile();
|
|
app = moduleRef.createNestApplication();
|
|
app.setGlobalPrefix('api');
|
|
await app.init();
|
|
});
|
|
|
|
afterEach(async () => {
|
|
await app.close();
|
|
});
|
|
|
|
const login = (username: string, password: string) =>
|
|
request(app.getHttpServer()).post('/api/auth/login').send({ username, password });
|
|
|
|
it('/health es público, /health/sap exige sesión', async () => {
|
|
await request(app.getHttpServer()).get('/api/health').expect(200);
|
|
await request(app.getHttpServer()).get('/api/health/sap').expect(401);
|
|
});
|
|
|
|
it('flujo completo: login -> me -> ruta protegida -> logout -> 401', async () => {
|
|
const res = await login('ana', 'secreto').expect(200);
|
|
expect(res.body.user).toMatchObject({ webUser: 'ana', empId: 7, firstName: 'Ana' });
|
|
expect(JSON.stringify(res.body)).not.toContain('secreto');
|
|
const auth = { Authorization: `Bearer ${res.body.token}` };
|
|
|
|
const me = await request(app.getHttpServer()).get('/api/auth/me').set(auth).expect(200);
|
|
expect(me.body.user.webUser).toBe('ana');
|
|
await request(app.getHttpServer()).get('/api/health/sap').set(auth).expect(200);
|
|
|
|
await request(app.getHttpServer()).post('/api/auth/logout').set(auth).expect(204);
|
|
await request(app.getHttpServer()).get('/api/auth/me').set(auth).expect(401);
|
|
});
|
|
|
|
it('un segundo login invalida el token del primero', async () => {
|
|
const t1 = (await login('ana', 'secreto').expect(200)).body.token;
|
|
const t2 = (await login('ana', 'secreto').expect(200)).body.token;
|
|
await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', `Bearer ${t1}`).expect(401);
|
|
await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', `Bearer ${t2}`).expect(200);
|
|
});
|
|
|
|
it('credenciales inválidas -> 401 y cuerpo inválido -> 400', async () => {
|
|
await login('ana', 'mala').expect(401);
|
|
await login('nadie', 'x').expect(401);
|
|
await request(app.getHttpServer()).post('/api/auth/login').send({ username: 'ana' }).expect(400);
|
|
});
|
|
|
|
it('sin token o con token falso -> 401', async () => {
|
|
await request(app.getHttpServer()).get('/api/auth/me').expect(401);
|
|
await request(app.getHttpServer()).get('/api/auth/me').set('Authorization', 'Bearer falso').expect(401);
|
|
});
|
|
|
|
it('tras 5 intentos fallidos responde 429', async () => {
|
|
for (let i = 0; i < 5; i++) await login('ana', 'mala').expect(401);
|
|
await login('ana', 'secreto').expect(429);
|
|
});
|
|
});
|