From 5c50fda4dc2c0f3fb3476f62d22d7d85c7d411a5 Mon Sep 17 00:00:00 2001
From: Jure Triglav <juretriglav@gmail.com>
Date: Sat, 9 Feb 2019 17:14:11 +1300
Subject: [PATCH] fix(model-user): fix update user mutation's password hashing
---
packages/components/model-user/src/graphql.js | 9 +-
.../model-user/test/user_graphql_test.js | 83 +++++++++++++++++++
2 files changed, 91 insertions(+), 1 deletion(-)
create mode 100644 packages/components/model-user/test/user_graphql_test.js
diff --git a/packages/components/model-user/src/graphql.js b/packages/components/model-user/src/graphql.js
index 198384657..c7d309c2d 100644
--- a/packages/components/model-user/src/graphql.js
+++ b/packages/components/model-user/src/graphql.js
@@ -30,7 +30,14 @@ const resolvers = {
deleteUser(_, { id }, ctx) {
return ctx.connectors.User.delete(id, ctx)
},
- updateUser(_, { id, input }, ctx) {
+ async updateUser(_, { id, input }, ctx) {
+ if (input.password) {
+ input.passwordHash = await ctx.connectors.User.model.hashPassword(
+ input.password,
+ )
+ delete input.password
+ }
+
return ctx.connectors.User.update(id, input, ctx)
},
// Authentication
diff --git a/packages/components/model-user/test/user_graphql_test.js b/packages/components/model-user/test/user_graphql_test.js
new file mode 100644
index 000000000..49d79cbb3
--- /dev/null
+++ b/packages/components/model-user/test/user_graphql_test.js
@@ -0,0 +1,83 @@
+process.env.NODE_CONFIG = `{"pubsweet":{
+ "components":[
+ "@pubsweet/model-user",
+ "@pubsweet/model-team"
+ ]
+}}`
+
+const User = require('../src/user')
+const { dbCleaner, api } = require('pubsweet-server/test')
+
+const { fixtures } = require('@pubsweet/model-user/test')
+const authentication = require('pubsweet-server/src/authentication')
+
+describe('User mutations', () => {
+ // let token
+ // let user
+
+ beforeEach(async () => {
+ await dbCleaner()
+ // user = await new User(fixtures.user).save()
+ // token = authentication.token.create(user)
+ })
+
+ it('a user can sign up', async () => {
+ const { body } = await api.graphql.query(
+ `mutation($input: UserInput) {
+ createUser(input: $input) {
+ username
+ }
+ }`,
+ {
+ input: {
+ username: 'hi',
+ email: 'hi@example.com',
+ password: 'hello',
+ },
+ },
+ )
+
+ expect(body).toEqual({
+ data: {
+ createUser: {
+ username: 'hi',
+ },
+ },
+ })
+ })
+
+ it('a user can update a password', async () => {
+ const user = await new User(fixtures.user).save()
+ const token = authentication.token.create(user)
+
+ const { body } = await api.graphql.query(
+ `mutation($id: ID, $input: UserInput) {
+ updateUser(id: $id, input: $input) {
+ username
+ }
+ }`,
+ {
+ id: user.id,
+ input: {
+ username: 'hi',
+ email: 'hi@example.com',
+ password: 'hello2',
+ },
+ },
+ token,
+ )
+
+ expect(body).toEqual({
+ data: {
+ updateUser: {
+ username: 'hi',
+ },
+ },
+ })
+
+ const oldHash = user.passwordHash
+ const newHash = await User.find(user.id).passwordHash
+
+ expect(oldHash).not.toEqual(newHash)
+ })
+})
--
GitLab