pepepper/fluxer
1
0 Fork 0
mirror of https://github.com/fluxerapp/fluxer synced 2026-10-17 21:15:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): fix approval signups and auto-join invites (#3467)

Browse Source
This commit is contained in:
Hampus authored and GitHub committed 2026-10-14 16:41:33 +02:00
1 parent e403fb6cce
commit d5ca5d8293
64 files changed
+622 -72
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

fluxer_api/src/api/auth/tests/RegistrationPolicy.test.ts
+63
View File
@@ -91,4 +91,67 @@ describe('Auth registration policy', () => {
.expect(403, APIErrorCodes.REGISTRATION_PENDING_APPROVAL)
.execute();
});
it('refuses an approval registration without sign-in credentials', async () => {
await getInstanceConfigRepository().setRegistrationConfig({mode: 'approval'});
await createBuilderWithoutAuth(harness)
.post('/auth/register')
.body({global_name: 'Nobody Signs In', date_of_birth: '2000-01-01', consent: true})
.expect(400, APIErrorCodes.REGISTRATION_CREDENTIALS_REQUIRED)
.execute();
expect(await getInstanceConfigRepository().getPendingRegistrations()).toEqual([]);
});
it('refuses an approval registration with an email but no password', async () => {
await getInstanceConfigRepository().setRegistrationConfig({mode: 'approval'});
const {password: _password, ...body} = registrationBody('nopassword');
await createBuilderWithoutAuth(harness)
.post('/auth/register')
.body(body)
.expect(400, APIErrorCodes.REGISTRATION_CREDENTIALS_REQUIRED)
.execute();
expect(await getInstanceConfigRepository().getPendingRegistrations()).toEqual([]);
});
it('refuses an approval registration with a password but no email', async () => {
await getInstanceConfigRepository().setRegistrationConfig({mode: 'approval'});
const {email: _email, ...body} = registrationBody('noemail');
await createBuilderWithoutAuth(harness)
.post('/auth/register')
.body(body)
.expect(400, APIErrorCodes.REGISTRATION_CREDENTIALS_REQUIRED)
.execute();
expect(await getInstanceConfigRepository().getPendingRegistrations()).toEqual([]);
});
it('keeps the registration URL seat when an approval registration is refused', async () => {
const repository = getInstanceConfigRepository();
await repository.setRegistrationConfig({mode: 'open', admin_registration_urls_enabled: true});
const {code} = await repository.createRegistrationUrl({
label: 'Reviewed link',
createdByUserId: '1',
expiresAt: null,
maxUses: 1,
approvalRequired: true,
});
await createBuilderWithoutAuth(harness)
.post('/auth/register')
.body({global_name: 'Seat Keeper', date_of_birth: '2000-01-01', consent: true, registration_url_code: code})
.expect(400, APIErrorCodes.REGISTRATION_CREDENTIALS_REQUIRED)
.execute();
const registration = await createBuilderWithoutAuth<PendingRegistrationResponse>(harness)
.post('/auth/register')
.body({...registrationBody('seatkeeper'), registration_url_code: code})
.execute();
expect(registration.registration_pending_approval).toBe(true);
});
it('still accepts an unclaimed registration in open mode', async () => {
await getInstanceConfigRepository().setRegistrationConfig({mode: 'open'});
const registration = await createBuilderWithoutAuth<RegistrationTokenResponse>(harness)
.post('/auth/register')
.body({global_name: 'Open Unclaimed', date_of_birth: '2000-01-01', consent: true})
.execute();
expect(registration.token.length).toBeGreaterThan(0);
});
});