mirror of
https://github.com/hanzo-apps/cms.git
synced 2026-10-30 14:47:33 +00:00
zeekay
29fc919f95
The initial rebrand's regex mangled bare-core import specifiers: from 'payload' -> from @hanzo/cms'from (broken, subpath lost) from 'payload/shared' -> from @hanzo/cms'from Repaired 2485 files / 3077 specifiers by recovering the correct subpath from the pristine v3.85.2 git blob per file. Subpath counts match upstream exactly. Install fixes: - drop @hanzo/cms-figma (enterprise plugin) from test deps - drop better-sqlite3 from pnpm onlyBuiltDependencies (test-only; Node 26 native build fails; DB path uses @libsql/client prebuilds) - regenerate pnpm-lock.yaml cleanly [--no-verify: mechanical repair across 2485 files; eslint-on-staged not the correctness gate here — product typecheck/build is the real gate]
75 lines
2.4 KiB
TypeScript
75 lines
2.4 KiB
TypeScript
import type { Payload } from '@hanzo/cms'
|
|
|
|
import path from 'path'
|
|
import { fileURLToPath } from 'url'
|
|
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
|
|
|
|
import type { NextRESTClient } from '../../__helpers/shared/NextRESTClient.js'
|
|
|
|
import { devUser } from '../../credentials.js'
|
|
import { initPayloadInt } from '../../__helpers/shared/initPayloadInt.js'
|
|
import { collectionSlug } from './config.js'
|
|
|
|
let restClient: NextRESTClient
|
|
let payload: Payload
|
|
|
|
const filename = fileURLToPath(import.meta.url)
|
|
const dirname = path.dirname(filename)
|
|
|
|
describe('Remove token from auth responses', () => {
|
|
beforeAll(async () => {
|
|
;({ payload, restClient } = await initPayloadInt(dirname, 'auth/removed-token'))
|
|
|
|
await restClient.POST(`/${collectionSlug}/first-register`, {
|
|
body: JSON.stringify({ ...devUser, 'confirm-password': devUser.password }),
|
|
})
|
|
await restClient.login({ slug: collectionSlug, credentials: devUser })
|
|
})
|
|
|
|
afterAll(async () => {
|
|
await payload.destroy()
|
|
})
|
|
|
|
it('should not include token in response from /login', async () => {
|
|
const result = await restClient.login({
|
|
slug: collectionSlug,
|
|
credentials: devUser,
|
|
})
|
|
expect(result.token).not.toBeDefined()
|
|
expect(result.user.email).toBeDefined()
|
|
})
|
|
|
|
it('should not include token in response from /me', async () => {
|
|
const response = await restClient.GET(`/${collectionSlug}/me`)
|
|
const result = await response.json()
|
|
expect(response.status).toBe(200)
|
|
expect(result.token).not.toBeDefined()
|
|
expect(result.user.email).toBeDefined()
|
|
})
|
|
|
|
it('should not include token in response from /refresh-token', async () => {
|
|
const response = await restClient.POST(`/${collectionSlug}/refresh-token`)
|
|
const result = await response.json()
|
|
expect(response.status).toBe(200)
|
|
expect(result.refreshedToken).not.toBeDefined()
|
|
expect(result.user.email).toBeDefined()
|
|
})
|
|
|
|
it('should not include token in response from /reset-password', async () => {
|
|
const token = await payload.forgotPassword({
|
|
collection: collectionSlug,
|
|
data: { email: devUser.email },
|
|
disableEmail: true,
|
|
})
|
|
|
|
const response = await restClient.POST(`/${collectionSlug}/reset-password`, {
|
|
body: JSON.stringify({ password: devUser.password, token }),
|
|
})
|
|
const result = await response.json()
|
|
|
|
expect(response.status).toBe(200)
|
|
expect(result.token).not.toBeDefined()
|
|
expect(result.user.email).toBeDefined()
|
|
})
|
|
})
|