Password

import {
	currentUser,
	defineUser,
	isAuthenticated,
	isOwner,
	isSelf,
	signedIn,
} from '@ultimabase/auth'
import { graphql } from '@ultimabase/graphql'
import { password } from '@ultimabase/password'
import { allow, anyOf, defineModel } from 'ultimabase'

export const User = defineUser({
	name: 'User',
	use: [graphql(), password()],
	fields: (f) => ({
		name: f.string(),
		// Only the server makes an editor: no client writes this field.
		editor: f.boolean({ default: false }).with({ access: allow.readOnly }),
		posts: f.many(() => Post, { inverse: 'author' }),
	}),
}).with({
	// Signed-in users read each other's names; each user changes their own.
	access: { read: isAuthenticated, update: isSelf },
})

// Every rule, hook and function now reads `caller.user` as a `User`.
declare module 'ultimabase' {
	interface Register {
		readonly user: typeof User
	}
}

plugins: [
	// Listens on PORT, or 3000.
	httpPlugin(),
	graphqlPlugin(),
	// Sessions, and the caller of each request.
	authPlugin(),
	// A user signs up with an email, a password and a name, and receives
	// the reset and verification emails sendEmail sends.
	passwordPlugin({ signUp: ['name'], sendEmail }),
],

const response = await post(
	`mutation ($input: SignUpInput!) {
		signUp(input: $input) { token expiresAt user { name } }
	}`,
	{
		input: {
			email: '[email protected]',
			password: 'correct horse',
			name: 'Ada',
		},
	},
)
const { token } = signedUp.parse(await response.json()).data.signUp
const bearer = { authorization: `Bearer ${token}` }
expect(await viewer(bearer)).toEqual({ data: { viewer: { name: 'Ada' } } })
expect(await viewer({})).toEqual({ data: { viewer: null } })

const pages = {
	reset: 'reset-password',
	verify: 'verify-email',
	emailChange: 'confirm-email',
}

export async function sendEmail(email: Email): Promise<void> {
	if (email.kind === 'emailChanged') {
		// To the old address, which may not have asked for the change.
		const text = `Your email is now ${email.newEmail}. Not you? Contact us.`
		outbox.push({ ...email, text })
		return
	}
	if (email.kind === 'passwordChanged') {
		const text = 'Your password was changed. Not you? Reset it.'
		outbox.push({ ...email, text })
		return
	}
	// The link opens the application's page, which sends the token to
	// resetPassword, verifyEmail or confirmEmailChange.
	const link = `https://example.com/${pages[email.kind]}?token=${email.token}`
	// An application sends the text to `email.to` with its email provider.
	outbox.push({ ...email, text: `Open ${link}` })
}

// The same answer whether the email has an account.
expect(
	await request(
		`mutation ($input: RequestPasswordResetInput!) {
			requestPasswordReset(input: $input)
		}`,
		{ email: '[email protected]' },
	),
).toEqual({ data: { requestPasswordReset: true } })

// The page the link opens sends its token and the new password.
const token = await emailed('reset')
const reset = `mutation ($input: ResetPasswordInput!) { resetPassword(input: $input) }`
expect(await request(reset, { token, password: 'battery staple' })).toEqual({
	data: { resetPassword: true },
})
expect(await signIn('battery staple')).toEqual({
	data: { signIn: { user: { name: 'Ada' } } },
})
// A link works once.
expect(
	await request(reset, { token, password: 'another one' }),
).toMatchObject({
	errors: [
		{
			message: 'This link is invalid or has expired.',
			extensions: { code: 'INVALID_CREDENTIALS' },
		},
	],
})

// The signUp function sends the verification email.
const signedUp = await request(
	`mutation ($input: SignUpInput!) { signUp(input: $input) { token } }`,
	{ email: '[email protected]', password: 'correct horse', name: 'Ada' },
)
const session = z
	.object({ data: z.object({ signUp: z.object({ token: z.string() }) }) })
	.parse(signedUp).data.signUp.token
const bearer = { authorization: `Bearer ${session}` }
const verified = () =>
	request('{ viewer { emailVerified } }', undefined, bearer)
expect(await verified()).toEqual({
	data: { viewer: { emailVerified: false } },
})

const token = await emailed('verify')
await request(
	`mutation ($input: VerifyEmailInput!) { verifyEmail(input: $input) }`,
	{ token },
)
expect(await verified()).toEqual({
	data: { viewer: { emailVerified: true } },
})

const changed = await request(
	`mutation ($input: ChangePasswordInput!) {
		changePassword(input: $input) { token user { passwordSetAt } }
	}`,
	{ currentPassword: 'correct horse', newPassword: 'battery staple' },
	{ authorization: `Bearer ${token}` },
)
// A new session; every other one, this old token's too, has ended.
// passwordSetAt, which the user alone reads, is now.
expect(changed).toMatchObject({
	data: {
		changePassword: { token: aString, user: { passwordSetAt: aString } },
	},
})
expect(await signIn('correct horse')).toMatchObject({
	errors: [{ message: 'Wrong email or password.' }],
})
// The account is told.
await vi.waitFor(() => {
	expect(outbox.at(-1)).toMatchObject({
		kind: 'passwordChanged',
		to: '[email protected]',
	})
})

// The password again, so a stolen session cannot take the account.
await request(
	`mutation ($input: RequestEmailChangeInput!) {
		requestEmailChange(input: $input)
	}`,
	{ newEmail: '[email protected]', currentPassword: 'correct horse' },
	{ authorization: `Bearer ${session}` },
)
// The link goes to the new address; its page sends the token back.
const token = await emailed('emailChange')
expect(
	await request(
		`mutation ($input: ConfirmEmailChangeInput!) {
			confirmEmailChange(input: $input)
		}`,
		{ token },
	),
).toEqual({ data: { confirmEmailChange: true } })
expect(
	await User.signIn({ email: '[email protected]', password: 'correct horse' }),
).toMatchObject({ user: { email: '[email protected]', emailVerified: true } })
// The old address is told.
await vi.waitFor(() => {
	expect(outbox.at(-1)).toMatchObject({
		kind: 'emailChanged',
		to: '[email protected]',
	})
})

// As Master, without any email: the account follows the field.
const updated = await User.update(
	{ where: { id: ada.id }, data: { email: '[email protected]' } },
	{ as: master },
)
expect(updated).toMatchObject({
	email: '[email protected]',
	emailVerified: false,
})
await expect(
	User.signIn({ email: '[email protected]', password: 'correct horse' }),
).resolves.toMatchObject({ user: { name: 'Ada' } })

// In a function's run, as the caller, with the client it receives.
const as = { kind: 'user', user: ada } as const
await User.checkPassword({ id: ada.id, password: 'correct horse' }, { as })
await expect(
	User.checkPassword({ id: ada.id, password: 'wrong password' }, { as }),
).rejects.toMatchObject({
	code: 'INVALID_CREDENTIALS',
	message: 'Wrong password.',
})

for (let failed = 0; failed < 10; failed += 1) {
	expect(await signIn('wrong horse')).toMatchObject({
		errors: [{ extensions: { code: 'INVALID_CREDENTIALS' } }],
	})
}
// Refused before the password is checked, even the right one.
expect(await signIn('correct horse')).toMatchObject({
	errors: [
		{
			message: 'Too many attempts: try again later.',
			extensions: {
				code: 'TOO_MANY_ATTEMPTS',
				details: { retryAfter: aNumber },
			},
		},
	],
})