Function TestUserWithoutSessionUUID

auth/session_test.go:288–331

TestUserWithoutSessionUUID tests users that existed before we stamped SessionUUID into user docs

(t *testing.T)

// TestUserWithoutSessionUUID tests users that existed before we stamped SessionUUID into user docs
func TestUserWithoutSessionUUID(t *testing.T) {
	ctx := base.TestCtx(t)
	testBucket := base.GetTestBucket(t)
	defer testBucket.Close(ctx)
	dataStore := testBucket.GetSingleDataStore()
	auth := NewTestAuthenticator(t, dataStore, nil, DefaultAuthenticatorOptions(ctx))
	const username = "Alice"
	user, err := auth.NewUser(username, "password", base.Set{})
	require.NoError(t, err)
	require.NotNil(t, user)
	require.NoError(t, auth.Save(user))

	var rawUser map[string]interface{}
	_, err = auth.datastore.Get(user.DocID(), &rawUser)
	require.NoError(t, err)

	sessionUUIDKey := "session_uuid"
	_, exists := rawUser[sessionUUIDKey]
	require.True(t, exists)
	delete(rawUser, sessionUUIDKey)

	err = auth.datastore.Set(user.DocID(), 0, nil, rawUser)
	require.NoError(t, err)

	user, err = auth.GetUser(username)
	require.NoError(t, err)
	require.NotNil(t, user)

	oneTime := false
	session, err := auth.CreateSession(ctx, user, 2*time.Hour, oneTime)
	require.NoError(t, err)

	session, _, err = auth.GetSession(session.ID)
	require.NoError(t, err)

	request, err := http.NewRequest(http.MethodGet, "", nil)
	require.NoError(t, err)
	request.AddCookie(auth.MakeSessionCookie(session, true, true, http.SameSiteDefaultMode))

	recorder := httptest.NewRecorder()
	_, err = auth.AuthenticateCookie(request, recorder)
	require.NoError(t, err)

}

// TestUserDeleteAllSessions changes the session UUID on a user such that existing sessions should not be usable.
func TestUserDeleteAllSessions(t *testing.T) {