test(phase5a): permanent regression suite + dress rehearsal drill
- platform/test/e2e-phase5a.js (21 checks): the two-student RBAC matrix (student can't reach any /api/admin/* route, assigned/unassigned/viewer instructor access) and the full password security checklist (correct/wrong/unknown-identifier/deactivated/immediate-deactivation/ rate-limit/rate-limit-survives-a-real-restart/change-password/session-revocation/ forgot-password anti-enumeration/admin-issued reset/CSRF), plus a classroom lifecycle smoke pass. Replaces the throwaway smoke5a/smoke5b scripts used during development. - infra/scripts/drills/test-phase5a-rehearsal.js (15 checks): 5 pilot students with real seeded pre-existing progress/attempt/achievement history, a live classroom, help requests, announcements, a REAL Platform API restart mid-rehearsal proving classroom/session/presence recovery, then converting two students mid-rehearsal and confirming zero data was orphaned. - Both run against a live docker-compose.dev.yml stack over real HTTP, not mocks.
This commit is contained in:
@@ -0,0 +1,268 @@
|
||||
#!/usr/bin/env node
|
||||
// Phase 5A — student identity & remote classroom. Permanent regression test replacing the
|
||||
// throwaway smoke5a/smoke5b scripts used during development. Covers §31 (two-student + RBAC
|
||||
// matrix) and §32 (password security), plus a real classroom lifecycle smoke pass. Same
|
||||
// conventions as e2e-phase3a.js: assert-based, no framework, runs against a live
|
||||
// docker-compose.dev.yml stack, shells out for the restart-persistence test.
|
||||
//
|
||||
// Usage: cd platform && docker compose -f docker-compose.dev.yml up -d
|
||||
// (cd api && PLATFORM_DB_URL=... node bootstrap-owner.js OWNER_EMAIL "Owner" OWNER_PASSWORD)
|
||||
// OWNER_EMAIL=... OWNER_PASSWORD=... node test/e2e-phase5a.js
|
||||
|
||||
const assert = require('assert');
|
||||
const { execSync } = require('child_process');
|
||||
const { makeSession } = require('./session-helper');
|
||||
|
||||
const GW = process.env.GATEWAY_URL || 'http://localhost:4200';
|
||||
const OWNER_EMAIL = process.env.OWNER_EMAIL;
|
||||
const OWNER_PASSWORD = process.env.OWNER_PASSWORD;
|
||||
const SKIP_RESTART_TEST = process.env.SKIP_RESTART_TEST === '1';
|
||||
if (!OWNER_EMAIL || !OWNER_PASSWORD) {
|
||||
console.error('Set OWNER_EMAIL and OWNER_PASSWORD (bootstrap one first with platform/api/bootstrap-owner.js)');
|
||||
process.exit(1);
|
||||
}
|
||||
const RUN_ID = Date.now();
|
||||
|
||||
let passed = 0, failed = 0;
|
||||
async function test(name, fn) {
|
||||
try { await fn(); console.log(` ok — ${name}`); passed++; }
|
||||
catch (e) { console.error(` FAIL — ${name}\n ${e.message}`); failed++; }
|
||||
}
|
||||
|
||||
async function main() {
|
||||
console.log('Phase 5A student identity / remote classroom acceptance test\n');
|
||||
|
||||
const owner = makeSession(GW);
|
||||
await owner.request('POST', '/api/auth/instructor/login', { email: OWNER_EMAIL, password: OWNER_PASSWORD });
|
||||
assert.ok(owner.hasCookie('rn_instructor'), 'owner login must succeed before anything else can run');
|
||||
|
||||
// ── Fixtures: two cohorts, an assigned instructor, an unassigned instructor, a viewer,
|
||||
// two students (Alice/Bob) in cohort A. ────────────────────────────────────────────────
|
||||
const cohortA = `p5a-cohort-a-${RUN_ID}`;
|
||||
const cohortB = `p5a-cohort-b-${RUN_ID}`;
|
||||
await owner.request('POST', '/api/admin/cohorts', { cohort_id: cohortA, name: 'P5A Cohort A' });
|
||||
await owner.request('POST', '/api/admin/cohorts', { cohort_id: cohortB, name: 'P5A Cohort B' });
|
||||
|
||||
const { body: assignedInstr } = await owner.request('POST', '/api/admin/instructors', {
|
||||
email: `p5a-assigned-${RUN_ID}@rootnode.test`, display_name: 'Assigned Instructor', role: 'instructor', password: 'AssignedPass123!',
|
||||
});
|
||||
const { body: unassignedInstr } = await owner.request('POST', '/api/admin/instructors', {
|
||||
email: `p5a-unassigned-${RUN_ID}@rootnode.test`, display_name: 'Unassigned Instructor', role: 'instructor', password: 'UnassignedPass123!',
|
||||
});
|
||||
await owner.request('POST', `/api/admin/cohorts/${cohortA}/instructors`, { instructor_id: assignedInstr.instructor_id, role_in_cohort: 'teacher' });
|
||||
const { body: viewerInstr } = await owner.request('POST', '/api/admin/instructors', {
|
||||
email: `p5a-viewer-${RUN_ID}@rootnode.test`, display_name: 'Viewer Instructor', role: 'instructor', password: 'ViewerPass123!',
|
||||
});
|
||||
await owner.request('POST', `/api/admin/cohorts/${cohortA}/instructors`, { instructor_id: viewerInstr.instructor_id, role_in_cohort: 'viewer' });
|
||||
|
||||
const { body: aliceCreate } = await owner.request('POST', '/api/admin/students', {
|
||||
display_name: 'Alice', cohort_id: cohortA, login_identifier: `p5a-alice-${RUN_ID}`,
|
||||
});
|
||||
const { body: bobCreate } = await owner.request('POST', '/api/admin/students', {
|
||||
display_name: 'Bob', cohort_id: cohortA, login_identifier: `p5a-bob-${RUN_ID}`,
|
||||
});
|
||||
const alicePassword = 'AlicePassword123!';
|
||||
const bobPassword = 'BobPassword123!';
|
||||
const alice = makeSession(GW);
|
||||
const bob = makeSession(GW);
|
||||
await test('activation: token sets password and logs the student in', async () => {
|
||||
const { status, body } = await alice.request('POST', '/api/student/activate', { token: aliceCreate.activation_token, password: alicePassword });
|
||||
assert.equal(status, 200);
|
||||
assert.equal(body.student.display_name, 'Alice');
|
||||
assert.ok(alice.hasCookie('rn_session'));
|
||||
});
|
||||
await test('activation: the same token cannot be used twice (single-use)', async () => {
|
||||
const { status } = await makeSession(GW).request('POST', '/api/student/activate', { token: aliceCreate.activation_token, password: 'SomeOtherPass123!' });
|
||||
assert.equal(status, 400);
|
||||
});
|
||||
await bob.request('POST', '/api/student/activate', { token: bobCreate.activation_token, password: bobPassword });
|
||||
|
||||
const { body: classroomCreate } = await owner.request('POST', `/api/admin/cohorts/${cohortA}/classroom-sessions`, { title: 'P5A Live Class' });
|
||||
const classroomId = classroomCreate.classroom_session_id;
|
||||
|
||||
// ── §32 Password security ───────────────────────────────────────────────────────────────
|
||||
console.log('\nPassword security (§32)');
|
||||
|
||||
await test('correct identifier + password logs in', async () => {
|
||||
const s = makeSession(GW);
|
||||
const { status } = await s.request('POST', '/api/student/login', { identifier: `p5a-alice-${RUN_ID}`, password: alicePassword });
|
||||
assert.equal(status, 200);
|
||||
});
|
||||
|
||||
await test('wrong password is rejected generically', async () => {
|
||||
const s = makeSession(GW);
|
||||
const { status, body } = await s.request('POST', '/api/student/login', { identifier: `p5a-alice-${RUN_ID}`, password: 'wrong-password-entirely' });
|
||||
assert.equal(status, 401);
|
||||
assert.equal(body.error, 'invalid_credentials');
|
||||
});
|
||||
|
||||
await test('unknown identifier fails with the SAME response as a wrong password (no enumeration)', async () => {
|
||||
const s1 = makeSession(GW), s2 = makeSession(GW);
|
||||
const unknown = await s1.request('POST', '/api/student/login', { identifier: `nobody-${RUN_ID}`, password: 'whatever12345' });
|
||||
const wrongPw = await s2.request('POST', '/api/student/login', { identifier: `p5a-alice-${RUN_ID}`, password: 'wrong-password-entirely' });
|
||||
assert.equal(unknown.status, wrongPw.status);
|
||||
assert.deepEqual(unknown.body, wrongPw.body);
|
||||
});
|
||||
|
||||
await test('deactivated account is blocked at login', async () => {
|
||||
await owner.request('PATCH', `/api/admin/students/${bobCreate.student_id}`, { status: 'inactive' });
|
||||
const s = makeSession(GW);
|
||||
const { status } = await s.request('POST', '/api/student/login', { identifier: `p5a-bob-${RUN_ID}`, password: bobPassword });
|
||||
assert.equal(status, 403);
|
||||
await owner.request('PATCH', `/api/admin/students/${bobCreate.student_id}`, { status: 'active' }); // restore for later tests
|
||||
});
|
||||
|
||||
await test('deactivation takes effect immediately on an EXISTING session, not just at next login', async () => {
|
||||
const s = makeSession(GW);
|
||||
await s.request('POST', '/api/student/login', { identifier: `p5a-bob-${RUN_ID}`, password: bobPassword });
|
||||
const before = await s.request('GET', '/api/student/profile');
|
||||
assert.equal(before.status, 200);
|
||||
await owner.request('PATCH', `/api/admin/students/${bobCreate.student_id}`, { status: 'inactive' });
|
||||
const after = await s.request('GET', '/api/student/profile');
|
||||
assert.notEqual(after.status, 200); // studentSession middleware re-checks status='active' every request
|
||||
await owner.request('PATCH', `/api/admin/students/${bobCreate.student_id}`, { status: 'active' });
|
||||
});
|
||||
|
||||
await test('rate limiting: repeated failures against the same identifier eventually 429s', async () => {
|
||||
const key = `p5a-ratelimit-${RUN_ID}`;
|
||||
let sawTooMany = false;
|
||||
for (let i = 0; i < 12 && !sawTooMany; i++) {
|
||||
const s = makeSession(GW);
|
||||
const { status } = await s.request('POST', '/api/student/login', { identifier: key, password: 'wrong-password' });
|
||||
if (status === 429) sawTooMany = true;
|
||||
}
|
||||
assert.ok(sawTooMany, 'expected a 429 within 12 attempts (LOGIN_MAX_ATTEMPTS=8)');
|
||||
});
|
||||
|
||||
if (!SKIP_RESTART_TEST) {
|
||||
await test('rate limit state survives a Platform API restart (Postgres-backed, not in-memory)', async () => {
|
||||
const key = `p5a-ratelimit-restart-${RUN_ID}`;
|
||||
for (let i = 0; i < 9; i++) {
|
||||
await makeSession(GW).request('POST', '/api/student/login', { identifier: key, password: 'wrong-password' });
|
||||
}
|
||||
execSync('docker compose -f docker-compose.dev.yml restart api', { cwd: `${__dirname}/..`, stdio: 'pipe' });
|
||||
await new Promise((r) => setTimeout(r, 4000));
|
||||
const { status } = await makeSession(GW).request('POST', '/api/student/login', { identifier: key, password: 'wrong-password' });
|
||||
assert.equal(status, 429, 'the attempt count must have survived the restart');
|
||||
});
|
||||
} else {
|
||||
console.log(' skip — restart persistence (SKIP_RESTART_TEST=1)');
|
||||
}
|
||||
|
||||
await test('change-password: wrong current password is rejected', async () => {
|
||||
const { status } = await alice.request('POST', '/api/student/change-password', { old_password: 'not-the-real-password', new_password: 'NewAlicePass123!' });
|
||||
assert.equal(status, 401);
|
||||
});
|
||||
|
||||
await test('change-password: correct current password succeeds and revokes OTHER sessions', async () => {
|
||||
const otherSession = makeSession(GW);
|
||||
await otherSession.request('POST', '/api/student/login', { identifier: `p5a-alice-${RUN_ID}`, password: alicePassword });
|
||||
const { status } = await alice.request('POST', '/api/student/change-password', { old_password: alicePassword, new_password: 'NewAlicePass123!' });
|
||||
assert.equal(status, 200);
|
||||
const { status: otherStatus } = await otherSession.request('GET', '/api/student/profile');
|
||||
assert.notEqual(otherStatus, 200); // the OTHER session (not the one that made the change) is revoked
|
||||
const { status: selfStatus } = await alice.request('GET', '/api/student/profile');
|
||||
assert.equal(selfStatus, 200); // the session that made the change is untouched
|
||||
});
|
||||
|
||||
await test('forgot-password: identical generic response for a real vs unknown identifier (anti-enumeration)', async () => {
|
||||
const real = await makeSession(GW).request('POST', '/api/student/request-password-reset', { identifier: `p5a-alice-${RUN_ID}` });
|
||||
const fake = await makeSession(GW).request('POST', '/api/student/request-password-reset', { identifier: `nobody-${RUN_ID}` });
|
||||
assert.equal(real.body.message, fake.body.message);
|
||||
});
|
||||
|
||||
await test('admin-issued reset token: sets a new password and revokes ALL sessions', async () => {
|
||||
const { body } = await owner.request('POST', `/api/admin/students/${aliceCreate.student_id}/reset-password`);
|
||||
assert.ok(body.reset_token);
|
||||
const preCheck = await alice.request('GET', '/api/student/profile');
|
||||
assert.notEqual(preCheck.status, 200); // reset-password revokes existing sessions immediately
|
||||
const fresh = makeSession(GW);
|
||||
const { status } = await fresh.request('POST', '/api/student/reset-password', { token: body.reset_token, password: 'ResetAlicePass123!' });
|
||||
assert.equal(status, 200);
|
||||
const login = await makeSession(GW).request('POST', '/api/student/login', { identifier: `p5a-alice-${RUN_ID}`, password: 'ResetAlicePass123!' });
|
||||
assert.equal(login.status, 200);
|
||||
});
|
||||
|
||||
await test('CSRF: a mutating request without the header is rejected even with a valid session cookie', async () => {
|
||||
const s = makeSession(GW);
|
||||
await s.request('POST', '/api/student/login', { identifier: `p5a-bob-${RUN_ID}`, password: bobPassword });
|
||||
const res = await fetch(`${GW}/api/student/change-password`, {
|
||||
method: 'POST', headers: { 'Content-Type': 'application/json', Cookie: `rn_session=${s.getCookie('rn_session')}` },
|
||||
body: JSON.stringify({ old_password: bobPassword, new_password: 'ShouldNotWork123!' }),
|
||||
});
|
||||
assert.notEqual(res.status, 200);
|
||||
});
|
||||
|
||||
// ── §31 Two-student + RBAC matrix ───────────────────────────────────────────────────────
|
||||
console.log('\nTwo-student and RBAC matrix (§31)');
|
||||
|
||||
const bobSession = makeSession(GW);
|
||||
await bobSession.request('POST', '/api/student/login', { identifier: `p5a-bob-${RUN_ID}`, password: bobPassword });
|
||||
|
||||
await test('a student session cannot reach ANY /api/admin/* route', async () => {
|
||||
const { status } = await bobSession.request('GET', '/api/admin/students');
|
||||
assert.ok([401, 403].includes(status));
|
||||
});
|
||||
|
||||
await test('a student profile request only ever returns that student\'s own identity', async () => {
|
||||
const { body } = await bobSession.request('GET', '/api/student/profile');
|
||||
assert.equal(body.student.display_name, 'Bob');
|
||||
});
|
||||
|
||||
await test('assigned instructor CAN view and manage cohort A (students, classroom)', async () => {
|
||||
const assigned = makeSession(GW);
|
||||
await assigned.request('POST', '/api/auth/instructor/login', { email: `p5a-assigned-${RUN_ID}@rootnode.test`, password: 'AssignedPass123!' });
|
||||
const view = await assigned.request('GET', `/api/admin/cohorts/${cohortA}/students`);
|
||||
assert.equal(view.status, 200);
|
||||
const write = await assigned.request('POST', `/api/admin/cohorts/${cohortA}/classroom-sessions`, { title: 'Assigned-created class' });
|
||||
assert.equal(write.status, 201);
|
||||
});
|
||||
|
||||
await test('instructor NOT assigned to cohort A is DENIED (403) on its resources', async () => {
|
||||
const unassigned = makeSession(GW);
|
||||
await unassigned.request('POST', '/api/auth/instructor/login', { email: `p5a-unassigned-${RUN_ID}@rootnode.test`, password: 'UnassignedPass123!' });
|
||||
const view = await unassigned.request('GET', `/api/admin/cohorts/${cohortA}/students`);
|
||||
assert.equal(view.status, 403);
|
||||
const dashboard = await unassigned.request('GET', `/api/admin/classroom-sessions/${classroomId}`);
|
||||
assert.equal(dashboard.status, 403);
|
||||
});
|
||||
|
||||
await test('viewer role_in_cohort CAN view but is DENIED mutation on cohort A', async () => {
|
||||
const viewer = makeSession(GW);
|
||||
await viewer.request('POST', '/api/auth/instructor/login', { email: `p5a-viewer-${RUN_ID}@rootnode.test`, password: 'ViewerPass123!' });
|
||||
const view = await viewer.request('GET', `/api/admin/classroom-sessions/${classroomId}`);
|
||||
assert.equal(view.status, 200);
|
||||
const write = await viewer.request('POST', `/api/admin/classroom-sessions/${classroomId}/announcements`, { message: 'should be denied' });
|
||||
assert.equal(write.status, 403);
|
||||
});
|
||||
|
||||
// ── Classroom lifecycle smoke pass ──────────────────────────────────────────────────────
|
||||
console.log('\nClassroom lifecycle');
|
||||
|
||||
await test('classroom: start -> join -> heartbeat -> dashboard reflects presence -> end', async () => {
|
||||
const { status: startStatus } = await owner.request('POST', `/api/admin/classroom-sessions/${classroomId}/start`);
|
||||
assert.equal(startStatus, 200);
|
||||
await bobSession.request('POST', `/api/classroom/${classroomId}/join`);
|
||||
await bobSession.request('POST', `/api/classroom/${classroomId}/heartbeat`);
|
||||
const { body: dash } = await owner.request('GET', `/api/admin/classroom-sessions/${classroomId}`);
|
||||
const bobRow = dash.students.find((s) => s.student_id === bobCreate.student_id);
|
||||
assert.ok(bobRow, 'Bob must appear as a participant after joining');
|
||||
assert.equal(bobRow.presence, 'online');
|
||||
const { status: endStatus } = await owner.request('POST', `/api/admin/classroom-sessions/${classroomId}/end`);
|
||||
assert.equal(endStatus, 200);
|
||||
});
|
||||
|
||||
await test('classroom: only one LIVE classroom per cohort at a time', async () => {
|
||||
const c2 = await owner.request('POST', `/api/admin/cohorts/${cohortA}/classroom-sessions`, { title: 'Second class' });
|
||||
await owner.request('POST', `/api/admin/classroom-sessions/${c2.body.classroom_session_id}/start`);
|
||||
const c3 = await owner.request('POST', `/api/admin/cohorts/${cohortA}/classroom-sessions`, { title: 'Third class' });
|
||||
const { status } = await owner.request('POST', `/api/admin/classroom-sessions/${c3.body.classroom_session_id}/start`);
|
||||
assert.equal(status, 409);
|
||||
await owner.request('POST', `/api/admin/classroom-sessions/${c2.body.classroom_session_id}/end`);
|
||||
});
|
||||
|
||||
console.log(`\n${passed} passed, ${failed} failed`);
|
||||
if (failed > 0) process.exit(1);
|
||||
}
|
||||
|
||||
main().catch((e) => { console.error(e); process.exit(1); });
|
||||
Reference in New Issue
Block a user