homeio

1import { describe, expect, it, vi } from "vitest";
2
3vi.mock("@/lib/server/modules/auth/repository", () => ({
4  hasAnyUsers: vi.fn(),
5}));
6
7vi.mock("@/lib/server/modules/auth/service", () => {
8  class AuthError extends Error {
9    constructor(
10      message: string,
11      public readonly statusCode: number,
12    ) {
13      super(message);
14    }
15  }
16
17  return {
18    AuthError,
19    registerUser: vi.fn(),
20  };
21});
22
23vi.mock("@/lib/server/modules/store/catalog", () => ({
24  bootstrapDefaultCasaosCatalog: vi.fn(),
25}));
26
27vi.mock("@/lib/server/storage/data-root", () => ({
28  ensureDataRootDirectories: vi.fn(),
29  resolveDataRootDirectory: vi.fn(() => "/DATA"),
30}));
31
32import { POST } from "@/app/api/auth/register/route";
33import { hasAnyUsers } from "@/lib/server/modules/auth/repository";
34import { registerUser } from "@/lib/server/modules/auth/service";
35import { bootstrapDefaultCasaosCatalog } from "@/lib/server/modules/store/catalog";
36import { ensureDataRootDirectories } from "@/lib/server/storage/data-root";
37
38describe("POST /api/auth/register", () => {
39  it("refuses a second account, whatever the environment says", async () => {
40    // The database is the only authority on this. There used to be an
41    // AUTH_ALLOW_REGISTRATION env var alongside it, which install.sh set to
42    // `true` and never unset — so a script-installed server kept handing out
43    // full accounts to anyone who could reach the endpoint.
44    vi.mocked(hasAnyUsers).mockResolvedValueOnce(true);
45
46    const request = new Request("http://localhost/api/auth/register", {
47      method: "POST",
48      body: JSON.stringify({
49        username: "admin",
50        password: "StrongPass123",
51        confirmPassword: "StrongPass123",
52      }),
53    });
54
55    const response = await POST(request);
56    const json = (await response.json()) as { error: string };
57
58    expect(response.status).toBe(403);
59    expect(json.error).toContain("already has an account");
60    expect(registerUser).not.toHaveBeenCalled();
61    expect(ensureDataRootDirectories).not.toHaveBeenCalled();
62    expect(bootstrapDefaultCasaosCatalog).not.toHaveBeenCalled();
63  });
64
65  it("allows first registration when no users exist and bootstraps the catalog", async () => {
66    vi.mocked(hasAnyUsers).mockResolvedValueOnce(false);
67    vi.mocked(bootstrapDefaultCasaosCatalog).mockResolvedValueOnce({
68      path: "/DATA/AppStore/CasaOS-AppStore",
69      indexedApps: 10,
70    });
71    vi.mocked(registerUser).mockResolvedValueOnce({
72      id: "11111111-1111-1111-1111-111111111111",
73      username: "admin",
74    });
75
76    const request = new Request("http://localhost/api/auth/register", {
77      method: "POST",
78      body: JSON.stringify({
79        username: "admin",
80        password: "StrongPass123",
81        confirmPassword: "StrongPass123",
82      }),
83    });
84
85    const response = await POST(request);
86    const json = (await response.json()) as {
87      data: { username: string };
88    };
89
90    expect(response.status).toBe(201);
91    expect(json.data.username).toBe("admin");
92    expect(ensureDataRootDirectories).toHaveBeenCalledTimes(1);
93    expect(bootstrapDefaultCasaosCatalog).toHaveBeenCalledTimes(1);
94  });
95});
96