tests for login

src/controllers/authentication.js

@@ -282,14 +282,14 @@ authenticationController.doLogin = function (req, uid, callback) {
 	if (!uid) {
 		return callback();
 	}
-
+	async.waterfall([
-	req.login({ uid: uid }, function (err) {
+		function (next) {
-		if (err) {
+			req.login({ uid: uid }, next);
-			return callback(err);
+		},
-		}
+		function (next) {
-
+			authenticationController.onSuccessfulLogin(req, uid, next);
-		authenticationController.onSuccessfulLogin(req, uid, callback);
+		},
-	});
+	], callback);
 };
 
 authenticationController.onSuccessfulLogin = function (req, uid, callback) {
@@ -312,7 +312,8 @@ authenticationController.onSuccessfulLogin = function (req, uid, callback) {
 		version: req.useragent.version,
 	});
 
-	// Associate login session with user
+	async.waterfall([
+		function (next) {
 			async.parallel([
 				function (next) {
 					user.auth.addSession(uid, req.sessionID, next);
@@ -324,16 +325,17 @@ authenticationController.onSuccessfulLogin = function (req, uid, callback) {
 					user.updateLastOnlineTime(uid, next);
 				},
 			], function (err) {
-		if (err) {
+				next(err);
-			return callback(err);
+			});
-		}
+		},
-
+		function (next) {
 			// Force session check for all connected socket.io clients with the same session id
 			sockets.in('sess_' + req.sessionID).emit('checkSession', uid);
 
 			plugins.fireHook('action:user.loggedIn', { uid: uid, req: req });
-		callback();
+			next();
-	});
+		},
+	], callback);
 };
 
 authenticationController.localLogin = function (req, username, password, next) {

test/authentication.js

@@ -7,8 +7,37 @@ var request = require('request');
 
 var db = require('./mocks/databasemock');
 var user = require('../src/user');
+var meta = require('../src/meta');
 
 describe('authentication', function () {
+	function loginUser(username, password, callback) {
+		var jar = request.jar();
+		request({
+			url: nconf.get('url') + '/api/config',
+			json: true,
+			jar: jar,
+		}, function (err, response, body) {
+			if (err) {
+				return callback(err);
+			}
+
+			request.post(nconf.get('url') + '/login', {
+				form: {
+					username: username,
+					password: password,
+				},
+				json: true,
+				jar: jar,
+				headers: {
+					'x-csrf-token': body.csrf_token,
+				},
+			}, function (err, response, body) {
+				callback(err, response, body, jar);
+			});
+		});
+	}
+
+
 	var jar = request.jar();
 	var regularUid;
 	before(function (done) {
@@ -89,25 +118,7 @@ describe('authentication', function () {
 	});
 
 	it('should login a user', function (done) {
-		var jar = request.jar();
+		loginUser('regular', 'regularpwd', function (err, response, body, jar) {
-		request({
-			url: nconf.get('url') + '/api/config',
-			json: true,
-			jar: jar,
-		}, function (err, response, body) {
-			assert.ifError(err);
-
-			request.post(nconf.get('url') + '/login', {
-				form: {
-					username: 'regular',
-					password: 'regularpwd',
-				},
-				json: true,
-				jar: jar,
-				headers: {
-					'x-csrf-token': body.csrf_token,
-				},
-			}, function (err, response, body) {
 			assert.ifError(err);
 			assert(body);
 
@@ -129,7 +140,6 @@ describe('authentication', function () {
 			});
 		});
 	});
-	});
 
 	it('should revoke all sessions', function (done) {
 		var socketAdmin = require('../src/socket.io/admin');
@@ -148,33 +158,65 @@ describe('authentication', function () {
 	});
 
 	it('should fail to login if user does not exist', function (done) {
-		var jar = request.jar();
+		loginUser('doesnotexist', 'nopassword', function (err, response, body) {
-		request({
-			url: nconf.get('url') + '/api/config',
-			json: true,
-			jar: jar,
-		}, function (err, response, body) {
-			assert.ifError(err);
-
-			request.post(nconf.get('url') + '/login', {
-				form: {
-					username: 'doesnotexist',
-					password: 'nopassword',
-				},
-				json: true,
-				jar: jar,
-				headers: {
-					'x-csrf-token': body.csrf_token,
-				},
-			}, function (err, response, body) {
 			assert.ifError(err);
 			assert.equal(response.statusCode, 403);
 			assert.equal(body, '[[error:invalid-login-credentials]]');
 			done();
 		});
 	});
+
+	it('should fail to login if username is empty', function (done) {
+		loginUser('', 'some password', function (err, response, body) {
+			assert.ifError(err);
+			assert.equal(response.statusCode, 403);
+			assert.equal(body, '[[error:invalid-username-or-password]]');
+			done();
+		});
 	});
 
+	it('should fail to login if password is empty', function (done) {
+		loginUser('someuser', '', function (err, response, body) {
+			assert.ifError(err);
+			assert.equal(response.statusCode, 403);
+			assert.equal(body, '[[error:invalid-username-or-password]]');
+			done();
+		});
+	});
+
+	it('should fail to login if username and password are empty', function (done) {
+		loginUser('', '', function (err, response, body) {
+			assert.ifError(err);
+			assert.equal(response.statusCode, 403);
+			assert.equal(body, '[[error:invalid-username-or-password]]');
+			done();
+		});
+	});
+
+	it('should fail to login if password is longer than 4096', function (done) {
+		var longPassword;
+		for (var i = 0; i < 5000; i++) {
+			longPassword += 'a';
+		}
+		loginUser('someuser', longPassword, function (err, response, body) {
+			assert.ifError(err);
+			assert.equal(response.statusCode, 403);
+			assert.equal(body, '[[error:password-too-long]]');
+			done();
+		});
+	});
+
+
+	it('should fail to login if local login is disabled', function (done) {
+		meta.config.allowLocalLogin = 0;
+		loginUser('someuser', 'somepass', function (err, response, body) {
+			meta.config.allowLocalLogin = 1;
+			assert.ifError(err);
+			assert.equal(response.statusCode, 403);
+			assert.equal(body, '[[error:local-login-disabled]]');
+			done();
+		});
+	});
 
 	after(function (done) {
 		db.emptydb(done);