From fc625806963c52ba9dbe3d71db2dbd682e715827 Mon Sep 17 00:00:00 2001
From: zkldi <notzkldi@zkldi.com>
Date: Sun, 18 Apr 2021 03:08:05 +0100
Subject: [PATCH] This is the one.

---
 server/dump.rdb                               | Bin 0 -> 92 bytes
 server/src/internal-api/import/import.test.ts |   8 +++--
 server/src/middleware/require-logged-in.ts    |   7 +++++
 server/src/scripts/initialise-counters.ts     |   2 +-
 .../single-use/create-fake-password.ts        |   4 +++
 server/src/test-utils/fake-session.ts         |  28 ++++++++++++++++++
 server/src/test-utils/mock-db/users.json      |   6 ++--
 7 files changed, 49 insertions(+), 6 deletions(-)
 create mode 100644 server/dump.rdb
 create mode 100644 server/src/scripts/single-use/create-fake-password.ts
 create mode 100644 server/src/test-utils/fake-session.ts

diff --git a/server/dump.rdb b/server/dump.rdb
new file mode 100644
index 0000000000000000000000000000000000000000..b4c835ad901f72a62a08276d049464a5660c0ad6
GIT binary patch
literal 92
zcmWG?b@2=~Ffg$A#aWb^l3A=<mRiJWqGzCI`HKr8kd#?ce8AxsYjR0uZt9`z%Ibt)
s9HqsnDZ06-xrZV?a5MbkNz6~vEhtJ&%uUKkJ;3n4bCt!1-@HP%06I}6Q2+n{

literal 0
HcmV?d00001

diff --git a/server/src/internal-api/import/import.test.ts b/server/src/internal-api/import/import.test.ts
index 7d4570b41..b0fe37023 100644
--- a/server/src/internal-api/import/import.test.ts
+++ b/server/src/internal-api/import/import.test.ts
@@ -3,10 +3,14 @@ import mockApi from "../../test-utils/mock-api";
 import { TestingIIDXEamusementCSV26 } from "../../test-utils/test-data";
 import { CloseAllConnections } from "../../test-utils/close-connections";
 import { RequireNeutralAuthentication } from "../../test-utils/api-common";
+import { CreateFakeAuthCookie } from "../../test-utils/fake-session";
+import ResetDBState from "../../test-utils/reset-db-state";
 
-t.test("POST /internal-api/import/file", (t) => {
+t.test("POST /internal-api/import/file", async (t) => {
+    t.beforeEach(ResetDBState);
+    const cookie = await CreateFakeAuthCookie();
     function PostImportFile() {
-        return mockApi.post("/internal-api/import/file");
+        return mockApi.post("/internal-api/import/file").set("Cookie", cookie);
     }
 
     RequireNeutralAuthentication(t, "/internal-api/import/file", "POST");
diff --git a/server/src/middleware/require-logged-in.ts b/server/src/middleware/require-logged-in.ts
index c3ea4fb0f..7bd1e5cf8 100644
--- a/server/src/middleware/require-logged-in.ts
+++ b/server/src/middleware/require-logged-in.ts
@@ -1,7 +1,14 @@
 import { NextFunction, Request, Response } from "express";
+import CreateLogCtx from "../logger";
+
+const logger = CreateLogCtx("require-logged-in.ts");
 
 export function RequireLoggedIn(req: Request, res: Response, next: NextFunction) {
     if (!req.session.ktchi?.userID) {
+        logger.info(`Received unauthorised request from ${req.ip} from ${req.originalUrl}`, {
+            auth: req.session,
+        });
+
         return res.status(401).json({
             success: false,
             description: `You are not authorised to perform this action.`,
diff --git a/server/src/scripts/initialise-counters.ts b/server/src/scripts/initialise-counters.ts
index 5b8b35848..f11c5915f 100644
--- a/server/src/scripts/initialise-counters.ts
+++ b/server/src/scripts/initialise-counters.ts
@@ -14,7 +14,7 @@ const logger = CreateLogCtx("scripts/initialise-counters.ts");
 
     await db.counters.insert({
         counterName: "users",
-        value: 0,
+        value: 1,
     });
 
     logger.info("Successfully initialised counter documents. Exiting.");
diff --git a/server/src/scripts/single-use/create-fake-password.ts b/server/src/scripts/single-use/create-fake-password.ts
new file mode 100644
index 000000000..8c94bd0af
--- /dev/null
+++ b/server/src/scripts/single-use/create-fake-password.ts
@@ -0,0 +1,4 @@
+/* eslint-disable no-console */
+import bcrypt from "bcrypt";
+
+console.log(bcrypt.hashSync("password", 12));
diff --git a/server/src/test-utils/fake-session.ts b/server/src/test-utils/fake-session.ts
new file mode 100644
index 000000000..d4c586d76
--- /dev/null
+++ b/server/src/test-utils/fake-session.ts
@@ -0,0 +1,28 @@
+import mockApi from "./mock-api";
+import assert from "assert";
+import db from "../db/db";
+import ResetDBState from "./reset-db-state";
+import CreateLogCtx from "../logger";
+
+const logger = CreateLogCtx("fake-session.ts");
+
+export async function CreateFakeAuthCookie() {
+    await ResetDBState();
+    // possible security issue, ask hazel
+    let res = await mockApi.post("/internal-api/auth/login").send({
+        username: "test_zkldi",
+        password: "password",
+        captcha: "asdf",
+    });
+
+    if (res.status !== 200) {
+        logger.crit("Failed to login. Cannot generate auth cookie.");
+        throw res.body;
+    }
+
+    return res.headers["set-cookie"] as string[];
+}
+
+export async function DestroyFakeAuthToken(cookie: string) {
+    // stub
+}
diff --git a/server/src/test-utils/mock-db/users.json b/server/src/test-utils/mock-db/users.json
index 1f1ccfa95..1a4dc230f 100644
--- a/server/src/test-utils/mock-db/users.json
+++ b/server/src/test-utils/mock-db/users.json
@@ -1,8 +1,8 @@
 [
     {
-        "username": "zkldi",
-        "usernameLowercase": "zkldi",
-        "password": "$2y$12$u2FK6QJAv/WDF/ExGUWI9OoIks8Q0ExT1qjPMBu6zCZ5z72swQ01K",
+        "username": "test_zkldi",
+        "usernameLowercase": "test_zkldi",
+        "password": "$2b$12$QRFCAxvFoNI2spszFPgt/e.qLy55GvYWlSHioa0AujRbFpChLwHmu",
         "email": "thepasswordis@password.com",
         "id": 1,
         "settings": {