Password

import {
	currentUser,
	defineUser,
	isAuthenticated,
	isOwner,
	isSelf,
	signedIn,
} from '@ultimabase/auth'
import { graphql } from '@ultimabase/graphql'
import { password } from '@ultimabase/password'
import { allow, anyOf, defineModel } from 'ultimabase'

export const User = defineUser({
	name: 'User',
	use: [graphql(), password()],
	fields: (f) => ({
		name: f.string(),
		// Only the server makes an editor: no client writes this field.
		editor: f.boolean({ default: false }).with({ access: allow.readOnly }),
		posts: f.many(() => Post, { inverse: 'author' }),
	}),
}).with({
	// Signed-in users read each other's names; each user changes their own.
	access: { read: isAuthenticated, update: isSelf },
})

// Every rule, hook and function now reads `caller.user` as a `User`.
declare module 'ultimabase' {
	interface Register {
		readonly user: typeof User
	}
}

plugins: [
	// Listens on PORT, or 3000.
	httpPlugin(),
	graphqlPlugin(),
	// Sessions, and the caller of each request.
	authPlugin(),
	// A user signs up with an email, a password and a name, and receives
	// the reset and verification emails sendEmail sends.
	passwordPlugin({ signUp: ['name'], sendEmail }),
],

const response = await post(
	`mutation ($input: SignUpInput!) {
		signUp(input: $input) { token expiresAt user { name } }
	}`,
	{
		input: {
			email: 'ada@example.com',
			password: 'correct horse',
			name: 'Ada',
		},
	},
)
const { token } = signedUp.parse(await response.json()).data.signUp
const bearer = { authorization: `Bearer ${token}` }
expect(await viewer(bearer)).toEqual({ data: { viewer: { name: 'Ada' } } })
expect(await viewer({})).toEqual({ data: { viewer: null } })

export async function sendEmail(email: Email): Promise<void> {
	// The link opens the application's page, which sends the token to
	// resetPassword or verifyEmail.
	const page = email.kind === 'reset' ? 'reset-password' : 'verify-email'
	const link = `https://example.com/${page}?token=${email.token}`
	// An application sends `link` to `email.to` with its email provider.
	outbox.push({ ...email, link })
}

// The same answer whether the email has an account.
expect(
	await request(
		`mutation ($input: RequestPasswordResetInput!) {
			requestPasswordReset(input: $input)
		}`,
		{ email: 'ada@example.com' },
	),
).toEqual({ data: { requestPasswordReset: true } })

// The page the link opens sends its token and the new password.
const token = await emailed('reset')
const reset = `mutation ($input: ResetPasswordInput!) { resetPassword(input: $input) }`
expect(await request(reset, { token, password: 'battery staple' })).toEqual({
	data: { resetPassword: true },
})
expect(await signIn('battery staple')).toEqual({
	data: { signIn: { user: { name: 'Ada' } } },
})
// A link works once.
expect(
	await request(reset, { token, password: 'another one' }),
).toMatchObject({
	errors: [
		{
			message: 'This link is invalid or has expired.',
			extensions: { code: 'INVALID_CREDENTIALS' },
		},
	],
})

// The signUp function sends the verification email.
const signedUp = await request(
	`mutation ($input: SignUpInput!) { signUp(input: $input) { token } }`,
	{ email: 'ada@example.com', password: 'correct horse', name: 'Ada' },
)
const session = z
	.object({ data: z.object({ signUp: z.object({ token: z.string() }) }) })
	.parse(signedUp).data.signUp.token
const bearer = { authorization: `Bearer ${session}` }
const verified = () =>
	request('{ viewer { emailVerified } }', undefined, bearer)
expect(await verified()).toEqual({
	data: { viewer: { emailVerified: false } },
})

const token = await emailed('verify')
await request(
	`mutation ($input: VerifyEmailInput!) { verifyEmail(input: $input) }`,
	{ token },
)
expect(await verified()).toEqual({
	data: { viewer: { emailVerified: true } },
})

const changed = await request(
	`mutation ($input: ChangePasswordInput!) {
		changePassword(input: $input) { token }
	}`,
	{ currentPassword: 'correct horse', newPassword: 'battery staple' },
	{ authorization: `Bearer ${token}` },
)
// A new session; every other one, this old token's too, has ended.
expect(changed).toMatchObject({
	data: { changePassword: { token: aString } },
})
expect(await signIn('correct horse')).toMatchObject({
	errors: [{ message: 'Wrong email or password.' }],
})

for (let failed = 0; failed < 10; failed += 1) {
	expect(await signIn('wrong horse')).toMatchObject({
		errors: [{ extensions: { code: 'INVALID_CREDENTIALS' } }],
	})
}
// Refused before the password is checked, even the right one.
expect(await signIn('correct horse')).toMatchObject({
	errors: [
		{
			message: 'Too many attempts: try again later.',
			extensions: {
				code: 'TOO_MANY_ATTEMPTS',
				details: { retryAfter: aNumber },
			},
		},
	],
})