Add DB viewer access logging, account deletion, and forced password change

Logs a distinct db_viewer_accessed event (not just the earlier session_created "requested" event) when an admin's browser actually completes the hand-off into Adminer. Adds a password-confirmed account-deletion box to Settings, relying on the existing ON DELETE CASCADE foreign keys to clean up everything the account owns. Adds an admin-only "require password change" flag that get_current_user enforces server-side (403 on everything except /auth/me, /auth/change-password, /auth/logout) - meant for handing a demo account to someone with a known sample password. Co-Authored-By: Claude Sonnet 5 <[email protected]>
2026-08-05 23:41:21 -04:00
parent 3d6fe56991
commit 4ee38b6241
23 changed files with 1056 additions and 7 deletions
@@ -0,0 +1,86 @@
+import { screen, waitFor } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import DashboardLayout from "@/app/(app)/layout";
+import { renderWithQueryClient } from "./test-utils";
+
+const replaceMock = vi.fn();
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn(), replace: replaceMock }),
+  usePathname: () => "/dashboard",
+}));
+
+function meBody(mustChangePassword: boolean) {
+  return {
+    id: "user-1",
+    email: "[email protected]",
+    display_name: "Regular User",
+    timezone: "America/New_York",
+    is_active: true,
+    is_admin: false,
+    auth_mode: "jwt",
+    must_change_password: mustChangePassword,
+  };
+}
+
+function systemStatusBody() {
+  return {
+    app_env: "development",
+    auth_mode: "jwt",
+    llm_provider: "mock",
+    search_provider: "mock",
+    sms_enabled: false,
+    sms_provider: "twilio",
+    ninjapear_configured: false,
+    ninjapear_credit_balance: null,
+    ninjapear_estimated_credits_per_company: null,
+    is_localhost: false,
+    turnstile_site_key: null,
+    components: [],
+  };
+}
+
+function mockFetchImplementation(mustChangePassword: boolean) {
+  return vi.fn().mockImplementation((url: string) => {
+    const path = url.replace("http://localhost:8000", "");
+    if (path === "/api/v1/auth/me") {
+      return Promise.resolve({ ok: true, status: 200, json: async () => meBody(mustChangePassword) });
+    }
+    if (path === "/api/v1/system/status") {
+      return Promise.resolve({ ok: true, status: 200, json: async () => systemStatusBody() });
+    }
+    return Promise.resolve({ ok: false, status: 404, json: async () => ({ detail: "not found" }) });
+  });
+}
+
+beforeEach(() => {
+  replaceMock.mockClear();
+});
+
+describe("DashboardLayout - must_change_password redirect", () => {
+  it("redirects to /change-password and withholds the page content when the flag is set", async () => {
+    vi.stubGlobal("fetch", mockFetchImplementation(true));
+    renderWithQueryClient(
+      <DashboardLayout>
+        <div>Protected dashboard content</div>
+      </DashboardLayout>,
+    );
+
+    await waitFor(() => {
+      expect(replaceMock).toHaveBeenCalledWith("/change-password");
+    });
+    expect(screen.queryByText(/protected dashboard content/i)).not.toBeInTheDocument();
+  });
+
+  it("renders normally when the flag is not set", async () => {
+    vi.stubGlobal("fetch", mockFetchImplementation(false));
+    renderWithQueryClient(
+      <DashboardLayout>
+        <div>Protected dashboard content</div>
+      </DashboardLayout>,
+    );
+
+    expect(await screen.findByText(/protected dashboard content/i)).toBeInTheDocument();
+    expect(replaceMock).not.toHaveBeenCalledWith("/change-password");
+  });
+});
@@ -0,0 +1,86 @@
+import { screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import ChangePasswordPage from "@/app/change-password/page";
+import { renderWithQueryClient } from "./test-utils";
+
+const replaceMock = vi.fn();
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn(), replace: replaceMock }),
+}));
+
+beforeEach(() => {
+  replaceMock.mockClear();
+});
+
+describe("ChangePasswordPage", () => {
+  it("rejects a weak new password before submitting", async () => {
+    const user = userEvent.setup();
+    renderWithQueryClient(<ChangePasswordPage />);
+
+    await user.type(screen.getByLabelText(/current password/i), "correct-horse-1");
+    await user.type(screen.getByLabelText(/new password/i), "allletters");
+    await user.click(screen.getByRole("button", { name: /update password/i }));
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/must contain at least one letter and one digit/i),
+      ).toBeInTheDocument();
+    });
+  });
+
+  it("submits current + new password and redirects to the dashboard on success", async () => {
+    const fetchMock = vi.fn().mockImplementation((url: string, init?: RequestInit) => {
+      const path = url.replace("http://localhost:8000", "");
+      if (path === "/api/v1/auth/change-password" && init?.method === "POST") {
+        expect(JSON.parse(init.body as string)).toEqual({
+          current_password: "correct-horse-1",
+          new_password: "brand-new-horse-2",
+        });
+        return Promise.resolve({
+          ok: true,
+          status: 200,
+          json: async () => ({
+            access_token: "new-access",
+            refresh_token: "new-refresh",
+            token_type: "bearer",
+            expires_in_minutes: 15,
+          }),
+        });
+      }
+      return Promise.resolve({ ok: false, status: 404, json: async () => ({ detail: "not found" }) });
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const user = userEvent.setup();
+    renderWithQueryClient(<ChangePasswordPage />);
+
+    await user.type(screen.getByLabelText(/current password/i), "correct-horse-1");
+    await user.type(screen.getByLabelText(/new password/i), "brand-new-horse-2");
+    await user.click(screen.getByRole("button", { name: /update password/i }));
+
+    await waitFor(() => {
+      expect(replaceMock).toHaveBeenCalledWith("/dashboard");
+    });
+  });
+
+  it("surfaces an error for the wrong current password", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({
+        ok: false,
+        status: 401,
+        json: async () => ({ detail: "Incorrect current password" }),
+      }),
+    );
+    const user = userEvent.setup();
+    renderWithQueryClient(<ChangePasswordPage />);
+
+    await user.type(screen.getByLabelText(/current password/i), "wrong-password-1");
+    await user.type(screen.getByLabelText(/new password/i), "brand-new-horse-2");
+    await user.click(screen.getByRole("button", { name: /update password/i }));
+
+    expect(await screen.findByText(/incorrect current password/i)).toBeInTheDocument();
+  });
+});
@@ -4,6 +4,10 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import SettingsPage from "@/app/(app)/settings/page";
 import { renderWithQueryClient } from "./test-utils";

+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn(), replace: vi.fn() }),
+}));
+
 const ADMIN_USER = {
  id: "user-1",
  email: "[email protected]",
@@ -12,6 +16,7 @@ const ADMIN_USER = {
  is_active: true,
  is_admin: true,
  auth_mode: "jwt",
+  must_change_password: false,
 };

 function systemStatusBody(isLocalhost: boolean, authMode: "local" | "jwt") {
@@ -67,7 +72,7 @@ describe("Settings - Database viewer box", () => {
    renderWithQueryClient(<SettingsPage />);

    const link = await screen.findByRole("link", { name: /open database viewer/i });
-    expect(link).toHaveAttribute("href", "http://localhost:8081");
+    expect(link).toHaveAttribute("href", "http://localhost:8081/?pgsql=postgres&username=ciagent");
    expect(link).toHaveAttribute("target", "_blank");
  });

@@ -0,0 +1,148 @@
+import { screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import SettingsPage from "@/app/(app)/settings/page";
+import { renderWithQueryClient } from "./test-utils";
+
+const replaceMock = vi.fn();
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn(), replace: replaceMock }),
+}));
+
+const REGULAR_USER = {
+  id: "user-1",
+  email: "[email protected]",
+  display_name: "Regular User",
+  timezone: "America/New_York",
+  is_active: true,
+  is_admin: false,
+  auth_mode: "jwt",
+  must_change_password: false,
+};
+
+const LOCAL_DEV_USER = {
+  id: "00000000-0000-0000-0000-000000000001",
+  email: "[email protected]",
+  display_name: "Local Developer",
+  timezone: "America/New_York",
+  is_active: true,
+  is_admin: true,
+  auth_mode: "local",
+  must_change_password: false,
+};
+
+function systemStatusBody(isLocalhost: boolean, authMode: "local" | "jwt") {
+  return {
+    app_env: "development",
+    auth_mode: authMode,
+    llm_provider: "mock",
+    search_provider: "mock",
+    sms_enabled: false,
+    sms_provider: "twilio",
+    ninjapear_configured: false,
+    ninjapear_credit_balance: null,
+    ninjapear_estimated_credits_per_company: null,
+    is_localhost: isLocalhost,
+    turnstile_site_key: null,
+    components: [],
+  };
+}
+
+function mockFetchImplementation(
+  isLocalhost: boolean,
+  authMode: "local" | "jwt",
+  meUser: typeof REGULAR_USER,
+) {
+  return vi.fn().mockImplementation((url: string, init?: RequestInit) => {
+    const path = url.replace("http://localhost:8000", "");
+    const ok = (json: unknown, status = 200) =>
+      Promise.resolve({ ok: true, status, json: async () => json });
+
+    if (path === "/api/v1/auth/me") return ok(meUser);
+    if (path === "/api/v1/system/status") return ok(systemStatusBody(isLocalhost, authMode));
+    if (path === "/api/v1/notification-destinations") return ok([]);
+    if (path === "/api/v1/companies") return ok([]);
+    if (path === "/api/v1/system/logs") return ok([]);
+    if (path === "/api/v1/user-api-keys") return ok([]);
+    if (path === "/api/v1/system/secrets") return ok([]);
+    if (path === "/api/v1/auth/security-events") return ok([]);
+    if (path === "/api/v1/admin/ip-bans") return ok([]);
+    if (path === "/api/v1/admin/unban-requests") return ok([]);
+    if (path === "/api/v1/auth/me" && init?.method === "DELETE") return ok(undefined, 204);
+    return Promise.resolve({ ok: false, status: 404, json: async () => ({ detail: "not found" }) });
+  });
+}
+
+beforeEach(() => {
+  replaceMock.mockClear();
+});
+
+describe("Settings - Delete account box", () => {
+  it("renders for a regular (non-local-dev) user, disabled until a password is typed", async () => {
+    vi.stubGlobal("fetch", mockFetchImplementation(false, "jwt", REGULAR_USER));
+    renderWithQueryClient(<SettingsPage />);
+
+    const button = await screen.findByRole("button", { name: /delete account/i });
+    expect(button).toBeDisabled();
+
+    const user = userEvent.setup();
+    await user.type(screen.getByLabelText(/confirm your password/i), "correct-horse-1");
+    expect(button).not.toBeDisabled();
+  });
+
+  it("is hidden entirely for the local-dev bypass account", async () => {
+    vi.stubGlobal("fetch", mockFetchImplementation(true, "local", LOCAL_DEV_USER));
+    renderWithQueryClient(<SettingsPage />);
+
+    await screen.findByText(LOCAL_DEV_USER.email);
+    expect(screen.queryByRole("button", { name: /delete account/i })).not.toBeInTheDocument();
+  });
+
+  it("submits the password, then clears tokens and redirects home on success", async () => {
+    const fetchMock = vi.fn().mockImplementation((url: string, init?: RequestInit) => {
+      const path = url.replace("http://localhost:8000", "");
+      if (path === "/api/v1/auth/me" && init?.method === "DELETE") {
+        expect(JSON.parse(init.body as string)).toEqual({ password: "correct-horse-1" });
+        return Promise.resolve({ ok: true, status: 204, json: async () => undefined });
+      }
+      return mockFetchImplementation(false, "jwt", REGULAR_USER)(url, init);
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const user = userEvent.setup();
+    renderWithQueryClient(<SettingsPage />);
+
+    const button = await screen.findByRole("button", { name: /delete account/i });
+    await user.type(screen.getByLabelText(/confirm your password/i), "correct-horse-1");
+    await user.click(button);
+
+    await waitFor(() => {
+      expect(replaceMock).toHaveBeenCalledWith("/");
+    });
+  });
+
+  it("shows an error message when the password is wrong", async () => {
+    const fetchMock = vi.fn().mockImplementation((url: string, init?: RequestInit) => {
+      const path = url.replace("http://localhost:8000", "");
+      if (path === "/api/v1/auth/me" && init?.method === "DELETE") {
+        return Promise.resolve({
+          ok: false,
+          status: 401,
+          json: async () => ({ detail: "Incorrect password" }),
+        });
+      }
+      return mockFetchImplementation(false, "jwt", REGULAR_USER)(url, init);
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const user = userEvent.setup();
+    renderWithQueryClient(<SettingsPage />);
+
+    const button = await screen.findByRole("button", { name: /delete account/i });
+    await user.type(screen.getByLabelText(/confirm your password/i), "wrong-password");
+    await user.click(button);
+
+    expect(await screen.findByText(/incorrect password/i)).toBeInTheDocument();
+  });
+});