Merge pull request #3713 from overleaf/jpa-login-event-drop-pii

[AuthenticationController] do not include PII as part of login event GitOrigin-RevId: 274378b3a21945637dc33d2cfb39a53e9aaad9b7
2021-03-30 02:05:09 +00:00
parent b2b9a05e3c
commit 8ec7ebe645
3 changed files with 93 additions and 4 deletions
@@ -0,0 +1,37 @@
+const { expect } = require('chai')
+const { ObjectId } = require('mongodb')
+const User = require('./helpers/User').promises
+
+describe('Authentication', function() {
+  let user
+  beforeEach('init vars', function() {
+    user = new User()
+  })
+
+  describe('login', function() {
+    beforeEach('doLogin', async function() {
+      await user.login()
+    })
+
+    it('should log the user in', async function() {
+      const {
+        response: { statusCode }
+      } = await user.doRequest('GET', '/project')
+      expect(statusCode).to.equal(200)
+    })
+
+    it('should emit an user auditLog entry for the login', async function() {
+      const {
+        auditLog: [auditLogEntry]
+      } = await user.get()
+      expect(auditLogEntry).to.exist
+      expect(auditLogEntry.timestamp).to.exist
+      delete auditLogEntry.timestamp
+      expect(auditLogEntry).to.deep.equal({
+        operation: 'login',
+        ipAddress: '127.0.0.1',
+        initiatorId: ObjectId(user.id)
+      })
+    })
+  })
+})