snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/graphql/suites/auth/user-sessions/utils/setup-database-config-override.util.ts

@@ -0,0 +1,53 @@
+import { type ConfigVariableValue } from 'twenty-shared/types';
+
+import { createConfigVariable } from 'test/integration/twenty-config/utils/create-config-variable.util';
+import { deleteConfigVariable } from 'test/integration/twenty-config/utils/delete-config-variable.util';
+import { getConfigVariable } from 'test/integration/twenty-config/utils/get-config-variable.util';
+import { updateConfigVariable } from 'test/integration/twenty-config/utils/update-config-variable.util';
+
+// Registers beforeAll/afterAll hooks that apply a database config override for
+// the suite and restore the previous state afterwards, rather than blindly
+// deleting: a suite must not erase an override another suite (or the
+// environment) had in place.
+export const setupDatabaseConfigOverrideForSuite = (
+  key: string,
+  value: ConfigVariableValue,
+): void => {
+  let previousOverrideValue: ConfigVariableValue;
+  let hadPreviousOverride = false;
+
+  beforeAll(async () => {
+    const { data } = await getConfigVariable({ input: { key } });
+
+    hadPreviousOverride = data.getDatabaseConfigVariable.source === 'DATABASE';
+
+    if (hadPreviousOverride) {
+      previousOverrideValue = data.getDatabaseConfigVariable.value;
+      await updateConfigVariable({ input: { key, value } });
+    } else {
+      await createConfigVariable({ input: { key, value } });
+    }
+  });
+
+  afterAll(async () => {
+    try {
+      if (hadPreviousOverride) {
+        await updateConfigVariable({
+          input: { key, value: previousOverrideValue },
+        });
+      } else {
+        await deleteConfigVariable({ input: { key } });
+      }
+    } catch (error) {
+      // Reported rather than rethrown: a passing suite should not go red over
+      // its own teardown. But a swallowed failure leaves the override in place
+      // and the next suite fails for reasons that point nowhere near here, so
+      // it has to be visible.
+      process.stderr.write(
+        `[config-override] failed to restore ${key}, later suites may see a stale value: ${
+          error instanceof Error ? error.message : String(error)
+        }\n`,
+      );
+    }
+  });
+};

packages/twenty-server/test/integration/graphql/suites/auth/user-sessions/utils/sign-in-with-cookie-capture.util.ts

@@ -0,0 +1,152 @@
+import { type Response } from 'supertest';
+import { buildWorkspaceOriginForSubdomain } from 'test/integration/graphql/utils/build-apple-workspace-origin.util';
+import { getAuthTokensFromLoginTokenQueryFactory } from 'test/integration/graphql/utils/get-auth-tokens-from-login-token.query-factory.util';
+import { getLoginTokenFromCredentialsQueryFactory } from 'test/integration/graphql/utils/get-login-token-from-credentials.query-factory.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { USER_SESSION_COOKIE_NAME } from 'src/engine/core-modules/user-session/constants/user-session-cookie-name.constant';
+import { USER_SESSION_SECURE_COOKIE_NAME } from 'src/engine/core-modules/user-session/constants/user-session-secure-cookie-name.constant';
+
+type RequestHeaders = {
+  originHeader?: string;
+  cookieHeader?: string;
+};
+
+// Supertest requests dispatch lazily, so Origin and Cookie can be set on the
+// request makeMetadataAPIRequest already built. The explicit null token keeps
+// these requests off Bearer authentication, which would bypass both the
+// cookie auth path and the CSRF middleware; undefined would fall back to the
+// util's default admin token.
+export const postMetadataOperationWithHeaders = (
+  graphqlOperation: Parameters<typeof makeMetadataAPIRequest>[0],
+  { originHeader, cookieHeader }: RequestHeaders,
+  expectedStatus = 200,
+) => {
+  const graphqlRequest = makeMetadataAPIRequest(graphqlOperation, null);
+
+  if (originHeader !== undefined) {
+    graphqlRequest.set('Origin', originHeader);
+  }
+
+  if (cookieHeader !== undefined) {
+    graphqlRequest.set('Cookie', cookieHeader);
+  }
+
+  return graphqlRequest.expect(expectedStatus);
+};
+
+type SignInOptions = RequestHeaders & {
+  email?: string;
+  password?: string;
+  workspaceSubdomain?: string;
+};
+
+// Runs the full credentials exchange (credentials -> login token -> auth
+// tokens) and returns the raw supertest response of the final exchange, so
+// callers can assert on set-cookie headers, not just the GraphQL body.
+export const signInWithCookieCapture = async ({
+  email = 'tim@apple.dev',
+  password = 'tim@apple.dev',
+  workspaceSubdomain = 'apple',
+  originHeader,
+  cookieHeader,
+}: SignInOptions = {}): Promise<Response> => {
+  const workspaceOrigin = buildWorkspaceOriginForSubdomain(workspaceSubdomain);
+
+  const loginTokenResponse = await postMetadataOperationWithHeaders(
+    getLoginTokenFromCredentialsQueryFactory({
+      email,
+      password,
+      origin: workspaceOrigin,
+    }),
+    { originHeader, cookieHeader },
+  );
+
+  const loginToken =
+    loginTokenResponse.body.data?.getLoginTokenFromCredentials?.loginToken
+      ?.token;
+
+  expect(loginToken).toBeDefined();
+
+  return await postMetadataOperationWithHeaders(
+    getAuthTokensFromLoginTokenQueryFactory({
+      loginToken,
+      origin: workspaceOrigin,
+    }),
+    { originHeader, cookieHeader },
+  );
+};
+
+// Redacts the two dynamic parts (token value, expiry timestamp) so the rest of
+// the set-cookie header can be snapshot: name, attribute list and order are
+// deterministic, and the snapshot also pins the absence of Domain and Secure.
+export const normalizeSessionCookieForSnapshot = (rawCookie: string): string =>
+  rawCookie
+    .replace(/=sess_[A-Za-z0-9_-]+/, '=sess_<redacted>')
+    .replace(/Expires=[^;]+/, 'Expires=<redacted>');
+
+export const getSetCookieHeaders = (response: Response): string[] =>
+  Array.isArray(response.headers['set-cookie'])
+    ? response.headers['set-cookie']
+    : [];
+
+// Which of the two names the server issues depends on SERVER_URL and
+// AUTH_COOKIE_SAME_SITE, so callers match on both by default and read the name
+// back off the response rather than assuming the insecure deployment. Specs
+// that assert one specific variant pass the name explicitly.
+const SESSION_COOKIE_NAMES = [
+  USER_SESSION_SECURE_COOKIE_NAME,
+  USER_SESSION_COOKIE_NAME,
+];
+
+// startsWith keeps the plain and __Host- names distinct: the prefixed name
+// does not start with the plain one.
+export const extractSessionCookie = (
+  response: Response,
+  cookieName?: string,
+):
+  | { rawCookie: string; cookieName: string; cookieHeader: string; sessionToken: string }
+  | undefined => {
+  const candidateNames =
+    cookieName === undefined ? SESSION_COOKIE_NAMES : [cookieName];
+
+  for (const candidateName of candidateNames) {
+    const rawCookie = getSetCookieHeaders(response).find((cookie) =>
+      cookie.startsWith(`${candidateName}=sess_`),
+    );
+
+    if (rawCookie === undefined) {
+      continue;
+    }
+
+    const sessionToken = rawCookie
+      .split(';')[0]
+      .slice(`${candidateName}=`.length);
+
+    return {
+      rawCookie,
+      cookieName: candidateName,
+      cookieHeader: `${candidateName}=${sessionToken}`,
+      sessionToken,
+    };
+  }
+
+  return undefined;
+};
+
+// A deletion cookie is the name with an empty value and an epoch expiry; the
+// extractor above will not match it because the value lacks the sess_ prefix.
+export const hasClearingCookie = (
+  response: Response,
+  cookieName?: string,
+): boolean => {
+  const candidateNames =
+    cookieName === undefined ? SESSION_COOKIE_NAMES : [cookieName];
+
+  return getSetCookieHeaders(response).some((cookie) =>
+    candidateNames.some(
+      (candidateName) =>
+        cookie.startsWith(`${candidateName}=;`) &&
+        cookie.includes('Expires=Thu, 01 Jan 1970'),
+    ),
+  );
+};

packages/twenty-server/test/integration/graphql/suites/auth/user-sessions/utils/user-session-operations.util.ts

@@ -0,0 +1,95 @@
+import { gql } from 'graphql-tag';
+
+export const currentUserIdentityQueryFactory = () => {
+  return {
+    query: gql`
+      query CurrentUser {
+        currentUser {
+          id
+          email
+        }
+      }
+    `,
+    variables: {},
+  };
+};
+
+export const currentUserWorkspaceContextQueryFactory = () => {
+  return {
+    query: gql`
+      query CurrentUserWorkspaceContext {
+        currentUser {
+          id
+          email
+          currentWorkspace {
+            id
+          }
+          currentUserWorkspace {
+            id
+          }
+        }
+      }
+    `,
+    variables: {},
+  };
+};
+
+export const currentUserSessionsQueryFactory = () => {
+  return {
+    query: gql`
+      query CurrentUserSessions {
+        currentUserSessions {
+          id
+          workspaceId
+          authProvider
+          isImpersonating
+          isCurrent
+          lastActiveAt
+          expiresAt
+        }
+      }
+    `,
+    variables: {},
+  };
+};
+
+export const revokeUserSessionQueryFactory = ({
+  userSessionId,
+}: {
+  userSessionId: string;
+}) => {
+  return {
+    query: gql`
+      mutation RevokeUserSession($userSessionId: UUID!) {
+        revokeUserSession(userSessionId: $userSessionId)
+      }
+    `,
+    variables: { userSessionId },
+  };
+};
+
+export const revokeAllOtherUserSessionsQueryFactory = () => {
+  return {
+    query: gql`
+      mutation RevokeAllOtherUserSessions {
+        revokeAllOtherUserSessions
+      }
+    `,
+    variables: {},
+  };
+};
+
+export const signOutQueryFactory = ({
+  refreshToken,
+}: {
+  refreshToken?: string;
+} = {}) => {
+  return {
+    query: gql`
+      mutation SignOut($refreshToken: String) {
+        signOut(refreshToken: $refreshToken)
+      }
+    `,
+    variables: { refreshToken },
+  };
+};