merge: integrate Google OAuth and latest application fixes
This commit is contained in:
@@ -5,8 +5,17 @@ DATABASE_URL="postgresql://postgres:password@localhost:5432/the_tip_top_db"
|
||||
JWT_SECRET="your_secret_key"
|
||||
|
||||
APP_URL="http://localhost:5000"
|
||||
FRONTEND_URL="http://localhost:5173"
|
||||
MAIL_HOST="smtp.gmail.com"
|
||||
MAIL_PORT="587"
|
||||
MAIL_USER="your_email@gmail.com"
|
||||
MAIL_PASS="your_app_password"
|
||||
MAIL_FROM="Thé Tip Top <your_email@gmail.com>"
|
||||
MAIL_USER=abayomiandil62@gmail.com
|
||||
MAIL_PASS=dumqamoupdrliygf
|
||||
MAIL_FROM="Thé Tip Top <abayomiandil62@gmail.com>"
|
||||
|
||||
# Connexion externe (OAuth 2.0). Laisser vide désactive proprement le bouton
|
||||
# correspondant : la route répond 503 au lieu de faire planter le serveur.
|
||||
# URI de redirection à déclarer côté provider : APP_URL + /api/auth/google/callback
|
||||
GOOGLE_CLIENT_ID=""
|
||||
GOOGLE_CLIENT_SECRET=""
|
||||
FACEBOOK_APP_ID=""
|
||||
FACEBOOK_APP_SECRET=""
|
||||
|
||||
3
backend/.gitignore
vendored
3
backend/.gitignore
vendored
@@ -2,4 +2,5 @@ node_modules/
|
||||
.env
|
||||
.prisma
|
||||
coverage/
|
||||
dist/
|
||||
dist/
|
||||
test-results/
|
||||
|
||||
143
backend/package-lock.json
generated
143
backend/package-lock.json
generated
@@ -13,8 +13,12 @@
|
||||
"bcrypt": "^6.0.0",
|
||||
"cors": "^2.8.6",
|
||||
"express": "^5.2.1",
|
||||
"express-rate-limit": "^8.6.1",
|
||||
"helmet": "^8.3.0",
|
||||
"jsonwebtoken": "^9.0.3",
|
||||
"nodemailer": "^9.0.3",
|
||||
"passport": "^0.7.0",
|
||||
"passport-google-oauth20": "^2.0.0",
|
||||
"prisma": "^6.19.3",
|
||||
"swagger-jsdoc": "^6.3.0",
|
||||
"swagger-ui-express": "^5.0.1",
|
||||
@@ -2197,6 +2201,15 @@
|
||||
"node": "18 || 20 || >=22"
|
||||
}
|
||||
},
|
||||
"node_modules/base64url": {
|
||||
"version": "3.0.1",
|
||||
"resolved": "https://registry.npmjs.org/base64url/-/base64url-3.0.1.tgz",
|
||||
"integrity": "sha512-ir1UPr3dkwexU7FdV8qBBbNDRUhMmIekYMFZfi+C/sLNnRESKPl23nB9b2pltqfOQNnGzsDdId90AEtG5tCx4A==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=6.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/baseline-browser-mapping": {
|
||||
"version": "2.10.40",
|
||||
"resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.40.tgz",
|
||||
@@ -3210,6 +3223,25 @@
|
||||
"url": "https://opencollective.com/express"
|
||||
}
|
||||
},
|
||||
"node_modules/express-rate-limit": {
|
||||
"version": "8.6.2",
|
||||
"resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.6.2.tgz",
|
||||
"integrity": "sha512-YH4ru+eOJxQABscKFfRCy9R7x9QFGdezclVMwwgFFndzS2Xnm0uo6B0ABZsLhcpeptGv2qvuJVWlQr9gQZoC3A==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"debug": "^4.4.3",
|
||||
"ip-address": "^10.2.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 16"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/express-rate-limit"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"express": ">= 4.11"
|
||||
}
|
||||
},
|
||||
"node_modules/exsolve": {
|
||||
"version": "1.0.8",
|
||||
"resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
|
||||
@@ -3658,6 +3690,18 @@
|
||||
"node": ">= 0.4"
|
||||
}
|
||||
},
|
||||
"node_modules/helmet": {
|
||||
"version": "8.3.0",
|
||||
"resolved": "https://registry.npmjs.org/helmet/-/helmet-8.3.0.tgz",
|
||||
"integrity": "sha512-Qgpiaws3Sm30Av8Eah6sjMCZZwjlBu+E68rhpCWBshY1lb09HtLwj5GviX0OyQIn+ulUS0iX0AxN5n3tLZzz1w==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=18.0.0"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/EvanHahn"
|
||||
}
|
||||
},
|
||||
"node_modules/html-escaper": {
|
||||
"version": "2.0.2",
|
||||
"resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
|
||||
@@ -3766,6 +3810,15 @@
|
||||
"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
|
||||
"license": "ISC"
|
||||
},
|
||||
"node_modules/ip-address": {
|
||||
"version": "10.5.0",
|
||||
"resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
|
||||
"integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 12"
|
||||
}
|
||||
},
|
||||
"node_modules/ipaddr.js": {
|
||||
"version": "1.9.1",
|
||||
"resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
|
||||
@@ -5487,9 +5540,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/nodemailer": {
|
||||
"version": "9.0.3",
|
||||
"resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.3.tgz",
|
||||
"integrity": "sha512-n+YP+NKwR5zRWa60k3GiQ6Q3B4KXCoAw40dAKeCtYn020iNN74aWK2liXIC3ZEATeGql7we3tE3t8QwhY0eskw==",
|
||||
"version": "9.0.5",
|
||||
"resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.5.tgz",
|
||||
"integrity": "sha512-wvjiKvjczmsN7U/8006JOdXubgBk2XFAbioDMbT+sM7cPs0QrhJTa6KBRX7P5REGGkDcLUz/EarWidb8G8C1jQ==",
|
||||
"license": "MIT-0",
|
||||
"engines": {
|
||||
"node": ">=6.0.0"
|
||||
@@ -5608,6 +5661,12 @@
|
||||
"integrity": "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/oauth": {
|
||||
"version": "0.10.2",
|
||||
"resolved": "https://registry.npmjs.org/oauth/-/oauth-0.10.2.tgz",
|
||||
"integrity": "sha512-JtFnB+8nxDEXgNyniwz573xxbKSOu3R8D40xQKqcjwJ2CDkYqUDI53o6IuzDJBx60Z8VKCm271+t8iFjakrl8Q==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/object-assign": {
|
||||
"version": "4.1.1",
|
||||
"resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
|
||||
@@ -5768,6 +5827,64 @@
|
||||
"node": ">= 0.8"
|
||||
}
|
||||
},
|
||||
"node_modules/passport": {
|
||||
"version": "0.7.0",
|
||||
"resolved": "https://registry.npmjs.org/passport/-/passport-0.7.0.tgz",
|
||||
"integrity": "sha512-cPLl+qZpSc+ireUvt+IzqbED1cHHkDoVYMo30jbJIdOOjQ1MQYZBPiNvmi8UM6lJuOpTPXJGZQk0DtC4y61MYQ==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"passport-strategy": "1.x.x",
|
||||
"pause": "0.0.1",
|
||||
"utils-merge": "^1.0.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4.0"
|
||||
},
|
||||
"funding": {
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/jaredhanson"
|
||||
}
|
||||
},
|
||||
"node_modules/passport-google-oauth20": {
|
||||
"version": "2.0.0",
|
||||
"resolved": "https://registry.npmjs.org/passport-google-oauth20/-/passport-google-oauth20-2.0.0.tgz",
|
||||
"integrity": "sha512-KSk6IJ15RoxuGq7D1UKK/8qKhNfzbLeLrG3gkLZ7p4A6DBCcv7xpyQwuXtWdpyR0+E0mwkpjY1VfPOhxQrKzdQ==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"passport-oauth2": "1.x.x"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/passport-oauth2": {
|
||||
"version": "1.8.0",
|
||||
"resolved": "https://registry.npmjs.org/passport-oauth2/-/passport-oauth2-1.8.0.tgz",
|
||||
"integrity": "sha512-cjsQbOrXIDE4P8nNb3FQRCCmJJ/utnFKEz2NX209f7KOHPoX18gF7gBzBbLLsj2/je4KrgiwLLGjf0lm9rtTBA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"base64url": "3.x.x",
|
||||
"oauth": "0.10.x",
|
||||
"passport-strategy": "1.x.x",
|
||||
"uid2": "0.0.x",
|
||||
"utils-merge": "1.x.x"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 0.4.0"
|
||||
},
|
||||
"funding": {
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/jaredhanson"
|
||||
}
|
||||
},
|
||||
"node_modules/passport-strategy": {
|
||||
"version": "1.0.0",
|
||||
"resolved": "https://registry.npmjs.org/passport-strategy/-/passport-strategy-1.0.0.tgz",
|
||||
"integrity": "sha512-CB97UUvDKJde2V0KDWWB3lyf6PC3FaZP7YxZ2G8OAtn9p4HI9j9JLP9qjOGZFvyl8uwNT8qM+hGnz/n16NI7oA==",
|
||||
"engines": {
|
||||
"node": ">= 0.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/path-exists": {
|
||||
"version": "4.0.0",
|
||||
"resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
|
||||
@@ -5829,6 +5946,11 @@
|
||||
"integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/pause": {
|
||||
"version": "0.0.1",
|
||||
"resolved": "https://registry.npmjs.org/pause/-/pause-0.0.1.tgz",
|
||||
"integrity": "sha512-KG8UEiEVkR3wGEb4m5yZkVCzigAD+cVEJck2CzYZO37ZGJfctvVptVO192MwrtPhzONn6go8ylnOdMhKqi4nfg=="
|
||||
},
|
||||
"node_modules/perfect-debounce": {
|
||||
"version": "1.0.0",
|
||||
"resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-1.0.0.tgz",
|
||||
@@ -6774,6 +6896,12 @@
|
||||
"url": "https://opencollective.com/express"
|
||||
}
|
||||
},
|
||||
"node_modules/uid2": {
|
||||
"version": "0.0.4",
|
||||
"resolved": "https://registry.npmjs.org/uid2/-/uid2-0.0.4.tgz",
|
||||
"integrity": "sha512-IevTus0SbGwQzYh3+fRsAMTVVPOoIVufzacXcHPmdlle1jUpq7BRL+mw3dgeLanvGZdwwbWhRV6XrcFNdBmjWA==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/undefsafe": {
|
||||
"version": "2.0.5",
|
||||
"resolved": "https://registry.npmjs.org/undefsafe/-/undefsafe-2.0.5.tgz",
|
||||
@@ -6866,6 +6994,15 @@
|
||||
"browserslist": ">= 4.21.0"
|
||||
}
|
||||
},
|
||||
"node_modules/utils-merge": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
|
||||
"integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">= 0.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/uuid": {
|
||||
"version": "14.0.1",
|
||||
"resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz",
|
||||
|
||||
@@ -20,8 +20,12 @@
|
||||
"bcrypt": "^6.0.0",
|
||||
"cors": "^2.8.6",
|
||||
"express": "^5.2.1",
|
||||
"express-rate-limit": "^8.6.1",
|
||||
"helmet": "^8.3.0",
|
||||
"jsonwebtoken": "^9.0.3",
|
||||
"nodemailer": "^9.0.3",
|
||||
"passport": "^0.7.0",
|
||||
"passport-google-oauth20": "^2.0.0",
|
||||
"prisma": "^6.19.3",
|
||||
"swagger-jsdoc": "^6.3.0",
|
||||
"swagger-ui-express": "^5.0.1",
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
-- CreateEnum
|
||||
CREATE TYPE "AuthProvider" AS ENUM ('LOCAL', 'GOOGLE', 'FACEBOOK');
|
||||
|
||||
-- AlterTable
|
||||
ALTER TABLE "User" ADD COLUMN "avatarUrl" TEXT,
|
||||
ADD COLUMN "provider" "AuthProvider" NOT NULL DEFAULT 'LOCAL',
|
||||
ADD COLUMN "providerId" TEXT,
|
||||
ALTER COLUMN "password" DROP NOT NULL;
|
||||
|
||||
-- CreateIndex
|
||||
CREATE UNIQUE INDEX "User_provider_providerId_key" ON "User"("provider", "providerId");
|
||||
@@ -24,12 +24,20 @@ enum ClaimStatus {
|
||||
CANCELLED
|
||||
}
|
||||
|
||||
enum AuthProvider {
|
||||
LOCAL
|
||||
GOOGLE
|
||||
FACEBOOK
|
||||
}
|
||||
|
||||
model User {
|
||||
id Int @id @default(autoincrement())
|
||||
firstname String
|
||||
lastname String
|
||||
email String @unique
|
||||
password String
|
||||
// Nul pour les comptes créés via un provider externe (Google, Facebook) :
|
||||
// ces utilisateurs n'ont jamais choisi de mot de passe chez nous.
|
||||
password String?
|
||||
role Role @default(CLIENT)
|
||||
birthdate DateTime?
|
||||
gender String?
|
||||
@@ -43,10 +51,16 @@ model User {
|
||||
resetPasswordToken String?
|
||||
resetPasswordExpires DateTime?
|
||||
|
||||
provider AuthProvider @default(LOCAL)
|
||||
providerId String?
|
||||
avatarUrl String?
|
||||
|
||||
tickets Ticket[]
|
||||
participations Participation[]
|
||||
grandPrizeWinner GrandPrizeWinner?
|
||||
claimsValidated Claim[] @relation("EmployeeClaims")
|
||||
|
||||
@@unique([provider, providerId])
|
||||
}
|
||||
|
||||
model Lot {
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
const express = require("express");
|
||||
const cors = require("cors");
|
||||
const helmet = require("helmet");
|
||||
const rateLimit = require("express-rate-limit");
|
||||
require("dotenv").config();
|
||||
|
||||
const authRoutes = require("./routes/auth.routes");
|
||||
@@ -9,11 +11,37 @@ const adminRoutes = require("./routes/admin.routes");
|
||||
|
||||
const swaggerUi = require("swagger-ui-express");
|
||||
const swaggerSpec = require("./docs/swagger");
|
||||
const { passport } = require("./config/passport");
|
||||
|
||||
const app = express();
|
||||
|
||||
app.use(cors());
|
||||
const allowedOrigins = (process.env.FRONTEND_URL || "http://localhost:5173").split(",");
|
||||
|
||||
// La CSP par défaut de helmet bloque les scripts inline de Swagger UI :
|
||||
// on l'applique partout sauf sur /api-docs, où une CSP dédiée (désactivée)
|
||||
// est posée juste avant de monter Swagger, plus bas.
|
||||
app.use((req, res, next) => {
|
||||
if (req.path.startsWith("/api-docs")) return next();
|
||||
return helmet()(req, res, next);
|
||||
});
|
||||
app.use(cors({ origin: allowedOrigins }));
|
||||
app.use(express.json());
|
||||
// OAuth stateless : initialize() suffit, aucune session n'est ouverte.
|
||||
app.use(passport.initialize());
|
||||
|
||||
// Anti-bruteforce sur les routes d'authentification uniquement : 20
|
||||
// tentatives par IP toutes les 15 minutes, sans limiter le reste de l'API
|
||||
// (participation au jeu, consultation des gains, etc.).
|
||||
const authLimiter = rateLimit({
|
||||
windowMs: 15 * 60 * 1000,
|
||||
limit: 20,
|
||||
standardHeaders: true,
|
||||
legacyHeaders: false,
|
||||
message: { message: "Trop de tentatives, réessayez dans quelques minutes." },
|
||||
});
|
||||
app.use("/api/auth/login", authLimiter);
|
||||
app.use("/api/auth/register", authLimiter);
|
||||
app.use("/api/auth/forgot-password", authLimiter);
|
||||
|
||||
// routes
|
||||
app.use("/api/auth", authRoutes);
|
||||
@@ -22,7 +50,7 @@ app.use("/api/employee", employeeRoutes);
|
||||
app.use("/api/admin", adminRoutes);
|
||||
|
||||
// swagger
|
||||
app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerSpec));
|
||||
app.use("/api-docs", helmet({ contentSecurityPolicy: false }), swaggerUi.serve, swaggerUi.setup(swaggerSpec));
|
||||
|
||||
// test route
|
||||
app.get("/", (req, res) => {
|
||||
|
||||
136
backend/src/config/passport.js
Normal file
136
backend/src/config/passport.js
Normal file
@@ -0,0 +1,136 @@
|
||||
const passport = require("passport");
|
||||
const GoogleStrategy = require("passport-google-oauth20").Strategy;
|
||||
const crypto = require("crypto");
|
||||
const prisma = require("./prisma");
|
||||
const transporter = require("./mailer");
|
||||
|
||||
// Un compte créé via un provider externe n'a pas de mot de passe. On lui en
|
||||
// propose un dès l'inscription, via le même mécanisme de jeton que la
|
||||
// réinitialisation : sans mot de passe, l'utilisateur dépend entièrement de
|
||||
// Google pour se connecter, et le formulaire de changement de son profil lui
|
||||
// reste inaccessible.
|
||||
const PASSWORD_SETUP_EXPIRY_MS = 1000 * 60 * 60 * 24; // 24 h
|
||||
|
||||
async function sendPasswordSetupEmail(user) {
|
||||
const token = crypto.randomBytes(32).toString("hex");
|
||||
|
||||
await prisma.user.update({
|
||||
where: { id: user.id },
|
||||
data: {
|
||||
resetPasswordToken: token,
|
||||
resetPasswordExpires: new Date(Date.now() + PASSWORD_SETUP_EXPIRY_MS),
|
||||
},
|
||||
});
|
||||
|
||||
const frontendUrl = process.env.FRONTEND_URL || "http://localhost:5173";
|
||||
const setupUrl = `${frontendUrl}/definir-mot-de-passe/${token}`;
|
||||
|
||||
await transporter.sendMail({
|
||||
from: process.env.MAIL_FROM,
|
||||
to: user.email,
|
||||
subject: "Définissez votre mot de passe Thé Tip Top",
|
||||
html: `
|
||||
<div style="font-family:sans-serif;max-width:480px;margin:auto">
|
||||
<h2 style="color:#006B6B">Bienvenue ${user.firstname} !</h2>
|
||||
<p>Votre compte a été créé avec Google. Vous pouvez continuer à vous
|
||||
connecter de cette façon, ou définir un mot de passe pour accéder
|
||||
également à votre compte sans passer par Google.</p>
|
||||
<p style="text-align:center;padding:20px 0">
|
||||
<a href="${setupUrl}" style="background:#006B6B;color:#fff;text-decoration:none;padding:12px 24px;border-radius:8px;display:inline-block">
|
||||
Définir mon mot de passe
|
||||
</a>
|
||||
</p>
|
||||
<p style="color:#888;font-size:13px">Ce lien expire dans 24 heures. Si vous
|
||||
ne souhaitez pas de mot de passe, ignorez simplement cet email : votre
|
||||
connexion Google continuera de fonctionner.</p>
|
||||
</div>
|
||||
`,
|
||||
});
|
||||
}
|
||||
|
||||
// Authentification stateless : le callback OAuth émet directement notre JWT,
|
||||
// donc pas de session Express ni de serialize/deserialize à brancher.
|
||||
|
||||
const googleEnabled =
|
||||
Boolean(process.env.GOOGLE_CLIENT_ID) && Boolean(process.env.GOOGLE_CLIENT_SECRET);
|
||||
|
||||
if (googleEnabled) {
|
||||
passport.use(
|
||||
new GoogleStrategy(
|
||||
{
|
||||
clientID: process.env.GOOGLE_CLIENT_ID,
|
||||
clientSecret: process.env.GOOGLE_CLIENT_SECRET,
|
||||
callbackURL: `${process.env.APP_URL || "http://localhost:5000"}/api/auth/google/callback`,
|
||||
scope: ["profile", "email"],
|
||||
},
|
||||
async (accessToken, refreshToken, profile, done) => {
|
||||
try {
|
||||
const email = profile.emails?.[0]?.value;
|
||||
|
||||
if (!email) {
|
||||
return done(null, false, {
|
||||
message: "Aucune adresse email n'est associée à ce compte Google.",
|
||||
});
|
||||
}
|
||||
|
||||
// 1. Compte déjà lié à ce compte Google : connexion directe.
|
||||
const byProvider = await prisma.user.findUnique({
|
||||
where: {
|
||||
provider_providerId: { provider: "GOOGLE", providerId: profile.id },
|
||||
},
|
||||
});
|
||||
|
||||
if (byProvider) return done(null, byProvider);
|
||||
|
||||
// 2. Un compte existe avec le même email : on le rattache à Google.
|
||||
// L'email étant déjà validé par Google, on en profite pour lever
|
||||
// la vérification si elle était en attente.
|
||||
const byEmail = await prisma.user.findUnique({ where: { email } });
|
||||
|
||||
if (byEmail) {
|
||||
const linked = await prisma.user.update({
|
||||
where: { id: byEmail.id },
|
||||
data: {
|
||||
provider: "GOOGLE",
|
||||
providerId: profile.id,
|
||||
isEmailVerified: true,
|
||||
emailVerifyToken: null,
|
||||
emailVerifyExpires: null,
|
||||
avatarUrl: byEmail.avatarUrl || profile.photos?.[0]?.value || null,
|
||||
},
|
||||
});
|
||||
return done(null, linked);
|
||||
}
|
||||
|
||||
// 3. Première connexion : création du compte.
|
||||
const created = await prisma.user.create({
|
||||
data: {
|
||||
firstname: profile.name?.givenName || profile.displayName || "Utilisateur",
|
||||
lastname: profile.name?.familyName || "",
|
||||
email,
|
||||
password: null,
|
||||
provider: "GOOGLE",
|
||||
providerId: profile.id,
|
||||
avatarUrl: profile.photos?.[0]?.value || null,
|
||||
isEmailVerified: true,
|
||||
},
|
||||
});
|
||||
|
||||
// Un envoi qui échoue ne doit pas bloquer la connexion : le compte
|
||||
// est valide, et « mot de passe oublié » permet de rattraper.
|
||||
try {
|
||||
await sendPasswordSetupEmail(created);
|
||||
} catch (mailError) {
|
||||
console.error("Erreur envoi email de definition du mot de passe:", mailError);
|
||||
}
|
||||
|
||||
return done(null, created);
|
||||
} catch (error) {
|
||||
return done(error);
|
||||
}
|
||||
}
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
module.exports = { passport, googleEnabled };
|
||||
@@ -1,6 +1,8 @@
|
||||
const bcrypt = require("bcrypt");
|
||||
const crypto = require("crypto");
|
||||
const prisma = require("../config/prisma");
|
||||
const { getGameWindow, expireOverdueClaims } = require("../utils/gameWindow");
|
||||
const transporter = require("../config/mailer");
|
||||
const { getGameWindow } = require("../utils/gameWindow");
|
||||
|
||||
const AGE_BRACKETS = ["-18", "18-24", "25-34", "35-44", "45-54", "55-64", "65+"];
|
||||
|
||||
@@ -33,7 +35,6 @@ function computeAgeStats(users) {
|
||||
|
||||
const getStats = async (req, res) => {
|
||||
try {
|
||||
await expireOverdueClaims();
|
||||
const gameWindow = await getGameWindow();
|
||||
|
||||
const [
|
||||
@@ -79,9 +80,11 @@ const getStats = async (req, res) => {
|
||||
ticketsUsed,
|
||||
ticketsRemaining: ticketsTotal - ticketsUsed,
|
||||
participations,
|
||||
claimsPending,
|
||||
// L'expiration n'est pas écrite en base : une fois la fenêtre de retrait
|
||||
// fermée, les PENDING restants comptent comme annulés.
|
||||
claimsPending: gameWindow.isOpen ? claimsPending : 0,
|
||||
claimsDelivered,
|
||||
claimsCancelled,
|
||||
claimsCancelled: gameWindow.isOpen ? claimsCancelled : claimsCancelled + claimsPending,
|
||||
users,
|
||||
gameWindow,
|
||||
ageStats: computeAgeStats(clientsWithBirthdate),
|
||||
@@ -214,6 +217,31 @@ const createEmployee = async (req, res) => {
|
||||
|
||||
const drawWinner = async (req, res) => {
|
||||
try {
|
||||
// Le grand gagnant est tiré parmi tous les participants : le tirage n'a de
|
||||
// sens qu'une fois la période de participation close. Avant l'ouverture,
|
||||
// il n'existe aucun participant à départager.
|
||||
const gameWindow = await getGameWindow();
|
||||
|
||||
if (!gameWindow.configured) {
|
||||
return res.status(409).json({
|
||||
message: "Le jeu-concours n'a pas encore été lancé : aucun tirage au sort n'est possible.",
|
||||
});
|
||||
}
|
||||
|
||||
if (!gameWindow.hasStarted) {
|
||||
return res.status(409).json({
|
||||
message: `Le jeu-concours n'a pas encore commencé. Il ouvre le ${gameWindow.startDate.toLocaleDateString("fr-FR")}.`,
|
||||
startDate: gameWindow.startDate,
|
||||
});
|
||||
}
|
||||
|
||||
if (gameWindow.isParticipationOpen) {
|
||||
return res.status(409).json({
|
||||
message: `Le tirage au sort ne peut avoir lieu qu'après la fin des participations, le ${gameWindow.participationDeadline.toLocaleDateString("fr-FR")}.`,
|
||||
participationDeadline: gameWindow.participationDeadline,
|
||||
});
|
||||
}
|
||||
|
||||
const existingWinner = await prisma.grandPrizeWinner.findFirst({
|
||||
include: {
|
||||
user: {
|
||||
@@ -234,6 +262,10 @@ const drawWinner = async (req, res) => {
|
||||
});
|
||||
}
|
||||
|
||||
// Un utilisateur = une entrée dans le pool, quel que soit son nombre de
|
||||
// participations. On sélectionne des CLIENT distincts (pas des
|
||||
// participations), donc avoir utilisé 10 tickets ou 1 seul ne change
|
||||
// strictement rien aux chances de gagner le gros lot.
|
||||
const participants = await prisma.user.findMany({
|
||||
where: {
|
||||
role: "CLIENT",
|
||||
@@ -255,7 +287,11 @@ const drawWinner = async (req, res) => {
|
||||
});
|
||||
}
|
||||
|
||||
const randomIndex = Math.floor(Math.random() * participants.length);
|
||||
// Tirage purement aléatoire et équiprobable parmi les participants
|
||||
// distincts. crypto.randomInt (générateur cryptographiquement sûr,
|
||||
// sans biais) plutôt que Math.random(), pour un tirage défendable
|
||||
// devant l'huissier qui le supervise.
|
||||
const randomIndex = crypto.randomInt(participants.length);
|
||||
const winner = participants[randomIndex];
|
||||
|
||||
const savedWinner = await prisma.grandPrizeWinner.create({
|
||||
@@ -274,9 +310,41 @@ const drawWinner = async (req, res) => {
|
||||
},
|
||||
});
|
||||
|
||||
// Le tirage est un acte irréversible réalisé sous contrôle d'huissier :
|
||||
// un email qui ne part pas ne doit surtout pas l'invalider. On signale
|
||||
// simplement l'échec pour que l'administrateur prévienne autrement.
|
||||
let emailSent = true;
|
||||
|
||||
try {
|
||||
await transporter.sendMail({
|
||||
from: process.env.MAIL_FROM,
|
||||
to: savedWinner.user.email,
|
||||
subject: "Vous avez gagné le gros lot Thé Tip Top !",
|
||||
html: `
|
||||
<div style="font-family:sans-serif;max-width:480px;margin:auto">
|
||||
<h2 style="color:#006B6B">Félicitations ${savedWinner.user.firstname} !</h2>
|
||||
<p>Le tirage au sort du jeu-concours « 100% Gagnant » vient d'avoir lieu,
|
||||
et c'est vous qui remportez le gros lot :</p>
|
||||
<div style="font-size:20px;font-weight:bold;color:#006B6B;text-align:center;padding:20px;background:#F0F0F0;border-radius:12px">
|
||||
${savedWinner.prize}
|
||||
</div>
|
||||
<p>Notre équipe vous recontactera très prochainement pour convenir des
|
||||
modalités de remise de votre lot.</p>
|
||||
<p style="color:#888;font-size:13px">Merci de votre participation et à bientôt chez Thé Tip Top.</p>
|
||||
</div>
|
||||
`,
|
||||
});
|
||||
} catch (mailError) {
|
||||
emailSent = false;
|
||||
console.error("Erreur envoi email au grand gagnant:", mailError);
|
||||
}
|
||||
|
||||
return res.status(201).json({
|
||||
message: "Tirage au sort effectué avec succès.",
|
||||
message: emailSent
|
||||
? "Tirage au sort effectué avec succès. Le gagnant a été prévenu par email."
|
||||
: "Tirage au sort effectué avec succès, mais l'email n'a pas pu être envoyé au gagnant. Merci de le contacter directement.",
|
||||
totalEligibleParticipants: participants.length,
|
||||
emailSent,
|
||||
winner: savedWinner,
|
||||
});
|
||||
} catch (error) {
|
||||
@@ -287,6 +355,52 @@ const drawWinner = async (req, res) => {
|
||||
}
|
||||
};
|
||||
|
||||
// Lancement du jeu-concours : fixe (ou corrige) la date de début, dont
|
||||
// découlent les deux échéances. Une seule ligne de configuration existe, on
|
||||
// la met donc à jour si elle est déjà présente.
|
||||
const setGameSettings = async (req, res) => {
|
||||
try {
|
||||
const { startDate } = req.body;
|
||||
const parsedStartDate = new Date(startDate);
|
||||
|
||||
const existing = await prisma.gameSettings.findFirst({ orderBy: { id: "asc" } });
|
||||
|
||||
if (existing) {
|
||||
await prisma.gameSettings.update({
|
||||
where: { id: existing.id },
|
||||
data: { startDate: parsedStartDate },
|
||||
});
|
||||
} else {
|
||||
await prisma.gameSettings.create({ data: { startDate: parsedStartDate } });
|
||||
}
|
||||
|
||||
const gameWindow = await getGameWindow();
|
||||
|
||||
return res.json({
|
||||
message: existing
|
||||
? "Dates du jeu-concours mises à jour."
|
||||
: "Jeu-concours lancé avec succès.",
|
||||
gameWindow,
|
||||
});
|
||||
} catch (error) {
|
||||
console.error("Erreur configuration du jeu:", error);
|
||||
return res.status(500).json({
|
||||
message: "Erreur serveur lors de la configuration du jeu-concours.",
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
const getGameSettings = async (req, res) => {
|
||||
try {
|
||||
return res.json({ gameWindow: await getGameWindow() });
|
||||
} catch (error) {
|
||||
console.error("Erreur lecture configuration du jeu:", error);
|
||||
return res.status(500).json({
|
||||
message: "Erreur serveur lors de la lecture de la configuration.",
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
const getGrandPrizeWinner = async (req, res) => {
|
||||
try {
|
||||
const winner = await prisma.grandPrizeWinner.findFirst({
|
||||
@@ -302,14 +416,8 @@ const getGrandPrizeWinner = async (req, res) => {
|
||||
},
|
||||
});
|
||||
|
||||
if (!winner) {
|
||||
return res.status(404).json({
|
||||
message: "Aucun gagnant du gros lot n'a encore été tiré.",
|
||||
});
|
||||
}
|
||||
|
||||
return res.json({
|
||||
winner,
|
||||
winner: winner ?? null,
|
||||
});
|
||||
} catch (error) {
|
||||
console.error("Erreur récupération gagnant:", error);
|
||||
@@ -326,4 +434,6 @@ module.exports = {
|
||||
createEmployee,
|
||||
drawWinner,
|
||||
getGrandPrizeWinner,
|
||||
setGameSettings,
|
||||
getGameSettings,
|
||||
};
|
||||
@@ -62,11 +62,17 @@ const register = async (req, res) => {
|
||||
},
|
||||
});
|
||||
|
||||
await transporter.sendMail({
|
||||
from: process.env.MAIL_FROM,
|
||||
to: email,
|
||||
subject: "Votre code de validation Thé Tip Top",
|
||||
html: `
|
||||
// Le code de validation est le seul moyen d'activer le compte. Si l'envoi
|
||||
// échoue, laisser l'utilisateur en base le bloquerait définitivement : il
|
||||
// ne pourrait ni se connecter (email non vérifié) ni se réinscrire (email
|
||||
// déjà pris). On annule donc la création pour que la tentative reste
|
||||
// rejouable.
|
||||
try {
|
||||
await transporter.sendMail({
|
||||
from: process.env.MAIL_FROM,
|
||||
to: email,
|
||||
subject: "Votre code de validation Thé Tip Top",
|
||||
html: `
|
||||
<div style="font-family:sans-serif;max-width:480px;margin:auto">
|
||||
<h2 style="color:#006B6B">Bienvenue ${firstname} !</h2>
|
||||
<p>Merci pour votre inscription sur Thé Tip Top.</p>
|
||||
@@ -77,7 +83,21 @@ const register = async (req, res) => {
|
||||
<p style="color:#888;font-size:13px">Ce code expire dans <strong>15 minutes</strong>.</p>
|
||||
</div>
|
||||
`,
|
||||
});
|
||||
});
|
||||
} catch (mailError) {
|
||||
console.error("Erreur envoi du code de validation:", mailError);
|
||||
|
||||
try {
|
||||
await prisma.user.delete({ where: { id: user.id } });
|
||||
} catch (rollbackError) {
|
||||
console.error("Echec de l'annulation de l'inscription:", rollbackError);
|
||||
}
|
||||
|
||||
return res.status(502).json({
|
||||
message:
|
||||
"Votre compte n'a pas pu être créé : l'email de validation n'a pas pu être envoyé. Merci de réessayer dans quelques instants.",
|
||||
});
|
||||
}
|
||||
|
||||
return res.status(201).json({
|
||||
message: "Inscription réussie. Un code de validation a été envoyé par email.",
|
||||
@@ -156,6 +176,14 @@ const login = async (req, res) => {
|
||||
});
|
||||
}
|
||||
|
||||
// Compte créé via un provider externe : aucun mot de passe à comparer.
|
||||
if (!user.password) {
|
||||
const providerLabel = user.provider === "FACEBOOK" ? "Facebook" : "Google";
|
||||
return res.status(401).json({
|
||||
message: `Ce compte utilise la connexion ${providerLabel}. Utilisez le bouton « ${providerLabel} » pour vous connecter.`,
|
||||
});
|
||||
}
|
||||
|
||||
const isPasswordValid = await bcrypt.compare(password, user.password);
|
||||
|
||||
if (!isPasswordValid) {
|
||||
@@ -224,7 +252,10 @@ const forgotPassword = async (req, res) => {
|
||||
},
|
||||
});
|
||||
|
||||
const resetUrl = `${process.env.APP_URL}/api/auth/reset-password/${resetPasswordToken}`;
|
||||
// Le lien doit ouvrir le formulaire du front, pas la route POST de l'API :
|
||||
// un clic depuis un email est une requête GET, qui tombait en 404.
|
||||
const frontendUrl = process.env.FRONTEND_URL || "http://localhost:5173";
|
||||
const resetUrl = `${frontendUrl}/definir-mot-de-passe/${resetPasswordToken}`;
|
||||
|
||||
await transporter.sendMail({
|
||||
from: process.env.MAIL_FROM,
|
||||
@@ -255,7 +286,7 @@ const forgotPassword = async (req, res) => {
|
||||
const resetPassword = async (req, res) => {
|
||||
try {
|
||||
const { token } = req.params;
|
||||
const { password } = req.body;
|
||||
const { password, confirmPassword } = req.body;
|
||||
|
||||
if (!password || password.length < 8) {
|
||||
return res.status(400).json({
|
||||
@@ -263,6 +294,14 @@ const resetPassword = async (req, res) => {
|
||||
});
|
||||
}
|
||||
|
||||
// La confirmation est vérifiée côté serveur aussi : le contrôle du
|
||||
// navigateur ne protège pas un appel direct à l'API.
|
||||
if (confirmPassword !== undefined && password !== confirmPassword) {
|
||||
return res.status(400).json({
|
||||
message: "Les deux mots de passe ne correspondent pas.",
|
||||
});
|
||||
}
|
||||
|
||||
const user = await prisma.user.findFirst({
|
||||
where: {
|
||||
resetPasswordToken: token,
|
||||
@@ -354,6 +393,50 @@ const verifyCode = async (req, res) => {
|
||||
}
|
||||
};
|
||||
|
||||
// Fin du parcours OAuth : passport a posé l'utilisateur sur req.user, on émet
|
||||
// le même JWT que la connexion classique et on renvoie le navigateur vers le
|
||||
// front, qui récupère le token dans l'URL.
|
||||
const oauthCallback = (req, res) => {
|
||||
const frontendUrl = process.env.FRONTEND_URL || "http://localhost:5173";
|
||||
|
||||
try {
|
||||
const user = req.user;
|
||||
|
||||
if (!user) {
|
||||
return res.redirect(
|
||||
`${frontendUrl}/auth/callback?error=${encodeURIComponent(
|
||||
"Connexion externe refusée."
|
||||
)}`
|
||||
);
|
||||
}
|
||||
|
||||
const token = jwt.sign(
|
||||
{ id: user.id, role: user.role },
|
||||
process.env.JWT_SECRET,
|
||||
{ expiresIn: "24h" }
|
||||
);
|
||||
|
||||
const payload = Buffer.from(
|
||||
JSON.stringify({
|
||||
id: user.id,
|
||||
firstname: user.firstname,
|
||||
lastname: user.lastname,
|
||||
email: user.email,
|
||||
role: user.role,
|
||||
})
|
||||
).toString("base64");
|
||||
|
||||
return res.redirect(`${frontendUrl}/auth/callback?token=${token}&user=${payload}`);
|
||||
} catch (error) {
|
||||
console.error("Erreur oauthCallback:", error);
|
||||
return res.redirect(
|
||||
`${frontendUrl}/auth/callback?error=${encodeURIComponent(
|
||||
"Erreur serveur lors de la connexion externe."
|
||||
)}`
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
const me = async (req, res) => {
|
||||
return res.json({
|
||||
user: req.user,
|
||||
@@ -383,10 +466,13 @@ const deleteAccount = async (req, res) => {
|
||||
// 4. Supprimer les participations
|
||||
await tx.participation.deleteMany({ where: { userId } });
|
||||
|
||||
// 5. Libérer les tickets utilisés par ce user
|
||||
// 5. Détacher les tickets du compte sans les remettre en jeu : un code
|
||||
// figure sur un ticket de caisse physique et n'est jouable qu'une
|
||||
// fois. Le réinitialiser permettrait de rejouer indéfiniment le même
|
||||
// code en supprimant puis recréant un compte.
|
||||
await tx.ticket.updateMany({
|
||||
where: { userId },
|
||||
data: { userId: null, isUsed: false, usedAt: null },
|
||||
data: { userId: null },
|
||||
});
|
||||
|
||||
// 6. Supprimer l'utilisateur
|
||||
@@ -415,6 +501,13 @@ const changePassword = async (req, res) => {
|
||||
|
||||
const user = await prisma.user.findUnique({ where: { id: userId } });
|
||||
|
||||
if (!user.password) {
|
||||
return res.status(400).json({
|
||||
message:
|
||||
"Ce compte utilise une connexion externe et n'a pas de mot de passe à modifier.",
|
||||
});
|
||||
}
|
||||
|
||||
const isValid = await bcrypt.compare(currentPassword, user.password);
|
||||
if (!isValid) {
|
||||
return res.status(401).json({ message: "Mot de passe actuel incorrect." });
|
||||
@@ -440,4 +533,5 @@ module.exports = {
|
||||
forgotPassword,
|
||||
changePassword,
|
||||
deleteAccount,
|
||||
oauthCallback,
|
||||
};
|
||||
@@ -1,11 +1,11 @@
|
||||
const prisma = require("../config/prisma");
|
||||
const { expireOverdueClaims } = require("../utils/gameWindow");
|
||||
const { getGameWindow, effectiveClaimStatus } = require("../utils/gameWindow");
|
||||
|
||||
const getGainByTicketCode = async (req, res) => {
|
||||
try {
|
||||
const { code } = req.params;
|
||||
|
||||
await expireOverdueClaims();
|
||||
const gameWindow = await getGameWindow();
|
||||
|
||||
const ticket = await prisma.ticket.findUnique({
|
||||
where: { code: code.toUpperCase() },
|
||||
@@ -52,7 +52,7 @@ const getGainByTicketCode = async (req, res) => {
|
||||
},
|
||||
claim: {
|
||||
id: ticket.participation.claim.id,
|
||||
status: ticket.participation.claim.status,
|
||||
status: effectiveClaimStatus(ticket.participation.claim.status, gameWindow),
|
||||
claimedAt: ticket.participation.claim.claimedAt,
|
||||
},
|
||||
});
|
||||
@@ -69,7 +69,7 @@ const deliverClaim = async (req, res) => {
|
||||
const { id } = req.params;
|
||||
const employeeId = req.user.id;
|
||||
|
||||
await expireOverdueClaims();
|
||||
const gameWindow = await getGameWindow();
|
||||
|
||||
const claim = await prisma.claim.findUnique({
|
||||
where: { id: Number(id) },
|
||||
@@ -87,7 +87,7 @@ const deliverClaim = async (req, res) => {
|
||||
});
|
||||
}
|
||||
|
||||
if (claim.status === "CANCELLED") {
|
||||
if (effectiveClaimStatus(claim.status, gameWindow) === "CANCELLED") {
|
||||
return res.status(400).json({
|
||||
message: "Ce gain est expiré et ne peut plus être remis.",
|
||||
});
|
||||
|
||||
@@ -1,5 +1,13 @@
|
||||
const prisma = require("../config/prisma");
|
||||
const { getGameWindow, expireOverdueClaims } = require("../utils/gameWindow");
|
||||
const transporter = require("../config/mailer");
|
||||
const {
|
||||
getGameWindow,
|
||||
effectiveClaimStatus,
|
||||
participationClosedMessage,
|
||||
} = require("../utils/gameWindow");
|
||||
|
||||
// Levée par la transaction quand le ticket a été consommé entre-temps.
|
||||
class TicketDejaUtiliseError extends Error {}
|
||||
|
||||
const participate = async (req, res) => {
|
||||
try {
|
||||
@@ -7,9 +15,13 @@ const participate = async (req, res) => {
|
||||
const userId = req.user.id;
|
||||
|
||||
const gameWindow = await getGameWindow();
|
||||
if (!gameWindow.isOpen) {
|
||||
|
||||
// Un code n'est jouable que pendant les 30 jours de jeu : ni avant
|
||||
// l'ouverture, ni pendant la prolongation réservée aux retraits.
|
||||
if (!gameWindow.isParticipationOpen) {
|
||||
return res.status(410).json({
|
||||
message: "Le jeu-concours est terminé. Vous ne pouvez plus tester de code ni réclamer de lot.",
|
||||
message: participationClosedMessage(gameWindow),
|
||||
phase: gameWindow.phase,
|
||||
});
|
||||
}
|
||||
|
||||
@@ -33,16 +45,24 @@ const participate = async (req, res) => {
|
||||
}
|
||||
|
||||
const result = await prisma.$transaction(async (tx) => {
|
||||
const updatedTicket = await tx.ticket.update({
|
||||
where: { id: ticket.id },
|
||||
// Le contrôle isUsed ci-dessus ne suffit pas : deux requêtes simultanées
|
||||
// peuvent le franchir ensemble. On repasse donc par un update
|
||||
// conditionnel, atomique, qui ne touche le ticket que s'il est encore
|
||||
// libre — le perdant de la course obtient 0 ligne modifiée.
|
||||
const { count } = await tx.ticket.updateMany({
|
||||
where: { id: ticket.id, isUsed: false },
|
||||
data: {
|
||||
isUsed: true,
|
||||
usedAt: new Date(),
|
||||
userId,
|
||||
},
|
||||
include: {
|
||||
lot: true,
|
||||
},
|
||||
});
|
||||
|
||||
if (count === 0) throw new TicketDejaUtiliseError();
|
||||
|
||||
const updatedTicket = await tx.ticket.findUnique({
|
||||
where: { id: ticket.id },
|
||||
include: { lot: true },
|
||||
});
|
||||
|
||||
const participation = await tx.participation.create({
|
||||
@@ -67,8 +87,41 @@ const participate = async (req, res) => {
|
||||
};
|
||||
});
|
||||
|
||||
// La participation est déjà enregistrée et consultable dans « Mes gains » :
|
||||
// un email qui ne part pas ne doit pas l'annuler ni consommer le ticket
|
||||
// pour rien. On se contente de signaler l'échec.
|
||||
let emailSent = true;
|
||||
|
||||
try {
|
||||
await transporter.sendMail({
|
||||
from: process.env.MAIL_FROM,
|
||||
to: req.user.email,
|
||||
subject: `Vous avez gagné : ${result.ticket.lot.name} !`,
|
||||
html: `
|
||||
<div style="font-family:sans-serif;max-width:480px;margin:auto">
|
||||
<h2 style="color:#006B6B">Bravo ${req.user.firstname} !</h2>
|
||||
<p>Votre code <strong>${result.ticket.code}</strong> est gagnant. Vous remportez :</p>
|
||||
<div style="font-size:20px;font-weight:bold;color:#006B6B;text-align:center;padding:20px;background:#F0F0F0;border-radius:12px">
|
||||
${result.ticket.lot.name}
|
||||
</div>
|
||||
${result.ticket.lot.description ? `<p style="text-align:center;color:#666">${result.ticket.lot.description}</p>` : ""}
|
||||
<p>Présentez-vous en boutique avec ce code pour retirer votre lot${
|
||||
gameWindow.claimDeadline
|
||||
? `, avant le <strong>${gameWindow.claimDeadline.toLocaleDateString("fr-FR")}</strong>`
|
||||
: ""
|
||||
}.</p>
|
||||
<p style="color:#888;font-size:13px">Retrouvez à tout moment vos gains dans votre espace « Mes gains ».</p>
|
||||
</div>
|
||||
`,
|
||||
});
|
||||
} catch (mailError) {
|
||||
emailSent = false;
|
||||
console.error("Erreur envoi email de gain:", mailError);
|
||||
}
|
||||
|
||||
return res.status(201).json({
|
||||
message: "Participation enregistrée avec succès.",
|
||||
emailSent,
|
||||
gain: {
|
||||
name: result.ticket.lot.name,
|
||||
description: result.ticket.lot.description,
|
||||
@@ -80,6 +133,12 @@ const participate = async (req, res) => {
|
||||
},
|
||||
});
|
||||
} catch (error) {
|
||||
if (error instanceof TicketDejaUtiliseError) {
|
||||
return res.status(409).json({
|
||||
message: "Ce code a déjà été utilisé.",
|
||||
});
|
||||
}
|
||||
|
||||
console.error("Erreur participation:", error);
|
||||
return res.status(500).json({
|
||||
message: "Erreur serveur lors de la participation.",
|
||||
@@ -91,7 +150,7 @@ const myGains = async (req, res) => {
|
||||
try {
|
||||
const userId = req.user.id;
|
||||
|
||||
await expireOverdueClaims();
|
||||
const gameWindow = await getGameWindow();
|
||||
|
||||
const participations = await prisma.participation.findMany({
|
||||
where: { userId },
|
||||
@@ -112,7 +171,9 @@ const myGains = async (req, res) => {
|
||||
lot: participation.lot.name,
|
||||
description: participation.lot.description,
|
||||
value: participation.lot.value,
|
||||
claimStatus: participation.claim?.status,
|
||||
claimStatus: participation.claim
|
||||
? effectiveClaimStatus(participation.claim.status, gameWindow)
|
||||
: undefined,
|
||||
wonAt: participation.createdAt,
|
||||
})),
|
||||
});
|
||||
|
||||
@@ -23,6 +23,8 @@ const authMiddleware = async (req, res, next) => {
|
||||
lastname: true,
|
||||
email: true,
|
||||
role: true,
|
||||
provider: true,
|
||||
password: true,
|
||||
},
|
||||
});
|
||||
|
||||
@@ -32,7 +34,11 @@ const authMiddleware = async (req, res, next) => {
|
||||
});
|
||||
}
|
||||
|
||||
req.user = user;
|
||||
// req.user est renvoyé tel quel par /api/auth/me : on remplace le hash par
|
||||
// un simple booléen, qui suffit au profil pour proposer « définir » ou
|
||||
// « modifier » son mot de passe.
|
||||
const { password, ...rest } = user;
|
||||
req.user = { ...rest, hasPassword: Boolean(password) };
|
||||
next();
|
||||
} catch (error) {
|
||||
return res.status(401).json({
|
||||
|
||||
@@ -6,12 +6,14 @@ const {
|
||||
createEmployee,
|
||||
drawWinner,
|
||||
getGrandPrizeWinner,
|
||||
setGameSettings,
|
||||
getGameSettings,
|
||||
} = require("../controllers/admin.controller");
|
||||
|
||||
const authMiddleware = require("../middlewares/auth.middleware");
|
||||
const roleMiddleware = require("../middlewares/role.middleware");
|
||||
const validate = require("../middlewares/validate.middleware");
|
||||
const { createEmployeeSchema } = require("../validations/admin.validation");
|
||||
const { createEmployeeSchema, gameSettingsSchema } = require("../validations/admin.validation");
|
||||
|
||||
const router = express.Router();
|
||||
|
||||
@@ -105,10 +107,48 @@ router.post("/draw", drawWinner);
|
||||
* - bearerAuth: []
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Gagnant du gros lot
|
||||
* 404:
|
||||
* description: Aucun gagnant encore tiré
|
||||
* description: Gagnant du gros lot, ou { winner - null } si aucun tirage n'a encore eu lieu
|
||||
*/
|
||||
router.get("/draw", getGrandPrizeWinner);
|
||||
|
||||
/**
|
||||
* @swagger
|
||||
* /api/admin/game-settings:
|
||||
* get:
|
||||
* summary: Fenêtre du jeu-concours (début, fin des participations, fin des retraits)
|
||||
* tags:
|
||||
* - Admin
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Configuration courante du jeu-concours
|
||||
* put:
|
||||
* summary: Lance le jeu-concours ou corrige sa date de début
|
||||
* tags:
|
||||
* - Admin
|
||||
* security:
|
||||
* - bearerAuth: []
|
||||
* requestBody:
|
||||
* required: true
|
||||
* content:
|
||||
* application/json:
|
||||
* schema:
|
||||
* type: object
|
||||
* required:
|
||||
* - startDate
|
||||
* properties:
|
||||
* startDate:
|
||||
* type: string
|
||||
* format: date-time
|
||||
* example: 2026-09-01T00:00:00.000Z
|
||||
* responses:
|
||||
* 200:
|
||||
* description: Jeu-concours lancé ou mis à jour
|
||||
* 400:
|
||||
* description: Date de début invalide
|
||||
*/
|
||||
router.get("/game-settings", getGameSettings);
|
||||
router.put("/game-settings", validate(gameSettingsSchema), setGameSettings);
|
||||
|
||||
module.exports = router;
|
||||
@@ -1,8 +1,9 @@
|
||||
const express = require("express");
|
||||
const { register, login, verifyEmail, verifyCode, forgotPassword, resetPassword, me, changePassword, deleteAccount } = require("../controllers/auth.controller");
|
||||
const { register, login, verifyEmail, verifyCode, forgotPassword, resetPassword, me, changePassword, deleteAccount, oauthCallback } = require("../controllers/auth.controller");
|
||||
const authMiddleware = require("../middlewares/auth.middleware");
|
||||
const validate = require("../middlewares/validate.middleware");
|
||||
const { registerSchema, loginSchema } = require("../validations/auth.validation");
|
||||
const { passport, googleEnabled } = require("../config/passport");
|
||||
|
||||
const router = express.Router();
|
||||
|
||||
@@ -161,4 +162,55 @@ router.post("/verify-code", verifyCode);
|
||||
router.patch("/change-password", authMiddleware, changePassword);
|
||||
router.delete("/account", authMiddleware, deleteAccount);
|
||||
|
||||
/**
|
||||
* @swagger
|
||||
* /api/auth/google:
|
||||
* get:
|
||||
* summary: Démarre la connexion via Google (redirection OAuth 2.0)
|
||||
* tags:
|
||||
* - Auth
|
||||
* responses:
|
||||
* 302:
|
||||
* description: Redirection vers l'écran de consentement Google.
|
||||
* 503:
|
||||
* description: Connexion Google non configurée sur ce serveur.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @swagger
|
||||
* /api/auth/google/callback:
|
||||
* get:
|
||||
* summary: Retour de Google, émet le JWT et redirige vers le front
|
||||
* tags:
|
||||
* - Auth
|
||||
* responses:
|
||||
* 302:
|
||||
* description: Redirection vers FRONTEND_URL/auth/callback avec le token.
|
||||
*/
|
||||
if (googleEnabled) {
|
||||
router.get(
|
||||
"/google",
|
||||
passport.authenticate("google", { scope: ["profile", "email"], session: false })
|
||||
);
|
||||
|
||||
router.get(
|
||||
"/google/callback",
|
||||
passport.authenticate("google", {
|
||||
session: false,
|
||||
failureRedirect: `${process.env.FRONTEND_URL || "http://localhost:5173"}/auth/callback?error=${encodeURIComponent(
|
||||
"Connexion Google refusée."
|
||||
)}`,
|
||||
}),
|
||||
oauthCallback
|
||||
);
|
||||
} else {
|
||||
// Sans identifiants configurés, on répond explicitement plutôt que de
|
||||
// laisser passport planter au démarrage.
|
||||
const notConfigured = (req, res) =>
|
||||
res.status(503).json({ message: "La connexion Google n'est pas configurée sur ce serveur." });
|
||||
|
||||
router.get("/google", notConfigured);
|
||||
router.get("/google/callback", notConfigured);
|
||||
}
|
||||
|
||||
module.exports = router;
|
||||
@@ -1,6 +1,7 @@
|
||||
const express = require("express");
|
||||
const { participate, myGains } = require("../controllers/game.controller");
|
||||
const authMiddleware = require("../middlewares/auth.middleware");
|
||||
const roleMiddleware = require("../middlewares/role.middleware");
|
||||
const validate = require("../middlewares/validate.middleware");
|
||||
const { participateSchema } = require("../validations/game.validation");
|
||||
|
||||
@@ -20,7 +21,9 @@ const router = express.Router();
|
||||
* description: Participation enregistrée
|
||||
*/
|
||||
|
||||
router.post("/participate", authMiddleware, validate(participateSchema), participate);
|
||||
// Le jeu est reserve aux clients : un ADMIN ou un EMPLOYEE qui joue
|
||||
// consommerait des tickets et fausserait les statistiques.
|
||||
router.post("/participate", authMiddleware, roleMiddleware("CLIENT"), validate(participateSchema), participate);
|
||||
|
||||
/**
|
||||
* @swagger
|
||||
@@ -36,6 +39,6 @@ router.post("/participate", authMiddleware, validate(participateSchema), partici
|
||||
* description: Liste des gains
|
||||
*/
|
||||
|
||||
router.get("/my-gains", authMiddleware, myGains);
|
||||
router.get("/my-gains", authMiddleware, roleMiddleware("CLIENT"), myGains);
|
||||
|
||||
module.exports = router;
|
||||
@@ -1,23 +1,41 @@
|
||||
const prisma = require("../config/prisma");
|
||||
|
||||
// Le concours traverse cinq états, et non deux : confondre « pas encore
|
||||
// ouvert » avec « terminé » produit des messages faux côté joueur et laisse
|
||||
// passer le tirage au sort avant le début du jeu.
|
||||
const PHASES = {
|
||||
NOT_CONFIGURED: "NOT_CONFIGURED",
|
||||
SCHEDULED: "SCHEDULED",
|
||||
OPEN: "OPEN",
|
||||
CLAIM_ONLY: "CLAIM_ONLY",
|
||||
CLOSED: "CLOSED",
|
||||
};
|
||||
|
||||
const GAME_DURATION_DAYS = 30;
|
||||
const CLAIM_EXTENSION_DAYS = 30;
|
||||
const DAY_MS = 24 * 60 * 60 * 1000;
|
||||
|
||||
// Fenêtre pendant laquelle un joueur peut à la fois tester son code et
|
||||
// réclamer son lot : 30 jours de jeu + 30 jours supplémentaires à compter
|
||||
// de startDate. Tant qu'aucune GameSettings n'existe, le jeu est considéré
|
||||
// comme non démarré et donc ouvert (comportement de dev par défaut).
|
||||
async function getGameWindow() {
|
||||
// Deux échéances distinctes à partir de startDate :
|
||||
// - participationDeadline (30 j) : dernier moment pour tester un code ;
|
||||
// - claimDeadline (60 j) : dernier moment pour retirer un lot déjà gagné.
|
||||
// Les 30 jours supplémentaires servent uniquement au retrait, pas au jeu.
|
||||
// Tant qu'aucune GameSettings n'existe, le jeu est considéré comme non
|
||||
// configuré et donc ouvert (comportement de dev par défaut).
|
||||
async function getGameWindow(now = new Date()) {
|
||||
const settings = await prisma.gameSettings.findFirst({ orderBy: { id: "asc" } });
|
||||
|
||||
// Tant que l'administrateur n'a pas fixé de date, le concours n'existe pas :
|
||||
// rien n'est jouable et aucun tirage n'est possible. Ouvrir par défaut
|
||||
// reviendrait à faire gagner des lots dans un jeu qui n'a jamais été lancé.
|
||||
if (!settings) {
|
||||
return {
|
||||
configured: false,
|
||||
phase: PHASES.NOT_CONFIGURED,
|
||||
startDate: null,
|
||||
participationDeadline: null,
|
||||
claimDeadline: null,
|
||||
isOpen: true,
|
||||
isParticipationOpen: false,
|
||||
isOpen: false,
|
||||
};
|
||||
}
|
||||
|
||||
@@ -26,26 +44,57 @@ async function getGameWindow() {
|
||||
settings.startDate.getTime() + (GAME_DURATION_DAYS + CLAIM_EXTENSION_DAYS) * DAY_MS
|
||||
);
|
||||
|
||||
const hasStarted = now >= settings.startDate;
|
||||
const isParticipationOpen = hasStarted && now <= participationDeadline;
|
||||
const isOpen = hasStarted && now <= claimDeadline;
|
||||
|
||||
let phase;
|
||||
if (!hasStarted) phase = PHASES.SCHEDULED;
|
||||
else if (isParticipationOpen) phase = PHASES.OPEN;
|
||||
else if (isOpen) phase = PHASES.CLAIM_ONLY;
|
||||
else phase = PHASES.CLOSED;
|
||||
|
||||
return {
|
||||
configured: true,
|
||||
phase,
|
||||
startDate: settings.startDate,
|
||||
participationDeadline,
|
||||
claimDeadline,
|
||||
isOpen: new Date() <= claimDeadline,
|
||||
hasStarted,
|
||||
isParticipationOpen,
|
||||
isOpen,
|
||||
};
|
||||
}
|
||||
|
||||
// Bascule en CANCELLED les gains PENDING non réclamés une fois la fenêtre
|
||||
// fermée. Appelé au fil de l'eau (pas de cron) avant toute lecture/écriture
|
||||
// de claims, ce qui suffit pour ce projet.
|
||||
async function expireOverdueClaims() {
|
||||
const window = await getGameWindow();
|
||||
if (window.isOpen) return;
|
||||
|
||||
await prisma.claim.updateMany({
|
||||
where: { status: "PENDING" },
|
||||
data: { status: "CANCELLED" },
|
||||
});
|
||||
// L'expiration d'un gain est *dérivée* de la fenêtre de jeu, jamais écrite en
|
||||
// base : un PENDING dont le délai de retrait est passé est présenté comme
|
||||
// CANCELLED, mais la ligne reste intacte. Corriger une startDate erronée
|
||||
// suffit donc à rétablir les gains, et aucune lecture ne modifie la base.
|
||||
function effectiveClaimStatus(status, gameWindow) {
|
||||
if (status === "PENDING" && !gameWindow.isOpen) return "CANCELLED";
|
||||
return status;
|
||||
}
|
||||
|
||||
module.exports = { getGameWindow, expireOverdueClaims };
|
||||
// Message destiné au joueur qui tente de jouer hors de la fenêtre : chaque
|
||||
// phase a sa propre explication, avec la date utile quand elle existe.
|
||||
function participationClosedMessage(gameWindow) {
|
||||
switch (gameWindow.phase) {
|
||||
case PHASES.NOT_CONFIGURED:
|
||||
return "Le jeu-concours n'est pas encore ouvert. Revenez prochainement.";
|
||||
case PHASES.SCHEDULED:
|
||||
return `Le jeu-concours ouvrira le ${gameWindow.startDate.toLocaleDateString("fr-FR")}.`;
|
||||
case PHASES.CLAIM_ONLY:
|
||||
return "La période de participation est terminée. Vous pouvez encore retirer les lots déjà gagnés.";
|
||||
default:
|
||||
return "Le jeu-concours est terminé. Vous ne pouvez plus tester de code ni réclamer de lot.";
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
getGameWindow,
|
||||
effectiveClaimStatus,
|
||||
participationClosedMessage,
|
||||
PHASES,
|
||||
GAME_DURATION_DAYS,
|
||||
CLAIM_EXTENSION_DAYS,
|
||||
};
|
||||
|
||||
@@ -9,6 +9,13 @@ const createEmployeeSchema = z.object({
|
||||
gender: z.string().optional(),
|
||||
});
|
||||
|
||||
const gameSettingsSchema = z.object({
|
||||
startDate: z
|
||||
.string()
|
||||
.refine((value) => !Number.isNaN(new Date(value).getTime()), "Date de début invalide"),
|
||||
});
|
||||
|
||||
module.exports = {
|
||||
createEmployeeSchema,
|
||||
gameSettingsSchema,
|
||||
};
|
||||
87
backend/tests/draw.test.js
Normal file
87
backend/tests/draw.test.js
Normal file
@@ -0,0 +1,87 @@
|
||||
const bcrypt = require("bcrypt");
|
||||
const prisma = require("../src/config/prisma");
|
||||
|
||||
// ------------------------
|
||||
// Vérifie que le pool de participants au tirage du gros lot ne compte
|
||||
// chaque client qu'une seule fois, quel que soit son nombre de
|
||||
// participations. On rejoue ici exactement la requête utilisée par
|
||||
// admin.controller.js::drawWinner, restreinte à des utilisateurs dédiés
|
||||
// pour ne pas dépendre des autres données déjà présentes en base
|
||||
// (et surtout ne jamais toucher aux vrais tickets du jeu-concours).
|
||||
// ------------------------
|
||||
|
||||
let userManyParticipations;
|
||||
let userOneParticipation;
|
||||
let ticketIds = [];
|
||||
|
||||
beforeAll(async () => {
|
||||
const lot = await prisma.lot.findFirst();
|
||||
if (!lot) throw new Error("Aucun lot en base : lancez `npx prisma db seed` avant ce test.");
|
||||
|
||||
const hashed = await bcrypt.hash("Password123", 10);
|
||||
|
||||
userManyParticipations = await prisma.user.create({
|
||||
data: {
|
||||
firstname: "Draw",
|
||||
lastname: "MultiParticip",
|
||||
email: "draw-test-multi@test.com",
|
||||
password: hashed,
|
||||
role: "CLIENT",
|
||||
isEmailVerified: true,
|
||||
},
|
||||
});
|
||||
|
||||
userOneParticipation = await prisma.user.create({
|
||||
data: {
|
||||
firstname: "Draw",
|
||||
lastname: "SingleParticip",
|
||||
email: "draw-test-single@test.com",
|
||||
password: hashed,
|
||||
role: "CLIENT",
|
||||
isEmailVerified: true,
|
||||
},
|
||||
});
|
||||
|
||||
const codes = ["ZZDRAWTEST1", "ZZDRAWTEST2", "ZZDRAWTEST3", "ZZDRAWTEST4"];
|
||||
const owners = [
|
||||
userManyParticipations,
|
||||
userManyParticipations,
|
||||
userManyParticipations,
|
||||
userOneParticipation,
|
||||
];
|
||||
|
||||
for (let i = 0; i < codes.length; i++) {
|
||||
const ticket = await prisma.ticket.create({
|
||||
data: { code: codes[i], lotId: lot.id, isUsed: true, usedAt: new Date(), userId: owners[i].id },
|
||||
});
|
||||
ticketIds.push(ticket.id);
|
||||
await prisma.participation.create({
|
||||
data: { userId: owners[i].id, ticketId: ticket.id, lotId: lot.id },
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await prisma.participation.deleteMany({ where: { ticketId: { in: ticketIds } } });
|
||||
await prisma.ticket.deleteMany({ where: { id: { in: ticketIds } } });
|
||||
await prisma.user.deleteMany({
|
||||
where: { id: { in: [userManyParticipations.id, userOneParticipation.id] } },
|
||||
});
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
test("un client avec plusieurs participations ne compte qu'une fois dans le pool du tirage", async () => {
|
||||
const eligible = await prisma.user.findMany({
|
||||
where: {
|
||||
role: "CLIENT",
|
||||
id: { in: [userManyParticipations.id, userOneParticipation.id] },
|
||||
participations: { some: {} },
|
||||
},
|
||||
select: { id: true },
|
||||
});
|
||||
|
||||
expect(eligible).toHaveLength(2);
|
||||
expect(eligible.map((u) => u.id).sort()).toEqual(
|
||||
[userManyParticipations.id, userOneParticipation.id].sort()
|
||||
);
|
||||
});
|
||||
106
backend/tests/drawNotification.test.js
Normal file
106
backend/tests/drawNotification.test.js
Normal file
@@ -0,0 +1,106 @@
|
||||
const request = require("supertest");
|
||||
const app = require("../src/app");
|
||||
const prisma = require("../src/config/prisma");
|
||||
const jwt = require("jsonwebtoken");
|
||||
const bcrypt = require("bcrypt");
|
||||
const mailer = require("../src/config/mailer");
|
||||
|
||||
jest.mock("../src/config/mailer", () => ({ sendMail: jest.fn() }));
|
||||
|
||||
const DAY = 86400000;
|
||||
const PREFIX = "notif-";
|
||||
const CODE = "NOTIFTICK1";
|
||||
let ctx = {};
|
||||
|
||||
async function cleanup() {
|
||||
const us = await prisma.user.findMany({ where: { email: { contains: PREFIX } } });
|
||||
const ids = us.map((u) => u.id);
|
||||
const ps = await prisma.participation.findMany({ where: { userId: { in: ids } } });
|
||||
await prisma.claim.deleteMany({ where: { participationId: { in: ps.map((p) => p.id) } } });
|
||||
await prisma.participation.deleteMany({ where: { userId: { in: ids } } });
|
||||
await prisma.grandPrizeWinner.deleteMany({ where: { userId: { in: ids } } });
|
||||
await prisma.ticket.deleteMany({ where: { code: CODE } });
|
||||
await prisma.user.deleteMany({ where: { id: { in: ids } } });
|
||||
}
|
||||
|
||||
const tk = (u) => jwt.sign({ id: u.id, role: u.role }, process.env.JWT_SECRET, { expiresIn: "1h" });
|
||||
const jourJ = (d) =>
|
||||
prisma.gameSettings.update({
|
||||
where: { id: ctx.settingsId },
|
||||
data: { startDate: new Date(Date.now() - d * DAY) },
|
||||
});
|
||||
|
||||
beforeAll(async () => {
|
||||
await cleanup();
|
||||
const row = await prisma.gameSettings.findFirst({ orderBy: { id: "asc" } });
|
||||
ctx.settingsId = row.id;
|
||||
ctx.startDateOriginale = row.startDate;
|
||||
|
||||
const lot = await prisma.lot.findFirst({ orderBy: { id: "asc" } });
|
||||
await prisma.ticket.create({ data: { code: CODE, lotId: lot.id } });
|
||||
|
||||
const h = await bcrypt.hash("Password123", 10);
|
||||
ctx.admin = await prisma.user.create({ data: { firstname: "Alice", lastname: "Admin", email: PREFIX + "admin@test.local", password: h, role: "ADMIN", isEmailVerified: true } });
|
||||
ctx.client = await prisma.user.create({ data: { firstname: "Chloe", lastname: "Martin", email: PREFIX + "chloe@test.local", password: h, role: "CLIENT", isEmailVerified: true } });
|
||||
ctx.tAdmin = tk(ctx.admin);
|
||||
|
||||
await jourJ(1);
|
||||
mailer.sendMail.mockResolvedValue(true);
|
||||
await request(app).post("/api/game/participate").set("Authorization", "Bearer " + tk(ctx.client)).send({ code: CODE }).expect(201);
|
||||
await jourJ(35);
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await prisma.gameSettings.update({ where: { id: ctx.settingsId }, data: { startDate: ctx.startDateOriginale } });
|
||||
await cleanup();
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
describe("Notification du grand gagnant", () => {
|
||||
beforeEach(() => jest.clearAllMocks());
|
||||
|
||||
test("le gagnant recoit un email a son adresse", async () => {
|
||||
mailer.sendMail.mockResolvedValue(true);
|
||||
|
||||
const res = await request(app).post("/api/admin/draw").set("Authorization", "Bearer " + ctx.tAdmin).expect(201);
|
||||
|
||||
expect(res.body.emailSent).toBe(true);
|
||||
expect(mailer.sendMail).toHaveBeenCalledTimes(1);
|
||||
|
||||
const envoi = mailer.sendMail.mock.calls[0][0];
|
||||
expect(envoi.to).toBe(ctx.client.email);
|
||||
expect(envoi.subject).toMatch(/gros lot/i);
|
||||
expect(envoi.html).toContain("Chloe");
|
||||
expect(envoi.html).toContain("360");
|
||||
|
||||
await prisma.grandPrizeWinner.deleteMany({ where: { userId: ctx.client.id } });
|
||||
});
|
||||
|
||||
test("un SMTP en panne n invalide pas le tirage", async () => {
|
||||
mailer.sendMail.mockRejectedValue(new Error("SMTP indisponible"));
|
||||
|
||||
const res = await request(app).post("/api/admin/draw").set("Authorization", "Bearer " + ctx.tAdmin);
|
||||
|
||||
expect(res.status).toBe(201);
|
||||
expect(res.body.emailSent).toBe(false);
|
||||
expect(res.body.message).toMatch(/contacter directement/);
|
||||
|
||||
// Le tirage reste enregistre : c est un acte irreversible.
|
||||
const enBase = await prisma.grandPrizeWinner.findFirst({ where: { userId: ctx.client.id } });
|
||||
expect(enBase).not.toBeNull();
|
||||
|
||||
await prisma.grandPrizeWinner.deleteMany({ where: { userId: ctx.client.id } });
|
||||
});
|
||||
|
||||
test("aucun email n est envoye si le tirage est refuse", async () => {
|
||||
mailer.sendMail.mockResolvedValue(true);
|
||||
await jourJ(1);
|
||||
|
||||
const res = await request(app).post("/api/admin/draw").set("Authorization", "Bearer " + ctx.tAdmin);
|
||||
|
||||
expect(res.status).toBe(409);
|
||||
expect(mailer.sendMail).not.toHaveBeenCalled();
|
||||
|
||||
await jourJ(35);
|
||||
});
|
||||
});
|
||||
@@ -10,125 +10,88 @@ jest.mock("../src/config/mailer", () => ({
|
||||
}));
|
||||
|
||||
// ------------------------
|
||||
// Réinitialisation DB avant tests
|
||||
// Ce test tourne sur la même base que le reste du dev (500 000 tickets
|
||||
// réels du jeu-concours). On ne touche donc JAMAIS les tables globales
|
||||
// (pas de deleteMany sur claim/participation/ticket/user/lot) : tout ce
|
||||
// que ce fichier crée est identifiable de façon unique et nettoyé dans
|
||||
// afterAll, rien d'autre.
|
||||
// ------------------------
|
||||
|
||||
const testEmail = "e2e-flow-test@test.com";
|
||||
const ticketCode = "ZZE2ETEST1";
|
||||
let token;
|
||||
let createdTicketId;
|
||||
|
||||
beforeAll(async () => {
|
||||
await prisma.claim.deleteMany();
|
||||
await prisma.participation.deleteMany();
|
||||
await prisma.ticket.deleteMany();
|
||||
await prisma.user.deleteMany();
|
||||
await prisma.user.deleteMany({ where: { email: testEmail } });
|
||||
await prisma.ticket.deleteMany({ where: { code: ticketCode } });
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
const user = await prisma.user.findUnique({ where: { email: testEmail } });
|
||||
if (user) {
|
||||
await prisma.claim.deleteMany({ where: { participation: { userId: user.id } } });
|
||||
await prisma.participation.deleteMany({ where: { userId: user.id } });
|
||||
}
|
||||
if (createdTicketId) {
|
||||
await prisma.ticket.delete({ where: { id: createdTicketId } }).catch(() => {});
|
||||
}
|
||||
if (user) {
|
||||
await prisma.user.delete({ where: { id: user.id } });
|
||||
}
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
describe("THE TIP TOP - FULL E2E FLOW", () => {
|
||||
let token;
|
||||
let ticketCode = "ABC123";
|
||||
|
||||
// ------------------------
|
||||
// 1. REGISTER
|
||||
// ------------------------
|
||||
test("Register user", async () => {
|
||||
const res = await request(app)
|
||||
.post("/api/auth/register")
|
||||
.send({
|
||||
firstname: "Test",
|
||||
lastname: "User",
|
||||
email: "test@test.com",
|
||||
password: "Password123",
|
||||
});
|
||||
const res = await request(app).post("/api/auth/register").send({
|
||||
firstname: "E2E",
|
||||
lastname: "Test",
|
||||
email: testEmail,
|
||||
password: "Password123",
|
||||
});
|
||||
|
||||
expect([201, 409]).toContain(res.statusCode);
|
||||
expect(res.statusCode).toBe(201);
|
||||
});
|
||||
|
||||
// ------------------------
|
||||
// 2. LOGIN
|
||||
// ------------------------
|
||||
test("Login user", async () => {
|
||||
// Validation du user pour bypasser vérification email
|
||||
await prisma.user.update({
|
||||
where: { email: "test@test.com" },
|
||||
where: { email: testEmail },
|
||||
data: { isEmailVerified: true },
|
||||
});
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/auth/login")
|
||||
.send({
|
||||
email: "test@test.com",
|
||||
password: "Password123",
|
||||
});
|
||||
const res = await request(app).post("/api/auth/login").send({
|
||||
email: testEmail,
|
||||
password: "Password123",
|
||||
});
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(res.body.token).toBeDefined();
|
||||
token = res.body.token;
|
||||
});
|
||||
|
||||
// ------------------------
|
||||
// 3. PARTICIPATE GAME
|
||||
// ------------------------
|
||||
test("Participate to game", async () => {
|
||||
const res = await request(app)
|
||||
.post("/api/game/participate")
|
||||
.set("Authorization", `Bearer ${token}`)
|
||||
.send({ code: ticketCode });
|
||||
|
||||
expect([200, 201, 404, 409, 400]).toContain(res.statusCode);
|
||||
console.log("Ticket in DB before participate:", ticketCode);
|
||||
});
|
||||
|
||||
// ------------------------
|
||||
// 4. MY GAINS
|
||||
// ------------------------
|
||||
test("Get my gains", async () => {
|
||||
const res = await request(app)
|
||||
.get("/api/game/my-gains")
|
||||
.set("Authorization", `Bearer ${token}`);
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(res.body.gains).toBeDefined();
|
||||
});
|
||||
|
||||
// ------------------------
|
||||
// 3. GENERER UN TICKET
|
||||
// ------------------------
|
||||
test("Create a ticket for testing", async () => {
|
||||
const lot = await prisma.lot.create({
|
||||
data: {
|
||||
name: "Lot Test",
|
||||
description: "Lot pour test E2E",
|
||||
value: 10,
|
||||
percentage: 100
|
||||
},
|
||||
});
|
||||
test("Create a dedicated ticket for this test", async () => {
|
||||
const lot = await prisma.lot.findFirst();
|
||||
expect(lot).not.toBeNull();
|
||||
|
||||
const ticket = await prisma.ticket.create({
|
||||
data: {
|
||||
code: ticketCode,
|
||||
lotId: lot.id
|
||||
}
|
||||
data: { code: ticketCode, lotId: lot.id },
|
||||
});
|
||||
createdTicketId = ticket.id;
|
||||
|
||||
expect(ticket).toBeDefined();
|
||||
expect(ticket.code).toBe(ticketCode);
|
||||
});
|
||||
|
||||
// ------------------------
|
||||
// 4. PARTICIPATE GAME
|
||||
// ------------------------
|
||||
test("Participate to game", async () => {
|
||||
const res = await request(app)
|
||||
.post("/api/game/participate")
|
||||
.set("Authorization", `Bearer ${token}`)
|
||||
.send({ code: ticketCode });
|
||||
|
||||
expect([200, 201, 404, 409, 400]).toContain(res.statusCode);
|
||||
expect(res.statusCode).toBe(201);
|
||||
expect(res.body.gain).toBeDefined();
|
||||
});
|
||||
|
||||
// ------------------------
|
||||
// 5. MY GAINS
|
||||
// ------------------------
|
||||
test("Get my gains", async () => {
|
||||
const res = await request(app)
|
||||
.get("/api/game/my-gains")
|
||||
@@ -136,11 +99,9 @@ describe("THE TIP TOP - FULL E2E FLOW", () => {
|
||||
|
||||
expect(res.statusCode).toBe(200);
|
||||
expect(res.body.gains).toBeDefined();
|
||||
expect(res.body.gains.some((g) => g.ticketCode === ticketCode)).toBe(true);
|
||||
});
|
||||
|
||||
// ------------------------
|
||||
// 6. ADMIN STATS (CLIENT access denied)
|
||||
// ------------------------
|
||||
test("Admin stats - CLIENT access denied", async () => {
|
||||
const res = await request(app)
|
||||
.get("/api/admin/stats")
|
||||
@@ -149,4 +110,4 @@ describe("THE TIP TOP - FULL E2E FLOW", () => {
|
||||
expect(res.statusCode).toBe(403);
|
||||
expect(res.body.message || res.body).toBeDefined();
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
113
backend/tests/gainNotification.test.js
Normal file
113
backend/tests/gainNotification.test.js
Normal file
@@ -0,0 +1,113 @@
|
||||
const request = require("supertest");
|
||||
const app = require("../src/app");
|
||||
const prisma = require("../src/config/prisma");
|
||||
const jwt = require("jsonwebtoken");
|
||||
const bcrypt = require("bcrypt");
|
||||
const mailer = require("../src/config/mailer");
|
||||
|
||||
jest.mock("../src/config/mailer", () => ({ sendMail: jest.fn() }));
|
||||
|
||||
const DAY = 86400000;
|
||||
const PREFIX = "gain-";
|
||||
const CODES = ["GAINTICK01", "GAINTICK02", "GAINTICK03"];
|
||||
let ctx = {};
|
||||
|
||||
async function cleanup() {
|
||||
const us = await prisma.user.findMany({ where: { email: { contains: PREFIX } } });
|
||||
const ids = us.map((u) => u.id);
|
||||
const ps = await prisma.participation.findMany({ where: { userId: { in: ids } } });
|
||||
await prisma.claim.deleteMany({ where: { participationId: { in: ps.map((p) => p.id) } } });
|
||||
await prisma.participation.deleteMany({ where: { userId: { in: ids } } });
|
||||
await prisma.grandPrizeWinner.deleteMany({ where: { userId: { in: ids } } });
|
||||
await prisma.ticket.deleteMany({ where: { code: { in: CODES } } });
|
||||
await prisma.user.deleteMany({ where: { id: { in: ids } } });
|
||||
}
|
||||
|
||||
const tk = (u) => jwt.sign({ id: u.id, role: u.role }, process.env.JWT_SECRET, { expiresIn: "1h" });
|
||||
const jourJ = (d) =>
|
||||
prisma.gameSettings.update({
|
||||
where: { id: ctx.settingsId },
|
||||
data: { startDate: new Date(Date.now() - d * DAY) },
|
||||
});
|
||||
|
||||
beforeAll(async () => {
|
||||
await cleanup();
|
||||
const row = await prisma.gameSettings.findFirst({ orderBy: { id: "asc" } });
|
||||
ctx.settingsId = row.id;
|
||||
ctx.startDateOriginale = row.startDate;
|
||||
|
||||
ctx.lot = await prisma.lot.findFirst({ orderBy: { id: "asc" } });
|
||||
for (const c of CODES) await prisma.ticket.create({ data: { code: c, lotId: ctx.lot.id } });
|
||||
|
||||
const h = await bcrypt.hash("Password123", 10);
|
||||
ctx.client = await prisma.user.create({ data: { firstname: "Chloe", lastname: "Martin", email: PREFIX + "chloe@test.local", password: h, role: "CLIENT", isEmailVerified: true } });
|
||||
ctx.tClient = tk(ctx.client);
|
||||
|
||||
await jourJ(1);
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await prisma.gameSettings.update({ where: { id: ctx.settingsId }, data: { startDate: ctx.startDateOriginale } });
|
||||
await cleanup();
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
describe("Notification du gain a chaque participation", () => {
|
||||
beforeEach(() => jest.clearAllMocks());
|
||||
|
||||
test("le joueur recoit un email decrivant son lot", async () => {
|
||||
mailer.sendMail.mockResolvedValue(true);
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/game/participate")
|
||||
.set("Authorization", "Bearer " + ctx.tClient)
|
||||
.send({ code: CODES[0] })
|
||||
.expect(201);
|
||||
|
||||
expect(res.body.emailSent).toBe(true);
|
||||
expect(mailer.sendMail).toHaveBeenCalledTimes(1);
|
||||
|
||||
const envoi = mailer.sendMail.mock.calls[0][0];
|
||||
expect(envoi.to).toBe(ctx.client.email);
|
||||
expect(envoi.subject).toContain(ctx.lot.name);
|
||||
expect(envoi.html).toContain("Chloe");
|
||||
expect(envoi.html).toContain(CODES[0]);
|
||||
expect(envoi.html).toContain(ctx.lot.name);
|
||||
});
|
||||
|
||||
test("un SMTP en panne n annule pas la participation", async () => {
|
||||
mailer.sendMail.mockRejectedValue(new Error("SMTP indisponible"));
|
||||
|
||||
const res = await request(app)
|
||||
.post("/api/game/participate")
|
||||
.set("Authorization", "Bearer " + ctx.tClient)
|
||||
.send({ code: CODES[1] });
|
||||
|
||||
expect(res.status).toBe(201);
|
||||
expect(res.body.emailSent).toBe(false);
|
||||
|
||||
// Le gain reste acquis et consultable.
|
||||
const t = await prisma.ticket.findUnique({ where: { code: CODES[1] } });
|
||||
expect(t.isUsed).toBe(true);
|
||||
|
||||
const gains = await request(app).get("/api/game/my-gains").set("Authorization", "Bearer " + ctx.tClient).expect(200);
|
||||
expect(gains.body.gains.some((g) => g.ticketCode === CODES[1])).toBe(true);
|
||||
});
|
||||
|
||||
test("aucun email si le code est refuse", async () => {
|
||||
mailer.sendMail.mockResolvedValue(true);
|
||||
|
||||
const rejoue = await request(app).post("/api/game/participate").set("Authorization", "Bearer " + ctx.tClient).send({ code: CODES[0] });
|
||||
expect(rejoue.status).toBe(409);
|
||||
|
||||
const inconnu = await request(app).post("/api/game/participate").set("Authorization", "Bearer " + ctx.tClient).send({ code: "INEXISTAN1" });
|
||||
expect(inconnu.status).toBe(404);
|
||||
|
||||
await jourJ(45);
|
||||
const horsDelai = await request(app).post("/api/game/participate").set("Authorization", "Bearer " + ctx.tClient).send({ code: CODES[2] });
|
||||
expect(horsDelai.status).toBe(410);
|
||||
await jourJ(1);
|
||||
|
||||
expect(mailer.sendMail).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
163
backend/tests/gameFlow.test.js
Normal file
163
backend/tests/gameFlow.test.js
Normal file
@@ -0,0 +1,163 @@
|
||||
const request = require("supertest");
|
||||
const app = require("../src/app");
|
||||
const prisma = require("../src/config/prisma");
|
||||
const jwt = require("jsonwebtoken");
|
||||
const bcrypt = require("bcrypt");
|
||||
|
||||
jest.mock("../src/config/mailer", () => ({ sendMail: jest.fn().mockResolvedValue(true) }));
|
||||
|
||||
const emails = { adm: "v-adm@test.local", emp: "v-emp@test.local", a: "v-a@test.local", b: "v-b@test.local" };
|
||||
const CODES = ["VERIFTICK1", "VERIFTICK2", "VERIFTICK3", "VERIFTICK4", "VERIFTICK5"];
|
||||
const DAY = 86400000;
|
||||
let ctx = {};
|
||||
const log = (...a) => console.log(" ", ...a);
|
||||
|
||||
async function cleanup() {
|
||||
const us = await prisma.user.findMany({ where: { email: { in: [...Object.values(emails), "v-r1@test.local", "v-r2@test.local"] } } });
|
||||
const ids = us.map((u) => u.id);
|
||||
const ps = await prisma.participation.findMany({ where: { userId: { in: ids } } });
|
||||
await prisma.claim.deleteMany({ where: { participationId: { in: ps.map((p) => p.id) } } });
|
||||
await prisma.participation.deleteMany({ where: { userId: { in: ids } } });
|
||||
await prisma.grandPrizeWinner.deleteMany({ where: { userId: { in: ids } } });
|
||||
await prisma.ticket.deleteMany({ where: { code: { in: CODES } } });
|
||||
await prisma.user.deleteMany({ where: { id: { in: ids } } });
|
||||
}
|
||||
|
||||
const setStart = (d) =>
|
||||
prisma.gameSettings.update({ where: { id: ctx.settings.id }, data: { startDate: new Date(Date.now() - d * DAY) } });
|
||||
|
||||
beforeAll(async () => {
|
||||
await cleanup();
|
||||
ctx.settings = await prisma.gameSettings.findFirst({ orderBy: { id: "asc" } });
|
||||
ctx.orig = ctx.settings.startDate;
|
||||
const lot = await prisma.lot.findFirst({ orderBy: { id: "asc" } });
|
||||
for (const c of CODES) await prisma.ticket.create({ data: { code: c, lotId: lot.id } });
|
||||
const h = await bcrypt.hash("Password123", 10);
|
||||
const mk = (e, r) => prisma.user.create({ data: { firstname: "V", lastname: r, email: e, password: h, role: r, isEmailVerified: true } });
|
||||
ctx.adm = await mk(emails.adm, "ADMIN");
|
||||
ctx.emp = await mk(emails.emp, "EMPLOYEE");
|
||||
ctx.a = await mk(emails.a, "CLIENT");
|
||||
ctx.b = await mk(emails.b, "CLIENT");
|
||||
const tk = (u) => jwt.sign({ id: u.id, role: u.role }, process.env.JWT_SECRET, { expiresIn: "1h" });
|
||||
ctx.tadm = tk(ctx.adm);
|
||||
ctx.temp = tk(ctx.emp);
|
||||
ctx.ta = tk(ctx.a);
|
||||
ctx.tb = tk(ctx.b);
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await prisma.gameSettings.update({ where: { id: ctx.settings.id }, data: { startDate: ctx.orig } });
|
||||
await cleanup();
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
describe("VERIFICATION DES 7 CORRECTIFS", () => {
|
||||
test("#1 ADMIN peut lancer le jeu", async () => {
|
||||
const futur = new Date(Date.now() + 5 * DAY).toISOString();
|
||||
const r = await request(app).put("/api/admin/game-settings").set("Authorization", `Bearer ${ctx.tadm}`).send({ startDate: futur });
|
||||
log("PUT game-settings ->", r.status, r.body.message);
|
||||
expect(r.status).toBe(200);
|
||||
|
||||
const g = await request(app).get("/api/admin/game-settings").set("Authorization", `Bearer ${ctx.tadm}`).expect(200);
|
||||
log("GET game-settings -> participation ouverte :", g.body.gameWindow.isParticipationOpen, "(jeu pas encore commence)");
|
||||
|
||||
const bad = await request(app).put("/api/admin/game-settings").set("Authorization", `Bearer ${ctx.tadm}`).send({ startDate: "pas-une-date" });
|
||||
log("date invalide ->", bad.status, bad.body.message);
|
||||
expect(bad.status).toBe(400);
|
||||
|
||||
const nonAdmin = await request(app).put("/api/admin/game-settings").set("Authorization", `Bearer ${ctx.ta}`).send({ startDate: futur });
|
||||
log("client tente de lancer le jeu ->", nonAdmin.status);
|
||||
expect(nonAdmin.status).toBe(403);
|
||||
});
|
||||
|
||||
test("#2 participation refusee apres 30 jours", async () => {
|
||||
await setStart(45);
|
||||
const r = await request(app).post("/api/game/participate").set("Authorization", `Bearer ${ctx.ta}`).send({ code: CODES[0] });
|
||||
log("jour 45 ->", r.status, r.body.message);
|
||||
expect(r.status).toBe(410);
|
||||
|
||||
await setStart(1);
|
||||
const ok = await request(app).post("/api/game/participate").set("Authorization", `Bearer ${ctx.ta}`).send({ code: CODES[0] });
|
||||
log("jour 1 ->", ok.status, ok.body.message || "accepte");
|
||||
expect(ok.status).toBe(201);
|
||||
ctx.claimId = ok.body.claim.id;
|
||||
});
|
||||
|
||||
test("#3 expiration derivee et reversible", async () => {
|
||||
await setStart(70);
|
||||
const g1 = await request(app).get("/api/game/my-gains").set("Authorization", `Bearer ${ctx.ta}`).expect(200);
|
||||
log("jour 70, statut affiche :", g1.body.gains.map((g) => g.claimStatus).join(","));
|
||||
expect(g1.body.gains[0].claimStatus).toBe("CANCELLED");
|
||||
|
||||
const enBase = await prisma.claim.findUnique({ where: { id: ctx.claimId } });
|
||||
log("statut REEL en base :", enBase.status, "(non ecrase)");
|
||||
expect(enBase.status).toBe("PENDING");
|
||||
|
||||
await setStart(1);
|
||||
const g2 = await request(app).get("/api/game/my-gains").set("Authorization", `Bearer ${ctx.ta}`).expect(200);
|
||||
log("retour jour 1, statut :", g2.body.gains.map((g) => g.claimStatus).join(","), "(reversible)");
|
||||
expect(g2.body.gains[0].claimStatus).toBe("PENDING");
|
||||
});
|
||||
|
||||
test("#4 tirage refuse pendant le jeu", async () => {
|
||||
await setStart(1);
|
||||
const r = await request(app).post("/api/admin/draw").set("Authorization", `Bearer ${ctx.tadm}`);
|
||||
log("tirage pendant le jeu ->", r.status, r.body.message);
|
||||
expect(r.status).toBe(409);
|
||||
|
||||
await setStart(35);
|
||||
const r2 = await request(app).post("/api/admin/draw").set("Authorization", `Bearer ${ctx.tadm}`);
|
||||
log("tirage apres cloture ->", r2.status, r2.body.message, r2.body.totalEligibleParticipants ? `(${r2.body.totalEligibleParticipants} eligibles)` : "");
|
||||
expect(r2.status).toBe(201);
|
||||
|
||||
await prisma.grandPrizeWinner.deleteMany({ where: { userId: { in: [ctx.a.id, ctx.b.id] } } });
|
||||
await setStart(1);
|
||||
});
|
||||
|
||||
test("#5 admin et employe ne peuvent plus jouer", async () => {
|
||||
const r1 = await request(app).post("/api/game/participate").set("Authorization", `Bearer ${ctx.tadm}`).send({ code: CODES[1] });
|
||||
const r2 = await request(app).post("/api/game/participate").set("Authorization", `Bearer ${ctx.temp}`).send({ code: CODES[1] });
|
||||
log("ADMIN ->", r1.status, r1.body.message);
|
||||
log("EMPLOYE ->", r2.status, r2.body.message);
|
||||
expect(r1.status).toBe(403);
|
||||
expect(r2.status).toBe(403);
|
||||
|
||||
const t = await prisma.ticket.findUnique({ where: { code: CODES[1] } });
|
||||
log("le ticket reste vierge :", t.isUsed === false);
|
||||
expect(t.isUsed).toBe(false);
|
||||
});
|
||||
|
||||
test("#6 suppression de compte ne remet pas le ticket en jeu", async () => {
|
||||
await request(app).post("/api/game/participate").set("Authorization", `Bearer ${ctx.tb}`).send({ code: CODES[2] }).expect(201);
|
||||
await request(app).delete("/api/auth/account").set("Authorization", `Bearer ${ctx.tb}`).expect(200);
|
||||
|
||||
const t = await prisma.ticket.findUnique({ where: { code: CODES[2] } });
|
||||
log("apres suppression : isUsed =", t.isUsed, "| userId =", t.userId);
|
||||
expect(t.isUsed).toBe(true);
|
||||
|
||||
const rejoue = await request(app).post("/api/game/participate").set("Authorization", `Bearer ${ctx.ta}`).send({ code: CODES[2] });
|
||||
log("tentative de rejouer le code ->", rejoue.status, rejoue.body.message);
|
||||
expect(rejoue.status).toBe(409);
|
||||
});
|
||||
|
||||
test("#7 course sur un meme code", async () => {
|
||||
const h = await bcrypt.hash("Password123", 10);
|
||||
const c1 = await prisma.user.create({ data: { firstname: "R", lastname: "1", email: "v-r1@test.local", password: h, role: "CLIENT", isEmailVerified: true } });
|
||||
const c2 = await prisma.user.create({ data: { firstname: "R", lastname: "2", email: "v-r2@test.local", password: h, role: "CLIENT", isEmailVerified: true } });
|
||||
const t1 = jwt.sign({ id: c1.id, role: "CLIENT" }, process.env.JWT_SECRET, { expiresIn: "1h" });
|
||||
const t2 = jwt.sign({ id: c2.id, role: "CLIENT" }, process.env.JWT_SECRET, { expiresIn: "1h" });
|
||||
|
||||
const [r1, r2] = await Promise.all([
|
||||
request(app).post("/api/game/participate").set("Authorization", `Bearer ${t1}`).send({ code: CODES[3] }),
|
||||
request(app).post("/api/game/participate").set("Authorization", `Bearer ${t2}`).send({ code: CODES[3] }),
|
||||
]);
|
||||
|
||||
const codes = [r1.status, r2.status].sort();
|
||||
log("statuts obtenus :", codes.join(" + "), "(201 + 409 attendu, aucun 500)");
|
||||
expect(codes).toEqual([201, 409]);
|
||||
|
||||
const n = await prisma.participation.count({ where: { ticket: { code: CODES[3] } } });
|
||||
log("participations pour ce ticket :", n);
|
||||
expect(n).toBe(1);
|
||||
});
|
||||
});
|
||||
145
backend/tests/gamePhases.test.js
Normal file
145
backend/tests/gamePhases.test.js
Normal file
@@ -0,0 +1,145 @@
|
||||
const request = require("supertest");
|
||||
const app = require("../src/app");
|
||||
const prisma = require("../src/config/prisma");
|
||||
const jwt = require("jsonwebtoken");
|
||||
const bcrypt = require("bcrypt");
|
||||
|
||||
jest.mock("../src/config/mailer", () => ({ sendMail: jest.fn().mockResolvedValue(true) }));
|
||||
|
||||
const DAY = 86400000;
|
||||
const PREFIX = "r2-";
|
||||
const CODES = ["R2TICKET01", "R2TICKET02", "R2TICKET03", "R2TICKET04"];
|
||||
let ctx = {};
|
||||
const log = (...a) => console.log(" ", ...a);
|
||||
const titre = (t) => console.log("\n===== " + t + " =====");
|
||||
|
||||
async function cleanup() {
|
||||
const us = await prisma.user.findMany({ where: { email: { contains: PREFIX } } });
|
||||
const ids = us.map((u) => u.id);
|
||||
const ps = await prisma.participation.findMany({ where: { userId: { in: ids } } });
|
||||
await prisma.claim.deleteMany({ where: { participationId: { in: ps.map((p) => p.id) } } });
|
||||
await prisma.participation.deleteMany({ where: { userId: { in: ids } } });
|
||||
await prisma.grandPrizeWinner.deleteMany({ where: { userId: { in: ids } } });
|
||||
await prisma.ticket.deleteMany({ where: { code: { in: CODES } } });
|
||||
await prisma.user.deleteMany({ where: { id: { in: ids } } });
|
||||
}
|
||||
|
||||
async function jourJ(offsetJours) {
|
||||
const row = await prisma.gameSettings.findFirst({ orderBy: { id: "asc" } });
|
||||
const debut = new Date(Date.now() - offsetJours * DAY);
|
||||
if (row) await prisma.gameSettings.update({ where: { id: row.id }, data: { startDate: debut } });
|
||||
else await prisma.gameSettings.create({ data: { startDate: debut } });
|
||||
}
|
||||
|
||||
const tk = (u) => jwt.sign({ id: u.id, role: u.role }, process.env.JWT_SECRET, { expiresIn: "2h" });
|
||||
|
||||
beforeAll(async () => {
|
||||
await cleanup();
|
||||
const row = await prisma.gameSettings.findFirst({ orderBy: { id: "asc" } });
|
||||
ctx.startDateOriginale = row ? row.startDate : null;
|
||||
|
||||
const lot = await prisma.lot.findFirst({ orderBy: { id: "asc" } });
|
||||
for (const c of CODES) await prisma.ticket.create({ data: { code: c, lotId: lot.id } });
|
||||
|
||||
const h = await bcrypt.hash("Password123", 10);
|
||||
ctx.admin = await prisma.user.create({ data: { firstname: "Alice", lastname: "Admin", email: PREFIX + "admin@test.local", password: h, role: "ADMIN", isEmailVerified: true } });
|
||||
ctx.client = await prisma.user.create({ data: { firstname: "Zoe", lastname: "Cliente", email: PREFIX + "zoe@test.local", password: h, role: "CLIENT", isEmailVerified: true } });
|
||||
ctx.tAdmin = tk(ctx.admin);
|
||||
ctx.tClient = tk(ctx.client);
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
const row = await prisma.gameSettings.findFirst({ orderBy: { id: "asc" } });
|
||||
if (ctx.startDateOriginale) {
|
||||
if (row) await prisma.gameSettings.update({ where: { id: row.id }, data: { startDate: ctx.startDateOriginale } });
|
||||
else await prisma.gameSettings.create({ data: { startDate: ctx.startDateOriginale } });
|
||||
}
|
||||
await cleanup();
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
describe("VERIFICATION DES 3 CORRECTIFS DE PHASE", () => {
|
||||
|
||||
test("A. rien nest jouable avant tout lancement", async () => {
|
||||
titre("A : aucune GameSettings en base");
|
||||
await prisma.gameSettings.deleteMany({});
|
||||
|
||||
const vue = await request(app).get("/api/admin/game-settings").set("Authorization", "Bearer " + ctx.tAdmin).expect(200);
|
||||
log("phase :", vue.body.gameWindow.phase, "| participations ouvertes :", vue.body.gameWindow.isParticipationOpen);
|
||||
expect(vue.body.gameWindow.phase).toBe("NOT_CONFIGURED");
|
||||
|
||||
const essai = await request(app).post("/api/game/participate").set("Authorization", "Bearer " + ctx.tClient).send({ code: CODES[0] });
|
||||
log("un client tente de jouer ->", essai.status, essai.body.message);
|
||||
expect(essai.status).toBe(410);
|
||||
|
||||
const t = await prisma.ticket.findUnique({ where: { code: CODES[0] } });
|
||||
log("le ticket reste vierge :", t.isUsed === false);
|
||||
expect(t.isUsed).toBe(false);
|
||||
|
||||
const tirage = await request(app).post("/api/admin/draw").set("Authorization", "Bearer " + ctx.tAdmin);
|
||||
log("admin tente le tirage ->", tirage.status, tirage.body.message);
|
||||
expect(tirage.status).toBe(409);
|
||||
expect(await prisma.grandPrizeWinner.count()).toBe(0);
|
||||
});
|
||||
|
||||
test("B. jeu programme : message juste et tirage bloque", async () => {
|
||||
titre("B : lancement programme a J+7");
|
||||
const futur = new Date(Date.now() + 7 * DAY).toISOString();
|
||||
const r = await request(app).put("/api/admin/game-settings").set("Authorization", "Bearer " + ctx.tAdmin).send({ startDate: futur });
|
||||
log("PUT game-settings ->", r.status, "| phase :", r.body.gameWindow.phase);
|
||||
expect(r.body.gameWindow.phase).toBe("SCHEDULED");
|
||||
|
||||
const anticipe = await request(app).post("/api/game/participate").set("Authorization", "Bearer " + ctx.tClient).send({ code: CODES[0] });
|
||||
log("client joue avant ouverture ->", anticipe.status);
|
||||
log("message :", JSON.stringify(anticipe.body.message));
|
||||
expect(anticipe.body.message).toMatch(/ouvrira le/);
|
||||
expect(anticipe.body.message).not.toMatch(/terminée/);
|
||||
|
||||
const tirage = await request(app).post("/api/admin/draw").set("Authorization", "Bearer " + ctx.tAdmin);
|
||||
log("tirage avant ouverture ->", tirage.status, tirage.body.message);
|
||||
expect(tirage.status).toBe(409);
|
||||
expect(tirage.body.message).toMatch(/pas encore commencé/);
|
||||
});
|
||||
|
||||
test("C. les quatre phases dun jeu configure", async () => {
|
||||
titre("C : parcours des phases");
|
||||
|
||||
await jourJ(1);
|
||||
let w = (await request(app).get("/api/admin/game-settings").set("Authorization", "Bearer " + ctx.tAdmin)).body.gameWindow;
|
||||
const ok = await request(app).post("/api/game/participate").set("Authorization", "Bearer " + ctx.tClient).send({ code: CODES[0] });
|
||||
log("jour 1 | phase", w.phase, "| participate ->", ok.status);
|
||||
expect(w.phase).toBe("OPEN");
|
||||
expect(ok.status).toBe(201);
|
||||
ctx.claimId = ok.body.claim.id;
|
||||
|
||||
await jourJ(35);
|
||||
w = (await request(app).get("/api/admin/game-settings").set("Authorization", "Bearer " + ctx.tAdmin)).body.gameWindow;
|
||||
const tard = await request(app).post("/api/game/participate").set("Authorization", "Bearer " + ctx.tClient).send({ code: CODES[1] });
|
||||
log("jour 35 | phase", w.phase, "| participate ->", tard.status, JSON.stringify(tard.body.message));
|
||||
expect(w.phase).toBe("CLAIM_ONLY");
|
||||
expect(tard.body.message).toMatch(/participation est terminée/);
|
||||
|
||||
const tirage = await request(app).post("/api/admin/draw").set("Authorization", "Bearer " + ctx.tAdmin);
|
||||
log("tirage apres cloture ->", tirage.status, tirage.body.message);
|
||||
expect(tirage.status).toBe(201);
|
||||
|
||||
await jourJ(70);
|
||||
w = (await request(app).get("/api/admin/game-settings").set("Authorization", "Bearer " + ctx.tAdmin)).body.gameWindow;
|
||||
const fini = await request(app).post("/api/game/participate").set("Authorization", "Bearer " + ctx.tClient).send({ code: CODES[2] });
|
||||
log("jour 70 | phase", w.phase, "| participate ->", fini.status, JSON.stringify(fini.body.message));
|
||||
expect(w.phase).toBe("CLOSED");
|
||||
expect(fini.body.message).toMatch(/jeu-concours est terminé/);
|
||||
});
|
||||
|
||||
test("D. non-regression : le parcours nominal fonctionne toujours", async () => {
|
||||
titre("D : verification du parcours de base");
|
||||
await jourJ(2);
|
||||
const g = await request(app).get("/api/game/my-gains").set("Authorization", "Bearer " + ctx.tClient).expect(200);
|
||||
log("gains du client :", JSON.stringify(g.body.gains.map((x) => x.claimStatus)));
|
||||
expect(g.body.gains[0].claimStatus).toBe("PENDING");
|
||||
|
||||
const stats = await request(app).get("/api/admin/stats").set("Authorization", "Bearer " + ctx.tAdmin).expect(200);
|
||||
log("stats : phase =", stats.body.gameWindow.phase, "| participations =", stats.body.participations);
|
||||
expect(stats.body.gameWindow.phase).toBe("OPEN");
|
||||
});
|
||||
});
|
||||
142
backend/tests/googlePassword.test.js
Normal file
142
backend/tests/googlePassword.test.js
Normal file
@@ -0,0 +1,142 @@
|
||||
const request = require("supertest");
|
||||
const app = require("../src/app");
|
||||
const prisma = require("../src/config/prisma");
|
||||
const mailer = require("../src/config/mailer");
|
||||
const { passport, googleEnabled } = require("../src/config/passport");
|
||||
|
||||
jest.mock("../src/config/mailer", () => ({ sendMail: jest.fn() }));
|
||||
|
||||
const EMAIL = "google-pwd-test@test.local";
|
||||
const PROFILE = {
|
||||
id: "sim-google-id-123456",
|
||||
displayName: "Chloe Martin",
|
||||
name: { givenName: "Chloe", familyName: "Martin" },
|
||||
emails: [{ value: EMAIL }],
|
||||
photos: [{ value: "https://example.test/avatar.png" }],
|
||||
};
|
||||
|
||||
async function cleanup() {
|
||||
await prisma.user.deleteMany({ where: { email: EMAIL } });
|
||||
}
|
||||
|
||||
// Rejoue le callback de la strategie Google sans sortir sur le reseau.
|
||||
function verifierProfilGoogle() {
|
||||
const strategy = passport._strategy("google");
|
||||
return new Promise((resolve, reject) => {
|
||||
strategy._verify("access-token", "refresh-token", PROFILE, (err, user) => {
|
||||
if (err) reject(err);
|
||||
else resolve(user);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
beforeAll(cleanup);
|
||||
afterAll(async () => {
|
||||
await cleanup();
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
const decrire = googleEnabled ? describe : describe.skip;
|
||||
|
||||
decrire("Inscription Google et definition du mot de passe", () => {
|
||||
beforeEach(() => jest.clearAllMocks());
|
||||
|
||||
test("un compte Google est cree sans mot de passe et recoit un lien", async () => {
|
||||
mailer.sendMail.mockResolvedValue(true);
|
||||
|
||||
const user = await verifierProfilGoogle();
|
||||
|
||||
expect(user.provider).toBe("GOOGLE");
|
||||
expect(user.password).toBeNull();
|
||||
expect(user.isEmailVerified).toBe(true);
|
||||
|
||||
expect(mailer.sendMail).toHaveBeenCalledTimes(1);
|
||||
const envoi = mailer.sendMail.mock.calls[0][0];
|
||||
expect(envoi.to).toBe(EMAIL);
|
||||
expect(envoi.subject).toMatch(/mot de passe/i);
|
||||
|
||||
// Le lien doit viser le formulaire du front, pas la route POST de l API.
|
||||
const frontendUrl = process.env.FRONTEND_URL || "http://localhost:5173";
|
||||
expect(envoi.html).toContain(`${frontendUrl}/definir-mot-de-passe/`);
|
||||
|
||||
const enBase = await prisma.user.findUnique({ where: { email: EMAIL } });
|
||||
expect(enBase.resetPasswordToken).toHaveLength(64);
|
||||
expect(enBase.resetPasswordExpires.getTime()).toBeGreaterThan(Date.now());
|
||||
ctxToken = enBase.resetPasswordToken;
|
||||
});
|
||||
|
||||
test("le profil signale que le compte n a pas de mot de passe", async () => {
|
||||
const jwt = require("jsonwebtoken");
|
||||
const u = await prisma.user.findUnique({ where: { email: EMAIL } });
|
||||
const token = jwt.sign({ id: u.id, role: u.role }, process.env.JWT_SECRET, { expiresIn: "1h" });
|
||||
|
||||
const res = await request(app).get("/api/auth/me").set("Authorization", "Bearer " + token).expect(200);
|
||||
|
||||
expect(res.body.user.hasPassword).toBe(false);
|
||||
expect(res.body.user.provider).toBe("GOOGLE");
|
||||
// Le hash ne doit jamais sortir de l API.
|
||||
expect(res.body.user.password).toBeUndefined();
|
||||
});
|
||||
|
||||
test("la connexion par mot de passe est refusee tant qu il n en existe pas", async () => {
|
||||
const res = await request(app).post("/api/auth/login").send({ email: EMAIL, password: "PeuImporte123" });
|
||||
expect(res.status).toBe(401);
|
||||
expect(res.body.message).toMatch(/connexion Google/);
|
||||
});
|
||||
|
||||
test("une confirmation qui ne correspond pas est refusee", async () => {
|
||||
const res = await request(app)
|
||||
.post("/api/auth/reset-password/" + ctxToken)
|
||||
.send({ password: "MonMotDePasse1", confirmPassword: "AutreMotDePasse2" });
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.message).toMatch(/ne correspondent pas/);
|
||||
|
||||
const u = await prisma.user.findUnique({ where: { email: EMAIL } });
|
||||
expect(u.password).toBeNull();
|
||||
});
|
||||
|
||||
test("un mot de passe trop court est refuse", async () => {
|
||||
const res = await request(app)
|
||||
.post("/api/auth/reset-password/" + ctxToken)
|
||||
.send({ password: "court", confirmPassword: "court" });
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.message).toMatch(/8 caractères/);
|
||||
});
|
||||
|
||||
test("le mot de passe defini permet ensuite de se connecter et de le changer", async () => {
|
||||
const ok = await request(app)
|
||||
.post("/api/auth/reset-password/" + ctxToken)
|
||||
.send({ password: "MonMotDePasse1", confirmPassword: "MonMotDePasse1" })
|
||||
.expect(200);
|
||||
expect(ok.body.message).toMatch(/réinitialisé/);
|
||||
|
||||
const login = await request(app).post("/api/auth/login").send({ email: EMAIL, password: "MonMotDePasse1" }).expect(200);
|
||||
expect(login.body.token).toBeDefined();
|
||||
|
||||
// Le jeton a bien ete consomme.
|
||||
const u = await prisma.user.findUnique({ where: { email: EMAIL } });
|
||||
expect(u.resetPasswordToken).toBeNull();
|
||||
|
||||
const me = await request(app).get("/api/auth/me").set("Authorization", "Bearer " + login.body.token).expect(200);
|
||||
expect(me.body.user.hasPassword).toBe(true);
|
||||
|
||||
const change = await request(app)
|
||||
.patch("/api/auth/change-password")
|
||||
.set("Authorization", "Bearer " + login.body.token)
|
||||
.send({ currentPassword: "MonMotDePasse1", newPassword: "EncoreUnAutre2" });
|
||||
expect(change.status).toBe(200);
|
||||
});
|
||||
|
||||
test("une seconde connexion Google ne renvoie pas de nouveau lien", async () => {
|
||||
mailer.sendMail.mockResolvedValue(true);
|
||||
|
||||
const user = await verifierProfilGoogle();
|
||||
|
||||
expect(user.email).toBe(EMAIL);
|
||||
expect(mailer.sendMail).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
let ctxToken;
|
||||
66
backend/tests/register.mail.test.js
Normal file
66
backend/tests/register.mail.test.js
Normal file
@@ -0,0 +1,66 @@
|
||||
const request = require("supertest");
|
||||
const app = require("../src/app");
|
||||
const prisma = require("../src/config/prisma");
|
||||
const mailer = require("../src/config/mailer");
|
||||
|
||||
jest.mock("../src/config/mailer", () => ({
|
||||
sendMail: jest.fn(),
|
||||
}));
|
||||
|
||||
// Comme le reste de la suite, ce fichier tourne sur la base de dev : il ne
|
||||
// touche qu'au compte qu'il crée lui-même, identifié par cet email.
|
||||
const testEmail = "rollback-mail-test@test.com";
|
||||
|
||||
const payload = {
|
||||
firstname: "Camille",
|
||||
lastname: "Martin",
|
||||
email: testEmail,
|
||||
password: "Password123",
|
||||
birthdate: "1990-05-14",
|
||||
gender: "Femme",
|
||||
};
|
||||
|
||||
beforeEach(async () => {
|
||||
jest.clearAllMocks();
|
||||
await prisma.user.deleteMany({ where: { email: testEmail } });
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await prisma.user.deleteMany({ where: { email: testEmail } });
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
|
||||
describe("Inscription - echec d'envoi du code de validation", () => {
|
||||
test("repond 502 et ne laisse aucun compte orphelin", async () => {
|
||||
mailer.sendMail.mockRejectedValue(new Error("SMTP indisponible"));
|
||||
|
||||
const res = await request(app).post("/api/auth/register").send(payload);
|
||||
|
||||
expect(res.statusCode).toBe(502);
|
||||
|
||||
const user = await prisma.user.findUnique({ where: { email: testEmail } });
|
||||
expect(user).toBeNull();
|
||||
});
|
||||
|
||||
test("l'email reste reutilisable apres un echec d'envoi", async () => {
|
||||
mailer.sendMail.mockRejectedValueOnce(new Error("SMTP indisponible"));
|
||||
const echec = await request(app).post("/api/auth/register").send(payload);
|
||||
expect(echec.statusCode).toBe(502);
|
||||
|
||||
mailer.sendMail.mockResolvedValue(true);
|
||||
const succes = await request(app).post("/api/auth/register").send(payload);
|
||||
|
||||
expect(succes.statusCode).toBe(201);
|
||||
});
|
||||
|
||||
test("enregistre la date de naissance et le genre", async () => {
|
||||
mailer.sendMail.mockResolvedValue(true);
|
||||
|
||||
const res = await request(app).post("/api/auth/register").send(payload);
|
||||
expect(res.statusCode).toBe(201);
|
||||
|
||||
const user = await prisma.user.findUnique({ where: { email: testEmail } });
|
||||
expect(user.gender).toBe("Femme");
|
||||
expect(user.birthdate.toISOString()).toBe("1990-05-14T00:00:00.000Z");
|
||||
});
|
||||
});
|
||||
@@ -1,31 +0,0 @@
|
||||
const prisma = require("../src/config/prisma");
|
||||
|
||||
beforeAll(async () => {
|
||||
await prisma.claim.deleteMany();
|
||||
await prisma.participation.deleteMany();
|
||||
await prisma.ticket.deleteMany();
|
||||
await prisma.user.deleteMany();
|
||||
|
||||
// Création de lots
|
||||
await prisma.lot.createMany({
|
||||
data: [
|
||||
{ name: "Infuseur", value: 10, percentage: 60, description: "Infuseur à thé" },
|
||||
{ name: "Thé Détox", value: 15, percentage: 20, description: "Thé détox bio" },
|
||||
{ name: "Thé Signature", value: 20, percentage: 10, description: "Thé signature" },
|
||||
{ name: "Coffret 39€", value: 39, percentage: 6, description: "Coffret découverte" },
|
||||
{ name: "Coffret 69€", value: 69, percentage: 4, description: "Coffret premium" },
|
||||
]
|
||||
});
|
||||
|
||||
// Création d'un ticket
|
||||
await prisma.ticket.create({
|
||||
data: {
|
||||
code: "ABC123",
|
||||
lotId: 1
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
afterAll(async () => {
|
||||
await prisma.$disconnect();
|
||||
});
|
||||
Reference in New Issue
Block a user