Logout users without 2FA when mandatory 2fa is enabled

Fixes #803

src/test/settings-test.js

@@ -7,10 +7,11 @@
 
 const common = require('./common.js'),
     expect = require('expect.js'),
-    settings = require('../settings.js');
+    settings = require('../settings.js'),
+    tokens = require('../tokens.js');
 
 describe('Settings', function () {
-    const { setup, cleanup } = common;
+    const { setup, cleanup, admin } = common;
 
     before(setup);
     after(cleanup);
@@ -53,6 +54,22 @@ describe('Settings', function () {
         expect(enabled).to.be(false);
     });
 
+    it('can get default directory config', async function () {
+        const directoryConfig = await settings.getDirectoryConfig();
+        expect(directoryConfig.lockUserProfiles).to.be(false);
+        expect(directoryConfig.mandatory2FA).to.be(false);
+    });
+
+    it('can set default directory config', async function () {
+        await tokens.add({ name: 'token1', identifier: admin.id, clientId: tokens.ID_WEBADMIN, expires: Number.MAX_SAFE_INTEGER, lastUsedTime: null, scope: 'unused' });
+        let result = await tokens.listByUserId(admin.id);
+        expect(result.length).to.be(1); // just confirm the token was really added!
+
+        await settings.setDirectoryConfig({ mandatory2FA: true, lockUserProfiles: true });
+        result = await tokens.listByUserId(admin.id);
+        expect(result.length).to.be(0); // should have been removed by mandatory 2fa setting change
+    });
+
     it('can get all values', async function () {
         const allSettings = await settings.list();
         expect(allSettings[settings.TIME_ZONE_KEY]).to.be.a('string');

src/test/tokens-test.js

@@ -119,4 +119,34 @@ describe('Tokens', function () {
         result = await tokens.getByAccessToken(token1.accessToken);
         expect(result).to.eql(token1);
     });
+
+    it('delByUserIdAndType succeeds', async function () {
+        const token1 = {
+            name: 'token1',
+            identifier: 'user1',
+            clientId: tokens.ID_WEBADMIN,
+            expires: Number.MAX_SAFE_INTEGER,
+            lastUsedTime: null,
+            scope: 'unused'
+        };
+        const token2 = {
+            name: 'token2',
+            identifier: 'user1',
+            clientId: tokens.ID_SDK,
+            expires: Date.now(),
+            lastUsedTime: null
+        };
+
+        await tokens.add(token1);
+        await tokens.add(token2);
+
+        await tokens.delByUserIdAndType('user2', tokens.ID_WEBADMIN);
+        let result = await tokens.listByUserId('user1');
+        expect(result.length).to.be(2); // should not have deleted user1 tokens
+
+        await tokens.delByUserIdAndType('user1', tokens.ID_WEBADMIN);
+        result = await tokens.listByUserId('user1');
+        expect(result.length).to.be(1);
+        expect(result[0].name).to.be(token2.name);
+    });
 });