appPassword: add expiry

src/routes/apppasswords.js

@@ -31,8 +31,9 @@ async function add(req, res, next) {
 
     if (typeof req.body.name !== 'string') return next(new HttpError(400, 'name must be string'));
     if (typeof req.body.identifier !== 'string') return next(new HttpError(400, 'identifier must be string'));
+    if (req.body.expiresAt !== null && (typeof req.body.expiresAt !== 'string' || isNaN(new Date(req.body.expiresAt).getTime()))) return next(new HttpError(400, 'expiresAt must be null or a valid date string'));
 
-    const [error, result] = await safe(appPasswords.add(req.user.id, req.body.identifier, req.body.name));
+    const [error, result] = await safe(appPasswords.add(req.user.id, req.body.identifier, req.body.name, req.body.expiresAt));
     if (error) return next(BoxError.toHttpError(error));
 
     next(new HttpSuccess(201, { id: result.id, password: result.password }));
@@ -41,11 +42,10 @@ async function add(req, res, next) {
 async function list(req, res, next) {
     assert.strictEqual(typeof req.user, 'object');
 
-    let [error, result] = await safe(appPasswords.list(req.user.id));
+    const [error, result] = await safe(appPasswords.list(req.user.id));
     if (error) return next(BoxError.toHttpError(error));
 
-    result = result.map(appPasswords.removePrivateFields);
-    next(new HttpSuccess(200, { appPasswords: result }));
+    next(new HttpSuccess(200, { appPasswords: result.map(appPasswords.removePrivateFields) }));
 }
 
 async function del(req, res, next) {

src/routes/test/apppasswords-test.js

@@ -29,7 +29,34 @@ describe('App Passwords', function () {
         it('cannot add app password without name', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/app_passwords`)
                 .query({ access_token: user.token })
-                .send({ identifier: 'someapp' })
+                .send({ identifier: 'someapp', expiresAt: null })
+                .ok(() => true);
+
+            expect(response.status).to.equal(400);
+        });
+
+        it('cannot add app password without expiresAt', async function () {
+            const response = await superagent.post(`${serverUrl}/api/v1/app_passwords`)
+                .query({ access_token: user.token })
+                .send({ name: 'my-device', identifier: 'someapp' })
+                .ok(() => true);
+
+            expect(response.status).to.equal(400);
+        });
+
+        it('cannot add app password with invalid expiresAt type', async function () {
+            const response = await superagent.post(`${serverUrl}/api/v1/app_passwords`)
+                .query({ access_token: user.token })
+                .send({ name: 'my-device', identifier: 'someapp', expiresAt: 12345 })
+                .ok(() => true);
+
+            expect(response.status).to.equal(400);
+        });
+
+        it('cannot add app password with invalid expiresAt date', async function () {
+            const response = await superagent.post(`${serverUrl}/api/v1/app_passwords`)
+                .query({ access_token: user.token })
+                .send({ name: 'my-device', identifier: 'someapp', expiresAt: 'not-a-date' })
                 .ok(() => true);
 
             expect(response.status).to.equal(400);
@@ -39,24 +66,36 @@ describe('App Passwords', function () {
         it('can add app password', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/app_passwords`)
                 .query({ access_token: user.token })
-                .send({ name: 'my-device', identifier: 'someapp' });
+                .send({ name: 'my-device', identifier: 'someapp', expiresAt: null });
 
             expect(response.status).to.equal(201);
             expect(response.body.password).to.be.a('string');
             pwd = response.body;
         });
 
+        it('can add app password with expiresAt', async function () {
+            const response = await superagent.post(`${serverUrl}/api/v1/app_passwords`)
+                .query({ access_token: user.token })
+                .send({ name: 'expiring-device', identifier: 'someapp', expiresAt: new Date(Date.now() + 86400000).toISOString() });
+
+            expect(response.status).to.equal(201);
+            expect(response.body.password).to.be.a('string');
+        });
+
         it('can get app passwords', async function () {
             const response = await superagent.get(`${serverUrl}/api/v1/app_passwords`)
                 .query({ access_token: user.token });
 
             expect(response.status).to.equal(200);
             expect(response.body.appPasswords).to.be.an(Array);
-            expect(response.body.appPasswords.length).to.be(1);
+            expect(response.body.appPasswords.length).to.be(2);
             expect(response.body.appPasswords[0].name).to.be('my-device');
             expect(response.body.appPasswords[0].identifier).to.be('someapp');
+            expect(response.body.appPasswords[0].expiresAt).to.be(null);
             expect(response.body.appPasswords[0].hashedPassword).to.be(undefined);
             expect(response.body.appPasswords[0].password).to.be(undefined);
+            expect(response.body.appPasswords[1].name).to.be('expiring-device');
+            expect(response.body.appPasswords[1].expiresAt).to.be.a('string');
         });
 
         it('can get app password', async function () {
@@ -66,6 +105,7 @@ describe('App Passwords', function () {
             expect(response.status).to.equal(200);
             expect(response.body.name).to.be('my-device');
             expect(response.body.identifier).to.be('someapp');
+            expect(response.body.expiresAt).to.be(null);
             expect(response.body.hashedPassword).to.be(undefined);
             expect(response.body.password).to.be(undefined);
         });