refactor: server auth e2e (#7203)

.github/workflows/test.yml

@@ -227,12 +227,35 @@ jobs:
         run: npx playwright install --with-deps
 
       - name: Docker build
-        run: docker compose -f docker/docker-compose.e2e.yml build
-        working-directory: ./
+        run: docker compose build
 
       - name: Run e2e tests
         run: npx playwright test
 
+  api-e2e-tests:
+    name: API (e2e)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./e2e
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run setup typescript-sdk
+        run: npm ci && npm run build
+        working-directory: ./open-api/typescript-sdk
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Docker build
+        run: docker compose build
+
+      - name: Run e2e tests
+        run: npm run test:api
+
   mobile-unit-tests:
     name: Mobile
     runs-on: ubuntu-latest

e2e/docker-compose.yml

@@ -30,19 +30,18 @@ services:
     command: [ "./start.sh", "microservices" ]
     <<: *server-common
 
-
   redis:
     image: redis:6.2-alpine@sha256:51d6c56749a4243096327e3fb964a48ed92254357108449cb6e23999c37773c5
-    restart: always
 
   database:
     image: tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
+    command: -c fsync=off -c shared_preload_libraries=vectors.so
     environment:
       POSTGRES_PASSWORD: postgres
       POSTGRES_USER: postgres
       POSTGRES_DB: immich
     ports:
-      - 5432:5432
+      - 5433:5432
 
 volumes:
   model-cache:

e2e/package.json

@@ -5,8 +5,8 @@
   "main": "index.js",
   "type": "module",
   "scripts": {
-    "test": "npx playwright test",
-    "build": "tsc"
+    "test:web": "npx playwright test",
+    "test:api": "vitest"
   },
   "keywords": [],
   "author": "",
@@ -16,7 +16,11 @@
     "@playwright/test": "^1.41.2",
     "@types/node": "^20.11.17",
     "@types/pg": "^8.11.0",
+    "@types/supertest": "^6.0.2",
+    "@vitest/coverage-v8": "^1.3.0",
     "pg": "^8.11.3",
-    "typescript": "^5.3.3"
+    "supertest": "^6.3.4",
+    "typescript": "^5.3.3",
+    "vitest": "^1.3.0"
   }
 }

e2e/playwright.config.ts

@@ -1,7 +1,7 @@
 import { defineConfig, devices } from '@playwright/test';
 
 export default defineConfig({
-  testDir: './specs/',
+  testDir: './src/web/specs',
   fullyParallel: false,
   forbidOnly: !!process.env.CI,
   retries: process.env.CI ? 2 : 0,
@@ -53,8 +53,7 @@ export default defineConfig({
 
   /* Run your local dev server before starting the tests */
   webServer: {
-    command:
-      'docker compose -f ../docker/docker-compose.e2e.yml up --build -V --remove-orphans',
+    command: 'docker compose up --build -V --remove-orphans',
     url: 'http://127.0.0.1:2283',
     reuseExistingServer: true,
   },

e2e/src/api/setup.ts

@@ -0,0 +1,26 @@
+import { spawn, exec } from 'child_process';
+
+export default async () => {
+  let _resolve: () => unknown;
+  const promise = new Promise<void>((resolve, reject) => (_resolve = resolve));
+
+  const child = spawn('docker', ['compose', 'up'], { stdio: 'pipe' });
+
+  child.stdout.on('data', (data) => {
+    const input = data.toString();
+    console.log(input);
+    if (input.includes('Immich Server is listening')) {
+      _resolve();
+    }
+  });
+
+  child.stderr.on('data', (data) => console.log(data.toString()));
+
+  await promise;
+
+  return async () => {
+    await new Promise<void>((resolve) =>
+      exec('docker compose down', () => resolve())
+    );
+  };
+};

e2e/src/api/specs/auth.e2e-spec.ts

@@ -0,0 +1,291 @@
+import {
+  LoginResponseDto,
+  getAuthDevices,
+  login,
+  signUpAdmin,
+} from '@immich/sdk';
+import { loginDto, signupDto, uuidDto } from 'src/fixtures';
+import {
+  deviceDto,
+  errorDto,
+  loginResponseDto,
+  signupResponseDto,
+} from 'src/responses';
+import { app, asAuthHeader, dbUtils } from 'src/utils';
+import request from 'supertest';
+import { beforeAll, beforeEach, describe, expect, it } from 'vitest';
+
+const { name, email, password } = signupDto.admin;
+
+describe(`Registration`, () => {
+  beforeAll(() => {
+    dbUtils.setup();
+  });
+
+  beforeEach(async () => {
+    await dbUtils.reset();
+  });
+
+  describe('POST /auth/admin-sign-up', () => {
+    const invalid = [
+      {
+        should: 'require an email address',
+        data: { name, password },
+      },
+      {
+        should: 'require a password',
+        data: { name, email },
+      },
+      {
+        should: 'require a name',
+        data: { email, password },
+      },
+      {
+        should: 'require a valid email',
+        data: { name, email: 'immich', password },
+      },
+    ];
+
+    for (const { should, data } of invalid) {
+      it(`should ${should}`, async () => {
+        const { status, body } = await request(app)
+          .post('/auth/admin-sign-up')
+          .send(data);
+        expect(status).toEqual(400);
+        expect(body).toEqual(errorDto.badRequest());
+      });
+    }
+
+    it(`should sign up the admin`, async () => {
+      const { status, body } = await request(app)
+        .post('/auth/admin-sign-up')
+        .send(signupDto.admin);
+      expect(status).toBe(201);
+      expect(body).toEqual(signupResponseDto.admin);
+    });
+
+    it('should sign up the admin with a local domain', async () => {
+      const { status, body } = await request(app)
+        .post('/auth/admin-sign-up')
+        .send({ ...signupDto.admin, email: 'admin@local' });
+      expect(status).toEqual(201);
+      expect(body).toEqual({
+        ...signupResponseDto.admin,
+        email: 'admin@local',
+      });
+    });
+
+    it('should transform email to lower case', async () => {
+      const { status, body } = await request(app)
+        .post('/auth/admin-sign-up')
+        .send({ ...signupDto.admin, email: 'aDmIn@IMMICH.cloud' });
+      expect(status).toEqual(201);
+      expect(body).toEqual(signupResponseDto.admin);
+    });
+
+    it('should not allow a second admin to sign up', async () => {
+      await signUpAdmin({ signUpDto: signupDto.admin });
+
+      const { status, body } = await request(app)
+        .post('/auth/admin-sign-up')
+        .send(signupDto.admin);
+
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.alreadyHasAdmin);
+    });
+  });
+});
+
+describe('Auth', () => {
+  let admin: LoginResponseDto;
+
+  beforeEach(async () => {
+    await dbUtils.reset();
+    await signUpAdmin({ signUpDto: signupDto.admin });
+    admin = await login({ loginCredentialDto: loginDto.admin });
+  });
+
+  describe(`POST /auth/login`, () => {
+    it('should reject an incorrect password', async () => {
+      const { status, body } = await request(app)
+        .post('/auth/login')
+        .send({ email, password: 'incorrect' });
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.incorrectLogin);
+    });
+
+    for (const key of Object.keys(loginDto.admin)) {
+      it(`should not allow null ${key}`, async () => {
+        const { status, body } = await request(app)
+          .post('/auth/login')
+          .send({ ...loginDto.admin, [key]: null });
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest());
+      });
+    }
+
+    it('should accept a correct password', async () => {
+      const { status, body, headers } = await request(app)
+        .post('/auth/login')
+        .send({ email, password });
+      expect(status).toBe(201);
+      expect(body).toEqual(loginResponseDto.admin);
+
+      const token = body.accessToken;
+      expect(token).toBeDefined();
+
+      const cookies = headers['set-cookie'];
+      expect(cookies).toHaveLength(3);
+      expect(cookies[0]).toEqual(
+        `immich_access_token=${token}; HttpOnly; Path=/; Max-Age=34560000; SameSite=Lax;`
+      );
+      expect(cookies[1]).toEqual(
+        'immich_auth_type=password; HttpOnly; Path=/; Max-Age=34560000; SameSite=Lax;'
+      );
+      expect(cookies[2]).toEqual(
+        'immich_is_authenticated=true; Path=/; Max-Age=34560000; SameSite=Lax;'
+      );
+    });
+  });
+
+  describe('GET /auth/devices', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/auth/devices');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should get a list of authorized devices', async () => {
+      const { status, body } = await request(app)
+        .get('/auth/devices')
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toEqual([deviceDto.current]);
+    });
+  });
+
+  describe('DELETE /auth/devices', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).delete(`/auth/devices`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should logout all devices (except the current one)', async () => {
+      for (let i = 0; i < 5; i++) {
+        await login({ loginCredentialDto: loginDto.admin });
+      }
+
+      await expect(
+        getAuthDevices({ headers: asAuthHeader(admin.accessToken) })
+      ).resolves.toHaveLength(6);
+
+      const { status } = await request(app)
+        .delete(`/auth/devices`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(204);
+
+      await expect(
+        getAuthDevices({ headers: asAuthHeader(admin.accessToken) })
+      ).resolves.toHaveLength(1);
+    });
+
+    it('should throw an error for a non-existent device id', async () => {
+      const { status, body } = await request(app)
+        .delete(`/auth/devices/${uuidDto.notFound}`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(400);
+      expect(body).toEqual(
+        errorDto.badRequest('Not found or no authDevice.delete access')
+      );
+    });
+
+    it('should logout a device', async () => {
+      const [device] = await getAuthDevices({
+        headers: asAuthHeader(admin.accessToken),
+      });
+      const { status } = await request(app)
+        .delete(`/auth/devices/${device.id}`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(204);
+
+      const response = await request(app)
+        .post('/auth/validateToken')
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(response.body).toEqual(errorDto.invalidToken);
+      expect(response.status).toBe(401);
+    });
+  });
+
+  describe('POST /auth/validateToken', () => {
+    it('should reject an invalid token', async () => {
+      const { status, body } = await request(app)
+        .post(`/auth/validateToken`)
+        .set('Authorization', 'Bearer 123');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.invalidToken);
+    });
+
+    it('should accept a valid token', async () => {
+      const { status, body } = await request(app)
+        .post(`/auth/validateToken`)
+        .send({})
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toEqual({ authStatus: true });
+    });
+  });
+
+  describe('POST /auth/change-password', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app)
+        .post(`/auth/change-password`)
+        .send({ password, newPassword: 'Password1234' });
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should require the current password', async () => {
+      const { status, body } = await request(app)
+        .post(`/auth/change-password`)
+        .send({ password: 'wrong-password', newPassword: 'Password1234' })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.wrongPassword);
+    });
+
+    it('should change the password', async () => {
+      const { status } = await request(app)
+        .post(`/auth/change-password`)
+        .send({ password, newPassword: 'Password1234' })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+
+      await login({
+        loginCredentialDto: {
+          email: 'admin@immich.cloud',
+          password: 'Password1234',
+        },
+      });
+    });
+  });
+
+  describe('POST /auth/logout', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post(`/auth/logout`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should logout the user', async () => {
+      const { status, body } = await request(app)
+        .post(`/auth/logout`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        successful: true,
+        redirectUri: '/auth/login?autoLaunch=0',
+      });
+    });
+  });
+});

e2e/src/fixtures.ts

@@ -0,0 +1,19 @@
+export const uuidDto = {
+  invalid: 'invalid-uuid',
+  // valid uuid v4
+  notFound: '00000000-0000-4000-a000-000000000000',
+};
+
+const adminLoginDto = {
+  email: 'admin@immich.cloud',
+  password: 'password',
+};
+const adminSignupDto = { ...adminLoginDto, name: 'Immich Admin' };
+
+export const loginDto = {
+  admin: adminLoginDto,
+};
+
+export const signupDto = {
+  admin: adminSignupDto,
+};

e2e/src/responses.ts

@@ -0,0 +1,103 @@
+import { expect } from 'vitest';
+
+export const errorDto = {
+  unauthorized: {
+    error: 'Unauthorized',
+    statusCode: 401,
+    message: 'Authentication required',
+  },
+  forbidden: {
+    error: 'Forbidden',
+    statusCode: 403,
+    message: expect.any(String),
+  },
+  wrongPassword: {
+    error: 'Bad Request',
+    statusCode: 400,
+    message: 'Wrong password',
+  },
+  invalidToken: {
+    error: 'Unauthorized',
+    statusCode: 401,
+    message: 'Invalid user token',
+  },
+  invalidShareKey: {
+    error: 'Unauthorized',
+    statusCode: 401,
+    message: 'Invalid share key',
+  },
+  invalidSharePassword: {
+    error: 'Unauthorized',
+    statusCode: 401,
+    message: 'Invalid password',
+  },
+  badRequest: (message: any = null) => ({
+    error: 'Bad Request',
+    statusCode: 400,
+    message: message ?? expect.anything(),
+  }),
+  noPermission: {
+    error: 'Bad Request',
+    statusCode: 400,
+    message: expect.stringContaining('Not found or no'),
+  },
+  incorrectLogin: {
+    error: 'Unauthorized',
+    statusCode: 401,
+    message: 'Incorrect email or password',
+  },
+  alreadyHasAdmin: {
+    error: 'Bad Request',
+    statusCode: 400,
+    message: 'The server already has an admin',
+  },
+  noDeleteUploadLibrary: {
+    error: 'Bad Request',
+    statusCode: 400,
+    message: 'Cannot delete the last upload library',
+  },
+};
+
+export const signupResponseDto = {
+  admin: {
+    avatarColor: expect.any(String),
+    id: expect.any(String),
+    name: 'Immich Admin',
+    email: 'admin@immich.cloud',
+    storageLabel: 'admin',
+    externalPath: null,
+    profileImagePath: '',
+    // why? lol
+    shouldChangePassword: true,
+    isAdmin: true,
+    createdAt: expect.any(String),
+    updatedAt: expect.any(String),
+    deletedAt: null,
+    oauthId: '',
+    memoriesEnabled: true,
+    quotaUsageInBytes: 0,
+    quotaSizeInBytes: null,
+  },
+};
+
+export const loginResponseDto = {
+  admin: {
+    accessToken: expect.any(String),
+    name: 'Immich Admin',
+    isAdmin: true,
+    profileImagePath: '',
+    shouldChangePassword: true,
+    userEmail: 'admin@immich.cloud',
+    userId: expect.any(String),
+  },
+};
+export const deviceDto = {
+  current: {
+    id: expect.any(String),
+    createdAt: expect.any(String),
+    updatedAt: expect.any(String),
+    current: true,
+    deviceOS: '',
+    deviceType: '',
+  },
+};

e2e/src/utils.ts

@@ -1,30 +1,70 @@
-import pg from 'pg';
-import { defaults, login, setAdminOnboarding, signUpAdmin } from '@immich/sdk';
+import {
+  LoginResponseDto,
+  defaults,
+  login,
+  setAdminOnboarding,
+  signUpAdmin,
+} from '@immich/sdk';
 import { BrowserContext } from '@playwright/test';
+import pg from 'pg';
+import { loginDto, signupDto } from 'src/fixtures';
 
-const client = new pg.Client(
-  'postgres://postgres:postgres@localhost:5432/immich'
-);
-let connected = false;
+export const app = 'http://127.0.0.1:2283/api';
 
-const loginCredentialDto = {
-  email: 'admin@immich.cloud',
-  password: 'password',
-};
-const signUpDto = { ...loginCredentialDto, name: 'Immich Admin' };
+defaults.baseUrl = app;
 
-const setBaseUrl = () => (defaults.baseUrl = 'http://127.0.0.1:2283/api');
-const asAuthHeader = (accessToken: string) => ({
+const setBaseUrl = () => (defaults.baseUrl = app);
+export const asAuthHeader = (accessToken: string) => ({
   Authorization: `Bearer ${accessToken}`,
 });
 
-export const app = {
-  adminSetup: async (context: BrowserContext) => {
+let client: pg.Client | null = null;
+
+export const dbUtils = {
+  setup: () => {
     setBaseUrl();
-    await signUpAdmin({ signUpDto });
+  },
+  reset: async () => {
+    try {
+      if (!client) {
+        client = new pg.Client(
+          'postgres://postgres:postgres@127.0.0.1:5433/immich'
+        );
+        await client.connect();
+      }
 
-    const response = await login({ loginCredentialDto });
+      for (const table of ['user_token', 'users', 'system_metadata']) {
+        await client.query(`DELETE FROM ${table} CASCADE;`);
+      }
+    } catch (error) {
+      console.error('Failed to reset database', error);
+      throw error;
+    }
+  },
+  teardown: async () => {
+    try {
+      if (client) {
+        await client.end();
+        client = null;
+      }
+    } catch (error) {
+      console.error('Failed to teardown database', error);
+      throw error;
+    }
+  },
+};
 
+export const apiUtils = {
+  adminSetup: async () => {
+    await signUpAdmin({ signUpDto: signupDto.admin });
+    const response = await login({ loginCredentialDto: loginDto.admin });
+    await setAdminOnboarding({ headers: asAuthHeader(response.accessToken) });
+    return response;
+  },
+};
+
+export const webUtils = {
+  setAuthCookies: async (context: BrowserContext, response: LoginResponseDto) =>
     await context.addCookies([
       {
         name: 'immich_access_token',
@@ -56,33 +96,5 @@ export const app = {
         secure: false,
         sameSite: 'Lax',
       },
-    ]);
-
-    await setAdminOnboarding({ headers: asAuthHeader(response.accessToken) });
-
-    return response;
-  },
-  reset: async () => {
-    try {
-      if (!connected) {
-        await client.connect();
-        connected = true;
-      }
-
-      for (const table of ['user_token', 'users', 'system_metadata']) {
-        await client.query(`DELETE FROM ${table} CASCADE;`);
-      }
-    } catch (error) {
-      console.error('Failed to reset database', error);
-    }
-  },
-  teardown: async () => {
-    try {
-      if (connected) {
-        await client.end();
-      }
-    } catch (error) {
-      console.error('Failed to teardown database', error);
-    }
-  },
+    ]),
 };

e2e/src/web/specs/auth.e2e-spec.ts

@@ -1,13 +1,13 @@
 import { test, expect } from '@playwright/test';
-import { app } from '../test-utils';
+import { apiUtils, dbUtils, webUtils } from 'src/utils';
 
 test.describe('Registration', () => {
   test.beforeEach(async () => {
-    await app.reset();
+    await dbUtils.reset();
   });
 
   test.afterAll(async () => {
-    await app.teardown();
+    await dbUtils.teardown();
   });
 
   test('admin registration', async ({ page }) => {
@@ -41,7 +41,8 @@ test.describe('Registration', () => {
   });
 
   test('user registration', async ({ context, page }) => {
-    await app.adminSetup(context);
+    const loginResponse = await apiUtils.adminSetup();
+    await webUtils.setAuthCookies(context, loginResponse);
 
     // create user
     await page.goto('/admin/user-management');

e2e/tsconfig.json

@@ -16,8 +16,7 @@
     "skipLibCheck": true,
     "esModuleInterop": true,
     "rootDirs": ["src"],
-    "baseUrl": "./",
-    "types": ["vitest/globals"]
+    "baseUrl": "./"
   },
   "exclude": ["dist", "node_modules"]
 }

e2e/vitest.config.ts

@@ -0,0 +1,13 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['src/api/specs/*.e2e-spec.ts'],
+    globalSetup: ['src/api/setup.ts'],
+    poolOptions: {
+      threads: {
+        singleThread: true,
+      },
+    },
+  },
+});

server/e2e/api/specs/auth.e2e-spec.ts

@@ -1,294 +0,0 @@
-import { AuthController } from '@app/immich';
-import {
-  adminSignupStub,
-  changePasswordStub,
-  deviceStub,
-  errorStub,
-  loginResponseStub,
-  loginStub,
-  uuidStub,
-} from '@test/fixtures';
-import request from 'supertest';
-import { api } from '../../client';
-import { testApp } from '../utils';
-
-const name = 'Immich Admin';
-const password = 'Password123';
-const email = 'admin@immich.app';
-
-const adminSignupResponse = {
-  avatarColor: expect.any(String),
-  id: expect.any(String),
-  name: 'Immich Admin',
-  email: 'admin@immich.app',
-  storageLabel: 'admin',
-  externalPath: null,
-  profileImagePath: '',
-  // why? lol
-  shouldChangePassword: true,
-  isAdmin: true,
-  createdAt: expect.any(String),
-  updatedAt: expect.any(String),
-  deletedAt: null,
-  oauthId: '',
-  memoriesEnabled: true,
-  quotaUsageInBytes: 0,
-  quotaSizeInBytes: null,
-};
-
-describe(`${AuthController.name} (e2e)`, () => {
-  let server: any;
-  let accessToken: string;
-
-  beforeAll(async () => {
-    server = (await testApp.create()).getHttpServer();
-  });
-
-  afterAll(async () => {
-    await testApp.teardown();
-  });
-
-  beforeEach(async () => {
-    await testApp.reset();
-    await api.authApi.adminSignUp(server);
-    const response = await api.authApi.adminLogin(server);
-    accessToken = response.accessToken;
-  });
-
-  describe('POST /auth/admin-sign-up', () => {
-    beforeEach(async () => {
-      await testApp.reset();
-    });
-
-    const invalid = [
-      {
-        should: 'require an email address',
-        data: { name, password },
-      },
-      {
-        should: 'require a password',
-        data: { name, email },
-      },
-      {
-        should: 'require a name',
-        data: { email, password },
-      },
-      {
-        should: 'require a valid email',
-        data: { name, email: 'immich', password },
-      },
-    ];
-
-    for (const { should, data } of invalid) {
-      it(`should ${should}`, async () => {
-        const { status, body } = await request(server).post('/auth/admin-sign-up').send(data);
-        expect(status).toEqual(400);
-        expect(body).toEqual(errorStub.badRequest());
-      });
-    }
-
-    it(`should sign up the admin`, async () => {
-      await api.authApi.adminSignUp(server);
-    });
-
-    it('should sign up the admin with a local domain', async () => {
-      const { status, body } = await request(server)
-        .post('/auth/admin-sign-up')
-        .send({ ...adminSignupStub, email: 'admin@local' });
-      expect(status).toEqual(201);
-      expect(body).toEqual({ ...adminSignupResponse, email: 'admin@local' });
-    });
-
-    it('should transform email to lower case', async () => {
-      const { status, body } = await request(server)
-        .post('/auth/admin-sign-up')
-        .send({ ...adminSignupStub, email: 'aDmIn@IMMICH.app' });
-      expect(status).toEqual(201);
-      expect(body).toEqual(adminSignupResponse);
-    });
-
-    it('should not allow a second admin to sign up', async () => {
-      await api.authApi.adminSignUp(server);
-
-      const { status, body } = await request(server).post('/auth/admin-sign-up').send(adminSignupStub);
-
-      expect(status).toBe(400);
-      expect(body).toEqual(errorStub.alreadyHasAdmin);
-    });
-
-    for (const key of Object.keys(adminSignupStub)) {
-      it(`should not allow null ${key}`, async () => {
-        const { status, body } = await request(server)
-          .post('/auth/admin-sign-up')
-          .send({ ...adminSignupStub, [key]: null });
-        expect(status).toBe(400);
-        expect(body).toEqual(errorStub.badRequest());
-      });
-    }
-  });
-
-  describe(`POST /auth/login`, () => {
-    it('should reject an incorrect password', async () => {
-      const { status, body } = await request(server).post('/auth/login').send({ email, password: 'incorrect' });
-      expect(body).toEqual(errorStub.incorrectLogin);
-      expect(status).toBe(401);
-    });
-
-    for (const key of Object.keys(loginStub.admin)) {
-      it(`should not allow null ${key}`, async () => {
-        const { status, body } = await request(server)
-          .post('/auth/login')
-          .send({ ...loginStub.admin, [key]: null });
-        expect(status).toBe(400);
-        expect(body).toEqual(errorStub.badRequest());
-      });
-    }
-
-    it('should accept a correct password', async () => {
-      const { status, body, headers } = await request(server).post('/auth/login').send({ email, password });
-      expect(status).toBe(201);
-      expect(body).toEqual(loginResponseStub.admin.response);
-
-      const token = body.accessToken;
-      expect(token).toBeDefined();
-
-      const cookies = headers['set-cookie'];
-      expect(cookies).toHaveLength(3);
-      expect(cookies[0]).toEqual(`immich_access_token=${token}; HttpOnly; Path=/; Max-Age=34560000; SameSite=Lax;`);
-      expect(cookies[1]).toEqual('immich_auth_type=password; HttpOnly; Path=/; Max-Age=34560000; SameSite=Lax;');
-      expect(cookies[2]).toEqual('immich_is_authenticated=true; Path=/; Max-Age=34560000; SameSite=Lax;');
-    });
-  });
-
-  describe('GET /auth/devices', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(server).get('/auth/devices');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorStub.unauthorized);
-    });
-
-    it('should get a list of authorized devices', async () => {
-      const { status, body } = await request(server).get('/auth/devices').set('Authorization', `Bearer ${accessToken}`);
-      expect(status).toBe(200);
-      expect(body).toEqual([deviceStub.current]);
-    });
-  });
-
-  describe('DELETE /auth/devices', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(server).delete(`/auth/devices`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorStub.unauthorized);
-    });
-
-    it('should logout all devices (except the current one)', async () => {
-      for (let i = 0; i < 5; i++) {
-        await api.authApi.adminLogin(server);
-      }
-
-      await expect(api.authApi.getAuthDevices(server, accessToken)).resolves.toHaveLength(6);
-
-      const { status } = await request(server).delete(`/auth/devices`).set('Authorization', `Bearer ${accessToken}`);
-      expect(status).toBe(204);
-
-      await api.authApi.validateToken(server, accessToken);
-    });
-  });
-
-  describe('DELETE /auth/devices/:id', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(server).delete(`/auth/devices/${uuidStub.notFound}`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorStub.unauthorized);
-    });
-
-    it('should throw an error for a non-existent device id', async () => {
-      const { status, body } = await request(server)
-        .delete(`/auth/devices/${uuidStub.notFound}`)
-        .set('Authorization', `Bearer ${accessToken}`);
-      expect(status).toBe(400);
-      expect(body).toEqual(errorStub.badRequest('Not found or no authDevice.delete access'));
-    });
-
-    it('should logout a device', async () => {
-      const [device] = await api.authApi.getAuthDevices(server, accessToken);
-      const { status } = await request(server)
-        .delete(`/auth/devices/${device.id}`)
-        .set('Authorization', `Bearer ${accessToken}`);
-      expect(status).toBe(204);
-
-      const response = await request(server).post('/auth/validateToken').set('Authorization', `Bearer ${accessToken}`);
-      expect(response.body).toEqual(errorStub.invalidToken);
-      expect(response.status).toBe(401);
-    });
-  });
-
-  describe('POST /auth/validateToken', () => {
-    it('should reject an invalid token', async () => {
-      const { status, body } = await request(server).post(`/auth/validateToken`).set('Authorization', 'Bearer 123');
-      expect(status).toBe(401);
-      expect(body).toEqual(errorStub.invalidToken);
-    });
-
-    it('should accept a valid token', async () => {
-      const { status, body } = await request(server)
-        .post(`/auth/validateToken`)
-        .send({})
-        .set('Authorization', `Bearer ${accessToken}`);
-      expect(status).toBe(200);
-      expect(body).toEqual({ authStatus: true });
-    });
-  });
-
-  describe('POST /auth/change-password', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(server).post(`/auth/change-password`).send(changePasswordStub);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorStub.unauthorized);
-    });
-
-    for (const key of Object.keys(changePasswordStub)) {
-      it(`should not allow null ${key}`, async () => {
-        const { status, body } = await request(server)
-          .post('/auth/change-password')
-          .send({ ...changePasswordStub, [key]: null })
-          .set('Authorization', `Bearer ${accessToken}`);
-        expect(status).toBe(400);
-        expect(body).toEqual(errorStub.badRequest());
-      });
-    }
-
-    it('should require the current password', async () => {
-      const { status, body } = await request(server)
-        .post(`/auth/change-password`)
-        .send({ ...changePasswordStub, password: 'wrong-password' })
-        .set('Authorization', `Bearer ${accessToken}`);
-      expect(status).toBe(400);
-      expect(body).toEqual(errorStub.wrongPassword);
-    });
-
-    it('should change the password', async () => {
-      const { status } = await request(server)
-        .post(`/auth/change-password`)
-        .send(changePasswordStub)
-        .set('Authorization', `Bearer ${accessToken}`);
-      expect(status).toBe(200);
-
-      await api.authApi.login(server, { email: 'admin@immich.app', password: 'Password1234' });
-    });
-  });
-
-  describe('POST /auth/logout', () => {
-    it('should require authentication', async () => {
-      const { status, body } = await request(server).post(`/auth/logout`);
-      expect(status).toBe(401);
-      expect(body).toEqual(errorStub.unauthorized);
-    });
-
-    it('should logout the user', async () => {
-      const { status, body } = await request(server).post(`/auth/logout`).set('Authorization', `Bearer ${accessToken}`);
-      expect(status).toBe(200);
-      expect(body).toEqual({ successful: true, redirectUri: '/auth/login?autoLaunch=0' });
-    });
-  });
-});

server/test/fixtures/auth.stub.ts

@@ -19,11 +19,6 @@ export const loginStub = {
   },
 };
 
-export const changePasswordStub = {
-  password: 'Password123',
-  newPassword: 'Password1234',
-};
-
 export const authStub = {
   admin: Object.freeze<AuthDto>({
     user: {

server/test/fixtures/device.stub.ts

@@ -1,10 +0,0 @@
-export const deviceStub = {
-  current: {
-    id: expect.any(String),
-    createdAt: expect.any(String),
-    updatedAt: expect.any(String),
-    current: true,
-    deviceOS: '',
-    deviceType: '',
-  },
-};

server/test/fixtures/index.ts

@@ -3,7 +3,6 @@ export * from './api-key.stub';
 export * from './asset.stub';
 export * from './audit.stub';
 export * from './auth.stub';
-export * from './device.stub';
 export * from './error.stub';
 export * from './face.stub';
 export * from './file.stub';