Merge pull request #3713 from overleaf/jpa-login-event-drop-pii

[AuthenticationController] do not include PII as part of login event

GitOrigin-RevId: 274378b3a21945637dc33d2cfb39a53e9aaad9b7

services/web/test/acceptance/src/AuthenticationTests.js

@@ -0,0 +1,37 @@
+const { expect } = require('chai')
+const { ObjectId } = require('mongodb')
+const User = require('./helpers/User').promises
+
+describe('Authentication', function() {
+  let user
+  beforeEach('init vars', function() {
+    user = new User()
+  })
+
+  describe('login', function() {
+    beforeEach('doLogin', async function() {
+      await user.login()
+    })
+
+    it('should log the user in', async function() {
+      const {
+        response: { statusCode }
+      } = await user.doRequest('GET', '/project')
+      expect(statusCode).to.equal(200)
+    })
+
+    it('should emit an user auditLog entry for the login', async function() {
+      const {
+        auditLog: [auditLogEntry]
+      } = await user.get()
+      expect(auditLogEntry).to.exist
+      expect(auditLogEntry.timestamp).to.exist
+      delete auditLogEntry.timestamp
+      expect(auditLogEntry).to.deep.equal({
+        operation: 'login',
+        ipAddress: '127.0.0.1',
+        initiatorId: ObjectId(user.id)
+      })
+    })
+  })
+})

services/web/test/unit/src/Authentication/AuthenticationControllerTests.js

@@ -23,6 +23,9 @@ describe('AuthenticationController', function() {
         console: console
       },
       requires: {
+        '../User/UserAuditLogHandler': (this.UserAuditLogHandler = {
+          addEntry: sinon.stub().yields(null)
+        }),
         '../Helpers/AsyncFormHelper': (this.AsyncFormHelper = {
           redirect: sinon.stub()
         }),
@@ -1188,6 +1191,48 @@ describe('AuthenticationController', function() {
       })
     })
 
+    describe('UserAuditLog', function() {
+      it('should add an audit log entry', function() {
+        this.AuthenticationController.finishLogin(
+          this.user,
+          this.req,
+          this.res,
+          this.next
+        )
+        expect(this.UserAuditLogHandler.addEntry).to.have.been.calledWith(
+          this.user._id,
+          'login',
+          this.user._id,
+          '42.42.42.42'
+        )
+      })
+
+      it('should add an audit log entry before logging the user in', function() {
+        this.AuthenticationController.finishLogin(
+          this.user,
+          this.req,
+          this.res,
+          this.next
+        )
+        expect(this.UserAuditLogHandler.addEntry).to.have.been.calledBefore(
+          this.req.login
+        )
+      })
+
+      it('should not log the user in without an audit log entry', function() {
+        const theError = new Error()
+        this.UserAuditLogHandler.addEntry.yields(theError)
+        this.AuthenticationController.finishLogin(
+          this.user,
+          this.req,
+          this.res,
+          this.next
+        )
+        expect(this.next).to.have.been.calledWith(theError)
+        expect(this.req.login).to.not.have.been.called
+      })
+    })
+
     describe('_afterLoginSessionSetup', function() {
       beforeEach(function() {})