Adding temporarty keycard escape

backend/test/labAuth.test.ts

@@ -10,6 +10,7 @@ const secret = 'test-lab-secret'
 function testApp(config: Parameters<typeof requireLabAccess>[0]) {
   const app = express()
   app.use(cookieParser())
+  app.use(express.urlencoded({ extended: false }))
   app.use(requireLabAccess(config))
   app.get('/admin', (_request, response) => response.send('ok'))
   app.get('/api/ca/decks', (_request, response) => response.json([{ id: 'deck' }]))
@@ -39,7 +40,7 @@ describe('lab auth middleware', () => {
     await request(app).get('/admin').expect(200, 'ok')
   })
 
-  it('redirects browser requests without a shared auth cookie', async () => {
+  it('shows the local lab login form for browser requests without a shared auth cookie', async () => {
     const app = testApp({
       enabled: true,
       gnommowebUrl: 'https://glitch.university',
@@ -55,10 +56,59 @@ describe('lab auth middleware', () => {
       .set('accept', 'text/html')
       .set('host', 'lab.glitch.university')
       .set('x-forwarded-proto', 'https')
+      .expect(401)
+
+    expect(response.text).toContain('Insert lab keycard')
+    expect(response.text).toContain('Temporary secret key')
+  })
+
+  it('allows browser requests with the temporary lab secret key', async () => {
+    const app = testApp({
+      enabled: true,
+      gnommowebUrl: 'https://glitch.university',
+      jwtSecret: '',
+      keycardMeritSlug: 'lab-keycard',
+      keycardRequired: true,
+      signInUrl: 'https://glitch.university/auth/google',
+      temporarySecretKey: 'supersecret',
+      userProfileUrl: 'https://glitch.university/api/user/profile'
+    })
+
+    const unlock = await request(app)
+      .post('/admin/lab-login')
+      .type('form')
+      .send({ secret_key: 'supersecret' })
       .expect(302)
 
-    expect(response.headers.location).toContain('https://glitch.university/auth/google?returnTo=')
-    expect(decodeURIComponent(response.headers.location)).toContain('https://lab.glitch.university/admin')
+    const cookie = unlock.headers['set-cookie']
+    expect(String(cookie)).toContain('lab_temp_key=supersecret')
+
+    await request(app)
+      .get('/admin')
+      .set('cookie', cookie)
+      .expect(200, 'ok')
+  })
+
+  it('rejects the temporary lab secret key when it is wrong', async () => {
+    const app = testApp({
+      enabled: true,
+      gnommowebUrl: 'https://glitch.university',
+      jwtSecret: secret,
+      keycardMeritSlug: 'lab-keycard',
+      keycardRequired: true,
+      signInUrl: 'https://glitch.university/auth/google',
+      temporarySecretKey: 'supersecret',
+      userProfileUrl: 'https://glitch.university/api/user/profile'
+    })
+
+    await request(app)
+      .post('/admin/lab-login')
+      .type('form')
+      .send({ secret_key: 'not-it' })
+      .expect(401)
+      .expect((response) => {
+        expect(response.text).toContain('Enter a JWT token or the temporary secret key')
+      })
   })
 
   it('rejects API requests with an invalid shared auth cookie', async () => {