From f9016feef4a4d5bf61cf444894a8e24ec7e0b484 Mon Sep 17 00:00:00 2001
From: 00Chaotic <J.Rizvi@outlook.com>
Date: Tue, 19 Mar 2024 15:08:23 +1100
Subject: [PATCH 1/5] feat: allow admin login when using demo auth type

---
 .../src/component/user/DemoAuth/DemoAuth.tsx  |  2 +-
 .../__snapshots__/create-config.test.ts.snap  |  1 +
 src/lib/create-config.test.ts                 | 14 ++++
 src/lib/create-config.ts                      |  4 +
 .../demo-authentication.e2e.test.ts           | 73 +++++++++++++++++++
 src/lib/middleware/demo-authentication.ts     | 23 +++---
 src/lib/services/user-service.ts              |  6 ++
 src/lib/types/option.ts                       |  1 +
 8 files changed, 114 insertions(+), 10 deletions(-)
 create mode 100644 src/lib/middleware/demo-authentication.e2e.test.ts

diff --git a/frontend/src/component/user/DemoAuth/DemoAuth.tsx b/frontend/src/component/user/DemoAuth/DemoAuth.tsx
index ff4054959f69..de29cfc970cd 100644
--- a/frontend/src/component/user/DemoAuth/DemoAuth.tsx
+++ b/frontend/src/component/user/DemoAuth/DemoAuth.tsx
@@ -63,7 +63,7 @@ const DemoAuth: VFC<IDemoAuthProps> = ({ authDetails, redirect }) => {
                         id='email'
                         data-testid={LOGIN_EMAIL_ID}
                         required
-                        type='email'
+                        type={email === 'admin' ? 'text' : 'email'}
                     />
 
                     <Button
diff --git a/src/lib/__snapshots__/create-config.test.ts.snap b/src/lib/__snapshots__/create-config.test.ts.snap
index d6a5d39d85e0..be00cbcb9097 100644
--- a/src/lib/__snapshots__/create-config.test.ts.snap
+++ b/src/lib/__snapshots__/create-config.test.ts.snap
@@ -15,6 +15,7 @@ exports[`should create default config 1`] = `
     "styleSrc": [],
   },
   "authentication": {
+    "authDemoAllowAdminLogin": false,
     "createAdminUser": true,
     "customAuthHandler": [Function],
     "enableApiToken": true,
diff --git a/src/lib/create-config.test.ts b/src/lib/create-config.test.ts
index 38140e5f021e..325073a2d952 100644
--- a/src/lib/create-config.test.ts
+++ b/src/lib/create-config.test.ts
@@ -226,6 +226,20 @@ test('should handle cases where no env var specified for tokens', async () => {
     expect(config.authentication.initApiTokens).toHaveLength(1);
 });
 
+test('should load demo admin login flag from env var', async () => {
+    process.env.AUTH_DEMO_ALLOW_ADMIN_LOGIN = 'true';
+
+    const config = createConfig({});
+
+    expect(config.authentication.authDemoAllowAdminLogin).toBeTruthy();
+    delete process.env.AUTH_DEMO_ALLOW_ADMIN_LOGIN;
+});
+
+test('should default demo admin login to false', async () => {
+    const config = createConfig({});
+    expect(config.authentication.authDemoAllowAdminLogin).toBeFalsy();
+});
+
 test('should load environment overrides from env var', async () => {
     process.env.ENABLED_ENVIRONMENTS = 'default,production';
 
diff --git a/src/lib/create-config.ts b/src/lib/create-config.ts
index 275271200a91..04ab30d23147 100644
--- a/src/lib/create-config.ts
+++ b/src/lib/create-config.ts
@@ -271,6 +271,10 @@ const defaultVersionOption: IVersionOption = {
 };
 
 const defaultAuthentication: IAuthOption = {
+    authDemoAllowAdminLogin: parseEnvVarBoolean(
+        process.env.AUTH_DEMO_ALLOW_ADMIN_LOGIN,
+        false,
+    ),
     enableApiToken: parseEnvVarBoolean(process.env.AUTH_ENABLE_API_TOKEN, true),
     type: authTypeFromString(process.env.AUTH_TYPE),
     customAuthHandler: defaultCustomAuthDenyAll,
diff --git a/src/lib/middleware/demo-authentication.e2e.test.ts b/src/lib/middleware/demo-authentication.e2e.test.ts
new file mode 100644
index 000000000000..749c34541b3b
--- /dev/null
+++ b/src/lib/middleware/demo-authentication.e2e.test.ts
@@ -0,0 +1,73 @@
+import dbInit from '../../test/e2e/helpers/database-init';
+import { IAuthType } from '../server-impl';
+import { setupAppWithCustomAuth } from '../../test/e2e/helpers/test-helper';
+import type { ITestDb } from '../../test/e2e/helpers/database-init';
+import type { IUnleashStores } from '../types';
+
+let db: ITestDb;
+let stores: IUnleashStores;
+
+beforeAll(async () => {
+    db = await dbInit('demo_auth_serial');
+    stores = db.stores;
+});
+
+afterAll(async () => {
+    await db?.destroy();
+});
+
+const getApp = (adminLoginEnabled: boolean) =>
+    setupAppWithCustomAuth(stores, () => {}, {
+        authentication: {
+            authDemoAllowAdminLogin: adminLoginEnabled,
+            type: IAuthType.DEMO,
+            createAdminUser: true,
+        },
+    });
+
+test('the authDemoAllowAdminLogin flag should not affect regular user login/creation', async () => {
+    const app = await getApp(true);
+    return app.request
+        .post(`/auth/demo/login`)
+        .send({ email: 'test@example.com' })
+        .expect(200)
+        .expect((res) => {
+            expect(res.body.email).toBe('test@example.com');
+            expect(res.body.id).not.toBe(1);
+        });
+});
+
+test('if the authDemoAllowAdminLogin flag is disabled, using `admin` should have the same result as any other invalid email', async () => {
+    const app = await getApp(false);
+
+    const nonAdminUsername = 'not-an-email';
+    const adminUsername = 'admin';
+
+    const nonAdminUser = await app.request
+        .post(`/auth/demo/login`)
+        .send({ email: nonAdminUsername });
+
+    const adminUser = await app.request
+        .post(`/auth/demo/login`)
+        .send({ email: adminUsername });
+
+    expect(nonAdminUser.status).toBe(adminUser.status);
+
+    for (const user of [nonAdminUser, adminUser]) {
+        expect(user.body).toMatchObject({
+            error: expect.stringMatching(/^Could not sign in with /),
+        });
+    }
+});
+
+test('should allow you to login as admin if the authDemoAllowAdminLogin flag enabled', async () => {
+    const app = await getApp(true);
+    return app.request
+        .post(`/auth/demo/login`)
+        .send({ email: 'admin' })
+        .expect(200)
+        .expect((res) => {
+            expect(res.body.id).toBe(1);
+            expect(res.body.username).toBe('admin');
+        });
+});
diff --git a/src/lib/middleware/demo-authentication.ts b/src/lib/middleware/demo-authentication.ts
index b1d62260373c..ce1b87e957e9 100644
--- a/src/lib/middleware/demo-authentication.ts
+++ b/src/lib/middleware/demo-authentication.ts
@@ -4,7 +4,7 @@ import type { IUnleashServices } from '../types/services';
 import type { IUnleashConfig } from '../types/option';
 import ApiUser from '../types/api-user';
 import { ApiTokenType } from '../types/models/api-token';
-import type { IAuthRequest } from '../server-impl';
+import type { IAuthRequest, IUser } from '../server-impl';
 import type { IApiRequest } from '../routes/unleash-types';
 import { encrypt } from '../util';
 
@@ -19,14 +19,19 @@ function demoAuthentication(
 ): void {
     app.post(`${basePath}/auth/demo/login`, async (req: IAuthRequest, res) => {
         let { email } = req.body;
-        email = flagResolver.isEnabled('encryptEmails', { email })
-            ? encrypt(email)
-            : email;
+        let user: IUser;
+
         try {
-            const user = await userService.loginUserWithoutPassword(
-                email,
-                true,
-            );
+            if (authentication.authDemoAllowAdminLogin && email === 'admin') {
+                user = await userService.loginDemoAuthDefaultAdmin();
+            } else {
+                email = flagResolver.isEnabled('encryptEmails', { email })
+                    ? encrypt(email)
+                    : email;
+
+                user = await userService.loginUserWithoutPassword(email, true);
+            }
+
             req.session.user = user;
             return res.status(200).json(user);
         } catch (e) {
@@ -37,7 +42,7 @@ function demoAuthentication(
     });
 
     app.use(`${basePath}/api/admin/`, (req: IAuthRequest, res, next) => {
-        if (req.session.user?.email) {
+        if (req.session.user?.email || req.session.user?.username === 'admin') {
             req.user = req.session.user;
         }
         next();
diff --git a/src/lib/services/user-service.ts b/src/lib/services/user-service.ts
index 04cffe106508..6956af8f36b1 100644
--- a/src/lib/services/user-service.ts
+++ b/src/lib/services/user-service.ts
@@ -379,6 +379,12 @@ class UserService {
         return user;
     }
 
+    async loginDemoAuthDefaultAdmin(): Promise<IUser> {
+        const user = await this.store.getByQuery({ id: 1 });
+        await this.store.successfullyLogin(user);
+        return user;
+    }
+
     async changePassword(userId: number, password: string): Promise<void> {
         this.validatePassword(password);
         const passwordHash = await bcrypt.hash(password, saltRounds);
diff --git a/src/lib/types/option.ts b/src/lib/types/option.ts
index 55b232e8df43..e83dd00e377e 100644
--- a/src/lib/types/option.ts
+++ b/src/lib/types/option.ts
@@ -67,6 +67,7 @@ export type CustomAuthHandler = (
 ) => void;
 
 export interface IAuthOption {
+    authDemoAllowAdminLogin?: boolean;
     enableApiToken: boolean;
     type: IAuthType;
     customAuthHandler?: CustomAuthHandler;

From 4702019a4cab386edf309e2cd9c0d10d4d87c104 Mon Sep 17 00:00:00 2001
From: 00Chaotic <J.Rizvi@outlook.com>
Date: Tue, 16 Apr 2024 18:19:26 +1000
Subject: [PATCH 2/5] patch: improve naming for demo auth admin login flag

---
 src/lib/create-config.test.ts             | 4 ++--
 src/lib/create-config.ts                  | 2 +-
 src/lib/middleware/demo-authentication.ts | 2 +-
 src/lib/types/option.ts                   | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/lib/create-config.test.ts b/src/lib/create-config.test.ts
index 325073a2d952..11fb55665bbc 100644
--- a/src/lib/create-config.test.ts
+++ b/src/lib/create-config.test.ts
@@ -231,13 +231,13 @@ test('should load demo admin login flag from env var', async () => {
 
     const config = createConfig({});
 
-    expect(config.authentication.authDemoAllowAdminLogin).toBeTruthy();
+    expect(config.authentication.demoAllowAdminLogin).toBeTruthy();
     delete process.env.AUTH_DEMO_ALLOW_ADMIN_LOGIN;
 });
 
 test('should default demo admin login to false', async () => {
     const config = createConfig({});
-    expect(config.authentication.authDemoAllowAdminLogin).toBeFalsy();
+    expect(config.authentication.demoAllowAdminLogin).toBeFalsy();
 });
 
 test('should load environment overrides from env var', async () => {
diff --git a/src/lib/create-config.ts b/src/lib/create-config.ts
index 04ab30d23147..5841011c11b1 100644
--- a/src/lib/create-config.ts
+++ b/src/lib/create-config.ts
@@ -271,7 +271,7 @@ const defaultVersionOption: IVersionOption = {
 };
 
 const defaultAuthentication: IAuthOption = {
-    authDemoAllowAdminLogin: parseEnvVarBoolean(
+    demoAllowAdminLogin: parseEnvVarBoolean(
         process.env.AUTH_DEMO_ALLOW_ADMIN_LOGIN,
         false,
     ),
diff --git a/src/lib/middleware/demo-authentication.ts b/src/lib/middleware/demo-authentication.ts
index ce1b87e957e9..6bc9803d28d7 100644
--- a/src/lib/middleware/demo-authentication.ts
+++ b/src/lib/middleware/demo-authentication.ts
@@ -22,7 +22,7 @@ function demoAuthentication(
         let user: IUser;
 
         try {
-            if (authentication.authDemoAllowAdminLogin && email === 'admin') {
+            if (authentication.demoAllowAdminLogin && email === 'admin') {
                 user = await userService.loginDemoAuthDefaultAdmin();
             } else {
                 email = flagResolver.isEnabled('encryptEmails', { email })
diff --git a/src/lib/types/option.ts b/src/lib/types/option.ts
index e83dd00e377e..e46b2c227cb8 100644
--- a/src/lib/types/option.ts
+++ b/src/lib/types/option.ts
@@ -67,7 +67,7 @@ export type CustomAuthHandler = (
 ) => void;
 
 export interface IAuthOption {
-    authDemoAllowAdminLogin?: boolean;
+    demoAllowAdminLogin?: boolean;
     enableApiToken: boolean;
     type: IAuthType;
     customAuthHandler?: CustomAuthHandler;

From 175d2f5a0844bfe8baa8d4a08ebaf454a9ddc099 Mon Sep 17 00:00:00 2001
From: 00Chaotic <J.Rizvi@outlook.com>
Date: Tue, 16 Apr 2024 18:57:19 +1000
Subject: [PATCH 3/5] patch: further renaming as auto-replace did not catch all
 occurrences

---
 src/lib/__snapshots__/create-config.test.ts.snap   | 2 +-
 src/lib/middleware/demo-authentication.e2e.test.ts | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/lib/__snapshots__/create-config.test.ts.snap b/src/lib/__snapshots__/create-config.test.ts.snap
index be00cbcb9097..1ae0ced23701 100644
--- a/src/lib/__snapshots__/create-config.test.ts.snap
+++ b/src/lib/__snapshots__/create-config.test.ts.snap
@@ -15,7 +15,7 @@ exports[`should create default config 1`] = `
     "styleSrc": [],
   },
   "authentication": {
-    "authDemoAllowAdminLogin": false,
+    "demoAllowAdminLogin": false,
     "createAdminUser": true,
     "customAuthHandler": [Function],
     "enableApiToken": true,
diff --git a/src/lib/middleware/demo-authentication.e2e.test.ts b/src/lib/middleware/demo-authentication.e2e.test.ts
index 749c34541b3b..acb2a4f6b9fe 100644
--- a/src/lib/middleware/demo-authentication.e2e.test.ts
+++ b/src/lib/middleware/demo-authentication.e2e.test.ts
@@ -19,13 +19,13 @@ afterAll(async () => {
 const getApp = (adminLoginEnabled: boolean) =>
     setupAppWithCustomAuth(stores, () => {}, {
         authentication: {
-            authDemoAllowAdminLogin: adminLoginEnabled,
+            demoAllowAdminLogin: adminLoginEnabled,
             type: IAuthType.DEMO,
             createAdminUser: true,
         },
     });
 
-test('the authDemoAllowAdminLogin flag should not affect regular user login/creation', async () => {
+test('the demoAllowAdminLogin flag should not affect regular user login/creation', async () => {
     const app = await getApp(true);
     return app.request
         .post(`/auth/demo/login`)
@@ -37,7 +37,7 @@ test('the authDemoAllowAdminLogin flag should not affect regular user login/crea
         });
 });
 
-test('if the authDemoAllowAdminLogin flag is disabled, using `admin` should have the same result as any other invalid email', async () => {
+test('if the demoAllowAdminLogin flag is disabled, using `admin` should have the same result as any other invalid email', async () => {
     const app = await getApp(false);
 
     const nonAdminUsername = 'not-an-email';
@@ -60,7 +60,7 @@ test('if the authDemoAllowAdminLogin flag is disabled, using `admin` should have
     }
 });
 
-test('should allow you to login as admin if the authDemoAllowAdminLogin flag enabled', async () => {
+test('should allow you to login as admin if the demoAllowAdminLogin flag enabled', async () => {
     const app = await getApp(true);
     return app.request
         .post(`/auth/demo/login`)

From 5e2b432cec436d4834646750923d8354fbe0c810 Mon Sep 17 00:00:00 2001
From: 00Chaotic <J.Rizvi@outlook.com>
Date: Tue, 16 Apr 2024 19:02:15 +1000
Subject: [PATCH 4/5] patch: update ordering of config test snapshot

---
 src/lib/__snapshots__/create-config.test.ts.snap | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/__snapshots__/create-config.test.ts.snap b/src/lib/__snapshots__/create-config.test.ts.snap
index 1ae0ced23701..707040402261 100644
--- a/src/lib/__snapshots__/create-config.test.ts.snap
+++ b/src/lib/__snapshots__/create-config.test.ts.snap
@@ -15,9 +15,9 @@ exports[`should create default config 1`] = `
     "styleSrc": [],
   },
   "authentication": {
-    "demoAllowAdminLogin": false,
     "createAdminUser": true,
     "customAuthHandler": [Function],
+    "demoAllowAdminLogin": false,
     "enableApiToken": true,
     "initApiTokens": [],
     "initialAdminUser": {

From f9a44f300e7e64f6b2b40c395a04aff5a7baf909 Mon Sep 17 00:00:00 2001
From: Thomas Heartman <thomasheartman+github@gmail.com>
Date: Tue, 23 Apr 2024 08:22:03 +0200
Subject: [PATCH 5/5] Update src/lib/create-config.test.ts

Remove test that was failing. The variable is loaded statically at startup and dynamically, so this test can't pass unless we change other things.
---
 src/lib/create-config.test.ts | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/src/lib/create-config.test.ts b/src/lib/create-config.test.ts
index 11fb55665bbc..286809e8185d 100644
--- a/src/lib/create-config.test.ts
+++ b/src/lib/create-config.test.ts
@@ -226,15 +226,6 @@ test('should handle cases where no env var specified for tokens', async () => {
     expect(config.authentication.initApiTokens).toHaveLength(1);
 });
 
-test('should load demo admin login flag from env var', async () => {
-    process.env.AUTH_DEMO_ALLOW_ADMIN_LOGIN = 'true';
-
-    const config = createConfig({});
-
-    expect(config.authentication.demoAllowAdminLogin).toBeTruthy();
-    delete process.env.AUTH_DEMO_ALLOW_ADMIN_LOGIN;
-});
-
 test('should default demo admin login to false', async () => {
     const config = createConfig({});
     expect(config.authentication.demoAllowAdminLogin).toBeFalsy();