refactor whoami route and update tests (#5045)

* refactor whoami route and update tests

* Update CHANGELOG

* Linting fix

Author: BoDonkey

CHANGELOG.md

@@ -24,6 +24,7 @@ It allows live preview to work well with it, it also avoids complexity and fixes
 ### Changes
 
 * Rolled back a change in 4.16.0 that strictly enforced `required` and `min` for relationship fields. Because the related document can be archived or deleted at any time, it is misleading to offer such enforcement. Also, it greatly complicates adding these constraints to existing schemas, resulting in surprising and unwanted behaviors. Therefore it is better for these constraints to be soft constraints on the front end. `max` is still a hard constraint.
+* The `@apostrophecms/login/whoami` route now accepts both `POST` (recommended) and `GET` requests. Previously, it only supported `GET`. This maintains backwards compatibility while aligning with the documentation’s recommendation to use `POST`.
 
 ## 4.20.0 (2025-08-06)
 

modules/@apostrophecms/login/index.js

@@ -92,7 +92,7 @@ module.exports = {
           // rather than ever being stored literally
           self.apos.user.addSecret('passwordReset');
         },
-        async checkForUser () {
+        async checkForUser() {
           await self.checkForUserAndAlert();
         }
       }
@@ -148,7 +148,7 @@ module.exports = {
           }
           if (req.session) {
             const destroySession = () => {
-              return require('util').promisify(function(callback) {
+              return require('util').promisify(function (callback) {
                 // Be thorough, nothing in the session potentially
                 // related to the login should survive logout
                 return req.session.destroy(callback);
@@ -259,6 +259,9 @@ module.exports = {
         async context(req) {
           return self.getContext(req);
         },
+        async whoami(req) {
+          return self.getWhoami(req);
+        },
         ...self.isPasswordResetEnabled() && {
           async resetRequest(req) {
             const wait = (t = 2000) => Promise.delay(t);
@@ -353,24 +356,8 @@ module.exports = {
         // it should be accessed via POST because the result
         // may differ by individual user session and should not
         // be cached
-        async whoami (req) {
-          if (!req.user) {
-            throw self.apos.error('notfound');
-          }
-
-          const fields = new Set([
-            ...self.options.minimumWhoamiFields,
-            ...self.options.whoamiFields
-          ]);
-          const user = {};
-
-          for (const field of fields) {
-            if (req.user[field] !== undefined) {
-              user[field] = req.user[field];
-            }
-          }
-
-          return user;
+        async whoami(req) {
+          return self.getWhoami(req);
         },
         async context(req) {
           return self.getContext(req);
@@ -423,6 +410,29 @@ module.exports = {
         };
       },
 
+      // Implements the whoami route, which provides
+      // information about the user that is currently
+      // logged in
+      async getWhoami(req) {
+        if (!req.user) {
+          throw self.apos.error('notfound');
+        }
+
+        const fields = new Set([
+          ...self.options.minimumWhoamiFields,
+          ...self.options.whoamiFields
+        ]);
+        const user = {};
+
+        for (const field of fields) {
+          if (req.user[field] !== undefined) {
+            user[field] = req.user[field];
+          }
+        }
+
+        return user;
+      },
+
       // return the loginUrl option
       login(url) {
         return self.options.loginUrl ? self.options.loginUrl : '/login';
@@ -806,7 +816,7 @@ module.exports = {
             self.apos.structuredLog.getRequestId(req)
           );
           if (!user) {
-          // For security reasons we may not tell the user which case applies
+            // For security reasons we may not tell the user which case applies
             throw self.apos.error('invalid', req.t('apostrophe:loginPageBadCredentials'));
           }
 
@@ -848,7 +858,7 @@ module.exports = {
               userId: user._id,
               expires: new Date(
                 new Date().getTime() +
-                  (self.options.bearerTokens.lifetime || (86400 * 7 * 2)) * 1000
+                (self.options.bearerTokens.lifetime || (86400 * 7 * 2)) * 1000
               )
             });
 
@@ -887,14 +897,14 @@ module.exports = {
           req.res.cookie(cookieName, 'true');
         }
         const passportLogin = (user) => {
-          return require('util').promisify(function(user, callback) {
+          return require('util').promisify(function (user, callback) {
             return req.login(user, callback);
           })(user);
         };
         await passportLogin(user);
       },
 
-      async addLoginAttempt (
+      async addLoginAttempt(
         username,
         attempts,
         namespace = loginAttemptsNamespace
@@ -920,7 +930,7 @@ module.exports = {
         }
       },
 
-      async checkLoginAttempts (username, namespace = loginAttemptsNamespace) {
+      async checkLoginAttempts(username, namespace = loginAttemptsNamespace) {
         const cachedAttempts = await self.apos.cache.get(namespace, username);
         const { allowedAttempts } = self.options.throttle;
 
@@ -944,7 +954,7 @@ module.exports = {
         };
       },
 
-      async clearLoginAttempts (username, namespace = loginAttemptsNamespace) {
+      async clearLoginAttempts(username, namespace = loginAttemptsNamespace) {
         await self.apos.cache.delete(namespace, username);
       },
 

test/login.js

@@ -1,7 +1,7 @@
 const t = require('../test-lib/test.js');
 const assert = require('assert').strict;
 
-describe('Login', function() {
+describe('Login', function () {
   let apos;
   let resetUserId;
   let resetToken;
@@ -31,13 +31,13 @@ describe('Login', function() {
     });
   });
 
-  after(function() {
+  after(function () {
     return t.destroy(apos);
   });
 
   // EXISTENCE
 
-  it('should initialize', async function() {
+  it('should initialize', async function () {
     assert(apos);
 
     assert(apos.modules['@apostrophecms/login']);
@@ -117,7 +117,7 @@ describe('Login', function() {
     await loginModule.clearLoginAttempts(username);
   });
 
-  it('should be able to login a user with their username', async function() {
+  it('should be able to login a user with their username', async function () {
     const getLoggedInCookieValue =
       jar => jar.toJSON().cookies.find(cookie => cookie.key === `${apos.options.shortName}.loggedIn`).value;
 
@@ -182,7 +182,7 @@ describe('Login', function() {
     assert(getLoggedInCookieValue(jar) === 'false');
   });
 
-  it('should be able to login a user with their email', async function() {
+  it('should be able to login a user with their email', async function () {
 
     const jar = apos.http.jar();
 
@@ -242,7 +242,7 @@ describe('Login', function() {
     assert(page.match(/logged out/));
   });
 
-  it('changing a user\'s password should invalidate sessions for that user', async function() {
+  it('changing a user\'s password should invalidate sessions for that user', async function () {
 
     const jar = apos.http.jar();
 
@@ -356,7 +356,7 @@ describe('Login', function() {
 
   });
 
-  it('changing a user\'s password should invalidate bearer tokens for that user', async function() {
+  it('changing a user\'s password should invalidate bearer tokens for that user', async function () {
 
     // Log in
     let response = await apos.http.post('/api/v1/@apostrophecms/login/login', {
@@ -425,7 +425,7 @@ describe('Login', function() {
 
   });
 
-  it('api key should beat session when both are present', async function() {
+  it('api key should beat session when both are present', async function () {
     const jar = apos.http.jar();
     await apos.http.post(
       '/api/v1/@apostrophecms/login/login',
@@ -463,7 +463,7 @@ describe('Login', function() {
     assert(page2.match(/System Task/));
   });
 
-  it('should validate POST /login/reset-request', async function() {
+  it('should validate POST /login/reset-request', async function () {
     const jar = apos.http.jar();
     await apos.http.get(
       '/',
@@ -485,7 +485,7 @@ describe('Login', function() {
     });
   });
 
-  it('should hide sensitive exceptions POST /login/reset-request', async function() {
+  it('should hide sensitive exceptions POST /login/reset-request', async function () {
     let log;
     const orig = apos.util.error;
     apos.util.error = (m) => {
@@ -532,7 +532,7 @@ describe('Login', function() {
     apos.util.error = orig;
   });
 
-  it('should reset password POST /login/reset-request (request)', async function() {
+  it('should reset password POST /login/reset-request (request)', async function () {
     let args;
     const orig = apos.login.email;
     apos.login.email = (req, ...a) => {
@@ -610,7 +610,7 @@ describe('Login', function() {
     apos.login.email = orig;
   });
 
-  it('should reset password GET /login/reset (validate)', async function() {
+  it('should reset password GET /login/reset (validate)', async function () {
     const user = await apos.doc.db.findOne({ _id: resetUserId });
 
     // Fail
@@ -667,7 +667,7 @@ describe('Login', function() {
     );
   });
 
-  it('should reset password POST /login/reset (validate & reset)', async function() {
+  it('should reset password POST /login/reset (validate & reset)', async function () {
     const jar = apos.http.jar();
     const user = await apos.doc.db.findOne({ _id: resetUserId });
     await apos.http.get(
@@ -798,7 +798,7 @@ describe('Login', function() {
     assert(page.match(/logged in/));
   });
 
-  it('should find user by reset data', async function() {
+  it('should find user by reset data', async function () {
     let user = apos.user.newInstance();
     user.title = 'getResetUser';
     user.email = 'getResetUser@example.com';
@@ -868,18 +868,39 @@ describe('Login', function() {
     );
   });
 
-  it('should return an error with code 404 at GET login/whoami when user is not logged in', async function() {
+  it('should return an error with code 404 at GET login/whoami when user is not logged in', async function () {
     try {
-      await apos.http.get('/api/v1/@apostrophecms/login/whoami');
+      const jar = apos.http.jar();
+      await apos.http.get(
+        '/',
+        {
+          jar
+        }
+      );
+      await apos.http.post('/api/v1/@apostrophecms/login/whoami',
+        {
+          method: 'POST',
+          body: {
+            session: true
+          },
+          jar
+        }
+      );
       assert.fail('Expected error but got success');
     } catch (err) {
       assert.strictEqual(err.status, 404);
     }
   });
 
-  it('should return user data at GET login/whoami when user is logged in', async function() {
+  it('should return user data at GET login/whoami when user is logged in', async function () {
 
     const jar = apos.http.jar();
+    await apos.http.get(
+      '/',
+      {
+        jar
+      }
+    );
 
     await apos.http.post(
       '/api/v1/@apostrophecms/login/login',
@@ -894,16 +915,28 @@ describe('Login', function() {
       }
     );
 
-    const whoamiResponse = await apos.http.get('/api/v1/@apostrophecms/login/whoami', { jar });
+    const whoamiResponse = await apos.http.post('/api/v1/@apostrophecms/login/whoami', {
+      method: 'POST',
+      body: {
+        session: true
+      },
+      jar
+    });
     assert.ok(whoamiResponse._id);
     assert.strictEqual(whoamiResponse.username, 'HarryPutter');
     assert.strictEqual(whoamiResponse.title, 'Extra Cool Putter');
     assert.strictEqual(whoamiResponse.email, 'hputter@aol.com');
   });
 
-  it('should return user data with additional whoamiFields if explicitly added at GET login/whoami when user is logged in', async function() {
+  it('should return user data with additional whoamiFields if explicitly added to the login module options when user is logged in', async function () {
 
     const jar = apos.http.jar();
+    await apos.http.get(
+      '/',
+      {
+        jar
+      }
+    );
 
     apos.modules['@apostrophecms/login'].options.whoamiFields = [ 'role' ];
 
@@ -920,13 +953,25 @@ describe('Login', function() {
       }
     );
 
-    const whoamiResponse = await apos.http.get('/api/v1/@apostrophecms/login/whoami', { jar });
+    const whoamiResponse = await apos.http.post('/api/v1/@apostrophecms/login/whoami', {
+      method: 'POST',
+      body: {
+        session: true
+      },
+      jar
+    });
     assert.strictEqual(whoamiResponse.role, 'admin');
   });
 
-  it('should not return user data with additional whoamiFields if not explicitly added at GET login/whoami when user is logged in', async function() {
+  it('should not return user data with additional whoamiFields if not explicitly added to the login module options when user is logged in', async function () {
 
     const jar = apos.http.jar();
+    await apos.http.get(
+      '/',
+      {
+        jar
+      }
+    );
 
     // Reset the whoamiFields to default (empty)
     apos.modules['@apostrophecms/login'].options.whoamiFields = [];
@@ -944,7 +989,13 @@ describe('Login', function() {
       }
     );
 
-    const whoamiResponse = await apos.http.get('/api/v1/@apostrophecms/login/whoami', { jar });
+    const whoamiResponse = await apos.http.post('/api/v1/@apostrophecms/login/whoami', {
+      method: 'POST',
+      body: {
+        session: true
+      },
+      jar
+    });
     assert.ok(!('role' in whoamiResponse));
   });
 });