From e31ea2de5040fa63bc97cf4df63bafed3bd9ad85 Mon Sep 17 00:00:00 2001
From: kolaente <k@knt.li>
Date: Sun, 19 Jul 2026 18:45:18 +0200
Subject: [PATCH] test(e2e): seed hashed user tokens in TokenFactory
 (GHSA-r6w9-259g-gwrv)

Reset/confirm/deletion tokens (kinds 1-3) are now stored as a SHA-256 hash and
looked up by hash, so the e2e factory must seed the hash while returning the
plaintext to the test. Kind 4 (caldav/bcrypt) is seeded verbatim.
---
 frontend/tests/factories/token.ts | 16 +++++++++++++++-
 frontend/tests/support/factory.ts |  9 ++++++++-
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/frontend/tests/factories/token.ts b/frontend/tests/factories/token.ts
index e15979654..7ea0be28f 100644
--- a/frontend/tests/factories/token.ts
+++ b/frontend/tests/factories/token.ts
@@ -1,3 +1,4 @@
+import {createHash} from 'node:crypto'
 import {faker} from '@faker-js/faker'
 import {Factory} from '../support/factory'
 
@@ -26,4 +27,17 @@ export class TokenFactory extends Factory {
 			...(attrs ?? {}),
 		}
 	}
-} 
+
+	// The API stores reset/confirm/deletion tokens (kinds 1-3) as a SHA-256 hash
+	// and looks them up by that hash; caldav tokens (kind 4) use bcrypt and are
+	// seeded verbatim. Seed the hash so the plaintext token the test uses still
+	// resolves server-side (matches pkg/user/token.go hashUserToken).
+	static transformForSeed(item: Record<string, unknown>): Record<string, unknown> {
+		const kind = item.kind as number
+		if (typeof item.token === 'string' && kind >= 1 && kind <= 3) {
+			return {...item, token: createHash('sha256').update(item.token).digest('hex')}
+		}
+		return item
+	}
+}
+
diff --git a/frontend/tests/support/factory.ts b/frontend/tests/support/factory.ts
index d0d0196e4..afeb0a4f4 100644
--- a/frontend/tests/support/factory.ts
+++ b/frontend/tests/support/factory.ts
@@ -15,6 +15,13 @@ export class Factory {
 		return {}
 	}
 
+	// Hook to transform a row just before it is seeded to the DB. The returned
+	// data (from create()) keeps the original values; only what is written to the
+	// database is transformed. Default: identity.
+	static transformForSeed(item: Record<string, unknown>): Record<string, unknown> {
+		return item
+	}
+
 	/**
 	 * Seeds a bunch of fake data into the database.
 	 *
@@ -61,7 +68,7 @@ export class Factory {
 				}
 				// Skip arrays, objects, and other complex types
 			}
-			return flatItem
+			return this.transformForSeed(flatItem)
 		})
 
 		await this.seed(this.table, flatData, truncate)