fix: user type registration vulnerability

lib/pearl/accounts.ex

@@ -259,10 +259,12 @@ defmodule Pearl.Accounts do
 
   """
   def register_attendee_user(attrs) do
+    attrs = attrs |> Map.put("type", :attendee)
+
     Ecto.Multi.new()
     |> Ecto.Multi.insert(
       :user,
-      User.registration_changeset(%User{}, Map.delete(attrs, :attendee),
+      User.registration_changeset(%User{}, Map.delete(attrs, "attendee"),
         hash_password: true,
         validate_email: true
       )

lib/pearl/accounts/user.ex

@@ -77,8 +77,11 @@ defmodule Pearl.Accounts.User do
   """
   def registration_changeset(user, attrs, opts \\ []) do
     user
-    |> cast(attrs, @required_fields ++ @optional_fields)
-    |> validate_required(@required_fields |> Enum.reject(&(&1 in [:email, :password, :handle])))
+    |> cast(attrs, (@required_fields |> Enum.reject(&(&1 == :type))) ++ @optional_fields)
+    |> validate_required(
+      @required_fields
+      |> Enum.reject(&(&1 in [:email, :password, :handle, :type]))
+    )
     |> validate_email(opts)
     |> validate_handle()
     |> validate_password(opts)

test/pearl/accounts_test.exs

@@ -61,7 +61,7 @@ defmodule Pearl.AccountsTest do
 
     test "validates email and password when given" do
       {:error, _, changeset, _} =
-        Accounts.register_attendee_user(%{email: "not valid", password: "not valid"})
+        Accounts.register_attendee_user(%{"email" => "not valid", "password" => "not valid"})
 
       assert %{
                email: ["must have the @ sign and no spaces"],
@@ -73,19 +73,21 @@ defmodule Pearl.AccountsTest do
       too_long = String.duplicate("db", 100)
 
       {:error, _, changeset, _} =
-        Accounts.register_attendee_user(%{email: too_long, password: too_long})
+        Accounts.register_attendee_user(%{"email" => too_long, "password" => too_long})
 
       assert "should be at most 160 character(s)" in errors_on(changeset).email
       assert "should be at most 72 character(s)" in errors_on(changeset).password
     end
 
     test "validates email uniqueness" do
       %{email: email} = user_fixture()
-      {:error, _, changeset, _} = Accounts.register_attendee_user(%{email: email})
+      {:error, _, changeset, _} = Accounts.register_attendee_user(%{"email" => email})
       assert "has already been taken" in errors_on(changeset).email
 
       # Now try with the upper cased email too, to check that email case is ignored.
-      {:error, _, changeset, _} = Accounts.register_attendee_user(%{email: String.upcase(email)})
+      {:error, _, changeset, _} =
+        Accounts.register_attendee_user(%{"email" => String.upcase(email)})
+
       assert "has already been taken" in errors_on(changeset).email
     end
 
@@ -94,7 +96,7 @@ defmodule Pearl.AccountsTest do
 
       {:ok, %{user: user}} =
         Accounts.register_attendee_user(
-          Map.put(valid_user_attributes(email: email), :attendee, %{})
+          Map.put(valid_user_attributes(%{"email" => email}), "attendee", %{})
         )
 
       assert user.email == email
@@ -139,7 +141,7 @@ defmodule Pearl.AccountsTest do
   describe "change_user_registration/2" do
     test "returns a changeset" do
       assert %Ecto.Changeset{} = changeset = Accounts.change_user_registration(%User{})
-      assert changeset.required == [:password, :handle, :email, :name, :type]
+      assert changeset.required == [:password, :handle, :email, :name]
     end
 
     test "allows fields to be set" do
@@ -149,7 +151,7 @@ defmodule Pearl.AccountsTest do
       changeset =
         Accounts.change_user_registration(
           %User{},
-          valid_user_attributes(email: email, password: password)
+          valid_user_attributes(%{"email" => email, "password" => password})
         )
 
       assert changeset.valid?

test/pearl_web/live/user_login_live_test.exs

@@ -21,7 +21,7 @@ defmodule PearlWeb.UserLoginLiveTest do
   describe "user login" do
     test "redirects if user login with valid credentials", %{conn: conn} do
       password = "123456789abcd"
-      user = user_fixture(%{password: password})
+      user = user_fixture(%{"password" => password})
 
       {:ok, lv, _html} = live(conn, ~p"/users/log_in")
 

test/support/fixtures/accounts_fixtures.ex

@@ -11,17 +11,17 @@ defmodule Pearl.AccountsFixtures do
   def valid_user_attributes(attrs \\ %{}) do
     attrs
     |> Enum.into(%{
-      name: "John Doe",
-      handle: unique_handle(),
-      email: unique_user_email(),
-      password: valid_user_password()
+      "name" => "John Doe",
+      "handle" => unique_handle(),
+      "email" => unique_user_email(),
+      "password" => valid_user_password()
     })
   end
 
   def user_fixture(attrs \\ %{}) do
     {:ok, %{user: user, attendee: _}} =
       attrs
-      |> Enum.into(%{attendee: %{}})
+      |> Enum.into(%{"attendee" => %{}})
       |> valid_user_attributes()
       |> Pearl.Accounts.register_attendee_user()