@auth0/auth0-checkmate 1.4.0

package/tests/attack_protection/checkBruteForce.test.js

@@ -0,0 +1,181 @@
+const { expect } = require("chai");
+const checkBruteForce = require("../../analyzer/lib/attack_protection/checkBruteForce");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkBruteForce", function () {
+  it("should return success when brute force protection is enabled and correctly configured", function () {
+    const options = {
+      attackProtection: {
+        bruteForceProtection: {
+          enabled: true,
+          shields: ["block", "user_notification"],
+          mode: "count_per_identifier_and_ip",
+          allowlist: [],
+          max_attempts: 3,
+        },
+      },
+    };
+
+    checkBruteForce(options, (report) => {
+      // Check if the report contains expected success statuses
+      expect(report).to.deep.include({
+        field: "enabled",
+        status: CONSTANTS.SUCCESS,
+      });
+      expect(report).to.deep.include({
+        field: "shieldsConfigured",
+        status: CONSTANTS.SUCCESS,
+      });
+      expect(report).to.deep.include({
+        field: "allowlistEmpty",
+        status: CONSTANTS.SUCCESS,
+      });
+      expect(report).to.deep.include({
+        field: "stageMaxAttempts",
+        status: CONSTANTS.SUCCESS,
+        value: 3,
+      });
+    });
+  });
+
+  it("should return failure when brute force protection is disabled", function () {
+    const options = {
+      attackProtection: {
+        bruteForceProtection: {
+          enabled: false,
+          shields: ["block"],
+          mode: "count_per_identifier_and_ip",
+          allowlist: [],
+          max_attempts: 3,
+        },
+      },
+    };
+
+    checkBruteForce(options, (report) => {
+      expect(report).to.deep.include({
+        field: "disabled",
+        status: CONSTANTS.FAIL,
+      });
+    });
+  });
+
+  it("should return failure when shields have missing values", function () {
+    const options = {
+      attackProtection: {
+        bruteForceProtection: {
+          enabled: true,
+          shields: ["block"], // Missing "user_notification"
+          mode: "count_per_identifier_and_ip",
+          allowlist: [],
+          max_attempts: 3,
+        },
+      },
+    };
+
+    checkBruteForce(options, (report) => {
+      expect(report).to.deep.include({
+        field: "shieldsMissing",
+        status: CONSTANTS.FAIL,
+        value: "user_notification",
+      });
+    });
+  });
+
+  it("should return failure when allowlist is not empty", function () {
+    const options = {
+      attackProtection: {
+        bruteForceProtection: {
+          enabled: true,
+          shields: ["block", "user_notification"],
+          mode: "count_per_identifier_and_ip",
+          allowlist: ["127.0.0.1"],
+          max_attempts: 3,
+        },
+      },
+    };
+
+    checkBruteForce(options, (report) => {
+      expect(report).to.deep.include({
+        field: "allowlistPresent",
+        status: CONSTANTS.FAIL,
+        value: "127.0.0.1",
+      });
+    });
+  });
+
+  it("should return failure when max_attempts is less than or equal to 0", function () {
+    const options = {
+      attackProtection: {
+        bruteForceProtection: {
+          enabled: true,
+          shields: ["block", "user_notification"],
+          mode: "count_per_identifier_and_ip",
+          allowlist: [],
+          max_attempts: 0, // Invalid value
+        },
+      },
+    };
+
+    checkBruteForce(options, (report) => {
+      expect(report).to.deep.include({
+        field: "stageMaxAttemptsInvalid",
+        status: CONSTANTS.FAIL,
+        value: 0,
+      });
+    });
+  });
+
+  it("should return failure when rate is less than or equal to 0", function () {
+    const options = {
+      attackProtection: {
+        bruteForceProtection: {
+          enabled: true,
+          shields: ["block", "user_notification"],
+          mode: "count_per_identifier_and_ip",
+          allowlist: [],
+          max_attempts: 3,
+          stage: {
+            "pre-user-registration": {
+              rate: 0, // Invalid value
+            },
+          },
+        },
+      },
+    };
+
+    checkBruteForce(options, (report) => {
+      expect(report).to.deep.include({
+        field: "stageRateInvalid",
+        status: CONSTANTS.FAIL,
+        value: 0,
+      });
+    });
+  });
+
+  it("should return success when rate is valid", function () {
+    const options = {
+      attackProtection: {
+        bruteForceProtection: {
+          enabled: true,
+          shields: ["block", "user_notification"],
+          mode: "count_per_identifier_and_ip",
+          allowlist: [],
+          max_attempts: 3,
+          stage: {
+            "pre-user-registration": {
+              rate: 5, // Valid value
+            },
+          },
+        },
+      },
+    };
+
+    checkBruteForce(options, (report) => {
+      expect(report).to.deep.include({
+        field: "stageRate",
+        status: CONSTANTS.SUCCESS,
+        value: 5,
+      });
+    });
+  });
+});

package/tests/attack_protection/checkSuspiciousIPThrottling.test.js

@@ -0,0 +1,222 @@
+const { expect } = require("chai");
+const checkSuspiciousIPThrottling = require("../../analyzer/lib/attack_protection/checkSuspiciousIPThrottling");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkSuspiciousIPThrottling", function () {
+  it("should return success when suspicious IP throttling is enabled and correctly configured", function () {
+    const options = {
+      attackProtection: {
+        suspiciousIpThrottling: {
+          enabled: true,
+          shields: ["admin_notification", "block"],
+          allowlist: [],
+          stage: {
+            "pre-login": {
+              max_attempts: 100,
+              rate: 864000,
+            },
+            "pre-user-registration": {
+              max_attempts: 50,
+              rate: 1200,
+            },
+          },
+        },
+      },
+    };
+
+    checkSuspiciousIPThrottling(options, (report) => {
+      // Check if the report contains expected success statuses
+      expect(report).to.deep.include({
+        field: "enabled",
+        status: CONSTANTS.SUCCESS,
+      });
+      expect(report).to.deep.include({
+        field: "shieldsConfigured",
+        status: CONSTANTS.SUCCESS,
+      });
+      expect(report).to.deep.include({
+        field: "allowlistEmpty",
+        status: CONSTANTS.SUCCESS,
+      });
+    });
+  });
+
+  it("should return failure when suspicious IP throttling is disabled", function () {
+    const options = {
+      attackProtection: {
+        suspiciousIpThrottling: {
+          enabled: false,
+          shields: ["block"],
+          allowlist: [],
+          stage: {
+            "pre-login": {
+              max_attempts: 100,
+              rate: 864000,
+            },
+            "pre-user-registration": {
+              max_attempts: 50,
+              rate: 1200,
+            },
+          },
+        },
+      },
+    };
+
+    checkSuspiciousIPThrottling(options, (report) => {
+      expect(report).to.deep.include({
+        field: "disabled",
+        status: CONSTANTS.FAIL,
+      });
+    });
+  });
+
+  it("should return failure when shields are missing values", function () {
+    const options = {
+      attackProtection: {
+        suspiciousIpThrottling: {
+          enabled: true,
+          shields: ["block"], // Missing "admin_notification"
+          allowlist: [],
+          stage: {
+            "pre-login": {
+              max_attempts: 100,
+              rate: 864000,
+            },
+            "pre-user-registration": {
+              max_attempts: 50,
+              rate: 1200,
+            },
+          },
+        },
+      },
+    };
+
+    checkSuspiciousIPThrottling(options, (report) => {
+      expect(report).to.deep.include({
+        field: "shieldsMissing",
+        status: CONSTANTS.FAIL,
+        value: "admin_notification",
+      });
+    });
+  });
+
+  it("should return failure when allowlist is not empty", function () {
+    const options = {
+      attackProtection: {
+        suspiciousIpThrottling: {
+          enabled: true,
+          shields: ["block", "admin_notification"],
+          allowlist: ["192.168.0.1"],
+          stage: {
+            "pre-login": {
+              max_attempts: 100,
+              rate: 864000,
+            },
+            "pre-user-registration": {
+              max_attempts: 50,
+              rate: 1200,
+            },
+          },
+        },
+      },
+    };
+
+    checkSuspiciousIPThrottling(options, (report) => {
+      expect(report).to.deep.include({
+        field: "allowlistPresent",
+        status: CONSTANTS.FAIL,
+        value: "192.168.0.1",
+      });
+    });
+  });
+
+  it("should return failure when max_attempts is less than or equal to 0", function () {
+    const options = {
+      attackProtection: {
+        suspiciousIpThrottling: {
+          enabled: true,
+          shields: ["block", "admin_notification"],
+          allowlist: [],
+          stage: {
+            "pre-login": {
+              max_attempts: 0, // Invalid value
+              rate: 864000,
+            },
+            "pre-user-registration": {
+              max_attempts: 50,
+              rate: 1200,
+            },
+          },
+        },
+      },
+    };
+
+    checkSuspiciousIPThrottling(options, (report) => {
+      expect(report).to.deep.include({
+        field: "stageMaxAttemptsInvalid",
+        status: CONSTANTS.FAIL,
+        value: 0,
+      });
+    });
+  });
+
+  it("should return failure when rate is less than or equal to 0", function () {
+    const options = {
+      attackProtection: {
+        suspiciousIpThrottling: {
+          enabled: true,
+          shields: ["block", "admin_notification"],
+          allowlist: [],
+          stage: {
+            "pre-login": {
+              max_attempts: 100,
+              rate: 0, // Invalid value
+            },
+            "pre-user-registration": {
+              max_attempts: 50,
+              rate: 1200,
+            },
+          },
+        },
+      },
+    };
+
+    checkSuspiciousIPThrottling(options, (report) => {
+      expect(report).to.deep.include({
+        field: "stageRateInvalid",
+        status: CONSTANTS.FAIL,
+        value: 0,
+      });
+    });
+  });
+
+  it("should return success when rate is valid", function () {
+    const options = {
+      attackProtection: {
+        suspiciousIpThrottling: {
+          enabled: true,
+          shields: ["block", "admin_notification"],
+          allowlist: [],
+          stage: {
+            "pre-login": {
+              max_attempts: 100,
+              rate: 864000, // Valid value
+            },
+            "pre-user-registration": {
+              max_attempts: 50,
+              rate: 1200,
+            },
+          },
+        },
+      },
+    };
+
+    checkSuspiciousIPThrottling(options, (report) => {
+      expect(report).to.deep.include({
+        field: "stageRate",
+        status: CONSTANTS.SUCCESS,
+        value: 864000,
+      });
+    });
+  });
+});

package/tests/canonical_domain/checkCanonicalDomain.test.js

@@ -0,0 +1,94 @@
+const chai = require("chai");
+const expect = chai.expect;
+const checkCanonicalDomain = require("../../analyzer/lib/canonical_domain/checkCanonicalDomain");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkCanonicalDomain", function () {
+  it("should add the hostname to report if logs are not empty but customDomains is empty", function () {
+    const options = {
+      customDomains: [], // Empty customDomains
+      logs: [
+        {
+          type: "s",
+          hostname: "contoso.us.auth0.com",
+          _id: "90020250210004837491441000000000000001223372036874609060",
+        },
+      ],
+    };
+
+    checkCanonicalDomain(options, (report) => {
+      // Check that the report contains the hostname from logs
+      expect(report).to.have.lengthOf(1);
+      expect(report[0].field).to.equal("canonical_domain_used");
+      expect(report[0].value).to.equal(
+        "log_id: 90020250210004837491441000000000000001223372036874609060",
+      );
+      expect(report[0].status).to.equal(CONSTANTS.FAIL);
+    });
+  });
+
+  it("should add the hostname to report if no match is found in customDomains", function () {
+    const options = {
+      customDomains: [
+        {
+          domain: "different.com",
+          primary: true,
+          status: "ready",
+          tls_policy: "recommended",
+          type: "auth0_managed_certs",
+          verification: {},
+        },
+      ], // Custom domain is different
+      logs: [
+        {
+          type: "s",
+          hostname: "contoso.us.auth0.com",
+          _id: "90020250210004837491441000000000000001223372036874609060",
+        },
+      ],
+    };
+
+    checkCanonicalDomain(options, (report) => {
+      // Check that the report contains the hostname from logs because there is no match
+      expect(report).to.have.lengthOf(1);
+      expect(report[0].field).to.equal("canonical_domain_used");
+      expect(report[0].value).to.equal(
+        "log_id: 90020250210004837491441000000000000001223372036874609060",
+      );
+      expect(report[0].status).to.equal(CONSTANTS.FAIL);
+    });
+  });
+
+  it("should return an empty report if logs are empty", function () {
+    const options = {
+      customDomains: [
+        {
+          domain: "contoso.com",
+          primary: true,
+          status: "ready",
+          tls_policy: "recommended",
+          type: "auth0_managed_certs",
+          verification: {},
+        },
+      ],
+      logs: [], // No logs
+    };
+
+    checkCanonicalDomain(options, (report) => {
+      // Check that the report is empty
+      expect(report).to.be.an("array").that.is.empty;
+    });
+  });
+
+  it("should not add anything to the report if customDomains are empty and no logs exist", function () {
+    const options = {
+      customDomains: [], // No custom domains
+      logs: [], // No logs
+    };
+
+    checkCanonicalDomain(options, (report) => {
+      // Check that the report is empty
+      expect(report).to.be.an("array").that.is.empty;
+    });
+  });
+});

package/tests/clients/checkAllowedCallbacks.test.js

@@ -0,0 +1,149 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkAllowedCallbacks = require("../../analyzer/lib/clients/checkAllowedCallbacks");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkAllowedCallbacks", function () {
+  it("should return an empty report when there are no clients", function () {
+    const options = {
+      clients: [], // No clients
+    };
+
+    checkAllowedCallbacks(options, (reports) => {
+      expect(reports).to.deep.equal([]); // No reports expected
+    });
+  });
+
+  it("should return a fail report when client has no callbacks and app_type is not non_interactive", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // Not non_interactive
+          callbacks: [], // No callbacks
+        },
+      ],
+    };
+
+    checkAllowedCallbacks(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "missing_callbacks",
+              url: "",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return a fail report when client has insecure callbacks (http://localhost)", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          callbacks: ["http://localhost:3000"], // Insecure callback URL
+          app_type: "spa",
+        },
+      ],
+    };
+
+    checkAllowedCallbacks(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "insecure_callbacks",
+              url: "http://localhost:3000",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return a success report when client has secure callbacks (https://contoso.com)", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          callbacks: ["https://contoso.com"], // Secure callback URL
+          app_type: "spa",
+        },
+      ],
+    };
+
+    checkAllowedCallbacks(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "secure_callbacks",
+              status: CONSTANTS.SUCCESS,
+              url: "https://contoso.com",
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return both fail and success reports when client has both insecure and secure callbacks", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          callbacks: ["http://localhost:3000", "https://contoso.com"], // Mix of insecure and secure URLs
+          app_type: "spa",
+        },
+      ],
+    };
+
+    checkAllowedCallbacks(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "insecure_callbacks",
+              url: "http://localhost:3000",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "secure_callbacks",
+              status: CONSTANTS.SUCCESS,
+              url: "https://contoso.com",
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+});