@auth0/auth0-checkmate 1.4.0

package/tests/clients/checkAllowedLogoutUrl.test.js

@@ -0,0 +1,149 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkAllowedLogoutUrl = require("../../analyzer/lib/clients/checkAllowedLogoutUrl");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkAllowedLogoutUrl", function () {
+  it("should return an empty report when there are no clients", function () {
+    const options = {
+      clients: [], // No clients
+    };
+
+    checkAllowedLogoutUrl(options, (reports) => {
+      expect(reports).to.deep.equal([]); // No reports expected
+    });
+  });
+
+  it("should return a fail report when client has no allowed logout URLs and app_type is not non_interactive", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // Not non_interactive
+          allowed_logout_urls: [], // No allowed logout URLs
+        },
+      ],
+    };
+
+    checkAllowedLogoutUrl(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "missing_allowed_logout_urls",
+              url: "missing_allowed_logout_urls",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return a fail report when client has insecure allowed logout URLs (http://localhost)", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          allowed_logout_urls: ["http://localhost:3000"], // Insecure logout URL
+          app_type: "spa",
+        },
+      ],
+    };
+
+    checkAllowedLogoutUrl(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "insecure_allowed_logout_urls",
+              url: "http://localhost:3000",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return a success report when client has secure allowed logout URLs (https://contoso.com)", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          allowed_logout_urls: ["https://contoso.com"], // Secure logout URL
+          app_type: "spa",
+        },
+      ],
+    };
+
+    checkAllowedLogoutUrl(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "secure_allowed_logout_urls",
+              status: CONSTANTS.SUCCESS,
+              url: "https://contoso.com",
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return both fail and success reports when client has both insecure and secure allowed logout URLs", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          allowed_logout_urls: ["http://localhost:3000", "https://contoso.com"], // Mix of insecure and secure URLs
+          app_type: "spa",
+        },
+      ],
+    };
+
+    checkAllowedLogoutUrl(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "insecure_allowed_logout_urls",
+              url: "http://localhost:3000",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "secure_allowed_logout_urls",
+              status: CONSTANTS.SUCCESS,
+              url: "https://contoso.com",
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+});

package/tests/clients/checkApplicationLoginUri.test.js

@@ -0,0 +1,180 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkApplicationLoginUri = require("../../analyzer/lib/clients/checkApplicationLoginUri");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkApplicationLoginUri", function () {
+  it("should return an empty report when there are no clients", function () {
+    const options = {
+      clients: [], // No clients
+    };
+
+    checkApplicationLoginUri(options, (reports) => {
+      expect(reports).to.deep.equal([]); // No reports expected
+    });
+  });
+
+  it("should return a fail report when client has missing initiate_login_uri for spa app type", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // spa app type
+          initiate_login_uri: "", // Missing initiate_login_uri
+        },
+      ],
+    };
+
+    checkApplicationLoginUri(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "missing_initiate_login_uri",
+              url: "missing_initiate_login_uri",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return a fail report when client has insecure initiate_login_uri containing localhost", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // spa app type
+          initiate_login_uri: "http://localhost:3000", // Insecure URI (localhost)
+        },
+      ],
+    };
+
+    checkApplicationLoginUri(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "insecure_initiate_login_uri",
+              url: "http://localhost:3000",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return a fail report when client has insecure initiate_login_uri containing http://", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // spa app type
+          initiate_login_uri: "http://example.com", // Insecure URI (http://)
+        },
+      ],
+    };
+
+    checkApplicationLoginUri(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "insecure_initiate_login_uri",
+              url: "http://example.com",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return a success report when client has a secure initiate_login_uri", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // spa app type
+          initiate_login_uri: "https://secure-example.com", // Secure URI
+        },
+      ],
+    };
+
+    checkApplicationLoginUri(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "secure_initiate_login_uri",
+              status: CONSTANTS.SUCCESS,
+              url: "https://secure-example.com",
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return both missing and insecure initiate_login_uri reports for a client with both issues", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // spa app type
+          initiate_login_uri: "http://localhost:3000", // Insecure URI and missing URI issue
+        },
+      ],
+    };
+
+    checkApplicationLoginUri(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "missing_initiate_login_uri",
+              url: "missing_initiate_login_uri",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "insecure_initiate_login_uri",
+              url: "http://localhost:3000",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+});

package/tests/clients/checkCrossOriginAuthentication.test.js

@@ -0,0 +1,99 @@
+const chai = require('chai');
+const expect = chai.expect;
+const checkCrossOriginAuthentication = require('../../analyzer/lib/clients/checkCrossOriginAuthentication');
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe('checkCrossOriginAuthentication', function() {
+
+  it('should return an empty report when clients array is empty', function() {
+    const options = {
+      clients: []
+    };
+
+    checkCrossOriginAuthentication(options, (report) => {
+      expect(report).to.be.an('array').that.is.empty;
+    });
+  });
+
+  it('should return a report when cross_origin_authentication is enabled', function() {
+    const options = {
+      clients: [
+        {
+          client_id: 'client_id_1',
+          name: 'Client 1',
+          cross_origin_authentication: true,
+          app_type: 'spa',
+        }
+      ]
+    };
+
+    checkCrossOriginAuthentication(options, (report) => {
+      expect(report).to.have.lengthOf(1);
+      expect(report[0]).to.include({
+        client_id: 'client_id_1',
+        field: 'cross_origin_authentication_enabled',
+        status: CONSTANTS.FAIL,
+        app_type: 'spa'
+      });
+      expect(report[0].name).to.equal('Client 1 (client_id_1)');
+    });
+  });
+
+  it('should not return a report when cross_origin_authentication is disabled', function() {
+    const options = {
+      clients: [
+        {
+          client_id: 'client_id_2',
+          name: 'Client 2',
+          cross_origin_authentication: false,
+          app_type: 'spa',
+        }
+      ]
+    };
+
+    checkCrossOriginAuthentication(options, (report) => {
+      expect(report).to.be.an('array').that.is.empty;
+    });
+  });
+
+  it('should handle cases where client_id is missing', function() {
+    const options = {
+      clients: [
+        {
+          name: 'Client 3',
+          cross_origin_authentication: true,
+          app_type: 'spa',
+        }
+      ]
+    };
+
+    checkCrossOriginAuthentication(options, (report) => {
+      expect(report).to.have.lengthOf(1);
+      expect(report[0]).to.include({
+        client_id: 'Client 3',
+        field: 'cross_origin_authentication_enabled',
+        status: CONSTANTS.FAIL,
+        app_type: 'spa'
+      });
+      expect(report[0].name).to.equal('Client 3');
+    });
+  });
+
+  it('should return an empty report if cross_origin_authentication is false and other properties exist', function() {
+    const options = {
+      clients: [
+        {
+          client_id: 'client_id_4',
+          name: 'Client 4',
+          cross_origin_authentication: false,
+          app_type: 'spa',
+          callbacks: ['http://localhost:3000'],
+        }
+      ]
+    };
+
+    checkCrossOriginAuthentication(options, (report) => {
+      expect(report).to.be.an('array').that.is.empty;
+    });
+  });
+});

package/tests/clients/checkGrantTypes.test.js

@@ -0,0 +1,154 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkGrantTypes = require("../../analyzer/lib/clients/checkGrantTypes");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkGrantTypes", function () {
+  it("should return an empty report when there are no clients", function () {
+    const options = {
+      clients: [], // No clients
+    };
+
+    checkGrantTypes(options, (reports) => {
+      expect(reports).to.deep.equal([]); // No reports expected
+    });
+  });
+
+  it("should return a fail report when client has missing grant types for spa app type", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // spa app type
+          grant_types: ["authorization_code"], // Missing refresh_token
+        },
+      ],
+    };
+
+    checkGrantTypes(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "missing_grant_type_for_app_type",
+              grant_type: "refresh_token",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return a fail report when client has unexpected grant types for spa app type", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // spa app type
+          grant_types: [
+            "authorization_code",
+            "implicit",
+            "refresh_token",
+            "client_credentials",
+          ], // Unexpected client_credentials
+        },
+      ],
+    };
+
+    checkGrantTypes(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "unexpected_grant_type_for_app_type",
+              grant_type: "client_credentials",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return a success report when client has the correct grant types for spa app type", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // spa app type
+          grant_types: ["authorization_code", "refresh_token"], // Correct grant types for spa
+        },
+      ],
+    };
+
+    checkGrantTypes(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "grant_types_passed",
+              status: CONSTANTS.SUCCESS,
+              grant_type: "authorization_code, refresh_token",
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+
+  it("should return both missing and unexpected grant type reports for a client with both issues", function () {
+    const options = {
+      clients: [
+        {
+          name: "Test App",
+          client_id: "client_id",
+          app_type: "spa", // spa app type
+          grant_types: ["authorization_code", "client_credentials"], // Missing refresh_token and unexpected client_credentials
+        },
+      ],
+    };
+
+    checkGrantTypes(options, (reports) => {
+      expect(reports).to.deep.equal([
+        {
+          name: "Test App",
+          report: [
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "missing_grant_type_for_app_type",
+              grant_type: "refresh_token",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+            {
+              name: "Test App",
+              client_id: "client_id",
+              field: "unexpected_grant_type_for_app_type",
+              grant_type: "client_credentials",
+              status: CONSTANTS.FAIL,
+              app_type: "spa",
+            },
+          ],
+        },
+      ]);
+    });
+  });
+});

package/tests/clients/checkJWTSignAlg.test.js

@@ -0,0 +1,121 @@
+const { expect } = require("chai");
+const checkJWTSignAlg = require("../../analyzer/lib/clients/checkJWTSignAlg");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkJWTSignAlg", function () {
+  it("should return RS256 when no jwt_configuration is provided", function () {
+    const options = {
+      clients: [
+        {
+          name: "Default App",
+          client_id: "client_id",
+          jwt_configuration: undefined, // No jwt_configuration provided, defaults to RS256
+        },
+      ],
+    };
+
+    checkJWTSignAlg(options, (report) => {
+      expect(report).to.have.lengthOf(1);
+      expect(report[0].field).to.equal("missing_jwt_alg");
+      expect(report[0].status).to.equal(CONSTANTS.SUCCESS);
+      expect(report[0].alg).to.equal("RS256");
+    });
+  });
+
+  it("should return success for clients using an asymmetric algorithm (e.g., RS512)", function () {
+    const options = {
+      clients: [
+        {
+          name: "Default App",
+          client_id: "client_id",
+          jwt_configuration: {
+            alg: "RS512", // Custom asymmetric algorithm
+          },
+        },
+      ],
+    };
+
+    checkJWTSignAlg(options, (report) => {
+      expect(report).to.have.lengthOf(1);
+      expect(report[0].field).to.equal("using_asymmetric_alg");
+      expect(report[0].status).to.equal(CONSTANTS.SUCCESS);
+      expect(report[0].alg).to.equal("RS512");
+    });
+  });
+
+  it("should return fail for clients using HS256 (symmetric algorithm)", function () {
+    const options = {
+      clients: [
+        {
+          name: "Default App",
+          client_id: "client_id",
+          jwt_configuration: {
+            alg: "HS256", // Symmetric algorithm, flagged as an issue
+          },
+        },
+      ],
+    };
+
+    checkJWTSignAlg(options, (report) => {
+      expect(report).to.have.lengthOf(1);
+      expect(report[0].field).to.equal("not_using_asymmetric_alg");
+      expect(report[0].status).to.equal(CONSTANTS.FAIL);
+      expect(report[0].alg).to.equal("HS256");
+    });
+  });
+
+  it("should return an empty report when no clients are provided", function () {
+    const options = {
+      clients: [], // Empty clients list
+    };
+
+    checkJWTSignAlg(options, (report) => {
+      expect(report).to.have.lengthOf(0); // No reports should be generated
+    });
+  });
+
+  it("should handle multiple clients with different JWT configurations", function () {
+    const options = {
+      clients: [
+        {
+          name: "Client 1",
+          client_id: "client_1_id",
+          jwt_configuration: undefined, // No jwt_configuration provided, defaults to RS256
+        },
+        {
+          name: "Client 2",
+          client_id: "client_2_id",
+          jwt_configuration: {
+            alg: "RS256",
+          },
+        },
+        {
+          name: "Client 3",
+          client_id: "client_3_id",
+          jwt_configuration: {
+            alg: "HS256",
+          },
+        },
+      ],
+    };
+
+    checkJWTSignAlg(options, (report) => {
+      expect(report).to.have.lengthOf(3);
+
+      // Client 1: Missing JWT configuration, defaults to RS256
+      expect(report[0].field).to.equal("missing_jwt_alg");
+      expect(report[0].status).to.equal(CONSTANTS.SUCCESS);
+      expect(report[0].alg).to.equal("RS256");
+
+      // Client 2: Uses RS256 (asymmetric)
+      expect(report[1].field).to.equal("using_asymmetric_alg");
+      expect(report[1].status).to.equal(CONSTANTS.SUCCESS);
+      expect(report[1].alg).to.equal("RS256");
+
+      // Client 3: Uses HS256 (symmetric)
+      expect(report[2].field).to.equal("not_using_asymmetric_alg");
+      expect(report[2].status).to.equal(CONSTANTS.FAIL);
+      expect(report[2].alg).to.equal("HS256");
+    });
+  });
+});