@auth0/auth0-checkmate 1.4.0

package/tests/log_streams/checkLogStream.test.js

@@ -0,0 +1,140 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkLogStream = require("../../analyzer/lib/log_streams/checkLogStream");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+// Mock the CONSTANTS values
+CONSTANTS.SUCCESS = "success";
+CONSTANTS.FAIL = "fail";
+
+describe("checkLogStream", function () {
+  it("should return fail when logStreams is empty", function () {
+    const options = { logStreams: [] };
+
+    checkLogStream(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "log_stream_not_configured",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+
+  it("should return success when a log stream is active", function () {
+    const options = {
+      logStreams: [
+        {
+          id: "lst_0001",
+          name: "Auth0 Logstream",
+          type: "http",
+          status: "active",
+          filters: [],
+          isPriority: false,
+        },
+      ],
+    };
+
+    checkLogStream(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "log_stream_active",
+          name: "Auth0 Logstream",
+          type: "http",
+          stream_status: "active",
+          status: CONSTANTS.SUCCESS,
+        },
+      ]);
+    });
+  });
+
+  it("should return fail when a log stream is inactive", function () {
+    const options = {
+      logStreams: [
+        {
+          id: "lst_0001",
+          name: "Auth0 Logstream",
+          type: "http",
+          status: "inactive",
+          filters: [],
+          isPriority: false,
+        },
+      ],
+    };
+
+    checkLogStream(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "log_stream_inactive",
+          name: "Auth0 Logstream",
+          type: "http",
+          stream_status: "inactive",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+
+  it('should return an empty report if errorCode "insufficient_scope" is present', function () {
+    const options = {
+      logStreams: [
+        {
+          id: "lst_0001",
+          name: "Auth0 Logstream",
+          type: "http",
+          status: "active",
+          errorCode: "insufficient_scope",
+          filters: [],
+          isPriority: false,
+        },
+      ],
+    };
+
+    checkLogStream(options, (report) => {
+      expect(report).to.deep.equal([]); // The report should be empty for insufficient scope
+    });
+  });
+
+  it("should handle multiple log streams with mixed statuses", function () {
+    const options = {
+      logStreams: [
+        {
+          id: "lst_0001",
+          name: "Auth0 Logstream",
+          type: "http",
+          status: "active",
+          filters: [],
+          isPriority: false,
+        },
+        {
+          id: "lst_0000000000014672",
+          name: "Another Logstream",
+          type: "http",
+          status: "inactive",
+          filters: [],
+          isPriority: true,
+        },
+      ],
+    };
+
+    checkLogStream(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "log_stream_active",
+          name: "Auth0 Logstream",
+          type: "http",
+          stream_status: "active",
+          status: CONSTANTS.SUCCESS,
+        },
+        {
+          field: "log_stream_inactive",
+          name: "Another Logstream",
+          type: "http",
+          stream_status: "inactive",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+});

package/tests/multifactor/checkGuardianFactors.test.js

@@ -0,0 +1,94 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkGuardianFactors = require("../../analyzer/lib/multifactor/checkGuardianFactors");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkGuardianFactors", function () {
+  it("should return fail when no MFA factors are enabled", function () {
+    const options = {
+      guardianFactors: [
+        { name: "sms", enabled: false, trial_expired: false },
+        { name: "push-notification", enabled: false, trial_expired: false },
+        { name: "otp", enabled: false, trial_expired: false },
+        { name: "email", enabled: false, trial_expired: false },
+        { name: "duo", enabled: false, trial_expired: false },
+        { name: "webauthn-roaming", enabled: false, trial_expired: false },
+        { name: "webauthn-platform", enabled: false, trial_expired: false },
+        { name: "recovery-code", enabled: false, trial_expired: false },
+      ],
+    };
+
+    checkGuardianFactors(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "mfa_factors_not_enabled",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+
+  it("should return success when one MFA factor is enabled", function () {
+    const options = {
+      guardianFactors: [
+        { name: "sms", enabled: false, trial_expired: false },
+        { name: "push-notification", enabled: false, trial_expired: false },
+        { name: "otp", enabled: true, trial_expired: false }, // enabled factor
+        { name: "email", enabled: false, trial_expired: false },
+        { name: "duo", enabled: false, trial_expired: false },
+        { name: "webauthn-roaming", enabled: false, trial_expired: false },
+        { name: "webauthn-platform", enabled: false, trial_expired: false },
+        { name: "recovery-code", enabled: false, trial_expired: false },
+      ],
+    };
+
+    checkGuardianFactors(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "mfa_factors_enabled",
+          value: "otp",
+          status: CONSTANTS.SUCCESS,
+        },
+      ]);
+    });
+  });
+
+  it("should return success when multiple MFA factors are enabled", function () {
+    const options = {
+      guardianFactors: [
+        { name: "sms", enabled: true, trial_expired: false },
+        { name: "push-notification", enabled: false, trial_expired: false },
+        { name: "otp", enabled: true, trial_expired: false }, // enabled factor
+        { name: "email", enabled: false, trial_expired: false },
+        { name: "duo", enabled: false, trial_expired: false },
+        { name: "webauthn-roaming", enabled: false, trial_expired: false },
+        { name: "webauthn-platform", enabled: false, trial_expired: false },
+        { name: "recovery-code", enabled: false, trial_expired: false },
+      ],
+    };
+
+    checkGuardianFactors(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "mfa_factors_enabled",
+          value: "smsotp", // concatenated list of enabled factors
+          status: CONSTANTS.SUCCESS,
+        },
+      ]);
+    });
+  });
+
+  it("should return fail when no guardianFactors are provided", function () {
+    const options = {};
+
+    checkGuardianFactors(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "mfa_factors_not_enabled",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+});

package/tests/multifactor/checkGuardianPolicy.test.js

@@ -0,0 +1,49 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkGuardianPolicy = require("../../analyzer/lib/multifactor/checkGuardianPolicy");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkGuardianPolicy", function () {
+  it("should return fail when guardianPolicies.policies is empty", function () {
+    const options = { guardianPolicies: { policies: [] } };
+
+    checkGuardianPolicy(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "mfa_policy_set_to_never",
+          value: "never",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+
+  it("should return success when guardianPolicies.policies has a value", function () {
+    const options = { guardianPolicies: { policies: ["all-applications"] } };
+
+    checkGuardianPolicy(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "mfa_policy_set",
+          value: "enabled",
+          status: CONSTANTS.SUCCESS,
+        },
+      ]);
+    });
+  });
+
+  it("should return fail when guardianPolicies is not provided", function () {
+    const options = {};
+
+    checkGuardianPolicy(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "mfa_policy_set_to_never",
+          value: "never",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+});

package/tests/rules/checkRules.test.js

@@ -0,0 +1,102 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkRules = require("../../analyzer/lib/rules/checkRules");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkRules", function () {
+  it("should return success when no rules are provided", function () {
+    const options = {};
+
+    checkRules(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "no_enabled_rules",
+          status: CONSTANTS.SUCCESS,
+        },
+      ]);
+    });
+  });
+
+  it("should return fail for an enabled rule", function () {
+    const options = {
+      rules: [
+        {
+          id: "rul_YFDdYGJSIwMPzsZR",
+          enabled: true,
+          name: "Override SAML Certificate",
+          order: 14,
+          stage: "login_success",
+        },
+      ],
+    };
+
+    checkRules(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          name: "Override SAML Certificate",
+          value: "rul_YFDdYGJSIwMPzsZR",
+          field: "enabled_rules",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+
+  it("should return empty for disabled rules", function () {
+    const options = {
+      rules: [
+        {
+          id: "rul_IYlu62iBa6K52fBi",
+          enabled: false,
+          name: "Dump Rule",
+          order: 1,
+          stage: "login_success",
+        },
+        {
+          id: "rul_RFtsxXcHptdfNytp",
+          enabled: false,
+          name: "auth0-account-link-extension",
+          order: 7,
+          stage: "login_success",
+        },
+      ],
+    };
+
+    checkRules(options, (report) => {
+      expect(report).to.deep.equal([]);
+    });
+  });
+
+  it("should return fail for only rules with enabled state", function () {
+    const options = {
+      rules: [
+        {
+          id: "rul_YFDdYGJSIwMPzsZR",
+          enabled: true,
+          name: "Override SAML Certificate",
+          order: 14,
+          stage: "login_success",
+        },
+        {
+          id: "rul_IYlu62iBa6K52fBi",
+          enabled: false,
+          name: "Dump Rule",
+          order: 1,
+          stage: "login_success",
+        },
+      ],
+    };
+
+    checkRules(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          name: "Override SAML Certificate",
+          value: "rul_YFDdYGJSIwMPzsZR",
+          field: "enabled_rules",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+});

package/tests/tenant_settings/checkDefaultAudience.test.js

@@ -0,0 +1,62 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkDefaultAudience = require("../../analyzer/lib/tenant_settings/checkDefaultAudience");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkDefaultAudience", function () {
+  it("should return an info report when default_audience is not set (null or empty)", function () {
+    const options = {
+      tenant: {
+        default_audience: null, // default_audience is null
+      },
+    };
+
+    checkDefaultAudience(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "no_default_audience",
+          attr: "default_audience",
+          status: CONSTANTS.INFO,
+        },
+      ]);
+    });
+  });
+
+  it("should return an info report when default_audience is an empty string", function () {
+    const options = {
+      tenant: {
+        default_audience: "", // default_audience is an empty string
+      },
+    };
+
+    checkDefaultAudience(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "no_default_audience",
+          attr: "default_audience",
+          status: CONSTANTS.INFO,
+        },
+      ]);
+    });
+  });
+
+  it("should return a fail report when default_audience is set to a non-empty value", function () {
+    const options = {
+      tenant: {
+        default_audience: "audience1", // default_audience is set to a non-empty string
+      },
+    };
+
+    checkDefaultAudience(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "default_audience",
+          attr: "default_audience",
+          value: "audience1",
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+});

package/tests/tenant_settings/checkDefaultDirectory.test.js

@@ -0,0 +1,62 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkDefaultDirectory = require("../../analyzer/lib/tenant_settings/checkDefaultDirectory");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkDefaultDirectory", function () {
+  it("should return an info report when default_directory is not set (null or empty)", function () {
+    const options = {
+      tenant: {
+        default_directory: null, // default_directory is null
+      },
+    };
+
+    checkDefaultDirectory(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "no_default_directory",
+          attr: "default_directory",
+          status: CONSTANTS.INFO,
+        },
+      ]);
+    });
+  });
+
+  it("should return an info report when default_directory is an empty string", function () {
+    const options = {
+      tenant: {
+        default_directory: "", // default_directory is an empty string
+      },
+    };
+
+    checkDefaultDirectory(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "no_default_directory",
+          attr: "default_directory",
+          status: CONSTANTS.INFO,
+        },
+      ]);
+    });
+  });
+
+  it("should return an info report when default_directory is set to a non-empty value", function () {
+    const options = {
+      tenant: {
+        default_directory: "my-directory", // default_directory is set to a non-empty string
+      },
+    };
+
+    checkDefaultDirectory(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "default_directory",
+          attr: "default_directory",
+          value: "my-directory",
+          status: CONSTANTS.INFO,
+        },
+      ]);
+    });
+  });
+});

package/tests/tenant_settings/checkEnabledDynamicClientRegistration.test.js

@@ -0,0 +1,97 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkReg = require("../../analyzer/lib/tenant_settings/checkEnabledDynamicClientRegistration");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkReg", function () {
+    it("should return fail when input is not set (null or empty)", function () {
+        const options = {
+            tenant: {
+            },
+        };
+
+        checkReg(options, (report) => {
+            expect(report).to.deep.equal([
+                {
+                    field: "tenant_setting_missing",
+                    status: CONSTANTS.FAIL,
+                },
+            ]);
+        });
+    });
+
+    it("should return fail when flag.enable_dynamic_client_registration attribute not present", function () {
+        const options = {
+            tenant: {
+                "flags": {
+                    "allow_changing_enable_sso": true,
+                    "disable_impersonation": true,
+                    "enable_sso": true,
+                    "universal_login": true,
+                    "revoke_refresh_token_grant": false,
+                    "disable_clickjack_protection_headers": false
+                },
+            },
+        };
+
+        checkReg(options, (report) => {
+            expect(report).to.deep.equal([
+                {
+                    field: "enable_dynamic_client_registration",
+                    status: CONSTANTS.FAIL,
+                },
+            ]);
+        });
+    });
+
+    it("should return fail when flag.enable_dynamic_client_registration attribute is present with false ", function () {
+        const options = {
+            tenant: {
+                "flags": {
+                    "allow_changing_enable_sso": true,
+                    "disable_impersonation": true,
+                    "enable_sso": true,
+                    "universal_login": true,
+                    "enable_dynamic_client_registration": false,
+                    "revoke_refresh_token_grant": false,
+                    "disable_clickjack_protection_headers": false
+                },
+            },
+        };
+
+        checkReg(options, (report) => {
+            expect(report).to.deep.equal([
+                {
+                    field: "enable_dynamic_client_registration",
+                    status: CONSTANTS.FAIL,
+                },
+            ]);
+        });
+    });
+
+    it("should return success when flag.enable_dynamic_client_registration attribute is present with true", function () {
+        const options = {
+            tenant: {
+                "flags": {
+                    "allow_changing_enable_sso": true,
+                    "disable_impersonation": true,
+                    "enable_sso": true,
+                    "universal_login": true,
+                    "enable_dynamic_client_registration": true,
+                    "revoke_refresh_token_grant": false,
+                    "disable_clickjack_protection_headers": false
+                },
+            },
+        };
+
+        checkReg(options, (report) => {
+            expect(report).to.deep.equal([
+                {
+                    field: "enabled_dynamic_client_registration",
+                    status: CONSTANTS.SUCCESS,
+                },
+            ]);
+        });
+    });
+});

package/tests/tenant_settings/checkSandboxVersion.test.js

@@ -0,0 +1,50 @@
+const chai = require("chai");
+const expect = chai.expect;
+
+const checkSandboxVersion = require("../../analyzer/lib/tenant_settings/checkSandboxVersion");
+const CONSTANTS = require("../../analyzer/lib/constants");
+
+describe("checkSandboxVersion", function () {
+  it("should return a failure report for sandbox version below minimum required version", function () {
+    const options = {
+      tenant: {
+        sandbox_version: "16", // Below the minimum required version
+      },
+    };
+
+    checkSandboxVersion(options, (report) => {
+      expect(report).to.deep.equal([
+        {
+          field: "sandbox_version",
+          attr: "sandbox_version",
+          value: 16,
+          status: CONSTANTS.FAIL,
+        },
+      ]);
+    });
+  });
+
+  it("should not return a report for sandbox version equal to or above the minimum required version", function () {
+    const options = {
+      tenant: {
+        sandbox_version: "18", // Minimum required version
+      },
+    };
+
+    checkSandboxVersion(options, (report) => {
+      expect(report).to.deep.equal([]);
+    });
+  });
+
+  it("should not return a report for sandbox version above the minimum required version", function () {
+    const options = {
+      tenant: {
+        sandbox_version: "22", // Above the minimum required version
+      },
+    };
+
+    checkSandboxVersion(options, (report) => {
+      expect(report).to.deep.equal([]);
+    });
+  });
+});