@axinom/mosaic-id-guard 0.18.0-rc.9 → 0.18.0

package/src/graphql/subscription-authorization-hook-factory.spec.ts

@@ -1,749 +0,0 @@
-import { Request, Response } from 'express';
-import { ExecutionArgs, GraphQLSchema } from 'graphql';
-import gql from 'graphql-tag';
-import { CloseCode } from 'graphql-ws';
-import { makePluginHook, PostGraphileOptions } from 'postgraphile';
-import { ExecutionParams } from 'subscriptions-transport-ws';
-import { IdGuardErrors, SubjectType } from '../common';
-import { subscriptionAuthorizationHookFactory } from './subscription-authorization-hook-factory';
-
-describe('subscriptionAuthorizationHookFactory', () => {
-  describe('When calling the subscription through postgraphile:ws:onOperation', () => {
-    it('Management User without required permissions -> UserNotAuthorized error', async () => {
-      // Arrange
-      const hookGenerator = subscriptionAuthorizationHookFactory;
-      const buildOptions: PostGraphileOptions<Request, Response> = {
-        graphileBuildOptions: {
-          // permission definition without permissions for the required subscription 'echoSubscription'
-          permissionDefinition: {
-            gqlOptions: {
-              anonymousGqlOperations: [],
-              ignoredGqlOperations: [],
-            },
-            permissions: [
-              {
-                key: 'Editor',
-                title: 'Editor',
-                gqlOperations: ['otherEndpoint'],
-              },
-            ],
-          },
-        },
-      };
-      const hookPlugin = hookGenerator(buildOptions);
-      const context = {
-        subject: {
-          sub: 'test-user',
-          permissions: { 'test-service': ['Editor'] },
-          exp: new Date().getTime() / 1000 + 20, // set expiry time of the token to currentTime + 20 seconds
-          subjectType: SubjectType.UserAccount,
-        },
-        config: { serviceId: 'test-service' },
-      };
-
-      const params: ExecutionParams = {
-        query: `subscription EchoSubscription {
-          echoSubscription
-        }`,
-        operationName: 'EchoSubscription',
-        context: context,
-        variables: [],
-      };
-      const hookFunction = makePluginHook([hookPlugin]);
-
-      // Act & Assert
-      expect(() =>
-        hookFunction('postgraphile:ws:onOperation', params, context),
-      ).toThrow('User is not authorized to access the operation.');
-    });
-
-    it('EndUserApplication token without required permissions -> UserNotAuthorized error', async () => {
-      // Arrange
-      const hookGenerator = subscriptionAuthorizationHookFactory;
-      const buildOptions: PostGraphileOptions<Request, Response> = {
-        graphileBuildOptions: {
-          endUserAuthorizationConfig: {
-            anonymousGqlOperations: [],
-            applicationTokenAllowedGqlOperations: [
-              'subscriptionPlans',
-              'subscriptionLifecycleStatusMutated',
-            ],
-          },
-        },
-      };
-      const hookPlugin = hookGenerator(buildOptions);
-      const context = {
-        subject: {
-          sub: 'test-user',
-          exp: new Date().getTime() / 1000 + 20, // set expiry time of the token to currentTime + 20 seconds
-          subjectType: SubjectType.EndUserApplication,
-        },
-        config: { serviceId: 'test-service' },
-      };
-
-      const params: ExecutionParams = {
-        query: `subscription EchoSubscription {
-          echoSubscription
-        }`,
-        operationName: 'EchoSubscription',
-        context: context,
-        variables: [],
-      };
-      const hookFunction = makePluginHook([hookPlugin]);
-
-      // Act & Assert
-      expect(() =>
-        hookFunction('postgraphile:ws:onOperation', params, context),
-      ).toThrow('Application Token is not authorized to access the operation.');
-    });
-
-    it.each([
-      SubjectType.UserAccount,
-      SubjectType.ManagedServiceAccount,
-      SubjectType.ServiceAccount,
-      SubjectType.ImpersonatedUserAccount,
-      SubjectType.EndUserApplication,
-      SubjectType.EndUserAccount,
-    ])(
-      'Authorized %s with expired token for subscription -> UserNotAuthorized error',
-      async (subjectType) => {
-        // Arrange
-        const hookGenerator = subscriptionAuthorizationHookFactory;
-        let buildOptions: PostGraphileOptions<Request, Response>;
-        if (
-          subjectType !== SubjectType.EndUserAccount &&
-          subjectType !== SubjectType.EndUserApplication
-        ) {
-          buildOptions = {
-            graphileBuildOptions: {
-              permissionDefinition: {
-                gqlOptions: {
-                  anonymousGqlOperations: [],
-                  ignoredGqlOperations: [],
-                },
-                permissions: [
-                  {
-                    key: 'Editor',
-                    title: 'Editor',
-                    gqlOperations: ['otherEndpoint', 'echoSubscription'],
-                  },
-                ],
-              },
-            },
-          };
-        } else {
-          buildOptions = {
-            graphileBuildOptions: {
-              endUserAuthorizationConfig: {
-                anonymousGqlOperations: [],
-                applicationTokenAllowedGqlOperations: ['echoSubscription'],
-              },
-            },
-          };
-        }
-
-        const hookPlugin = hookGenerator(buildOptions);
-        const context = {
-          subject: {
-            sub: 'test-user',
-            permissions: { 'test-service': ['Editor'] },
-            exp: new Date().getTime() / 1000 - 20, // set expiry time of the token to currentTime - 20 seconds
-            subjectType: subjectType,
-          },
-          config: { serviceId: 'test-service' },
-        };
-
-        const params: ExecutionParams = {
-          query: `subscription EchoSubscription {
-          echoSubscription
-        }`,
-          operationName: 'EchoSubscription',
-          context: context,
-          variables: [],
-        };
-        const hookFunction = makePluginHook([hookPlugin]);
-
-        // Act & Assert
-        expect(() =>
-          hookFunction('postgraphile:ws:onOperation', params, context),
-        ).toThrow('Access Token has expired.');
-      },
-    );
-
-    it.each([
-      SubjectType.UserAccount,
-      SubjectType.ManagedServiceAccount,
-      SubjectType.ServiceAccount,
-      SubjectType.ImpersonatedUserAccount,
-      SubjectType.EndUserApplication,
-      SubjectType.EndUserAccount,
-    ])(
-      'Authorized %s with non-expired token for subscription -> no error',
-      async (subjectType) => {
-        // Arrange
-        const hookGenerator = subscriptionAuthorizationHookFactory;
-        let buildOptions: PostGraphileOptions<Request, Response>;
-        if (
-          subjectType !== SubjectType.EndUserAccount &&
-          subjectType !== SubjectType.EndUserApplication
-        ) {
-          buildOptions = {
-            graphileBuildOptions: {
-              permissionDefinition: {
-                gqlOptions: {
-                  anonymousGqlOperations: [],
-                  ignoredGqlOperations: [],
-                },
-                permissions: [
-                  {
-                    key: 'Editor',
-                    title: 'Editor',
-                    gqlOperations: ['otherEndpoint', 'echoSubscription'],
-                  },
-                ],
-              },
-            },
-          };
-        } else {
-          buildOptions = {
-            graphileBuildOptions: {
-              endUserAuthorizationConfig: {
-                anonymousGqlOperations: [],
-                applicationTokenAllowedGqlOperations: ['echoSubscription'],
-              },
-            },
-          };
-        }
-        const hookPlugin = hookGenerator(buildOptions);
-
-        const context = {
-          subject: {
-            sub: 'test-user',
-            permissions: { 'test-service': ['Editor'] },
-            exp: new Date().getTime() / 1000 + 20, // set expiry time of the token to currentTime + 20 seconds
-            subjectType: subjectType,
-          },
-          config: { serviceId: 'test-service' },
-        };
-
-        const params: ExecutionParams = {
-          query: `subscription EchoSubscription {
-          echoSubscription
-        }`,
-          operationName: 'EchoSubscription',
-          context: context,
-          variables: [],
-        };
-        const hookFunction = makePluginHook([hookPlugin]);
-
-        // Act & Assert
-        expect(() =>
-          hookFunction('postgraphile:ws:onOperation', params, context),
-        ).not.toThrow();
-      },
-    );
-
-    it.each([
-      SubjectType.UserAccount,
-      SubjectType.ManagedServiceAccount,
-      SubjectType.ServiceAccount,
-      SubjectType.ImpersonatedUserAccount,
-      SubjectType.EndUserApplication,
-      SubjectType.EndUserAccount,
-    ])(
-      'When ensureOnlyAuthentication is set to true and %s with non-expired token without any specific permission for subscription -> no error',
-      async (subjectType) => {
-        // Arrange
-        const hookGenerator = subscriptionAuthorizationHookFactory;
-        let buildOptions: PostGraphileOptions<Request, Response>;
-        if (
-          subjectType !== SubjectType.EndUserAccount &&
-          subjectType !== SubjectType.EndUserApplication
-        ) {
-          buildOptions = {
-            graphileBuildOptions: {
-              ensureOnlyAuthentication: true,
-              permissionDefinition: {
-                gqlOptions: {
-                  anonymousGqlOperations: [],
-                  ignoredGqlOperations: [],
-                },
-                permissions: [
-                  {
-                    key: 'Editor',
-                    title: 'Editor',
-                    gqlOperations: ['otherEndpoint'],
-                  },
-                ],
-              },
-            },
-          };
-        } else {
-          buildOptions = {
-            graphileBuildOptions: {
-              ensureOnlyAuthentication: true,
-              endUserAuthorizationConfig: {
-                anonymousGqlOperations: [],
-                applicationTokenAllowedGqlOperations: ['otherEndpoint'],
-              },
-            },
-          };
-        }
-        const hookPlugin = hookGenerator(buildOptions);
-
-        const context = {
-          subject: {
-            sub: 'test-user',
-            permissions: { 'test-service': ['Editor'] },
-            exp: new Date().getTime() / 1000 + 20, // set expiry time of the token to currentTime + 20 seconds
-            subjectType: subjectType,
-          },
-          config: { serviceId: 'test-service' },
-        };
-
-        const params: ExecutionParams = {
-          query: `subscription EchoSubscription {
-          echoSubscription
-        }`,
-          operationName: 'EchoSubscription',
-          context: context,
-          variables: [],
-        };
-        const hookFunction = makePluginHook([hookPlugin]);
-
-        // Act & Assert
-        expect(() =>
-          hookFunction('postgraphile:ws:onOperation', params, context),
-        ).not.toThrow();
-      },
-    );
-  });
-
-  describe('When calling the subscription through postgraphile:ws:onSubscribe', () => {
-    const schema: GraphQLSchema = {
-      astNode: {
-        kind: 'SchemaDefinition',
-        operationTypes: [
-          {
-            kind: 'OperationTypeDefinition',
-            operation: 'subscription',
-            type: {
-              kind: 'NamedType',
-              name: {
-                kind: 'Name',
-                value: 'EchoSubscription',
-              },
-            },
-          },
-        ],
-      },
-      description: 'EchoSubscription',
-      extensionASTNodes: [],
-      extensions: [],
-      getDirective: jest.fn(),
-      getDirectives: jest.fn(),
-      getImplementations: jest.fn(),
-      getMutationType: jest.fn(),
-      getPossibleTypes: jest.fn(),
-      getQueryType: jest.fn(),
-      getSubscriptionType: jest.fn(),
-      getType: jest.fn(),
-      getTypeMap: jest.fn(),
-      isPossibleType: jest.fn(),
-      isSubType: jest.fn(),
-      toConfig: jest.fn(),
-    };
-    it('Management User without required permissions -> UserNotAuthorized error', async () => {
-      // Arrange
-      const hookGenerator = subscriptionAuthorizationHookFactory;
-      const buildOptions: PostGraphileOptions<Request, Response> = {
-        graphileBuildOptions: {
-          // permission definition without permissions for the required subscription 'echoSubscription'
-          permissionDefinition: {
-            gqlOptions: {
-              anonymousGqlOperations: [],
-              ignoredGqlOperations: [],
-            },
-            permissions: [
-              {
-                key: 'Editor',
-                title: 'Editor',
-                gqlOperations: ['otherEndpoint'],
-              },
-            ],
-          },
-        },
-      };
-      const hookPlugin = hookGenerator(buildOptions);
-      const socket = {
-        close: jest.fn(),
-      };
-      const socketSpy = jest.spyOn(socket, 'close');
-      const context = {
-        extra: {
-          request: {
-            authContext: {
-              subject: {
-                sub: 'test-user',
-                permissions: { 'test-service': ['Editor'] },
-                exp: new Date().getTime() / 1000 + 20, // set expiry time of the token to currentTime - 20 seconds
-                subjectType: SubjectType.UserAccount,
-              },
-            },
-          },
-          socket,
-        },
-        config: { serviceId: 'test-service' },
-      };
-
-      const args: ExecutionArgs = {
-        schema,
-        document: gql(`subscription EchoSubscription {
-          echoSubscription
-        }`),
-        operationName: 'EchoSubscription',
-        contextValue: {
-          subject: context.extra.request.authContext.subject,
-          config: { serviceId: 'test-service' },
-        },
-      };
-      const hookFunction = makePluginHook([hookPlugin]);
-
-      // Act & Assert
-      expect(() =>
-        hookFunction('postgraphile:ws:onSubscribe', args, {
-          context: context,
-        }),
-      ).toThrow('User is not authorized to access the operation.');
-    });
-
-    it('ApplicationToken user without required permissions -> UserNotAuthorized error', async () => {
-      // Arrange
-      const hookGenerator = subscriptionAuthorizationHookFactory;
-      const buildOptions: PostGraphileOptions<Request, Response> = {
-        graphileBuildOptions: {
-          // endUserAuthorizationConfig without permissions for the required subscription 'echoSubscription'
-          endUserAuthorizationConfig: {
-            anonymousGqlOperations: [],
-            applicationTokenAllowedGqlOperations: [
-              'subscriptionPlans',
-              'subscriptionLifecycleStatusMutated',
-            ],
-          },
-        },
-      };
-      const hookPlugin = hookGenerator(buildOptions);
-      const socket = {
-        close: jest.fn(),
-      };
-      const socketSpy = jest.spyOn(socket, 'close');
-      const context = {
-        extra: {
-          request: {
-            authContext: {
-              subject: {
-                sub: 'test-user',
-                exp: new Date().getTime() / 1000 + 20, // set expiry time of the token to currentTime - 20 seconds
-                subjectType: SubjectType.EndUserApplication,
-              },
-            },
-          },
-          socket,
-        },
-        config: { serviceId: 'test-service' },
-      };
-
-      const args: ExecutionArgs = {
-        schema,
-        document: gql(`subscription EchoSubscription {
-          echoSubscription
-        }`),
-        operationName: 'EchoSubscription',
-        contextValue: {
-          subject: context.extra.request.authContext.subject,
-          config: { serviceId: 'test-service' },
-        },
-      };
-      const hookFunction = makePluginHook([hookPlugin]);
-
-      // Act & Assert
-      expect(() =>
-        hookFunction('postgraphile:ws:onSubscribe', args, {
-          context: context,
-        }),
-      ).toThrow('Application Token is not authorized to access the operation.');
-    });
-
-    it.each([
-      SubjectType.UserAccount,
-      SubjectType.ManagedServiceAccount,
-      SubjectType.ServiceAccount,
-      SubjectType.ImpersonatedUserAccount,
-      SubjectType.EndUserApplication,
-      SubjectType.EndUserAccount,
-    ])(
-      'Authorized %s with expired token for subscription -> Closes the websocket with CloseCode.Forbidden',
-      async (subjectType) => {
-        // Arrange
-        const hookGenerator = subscriptionAuthorizationHookFactory;
-
-        let buildOptions: PostGraphileOptions<Request, Response>;
-        if (
-          subjectType !== SubjectType.EndUserAccount &&
-          subjectType !== SubjectType.EndUserApplication
-        ) {
-          buildOptions = {
-            graphileBuildOptions: {
-              permissionDefinition: {
-                gqlOptions: {
-                  anonymousGqlOperations: [],
-                  ignoredGqlOperations: [],
-                },
-                permissions: [
-                  {
-                    key: 'Editor',
-                    title: 'Editor',
-                    gqlOperations: ['otherEndpoint', 'echoSubscription'],
-                  },
-                ],
-              },
-            },
-          };
-        } else {
-          buildOptions = {
-            graphileBuildOptions: {
-              endUserAuthorizationConfig: {
-                anonymousGqlOperations: [],
-                applicationTokenAllowedGqlOperations: [],
-              },
-            },
-          };
-        }
-
-        const hookPlugin = hookGenerator(buildOptions);
-        const socket = {
-          close: jest.fn(),
-        };
-        const socketSpy = jest.spyOn(socket, 'close');
-
-        const context = {
-          extra: {
-            request: {
-              authContext: {
-                subject: {
-                  sub: 'test-user',
-                  permissions: { 'test-service': ['Editor'] },
-                  exp: new Date().getTime() / 1000 - 20, // set expiry time of the token to currentTime - 20 seconds
-                  subjectType,
-                },
-              },
-            },
-            socket,
-          },
-          config: { serviceId: 'test-service' },
-        };
-
-        const args: ExecutionArgs = {
-          schema,
-          document: gql(`subscription EchoSubscription {
-            echoSubscription
-          }`),
-          operationName: 'EchoSubscription',
-          contextValue: {
-            subject: context.extra.request.authContext.subject,
-            config: { serviceId: 'test-service' },
-          },
-        };
-        const hookFunction = makePluginHook([hookPlugin]);
-
-        // Act
-        hookFunction('postgraphile:ws:onSubscribe', args, { context: context });
-        // Assert
-        expect(socketSpy).toHaveBeenCalledWith(
-          CloseCode.Forbidden,
-          IdGuardErrors.AccessTokenExpired.code,
-        );
-      },
-    );
-
-    it.each([
-      SubjectType.UserAccount,
-      SubjectType.ManagedServiceAccount,
-      SubjectType.ServiceAccount,
-      SubjectType.ImpersonatedUserAccount,
-      SubjectType.EndUserApplication,
-      SubjectType.EndUserAccount,
-    ])(
-      'Authorized %s with non-expired token for subscription -> no error',
-      async (subjectType) => {
-        // Arrange
-        const hookGenerator = subscriptionAuthorizationHookFactory;
-        let buildOptions: PostGraphileOptions<Request, Response>;
-        if (
-          subjectType !== SubjectType.EndUserAccount &&
-          subjectType !== SubjectType.EndUserApplication
-        ) {
-          buildOptions = {
-            graphileBuildOptions: {
-              permissionDefinition: {
-                gqlOptions: {
-                  anonymousGqlOperations: [],
-                  ignoredGqlOperations: [],
-                },
-                permissions: [
-                  {
-                    key: 'Editor',
-                    title: 'Editor',
-                    gqlOperations: ['otherEndpoint', 'echoSubscription'],
-                  },
-                ],
-              },
-            },
-          };
-        } else {
-          buildOptions = {
-            graphileBuildOptions: {
-              endUserAuthorizationConfig: {
-                anonymousGqlOperations: [],
-                applicationTokenAllowedGqlOperations: ['echoSubscription'],
-              },
-            },
-          };
-        }
-        const hookPlugin = hookGenerator(buildOptions);
-        const socket = {
-          close: jest.fn(),
-        };
-        const socketSpy = jest.spyOn(socket, 'close');
-        const context = {
-          extra: {
-            request: {
-              authContext: {
-                subject: {
-                  sub: 'test-user',
-                  permissions: { 'test-service': ['Editor'] },
-                  exp: new Date().getTime() / 1000 + 20, // set expiry time of the token to currentTime - 20 seconds
-                  subjectType,
-                },
-              },
-            },
-            socket,
-          },
-          config: { serviceId: 'test-service' },
-        };
-
-        const args: ExecutionArgs = {
-          schema,
-          document: gql(`subscription EchoSubscription {
-            echoSubscription
-          }`),
-          operationName: 'EchoSubscription',
-          contextValue: {
-            subject: context.extra.request.authContext.subject,
-            config: { serviceId: 'test-service' },
-          },
-        };
-        const hookFunction = makePluginHook([hookPlugin]);
-
-        // Act & Assert
-        expect(() =>
-          hookFunction('postgraphile:ws:onSubscribe', args, {
-            context: context,
-          }),
-        ).not.toThrow();
-        expect(socketSpy).not.toHaveBeenCalled();
-      },
-    );
-
-    it.each([
-      SubjectType.UserAccount,
-      SubjectType.ManagedServiceAccount,
-      SubjectType.ServiceAccount,
-      SubjectType.ImpersonatedUserAccount,
-      SubjectType.EndUserApplication,
-      SubjectType.EndUserAccount,
-    ])(
-      'When ensureOnlyAuthentication is set to true, %s with non-expired token and no specific permission for subscription -> no error',
-      async (subjectType) => {
-        // Arrange
-        const hookGenerator = subscriptionAuthorizationHookFactory;
-        let buildOptions: PostGraphileOptions<Request, Response>;
-        if (
-          subjectType !== SubjectType.EndUserAccount &&
-          subjectType !== SubjectType.EndUserApplication
-        ) {
-          buildOptions = {
-            graphileBuildOptions: {
-              ensureOnlyAuthentication: true,
-              permissionDefinition: {
-                gqlOptions: {
-                  anonymousGqlOperations: [],
-                  ignoredGqlOperations: [],
-                },
-                permissions: [
-                  {
-                    key: 'Editor',
-                    title: 'Editor',
-                    gqlOperations: ['otherEndpoint'],
-                  },
-                ],
-              },
-            },
-          };
-        } else {
-          buildOptions = {
-            graphileBuildOptions: {
-              ensureOnlyAuthentication: true,
-              endUserAuthorizationConfig: {
-                anonymousGqlOperations: [],
-                applicationTokenAllowedGqlOperations: ['otherEndpoint'],
-              },
-            },
-          };
-        }
-        const hookPlugin = hookGenerator(buildOptions);
-        const socket = {
-          close: jest.fn(),
-        };
-        const socketSpy = jest.spyOn(socket, 'close');
-        const context = {
-          extra: {
-            request: {
-              authContext: {
-                subject: {
-                  sub: 'test-user',
-                  permissions: { 'test-service': ['Editor'] },
-                  exp: new Date().getTime() / 1000 + 20, // set expiry time of the token to currentTime - 20 seconds
-                  subjectType,
-                },
-              },
-            },
-            socket,
-          },
-          config: { serviceId: 'test-service' },
-        };
-
-        const args: ExecutionArgs = {
-          schema,
-          document: gql(`subscription EchoSubscription {
-            echoSubscription
-          }`),
-          operationName: 'EchoSubscription',
-          contextValue: {
-            subject: context.extra.request.authContext.subject,
-            config: { serviceId: 'test-service' },
-          },
-        };
-        const hookFunction = makePluginHook([hookPlugin]);
-
-        // Act & Assert
-        expect(() =>
-          hookFunction('postgraphile:ws:onSubscribe', args, {
-            context: context,
-          }),
-        ).not.toThrow();
-        expect(socketSpy).not.toHaveBeenCalled();
-      },
-    );
-  });
-});