@civic/auth 0.0.1--.tsc.alpha.1

package/test/unit/lib/oauth.test.ts

@@ -0,0 +1,72 @@
+import {
+  getOauthEndpoints,
+  getIssuerVariations,
+  displayModeFromState,
+  generateState,
+} from "@/lib/oauth.js";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { oauthWellKnownResponse } from "../../support/fixtures.js";
+
+describe("getOauthEndpoints", () => {
+  afterEach(vi.clearAllMocks);
+
+  beforeEach(() => {
+    global.fetch = vi.fn().mockResolvedValue({
+      json: vi.fn().mockResolvedValue(oauthWellKnownResponse),
+    });
+  });
+
+  it("should translate the response from the auth server into an endpoints object", async () => {
+    const response = await getOauthEndpoints("https://example.com");
+    expect(response).toEqual({
+      auth: "https://auth-dev.civic.com/oauth/auth",
+      token: "https://auth-dev.civic.com/oauth/token",
+      jwks: "https://auth-dev.civic.com/oauth/jwks",
+      userinfo: "https://auth-dev.civic.com/oauth/me",
+    });
+  });
+});
+
+describe("getIssuerVariations", () => {
+  it("should return an array of variations of the issuer", () => {
+    const issuer = "https://example.com";
+    const variations = getIssuerVariations(issuer);
+    expect(variations).toEqual(["https://example.com", "https://example.com/"]);
+  });
+});
+
+describe("displayModeFromState", () => {
+  it("should return the display mode from the state", () => {
+    const state = "state";
+    const displayMode = "redirect";
+    const result = displayModeFromState(state, displayMode);
+
+    expect(result).toEqual(displayMode);
+  });
+
+  it("should extract the display mode correctly from state", () => {
+    const state =
+      "eyJ1dWlkIjoiMGY0NWU5YWItY2U1Ni00OWZiLTlkYmUtOGQ3ZmM3YTI3NDFhIiwiZGlzcGxheU1vZGUiOiJpZnJhbWUiLCJzZXJ2ZXJUb2tlbkV4Y2hhbmdlIjp0cnVlfQ";
+    const displayMode = "redirect";
+    const result = displayModeFromState(state, displayMode);
+
+    expect(result).toEqual("iframe");
+  });
+});
+
+describe("generateState", () => {
+  it("should generate a state string", () => {
+    const state = generateState("redirect");
+
+    expect(state).toBeTruthy();
+    expect(state).toHaveLength(96);
+  });
+
+  it('should generate a state string with "serverTokenExchange" key', () => {
+    const state = generateState("redirect", true);
+
+    expect(state).toBeTruthy();
+    const decoded = atob(state);
+    expect(JSON.parse(decoded)).toHaveProperty("serverTokenExchange", true);
+  });
+});

package/test/unit/logger.test.ts

@@ -0,0 +1,175 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import debug from "debug";
+import { createLogger } from "../../src/lib/logger";
+
+// Mock the debug package
+vi.mock("debug", () => {
+  const debugInstance = vi.fn();
+  const debug = vi.fn(() => debugInstance);
+  // Add color property to match debug package API
+  Object.defineProperty(debugInstance, "color", {
+    set: vi.fn(),
+    get: vi.fn(),
+  });
+  return { default: debug };
+});
+
+describe("Logger", () => {
+  let mockDebug: ReturnType<typeof debug>;
+  let debugInstance: ReturnType<typeof vi.fn>;
+  let logger: ReturnType<typeof createLogger>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockDebug = debug as unknown as ReturnType<typeof debug>;
+    debugInstance = mockDebug("test") as unknown as ReturnType<typeof vi.fn>;
+    logger = createLogger("test");
+  });
+
+  it("should create debug instances with correct namespaces", () => {
+    logger = createLogger("api:routes");
+
+    // Verify that debug was called with the correct namespaces
+    expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:routes:debug");
+    expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:routes:info");
+    expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:routes:warn");
+    expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:routes:error");
+  });
+
+  it("should log debug messages with context", () => {
+    const context = { requestId: "123", userId: "456" };
+    logger.debug("Processing request", context);
+
+    expect(debugInstance).toHaveBeenCalledWith("Processing request", context);
+  });
+
+  it("should log info messages with multiple arguments", () => {
+    const requestId = "123";
+    const duration = 456;
+    logger.info("Request completed", { requestId, duration });
+
+    expect(debugInstance).toHaveBeenCalledWith("Request completed", {
+      requestId,
+      duration,
+    });
+  });
+
+  it("should log warning messages with structured data", () => {
+    const warning = {
+      code: "RATE_LIMIT",
+      requestId: "123",
+      limit: 100,
+      current: 95,
+    };
+
+    logger.warn("Rate limit approaching", warning);
+
+    expect(debugInstance).toHaveBeenCalledWith(
+      "Rate limit approaching",
+      warning,
+    );
+  });
+
+  it("should log error messages with error objects", () => {
+    const error = new Error("Database connection failed");
+    const context = {
+      requestId: "123",
+      operation: "getUserProfile",
+    };
+
+    logger.error("Operation failed", { error, ...context });
+
+    expect(debugInstance).toHaveBeenCalledWith("Operation failed", {
+      error,
+      ...context,
+    });
+  });
+
+  it("should handle undefined arguments", () => {
+    logger.info("Simple message");
+
+    expect(debugInstance).toHaveBeenCalledWith("Simple message");
+  });
+
+  it("should handle null values in context", () => {
+    const context = {
+      userId: null,
+      sessionId: undefined,
+      requestId: "123",
+    };
+
+    logger.debug("User context", context);
+
+    expect(debugInstance).toHaveBeenCalledWith("User context", context);
+  });
+
+  // Testing different logger namespaces
+  describe("Logger namespaces", () => {
+    it("should create db logger with correct namespace", () => {
+      const dbLogger = createLogger("api:db");
+      dbLogger.info("DB Operation");
+
+      expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:db:info");
+    });
+
+    it("should create auth handler logger with correct namespace", () => {
+      const authLogger = createLogger("api:handlers:auth");
+      authLogger.debug("Auth check");
+
+      expect(mockDebug).toHaveBeenCalledWith(
+        "@civic/auth:api:handlers:auth:debug",
+      );
+    });
+  });
+
+  // Integration-style tests
+  describe("Real-world scenarios", () => {
+    it("should log complete request lifecycle", () => {
+      const requestLogger = createLogger("api:request");
+      const requestId = "123";
+      const start = Date.now();
+
+      requestLogger.debug("Request started", {
+        requestId,
+        method: "GET",
+        path: "/api/users",
+      });
+      requestLogger.info("Processing request", { requestId, userId: "456" });
+      requestLogger.debug("DB query executed", { requestId, duration: 50 });
+      requestLogger.info("Request completed", {
+        requestId,
+        duration: Date.now() - start,
+        status: 200,
+      });
+
+      expect(debugInstance).toHaveBeenCalledTimes(4);
+    });
+
+    it("should log error scenario with full context", () => {
+      const requestLogger = createLogger("api:request");
+      const requestId = "123";
+      const error = new Error("Invalid user input");
+      const context = {
+        userId: "456",
+        input: { email: "invalid" },
+        validation: { failed: true, errors: ["Invalid email format"] },
+      };
+
+      requestLogger.debug("Validating input", {
+        requestId,
+        input: context.input,
+      });
+      requestLogger.warn("Validation failed", {
+        requestId,
+        validation: context.validation,
+      });
+      requestLogger.error("Request failed", {
+        requestId,
+        error,
+        context,
+      });
+
+      expect(debugInstance).toHaveBeenCalledTimes(3);
+    });
+  });
+});

package/test/unit/nextjs/NextAuthProvider.test.tsx

@@ -0,0 +1,38 @@
+import { render } from "@testing-library/react";
+import { describe, it, vi, expect } from "vitest";
+import { CivicNextAuthProvider } from "@/nextjs/providers/NextAuthProvider.js";
+import { resolveAuthConfig } from "@/nextjs/config.js";
+import React from "react";
+
+vi.mock("@/nextjs/config.js", () => ({
+  resolveAuthConfig: vi.fn(() => ({
+    clientId: "test-client-id",
+    oauthServer: "https://example.com",
+    callbackUrl: "https://example.com/callback",
+    challengeUrl: "https://example.com/challenge",
+    logoutUrl: "https://example.com/logout",
+  })),
+}));
+
+vi.mock("@/nextjs/hooks/useUserCookie", () => ({
+  useUserCookie: vi.fn(),
+}));
+
+vi.mock("@/nextjs/hooks/useTokenCookie", () => ({
+  useTokenCookie: vi.fn(),
+}));
+
+describe("CivicNextAuthProvider", () => {
+  it("should call resolveAuthConfig with no arguments", () => {
+    const children = <div>Test Content</div>;
+
+    render(
+      <CivicNextAuthProvider>
+        {children}
+      </CivicNextAuthProvider>
+    );
+
+    // The Next implementation should take all config from the next.config.js file, no config taken from provider props.
+    expect(resolveAuthConfig).toHaveBeenCalledWith();
+  });
+});

package/test/unit/nextjs/config.test.ts

@@ -0,0 +1,201 @@
+/* eslint-disable turbo/no-undeclared-env-vars */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import {
+  resolveAuthConfig,
+  createCivicAuthPlugin,
+  type AuthConfig,
+  defaultAuthConfig,
+} from "@/nextjs/config.js";
+import { TokensCookieConfig } from "@/index.js";
+import { DEFAULT_AUTH_SERVER } from "@/constants.js";
+
+const defaultCookies = {
+  id_token: {
+    httpOnly: true,
+    path: "/",
+    sameSite: "strict",
+    secure: true,
+  },
+  access_token: {
+    httpOnly: true,
+    path: "/",
+    sameSite: "strict",
+    secure: true,
+  },
+  refresh_token: {
+    httpOnly: true,
+    path: "/",
+    sameSite: "strict",
+    secure: true,
+  },
+  code_verifier: {
+    httpOnly: true,
+    path: "/",
+    sameSite: "strict",
+    secure: true,
+  },
+} as TokensCookieConfig;
+describe("nextjs/config", () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    vi.resetModules();
+    process.env = { ...originalEnv };
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+    vi.restoreAllMocks();
+  });
+
+  describe("resolveAuthConfig", () => {
+    it("should throw an error if clientId is not provided", () => {
+      expect(() => resolveAuthConfig()).toThrowError(
+        "Civic Auth client ID is required",
+      );
+    });
+
+    it("should use default values when no config is provided", () => {
+      // client id must be defined
+      process.env._civic_auth_client_id = "clientId";
+      const result = resolveAuthConfig();
+      expect(result).toEqual({ ...defaultAuthConfig, clientId: "clientId" });
+    });
+
+    it("should override default values with provided config", () => {
+      const config: AuthConfig = {
+        clientId: "clientId",
+        callbackUrl: "/custom/callback",
+        loginUrl: "/custom/login",
+        include: ["/protected/*"],
+        exclude: ["/public/*"],
+      };
+      const result = resolveAuthConfig(config);
+      expect(result.callbackUrl).toBe("/custom/callback");
+      expect(result.loginUrl).toBe("/custom/login");
+      expect(result.include).toEqual(["/protected/*"]);
+      expect(result.exclude).toEqual(["/public/*"]);
+    });
+
+    it("should use environment variables if set", () => {
+      process.env._civic_auth_client_id = "clientId";
+      process.env._civic_auth_callback_url = "/env/callback";
+      process.env._civic_auth_login_url = "/env/login";
+      process.env._civic_auth_includes = "/env/protected/*";
+      process.env._civic_auth_excludes = "/env/public/*";
+
+      const result = resolveAuthConfig();
+      expect(result.callbackUrl).toBe("/env/callback");
+      expect(result.loginUrl).toBe("/env/login");
+      expect(result.include).toEqual(["/env/protected/*"]);
+      expect(result.exclude).toEqual(["/env/public/*"]);
+    });
+
+    it("should prioritize provided config over environment variables", () => {
+      process.env._civic_auth_callback_url = "/env/callback";
+      const config: AuthConfig = {
+        clientId: "clientId",
+        callbackUrl: "/config/callback",
+      };
+
+      const result = resolveAuthConfig(config);
+      expect(result.callbackUrl).toBe("/config/callback");
+    });
+
+    it("should merge cookie configurations correctly", () => {
+      const config: AuthConfig = {
+        clientId: "clientId",
+        cookies: {
+          tokens: {
+            id_token: { ...defaultCookies.id_token, secure: false },
+          } as TokensCookieConfig,
+          user: {
+            httpOnly: false,
+            secure: false,
+            sameSite: "strict",
+          },
+        },
+      };
+
+      const result = resolveAuthConfig(config);
+      expect(result.cookies.tokens).toEqual({
+        ...defaultCookies,
+        id_token: { ...defaultCookies.id_token, secure: false },
+      });
+
+      expect(result.cookies.user).toEqual({
+        httpOnly: false,
+        secure: false,
+        sameSite: "strict",
+        path: "/",
+        maxAge: 3600,
+      });
+    });
+  });
+
+  describe("createCivicAuthPlugin", () => {
+    it("should return a function", () => {
+      const plugin = createCivicAuthPlugin({ clientId: "clientId" });
+      expect(typeof plugin).toBe("function");
+    });
+
+    it("should set environment variables based on resolved config", () => {
+      const config = {
+        clientId: "clientId",
+        callbackUrl: "/custom/callback",
+        loginUrl: "/custom/login",
+        logoutUrl: "/custom/logout",
+        include: ["/protected/*"],
+        exclude: ["/public/*"],
+        cookies: {
+          tokens: defaultCookies,
+          user: {
+            secure: false,
+            sameSite: "strict",
+            maxAge: 3600,
+          } as const,
+        },
+      };
+
+      const plugin = createCivicAuthPlugin(config);
+      const nextConfig = plugin({});
+
+      expect(nextConfig.env).toEqual({
+        _civic_auth_client_id: "clientId",
+        _civic_auth_callback_url: "/custom/callback",
+        _civic_auth_challenge_url: "/api/auth/challenge",
+        _civic_auth_login_url: "/custom/login",
+        _civic_auth_logout_url: "/custom/logout",
+        _civic_auth_includes: "/protected/*",
+        _civic_auth_excludes: "/public/*",
+        _civic_oauth_server: DEFAULT_AUTH_SERVER,
+        _civic_auth_cookie_config: JSON.stringify({
+          tokens: defaultCookies,
+          user: {
+            secure: false,
+            httpOnly: false,
+            sameSite: "strict",
+            path: "/",
+            maxAge: 3600,
+          },
+        }),
+      });
+    });
+
+    it("should merge with existing Next.js config", () => {
+      const existingConfig = {
+        reactStrictMode: true,
+        env: {
+          CUSTOM_VAR: "value",
+        },
+      };
+
+      const plugin = createCivicAuthPlugin({ clientId: "clientId" });
+      const nextConfig = plugin(existingConfig);
+
+      expect(nextConfig.reactStrictMode).toBe(true);
+      expect(nextConfig.env).toHaveProperty("CUSTOM_VAR", "value");
+      expect(nextConfig.env).toHaveProperty("_civic_auth_callback_url");
+    });
+  });
+});

package/test/unit/nextjs/getUser.test.ts

@@ -0,0 +1,41 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { GenericUserSession } from "@/shared/lib/UserSession.js";
+import type { User } from "@/types.ts";
+import { getUser } from "@/nextjs/index.js";
+import { NextjsClientStorage } from "@/nextjs/cookies.js";
+
+const mockUser: User = {
+  id: "user123",
+  name: "John Doe",
+  email: "john@example.com",
+  picture: "https://example.com/john.jpg",
+  idToken: "test-id-token",
+  accessToken: "test-access-token",
+  refreshToken: "test-refresh-token",
+} as unknown as User;
+
+describe("getUser", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.spyOn(GenericUserSession.prototype, "get").mockReturnValue(mockUser);
+    vi.spyOn(NextjsClientStorage.prototype, "get").mockImplementation(
+      (cookieName: string) => {
+        switch (cookieName) {
+          case "access_token":
+            return "test-access-token";
+          case "id_token":
+            return "test-id-token";
+          case "refresh_token":
+            return "test-refresh-token";
+          default:
+            return null;
+        }
+      },
+    );
+  });
+
+  it("should get the user from session", () => {
+    const user = getUser();
+    expect(user).toEqual(mockUser);
+  });
+});

package/test/unit/nextjs/middleware.test.ts

@@ -0,0 +1,138 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { NextResponse, type NextRequest } from "next/server.js";
+import { authMiddleware, withAuth } from "@/nextjs/middleware/index.js";
+import { defaultAuthConfig } from "@/nextjs/config.js";
+
+// Mock next/server
+vi.mock("next/server.js", () => ({
+  NextResponse: {
+    next: vi.fn(() => ({ type: "next" })),
+    redirect: vi.fn((url) => ({ type: "redirect", url })),
+  },
+}));
+
+describe("Auth Middleware", () => {
+  let request: NextRequest;
+
+  beforeEach(() => {
+    // Reset mocks
+    vi.clearAllMocks();
+
+    // Create base request
+    request = {
+      nextUrl: {
+        pathname: "/protected",
+      },
+      cookies: {
+        get: vi.fn(),
+      },
+      method: "GET",
+      url: "http://example.com/protected",
+    } as unknown as NextRequest;
+
+    process.env._civic_auth_client_id = "abc";
+  });
+
+  describe("authMiddleware", () => {
+    /* FIXME
+    it("should redirect to login when no token present", async () => {
+      const middleware = authMiddleware();
+      const response = await middleware(request);
+
+      expect(NextResponse.redirect).toHaveBeenCalledWith("http://example.com/");
+      expect(response.type).toBe("redirect");
+    });
+    */
+
+    it("should allow access when token is present", async () => {
+      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
+      const middleware = authMiddleware();
+      const response = await middleware(request);
+
+      expect(NextResponse.next).toHaveBeenCalled();
+      expect(response.type).toBe("next");
+    });
+
+    it("should skip auth check for redirect to login page", async () => {
+      request.nextUrl.pathname = "/login";
+      const middleware = authMiddleware({
+        ...defaultAuthConfig,
+        loginUrl: "/login",
+      });
+      const response = await middleware(request);
+
+      expect(NextResponse.next).toHaveBeenCalled();
+      expect(response.type).toBe("next");
+    });
+
+    it("should not skip auth check for non-GET to login page", async () => {
+      request.nextUrl.pathname = "/login";
+      const middleware = authMiddleware({
+        ...defaultAuthConfig,
+        loginUrl: "/login",
+      });
+      const response = await middleware({
+        ...request,
+        method: "POST",
+      } as NextRequest);
+
+      // should have redirected to the login page
+      expect(NextResponse.next).not.toHaveBeenCalled();
+      expect(response.type).toBe("redirect");
+    });
+  });
+
+  describe("withAuth", () => {
+    it("should chain custom middleware when authenticated", async () => {
+      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
+      const customMiddleware = vi.fn(() => NextResponse.next());
+      const middleware = withAuth(customMiddleware);
+
+      await middleware(request);
+
+      expect(customMiddleware).toHaveBeenCalled();
+    });
+
+    it("should not chain custom middleware when unauthorized", async () => {
+      const customMiddleware = vi.fn(() => NextResponse.next());
+      const middleware = withAuth(customMiddleware);
+
+      const response = await middleware(request);
+
+      expect(customMiddleware).not.toHaveBeenCalled();
+      expect(NextResponse.redirect).toHaveBeenCalled();
+      expect(response.type).toBe("redirect");
+    });
+  });
+
+  describe("path matching", () => {
+    it("should respect include patterns", async () => {
+      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
+      request.nextUrl.pathname = "/public";
+
+      const middleware = authMiddleware({
+        include: ["/protected/**"],
+      });
+
+      const response = await middleware(request);
+
+      expect(NextResponse.next).toHaveBeenCalled();
+      expect(response.type).toBe("next");
+    });
+
+    it("should respect exclude patterns", async () => {
+      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
+      request.nextUrl.pathname = "/protected/public";
+
+      const middleware = authMiddleware({
+        include: ["/protected/**"],
+        exclude: ["/protected/public"],
+      });
+
+      const response = await middleware(request);
+
+      expect(NextResponse.next).toHaveBeenCalled();
+      expect(response.type).toBe("next");
+    });
+  });
+});