@civic/auth 0.0.1--.tsc.alpha.1

package/test/unit/server/login.test.ts

@@ -0,0 +1,179 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  resolveOAuthAccessCode,
+  isLoggedIn,
+  buildLoginUrl,
+} from "@/server/login.js";
+import { ServerAuthenticationResolver } from "@/server/ServerAuthenticationResolver.js";
+import { GenericAuthenticationInitiator } from "@/services/AuthenticationService.js";
+import { GenericPublicClientPKCEProducer } from "@/services/PKCE.js";
+import { DEFAULT_AUTH_SERVER, DEFAULT_SCOPES } from "@/constants.js";
+import type { OIDCTokenResponseBody, AuthStorage } from "@/types.js";
+import type { AuthConfig } from "@/server/config.js";
+import type { PKCEProducer } from "@/services/types.js";
+
+vi.mock("@/server/ServerAuthenticationResolver");
+vi.mock("@/services/AuthenticationService");
+vi.mock("@/services/PKCE");
+
+class StubPKCEProducer implements PKCEProducer {
+  constructor() {}
+
+  async getCodeChallenge(): Promise<string> {
+    return "dummyCodeChallenge";
+  }
+
+  async getCodeVerifier(): Promise<string> {
+    return "dummyCodeVerifier";
+  }
+}
+
+describe("Login Utilities", () => {
+  const mockAuthConfig: AuthConfig = {
+    clientId: "mockClientId",
+    oauthServer: "http://mockOauthServer",
+    redirectUrl: "http://localhost/redirect",
+  };
+  const mockTokens: OIDCTokenResponseBody = {
+    id_token: "mockIdToken",
+    access_token: "mockAccessToken",
+    refresh_token: "mockRefreshToken",
+  };
+  const mockStorage = {
+    get: vi.fn(),
+    set: vi.fn(),
+  } as unknown as AuthStorage;
+
+  describe("resolveOAuthAccessCode", () => {
+    it("should resolve the OAuth access code and return tokens", async () => {
+      vi.mocked(ServerAuthenticationResolver.build).mockResolvedValue({
+        tokenExchange: vi.fn().mockResolvedValue(mockTokens),
+      } as unknown as ServerAuthenticationResolver);
+
+      const result = await resolveOAuthAccessCode(
+        "mockCode",
+        "mockState",
+        mockStorage,
+        mockAuthConfig,
+      );
+
+      expect(ServerAuthenticationResolver.build).toHaveBeenCalledWith(
+        {
+          ...mockAuthConfig,
+          oauthServer: mockAuthConfig.oauthServer ?? DEFAULT_AUTH_SERVER,
+        },
+        mockStorage,
+        undefined,
+      );
+      expect(result).toEqual(mockTokens);
+    });
+  });
+
+  describe("isLoggedIn", () => {
+    it("should return true if id_token is in storage", () => {
+      vi.mocked(mockStorage.get).mockReturnValue("mockIdToken");
+
+      const result = isLoggedIn(mockStorage);
+
+      expect(result).toBe(true);
+    });
+
+    it("should return false if id_token is not in storage", () => {
+      vi.mocked(mockStorage.get).mockReturnValue(null);
+
+      const result = isLoggedIn(mockStorage);
+
+      expect(result).toBe(false);
+    });
+  });
+
+  describe("buildLoginUrl", () => {
+    it("should generate a login URL with provided config", async () => {
+      const state = "mockState";
+      const scopes = ["openid", "profile"];
+      const pkceProducer = new StubPKCEProducer();
+
+      const authInitiator = new GenericAuthenticationInitiator({
+        ...mockAuthConfig,
+        state,
+        scopes,
+        oauthServer: mockAuthConfig.oauthServer ?? DEFAULT_AUTH_SERVER,
+        pkceConsumer: pkceProducer,
+      });
+      vi.mocked(GenericAuthenticationInitiator).mockReturnValue(authInitiator);
+      vi.mocked(authInitiator.signIn).mockResolvedValue(
+        new URL("http://mockLoginUrl"),
+      );
+
+      const result = await buildLoginUrl(
+        {
+          ...mockAuthConfig,
+          state,
+          scopes,
+        },
+        mockStorage,
+      );
+
+      expect(result.toString()).toBe("http://mockloginurl/");
+      expect(GenericAuthenticationInitiator).toHaveBeenCalledWith({
+        ...mockAuthConfig,
+        state,
+        scopes,
+        oauthServer: mockAuthConfig.oauthServer ?? DEFAULT_AUTH_SERVER,
+        pkceConsumer: pkceProducer,
+      });
+    });
+
+    it("should generate a login URL with default state and scopes", async () => {
+      const authInitiator = new GenericAuthenticationInitiator({
+        ...mockAuthConfig,
+        state: expect.any(String), // state is random if not provided
+        scopes: DEFAULT_SCOPES,
+        oauthServer: mockAuthConfig.oauthServer ?? DEFAULT_AUTH_SERVER,
+        pkceConsumer: expect.any(GenericPublicClientPKCEProducer),
+      });
+      vi.mocked(GenericAuthenticationInitiator).mockReturnValue(authInitiator);
+      vi.mocked(authInitiator.signIn).mockResolvedValue(
+        new URL("http://mockLoginUrl"),
+      );
+
+      const result = await buildLoginUrl(mockAuthConfig, mockStorage);
+
+      expect(result.toString()).toBe("http://mockloginurl/");
+    });
+
+    it("should include nonce in the login URL if provided in config", async () => {
+      const state = "mockState";
+      const scopes = ["openid", "profile"];
+      const nonce = "mockNonce";
+      const pkceProducer = new GenericPublicClientPKCEProducer(mockStorage);
+
+      const authInitiator = new GenericAuthenticationInitiator({
+        ...mockAuthConfig,
+        state,
+        scopes,
+        oauthServer: mockAuthConfig.oauthServer ?? DEFAULT_AUTH_SERVER,
+        pkceConsumer: pkceProducer,
+        nonce,
+      });
+      vi.mocked(GenericAuthenticationInitiator).mockReturnValue(authInitiator);
+      vi.mocked(authInitiator.signIn).mockResolvedValue(
+        new URL(`http://mockLoginUrl?nonce=${nonce}`),
+      );
+
+      await buildLoginUrl(
+        {
+          ...mockAuthConfig,
+          state,
+          scopes,
+          nonce,
+        },
+        mockStorage,
+      );
+
+      expect(GenericAuthenticationInitiator).toHaveBeenCalledWith(expect.objectContaining({
+        nonce,
+      }));
+    });
+  });
+});

package/test/unit/server/session.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import type { JWT } from "oslo/jwt";
+import { parseJWT } from "oslo/jwt";
+import { getUser } from "@/shared/lib/session.js";
+import { retrieveTokens } from "@/shared/lib/util.js";
+import type { AuthStorage, OIDCTokenResponseBody, User } from "@/types.js";
+
+vi.mock("@/shared/lib/util.js");
+vi.mock("oslo/jwt");
+
+describe("getUser", () => {
+  const mockStorage = {} as AuthStorage;
+  const mockUser: User = {
+    id: "mockUserId",
+    email: "user@example.com",
+  } as User;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("should return null if no tokens are retrieved", async () => {
+    vi.mocked(retrieveTokens).mockReturnValue(null);
+
+    const result = await getUser(mockStorage);
+    expect(result).toBeNull();
+    expect(retrieveTokens).toHaveBeenCalledWith(mockStorage);
+  });
+
+  it("should return a User if tokens are retrieved and parsed successfully", async () => {
+    const mockTokens = { id_token: "mockIdToken" } as OIDCTokenResponseBody;
+    vi.mocked(retrieveTokens).mockReturnValue(mockTokens);
+    vi.mocked(parseJWT).mockReturnValue({ payload: mockUser } as JWT);
+
+    const result = await getUser(mockStorage);
+    expect(result).toEqual(mockUser);
+    expect(retrieveTokens).toHaveBeenCalledWith(mockStorage);
+    expect(parseJWT).toHaveBeenCalledWith(mockTokens.id_token);
+  });
+
+  it("should return null if parsing the ID token fails", async () => {
+    const mockTokens = { id_token: "mockIdToken" } as OIDCTokenResponseBody;
+    vi.mocked(retrieveTokens).mockReturnValue(mockTokens);
+    vi.mocked(parseJWT).mockReturnValue(null); // Simulate parse failure
+
+    const result = await getUser(mockStorage);
+    expect(result).toBeNull();
+    expect(retrieveTokens).toHaveBeenCalledWith(mockStorage);
+    expect(parseJWT).toHaveBeenCalledWith(mockTokens.id_token);
+  });
+});

package/test/unit/services/AuthenticationService.test.ts

@@ -0,0 +1,152 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  BrowserAuthenticationInitiator,
+  BrowserAuthenticationService,
+  GenericAuthenticationInitiator,
+} from "@/services/AuthenticationService.js";
+import {
+  generateOauthLoginUrl,
+  generateOauthLogoutUrl,
+  exchangeTokens,
+  retrieveTokens,
+  storeTokens,
+} from "@/shared/lib/util.js";
+import { LocalStorageAdapter } from "@/browser/storage.js";
+import { BrowserPublicClientPKCEProducer } from "@/services/PKCE.js";
+import type { OIDCTokenResponseBody, SessionData } from "@/types.js";
+import type { AuthenticationResolver, PKCEConsumer } from "@/services/types.js";
+
+vi.mock("@/shared/lib/util.js", () => ({
+  getEndpointsWithOverrides: async () => ({
+    auth: "auth-endpoint",
+  }),
+  exchangeTokens: vi.fn(),
+  retrieveTokens: vi.fn(),
+  storeTokens: vi.fn(),
+  generateOauthLoginUrl: vi.fn(),
+  generateOauthLogoutUrl: vi.fn(),
+  clearTokens: vi.fn(),
+  clearUser: vi.fn(),
+}));
+vi.mock("@/browser/storage");
+vi.mock("@/services/PKCE");
+
+describe("Authentication Services", () => {
+  const mockConfig = {
+    clientId: "mockClientId",
+    redirectUrl: "http://localhost/redirect",
+    state: "mockState",
+    scopes: ["openid", "profile"],
+    displayMode: "redirect" as const,
+    oauthServer: "http://mockOauthServer",
+  };
+
+  describe("BrowserAuthenticationInitiator", () => {
+    it("should generate a login URL", async () => {
+      const initiator = new BrowserAuthenticationInitiator({
+        ...mockConfig,
+        pkceConsumer: {} as PKCEConsumer,
+      });
+      vi.mocked(generateOauthLoginUrl).mockResolvedValue(
+        new URL("http://mockLoginUrl"),
+      );
+
+      const url = await initiator.signIn(null);
+
+      expect(url.toString()).toBe("http://mockloginurl/");
+    });
+
+    it("should generate a logout URL", async () => {
+      const initiator = new BrowserAuthenticationInitiator({
+        ...mockConfig,
+        pkceConsumer: {} as PKCEConsumer,
+      });
+      vi.mocked(generateOauthLogoutUrl).mockResolvedValue(
+        new URL("http://mocklogouturl"),
+      );
+
+      const url = await initiator.signOut();
+
+      expect(url.toString()).toBe("http://mocklogouturl/");
+    });
+  });
+
+  describe("GenericAuthenticationInitiator", () => {
+    it("should generate a login URL", async () => {
+      const initiator = new GenericAuthenticationInitiator({
+        ...mockConfig,
+        pkceConsumer: {} as PKCEConsumer,
+      });
+      vi.mocked(generateOauthLoginUrl).mockResolvedValue(
+        new URL("http://mockloginurl"),
+      );
+
+      const url = await initiator.signIn();
+
+      expect(url.toString()).toBe("http://mockloginurl/");
+    });
+
+    it("should generate a logout URL", async () => {
+      const initiator = new GenericAuthenticationInitiator({
+        ...mockConfig,
+        pkceConsumer: {} as PKCEConsumer,
+      });
+      vi.mocked(generateOauthLogoutUrl).mockResolvedValue(
+        new URL("http://mocklogouturl"),
+      );
+
+      const url = await initiator.signOut();
+
+      expect(url.toString()).toBe("http://mocklogouturl/");
+    });
+  });
+
+  describe("BrowserAuthenticationService", () => {
+    let service: AuthenticationResolver;
+    const mockTokens: OIDCTokenResponseBody = {
+      id_token: "mockIdToken",
+      access_token: "mockAccessToken",
+      refresh_token: "mockRefreshToken",
+    };
+
+    beforeEach(async () => {
+      service = await BrowserAuthenticationService.build({
+        ...mockConfig,
+      });
+      vi.mocked(exchangeTokens).mockResolvedValue(mockTokens);
+      vi.mocked(retrieveTokens).mockReturnValue(mockTokens);
+    });
+
+    it("should exchange auth code for tokens and store them", async () => {
+      const code = "mockCode";
+      const state = "mockState";
+
+      vi.mocked(
+        BrowserPublicClientPKCEProducer.prototype.getCodeVerifier,
+      ).mockResolvedValue("dummy-verifier");
+
+      const tokens = await service.tokenExchange(code, state);
+
+      expect(storeTokens).toHaveBeenCalledWith(
+        expect.any(LocalStorageAdapter),
+        mockTokens,
+      );
+      expect(tokens).toEqual(mockTokens);
+    });
+
+    it("should retrieve session data from local storage", async () => {
+      const sessionData: SessionData = {
+        authenticated: true,
+        idToken: mockTokens.id_token,
+        accessToken: mockTokens.access_token,
+        refreshToken: mockTokens.refresh_token,
+      };
+      const result = await service.getSessionData();
+
+      expect(retrieveTokens).toHaveBeenCalledWith(
+        expect.any(LocalStorageAdapter),
+      );
+      expect(result).toEqual(sessionData);
+    });
+  });
+});

package/test/unit/services/ServerAuthenticationResolver.test.ts

@@ -0,0 +1,110 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { ServerAuthenticationResolver } from "@/server/ServerAuthenticationResolver.js";
+import {
+  exchangeTokens,
+  getEndpointsWithOverrides,
+  retrieveTokens,
+  storeTokens,
+} from "@/shared/lib/util.js";
+import type { Endpoints, OIDCTokenResponseBody, SessionData, AuthStorage } from "@/types.js";
+import type { AuthConfig } from "@/server/config.js";
+import { GenericPublicClientPKCEProducer } from "@/services/PKCE.js";
+import type { AuthenticationResolver } from '@/services/types.js';
+
+vi.mock("oslo/oauth2");
+vi.mock("@/services/PKCE");
+vi.mock("@/shared/lib/util.js");
+
+describe("ServerAuthenticationResolver", () => {
+  const mockAuthConfig: AuthConfig = {
+    clientId: "mockClientId",
+    oauthServer: "http://mockOauthServer",
+    redirectUrl: "http://localhost/redirect",
+    challengeUrl: "http://localhost/challenge",
+  };
+  const mockEndpoints: Endpoints = {
+    auth: "http://mockAuthEndpoint",
+    token: "http://mockTokenEndpoint",
+    jwks: "http://mockJwksEndpoint",
+    userinfo: "http://mockUserinfoEndpoint",
+  };
+  const mockTokens: OIDCTokenResponseBody = {
+    id_token: "mockIdToken",
+    access_token: "mockAccessToken",
+    refresh_token: "mockRefreshToken",
+  };
+  const mockStorage = {} as AuthStorage;
+
+  let resolver: AuthenticationResolver;
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    vi.mocked(getEndpointsWithOverrides).mockResolvedValue(mockEndpoints);
+    resolver = await ServerAuthenticationResolver.build(
+      mockAuthConfig,
+      mockStorage,
+    );
+  });
+
+  describe("init", () => {
+    it("should initialize OAuth2 client with resolved endpoints", async () => {
+      expect(getEndpointsWithOverrides).toHaveBeenCalledWith(
+        mockAuthConfig.oauthServer,
+        undefined,
+      );
+    });
+  });
+
+  describe("tokenExchange", () => {
+    it("should exchange auth code for tokens and store them", async () => {
+      const code = "mockCode";
+      const state = "mockState";
+      const codeVerifier = "mockCodeVerifier";
+      vi.mocked(
+        GenericPublicClientPKCEProducer.prototype.getCodeVerifier,
+      ).mockResolvedValue(codeVerifier);
+      vi.mocked(exchangeTokens).mockResolvedValue(mockTokens);
+
+      const tokens = await resolver.tokenExchange(code, state);
+
+      expect(storeTokens).toHaveBeenCalledWith(mockStorage, mockTokens);
+      expect(tokens).toEqual(mockTokens);
+    });
+
+    it("should throw an error if code verifier is not found", async () => {
+      vi.mocked(
+        GenericPublicClientPKCEProducer.prototype.getCodeVerifier,
+      ).mockResolvedValue(null);
+
+      await expect(
+        resolver.tokenExchange("mockCode", "mockState"),
+      ).rejects.toThrow("Code verifier not found in storage");
+    });
+  });
+
+  describe("getSessionData", () => {
+    it("should retrieve session data from storage", async () => {
+      vi.mocked(retrieveTokens).mockReturnValue(mockTokens);
+
+      const sessionData: SessionData = {
+        authenticated: true,
+        idToken: mockTokens.id_token,
+        accessToken: mockTokens.access_token,
+        refreshToken: mockTokens.refresh_token,
+      };
+
+      const result = await resolver.getSessionData();
+
+      expect(retrieveTokens).toHaveBeenCalledWith(mockStorage);
+      expect(result).toEqual(sessionData);
+    });
+
+    it("should return null if no tokens are found in storage", async () => {
+      vi.mocked(retrieveTokens).mockReturnValue(null);
+
+      const result = await resolver.getSessionData();
+
+      expect(result).toBeNull();
+    });
+  });
+});

package/test/unit/shared/GenericAuthenticationRefresher.test.ts

@@ -0,0 +1,89 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { GenericAuthenticationRefresher } from "@/shared/lib/GenericAuthenticationRefresher.js";
+import {
+  getEndpointsWithOverrides,
+  retrieveTokens,
+  storeTokens,
+} from "@/shared/lib/util.js";
+import type { Endpoints, OIDCTokenResponseBody, AuthStorage} from "@/types.js";
+import { OAuth2Client } from "oslo/oauth2";
+import type { AuthConfig } from "@/server/config.js";
+
+vi.mock("@/shared/lib/util.js");
+vi.mock("oslo/oauth2");
+
+describe("GenericAuthenticationRefresher", () => {
+  const mockAuthConfig: AuthConfig = {
+    clientId: "mockClientId",
+    oauthServer: "http://mockOauthServer",
+    redirectUrl: "http://localhost/redirect",
+  };
+  const mockEndpoints: Endpoints = {
+    auth: "http://mockAuthEndpoint",
+    token: "http://mockTokenEndpoint",
+    jwks: "http://mockJwksEndpoint",
+    userinfo: "http://mockUserinfoEndpoint",
+  };
+  const mockTokens: OIDCTokenResponseBody = {
+    id_token: "mockIdToken",
+    access_token: "mockAccessToken",
+    refresh_token: "mockRefreshToken",
+  };
+  const mockStorage = {} as AuthStorage;
+
+  let refresher: GenericAuthenticationRefresher;
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    vi.mocked(getEndpointsWithOverrides).mockResolvedValue(mockEndpoints);
+    refresher = await GenericAuthenticationRefresher.build(
+      mockAuthConfig,
+      mockStorage,
+    );
+  });
+
+  describe("init", () => {
+    it("should initialize OAuth2 client with resolved endpoints", async () => {
+      expect(getEndpointsWithOverrides).toHaveBeenCalledWith(
+        mockAuthConfig.oauthServer,
+        undefined,
+      );
+      expect(refresher["endpoints"]).toEqual(mockEndpoints);
+      expect(refresher["oauth2client"]).toBeInstanceOf(OAuth2Client);
+    });
+  });
+
+  describe("refreshTokens", () => {
+    it("should refresh tokens and store them", async () => {
+      vi.mocked(retrieveTokens).mockReturnValue(mockTokens);
+      const refreshedTokens: OIDCTokenResponseBody = {
+        id_token: "newIdToken",
+        access_token: "newAccessToken",
+        refresh_token: "newRefreshToken",
+      };
+
+      vi.mocked(OAuth2Client.prototype.refreshAccessToken).mockResolvedValue(
+        refreshedTokens,
+      );
+
+      const result = await refresher.refreshTokens();
+
+      expect(
+        refresher["oauth2client"]?.refreshAccessToken,
+      ).toHaveBeenCalledWith(mockTokens.refresh_token);
+      expect(storeTokens).toHaveBeenCalledWith(mockStorage, refreshedTokens);
+      expect(result).toEqual(mockTokens);
+    });
+
+    it("should throw an error if no refresh token is available", async () => {
+      vi.mocked(retrieveTokens).mockReturnValue({
+        ...mockTokens,
+        refresh_token: undefined,
+      });
+
+      await expect(refresher.refreshTokens()).rejects.toThrow(
+        "No refresh token available",
+      );
+    });
+  });
+});

package/test/unit/shared/UserSession.test.ts

@@ -0,0 +1,42 @@
+import { describe, it, expect } from "vitest";
+import { GenericUserSession } from "@/shared/lib/UserSession.js";
+import type { AuthStorage, User } from "@/types.ts";
+
+const mockUser: User = {
+  id: "user123",
+  name: "John Doe",
+  email: "john@example.com",
+  picture: "https://example.com/john.jpg",
+  forwardedTokens: null,
+} as unknown as User;
+
+let storage: Record<string, string> = {};
+class TestStorage implements AuthStorage {
+  get(key: string): string | null {
+    return storage[key] ?? null;
+  }
+  set(key: string, value: string): void {
+    storage[key] = value;
+  }
+}
+
+describe("UserSession", () => {
+  beforeEach(() => {
+    storage = {}; // clear storage
+  });
+
+  describe("GenericUserSession", () => {
+    it("should get the user from session", () => {
+      const userSession = new GenericUserSession(new TestStorage());
+      userSession.set(mockUser);
+      const user = userSession.get();
+      expect(user).toEqual(mockUser);
+    });
+
+    it("should return null if user it not found", () => {
+      const userSession = new GenericUserSession(new TestStorage());
+      const user = userSession.get();
+      expect(user).toBeNull();
+    });
+  });
+});