@civic/auth 0.0.1-beta.9.1 → 0.0.1-tsc.alpha.2

package/test/unit/nextjs/config.test.ts

@@ -0,0 +1,218 @@
+/* eslint-disable turbo/no-undeclared-env-vars */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import {
+  resolveAuthConfig,
+  createCivicAuthPlugin,
+  type AuthConfig,
+  defaultAuthConfig,
+} from "@/nextjs/config.js";
+import type { TokensCookieConfig } from "@/index.js";
+import { DEFAULT_AUTH_SERVER } from "@/constants.js";
+
+const defaultCookies = {
+  id_token: {
+    httpOnly: true,
+    path: "/",
+    sameSite: "strict",
+    secure: false,
+  },
+  access_token: {
+    httpOnly: true,
+    path: "/",
+    sameSite: "strict",
+    secure: false,
+  },
+  refresh_token: {
+    httpOnly: true,
+    path: "/",
+    sameSite: "strict",
+    secure: false,
+  },
+  code_verifier: {
+    httpOnly: true,
+    path: "/",
+    sameSite: "strict",
+    secure: false,
+  },
+  app_url: {
+    httpOnly: true,
+    path: "/",
+    sameSite: "strict",
+    secure: false,
+  },
+} as TokensCookieConfig;
+
+describe("nextjs/config", () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    vi.resetModules();
+    process.env = { ...originalEnv, NODE_ENV: "development" };
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+    vi.restoreAllMocks();
+  });
+
+  describe("resolveAuthConfig", () => {
+    it("should throw an error if clientId is not provided", () => {
+      expect(() => resolveAuthConfig()).toThrowError(
+        "Civic Auth client ID is required",
+      );
+    });
+
+    it("should use default values when no config is provided", () => {
+      // client id must be defined
+      process.env._civic_auth_client_id = "clientId";
+      const result = resolveAuthConfig();
+      expect(result).toEqual({ ...defaultAuthConfig, clientId: "clientId" });
+    });
+
+    it("should override default values with provided config", () => {
+      const config: AuthConfig = {
+        clientId: "clientId",
+        callbackUrl: "/custom/callback",
+        loginUrl: "/custom/login",
+        include: ["/protected/*"],
+        exclude: ["/public/*"],
+      };
+      const result = resolveAuthConfig(config);
+      expect(result.callbackUrl).toBe("/custom/callback");
+      expect(result.loginUrl).toBe("/custom/login");
+      expect(result.include).toEqual(["/protected/*"]);
+      expect(result.exclude).toEqual(["/public/*"]);
+    });
+
+    it("should use environment variables if set", () => {
+      process.env._civic_auth_client_id = "clientId";
+      process.env._civic_auth_callback_url = "/env/callback";
+      process.env._civic_auth_login_url = "/env/login";
+      process.env._civic_auth_includes = "/env/protected/*";
+      process.env._civic_auth_excludes = "/env/public/*";
+
+      const result = resolveAuthConfig();
+      expect(result.callbackUrl).toBe("/env/callback");
+      expect(result.loginUrl).toBe("/env/login");
+      expect(result.include).toEqual(["/env/protected/*"]);
+      expect(result.exclude).toEqual(["/env/public/*"]);
+    });
+
+    it("should prioritize provided config over environment variables", () => {
+      process.env._civic_auth_callback_url = "/env/callback";
+      const config: AuthConfig = {
+        clientId: "clientId",
+        callbackUrl: "/config/callback",
+      };
+
+      const result = resolveAuthConfig(config);
+      expect(result.callbackUrl).toBe("/config/callback");
+    });
+
+    it("should merge cookie configurations correctly", () => {
+      const config: AuthConfig = {
+        clientId: "clientId",
+        cookies: {
+          tokens: {
+            id_token: { ...defaultCookies.id_token, secure: false },
+          } as TokensCookieConfig,
+          user: {
+            httpOnly: false,
+            secure: false,
+            sameSite: "strict",
+          },
+        },
+      };
+
+      const result = resolveAuthConfig(config);
+      expect(result.cookies.tokens).toEqual({
+        ...defaultCookies,
+        id_token: { ...defaultCookies.id_token, secure: false },
+      });
+
+      expect(result.cookies.user).toEqual({
+        httpOnly: false,
+        secure: false,
+        sameSite: "strict",
+        path: "/",
+        maxAge: 3600,
+      });
+    });
+
+    it("should set secure to true in the default cookie configs if NODE_ENV is not development", async () => {
+      process.env = { ...originalEnv, NODE_ENV: "production" };
+      // re-import to get the configs with the updated NODE_ENV
+      const configs = await import("../../../src/nextjs/config.js");
+      const result = configs.resolveAuthConfig({ clientId: "clientId" });
+      Object.values(result.cookies.tokens).forEach((cookie) => {
+        expect(cookie.secure).toBe(true);
+      });
+    });
+  });
+
+  describe("createCivicAuthPlugin", () => {
+    it("should return a function", () => {
+      const plugin = createCivicAuthPlugin({ clientId: "clientId" });
+      expect(typeof plugin).toBe("function");
+    });
+
+    it("should set environment variables based on resolved config", () => {
+      const config = {
+        clientId: "clientId",
+        callbackUrl: "/custom/callback",
+        loginUrl: "/custom/login",
+        logoutUrl: "/custom/logout",
+        include: ["/protected/*"],
+        exclude: ["/public/*"],
+        cookies: {
+          tokens: defaultCookies,
+          user: {
+            secure: false,
+            sameSite: "strict",
+            maxAge: 3600,
+          } as const,
+        },
+      };
+
+      const plugin = createCivicAuthPlugin(config);
+      const nextConfig = plugin({});
+
+      expect(nextConfig.env).toEqual({
+        _civic_auth_client_id: "clientId",
+        _civic_auth_callback_url: "/custom/callback",
+        _civic_auth_challenge_url: "/api/auth/challenge",
+        _civic_auth_login_url: "/custom/login",
+        _civic_auth_logout_url: "/custom/logout",
+        _civic_auth_includes: "/protected/*",
+        _civic_auth_excludes: "/public/*",
+        _civic_oauth_server: DEFAULT_AUTH_SERVER,
+        _civic_auth_cookie_config: JSON.stringify({
+          tokens: defaultCookies,
+          user: {
+            secure: false,
+            httpOnly: false,
+            sameSite: "strict",
+            path: "/",
+            maxAge: 3600,
+          },
+        }),
+      });
+    });
+
+    it("should merge with existing Next.js config", () => {
+      const existingConfig = {
+        reactStrictMode: true,
+        env: {
+          CUSTOM_VAR: "value",
+        },
+      };
+
+      const plugin = createCivicAuthPlugin({ clientId: "clientId" });
+      const nextConfig = plugin(existingConfig);
+
+      expect(nextConfig.reactStrictMode).toBe(true);
+      expect(nextConfig.env).toHaveProperty("CUSTOM_VAR", "value");
+      expect(nextConfig.env).toHaveProperty("_civic_auth_callback_url");
+    });
+  });
+});

package/test/unit/nextjs/getUser.test.ts

@@ -0,0 +1,41 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { GenericUserSession } from "@/shared/lib/UserSession.js";
+import type { User } from "@/types.ts";
+import { getUser } from "@/nextjs/index.js";
+import { NextjsClientStorage } from "@/nextjs/cookies.js";
+
+const mockUser: User = {
+  id: "user123",
+  name: "John Doe",
+  email: "john@example.com",
+  picture: "https://example.com/john.jpg",
+  idToken: "test-id-token",
+  accessToken: "test-access-token",
+  refreshToken: "test-refresh-token",
+} as unknown as User;
+
+describe("getUser", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.spyOn(GenericUserSession.prototype, "get").mockReturnValue(mockUser);
+    vi.spyOn(NextjsClientStorage.prototype, "get").mockImplementation(
+      (cookieName: string) => {
+        switch (cookieName) {
+          case "access_token":
+            return "test-access-token";
+          case "id_token":
+            return "test-id-token";
+          case "refresh_token":
+            return "test-refresh-token";
+          default:
+            return null;
+        }
+      },
+    );
+  });
+
+  it("should get the user from session", () => {
+    const user = getUser();
+    expect(user).toEqual(mockUser);
+  });
+});

package/test/unit/nextjs/middleware.test.ts

@@ -0,0 +1,138 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { NextResponse, type NextRequest } from "next/server.js";
+import { authMiddleware, withAuth } from "@/nextjs/middleware/index.js";
+import { defaultAuthConfig } from "@/nextjs/config.js";
+
+// Mock next/server
+vi.mock("next/server.js", () => ({
+  NextResponse: {
+    next: vi.fn(() => ({ type: "next" })),
+    redirect: vi.fn((url) => ({ type: "redirect", url })),
+  },
+}));
+
+describe("Auth Middleware", () => {
+  let request: NextRequest;
+
+  beforeEach(() => {
+    // Reset mocks
+    vi.clearAllMocks();
+
+    // Create base request
+    request = {
+      nextUrl: {
+        pathname: "/protected",
+      },
+      cookies: {
+        get: vi.fn(),
+      },
+      method: "GET",
+      url: "http://example.com/protected",
+    } as unknown as NextRequest;
+
+    process.env._civic_auth_client_id = "abc";
+  });
+
+  describe("authMiddleware", () => {
+    /* FIXME
+    it("should redirect to login when no token present", async () => {
+      const middleware = authMiddleware();
+      const response = await middleware(request);
+
+      expect(NextResponse.redirect).toHaveBeenCalledWith("http://example.com/");
+      expect(response.type).toBe("redirect");
+    });
+    */
+
+    it("should allow access when token is present", async () => {
+      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
+      const middleware = authMiddleware();
+      const response = await middleware(request);
+
+      expect(NextResponse.next).toHaveBeenCalled();
+      expect(response.type).toBe("next");
+    });
+
+    it("should skip auth check for redirect to login page", async () => {
+      request.nextUrl.pathname = "/login";
+      const middleware = authMiddleware({
+        ...defaultAuthConfig,
+        loginUrl: "/login",
+      });
+      const response = await middleware(request);
+
+      expect(NextResponse.next).toHaveBeenCalled();
+      expect(response.type).toBe("next");
+    });
+
+    it("should not skip auth check for non-GET to login page", async () => {
+      request.nextUrl.pathname = "/login";
+      const middleware = authMiddleware({
+        ...defaultAuthConfig,
+        loginUrl: "/login",
+      });
+      const response = await middleware({
+        ...request,
+        method: "POST",
+      } as NextRequest);
+
+      // should have redirected to the login page
+      expect(NextResponse.next).not.toHaveBeenCalled();
+      expect(response.type).toBe("redirect");
+    });
+  });
+
+  describe("withAuth", () => {
+    it("should chain custom middleware when authenticated", async () => {
+      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
+      const customMiddleware = vi.fn(() => NextResponse.next());
+      const middleware = withAuth(customMiddleware);
+
+      await middleware(request);
+
+      expect(customMiddleware).toHaveBeenCalled();
+    });
+
+    it("should not chain custom middleware when unauthorized", async () => {
+      const customMiddleware = vi.fn(() => NextResponse.next());
+      const middleware = withAuth(customMiddleware);
+
+      const response = await middleware(request);
+
+      expect(customMiddleware).not.toHaveBeenCalled();
+      expect(NextResponse.redirect).toHaveBeenCalled();
+      expect(response.type).toBe("redirect");
+    });
+  });
+
+  describe("path matching", () => {
+    it("should respect include patterns", async () => {
+      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
+      request.nextUrl.pathname = "/public";
+
+      const middleware = authMiddleware({
+        include: ["/protected/**"],
+      });
+
+      const response = await middleware(request);
+
+      expect(NextResponse.next).toHaveBeenCalled();
+      expect(response.type).toBe("next");
+    });
+
+    it("should respect exclude patterns", async () => {
+      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
+      request.nextUrl.pathname = "/protected/public";
+
+      const middleware = authMiddleware({
+        include: ["/protected/**"],
+        exclude: ["/protected/public"],
+      });
+
+      const response = await middleware(request);
+
+      expect(NextResponse.next).toHaveBeenCalled();
+      expect(response.type).toBe("next");
+    });
+  });
+});