@civic/auth 0.1.3 → 0.1.4-beta.0

package/test/unit/lib/oauth.test.ts

@@ -1,72 +0,0 @@
-import {
-  getOauthEndpoints,
-  getIssuerVariations,
-  displayModeFromState,
-  generateState,
-} from "@/lib/oauth.js";
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { oauthWellKnownResponse } from "../../support/fixtures.js";
-
-describe("getOauthEndpoints", () => {
-  afterEach(vi.clearAllMocks);
-
-  beforeEach(() => {
-    global.fetch = vi.fn().mockResolvedValue({
-      json: vi.fn().mockResolvedValue(oauthWellKnownResponse),
-    });
-  });
-
-  it("should translate the response from the auth server into an endpoints object", async () => {
-    const response = await getOauthEndpoints("https://example.com");
-    expect(response).toEqual({
-      auth: "https://auth-dev.civic.com/oauth/auth",
-      token: "https://auth-dev.civic.com/oauth/token",
-      jwks: "https://auth-dev.civic.com/oauth/jwks",
-      userinfo: "https://auth-dev.civic.com/oauth/me",
-    });
-  });
-});
-
-describe("getIssuerVariations", () => {
-  it("should return an array of variations of the issuer", () => {
-    const issuer = "https://example.com";
-    const variations = getIssuerVariations(issuer);
-    expect(variations).toEqual(["https://example.com", "https://example.com/"]);
-  });
-});
-
-describe("displayModeFromState", () => {
-  it("should return the display mode from the state", () => {
-    const state = "state";
-    const displayMode = "redirect";
-    const result = displayModeFromState(state, displayMode);
-
-    expect(result).toEqual(displayMode);
-  });
-
-  it("should extract the display mode correctly from state", () => {
-    const state =
-      "eyJ1dWlkIjoiMGY0NWU5YWItY2U1Ni00OWZiLTlkYmUtOGQ3ZmM3YTI3NDFhIiwiZGlzcGxheU1vZGUiOiJpZnJhbWUiLCJzZXJ2ZXJUb2tlbkV4Y2hhbmdlIjp0cnVlfQ";
-    const displayMode = "redirect";
-    const result = displayModeFromState(state, displayMode);
-
-    expect(result).toEqual("iframe");
-  });
-});
-
-describe("generateState", () => {
-  it("should generate a state string", () => {
-    const state = generateState("redirect");
-
-    expect(state).toBeTruthy();
-    expect(state).toHaveLength(96);
-  });
-
-  it('should generate a state string with "serverTokenExchange" key', () => {
-    const state = generateState("redirect", true);
-
-    expect(state).toBeTruthy();
-    const decoded = atob(state);
-    expect(JSON.parse(decoded)).toHaveProperty("serverTokenExchange", true);
-  });
-});

package/test/unit/logger.test.ts

@@ -1,175 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from "vitest";
-import debug from "debug";
-import { createLogger } from "../../src/lib/logger.js";
-
-// Mock the debug package
-vi.mock("debug", () => {
-  const debugInstance = vi.fn();
-  const debug = vi.fn(() => debugInstance);
-  // Add color property to match debug package API
-  Object.defineProperty(debugInstance, "color", {
-    set: vi.fn(),
-    get: vi.fn(),
-  });
-  return { default: debug };
-});
-
-describe("Logger", () => {
-  let mockDebug: ReturnType<typeof debug>;
-  let debugInstance: ReturnType<typeof vi.fn>;
-  let logger: ReturnType<typeof createLogger>;
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockDebug = debug as unknown as ReturnType<typeof debug>;
-    debugInstance = mockDebug("test") as unknown as ReturnType<typeof vi.fn>;
-    logger = createLogger("test");
-  });
-
-  it("should create debug instances with correct namespaces", () => {
-    logger = createLogger("api:routes");
-
-    // Verify that debug was called with the correct namespaces
-    expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:routes:debug");
-    expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:routes:info");
-    expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:routes:warn");
-    expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:routes:error");
-  });
-
-  it("should log debug messages with context", () => {
-    const context = { requestId: "123", userId: "456" };
-    logger.debug("Processing request", context);
-
-    expect(debugInstance).toHaveBeenCalledWith("Processing request", context);
-  });
-
-  it("should log info messages with multiple arguments", () => {
-    const requestId = "123";
-    const duration = 456;
-    logger.info("Request completed", { requestId, duration });
-
-    expect(debugInstance).toHaveBeenCalledWith("Request completed", {
-      requestId,
-      duration,
-    });
-  });
-
-  it("should log warning messages with structured data", () => {
-    const warning = {
-      code: "RATE_LIMIT",
-      requestId: "123",
-      limit: 100,
-      current: 95,
-    };
-
-    logger.warn("Rate limit approaching", warning);
-
-    expect(debugInstance).toHaveBeenCalledWith(
-      "Rate limit approaching",
-      warning,
-    );
-  });
-
-  it("should log error messages with error objects", () => {
-    const error = new Error("Database connection failed");
-    const context = {
-      requestId: "123",
-      operation: "getUserProfile",
-    };
-
-    logger.error("Operation failed", { error, ...context });
-
-    expect(debugInstance).toHaveBeenCalledWith("Operation failed", {
-      error,
-      ...context,
-    });
-  });
-
-  it("should handle undefined arguments", () => {
-    logger.info("Simple message");
-
-    expect(debugInstance).toHaveBeenCalledWith("Simple message");
-  });
-
-  it("should handle null values in context", () => {
-    const context = {
-      userId: null,
-      sessionId: undefined,
-      requestId: "123",
-    };
-
-    logger.debug("User context", context);
-
-    expect(debugInstance).toHaveBeenCalledWith("User context", context);
-  });
-
-  // Testing different logger namespaces
-  describe("Logger namespaces", () => {
-    it("should create db logger with correct namespace", () => {
-      const dbLogger = createLogger("api:db");
-      dbLogger.info("DB Operation");
-
-      expect(mockDebug).toHaveBeenCalledWith("@civic/auth:api:db:info");
-    });
-
-    it("should create auth handler logger with correct namespace", () => {
-      const authLogger = createLogger("api:handlers:auth");
-      authLogger.debug("Auth check");
-
-      expect(mockDebug).toHaveBeenCalledWith(
-        "@civic/auth:api:handlers:auth:debug",
-      );
-    });
-  });
-
-  // Integration-style tests
-  describe("Real-world scenarios", () => {
-    it("should log complete request lifecycle", () => {
-      const requestLogger = createLogger("api:request");
-      const requestId = "123";
-      const start = Date.now();
-
-      requestLogger.debug("Request started", {
-        requestId,
-        method: "GET",
-        path: "/api/users",
-      });
-      requestLogger.info("Processing request", { requestId, userId: "456" });
-      requestLogger.debug("DB query executed", { requestId, duration: 50 });
-      requestLogger.info("Request completed", {
-        requestId,
-        duration: Date.now() - start,
-        status: 200,
-      });
-
-      expect(debugInstance).toHaveBeenCalledTimes(4);
-    });
-
-    it("should log error scenario with full context", () => {
-      const requestLogger = createLogger("api:request");
-      const requestId = "123";
-      const error = new Error("Invalid user input");
-      const context = {
-        userId: "456",
-        input: { email: "invalid" },
-        validation: { failed: true, errors: ["Invalid email format"] },
-      };
-
-      requestLogger.debug("Validating input", {
-        requestId,
-        input: context.input,
-      });
-      requestLogger.warn("Validation failed", {
-        requestId,
-        validation: context.validation,
-      });
-      requestLogger.error("Request failed", {
-        requestId,
-        error,
-        context,
-      });
-
-      expect(debugInstance).toHaveBeenCalledTimes(3);
-    });
-  });
-});

package/test/unit/nextjs/NextAuthProvider.test.tsx

@@ -1,38 +0,0 @@
-import { render } from "@testing-library/react";
-import { describe, it, vi, expect } from "vitest";
-import { CivicNextAuthProvider } from "@/nextjs/providers/NextAuthProvider.js";
-import { resolveAuthConfig } from "@/nextjs/config.js";
-import React from "react";
-
-vi.mock("@/nextjs/config.js", () => ({
-  resolveAuthConfig: vi.fn(() => ({
-    clientId: "test-client-id",
-    oauthServer: "https://example.com",
-    callbackUrl: "https://example.com/callback",
-    challengeUrl: "https://example.com/challenge",
-    logoutUrl: "https://example.com/logout",
-  })),
-}));
-
-vi.mock("@/nextjs/hooks/useUserCookie", () => ({
-  useUserCookie: vi.fn(),
-}));
-
-vi.mock("@/nextjs/hooks/useTokenCookie", () => ({
-  useTokenCookie: vi.fn(),
-}));
-
-describe("CivicNextAuthProvider", () => {
-  it("should call resolveAuthConfig with no arguments", () => {
-    const children = <div>Test Content</div>;
-
-    render(
-      <CivicNextAuthProvider>
-        {children}
-      </CivicNextAuthProvider>
-    );
-
-    // The Next implementation should take all config from the next.config.js file, no config taken from provider props.
-    expect(resolveAuthConfig).toHaveBeenCalledWith();
-  });
-});

package/test/unit/nextjs/config.test.ts

@@ -1,218 +0,0 @@
-/* eslint-disable turbo/no-undeclared-env-vars */
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import {
-  resolveAuthConfig,
-  createCivicAuthPlugin,
-  type AuthConfig,
-  defaultAuthConfig,
-} from "@/nextjs/config.js";
-import type { TokensCookieConfig } from "@/index.js";
-import { DEFAULT_AUTH_SERVER } from "@/constants.js";
-
-const defaultCookies = {
-  id_token: {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: false,
-  },
-  access_token: {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: false,
-  },
-  refresh_token: {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: false,
-  },
-  code_verifier: {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: false,
-  },
-  app_url: {
-    httpOnly: true,
-    path: "/",
-    sameSite: "strict",
-    secure: false,
-  },
-} as TokensCookieConfig;
-
-describe("nextjs/config", () => {
-  const originalEnv = process.env;
-
-  beforeEach(() => {
-    vi.resetModules();
-    process.env = { ...originalEnv, NODE_ENV: "development" };
-  });
-
-  afterEach(() => {
-    process.env = originalEnv;
-    vi.restoreAllMocks();
-  });
-
-  describe("resolveAuthConfig", () => {
-    it("should throw an error if clientId is not provided", () => {
-      expect(() => resolveAuthConfig()).toThrowError(
-        "Civic Auth client ID is required",
-      );
-    });
-
-    it("should use default values when no config is provided", () => {
-      // client id must be defined
-      process.env._civic_auth_client_id = "clientId";
-      const result = resolveAuthConfig();
-      expect(result).toEqual({ ...defaultAuthConfig, clientId: "clientId" });
-    });
-
-    it("should override default values with provided config", () => {
-      const config: AuthConfig = {
-        clientId: "clientId",
-        callbackUrl: "/custom/callback",
-        loginUrl: "/custom/login",
-        include: ["/protected/*"],
-        exclude: ["/public/*"],
-      };
-      const result = resolveAuthConfig(config);
-      expect(result.callbackUrl).toBe("/custom/callback");
-      expect(result.loginUrl).toBe("/custom/login");
-      expect(result.include).toEqual(["/protected/*"]);
-      expect(result.exclude).toEqual(["/public/*"]);
-    });
-
-    it("should use environment variables if set", () => {
-      process.env._civic_auth_client_id = "clientId";
-      process.env._civic_auth_callback_url = "/env/callback";
-      process.env._civic_auth_login_url = "/env/login";
-      process.env._civic_auth_includes = "/env/protected/*";
-      process.env._civic_auth_excludes = "/env/public/*";
-
-      const result = resolveAuthConfig();
-      expect(result.callbackUrl).toBe("/env/callback");
-      expect(result.loginUrl).toBe("/env/login");
-      expect(result.include).toEqual(["/env/protected/*"]);
-      expect(result.exclude).toEqual(["/env/public/*"]);
-    });
-
-    it("should prioritize provided config over environment variables", () => {
-      process.env._civic_auth_callback_url = "/env/callback";
-      const config: AuthConfig = {
-        clientId: "clientId",
-        callbackUrl: "/config/callback",
-      };
-
-      const result = resolveAuthConfig(config);
-      expect(result.callbackUrl).toBe("/config/callback");
-    });
-
-    it("should merge cookie configurations correctly", () => {
-      const config: AuthConfig = {
-        clientId: "clientId",
-        cookies: {
-          tokens: {
-            id_token: { ...defaultCookies.id_token, secure: false },
-          } as TokensCookieConfig,
-          user: {
-            httpOnly: false,
-            secure: false,
-            sameSite: "strict",
-          },
-        },
-      };
-
-      const result = resolveAuthConfig(config);
-      expect(result.cookies.tokens).toEqual({
-        ...defaultCookies,
-        id_token: { ...defaultCookies.id_token, secure: false },
-      });
-
-      expect(result.cookies.user).toEqual({
-        httpOnly: false,
-        secure: false,
-        sameSite: "strict",
-        path: "/",
-        maxAge: 3600,
-      });
-    });
-
-    it("should set secure to true in the default cookie configs if NODE_ENV is not development", async () => {
-      process.env = { ...originalEnv, NODE_ENV: "production" };
-      // re-import to get the configs with the updated NODE_ENV
-      const configs = await import("../../../src/nextjs/config.js");
-      const result = configs.resolveAuthConfig({ clientId: "clientId" });
-      Object.values(result.cookies.tokens).forEach((cookie) => {
-        expect(cookie.secure).toBe(true);
-      });
-    });
-  });
-
-  describe("createCivicAuthPlugin", () => {
-    it("should return a function", () => {
-      const plugin = createCivicAuthPlugin({ clientId: "clientId" });
-      expect(typeof plugin).toBe("function");
-    });
-
-    it("should set environment variables based on resolved config", () => {
-      const config = {
-        clientId: "clientId",
-        callbackUrl: "/custom/callback",
-        loginUrl: "/custom/login",
-        logoutUrl: "/custom/logout",
-        include: ["/protected/*"],
-        exclude: ["/public/*"],
-        cookies: {
-          tokens: defaultCookies,
-          user: {
-            secure: false,
-            sameSite: "strict",
-            maxAge: 3600,
-          } as const,
-        },
-      };
-
-      const plugin = createCivicAuthPlugin(config);
-      const nextConfig = plugin({});
-
-      expect(nextConfig.env).toEqual({
-        _civic_auth_client_id: "clientId",
-        _civic_auth_callback_url: "/custom/callback",
-        _civic_auth_challenge_url: "/api/auth/challenge",
-        _civic_auth_login_url: "/custom/login",
-        _civic_auth_logout_url: "/custom/logout",
-        _civic_auth_includes: "/protected/*",
-        _civic_auth_excludes: "/public/*",
-        _civic_oauth_server: DEFAULT_AUTH_SERVER,
-        _civic_auth_cookie_config: JSON.stringify({
-          tokens: defaultCookies,
-          user: {
-            secure: false,
-            httpOnly: false,
-            sameSite: "strict",
-            path: "/",
-            maxAge: 3600,
-          },
-        }),
-      });
-    });
-
-    it("should merge with existing Next.js config", () => {
-      const existingConfig = {
-        reactStrictMode: true,
-        env: {
-          CUSTOM_VAR: "value",
-        },
-      };
-
-      const plugin = createCivicAuthPlugin({ clientId: "clientId" });
-      const nextConfig = plugin(existingConfig);
-
-      expect(nextConfig.reactStrictMode).toBe(true);
-      expect(nextConfig.env).toHaveProperty("CUSTOM_VAR", "value");
-      expect(nextConfig.env).toHaveProperty("_civic_auth_callback_url");
-    });
-  });
-});

package/test/unit/nextjs/getUser.test.ts

@@ -1,41 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from "vitest";
-import { GenericUserSession } from "@/shared/lib/UserSession.js";
-import type { User } from "@/types.ts";
-import { getUser } from "@/nextjs/index.js";
-import { NextjsClientStorage } from "@/nextjs/cookies.js";
-
-const mockUser: User = {
-  id: "user123",
-  name: "John Doe",
-  email: "john@example.com",
-  picture: "https://example.com/john.jpg",
-  idToken: "test-id-token",
-  accessToken: "test-access-token",
-  refreshToken: "test-refresh-token",
-} as unknown as User;
-
-describe("getUser", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    vi.spyOn(GenericUserSession.prototype, "get").mockResolvedValue(mockUser);
-    vi.spyOn(NextjsClientStorage.prototype, "get").mockImplementation(
-      async (cookieName: string) => {
-        switch (cookieName) {
-          case "access_token":
-            return Promise.resolve("test-access-token");
-          case "id_token":
-            return Promise.resolve("test-id-token");
-          case "refresh_token":
-            return Promise.resolve("test-refresh-token");
-          default:
-            return Promise.resolve(null);
-        }
-      },
-    );
-  });
-
-  it("should get the user from session", async () => {
-    const user = await getUser();
-    expect(user).toEqual(mockUser);
-  });
-});

package/test/unit/nextjs/middleware.test.ts

@@ -1,138 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from "vitest";
-import { NextResponse, type NextRequest } from "next/server.js";
-import { authMiddleware, withAuth } from "@/nextjs/middleware/index.js";
-import { defaultAuthConfig } from "@/nextjs/config.js";
-
-// Mock next/server
-vi.mock("next/server.js", () => ({
-  NextResponse: {
-    next: vi.fn(() => ({ type: "next" })),
-    redirect: vi.fn((url) => ({ type: "redirect", url })),
-  },
-}));
-
-describe("Auth Middleware", () => {
-  let request: NextRequest;
-
-  beforeEach(() => {
-    // Reset mocks
-    vi.clearAllMocks();
-
-    // Create base request
-    request = {
-      nextUrl: {
-        pathname: "/protected",
-      },
-      cookies: {
-        get: vi.fn(),
-      },
-      method: "GET",
-      url: "http://example.com/protected",
-    } as unknown as NextRequest;
-
-    process.env._civic_auth_client_id = "abc";
-  });
-
-  describe("authMiddleware", () => {
-    /* FIXME
-    it("should redirect to login when no token present", async () => {
-      const middleware = authMiddleware();
-      const response = await middleware(request);
-
-      expect(NextResponse.redirect).toHaveBeenCalledWith("http://example.com/");
-      expect(response.type).toBe("redirect");
-    });
-    */
-
-    it("should allow access when token is present", async () => {
-      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
-      const middleware = authMiddleware();
-      const response = await middleware(request);
-
-      expect(NextResponse.next).toHaveBeenCalled();
-      expect(response.type).toBe("next");
-    });
-
-    it("should skip auth check for redirect to login page", async () => {
-      request.nextUrl.pathname = "/login";
-      const middleware = authMiddleware({
-        ...defaultAuthConfig,
-        loginUrl: "/login",
-      });
-      const response = await middleware(request);
-
-      expect(NextResponse.next).toHaveBeenCalled();
-      expect(response.type).toBe("next");
-    });
-
-    it("should not skip auth check for non-GET to login page", async () => {
-      request.nextUrl.pathname = "/login";
-      const middleware = authMiddleware({
-        ...defaultAuthConfig,
-        loginUrl: "/login",
-      });
-      const response = await middleware({
-        ...request,
-        method: "POST",
-      } as NextRequest);
-
-      // should have redirected to the login page
-      expect(NextResponse.next).not.toHaveBeenCalled();
-      expect(response.type).toBe("redirect");
-    });
-  });
-
-  describe("withAuth", () => {
-    it("should chain custom middleware when authenticated", async () => {
-      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
-      const customMiddleware = vi.fn(() => NextResponse.next());
-      const middleware = withAuth(customMiddleware);
-
-      await middleware(request);
-
-      expect(customMiddleware).toHaveBeenCalled();
-    });
-
-    it("should not chain custom middleware when unauthorized", async () => {
-      const customMiddleware = vi.fn(() => NextResponse.next());
-      const middleware = withAuth(customMiddleware);
-
-      const response = await middleware(request);
-
-      expect(customMiddleware).not.toHaveBeenCalled();
-      expect(NextResponse.redirect).toHaveBeenCalled();
-      expect(response.type).toBe("redirect");
-    });
-  });
-
-  describe("path matching", () => {
-    it("should respect include patterns", async () => {
-      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
-      request.nextUrl.pathname = "/public";
-
-      const middleware = authMiddleware({
-        include: ["/protected/**"],
-      });
-
-      const response = await middleware(request);
-
-      expect(NextResponse.next).toHaveBeenCalled();
-      expect(response.type).toBe("next");
-    });
-
-    it("should respect exclude patterns", async () => {
-      request.cookies.get = vi.fn().mockReturnValue({ value: "valid-token" });
-      request.nextUrl.pathname = "/protected/public";
-
-      const middleware = authMiddleware({
-        include: ["/protected/**"],
-        exclude: ["/protected/public"],
-      });
-
-      const response = await middleware(request);
-
-      expect(NextResponse.next).toHaveBeenCalled();
-      expect(response.type).toBe("next");
-    });
-  });
-});