@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/tests/cases/unit/idp/oidcLogout.test.ts

@@ -0,0 +1,190 @@
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { exportJWK, generateKeyPair, SignJWT } from 'jose'
+import { buildOIDCLogoutUrl, validateOIDCLogoutToken } from '../../../../src/model/service/idp/providers/OIDCHelpers.js'
+import { IDPValidationError } from '../../../../src/model/service/idp/IDPValidationError.js'
+
+const clientWith = (endSessionEndpoint: string | undefined) => {
+	const captured: { params?: any } = {}
+	const client = {
+		issuer: { metadata: { end_session_endpoint: endSessionEndpoint } },
+		endSessionUrl: (params: any) => {
+			captured.params = params
+			const sp = new URLSearchParams()
+			if (params.id_token_hint) {
+				sp.set('id_token_hint', params.id_token_hint)
+			}
+			if (params.post_logout_redirect_uri) {
+				sp.set('post_logout_redirect_uri', params.post_logout_redirect_uri)
+			}
+			const q = sp.toString()
+			return q ? `${endSessionEndpoint}?${q}` : (endSessionEndpoint as string)
+		},
+	} as any
+	return { client, captured }
+}
+
+describe('buildOIDCLogoutUrl', () => {
+	test('no end_session_endpoint → null (graceful fallback)', () => {
+		const { client } = clientWith(undefined)
+		expect(buildOIDCLogoutUrl(client, { idToken: 'id-1' })).toBeNull()
+	})
+
+	test('builds URL with id_token_hint and post_logout_redirect_uri', () => {
+		const { client, captured } = clientWith('https://idp.example.com/logout')
+		const url = buildOIDCLogoutUrl(client, { idToken: 'id-1', postLogoutRedirectUri: 'https://app.example.com/' })
+		expect(captured.params).toEqual({ id_token_hint: 'id-1', post_logout_redirect_uri: 'https://app.example.com/' })
+		expect(url).toBe('https://idp.example.com/logout?id_token_hint=id-1&post_logout_redirect_uri=https%3A%2F%2Fapp.example.com%2F')
+	})
+
+	test('omits absent optional params (no id_token / redirect)', () => {
+		const { client, captured } = clientWith('https://idp.example.com/logout')
+		const url = buildOIDCLogoutUrl(client, {})
+		expect(captured.params).toEqual({})
+		expect(url).toBe('https://idp.example.com/logout')
+	})
+})
+
+/**
+ * Direct coverage of the back-channel logout-token validation — the single trust gate on the public,
+ * unauthenticated `/oidc/backchannel-logout` endpoint. Tokens are signed with a local `jose` keypair
+ * whose public JWK is served (via a stubbed global `fetch`) as the IdP's JWKS, so each branch of the
+ * verification is exercised end-to-end rather than mocked away.
+ */
+describe('validateOIDCLogoutToken', () => {
+	type SigningKey = Awaited<ReturnType<typeof generateKeyPair>>['privateKey']
+
+	const JWKS_URI = 'https://idp.logout-test.example.com/jwks'
+	const ISS = 'https://idp.logout-test.example.com'
+	const CLIENT_ID = 'client-123'
+	const LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout'
+	const KID = 'test-key-1'
+	const KID_RS384 = 'test-key-384'
+
+	let signingKey: SigningKey
+	let otherSigningKey: SigningKey
+	let rs384Key: SigningKey
+	let realFetch: typeof globalThis.fetch
+
+	const clientWithMeta = (meta: Record<string, unknown> = {}) =>
+		({ metadata: { client_id: CLIENT_ID, id_token_signed_response_alg: 'RS256', ...meta } }) as any
+	const issuerWithMeta = (meta: Record<string, unknown> = {}) => ({ metadata: { issuer: ISS, jwks_uri: JWKS_URI, ...meta } }) as any
+
+	const validClaims = (): Record<string, unknown> => ({ iss: ISS, aud: CLIENT_ID, sid: 'sid-1', events: { [LOGOUT_EVENT]: {} } })
+
+	const signToken = async (
+		claims: Record<string, unknown>,
+		opts: { alg?: string; kid?: string; key?: SigningKey; setIat?: boolean; iat?: number; setExp?: boolean } = {},
+	): Promise<string> => {
+		const { alg = 'RS256', kid = KID, key, setIat = true, iat, setExp = true } = opts
+		let builder = new SignJWT(claims).setProtectedHeader({ alg, kid })
+		if (setIat) {
+			builder = builder.setIssuedAt(iat)
+		}
+		if (setExp) {
+			builder = builder.setExpirationTime('1h')
+		}
+		return builder.sign(key ?? signingKey)
+	}
+
+	const validate = (token: string, client = clientWithMeta(), issuer = issuerWithMeta()) => validateOIDCLogoutToken(client, issuer, token)
+
+	beforeAll(async () => {
+		const keyPair = await generateKeyPair('RS256')
+		signingKey = keyPair.privateKey
+		otherSigningKey = (await generateKeyPair('RS256')).privateKey
+		const rs384Pair = await generateKeyPair('RS384')
+		rs384Key = rs384Pair.privateKey
+		const jwk = await exportJWK(keyPair.publicKey)
+		const rs384Jwk = await exportJWK(rs384Pair.publicKey)
+		// The RS384 key resolves fine; the validator's algorithm pinning (algorithms: ['RS256']) is then
+		// the *only* reason an RS384-signed token is rejected — so the alg-pinning test stays isolated.
+		const jwks = {
+			keys: [
+				{ ...jwk, kid: KID, alg: 'RS256', use: 'sig' },
+				{ ...rs384Jwk, kid: KID_RS384, alg: 'RS384', use: 'sig' },
+			],
+		}
+
+		realFetch = globalThis.fetch
+		globalThis.fetch = (async (input: any) => {
+			const u = typeof input === 'string' ? input : input instanceof URL ? input.href : input?.url
+			if (typeof u === 'string' && u.startsWith(JWKS_URI)) {
+				return new Response(JSON.stringify(jwks), { status: 200, headers: { 'content-type': 'application/json' } })
+			}
+			return realFetch(input)
+		}) as typeof globalThis.fetch
+	})
+
+	afterAll(() => {
+		globalThis.fetch = realFetch
+	})
+
+	test('accepts a well-formed logout token and extracts sid', async () => {
+		expect(await validate(await signToken(validClaims()))).toEqual({ sid: 'sid-1', sub: undefined })
+	})
+
+	test('accepts a sub-only logout token and extracts sub', async () => {
+		const token = await signToken({ iss: ISS, aud: CLIENT_ID, sub: 'user-1', events: { [LOGOUT_EVENT]: {} } })
+		expect(await validate(token)).toEqual({ sid: undefined, sub: 'user-1' })
+	})
+
+	test('rejects a token signed by an unknown key (bad signature)', async () => {
+		const token = await signToken(validClaims(), { key: otherSigningKey })
+		await expect(validate(token)).rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects a wrong issuer', async () => {
+		const token = await signToken({ ...validClaims(), iss: 'https://evil.example.com' })
+		await expect(validate(token)).rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects a wrong audience (token-substitution guard)', async () => {
+		const token = await signToken({ ...validClaims(), aud: 'some-other-client' })
+		await expect(validate(token)).rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects an algorithm other than the configured one (alg pinning)', async () => {
+		const token = await signToken(validClaims(), { alg: 'RS384', kid: KID_RS384, key: rs384Key })
+		await expect(validate(token)).rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects a token with no iat (replay-window guard)', async () => {
+		const token = await signToken(validClaims(), { setIat: false })
+		await expect(validate(token)).rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects a stale iat beyond the max age', async () => {
+		const token = await signToken(validClaims(), { iat: Math.floor(Date.now() / 1000) - 600 })
+		await expect(validate(token)).rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects a token with no exp', async () => {
+		const token = await signToken(validClaims(), { setExp: false })
+		await expect(validate(token)).rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects a token carrying a nonce (ID-token-replay guard)', async () => {
+		const token = await signToken({ ...validClaims(), nonce: 'n-1' })
+		await expect(validate(token)).rejects.toThrow(/nonce/)
+	})
+
+	test('rejects a token missing the back-channel-logout event member', async () => {
+		const token = await signToken({ iss: ISS, aud: CLIENT_ID, sid: 'sid-1', events: {} })
+		await expect(validate(token)).rejects.toThrow(/back-channel-logout event/)
+	})
+
+	test('rejects a token with neither sid nor sub', async () => {
+		const token = await signToken({ iss: ISS, aud: CLIENT_ID, events: { [LOGOUT_EVENT]: {} } })
+		await expect(validate(token)).rejects.toThrow(/sid or sub/)
+	})
+
+	test('rejects when the client has no client_id (aud check must fail closed)', async () => {
+		const token = await signToken(validClaims())
+		await expect(validate(token, clientWithMeta({ client_id: undefined }))).rejects.toThrow(/client_id/)
+	})
+
+	test('rejects when the issuer advertises no jwks_uri', async () => {
+		const token = await signToken(validClaims())
+		await expect(validate(token, clientWithMeta(), issuerWithMeta({ jwks_uri: undefined }))).rejects.toThrow(/jwks_uri/)
+	})
+})

package/tests/cases/unit/idp/oidcProvider.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from 'bun:test'
+import { OIDCProvider } from '../../../../src/model/service/idp/providers/OIDCProvider.js'
+import { InvalidIDPConfigurationError } from '../../../../src/model/service/idp/InvalidIDPConfigurationError.js'
+
+const baseConfig = {
+	url: 'https://idp.example.com',
+	clientId: 'client',
+	clientSecret: 'secret',
+}
+
+describe('OIDCProvider.validateConfiguration', () => {
+	const provider = new OIDCProvider()
+
+	test('accepts tokenEndpointAuthMethod', () => {
+		const config = provider.validateConfiguration({ ...baseConfig, tokenEndpointAuthMethod: 'client_secret_post' })
+		expect(config.tokenEndpointAuthMethod).toBe('client_secret_post')
+	})
+
+	test('rejects an unknown tokenEndpointAuthMethod', () => {
+		expect(() => provider.validateConfiguration({ ...baseConfig, tokenEndpointAuthMethod: 'magic' }))
+			.toThrow(InvalidIDPConfigurationError)
+	})
+
+	test('accepts a claimMapping with attributesKey and dot-path subject', () => {
+		const config = provider.validateConfiguration({
+			...baseConfig,
+			claimMapping: { externalIdentifier: 'oid', email: 'email', attributesKey: 'attributes' },
+		})
+		expect(config.claimMapping).toEqual({ externalIdentifier: 'oid', email: 'email', attributesKey: 'attributes' })
+	})
+})

package/tests/cases/unit/idp/oidcResponse.test.ts

@@ -0,0 +1,198 @@
+import { describe, expect, test } from 'bun:test'
+import { handleOIDCResponse } from '../../../../src/model/service/idp/providers/OIDCHelpers.js'
+import { IDPValidationError } from '../../../../src/model/service/idp/IDPValidationError.js'
+
+/** A stub openid-client whose `callback` yields the given id-token claims and `userinfo` the given object. */
+const stubClient = (idTokenClaims: Record<string, unknown>, userInfo?: Record<string, unknown>) =>
+	({
+		callback: async () => ({
+			access_token: 'access-token',
+			claims: () => idTokenClaims,
+		}),
+		userinfo: async () => userInfo ?? {},
+	}) as any
+
+const responseData = { parameters: {}, redirectUrl: 'https://app.example.com/cb' }
+
+describe('handleOIDCResponse — claim mapping', () => {
+	test('defaults: subject from `sub`, e-mail from `email`', async () => {
+		const client = stubClient({ sub: 'jan.pokusny@npi.cz', email: 'jan.pokusny@npi.cz', given_name: 'Jan' })
+		const result = await handleOIDCResponse(client, responseData)
+		expect(result.externalIdentifier).toBe('jan.pokusny@npi.cz')
+		expect(result.email).toBe('jan.pokusny@npi.cz')
+	})
+
+	test('maps the external identifier to a stable claim (oid) from a flat id_token', async () => {
+		const client = stubClient({ sub: 'jan.pokusny@npi.cz', email: 'jan.pokusny@npi.cz', oid: 'cf0f5802-4afa-42bf' })
+		const result = await handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'oid' } })
+		expect(result.externalIdentifier).toBe('cf0f5802-4afa-42bf')
+		expect(result.email).toBe('jan.pokusny@npi.cz')
+	})
+
+	test('unwraps userinfo claims nested under `attributes` (Apereo CAS shape)', async () => {
+		const client = stubClient(
+			{ sub: 'jan.pokusny@npi.cz' },
+			{
+				sub: 'jan.pokusny@npi.cz',
+				attributes: { oid: 'cf0f5802-4afa-42bf', email: 'jan.pokusny@npi.cz', given_name: 'Jan', family_name: 'Pokusný' },
+			},
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { externalIdentifier: 'oid', attributesKey: 'attributes' },
+		})
+		expect(result.externalIdentifier).toBe('cf0f5802-4afa-42bf')
+		expect(result.email).toBe('jan.pokusny@npi.cz')
+		expect(result.given_name).toBe('Jan')
+	})
+
+	test('dot-path mapping reaches into a nested claim without unwrapping', async () => {
+		const client = stubClient({ sub: 's', user: { id: 'nested-id' } })
+		const result = await handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'user.id' } })
+		expect(result.externalIdentifier).toBe('nested-id')
+	})
+
+	test('falls back to `sub` when the mapped subject claim is absent', async () => {
+		const client = stubClient({ sub: 'fallback-sub' })
+		const result = await handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'oid' } })
+		expect(result.externalIdentifier).toBe('fallback-sub')
+	})
+
+	test('email_verified is read from unwrapped attributes (string "true" accepted)', async () => {
+		const client = stubClient(
+			{ sub: 's' },
+			{ sub: 's', attributes: { email: 'a@b.cz', email_verified: 'true' } },
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { attributesKey: 'attributes' },
+		})
+		expect(result.emailVerified).toBe(true)
+	})
+})
+
+describe('handleOIDCResponse — externalIdentifier scalar guard', () => {
+	// The federation key is persisted and matched on the next sign-in; a non-scalar coerced via
+	// String() would collapse every user of the provider onto one key, so we fail closed.
+	test('rejects a mapped subject that is an object', async () => {
+		const client = stubClient({ sub: 's', obj: { a: 1 } })
+		await expect(handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'obj' } }))
+			.rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects a mapped subject that is an array', async () => {
+		const client = stubClient({ sub: 's', list: ['a', 'b'] })
+		await expect(handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'list' } }))
+			.rejects.toThrow(IDPValidationError)
+	})
+
+	test('accepts a numeric mapped subject, coercing it to its string form', async () => {
+		const client = stubClient({ sub: 's', uid: 12345 })
+		const result = await handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'uid' } })
+		expect(result.externalIdentifier).toBe('12345')
+	})
+
+	test('rejects a mapped subject that resolves to an empty string', async () => {
+		const client = stubClient({ sub: 's', oid: '' })
+		await expect(handleOIDCResponse(client, responseData, { claimMapping: { externalIdentifier: 'oid' } }))
+			.rejects.toThrow(IDPValidationError)
+	})
+
+	test('rejects an empty `sub` on the default path', async () => {
+		const client = stubClient({ sub: '' })
+		await expect(handleOIDCResponse(client, responseData))
+			.rejects.toThrow(IDPValidationError)
+	})
+})
+
+describe('handleOIDCResponse — signed claims win over unwrapped attributes', () => {
+	// `attributes` come from the unsigned userinfo response; they must not override a claim already
+	// present in the signature-verified ID-token / userInfo merge.
+	test('a signed id_token `sub` is not overridden by an attributes-level `sub`', async () => {
+		const client = stubClient(
+			{ sub: 'signed-subject' },
+			{ sub: 'signed-subject', attributes: { sub: 'spoofed-subject', email: 'a@b.cz' } },
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { attributesKey: 'attributes' },
+		})
+		expect(result.externalIdentifier).toBe('signed-subject')
+	})
+
+	test('a top-level email_verified is not overridden by an attributes-level one', async () => {
+		const client = stubClient(
+			{ sub: 's' },
+			{ sub: 's', email_verified: false, attributes: { email: 'a@b.cz', email_verified: 'true' } },
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { attributesKey: 'attributes' },
+		})
+		expect(result.emailVerified).toBe(false)
+	})
+})
+
+describe('handleOIDCResponse — non-string email/name do not leak', () => {
+	// A non-string `email` claim must be dropped, not passed through `...source` — it would
+	// otherwise reach the by-e-mail lookup and crash normalizeEmail (TypeError -> 500).
+	test('a non-string e-mail claim is dropped to undefined, not leaked', async () => {
+		const client = stubClient({ sub: 's', email: ['a@b.cz', 'c@d.cz'] })
+		const result = await handleOIDCResponse(client, responseData)
+		expect(result.email).toBeUndefined()
+	})
+})
+
+describe('handleOIDCResponse — display name', () => {
+	// `name` is optional in OIDC core and several providers (Apereo CAS, Entra ID, Keycloak under its
+	// default mappers) omit it while sending the parts. Without the fallback CreatePersonCommand lands
+	// on its own last-resort default and the person ends up named after their e-mail's local part.
+	test('composes the name from given_name + family_name when there is no `name` claim', async () => {
+		const client = stubClient({ sub: 's', email: 'jan@example.com', given_name: 'Jan', family_name: 'Novák' })
+		const result = await handleOIDCResponse(client, responseData)
+		expect(result.name).toBe('Jan Novák')
+	})
+
+	test('an explicit `name` claim still wins over the parts', async () => {
+		const client = stubClient({ sub: 's', name: 'Jan Novák ml.', given_name: 'Jan', family_name: 'Novák' })
+		const result = await handleOIDCResponse(client, responseData)
+		expect(result.name).toBe('Jan Novák ml.')
+	})
+
+	test('only one part present → that part alone, no stray whitespace', async () => {
+		expect((await handleOIDCResponse(stubClient({ sub: 's', given_name: 'Jan' }), responseData)).name).toBe('Jan')
+		expect((await handleOIDCResponse(stubClient({ sub: 's', family_name: 'Novák' }), responseData)).name).toBe('Novák')
+	})
+
+	test('blank / non-string parts are ignored rather than composed into whitespace', async () => {
+		expect((await handleOIDCResponse(stubClient({ sub: 's', given_name: '  ', family_name: '' }), responseData)).name)
+			.toBeUndefined()
+		expect((await handleOIDCResponse(stubClient({ sub: 's', given_name: ['Jan'], family_name: 3 }), responseData)).name)
+			.toBeUndefined()
+	})
+
+	test('a blank `name` claim falls back to the parts', async () => {
+		const client = stubClient({ sub: 's', name: '   ', given_name: 'Jan', family_name: 'Novák' })
+		expect((await handleOIDCResponse(client, responseData)).name).toBe('Jan Novák')
+	})
+
+	test('an explicitly mapped name claim is honoured as-is — no silent substitution', async () => {
+		// Mapping a claim states where the name lives; falling back to other claims would defeat that.
+		const client = stubClient({ sub: 's', displayName: 'Jan N.', given_name: 'Jan', family_name: 'Novák' })
+		expect((await handleOIDCResponse(client, responseData, { claimMapping: { name: 'displayName' } })).name).toBe('Jan N.')
+		const missing = stubClient({ sub: 's', given_name: 'Jan', family_name: 'Novák' })
+		expect((await handleOIDCResponse(missing, responseData, { claimMapping: { name: 'displayName' } })).name).toBeUndefined()
+	})
+
+	test('the parts are read after attributes-lifting, so a CAS-shaped userinfo works', async () => {
+		const client = stubClient(
+			{ sub: 's' },
+			{ sub: 's', attributes: { given_name: 'Jan', family_name: 'Novák' } },
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { attributesKey: 'attributes' },
+		})
+		expect(result.name).toBe('Jan Novák')
+	})
+})