@docupace/pipeline 1.0.66 → 1.0.68

package/src/auth0/export.test.js

@@ -0,0 +1,103 @@
+// exportConf.test.js
+import { jest } from '@jest/globals';
+
+// Mock modules using ESM-safe methods
+jest.unstable_mockModule('./vault.js', () => ({
+  getVaultSecrets: jest.fn(),
+}));
+
+jest.unstable_mockModule('../next/config.js', () => ({
+  getVaultSecretsConfigs: jest.fn(),
+}));
+
+jest.unstable_mockModule('auth0-deploy-cli', () => ({
+  dump: jest.fn(),
+}));
+
+// Import the actual function and mocked dependencies after mocks are in place
+const { exportConf } = await import('./export.js');
+const { getVaultSecrets } = await import('./vault.js');
+const { getVaultSecretsConfigs } = await import('../next/config.js');
+const { dump } = await import('auth0-deploy-cli');
+
+describe('exportConf', () => {
+  const site = 'example';
+  const env = 'dev';
+  const auth0Tenant = '';
+
+  const mockSecrets = {
+    AUTH0_CLIENT_ID: 'test-client-id',
+    AUTH0_CLIENT_SECRET: 'test-client-secret',
+  };
+
+  const mockPath = 'vault/path/to/secrets';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    getVaultSecretsConfigs.mockReturnValue({
+      siteCommonSecretsPath: mockPath,
+    });
+
+    getVaultSecrets.mockResolvedValue(mockSecrets);
+
+    dump.mockResolvedValue(undefined);
+  });
+
+  it('should export Auth0 configuration with default tenant format', async () => {
+    const logSpy = jest.spyOn(console, 'log').mockImplementation(() => {});
+    await exportConf(site, env, auth0Tenant);
+
+    expect(getVaultSecretsConfigs).toHaveBeenCalledWith(site);
+    expect(getVaultSecrets).toHaveBeenCalledWith(mockPath);
+    expect(dump).toHaveBeenCalledWith(
+      expect.objectContaining({
+        config: {
+          AUTH0_DOMAIN: 'docupace-dev-example.us.auth0.com',
+          AUTH0_CLIENT_ID: 'test-client-id',
+          AUTH0_CLIENT_SECRET: 'test-client-secret',
+        },
+      }),
+    );
+
+    logSpy.mockRestore();
+  });
+
+  it('should export Auth0 configuration with custom tenant', async () => {
+    const customTenant = 'custom-tenant';
+    await exportConf(site, env, customTenant);
+
+    expect(dump).toHaveBeenCalledWith(
+      expect.objectContaining({
+        config: {
+          AUTH0_DOMAIN: 'custom-tenant.us.auth0.com',
+          AUTH0_CLIENT_ID: 'test-client-id',
+          AUTH0_CLIENT_SECRET: 'test-client-secret',
+        },
+      }),
+    );
+  });
+
+  it('should log error and exit process on failure', async () => {
+    getVaultSecrets.mockRejectedValue(new Error('Vault error'));
+
+    const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => {
+      throw new Error('process.exit');
+    });
+
+    await expect(exportConf(site, env, auth0Tenant)).rejects.toThrow(
+      'process.exit',
+    );
+
+    expect(errorSpy).toHaveBeenCalledWith(
+      expect.stringContaining(
+        'Error during Auth0 example configuration export:',
+      ),
+      'Vault error',
+    );
+
+    errorSpy.mockRestore();
+    exitSpy.mockRestore();
+  });
+});

package/src/auth0/metadata.js

@@ -1,16 +1,15 @@
 import fs from 'fs-extra';
 import axios from 'axios';
-import path from 'path';
+import * as path from 'node:path'; // ESM-compatible import
 import { cloneRepository, pushDeployConfig } from '../next/deploy.js';
 import { getAuth0AuthToken } from './configure.js';
 import { getVaultSecrets } from './vault.js';
 import { getVaultSecretsConfigs } from '../next/config.js';
 
-export async function getAuth0Metadata(site, env) {
+export async function getAuth0Metadata(site, env, auth0Tenant) {
   try {
     const connectDeployRepoPath = await cloneRepository('connect-deploy');
 
-    // mapping of env to env
     const envMap = {
       dev: 'dev',
       preprod: 'qa',
@@ -18,14 +17,15 @@ export async function getAuth0Metadata(site, env) {
       uat: 'uat',
       'prod-www3': 'prod',
     };
+
     process.chdir(`${connectDeployRepoPath}/envs/${env}/${site}`);
 
     const configPath = path.join('conf', 'application.conf');
     const appConf = await fs.readFile(configPath, 'utf-8');
+
     const connectContext = appConf.match(
       /application\.context\s*=\s*"(.*?)"/,
     )?.[1];
-
     if (!connectContext) {
       console.error('connectContext not found in application.conf. Exiting...');
       process.exit(1);
@@ -34,7 +34,6 @@ export async function getAuth0Metadata(site, env) {
     const siteHost = appConf.match(
       /docupace\.baseUrlClient\s*=\s*"?https?:\/\/([^/]+)"?/,
     )?.[1];
-
     if (!siteHost) {
       console.error('siteHost not found in application.conf. Exiting...');
       process.exit(1);
@@ -47,10 +46,17 @@ export async function getAuth0Metadata(site, env) {
     const siteCommonSecretsPath =
       getVaultSecretsConfigs(site).siteCommonSecretsPath;
     console.log(`siteCommonSecretsPath => ${siteCommonSecretsPath}`);
+
     const siteCommonSecrets = await getVaultSecrets(siteCommonSecretsPath);
-    const auth0Domain = `docupace-${envMap[env]}-${site}.us.auth0.com`;
+
+    const auth0Domain =
+      auth0Tenant === ''
+        ? `docupace-${envMap[env]}-${site}.us.auth0.com`
+        : `${auth0Tenant}.us.auth0.com`;
+
     const auth0ClientId = siteCommonSecrets.AUTH0_CLIENT_ID;
     const auth0ClientSecret = siteCommonSecrets.AUTH0_CLIENT_SECRET;
+
     const auth0Token = await getAuth0AuthToken(
       auth0Domain,
       auth0ClientId,
@@ -78,9 +84,7 @@ export async function getAuth0Metadata(site, env) {
 
     const metadataRes = await axios.get(
       `https://${auth0Domain}/samlp/metadata/${clientId}`,
-      {
-        responseType: 'text',
-      },
+      { responseType: 'text' },
     );
 
     const metadata = metadataRes.data;
@@ -91,6 +95,7 @@ export async function getAuth0Metadata(site, env) {
       );
       process.exit(1);
     }
+
     await fs.ensureDir('conf/saml');
     await fs.writeFile('conf/saml/auth0.xml', metadata);
     console.log('SAML metadata written to conf/saml/auth0.xml');
@@ -121,6 +126,7 @@ export async function getAuth0Metadata(site, env) {
 
     await fs.writeFile(configPath, newConfig);
     console.log('The application.conf has been updated.');
+
     await pushDeployConfig(
       connectDeployRepoPath,
       `Auth0 SAML metadata update for site: (${site}) in env: (${env})`,

package/src/auth0/metadata.test.js

@@ -0,0 +1,186 @@
+import { jest } from '@jest/globals';
+
+// ----- Mocks (ESM-safe) -----
+jest.unstable_mockModule('fs-extra', () => ({
+  default: {
+    readFile: jest.fn(),
+    writeFile: jest.fn(),
+    ensureDir: jest.fn(),
+  },
+}));
+
+jest.unstable_mockModule('axios', () => ({
+  default: {
+    get: jest.fn(),
+  },
+}));
+
+jest.unstable_mockModule('path', () => ({
+  join: jest.fn((...args) => args.join('/')),
+}));
+
+jest.unstable_mockModule('../next/deploy.js', () => ({
+  cloneRepository: jest.fn(),
+  pushDeployConfig: jest.fn(),
+}));
+
+jest.unstable_mockModule('./configure.js', () => ({
+  getAuth0AuthToken: jest.fn(),
+}));
+
+jest.unstable_mockModule('./vault.js', () => ({
+  getVaultSecrets: jest.fn(),
+}));
+
+jest.unstable_mockModule('../next/config.js', () => ({
+  getVaultSecretsConfigs: jest.fn(),
+}));
+
+// ----- Imports AFTER mocks -----
+const { getAuth0Metadata } = await import('./metadata.js');
+const fs = (await import('fs-extra')).default;
+const axios = (await import('axios')).default;
+const { cloneRepository, pushDeployConfig } = await import('../next/deploy.js');
+const { getAuth0AuthToken } = await import('./configure.js');
+const { getVaultSecrets } = await import('./vault.js');
+const { getVaultSecretsConfigs } = await import('../next/config.js');
+
+// ----- Shared Setup -----
+beforeAll(() => {
+  jest.spyOn(console, 'log').mockImplementation(() => {});
+  jest.spyOn(console, 'error').mockImplementation(() => {});
+});
+
+afterAll(() => {
+  console.log.mockRestore();
+  console.error.mockRestore();
+});
+
+describe('getAuth0Metadata', () => {
+  const site = 'example';
+  const env = 'dev';
+  const auth0Tenant = '';
+  const fakeRepoPath = '/tmp/repo';
+  const fakeAppConf = `
+    application.context = "/connect"
+    docupace.baseUrlClient = "https://example.docupace.com"
+  `;
+
+  const mockSecrets = {
+    AUTH0_CLIENT_ID: 'client-id',
+    AUTH0_CLIENT_SECRET: 'client-secret',
+  };
+
+  const auth0Token = 'fake-token';
+  const clientId = 'abc123';
+  const fakeMetadata = '<xml>'.padEnd(2500, 'a') + '</xml>';
+
+  let originalChdir;
+  let exitSpy;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    axios.get.mockReset();
+
+    cloneRepository.mockResolvedValue(fakeRepoPath);
+    getVaultSecretsConfigs.mockReturnValue({
+      siteCommonSecretsPath: 'vault/path',
+    });
+    getVaultSecrets.mockResolvedValue(mockSecrets);
+    getAuth0AuthToken.mockResolvedValue(auth0Token);
+    fs.readFile.mockResolvedValue(fakeAppConf);
+    fs.writeFile.mockResolvedValue();
+    fs.ensureDir.mockResolvedValue();
+    pushDeployConfig.mockResolvedValue();
+
+    originalChdir = process.chdir;
+    process.chdir = jest.fn();
+
+    exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    process.chdir = originalChdir;
+    exitSpy.mockRestore();
+  });
+
+  it('should download and write metadata, update config, and push changes', async () => {
+    axios.get
+      .mockResolvedValueOnce({
+        data: [{ name: 'docupace-connect', client_id: clientId }],
+      }) // clients
+      .mockResolvedValueOnce({ data: fakeMetadata }); // metadata
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(cloneRepository).toHaveBeenCalledWith('connect-deploy');
+    expect(fs.readFile).toHaveBeenCalledWith('conf/application.conf', 'utf-8');
+    expect(fs.ensureDir).toHaveBeenCalledWith('conf/saml');
+    expect(fs.writeFile).toHaveBeenCalledWith(
+      'conf/saml/auth0.xml',
+      expect.stringContaining('<xml'),
+    );
+    expect(fs.writeFile).toHaveBeenCalledWith(
+      'conf/application.conf',
+      expect.stringContaining('useSAML=true'),
+    );
+    expect(pushDeployConfig).toHaveBeenCalled();
+  });
+
+  it('should exit if docupace-connect client is not found', async () => {
+    axios.get.mockResolvedValueOnce({ data: [] }); // empty clients
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith(
+      'Client "docupace-connect" not found.',
+    );
+  });
+
+  it('should exit if metadata is too small', async () => {
+    axios.get
+      .mockResolvedValueOnce({
+        data: [{ name: 'docupace-connect', client_id: clientId }],
+      }) // clients
+      .mockResolvedValueOnce({ data: '<small>' }); // small metadata
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith(
+      'Downloaded metadata looks incorrect (too small). Exiting...',
+    );
+  });
+
+  it('should exit if connectContext is missing', async () => {
+    fs.readFile.mockResolvedValue(`docupace.baseUrlClient = "https://abc.com"`); // no context
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith(
+      'connectContext not found in application.conf. Exiting...',
+    );
+  });
+
+  it('should exit if siteHost is missing', async () => {
+    fs.readFile.mockResolvedValue(`application.context = "/abc"`); // no host
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith(
+      'siteHost not found in application.conf. Exiting...',
+    );
+  });
+
+  it('should exit on unknown error', async () => {
+    getVaultSecrets.mockRejectedValue(new Error('boom'));
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith('Error:', 'boom');
+  });
+});

package/src/auth0/vault.js

@@ -1,107 +1,60 @@
+// src/auth0/vault.js
 import axios from 'axios';
 
-/**
- * Fetch secrets from Vault.
- * @param {string} vaultPath - The path in Vault to fetch secrets from.
- * @returns {Promise<Object>} - The secret data as a JSON object.
- */
 export async function getVaultSecrets(vaultPath) {
-  if (!vaultPath) {
-    console.error('Error: VAULT_PATH is required.');
-    throw new Error('VAULT_PATH is required.');
-  }
-
-  const vaultToken = process.env.VAULT_TOKEN;
-  const vaultAddr = process.env.VAULT_ADDR;
+  if (!vaultPath) throw new Error('VAULT_PATH is required.');
 
-  if (!vaultToken || !vaultAddr) {
-    console.error('Error: VAULT_TOKEN and VAULT_ADDR must be set.');
+  const token = process.env.VAULT_TOKEN;
+  const addr = process.env.VAULT_ADDR;
+  if (!token || !addr)
     throw new Error('VAULT_TOKEN and VAULT_ADDR must be set.');
+
+  if (process.env.VAULT_SKIP_VERIFY === 'true') {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
   }
 
   try {
-    // Disable SSL verification globally by setting environment variable
-    if (process.env.VAULT_SKIP_VERIFY === 'true') {
-      process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
-    }
-
-    // Fetch the secret from Vault
-    const response = await axios.get(`${vaultAddr}/v1/${vaultPath}`, {
-      headers: {
-        'X-Vault-Token': vaultToken,
-      },
+    const response = await axios.get(`${addr}/v1/${vaultPath}`, {
+      headers: { 'X-Vault-Token': token },
     });
 
-    // Validate the response contains JSON data
     const data = response.data;
-    if (data && typeof data === 'object') {
-      // console.log(`Secrets fetched successfully from Vault at ${JSON.stringify(data.data.data)})`);
-      return data.data.data;
-    } else {
-      console.error('Error: Invalid JSON received from Vault.');
-      throw new Error('Invalid JSON received from Vault.');
-    }
-  } catch (error) {
-    if (error.response) {
-      console.error(
-        `Error: Failed to connect to Vault server at ${vaultAddr}. Response: ${error.response.status} ${error.response.statusText}`,
-      );
-    } else {
-      console.error(`Error: ${error.message}`);
-    }
-    // throw error;
+    if (data && typeof data === 'object') return data.data.data;
+    throw new Error('Invalid JSON received from Vault.');
+  } catch (err) {
+    console.error(
+      'Vault GET error:',
+      err?.message || err?.response?.statusText || err,
+    );
   }
 }
 
-/**
- * Update a secret in Vault.
- * @param {string} vaultPath - The path in Vault where the secret should be updated.
- * @param {Object} secretData - The secret data to be stored (as a JSON object).
- * @returns {Promise<Object>} - The response from Vault as a JSON object.
- */
 export async function updateVaultSecrets(vaultPath, secretData) {
-  if (!vaultPath || !secretData) {
-    console.error('Usage: updateVaultSecret(vaultPath, secretData)');
+  if (!vaultPath || !secretData)
     throw new Error('Both vaultPath and secretData are required.');
-  }
 
-  const vaultToken = process.env.VAULT_TOKEN;
-  const vaultAddr = process.env.VAULT_ADDR;
-
-  if (!vaultToken || !vaultAddr) {
-    console.error('Error: VAULT_TOKEN and VAULT_ADDR must be set.');
+  const token = process.env.VAULT_TOKEN;
+  const addr = process.env.VAULT_ADDR;
+  if (!token || !addr)
     throw new Error('VAULT_TOKEN and VAULT_ADDR must be set.');
+
+  if (process.env.VAULT_SKIP_VERIFY === 'true') {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
   }
 
   try {
-    // Disable SSL verification globally if VAULT_SKIP_VERIFY is set
-    if (process.env.VAULT_SKIP_VERIFY === 'true') {
-      process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
-    }
-
-    // Make the POST request to update the Vault secret
-    const response = await axios.post(
-      `${vaultAddr}/v1/${vaultPath}`,
-      secretData,
-      {
-        headers: {
-          'X-Vault-Token': vaultToken,
-          'Content-Type': 'application/json',
-        },
+    const response = await axios.post(`${addr}/v1/${vaultPath}`, secretData, {
+      headers: {
+        'X-Vault-Token': token,
+        'Content-Type': 'application/json',
       },
-    );
+    });
 
-    // Return the response from Vault
-    console.log(response.data);
     return response.data;
-  } catch (error) {
-    if (error.response) {
-      console.error(
-        `Error: Failed to update secret at ${vaultPath}. Response: ${error.response.status} ${error.response.statusText}`,
-      );
-    } else {
-      console.error(`Error: ${error.message}`);
-    }
-    // throw error;
+  } catch (err) {
+    console.error(
+      'Vault POST error:',
+      err?.message || err?.response?.statusText || err,
+    );
   }
 }

package/src/auth0/vault.test.js

@@ -0,0 +1,134 @@
+// src/auth0/vault.test.js
+import { jest } from '@jest/globals';
+
+// ESM-compatible mocking
+jest.unstable_mockModule('axios', () => ({
+  default: {
+    get: jest.fn(),
+    post: jest.fn(),
+  },
+}));
+
+describe('Vault Utilities', () => {
+  let axios;
+  let getVaultSecrets;
+  let updateVaultSecrets;
+  const OLD_ENV = process.env;
+
+  beforeAll(async () => {
+    // Dynamic import AFTER mocking
+    axios = (await import('axios')).default;
+    const vault = await import('./vault.js');
+    getVaultSecrets = vault.getVaultSecrets;
+    updateVaultSecrets = vault.updateVaultSecrets;
+  });
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = { ...OLD_ENV };
+    jest.clearAllMocks();
+  });
+
+  afterAll(() => {
+    process.env = OLD_ENV;
+  });
+
+  describe('getVaultSecrets', () => {
+    it('should fetch secrets from Vault successfully', async () => {
+      process.env.VAULT_TOKEN = 'test-token';
+      process.env.VAULT_ADDR = 'https://vault.example.com';
+
+      axios.get.mockResolvedValueOnce({
+        data: {
+          data: {
+            data: {
+              username: 'admin',
+              password: 'secret',
+            },
+          },
+        },
+      });
+
+      const result = await getVaultSecrets('secret/data/myapp');
+      expect(result).toEqual({ username: 'admin', password: 'secret' });
+    });
+
+    it('should throw error if vaultPath is missing', async () => {
+      await expect(getVaultSecrets()).rejects.toThrow(
+        'VAULT_PATH is required.',
+      );
+    });
+
+    it('should throw error if env vars are missing', async () => {
+      delete process.env.VAULT_TOKEN;
+      delete process.env.VAULT_ADDR;
+
+      await expect(getVaultSecrets('secret/data/myapp')).rejects.toThrow(
+        'VAULT_TOKEN and VAULT_ADDR must be set.',
+      );
+    });
+
+    it('should handle Vault error response', async () => {
+      process.env.VAULT_TOKEN = 'token';
+      process.env.VAULT_ADDR = 'https://vault.example.com';
+
+      axios.get.mockRejectedValueOnce({
+        response: { status: 403, statusText: 'Forbidden' },
+      });
+
+      const result = await getVaultSecrets('secret/data/myapp');
+      expect(result).toBeUndefined();
+    });
+  });
+
+  describe('updateVaultSecrets', () => {
+    it('should update secrets in Vault successfully', async () => {
+      process.env.VAULT_TOKEN = 'test-token';
+      process.env.VAULT_ADDR = 'https://vault.example.com';
+
+      const secretData = {
+        data: {
+          apiKey: '123456',
+        },
+      };
+
+      axios.post.mockResolvedValueOnce({
+        data: {
+          success: true,
+        },
+      });
+
+      const result = await updateVaultSecrets('secret/data/myapp', secretData);
+      expect(result).toEqual({ success: true });
+    });
+
+    it('should throw error if vaultPath or secretData is missing', async () => {
+      await expect(updateVaultSecrets()).rejects.toThrow(
+        'Both vaultPath and secretData are required.',
+      );
+    });
+
+    it('should throw error if env vars are missing', async () => {
+      delete process.env.VAULT_TOKEN;
+      delete process.env.VAULT_ADDR;
+
+      await expect(updateVaultSecrets('secret/data/myapp', {})).rejects.toThrow(
+        'VAULT_TOKEN and VAULT_ADDR must be set.',
+      );
+    });
+
+    it('should handle Vault error response', async () => {
+      process.env.VAULT_TOKEN = 'token';
+      process.env.VAULT_ADDR = 'https://vault.example.com';
+
+      axios.post.mockRejectedValueOnce({
+        response: { status: 500, statusText: 'Internal Server Error' },
+      });
+
+      const result = await updateVaultSecrets('secret/data/myapp', {
+        data: {},
+      });
+      expect(result).toBeUndefined();
+    });
+  });
+});