@docupace/pipeline 1.0.67 → 1.0.68

package/bitbucket-pipelines.yml

@@ -1,3 +1,4 @@
+# bitbucket-pipelines.yml
 clone:
   depth: 2
 
@@ -6,23 +7,54 @@ pipelines:
     '**':
       - step:
           runs-on:
+            - self.hosted
             - linux.shell
-            - onprem
           name: On Pull Request
           script:
+            - npm install -g pnpm
             - pnpm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
             - pnpm install --frozen-lockfile
-            - >
-              npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color
+            - 'npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color'
+            - pnpm test
+          artifacts:
+            - coverage/**
+          after-script:
+            - echo "Pipeline completed with status $BITBUCKET_EXIT_CODE"
+
   custom:
     scheduled-tests:
       - step:
           runs-on:
+            - self.hosted
             - linux.shell
-            - onprem
-          name: Manual
+          name: Scheduled Tests
           script:
+            - npm install -g pnpm
             - pnpm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
             - pnpm install --frozen-lockfile
-            - >
-              npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color
+            - 'npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color'
+            - pnpm test
+          artifacts:
+            - coverage/**
+          after-script:
+            - echo "Pipeline completed with status $BITBUCKET_EXIT_CODE"
+
+  branches:
+    main:
+      - step:
+          runs-on:
+            - self.hosted
+            - linux.shell
+          name: Main Branch Build
+          script:
+            - npm install -g pnpm
+            - pnpm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
+            - pnpm install --frozen-lockfile
+            - 'npx eslint . --rule "no-unused-vars: warn" --rule "no-useless-escape: warn" --color'
+            - pnpm test
+          artifacts:
+            - coverage/**
+
+definitions:
+  caches:
+    pnpm: ~/.pnpm-store

package/eslint.config.js

@@ -4,17 +4,29 @@ import prettierConfig from 'eslint-config-prettier';
 import prettierPlugin from 'eslint-plugin-prettier';
 import importPlugin from 'eslint-plugin-import';
 
-/** @type {import('eslint').Linter.Config[]} */
 export default [
   {
     languageOptions: {
       globals: {
         ...globals.browser,
-        ...globals.node, // Add Node.js globals
+        ...globals.node,
       },
     },
   },
+
+  // Core JS rules
   pluginJs.configs.recommended,
+
+  // Jest globals for test files only
+  {
+    files: ['**/*.test.js', '**/__tests__/**/*.js'],
+    languageOptions: {
+      globals: {
+        ...globals.jest,
+      },
+    },
+  },
+
   {
     plugins: {
       prettier: prettierPlugin,
@@ -29,7 +41,6 @@ export default [
     rules: {
       ...prettierConfig.rules,
       'prettier/prettier': 'error',
-      // Import-related rules
       'import/no-unresolved': 'error',
       'import/named': 'error',
       'import/no-extraneous-dependencies': 'error',

package/jest.config.js

@@ -0,0 +1,15 @@
+// jest.config.js
+export default {
+  testEnvironment: 'node',
+  transform: {},
+  verbose: true,
+  collectCoverage: true,
+  coverageDirectory: 'coverage',
+  coverageReporters: ['text', 'lcov', 'json', 'html'],
+  collectCoverageFrom: [
+    'src/**/*.{js,ts}',
+    '!src/**/cli.js',
+    '!src/**/*.test.{js,ts}',
+    '!**/node_modules/**',
+  ],
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.67",
+  "version": "1.0.68",
   "main": "index.js",
   "type": "module",
   "bin": {
@@ -18,6 +18,7 @@
     "@changesets/cli": "^2.27.10",
     "@docupace/core-client": "^0.1.94",
     "@docupace/pipeline": "^1.0.33-alpha-2",
+    "@jest/globals": "^30.1.2",
     "auth0-deploy-cli": "^8.8.0",
     "axios": "^1.7.9",
     "commander": "^12.1.0",
@@ -41,9 +42,11 @@
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-prettier": "^5.2.1",
     "globals": "^15.14.0",
+    "jest": "^30.1.3",
     "prettier": "^3.4.2"
   },
   "scripts": {
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage --testPathIgnorePatterns='src/next/test\\.js'",
     "test-deploy-core": "dp-next-cli deploy-core-pipeline dev template",
     "test-deploy-from-site": "dp-next-cli deploy-from-site --from-env dev --to-env dev --from-site financialdev --to-site template --deploy-core true",
     "test-run-pipline": "dp-next-cli run-pipeline -r docupace-next-e2e -b master -p run-tests-qa",

package/src/auth0/alias.js

@@ -1,13 +1,8 @@
 import axios from 'axios';
-
 import { createAlias } from '../next/alias.js';
-
 import { getAuth0AuthToken } from './configure.js';
-
 import { getVaultSecrets } from './vault.js';
-
 import { getVaultSecretsConfigs } from '../next/config.js';
-
 import { cloneEnvRepository, readDeployConfig } from '../next/deploy.js';
 
 export async function getCCAlias({ application, auth0Domain, auth0AuthToken }) {
@@ -35,7 +30,14 @@ export async function getCCAlias({ application, auth0Domain, auth0AuthToken }) {
   }
 }
 
-export async function configureAlias(site, env, username, password, realm) {
+export async function configureAlias(
+  site,
+  env,
+  username,
+  password,
+  realm,
+  auth0Tenant,
+) {
   console.log(`Creating alias for site: ${site} in env: ${env}`);
   // Site Common Secrets
   const siteCommonSecretsPath =
@@ -43,7 +45,12 @@ export async function configureAlias(site, env, username, password, realm) {
   console.log(`siteCommonSecretsPath => ${siteCommonSecretsPath}`);
   const siteCommonSecrets = await getVaultSecrets(siteCommonSecretsPath);
 
-  const auth0Domain = `docupace-${env}-${site}.us.auth0.com`;
+  let auth0Domain;
+  if (auth0Tenant === '') {
+    auth0Domain = `docupace-${env}-${site}.us.auth0.com`;
+  } else {
+    auth0Domain = `${auth0Tenant}.us.auth0.com`;
+  }
   const auth0ClientId = siteCommonSecrets.AUTH0_CLIENT_ID;
   const auth0ClientSecret = siteCommonSecrets.AUTH0_CLIENT_SECRET;
   const auth0Token = await getAuth0AuthToken(

package/src/auth0/alias.test.js

@@ -0,0 +1,172 @@
+// alias.test.js
+import { jest } from '@jest/globals';
+
+// --------- ESM-Compatible Mocks ---------
+jest.unstable_mockModule('axios', () => ({
+  default: {
+    get: jest.fn(),
+  },
+}));
+
+jest.unstable_mockModule('../next/alias.js', () => ({
+  createAlias: jest.fn(),
+}));
+
+jest.unstable_mockModule('./configure.js', () => ({
+  getAuth0AuthToken: jest.fn(),
+}));
+
+jest.unstable_mockModule('./vault.js', () => ({
+  getVaultSecrets: jest.fn(),
+}));
+
+jest.unstable_mockModule('../next/config.js', () => ({
+  getVaultSecretsConfigs: jest.fn(),
+}));
+
+jest.unstable_mockModule('../next/deploy.js', () => ({
+  cloneEnvRepository: jest.fn(),
+  readDeployConfig: jest.fn(),
+}));
+
+// --------- Import AFTER mocks ---------
+const { configureAlias, getCCAlias } = await import('./alias.js');
+const axios = (await import('axios')).default;
+const { createAlias } = await import('../next/alias.js');
+const { getAuth0AuthToken } = await import('./configure.js');
+const { getVaultSecrets } = await import('./vault.js');
+const { getVaultSecretsConfigs } = await import('../next/config.js');
+const { cloneEnvRepository, readDeployConfig } = await import(
+  '../next/deploy.js'
+);
+
+// --------- Shared Test Setup ---------
+beforeAll(() => {
+  jest.spyOn(console, 'log').mockImplementation(() => {}); // silence logs
+});
+
+afterAll(() => {
+  console.log.mockRestore();
+});
+
+describe('configureAlias', () => {
+  const site = 'example';
+  const env = 'dev';
+  const username = 'admin';
+  const password = 'pass';
+  const realm = 'Users';
+  const auth0Tenant = '';
+
+  const mockSecrets = {
+    AUTH0_CLIENT_ID: 'client-id',
+    AUTH0_CLIENT_SECRET: 'client-secret',
+  };
+
+  const mockToken = 'mocked-auth0-token';
+
+  const mockClients = [
+    { name: 'docupace-graphql-client-credentials', client_id: 'client-123' },
+  ];
+
+  const mockConfig = {
+    deployConfig: {
+      graphqlServer: {
+        coreUrl: 'https://core.example.com',
+      },
+    },
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    getVaultSecretsConfigs.mockReturnValue({
+      siteCommonSecretsPath: 'vault/path/to/secrets',
+    });
+
+    getVaultSecrets.mockResolvedValue(mockSecrets);
+    getAuth0AuthToken.mockResolvedValue(mockToken);
+    axios.get.mockResolvedValue({ data: mockClients });
+    cloneEnvRepository.mockResolvedValue(undefined);
+    readDeployConfig.mockResolvedValue(mockConfig);
+    createAlias.mockResolvedValue(undefined);
+  });
+
+  it('should configure alias with default tenant and call all required steps', async () => {
+    await configureAlias(site, env, username, password, realm, auth0Tenant);
+
+    expect(getVaultSecretsConfigs).toHaveBeenCalledWith(site);
+    expect(getVaultSecrets).toHaveBeenCalledWith('vault/path/to/secrets');
+
+    expect(getAuth0AuthToken).toHaveBeenCalledWith(
+      'docupace-dev-example.us.auth0.com',
+      'client-id',
+      'client-secret',
+    );
+
+    expect(cloneEnvRepository).toHaveBeenCalledWith(env);
+
+    expect(readDeployConfig).toHaveBeenCalledWith(
+      'graphql-server',
+      env,
+      site,
+      'values',
+    );
+
+    expect(axios.get).toHaveBeenCalledWith(
+      'https://docupace-dev-example.us.auth0.com/api/v2/clients',
+      { headers: { authorization: `Bearer ${mockToken}` } },
+    );
+
+    expect(createAlias).toHaveBeenCalledWith(
+      'https://core.example.com',
+      username,
+      password,
+      realm,
+      'client-123@clients',
+    );
+  });
+});
+
+describe('getCCAlias', () => {
+  const application = 'docupace-graphql-client-credentials';
+  const auth0Domain = 'example.auth0.com';
+  const auth0AuthToken = 'token';
+
+  it('should return correct alias string for client', async () => {
+    axios.get.mockResolvedValue({
+      data: [{ name: application, client_id: 'abc123' }],
+    });
+
+    const alias = await getCCAlias({
+      application,
+      auth0Domain,
+      auth0AuthToken,
+    });
+    expect(alias).toBe('abc123@clients');
+
+    expect(axios.get).toHaveBeenCalledWith(
+      'https://example.auth0.com/api/v2/clients',
+      { headers: { authorization: 'Bearer token' } },
+    );
+  });
+
+  it('should log error and return undefined if axios fails', async () => {
+    axios.get.mockRejectedValue(new Error('Network error'));
+    const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+
+    const result = await getCCAlias({
+      application,
+      auth0Domain,
+      auth0AuthToken,
+    });
+    expect(result).toBeUndefined();
+
+    expect(errorSpy).toHaveBeenCalledWith(
+      expect.stringContaining(
+        'Failed to form alias name for application: docupace-graphql-client-credentials: Network error',
+      ),
+    );
+
+    errorSpy.mockRestore();
+  });
+});

package/src/auth0/cli.js

@@ -57,24 +57,26 @@ program
   });
 
 program
-  .command('configureAlias <site> <env> <username> <password> <realm>')
+  .command(
+    'configureAlias <site> <env> <username> <password> <realm> [auth0Tenant]',
+  )
   .description('Configure Core Alias for the given site')
-  .action(async (site, env, username, password, realm) => {
-    await configureAlias(site, env, username, password, realm);
+  .action(async (site, env, username, password, realm, auth0Tenant = '') => {
+    await configureAlias(site, env, username, password, realm, auth0Tenant);
   });
 
 program
-  .command('exportConf <site> <env>')
+  .command('exportConf <site> <env> [auth0Tenant]')
   .description('Export Auth0 configuration for the given site')
-  .action(async (site, env) => {
-    await exportConf(site, env);
+  .action(async (site, env, auth0Tenant = '') => {
+    await exportConf(site, env, auth0Tenant);
   });
 
 program
-  .command('getAuth0Metadata <site> <env>')
+  .command('getAuth0Metadata <site> <env> [auth0Tenant]')
   .description('Get Auth0 metadata for the given site')
-  .action(async (site, env) => {
-    await getAuth0Metadata(site, env);
+  .action(async (site, env, auth0Tenant = '') => {
+    await getAuth0Metadata(site, env, auth0Tenant);
   });
 
 program.parse(process.argv);

package/src/auth0/configure.js

@@ -1,7 +1,7 @@
 import fs from 'fs-extra';
 import path from 'path';
 import axios from 'axios';
-import crypto from 'crypto';
+import * as crypto from 'crypto';
 
 import {
   cloneEnvRepository,
@@ -11,6 +11,7 @@ import {
 } from '../next/deploy.js';
 
 import { getVaultSecrets, updateVaultSecrets } from './vault.js';
+
 import {
   coreSiteEnvMap,
   environmentConfig,

package/src/auth0/configure.test.js

@@ -0,0 +1,167 @@
+// @jest-environment node
+import { jest } from '@jest/globals';
+
+// ─── Mock All Required Modules ───────────────────────────────────────────────
+
+jest.unstable_mockModule('fs-extra', () => ({
+  default: {
+    promises: {
+      mkdir: jest.fn(),
+    },
+    writeFile: jest.fn(),
+    ensureDir: jest.fn(),
+  },
+  writeFile: jest.fn(),
+  ensureDir: jest.fn(),
+}));
+
+jest.unstable_mockModule('axios', () => ({
+  default: {
+    post: jest.fn(),
+    get: jest.fn(),
+  },
+}));
+
+jest.unstable_mockModule('crypto', () => ({
+  randomBytes: () => ({
+    toString: () => 'mockBase64==',
+  }),
+}));
+
+jest.unstable_mockModule('../next/deploy.js', () => ({
+  cloneRepository: jest.fn(),
+  cloneEnvRepository: jest.fn(),
+  pushDeployConfig: jest.fn(),
+  readDeployConfig: jest.fn(),
+}));
+
+jest.unstable_mockModule('./vault.js', () => ({
+  getVaultSecrets: jest.fn(),
+  updateVaultSecrets: jest.fn(),
+}));
+
+jest.unstable_mockModule('../next/config.js', () => ({
+  coreSiteEnvMap: { dev: 'dev-env' },
+  environmentConfig: {
+    dev: {
+      newUrl: (site) => `dev.${site}.com`,
+      oldUrl: (site) => `legacy.${site}.com`,
+      ccUrl: (site) => `cc.${site}.com`,
+      docupaceHost: () => 'docupace.com',
+    },
+  },
+  getVaultSecretsConfigs: jest.fn(),
+}));
+
+// ─── Global References ───────────────────────────────────────────────────────
+
+let fs, axios, deploy, vault, config;
+let getAuth0AuthToken, cleanAndWritePropertiesFile, updateCoreSiteConfig;
+
+const originalProcessExit = process.exit;
+
+beforeAll(async () => {
+  // Mock process.exit to prevent killing the test runner
+  process.exit = jest.fn();
+
+  // Suppress noisy error output
+  jest.spyOn(console, 'error').mockImplementation(() => {});
+  jest.spyOn(console, 'log').mockImplementation(() => {});
+
+  // Import after mocks
+  ({ default: fs } = await import('fs-extra'));
+  ({ default: axios } = await import('axios'));
+  deploy = await import('../next/deploy.js');
+  vault = await import('./vault.js');
+  config = await import('../next/config.js');
+
+  const mod = await import('./configure.js');
+  ({ getAuth0AuthToken, cleanAndWritePropertiesFile, updateCoreSiteConfig } =
+    mod);
+});
+
+afterAll(() => {
+  // Restore
+  process.exit = originalProcessExit;
+  console.error.mockRestore();
+  console.log.mockRestore();
+});
+
+// ─── Tests ───────────────────────────────────────────────────────────────────
+
+describe('Deployment Automation Module (ESM)', () => {
+  describe('getAuth0AuthToken', () => {
+    it('should return access token on success', async () => {
+      axios.post.mockResolvedValue({ data: { access_token: 'mock-token' } });
+      const token = await getAuth0AuthToken('auth.domain', 'cid', 'secret');
+      expect(token).toBe('mock-token');
+    });
+
+    it('should return undefined on failure', async () => {
+      axios.post.mockRejectedValue({ message: 'fail' });
+      const token = await getAuth0AuthToken('auth.domain', 'cid', 'secret');
+      expect(token).toBeUndefined();
+      expect(console.error).toHaveBeenCalledWith(
+        'Error fetching Auth0 token:',
+        'fail',
+      );
+    });
+  });
+
+  describe('cleanAndWritePropertiesFile', () => {
+    it('writes cleaned file content', async () => {
+      fs.writeFile.mockResolvedValue();
+      await cleanAndWritePropertiesFile('/tmp/test.properties', 'a=1\n\nb=2\n');
+      expect(fs.writeFile).toHaveBeenCalledWith(
+        '/tmp/test.properties',
+        'a=1\nb=2',
+        'utf8',
+      );
+    });
+
+    it('calls process.exit on write error', async () => {
+      fs.writeFile.mockRejectedValue(new Error('disk full'));
+      await cleanAndWritePropertiesFile('/bad/path', 'x=y');
+      expect(process.exit).toHaveBeenCalledWith(1);
+    });
+  });
+
+  describe('updateCoreSiteConfig', () => {
+    it('updates config when S3 is enabled', async () => {
+      config.getVaultSecretsConfigs.mockReturnValue({
+        awsSecretsPath: 'aws/path',
+      });
+
+      deploy.cloneRepository.mockResolvedValue('/repo/path');
+
+      vault.getVaultSecrets.mockResolvedValue({
+        AWS_ACCESS_KEY_ID: 'abc',
+        AWS_SECRET_ACCESS_KEY: 'def',
+        AWS_REGION: 'us-west-2',
+      });
+
+      fs.ensureDir.mockResolvedValue();
+      fs.writeFile.mockResolvedValue();
+      deploy.pushDeployConfig.mockResolvedValue();
+
+      await updateCoreSiteConfig('mysite', 'dev', true, false);
+
+      expect(fs.ensureDir).toHaveBeenCalledWith('/repo/path/MYSITE');
+      expect(fs.writeFile).toHaveBeenCalled();
+      expect(deploy.pushDeployConfig).toHaveBeenCalled();
+    });
+
+    it('calls process.exit if cloneRepository fails', async () => {
+      config.getVaultSecretsConfigs.mockReturnValue({
+        awsSecretsPath: 'aws/path',
+      });
+
+      deploy.cloneRepository.mockRejectedValue(new Error('bad clone'));
+
+      await updateCoreSiteConfig('mysite', 'dev', true, false);
+
+      expect(process.exit).toHaveBeenCalledWith(1);
+      expect(console.error).toHaveBeenCalledWith('Error:', 'bad clone');
+    });
+  });
+});

package/src/auth0/export.js

@@ -2,7 +2,7 @@ import { getVaultSecrets } from './vault.js';
 import { getVaultSecretsConfigs } from '../next/config.js';
 import { dump } from 'auth0-deploy-cli';
 
-export async function exportConf(site, env) {
+export async function exportConf(site, env, auth0Tenant) {
   try {
     console.log(
       `Exporting Auth0 configuration for site: ${site} and env: ${env}`,
@@ -13,7 +13,12 @@ export async function exportConf(site, env) {
     console.log(`siteCommonSecretsPath => ${siteCommonSecretsPath}`);
     const siteCommonSecrets = await getVaultSecrets(siteCommonSecretsPath);
 
-    const auth0Domain = `docupace-${env}-${site}.us.auth0.com`;
+    let auth0Domain;
+    if (auth0Tenant === '') {
+      auth0Domain = `docupace-${env}-${site}.us.auth0.com`;
+    } else {
+      auth0Domain = `${auth0Tenant}.us.auth0.com`;
+    }
     const auth0ClientId = siteCommonSecrets.AUTH0_CLIENT_ID;
     const auth0ClientSecret = siteCommonSecrets.AUTH0_CLIENT_SECRET;
 

package/src/auth0/export.test.js

@@ -0,0 +1,103 @@
+// exportConf.test.js
+import { jest } from '@jest/globals';
+
+// Mock modules using ESM-safe methods
+jest.unstable_mockModule('./vault.js', () => ({
+  getVaultSecrets: jest.fn(),
+}));
+
+jest.unstable_mockModule('../next/config.js', () => ({
+  getVaultSecretsConfigs: jest.fn(),
+}));
+
+jest.unstable_mockModule('auth0-deploy-cli', () => ({
+  dump: jest.fn(),
+}));
+
+// Import the actual function and mocked dependencies after mocks are in place
+const { exportConf } = await import('./export.js');
+const { getVaultSecrets } = await import('./vault.js');
+const { getVaultSecretsConfigs } = await import('../next/config.js');
+const { dump } = await import('auth0-deploy-cli');
+
+describe('exportConf', () => {
+  const site = 'example';
+  const env = 'dev';
+  const auth0Tenant = '';
+
+  const mockSecrets = {
+    AUTH0_CLIENT_ID: 'test-client-id',
+    AUTH0_CLIENT_SECRET: 'test-client-secret',
+  };
+
+  const mockPath = 'vault/path/to/secrets';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    getVaultSecretsConfigs.mockReturnValue({
+      siteCommonSecretsPath: mockPath,
+    });
+
+    getVaultSecrets.mockResolvedValue(mockSecrets);
+
+    dump.mockResolvedValue(undefined);
+  });
+
+  it('should export Auth0 configuration with default tenant format', async () => {
+    const logSpy = jest.spyOn(console, 'log').mockImplementation(() => {});
+    await exportConf(site, env, auth0Tenant);
+
+    expect(getVaultSecretsConfigs).toHaveBeenCalledWith(site);
+    expect(getVaultSecrets).toHaveBeenCalledWith(mockPath);
+    expect(dump).toHaveBeenCalledWith(
+      expect.objectContaining({
+        config: {
+          AUTH0_DOMAIN: 'docupace-dev-example.us.auth0.com',
+          AUTH0_CLIENT_ID: 'test-client-id',
+          AUTH0_CLIENT_SECRET: 'test-client-secret',
+        },
+      }),
+    );
+
+    logSpy.mockRestore();
+  });
+
+  it('should export Auth0 configuration with custom tenant', async () => {
+    const customTenant = 'custom-tenant';
+    await exportConf(site, env, customTenant);
+
+    expect(dump).toHaveBeenCalledWith(
+      expect.objectContaining({
+        config: {
+          AUTH0_DOMAIN: 'custom-tenant.us.auth0.com',
+          AUTH0_CLIENT_ID: 'test-client-id',
+          AUTH0_CLIENT_SECRET: 'test-client-secret',
+        },
+      }),
+    );
+  });
+
+  it('should log error and exit process on failure', async () => {
+    getVaultSecrets.mockRejectedValue(new Error('Vault error'));
+
+    const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => {
+      throw new Error('process.exit');
+    });
+
+    await expect(exportConf(site, env, auth0Tenant)).rejects.toThrow(
+      'process.exit',
+    );
+
+    expect(errorSpy).toHaveBeenCalledWith(
+      expect.stringContaining(
+        'Error during Auth0 example configuration export:',
+      ),
+      'Vault error',
+    );
+
+    errorSpy.mockRestore();
+    exitSpy.mockRestore();
+  });
+});

package/src/auth0/metadata.js

@@ -1,16 +1,15 @@
 import fs from 'fs-extra';
 import axios from 'axios';
-import path from 'path';
+import * as path from 'node:path'; // ESM-compatible import
 import { cloneRepository, pushDeployConfig } from '../next/deploy.js';
 import { getAuth0AuthToken } from './configure.js';
 import { getVaultSecrets } from './vault.js';
 import { getVaultSecretsConfigs } from '../next/config.js';
 
-export async function getAuth0Metadata(site, env) {
+export async function getAuth0Metadata(site, env, auth0Tenant) {
   try {
     const connectDeployRepoPath = await cloneRepository('connect-deploy');
 
-    // mapping of env to env
     const envMap = {
       dev: 'dev',
       preprod: 'qa',
@@ -18,14 +17,15 @@ export async function getAuth0Metadata(site, env) {
       uat: 'uat',
       'prod-www3': 'prod',
     };
+
     process.chdir(`${connectDeployRepoPath}/envs/${env}/${site}`);
 
     const configPath = path.join('conf', 'application.conf');
     const appConf = await fs.readFile(configPath, 'utf-8');
+
     const connectContext = appConf.match(
       /application\.context\s*=\s*"(.*?)"/,
     )?.[1];
-
     if (!connectContext) {
       console.error('connectContext not found in application.conf. Exiting...');
       process.exit(1);
@@ -34,7 +34,6 @@ export async function getAuth0Metadata(site, env) {
     const siteHost = appConf.match(
       /docupace\.baseUrlClient\s*=\s*"?https?:\/\/([^/]+)"?/,
     )?.[1];
-
     if (!siteHost) {
       console.error('siteHost not found in application.conf. Exiting...');
       process.exit(1);
@@ -47,10 +46,17 @@ export async function getAuth0Metadata(site, env) {
     const siteCommonSecretsPath =
       getVaultSecretsConfigs(site).siteCommonSecretsPath;
     console.log(`siteCommonSecretsPath => ${siteCommonSecretsPath}`);
+
     const siteCommonSecrets = await getVaultSecrets(siteCommonSecretsPath);
-    const auth0Domain = `docupace-${envMap[env]}-${site}.us.auth0.com`;
+
+    const auth0Domain =
+      auth0Tenant === ''
+        ? `docupace-${envMap[env]}-${site}.us.auth0.com`
+        : `${auth0Tenant}.us.auth0.com`;
+
     const auth0ClientId = siteCommonSecrets.AUTH0_CLIENT_ID;
     const auth0ClientSecret = siteCommonSecrets.AUTH0_CLIENT_SECRET;
+
     const auth0Token = await getAuth0AuthToken(
       auth0Domain,
       auth0ClientId,
@@ -78,9 +84,7 @@ export async function getAuth0Metadata(site, env) {
 
     const metadataRes = await axios.get(
       `https://${auth0Domain}/samlp/metadata/${clientId}`,
-      {
-        responseType: 'text',
-      },
+      { responseType: 'text' },
     );
 
     const metadata = metadataRes.data;
@@ -91,6 +95,7 @@ export async function getAuth0Metadata(site, env) {
       );
       process.exit(1);
     }
+
     await fs.ensureDir('conf/saml');
     await fs.writeFile('conf/saml/auth0.xml', metadata);
     console.log('SAML metadata written to conf/saml/auth0.xml');
@@ -121,6 +126,7 @@ export async function getAuth0Metadata(site, env) {
 
     await fs.writeFile(configPath, newConfig);
     console.log('The application.conf has been updated.');
+
     await pushDeployConfig(
       connectDeployRepoPath,
       `Auth0 SAML metadata update for site: (${site}) in env: (${env})`,

package/src/auth0/metadata.test.js

@@ -0,0 +1,186 @@
+import { jest } from '@jest/globals';
+
+// ----- Mocks (ESM-safe) -----
+jest.unstable_mockModule('fs-extra', () => ({
+  default: {
+    readFile: jest.fn(),
+    writeFile: jest.fn(),
+    ensureDir: jest.fn(),
+  },
+}));
+
+jest.unstable_mockModule('axios', () => ({
+  default: {
+    get: jest.fn(),
+  },
+}));
+
+jest.unstable_mockModule('path', () => ({
+  join: jest.fn((...args) => args.join('/')),
+}));
+
+jest.unstable_mockModule('../next/deploy.js', () => ({
+  cloneRepository: jest.fn(),
+  pushDeployConfig: jest.fn(),
+}));
+
+jest.unstable_mockModule('./configure.js', () => ({
+  getAuth0AuthToken: jest.fn(),
+}));
+
+jest.unstable_mockModule('./vault.js', () => ({
+  getVaultSecrets: jest.fn(),
+}));
+
+jest.unstable_mockModule('../next/config.js', () => ({
+  getVaultSecretsConfigs: jest.fn(),
+}));
+
+// ----- Imports AFTER mocks -----
+const { getAuth0Metadata } = await import('./metadata.js');
+const fs = (await import('fs-extra')).default;
+const axios = (await import('axios')).default;
+const { cloneRepository, pushDeployConfig } = await import('../next/deploy.js');
+const { getAuth0AuthToken } = await import('./configure.js');
+const { getVaultSecrets } = await import('./vault.js');
+const { getVaultSecretsConfigs } = await import('../next/config.js');
+
+// ----- Shared Setup -----
+beforeAll(() => {
+  jest.spyOn(console, 'log').mockImplementation(() => {});
+  jest.spyOn(console, 'error').mockImplementation(() => {});
+});
+
+afterAll(() => {
+  console.log.mockRestore();
+  console.error.mockRestore();
+});
+
+describe('getAuth0Metadata', () => {
+  const site = 'example';
+  const env = 'dev';
+  const auth0Tenant = '';
+  const fakeRepoPath = '/tmp/repo';
+  const fakeAppConf = `
+    application.context = "/connect"
+    docupace.baseUrlClient = "https://example.docupace.com"
+  `;
+
+  const mockSecrets = {
+    AUTH0_CLIENT_ID: 'client-id',
+    AUTH0_CLIENT_SECRET: 'client-secret',
+  };
+
+  const auth0Token = 'fake-token';
+  const clientId = 'abc123';
+  const fakeMetadata = '<xml>'.padEnd(2500, 'a') + '</xml>';
+
+  let originalChdir;
+  let exitSpy;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    axios.get.mockReset();
+
+    cloneRepository.mockResolvedValue(fakeRepoPath);
+    getVaultSecretsConfigs.mockReturnValue({
+      siteCommonSecretsPath: 'vault/path',
+    });
+    getVaultSecrets.mockResolvedValue(mockSecrets);
+    getAuth0AuthToken.mockResolvedValue(auth0Token);
+    fs.readFile.mockResolvedValue(fakeAppConf);
+    fs.writeFile.mockResolvedValue();
+    fs.ensureDir.mockResolvedValue();
+    pushDeployConfig.mockResolvedValue();
+
+    originalChdir = process.chdir;
+    process.chdir = jest.fn();
+
+    exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    process.chdir = originalChdir;
+    exitSpy.mockRestore();
+  });
+
+  it('should download and write metadata, update config, and push changes', async () => {
+    axios.get
+      .mockResolvedValueOnce({
+        data: [{ name: 'docupace-connect', client_id: clientId }],
+      }) // clients
+      .mockResolvedValueOnce({ data: fakeMetadata }); // metadata
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(cloneRepository).toHaveBeenCalledWith('connect-deploy');
+    expect(fs.readFile).toHaveBeenCalledWith('conf/application.conf', 'utf-8');
+    expect(fs.ensureDir).toHaveBeenCalledWith('conf/saml');
+    expect(fs.writeFile).toHaveBeenCalledWith(
+      'conf/saml/auth0.xml',
+      expect.stringContaining('<xml'),
+    );
+    expect(fs.writeFile).toHaveBeenCalledWith(
+      'conf/application.conf',
+      expect.stringContaining('useSAML=true'),
+    );
+    expect(pushDeployConfig).toHaveBeenCalled();
+  });
+
+  it('should exit if docupace-connect client is not found', async () => {
+    axios.get.mockResolvedValueOnce({ data: [] }); // empty clients
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith(
+      'Client "docupace-connect" not found.',
+    );
+  });
+
+  it('should exit if metadata is too small', async () => {
+    axios.get
+      .mockResolvedValueOnce({
+        data: [{ name: 'docupace-connect', client_id: clientId }],
+      }) // clients
+      .mockResolvedValueOnce({ data: '<small>' }); // small metadata
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith(
+      'Downloaded metadata looks incorrect (too small). Exiting...',
+    );
+  });
+
+  it('should exit if connectContext is missing', async () => {
+    fs.readFile.mockResolvedValue(`docupace.baseUrlClient = "https://abc.com"`); // no context
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith(
+      'connectContext not found in application.conf. Exiting...',
+    );
+  });
+
+  it('should exit if siteHost is missing', async () => {
+    fs.readFile.mockResolvedValue(`application.context = "/abc"`); // no host
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith(
+      'siteHost not found in application.conf. Exiting...',
+    );
+  });
+
+  it('should exit on unknown error', async () => {
+    getVaultSecrets.mockRejectedValue(new Error('boom'));
+
+    await getAuth0Metadata(site, env, auth0Tenant);
+
+    expect(process.exit).toHaveBeenCalledWith(1);
+    expect(console.error).toHaveBeenCalledWith('Error:', 'boom');
+  });
+});

package/src/auth0/vault.js

@@ -1,107 +1,60 @@
+// src/auth0/vault.js
 import axios from 'axios';
 
-/**
- * Fetch secrets from Vault.
- * @param {string} vaultPath - The path in Vault to fetch secrets from.
- * @returns {Promise<Object>} - The secret data as a JSON object.
- */
 export async function getVaultSecrets(vaultPath) {
-  if (!vaultPath) {
-    console.error('Error: VAULT_PATH is required.');
-    throw new Error('VAULT_PATH is required.');
-  }
-
-  const vaultToken = process.env.VAULT_TOKEN;
-  const vaultAddr = process.env.VAULT_ADDR;
+  if (!vaultPath) throw new Error('VAULT_PATH is required.');
 
-  if (!vaultToken || !vaultAddr) {
-    console.error('Error: VAULT_TOKEN and VAULT_ADDR must be set.');
+  const token = process.env.VAULT_TOKEN;
+  const addr = process.env.VAULT_ADDR;
+  if (!token || !addr)
     throw new Error('VAULT_TOKEN and VAULT_ADDR must be set.');
+
+  if (process.env.VAULT_SKIP_VERIFY === 'true') {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
   }
 
   try {
-    // Disable SSL verification globally by setting environment variable
-    if (process.env.VAULT_SKIP_VERIFY === 'true') {
-      process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
-    }
-
-    // Fetch the secret from Vault
-    const response = await axios.get(`${vaultAddr}/v1/${vaultPath}`, {
-      headers: {
-        'X-Vault-Token': vaultToken,
-      },
+    const response = await axios.get(`${addr}/v1/${vaultPath}`, {
+      headers: { 'X-Vault-Token': token },
     });
 
-    // Validate the response contains JSON data
     const data = response.data;
-    if (data && typeof data === 'object') {
-      // console.log(`Secrets fetched successfully from Vault at ${JSON.stringify(data.data.data)})`);
-      return data.data.data;
-    } else {
-      console.error('Error: Invalid JSON received from Vault.');
-      throw new Error('Invalid JSON received from Vault.');
-    }
-  } catch (error) {
-    if (error.response) {
-      console.error(
-        `Error: Failed to connect to Vault server at ${vaultAddr}. Response: ${error.response.status} ${error.response.statusText}`,
-      );
-    } else {
-      console.error(`Error: ${error.message}`);
-    }
-    // throw error;
+    if (data && typeof data === 'object') return data.data.data;
+    throw new Error('Invalid JSON received from Vault.');
+  } catch (err) {
+    console.error(
+      'Vault GET error:',
+      err?.message || err?.response?.statusText || err,
+    );
   }
 }
 
-/**
- * Update a secret in Vault.
- * @param {string} vaultPath - The path in Vault where the secret should be updated.
- * @param {Object} secretData - The secret data to be stored (as a JSON object).
- * @returns {Promise<Object>} - The response from Vault as a JSON object.
- */
 export async function updateVaultSecrets(vaultPath, secretData) {
-  if (!vaultPath || !secretData) {
-    console.error('Usage: updateVaultSecret(vaultPath, secretData)');
+  if (!vaultPath || !secretData)
     throw new Error('Both vaultPath and secretData are required.');
-  }
 
-  const vaultToken = process.env.VAULT_TOKEN;
-  const vaultAddr = process.env.VAULT_ADDR;
-
-  if (!vaultToken || !vaultAddr) {
-    console.error('Error: VAULT_TOKEN and VAULT_ADDR must be set.');
+  const token = process.env.VAULT_TOKEN;
+  const addr = process.env.VAULT_ADDR;
+  if (!token || !addr)
     throw new Error('VAULT_TOKEN and VAULT_ADDR must be set.');
+
+  if (process.env.VAULT_SKIP_VERIFY === 'true') {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
   }
 
   try {
-    // Disable SSL verification globally if VAULT_SKIP_VERIFY is set
-    if (process.env.VAULT_SKIP_VERIFY === 'true') {
-      process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
-    }
-
-    // Make the POST request to update the Vault secret
-    const response = await axios.post(
-      `${vaultAddr}/v1/${vaultPath}`,
-      secretData,
-      {
-        headers: {
-          'X-Vault-Token': vaultToken,
-          'Content-Type': 'application/json',
-        },
+    const response = await axios.post(`${addr}/v1/${vaultPath}`, secretData, {
+      headers: {
+        'X-Vault-Token': token,
+        'Content-Type': 'application/json',
       },
-    );
+    });
 
-    // Return the response from Vault
-    console.log(response.data);
     return response.data;
-  } catch (error) {
-    if (error.response) {
-      console.error(
-        `Error: Failed to update secret at ${vaultPath}. Response: ${error.response.status} ${error.response.statusText}`,
-      );
-    } else {
-      console.error(`Error: ${error.message}`);
-    }
-    // throw error;
+  } catch (err) {
+    console.error(
+      'Vault POST error:',
+      err?.message || err?.response?.statusText || err,
+    );
   }
 }

package/src/auth0/vault.test.js

@@ -0,0 +1,134 @@
+// src/auth0/vault.test.js
+import { jest } from '@jest/globals';
+
+// ESM-compatible mocking
+jest.unstable_mockModule('axios', () => ({
+  default: {
+    get: jest.fn(),
+    post: jest.fn(),
+  },
+}));
+
+describe('Vault Utilities', () => {
+  let axios;
+  let getVaultSecrets;
+  let updateVaultSecrets;
+  const OLD_ENV = process.env;
+
+  beforeAll(async () => {
+    // Dynamic import AFTER mocking
+    axios = (await import('axios')).default;
+    const vault = await import('./vault.js');
+    getVaultSecrets = vault.getVaultSecrets;
+    updateVaultSecrets = vault.updateVaultSecrets;
+  });
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = { ...OLD_ENV };
+    jest.clearAllMocks();
+  });
+
+  afterAll(() => {
+    process.env = OLD_ENV;
+  });
+
+  describe('getVaultSecrets', () => {
+    it('should fetch secrets from Vault successfully', async () => {
+      process.env.VAULT_TOKEN = 'test-token';
+      process.env.VAULT_ADDR = 'https://vault.example.com';
+
+      axios.get.mockResolvedValueOnce({
+        data: {
+          data: {
+            data: {
+              username: 'admin',
+              password: 'secret',
+            },
+          },
+        },
+      });
+
+      const result = await getVaultSecrets('secret/data/myapp');
+      expect(result).toEqual({ username: 'admin', password: 'secret' });
+    });
+
+    it('should throw error if vaultPath is missing', async () => {
+      await expect(getVaultSecrets()).rejects.toThrow(
+        'VAULT_PATH is required.',
+      );
+    });
+
+    it('should throw error if env vars are missing', async () => {
+      delete process.env.VAULT_TOKEN;
+      delete process.env.VAULT_ADDR;
+
+      await expect(getVaultSecrets('secret/data/myapp')).rejects.toThrow(
+        'VAULT_TOKEN and VAULT_ADDR must be set.',
+      );
+    });
+
+    it('should handle Vault error response', async () => {
+      process.env.VAULT_TOKEN = 'token';
+      process.env.VAULT_ADDR = 'https://vault.example.com';
+
+      axios.get.mockRejectedValueOnce({
+        response: { status: 403, statusText: 'Forbidden' },
+      });
+
+      const result = await getVaultSecrets('secret/data/myapp');
+      expect(result).toBeUndefined();
+    });
+  });
+
+  describe('updateVaultSecrets', () => {
+    it('should update secrets in Vault successfully', async () => {
+      process.env.VAULT_TOKEN = 'test-token';
+      process.env.VAULT_ADDR = 'https://vault.example.com';
+
+      const secretData = {
+        data: {
+          apiKey: '123456',
+        },
+      };
+
+      axios.post.mockResolvedValueOnce({
+        data: {
+          success: true,
+        },
+      });
+
+      const result = await updateVaultSecrets('secret/data/myapp', secretData);
+      expect(result).toEqual({ success: true });
+    });
+
+    it('should throw error if vaultPath or secretData is missing', async () => {
+      await expect(updateVaultSecrets()).rejects.toThrow(
+        'Both vaultPath and secretData are required.',
+      );
+    });
+
+    it('should throw error if env vars are missing', async () => {
+      delete process.env.VAULT_TOKEN;
+      delete process.env.VAULT_ADDR;
+
+      await expect(updateVaultSecrets('secret/data/myapp', {})).rejects.toThrow(
+        'VAULT_TOKEN and VAULT_ADDR must be set.',
+      );
+    });
+
+    it('should handle Vault error response', async () => {
+      process.env.VAULT_TOKEN = 'token';
+      process.env.VAULT_ADDR = 'https://vault.example.com';
+
+      axios.post.mockRejectedValueOnce({
+        response: { status: 500, statusText: 'Internal Server Error' },
+      });
+
+      const result = await updateVaultSecrets('secret/data/myapp', {
+        data: {},
+      });
+      expect(result).toBeUndefined();
+    });
+  });
+});