@etcsec-com/etc-collector 1.4.0

package/tests/unit/providers/azure/azure-retry.test.ts

@@ -0,0 +1,254 @@
+/**
+ * Azure Retry Logic Unit Tests
+ *
+ * Tests for retry logic with exponential backoff and rate limit handling.
+ */
+
+import {
+  retryWithBackoff,
+  calculateDelay,
+  AZURE_RETRY_CONFIGS,
+  RetryOptions,
+} from '../../../../src/providers/azure/azure-retry';
+import {
+  AzureRateLimitError,
+  AzureTimeoutError,
+  AzureAuthenticationError,
+} from '../../../../src/providers/azure/azure-errors';
+
+describe('Azure Retry Logic', () => {
+  describe('calculateDelay', () => {
+    const options: Required<RetryOptions> = {
+      maxAttempts: 3,
+      initialDelay: 1000,
+      maxDelay: 30000,
+      backoffMultiplier: 2,
+      jitterPercent: 0, // No jitter for predictable testing
+      onRetry: () => {},
+    };
+
+    it('should calculate exponential backoff delays', () => {
+      const delay0 = calculateDelay(0, options);
+      const delay1 = calculateDelay(1, options);
+      const delay2 = calculateDelay(2, options);
+
+      expect(delay0).toBe(1000); // 1000 * 2^0 = 1000
+      expect(delay1).toBe(2000); // 1000 * 2^1 = 2000
+      expect(delay2).toBe(4000); // 1000 * 2^2 = 4000
+    });
+
+    it('should cap delay at maxDelay', () => {
+      const delay5 = calculateDelay(5, options); // 1000 * 2^5 = 32000
+      expect(delay5).toBe(30000); // Capped at maxDelay
+    });
+
+    it('should add jitter when enabled', () => {
+      const optionsWithJitter: Required<RetryOptions> = {
+        ...options,
+        jitterPercent: 10, // 10% jitter
+      };
+
+      const delays = Array.from({ length: 10 }, () => calculateDelay(0, optionsWithJitter));
+
+      // All delays should be different (with high probability)
+      const uniqueDelays = new Set(delays);
+      expect(uniqueDelays.size).toBeGreaterThan(1);
+
+      // All delays should be within range [1000, 1100]
+      delays.forEach((delay) => {
+        expect(delay).toBeGreaterThanOrEqual(1000);
+        expect(delay).toBeLessThanOrEqual(1100);
+      });
+    });
+  });
+
+  describe('retryWithBackoff', () => {
+    it('should succeed on first attempt', async () => {
+      const operation = jest.fn().mockResolvedValue('success');
+
+      const result = await retryWithBackoff(operation);
+
+      expect(result).toBe('success');
+      expect(operation).toHaveBeenCalledTimes(1);
+    });
+
+    it('should retry on retryable error and eventually succeed', async () => {
+      const operation = jest
+        .fn()
+        .mockRejectedValueOnce(new AzureTimeoutError('Timeout', 'GET /users', 30000))
+        .mockResolvedValue('success');
+
+      const result = await retryWithBackoff(operation, {
+        maxAttempts: 3,
+        initialDelay: 10,
+        maxDelay: 100,
+      });
+
+      expect(result).toBe('success');
+      expect(operation).toHaveBeenCalledTimes(2);
+    });
+
+    it('should throw error if all retries fail', async () => {
+      const error = new AzureTimeoutError('Timeout', 'GET /users', 30000);
+      const operation = jest.fn().mockRejectedValue(error);
+
+      await expect(
+        retryWithBackoff(operation, {
+          maxAttempts: 3,
+          initialDelay: 10,
+          maxDelay: 100,
+        })
+      ).rejects.toThrow(error);
+
+      expect(operation).toHaveBeenCalledTimes(3);
+    });
+
+    it('should NOT retry non-retryable errors', async () => {
+      const error = new AzureAuthenticationError('Auth failed', 'tenant', 'client');
+      const operation = jest.fn().mockRejectedValue(error);
+
+      await expect(
+        retryWithBackoff(operation, {
+          maxAttempts: 3,
+          initialDelay: 10,
+        })
+      ).rejects.toThrow(error);
+
+      expect(operation).toHaveBeenCalledTimes(1); // Should not retry
+    });
+
+    it('should use retry-after for rate limit errors', async () => {
+      const rateLimitError = new AzureRateLimitError('Rate limited', '/users', 2); // 2 seconds
+      const operation = jest
+        .fn()
+        .mockRejectedValueOnce(rateLimitError)
+        .mockResolvedValue('success');
+
+      const startTime = Date.now();
+      const result = await retryWithBackoff(operation, {
+        maxAttempts: 3,
+        initialDelay: 10,
+        maxDelay: 5000,
+      });
+      const elapsed = Date.now() - startTime;
+
+      expect(result).toBe('success');
+      expect(operation).toHaveBeenCalledTimes(2);
+      // Should have waited ~2 seconds (retry-after value)
+      expect(elapsed).toBeGreaterThanOrEqual(1900);
+      expect(elapsed).toBeLessThan(3000);
+    });
+
+    it('should call onRetry callback', async () => {
+      const onRetry = jest.fn();
+      const error = new AzureTimeoutError('Timeout', 'GET /users', 30000);
+      const operation = jest
+        .fn()
+        .mockRejectedValueOnce(error)
+        .mockResolvedValue('success');
+
+      await retryWithBackoff(operation, {
+        maxAttempts: 3,
+        initialDelay: 10,
+        maxDelay: 100,
+        onRetry,
+      });
+
+      expect(onRetry).toHaveBeenCalledTimes(1);
+      expect(onRetry).toHaveBeenCalledWith(error, 0, expect.any(Number));
+    });
+
+    it('should handle multiple retries with exponential backoff', async () => {
+      const delays: number[] = [];
+      const onRetry = jest.fn((_error, _attempt, delay) => {
+        delays.push(delay);
+      });
+
+      const operation = jest
+        .fn()
+        .mockRejectedValueOnce(new AzureTimeoutError('Timeout 1', 'GET /users', 30000))
+        .mockRejectedValueOnce(new AzureTimeoutError('Timeout 2', 'GET /users', 30000))
+        .mockResolvedValue('success');
+
+      await retryWithBackoff(operation, {
+        maxAttempts: 3,
+        initialDelay: 100,
+        maxDelay: 1000,
+        backoffMultiplier: 2,
+        jitterPercent: 0,
+        onRetry,
+      });
+
+      expect(delays.length).toBe(2);
+      expect(delays[0]).toBe(100); // 100 * 2^0 = 100
+      expect(delays[1]).toBe(200); // 100 * 2^1 = 200
+    });
+
+    it('should respect maxDelay cap', async () => {
+      const delays: number[] = [];
+      const onRetry = jest.fn((_error, _attempt, delay) => {
+        delays.push(delay);
+      });
+
+      const operation = jest
+        .fn()
+        .mockRejectedValueOnce(new AzureTimeoutError('Timeout 1', 'GET /users', 30000))
+        .mockRejectedValueOnce(new AzureTimeoutError('Timeout 2', 'GET /users', 30000))
+        .mockResolvedValue('success');
+
+      await retryWithBackoff(operation, {
+        maxAttempts: 3,
+        initialDelay: 1000,
+        maxDelay: 1500, // Cap at 1500ms
+        backoffMultiplier: 3,
+        jitterPercent: 0,
+        onRetry,
+      });
+
+      expect(delays[0]).toBe(1000); // 1000 * 3^0 = 1000
+      expect(delays[1]).toBe(1500); // 1000 * 3^1 = 3000, capped at 1500
+    });
+  });
+
+  describe('AZURE_RETRY_CONFIGS', () => {
+    it('should have default config', () => {
+      expect(AZURE_RETRY_CONFIGS.default).toEqual({
+        maxAttempts: 3,
+        initialDelay: 1000,
+        maxDelay: 30000,
+        backoffMultiplier: 2,
+        jitterPercent: 10,
+      });
+    });
+
+    it('should have aggressive config', () => {
+      expect(AZURE_RETRY_CONFIGS.aggressive).toEqual({
+        maxAttempts: 5,
+        initialDelay: 500,
+        maxDelay: 15000,
+        backoffMultiplier: 1.5,
+        jitterPercent: 15,
+      });
+    });
+
+    it('should have conservative config', () => {
+      expect(AZURE_RETRY_CONFIGS.conservative).toEqual({
+        maxAttempts: 2,
+        initialDelay: 2000,
+        maxDelay: 60000,
+        backoffMultiplier: 3,
+        jitterPercent: 5,
+      });
+    });
+
+    it('should have rate limit config', () => {
+      expect(AZURE_RETRY_CONFIGS.rateLimit).toEqual({
+        maxAttempts: 3,
+        initialDelay: 60000,
+        maxDelay: 300000,
+        backoffMultiplier: 1,
+        jitterPercent: 0,
+      });
+    });
+  });
+});

package/tests/unit/providers/azure/graph-provider.test.ts

@@ -0,0 +1,313 @@
+/**
+ * Graph Provider Unit Tests
+ *
+ * Tests for Microsoft Graph provider implementation.
+ */
+
+import { GraphProvider } from '../../../../src/providers/azure/graph.provider';
+import { GraphClient } from '../../../../src/providers/azure/graph-client';
+import { AzureConfig } from '../../../../src/types/config.types';
+import {
+  AzureAPIError,
+  AzureAuthenticationError,
+  AzurePermissionError,
+} from '../../../../src/providers/azure/azure-errors';
+import { AzureUser, AzureGroup, AzureApp, AzurePolicy } from '../../../../src/types/azure.types';
+
+// Mock GraphClient
+jest.mock('../../../../src/providers/azure/graph-client');
+
+describe('GraphProvider', () => {
+  let provider: GraphProvider;
+  let mockClient: jest.Mocked<GraphClient>;
+  const mockConfig: AzureConfig = {
+    tenantId: 'tenant-123',
+    clientId: 'client-456',
+    clientSecret: 'secret-789',
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    // Create mock client instance
+    mockClient = {
+      authenticate: jest.fn().mockResolvedValue(undefined),
+      get: jest.fn(),
+      getAll: jest.fn(),
+      testConnection: jest.fn(),
+      disconnect: jest.fn(),
+      getAccessToken: jest.fn(),
+    } as unknown as jest.Mocked<GraphClient>;
+
+    // Mock the GraphClient constructor to return our mock
+    (GraphClient as jest.MockedClass<typeof GraphClient>).mockImplementation(() => mockClient);
+
+    provider = new GraphProvider(mockConfig);
+  });
+
+  describe('authenticate', () => {
+    it('should authenticate with Graph API', async () => {
+      await provider.authenticate();
+
+      expect(mockClient.authenticate).toHaveBeenCalledTimes(1);
+    });
+
+    it('should throw error if authentication fails', async () => {
+      mockClient.authenticate.mockRejectedValue(
+        new AzureAuthenticationError('Auth failed', 'tenant', 'client')
+      );
+
+      await expect(provider.authenticate()).rejects.toThrow(AzureAuthenticationError);
+    });
+  });
+
+  describe('testConnection', () => {
+    it('should return success on successful connection', async () => {
+      mockClient.get.mockResolvedValue({ value: [{ id: 'org-123' }] });
+
+      const result = await provider.testConnection();
+
+      expect(result.success).toBe(true);
+      expect(result.message).toBe('Connection successful');
+      expect(result.details).toMatchObject({
+        tenantId: mockConfig.tenantId,
+        clientId: mockConfig.clientId,
+        authenticated: true,
+      });
+      expect(result.details?.responseTime).toBeGreaterThanOrEqual(0);
+    });
+
+    it('should return failure on authentication error', async () => {
+      mockClient.authenticate.mockRejectedValue(
+        new AzureAuthenticationError('Invalid credentials', 'tenant', 'client')
+      );
+
+      const result = await provider.testConnection();
+
+      expect(result.success).toBe(false);
+      expect(result.message).toContain('Authentication failed');
+      expect(result.details?.authenticated).toBe(false);
+    });
+
+    it('should return failure on API error', async () => {
+      mockClient.get.mockRejectedValue(new AzureAPIError('API error', '/organization', 500));
+
+      const result = await provider.testConnection();
+
+      expect(result.success).toBe(false);
+      expect(result.message).toContain('Connection test failed');
+    });
+  });
+
+  describe('getUsers', () => {
+    const mockUsers: AzureUser[] = [
+      {
+        id: 'user-1',
+        userPrincipalName: 'user1@example.com',
+        displayName: 'User One',
+        accountEnabled: true,
+      },
+      {
+        id: 'user-2',
+        userPrincipalName: 'user2@example.com',
+        displayName: 'User Two',
+        accountEnabled: false,
+      },
+    ];
+
+    it('should get all users without options', async () => {
+      mockClient.getAll.mockResolvedValue(mockUsers);
+
+      const users = await provider.getUsers();
+
+      expect(mockClient.getAll).toHaveBeenCalledWith('/users', undefined);
+      expect(users).toEqual(mockUsers);
+    });
+
+    it('should get users with filter', async () => {
+      mockClient.getAll.mockResolvedValue([mockUsers[0]]);
+
+      const users = await provider.getUsers({
+        filter: "startsWith(displayName, 'User One')",
+      });
+
+      expect(mockClient.getAll).toHaveBeenCalledWith('/users', {
+        '$filter': "startsWith(displayName, 'User One')",
+      });
+      expect(users).toHaveLength(1);
+    });
+
+    it('should get users with select', async () => {
+      mockClient.getAll.mockResolvedValue(mockUsers);
+
+      await provider.getUsers({
+        select: ['id', 'userPrincipalName', 'displayName'],
+      });
+
+      expect(mockClient.getAll).toHaveBeenCalledWith('/users', {
+        '$select': 'id,userPrincipalName,displayName',
+      });
+    });
+
+    it('should get users with top and skip', async () => {
+      mockClient.getAll.mockResolvedValue([mockUsers[0]]);
+
+      await provider.getUsers({ top: 1, skip: 1 });
+
+      expect(mockClient.getAll).toHaveBeenCalledWith('/users', {
+        '$top': '1',
+        '$skip': '1',
+      });
+    });
+
+    it('should throw permission error on 403', async () => {
+      mockClient.getAll.mockRejectedValue(new AzureAPIError('Forbidden', '/users', 403));
+
+      await expect(provider.getUsers()).rejects.toThrow(AzurePermissionError);
+      await expect(provider.getUsers()).rejects.toThrow('User.Read.All');
+    });
+  });
+
+  describe('getGroups', () => {
+    const mockGroups: AzureGroup[] = [
+      {
+        id: 'group-1',
+        displayName: 'Admins',
+        mailEnabled: false,
+        securityEnabled: true,
+      },
+      {
+        id: 'group-2',
+        displayName: 'Users',
+        mailEnabled: true,
+        securityEnabled: false,
+      },
+    ];
+
+    it('should get all groups', async () => {
+      mockClient.getAll.mockResolvedValue(mockGroups);
+
+      const groups = await provider.getGroups();
+
+      expect(mockClient.getAll).toHaveBeenCalledWith('/groups', undefined);
+      expect(groups).toEqual(mockGroups);
+    });
+
+    it('should get groups with filter', async () => {
+      mockClient.getAll.mockResolvedValue([mockGroups[0]]);
+
+      const groups = await provider.getGroups({
+        filter: 'securityEnabled eq true',
+      });
+
+      expect(mockClient.getAll).toHaveBeenCalledWith('/groups', {
+        '$filter': 'securityEnabled eq true',
+      });
+      expect(groups).toHaveLength(1);
+    });
+
+    it('should throw permission error on 403', async () => {
+      mockClient.getAll.mockRejectedValue(new AzureAPIError('Forbidden', '/groups', 403));
+
+      await expect(provider.getGroups()).rejects.toThrow(AzurePermissionError);
+      await expect(provider.getGroups()).rejects.toThrow('Group.Read.All');
+    });
+  });
+
+  describe('getApplications', () => {
+    const mockApps: AzureApp[] = [
+      {
+        id: 'app-1',
+        appId: 'appId-1',
+        displayName: 'My App',
+      },
+    ];
+
+    it('should get all applications', async () => {
+      mockClient.getAll.mockResolvedValue(mockApps);
+
+      const apps = await provider.getApplications();
+
+      expect(mockClient.getAll).toHaveBeenCalledWith('/applications', undefined);
+      expect(apps).toEqual(mockApps);
+    });
+
+    it('should throw permission error on 403', async () => {
+      mockClient.getAll.mockRejectedValue(new AzureAPIError('Forbidden', '/applications', 403));
+
+      await expect(provider.getApplications()).rejects.toThrow(AzurePermissionError);
+      await expect(provider.getApplications()).rejects.toThrow('Application.Read.All');
+    });
+  });
+
+  describe('getPolicies', () => {
+    const mockPolicies: AzurePolicy[] = [
+      {
+        id: 'policy-1',
+        displayName: 'Require MFA',
+        state: 'enabled',
+      },
+    ];
+
+    it('should get all policies', async () => {
+      mockClient.getAll.mockResolvedValue(mockPolicies);
+
+      const policies = await provider.getPolicies();
+
+      expect(mockClient.getAll).toHaveBeenCalledWith(
+        '/identity/conditionalAccess/policies',
+        undefined
+      );
+      expect(policies).toEqual(mockPolicies);
+    });
+
+    it('should throw permission error on 403', async () => {
+      mockClient.getAll.mockRejectedValue(
+        new AzureAPIError('Forbidden', '/identity/conditionalAccess/policies', 403)
+      );
+
+      await expect(provider.getPolicies()).rejects.toThrow(AzurePermissionError);
+      await expect(provider.getPolicies()).rejects.toThrow('Policy.Read.All');
+    });
+  });
+
+  describe('disconnect', () => {
+    it('should disconnect from Graph API', async () => {
+      await provider.disconnect();
+
+      expect(mockClient.disconnect).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe('buildQueryParams', () => {
+    it('should build complete query params', async () => {
+      mockClient.getAll.mockResolvedValue([]);
+
+      await provider.getUsers({
+        filter: 'accountEnabled eq true',
+        select: ['id', 'displayName'],
+        expand: ['memberOf'],
+        orderBy: 'displayName',
+        top: 10,
+        skip: 5,
+      });
+
+      expect(mockClient.getAll).toHaveBeenCalledWith('/users', {
+        '$filter': 'accountEnabled eq true',
+        '$select': 'id,displayName',
+        '$expand': 'memberOf',
+        '$orderby': 'displayName',
+        '$top': '10',
+        '$skip': '5',
+      });
+    });
+
+    it('should return undefined for empty options', async () => {
+      mockClient.getAll.mockResolvedValue([]);
+
+      await provider.getUsers({});
+
+      expect(mockClient.getAll).toHaveBeenCalledWith('/users', undefined);
+    });
+  });
+});