@flink-app/jwt-auth-plugin 0.12.1-alpha.7 → 0.13.0

package/spec/FlinkJwtAuthPlugin.spec.ts

@@ -6,7 +6,7 @@ describe("FlinkJwtAuthPlugin", () => {
   it("should create and configure plugin", () => {
     const plugin = jwtAuthPlugin({
       secret: "secret",
-      getUser: async (id: string) => {
+      getUser: async (id: string, req) => {
         return {
           id,
           username: "username",
@@ -21,7 +21,7 @@ describe("FlinkJwtAuthPlugin", () => {
   it("should fail auth if no token was provided", async () => {
     const plugin = jwtAuthPlugin({
       secret: "secret",
-      getUser: async (id: string) => {
+      getUser: async (id: string, req) => {
         return {
           id,
           username: "username",
@@ -46,7 +46,7 @@ describe("FlinkJwtAuthPlugin", () => {
   it("should fail auth if token is invalid provided", async () => {
     const plugin = jwtAuthPlugin({
       secret: "secret",
-      getUser: async (id: string) => {
+      getUser: async (id: string, req) => {
         fail(); // Should not invoke this
         return {
           id,
@@ -79,7 +79,7 @@ describe("FlinkJwtAuthPlugin", () => {
 
     const plugin = jwtAuthPlugin({
       secret,
-      getUser: async ({ id }: { id: string }) => {
+      getUser: async ({ id }: { id: string }, req) => {
         expect(id).toBe(userId);
         return {
           id,
@@ -106,7 +106,7 @@ describe("FlinkJwtAuthPlugin", () => {
     const secret = "secret";
     const plugin = jwtAuthPlugin({
       secret,
-      getUser: async (id: string) => {
+      getUser: async (id: string, req) => {
         fail(); // Should not invoke this
         return {
           id,
@@ -126,4 +126,691 @@ describe("FlinkJwtAuthPlugin", () => {
 
     expect(decoded.id).toBe("123");
   });
+
+  describe("tokenExtractor", () => {
+    it("should use custom token extractor when it returns a string", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const customToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          expect(id).toBe(userId);
+          return {
+            id,
+            username: "username",
+          };
+        },
+        rolePermissions: {
+          user: ["*"],
+        },
+        tokenExtractor: (req) => {
+          // Extract from query param
+          return req.query?.token as string;
+        },
+      });
+
+      const mockRequest = {
+        headers: {},
+        query: {
+          token: customToken,
+        },
+      } as unknown as FlinkRequest;
+
+      const authenticated = await plugin.authenticateRequest(mockRequest, "foo");
+
+      expect(authenticated).toBeTruthy();
+    });
+
+    it("should fail auth when tokenExtractor returns null", async () => {
+      const plugin = jwtAuthPlugin({
+        secret: "secret",
+        getUser: async (id: string, req) => {
+          fail(); // Should not be called
+          return {
+            id,
+            username: "username",
+          };
+        },
+        rolePermissions: {
+          user: ["*"],
+        },
+        tokenExtractor: (req) => {
+          // Explicitly no token for this route
+          return null;
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer some-valid-token",
+        },
+      } as FlinkRequest;
+
+      const authenticated = await plugin.authenticateRequest(mockRequest, "foo");
+
+      expect(authenticated).toBeFalse();
+    });
+
+    it("should fall back to Bearer token when tokenExtractor returns undefined", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          expect(id).toBe(userId);
+          return {
+            id,
+            username: "username",
+          };
+        },
+        rolePermissions: {
+          user: ["*"],
+        },
+        tokenExtractor: (req) => {
+          // Return undefined to fall back to default
+          return undefined;
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+        },
+      } as FlinkRequest;
+
+      const authenticated = await plugin.authenticateRequest(mockRequest, "foo");
+
+      expect(authenticated).toBeTruthy();
+    });
+
+    it("should support conditional extraction based on path", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const queryToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+      const bearerToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          return {
+            id,
+            username: "username",
+          };
+        },
+        rolePermissions: {
+          user: ["*"],
+        },
+        tokenExtractor: (req) => {
+          // Use query param for public API routes only
+          if (req.path?.startsWith("/api/public/")) {
+            return req.query?.token as string || null;
+          }
+          // Fall back to Bearer for other routes
+          return undefined;
+        },
+      });
+
+      // Test public route with query param
+      const publicRequest = {
+        path: "/api/public/data",
+        headers: {},
+        query: {
+          token: queryToken,
+        },
+      } as unknown as FlinkRequest;
+
+      const publicAuth = await plugin.authenticateRequest(publicRequest, "foo");
+      expect(publicAuth).toBeTruthy();
+
+      // Test non-public route with Bearer token
+      const privateRequest = {
+        path: "/api/private/data",
+        headers: {
+          authorization: "Bearer " + bearerToken,
+        },
+      } as unknown as FlinkRequest;
+
+      const privateAuth = await plugin.authenticateRequest(privateRequest, "foo");
+      expect(privateAuth).toBeTruthy();
+    });
+
+    it("should use default Bearer extraction when no tokenExtractor provided", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          return {
+            id,
+            username: "username",
+          };
+        },
+        rolePermissions: {
+          user: ["*"],
+        },
+        // No tokenExtractor provided
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+        },
+      } as FlinkRequest;
+
+      const authenticated = await plugin.authenticateRequest(mockRequest, "foo");
+
+      expect(authenticated).toBeTruthy();
+    });
+  });
+
+  describe("checkPermissions callback", () => {
+    it("should use custom permission checker when provided", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          return {
+            id,
+            username: "testuser",
+            permissions: ["read", "write", "delete"],
+          };
+        },
+        rolePermissions: {
+          user: [], // Empty - custom checker will handle this
+        },
+        checkPermissions: async (user, routePermissions) => {
+          // Check if user has all required permissions
+          return routePermissions.every((perm) =>
+            user.permissions?.includes(perm)
+          );
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+        },
+      } as FlinkRequest;
+
+      const authenticated = await plugin.authenticateRequest(mockRequest, [
+        "read",
+        "write",
+      ]);
+
+      expect(authenticated).toBeTruthy();
+      expect(mockRequest.user?.permissions).toEqual([
+        "read",
+        "write",
+        "delete",
+      ]);
+    });
+
+    it("should fail auth when custom checker returns false", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          return {
+            id,
+            username: "testuser",
+            permissions: ["read"], // Only has read
+          };
+        },
+        rolePermissions: {},
+        checkPermissions: async (user, routePermissions) => {
+          return routePermissions.every((perm) =>
+            user.permissions?.includes(perm)
+          );
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+        },
+      } as FlinkRequest;
+
+      // Route requires write, but user only has read
+      const authenticated = await plugin.authenticateRequest(mockRequest, [
+        "read",
+        "write",
+      ]);
+
+      expect(authenticated).toBeFalse();
+    });
+
+    it("should use static rolePermissions when checkPermissions not provided (backward compat)", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["admin"] },
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          return {
+            id,
+            username: "admin",
+          };
+        },
+        rolePermissions: {
+          admin: ["read", "write", "delete"],
+        },
+        // No checkPermissions provided - uses static
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+        },
+      } as FlinkRequest;
+
+      const authenticated = await plugin.authenticateRequest(
+        mockRequest,
+        "write"
+      );
+
+      expect(authenticated).toBeTruthy();
+    });
+
+    it("should support synchronous permission checker", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          return {
+            id,
+            username: "testuser",
+            permissions: ["read"],
+          };
+        },
+        rolePermissions: {},
+        // Synchronous checker (not async)
+        checkPermissions: (user, routePermissions) => {
+          return routePermissions.every((perm) =>
+            user.permissions?.includes(perm)
+          );
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+        },
+      } as FlinkRequest;
+
+      const authenticated = await plugin.authenticateRequest(
+        mockRequest,
+        "read"
+      );
+
+      expect(authenticated).toBeTruthy();
+    });
+
+    it("should pass when route has no permissions and custom checker provided", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+
+      let checkerCalled = false;
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          return { id, username: "testuser" };
+        },
+        rolePermissions: {},
+        checkPermissions: async (user, routePermissions) => {
+          checkerCalled = true;
+          return true;
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+        },
+      } as FlinkRequest;
+
+      // Empty permissions (public route)
+      const authenticated = await plugin.authenticateRequest(mockRequest, []);
+
+      expect(authenticated).toBeTruthy();
+      expect(checkerCalled).toBeFalse(); // Checker should not be called for public routes
+    });
+
+    it("should handle database-fetched permissions in getUser", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["user"] },
+        secret
+      );
+
+      // Simulate DB permissions
+      const dbPermissions: { [key: string]: string[] } = {
+        "123": ["read", "write", "custom_permission"],
+      };
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        getUser: async ({ id }: { id: string }, req) => {
+          // Simulate fetching permissions from DB
+          const permissions = dbPermissions[id] || [];
+          return {
+            id,
+            username: "testuser",
+            permissions,
+          };
+        },
+        rolePermissions: {},
+        checkPermissions: async (user, routePermissions) => {
+          return routePermissions.every((perm) =>
+            user.permissions?.includes(perm)
+          );
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+        },
+      } as FlinkRequest;
+
+      const authenticated = await plugin.authenticateRequest(mockRequest, [
+        "custom_permission",
+      ]);
+
+      expect(authenticated).toBeTruthy();
+      expect(mockRequest.user?.permissions).toContain("custom_permission");
+    });
+  });
+
+  describe("useDynamicRoles", () => {
+    it("should use roles from user object when useDynamicRoles is true", async () => {
+      const secret = "secret";
+      const userId = "123";
+      // Token has one set of roles
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["guest"] }, // Token says guest
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        useDynamicRoles: true,
+        getUser: async ({ id }: { id: string }, req) => {
+          // Simulate fetching org-specific role based on header
+          const orgId = req.headers["x-organization-id"];
+          const role = orgId === "org1" ? "admin" : "user";
+
+          return {
+            id,
+            username: "testuser",
+            roles: [role], // Dynamic role from database/context
+          };
+        },
+        rolePermissions: {
+          admin: ["read", "write", "delete"],
+          user: ["read", "write"],
+          guest: ["read"],
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+          "x-organization-id": "org1",
+        },
+      } as unknown as FlinkRequest;
+
+      // Should pass because user is admin in org1 (despite token saying guest)
+      const authenticated = await plugin.authenticateRequest(mockRequest, ["delete"]);
+
+      expect(authenticated).toBeTruthy();
+      expect(mockRequest.user?.roles).toEqual(["admin"]);
+    });
+
+    it("should fail when dynamic role doesn't have required permission", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["admin"] }, // Token says admin
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        useDynamicRoles: true,
+        getUser: async ({ id }: { id: string }, req) => {
+          const orgId = req.headers["x-organization-id"];
+          const role = orgId === "org2" ? "guest" : "admin";
+
+          return {
+            id,
+            username: "testuser",
+            roles: [role],
+          };
+        },
+        rolePermissions: {
+          admin: ["read", "write", "delete"],
+          guest: ["read"],
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+          "x-organization-id": "org2", // In org2, user is guest
+        },
+      } as unknown as FlinkRequest;
+
+      // Should fail because user is only guest in org2
+      const authenticated = await plugin.authenticateRequest(mockRequest, ["delete"]);
+
+      expect(authenticated).toBeFalse();
+    });
+
+    it("should use token roles when useDynamicRoles is false (default)", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: ["admin"] },
+        secret
+      );
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        // useDynamicRoles not set (defaults to false)
+        getUser: async ({ id }: { id: string }, req) => {
+          return {
+            id,
+            username: "testuser",
+            roles: ["guest"], // This should be ignored
+          };
+        },
+        rolePermissions: {
+          admin: ["read", "write", "delete"],
+          guest: ["read"],
+        },
+      });
+
+      const mockRequest = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+        },
+      } as FlinkRequest;
+
+      // Should pass because token has admin role (user.roles ignored)
+      const authenticated = await plugin.authenticateRequest(mockRequest, ["delete"]);
+
+      expect(authenticated).toBeTruthy();
+    });
+
+    it("should support multi-tenant scenario with organization context", async () => {
+      const secret = "secret";
+      const userId = "user123";
+      const encodedToken = jwtSimple.encode(
+        { id: userId, roles: [] }, // No roles in token
+        secret
+      );
+
+      // Simulate database of org memberships
+      const orgMemberships: { [key: string]: { [userId: string]: string } } = {
+        org1: { user123: "admin" },
+        org2: { user123: "user" },
+        org3: { user123: "guest" },
+      };
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        useDynamicRoles: true,
+        getUser: async ({ id }: { id: string }, req) => {
+          const orgId = req.headers["x-organization-id"] as string;
+          const role = orgMemberships[orgId]?.[id] || "guest";
+
+          return {
+            id,
+            username: "multitenantuser",
+            organizationId: orgId,
+            roles: [role],
+          };
+        },
+        rolePermissions: {
+          admin: ["read", "write", "delete", "manage"],
+          user: ["read", "write"],
+          guest: ["read"],
+        },
+      });
+
+      // Test as admin in org1
+      const org1Request = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+          "x-organization-id": "org1",
+        },
+      } as unknown as FlinkRequest;
+
+      const org1Auth = await plugin.authenticateRequest(org1Request, ["manage"]);
+      expect(org1Auth).toBeTruthy();
+      expect(org1Request.user?.roles).toEqual(["admin"]);
+
+      // Test as user in org2
+      const org2Request = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+          "x-organization-id": "org2",
+        },
+      } as unknown as FlinkRequest;
+
+      const org2AuthWrite = await plugin.authenticateRequest(org2Request, ["write"]);
+      expect(org2AuthWrite).toBeTruthy();
+
+      const org2AuthManage = await plugin.authenticateRequest(org2Request, ["manage"]);
+      expect(org2AuthManage).toBeFalse(); // User can't manage in org2
+
+      // Test as guest in org3
+      const org3Request = {
+        headers: {
+          authorization: "Bearer " + encodedToken,
+          "x-organization-id": "org3",
+        },
+      } as unknown as FlinkRequest;
+
+      const org3AuthRead = await plugin.authenticateRequest(org3Request, ["read"]);
+      expect(org3AuthRead).toBeTruthy();
+
+      const org3AuthWrite = await plugin.authenticateRequest(org3Request, ["write"]);
+      expect(org3AuthWrite).toBeFalse(); // Guest can't write in org3
+    });
+
+    it("should have access to request properties in getUser callback", async () => {
+      const secret = "secret";
+      const userId = "123";
+      const encodedToken = jwtSimple.encode({ id: userId }, secret);
+
+      let capturedPath: string | undefined;
+      let capturedMethod: string | undefined;
+      let capturedHeaders: any;
+
+      const plugin = jwtAuthPlugin({
+        secret,
+        useDynamicRoles: true,
+        getUser: async ({ id }: { id: string }, req) => {
+          // Capture request properties to verify they're accessible
+          capturedPath = req.path;
+          capturedMethod = req.method;
+          capturedHeaders = req.headers;
+
+          return {
+            id,
+            username: "testuser",
+            roles: ["user"],
+          };
+        },
+        rolePermissions: {
+          user: ["read"],
+        },
+      });
+
+      const mockRequest = {
+        path: "/api/users",
+        method: "GET",
+        headers: {
+          authorization: "Bearer " + encodedToken,
+          "x-custom-header": "custom-value",
+        },
+      } as unknown as FlinkRequest;
+
+      await plugin.authenticateRequest(mockRequest, ["read"]);
+
+      expect(capturedPath).toBe("/api/users");
+      expect(capturedMethod).toBe("GET");
+      expect(capturedHeaders["x-custom-header"]).toBe("custom-value");
+    });
+  });
 });