@geekmidas/auth 9.0.2 → 10.0.0-alpha.1

package/src/__tests__/jwt.spec.ts

@@ -1,197 +0,0 @@
-import * as jose from 'jose';
-import { describe, expect, it } from 'vitest';
-import { decodeJwt, JwtVerifier } from '../jwt';
-
-const TEST_SECRET = 'super-secret-key-for-testing-only-32chars';
-
-async function createTestToken(
-	claims: Record<string, unknown> = {},
-	options: {
-		secret?: string;
-		expiresIn?: string;
-		issuer?: string;
-		audience?: string;
-	} = {},
-) {
-	const secret = new TextEncoder().encode(options.secret ?? TEST_SECRET);
-	const jwt = new jose.SignJWT({ sub: 'user-123', ...claims })
-		.setProtectedHeader({ alg: 'HS256' })
-		.setIssuedAt();
-
-	if (options.expiresIn) {
-		jwt.setExpirationTime(options.expiresIn);
-	} else {
-		jwt.setExpirationTime('1h');
-	}
-
-	if (options.issuer) {
-		jwt.setIssuer(options.issuer);
-	}
-
-	if (options.audience) {
-		jwt.setAudience(options.audience);
-	}
-
-	return await jwt.sign(secret);
-}
-
-describe('JwtVerifier', () => {
-	describe('with secret', () => {
-		it('should verify a valid token', async () => {
-			const verifier = new JwtVerifier({ secret: TEST_SECRET });
-			const token = await createTestToken();
-
-			const claims = await verifier.verify(token);
-
-			expect(claims.sub).toBe('user-123');
-		});
-
-		it('should throw for invalid token', async () => {
-			const verifier = new JwtVerifier({ secret: TEST_SECRET });
-
-			await expect(verifier.verify('invalid-token')).rejects.toThrow();
-		});
-
-		it('should throw for wrong secret', async () => {
-			const verifier = new JwtVerifier({ secret: TEST_SECRET });
-			const token = await createTestToken(
-				{},
-				{ secret: 'wrong-secret-key-32-chars-long!!' },
-			);
-
-			await expect(verifier.verify(token)).rejects.toThrow();
-		});
-
-		it('should throw for expired token', async () => {
-			const verifier = new JwtVerifier({ secret: TEST_SECRET });
-			const token = await createTestToken({}, { expiresIn: '-1h' });
-
-			await expect(verifier.verify(token)).rejects.toThrow();
-		});
-
-		it('should validate issuer when configured', async () => {
-			const verifier = new JwtVerifier({
-				secret: TEST_SECRET,
-				issuer: 'my-app',
-			});
-
-			const validToken = await createTestToken({}, { issuer: 'my-app' });
-			const invalidToken = await createTestToken({}, { issuer: 'other-app' });
-
-			await expect(verifier.verify(validToken)).resolves.toBeDefined();
-			await expect(verifier.verify(invalidToken)).rejects.toThrow();
-		});
-
-		it('should validate audience when configured', async () => {
-			const verifier = new JwtVerifier({
-				secret: TEST_SECRET,
-				audience: 'my-api',
-			});
-
-			const validToken = await createTestToken({}, { audience: 'my-api' });
-			const invalidToken = await createTestToken({}, { audience: 'other-api' });
-
-			await expect(verifier.verify(validToken)).resolves.toBeDefined();
-			await expect(verifier.verify(invalidToken)).rejects.toThrow();
-		});
-	});
-
-	describe('verifyOrNull', () => {
-		it('should return claims for valid token', async () => {
-			const verifier = new JwtVerifier({ secret: TEST_SECRET });
-			const token = await createTestToken();
-
-			const claims = await verifier.verifyOrNull(token);
-
-			expect(claims).not.toBeNull();
-			expect(claims?.sub).toBe('user-123');
-		});
-
-		it('should return null for invalid token', async () => {
-			const verifier = new JwtVerifier({ secret: TEST_SECRET });
-
-			const claims = await verifier.verifyOrNull('invalid-token');
-
-			expect(claims).toBeNull();
-		});
-
-		it('should return null for expired token', async () => {
-			const verifier = new JwtVerifier({ secret: TEST_SECRET });
-			const token = await createTestToken({}, { expiresIn: '-1h' });
-
-			const claims = await verifier.verifyOrNull(token);
-
-			expect(claims).toBeNull();
-		});
-	});
-
-	describe('custom claims', () => {
-		interface CustomClaims {
-			sub?: string;
-			role: string;
-			permissions: string[];
-		}
-
-		it('should return typed claims', async () => {
-			const verifier = new JwtVerifier<CustomClaims>({ secret: TEST_SECRET });
-			const token = await createTestToken({
-				role: 'admin',
-				permissions: ['read', 'write'],
-			});
-
-			const claims = await verifier.verify(token);
-
-			expect(claims.role).toBe('admin');
-			expect(claims.permissions).toEqual(['read', 'write']);
-		});
-	});
-});
-
-describe('clearCache', () => {
-	it('should clear the JWKS cache', () => {
-		const verifier = new JwtVerifier({ secret: TEST_SECRET });
-
-		// Call clearCache - should not throw
-		verifier.clearCache();
-
-		// Verify the method exists and can be called
-		expect(verifier.clearCache).toBeDefined();
-	});
-
-	it('should allow re-verification after clearing cache', async () => {
-		const verifier = new JwtVerifier({ secret: TEST_SECRET });
-		const token = await createTestToken();
-
-		const claims1 = await verifier.verify(token);
-		verifier.clearCache();
-		const claims2 = await verifier.verify(token);
-
-		expect(claims1.sub).toBe(claims2.sub);
-	});
-});
-
-describe('decodeJwt', () => {
-	it('should decode token without verification', async () => {
-		const token = await createTestToken({ custom: 'data' });
-
-		const claims = decodeJwt(token);
-
-		expect(claims.sub).toBe('user-123');
-		expect(claims).toHaveProperty('custom', 'data');
-	});
-
-	it('should decode token even with wrong secret', async () => {
-		const token = await createTestToken(
-			{},
-			{ secret: 'any-secret-32-characters-long!!' },
-		);
-
-		const claims = decodeJwt(token);
-
-		expect(claims.sub).toBe('user-123');
-	});
-
-	it('should throw for malformed token', () => {
-		expect(() => decodeJwt('not.a.valid.jwt')).toThrow();
-	});
-});

package/src/__tests__/lambda-jwt.spec.ts

@@ -1,278 +0,0 @@
-import type {
-	APIGatewayRequestAuthorizerEvent,
-	APIGatewayTokenAuthorizerEvent,
-	Context as LambdaContext,
-} from 'aws-lambda';
-import * as jose from 'jose';
-import { describe, expect, it } from 'vitest';
-import { JwtAuthorizer } from '../lambda/jwt';
-
-const TEST_SECRET = 'super-secret-key-for-testing-only-32chars';
-const TEST_METHOD_ARN =
-	'arn:aws:execute-api:us-east-1:123456789:api-id/stage/GET/resource';
-
-async function createTestToken(
-	claims: Record<string, unknown> = {},
-	secret = TEST_SECRET,
-) {
-	const secretKey = new TextEncoder().encode(secret);
-	return await new jose.SignJWT({ sub: 'user-123', ...claims })
-		.setProtectedHeader({ alg: 'HS256' })
-		.setIssuedAt()
-		.setExpirationTime('1h')
-		.sign(secretKey);
-}
-
-function createTokenEvent(
-	token: string,
-	methodArn = TEST_METHOD_ARN,
-): APIGatewayTokenAuthorizerEvent {
-	return {
-		type: 'TOKEN',
-		authorizationToken: `Bearer ${token}`,
-		methodArn,
-	};
-}
-
-function createRequestEvent(
-	headers: Record<string, string> = {},
-	methodArn = TEST_METHOD_ARN,
-): APIGatewayRequestAuthorizerEvent {
-	return {
-		type: 'REQUEST',
-		methodArn,
-		headers,
-		multiValueHeaders: {},
-		pathParameters: null,
-		queryStringParameters: null,
-		multiValueQueryStringParameters: null,
-		stageVariables: null,
-		requestContext: {} as any,
-		resource: '',
-		path: '',
-		httpMethod: 'GET',
-	};
-}
-
-const mockLambdaContext = {} as LambdaContext;
-
-describe('JwtAuthorizer', () => {
-	describe('tokenHandler()', () => {
-		it('should allow valid token', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-			});
-			const handler = authorizer.tokenHandler();
-
-			const token = await createTestToken();
-			const event = createTokenEvent(token);
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Allow');
-			expect(result.principalId).toBe('user-123');
-		});
-
-		it('should deny invalid token', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-			});
-			const handler = authorizer.tokenHandler();
-
-			const event = createTokenEvent('invalid-token');
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Deny');
-			expect(result.principalId).toBe('unauthorized');
-		});
-
-		it('should use wildcard resource by default', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-			});
-			const handler = authorizer.tokenHandler();
-
-			const token = await createTestToken();
-			const event = createTokenEvent(token);
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Resource).toBe(
-				'arn:aws:execute-api:us-east-1:123456789:api-id/stage/*',
-			);
-		});
-
-		it('should use exact resource when wildcardResource is false', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-				wildcardResource: false,
-			});
-			const handler = authorizer.tokenHandler();
-
-			const token = await createTestToken();
-			const event = createTokenEvent(token);
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Resource).toBe(TEST_METHOD_ARN);
-		});
-
-		it('should use custom getPrincipalId', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-				getPrincipalId: (claims) => `custom-${claims.sub}`,
-			});
-			const handler = authorizer.tokenHandler();
-
-			const token = await createTestToken();
-			const event = createTokenEvent(token);
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.principalId).toBe('custom-user-123');
-		});
-
-		it('should include context from getContext', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-				getContext: (claims) => ({
-					userId: claims.sub!,
-					role: 'admin',
-				}),
-			});
-			const handler = authorizer.tokenHandler();
-
-			const token = await createTestToken();
-			const event = createTokenEvent(token);
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.context).toEqual({
-				userId: 'user-123',
-				role: 'admin',
-			});
-		});
-
-		it('should deny when custom authorize returns false', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-				authorize: (claims) => claims.sub === 'admin',
-			});
-			const handler = authorizer.tokenHandler();
-
-			const token = await createTestToken();
-			const event = createTokenEvent(token);
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Deny');
-		});
-
-		it('should allow when custom authorize returns true', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-				authorize: (claims) => claims.sub === 'user-123',
-			});
-			const handler = authorizer.tokenHandler();
-
-			const token = await createTestToken();
-			const event = createTokenEvent(token);
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Allow');
-		});
-
-		it('should handle token without Bearer prefix', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-			});
-			const handler = authorizer.tokenHandler();
-
-			const token = await createTestToken();
-			const event: APIGatewayTokenAuthorizerEvent = {
-				type: 'TOKEN',
-				authorizationToken: token, // No Bearer prefix
-				methodArn: TEST_METHOD_ARN,
-			};
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Allow');
-		});
-	});
-
-	describe('requestHandler()', () => {
-		it('should allow valid token from Authorization header', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-			});
-			const handler = authorizer.requestHandler();
-
-			const token = await createTestToken();
-			const event = createRequestEvent({ Authorization: `Bearer ${token}` });
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Allow');
-		});
-
-		it('should deny when no token provided', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-			});
-			const handler = authorizer.requestHandler();
-
-			const event = createRequestEvent({});
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Deny');
-		});
-
-		it('should extract token from custom header', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-				extraction: { headerName: 'x-api-token', tokenPrefix: '' },
-			});
-			const handler = authorizer.requestHandler();
-
-			const token = await createTestToken();
-			const event = createRequestEvent({ 'x-api-token': token });
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Allow');
-		});
-
-		it('should extract token from cookie', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-				extraction: { cookieName: 'session' },
-			});
-			const handler = authorizer.requestHandler();
-
-			const token = await createTestToken();
-			const event = createRequestEvent({ cookie: `session=${token}` });
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Allow');
-		});
-
-		it('should handle case-insensitive headers', async () => {
-			const authorizer = new JwtAuthorizer({
-				config: { secret: TEST_SECRET },
-			});
-			const handler = authorizer.requestHandler();
-
-			const token = await createTestToken();
-			const event = createRequestEvent({ authorization: `Bearer ${token}` });
-
-			const result = await handler(event, mockLambdaContext);
-
-			expect(result.policyDocument.Statement[0].Effect).toBe('Allow');
-		});
-	});
-});