@geekmidas/auth 9.0.2 → 10.0.0-alpha.1

package/src/__tests__/oidc.spec.ts

@@ -1,405 +0,0 @@
-// @vitest-environment node
-import * as jose from 'jose';
-import { HttpResponse, http } from 'msw';
-import { setupServer } from 'msw/node';
-import {
-	afterAll,
-	afterEach,
-	beforeAll,
-	describe,
-	expect,
-	it,
-	vi,
-} from 'vitest';
-import { OidcVerifier } from '../oidc';
-
-// Mock discovery document
-const mockDiscovery = {
-	issuer: 'https://auth.example.com',
-	authorization_endpoint: 'https://auth.example.com/authorize',
-	token_endpoint: 'https://auth.example.com/token',
-	userinfo_endpoint: 'https://auth.example.com/userinfo',
-	jwks_uri: 'https://auth.example.com/.well-known/jwks.json',
-	scopes_supported: ['openid', 'profile', 'email'],
-	response_types_supported: ['code', 'token'],
-	claims_supported: ['sub', 'name', 'email'],
-};
-
-// Mock user info
-const mockUserInfo = {
-	sub: 'user-123',
-	name: 'Test User',
-	email: 'test@example.com',
-	email_verified: true,
-};
-
-// Test keys - stored in object so the mock can access after initialization
-const testKeys: {
-	privateKey: jose.KeyLike | null;
-	publicKey: jose.KeyLike | null;
-} = {
-	privateKey: null,
-	publicKey: null,
-};
-let jwks: jose.JSONWebKeySet;
-
-async function setupKeys() {
-	const keyPair = await jose.generateKeyPair('RS256');
-	testKeys.privateKey = keyPair.privateKey;
-	testKeys.publicKey = keyPair.publicKey;
-	const publicJwk = await jose.exportJWK(keyPair.publicKey);
-	jwks = {
-		keys: [{ ...publicJwk, kid: 'test-key-id', use: 'sig', alg: 'RS256' }],
-	};
-}
-
-// Mock createRemoteJWKSet to return test keys directly.
-// MSW intercepts jose's fetch in standalone scripts but fails in vitest for unknown reasons.
-// TODO: Investigate vitest/MSW/jose interaction and remove this mock if possible.
-vi.mock('jose', async (importOriginal) => {
-	const actual = await importOriginal<typeof jose>();
-	return {
-		...actual,
-		createRemoteJWKSet: () => {
-			return async (protectedHeader: jose.JWSHeaderParameters) => {
-				if (protectedHeader.kid === 'test-key-id' && testKeys.publicKey) {
-					return testKeys.publicKey;
-				}
-				throw new Error(`Unknown key ID: ${protectedHeader.kid}`);
-			};
-		},
-	};
-});
-
-async function createTestToken(
-	claims: Record<string, unknown> = {},
-	options: { expiresIn?: string } = {},
-) {
-	if (!testKeys.privateKey) {
-		throw new Error('Keys not initialized');
-	}
-	return await new jose.SignJWT({ sub: 'user-123', ...claims })
-		.setProtectedHeader({ alg: 'RS256', kid: 'test-key-id' })
-		.setIssuedAt()
-		.setIssuer('https://auth.example.com')
-		.setAudience('my-api')
-		.setExpirationTime(options.expiresIn ?? '1h')
-		.sign(testKeys.privateKey);
-}
-
-// MSW server for discovery, userinfo, and other HTTP endpoints
-const server = setupServer(
-	http.get('https://auth.example.com/.well-known/openid-configuration', () => {
-		return HttpResponse.json(mockDiscovery);
-	}),
-	http.get('https://auth.example.com/.well-known/jwks.json', () => {
-		return HttpResponse.json(jwks);
-	}),
-	http.get('https://auth.example.com/userinfo', () => {
-		return HttpResponse.json(mockUserInfo);
-	}),
-	http.get(
-		'https://other-auth.example.com/.well-known/openid-configuration',
-		() => {
-			return HttpResponse.json({
-				...mockDiscovery,
-				issuer: 'https://other-auth.example.com',
-				jwks_uri: 'https://other-auth.example.com/.well-known/jwks.json',
-			});
-		},
-	),
-	http.get('https://other-auth.example.com/.well-known/jwks.json', () => {
-		return HttpResponse.json(jwks);
-	}),
-);
-
-describe('OidcVerifier', () => {
-	beforeAll(async () => {
-		await setupKeys();
-		server.listen({ onUnhandledRequest: 'error' });
-	});
-
-	afterEach(() => {
-		server.resetHandlers();
-	});
-
-	afterAll(() => {
-		server.close();
-	});
-
-	describe('getDiscovery', () => {
-		it('should fetch OIDC discovery document', async () => {
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-
-			const discovery = await verifier.getDiscovery();
-
-			expect(discovery.issuer).toBe('https://auth.example.com');
-			expect(discovery.jwks_uri).toBe(
-				'https://auth.example.com/.well-known/jwks.json',
-			);
-		});
-
-		it('should cache discovery document by default', async () => {
-			let callCount = 0;
-			server.use(
-				http.get(
-					'https://auth.example.com/.well-known/openid-configuration',
-					() => {
-						callCount++;
-						return HttpResponse.json(mockDiscovery);
-					},
-				),
-			);
-
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-
-			await verifier.getDiscovery();
-			await verifier.getDiscovery();
-
-			expect(callCount).toBe(1);
-		});
-
-		it('should handle issuer with trailing slash', async () => {
-			let requestedUrl = '';
-			server.use(
-				http.get(
-					'https://auth.example.com/.well-known/openid-configuration',
-					({ request }) => {
-						requestedUrl = request.url;
-						return HttpResponse.json(mockDiscovery);
-					},
-				),
-			);
-
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com/',
-				audience: 'my-api',
-			});
-
-			await verifier.getDiscovery();
-
-			expect(requestedUrl).toBe(
-				'https://auth.example.com/.well-known/openid-configuration',
-			);
-		});
-
-		it('should throw on failed discovery fetch', async () => {
-			server.use(
-				http.get(
-					'https://auth.example.com/.well-known/openid-configuration',
-					() => {
-						return new HttpResponse(null, {
-							status: 500,
-							statusText: 'Internal Server Error',
-						});
-					},
-				),
-			);
-
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-
-			await expect(verifier.getDiscovery()).rejects.toThrow(
-				'Failed to fetch OIDC discovery',
-			);
-		});
-	});
-
-	describe('verify', () => {
-		it('should verify a valid token', async () => {
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-			const token = await createTestToken();
-
-			const claims = await verifier.verify(token);
-
-			expect(claims.sub).toBe('user-123');
-		});
-
-		it('should throw for invalid token', async () => {
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-
-			await expect(verifier.verify('invalid-token')).rejects.toThrow();
-		});
-
-		it('should throw for expired token', async () => {
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-			const token = await createTestToken({}, { expiresIn: '-1h' });
-
-			await expect(verifier.verify(token)).rejects.toThrow();
-		});
-
-		it('should throw for wrong issuer', async () => {
-			const verifier = new OidcVerifier({
-				issuer: 'https://other-auth.example.com',
-				audience: 'my-api',
-			});
-			const token = await createTestToken();
-
-			await expect(verifier.verify(token)).rejects.toThrow();
-		});
-
-		it('should throw for wrong audience', async () => {
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'other-api',
-			});
-			const token = await createTestToken();
-
-			await expect(verifier.verify(token)).rejects.toThrow();
-		});
-	});
-
-	describe('verifyOrNull', () => {
-		it('should return claims for valid token', async () => {
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-			const token = await createTestToken();
-
-			const claims = await verifier.verifyOrNull(token);
-
-			expect(claims).not.toBeNull();
-			expect(claims?.sub).toBe('user-123');
-		});
-
-		it('should return null for invalid token', async () => {
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-
-			const claims = await verifier.verifyOrNull('invalid-token');
-
-			expect(claims).toBeNull();
-		});
-	});
-
-	describe('fetchUserInfo', () => {
-		it('should fetch user info with valid token', async () => {
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-			const token = await createTestToken();
-
-			const userInfo = await verifier.fetchUserInfo(token);
-
-			expect(userInfo).not.toBeNull();
-			expect(userInfo?.sub).toBe('user-123');
-			expect(userInfo?.name).toBe('Test User');
-			expect(userInfo?.email).toBe('test@example.com');
-		});
-
-		it('should return null when userinfo endpoint is not available', async () => {
-			server.use(
-				http.get(
-					'https://auth.example.com/.well-known/openid-configuration',
-					() => {
-						return HttpResponse.json({
-							...mockDiscovery,
-							userinfo_endpoint: undefined,
-						});
-					},
-				),
-			);
-
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-
-			const userInfo = await verifier.fetchUserInfo('some-token');
-
-			expect(userInfo).toBeNull();
-		});
-
-		it('should return null on userinfo fetch error', async () => {
-			server.use(
-				http.get('https://auth.example.com/userinfo', () => {
-					return new HttpResponse(null, { status: 401 });
-				}),
-			);
-
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-
-			const userInfo = await verifier.fetchUserInfo('invalid-token');
-
-			expect(userInfo).toBeNull();
-		});
-	});
-
-	describe('clearCache', () => {
-		it('should clear cached discovery and jwks', async () => {
-			let callCount = 0;
-			server.use(
-				http.get(
-					'https://auth.example.com/.well-known/openid-configuration',
-					() => {
-						callCount++;
-						return HttpResponse.json(mockDiscovery);
-					},
-				),
-			);
-
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-			});
-
-			await verifier.getDiscovery();
-			expect(callCount).toBe(1);
-
-			verifier.clearCache();
-
-			await verifier.getDiscovery();
-			expect(callCount).toBe(2);
-		});
-	});
-
-	describe('cacheDiscovery option', () => {
-		it('should not cache when cacheDiscovery is false', async () => {
-			let callCount = 0;
-			server.use(
-				http.get(
-					'https://auth.example.com/.well-known/openid-configuration',
-					() => {
-						callCount++;
-						return HttpResponse.json(mockDiscovery);
-					},
-				),
-			);
-
-			const verifier = new OidcVerifier({
-				issuer: 'https://auth.example.com',
-				audience: 'my-api',
-				cacheDiscovery: false,
-			});
-
-			await verifier.getDiscovery();
-			await verifier.getDiscovery();
-
-			expect(callCount).toBe(2);
-		});
-	});
-});

package/src/__tests__/tokenManager.spec.ts

@@ -1,259 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { TokenManager, type TokenPayload } from '../tokenManager.ts';
-
-describe('TokenManager', () => {
-	let tokenManager: TokenManager;
-	let userPayload: TokenPayload;
-
-	beforeEach(() => {
-		tokenManager = new TokenManager({
-			accessTokenSecret: 'test-access-secret',
-			refreshTokenSecret: 'test-refresh-secret',
-			accessTokenExpiresIn: '15m',
-			refreshTokenExpiresIn: '7d',
-		});
-
-		userPayload = {
-			userId: 'user123',
-			email: 'test@example.com',
-			role: 'admin',
-		};
-	});
-
-	describe('token generation and verification workflow', () => {
-		it('should generate and verify complete token pair', () => {
-			const { accessToken, refreshToken } =
-				tokenManager.generateTokenPair(userPayload);
-
-			const accessDecoded = tokenManager.verifyAccessToken(accessToken);
-			const refreshDecoded = tokenManager.verifyRefreshToken(refreshToken);
-
-			expect(accessDecoded.userId).toBe(userPayload.userId);
-			expect(accessDecoded.email).toBe(userPayload.email);
-			expect(accessDecoded.role).toBe(userPayload.role);
-			expect(refreshDecoded.userId).toBe(userPayload.userId);
-			expect(refreshDecoded.email).toBe(userPayload.email);
-			expect(refreshDecoded.role).toBe(userPayload.role);
-		});
-
-		it('should handle complete token refresh workflow', () => {
-			const { refreshToken } = tokenManager.generateTokenPair(userPayload);
-
-			const newAccessToken = tokenManager.refreshAccessToken(refreshToken);
-			const newDecoded = tokenManager.verifyAccessToken(newAccessToken);
-
-			expect(newDecoded.userId).toBe(userPayload.userId);
-			expect(newDecoded.email).toBe(userPayload.email);
-			expect(newDecoded.role).toBe(userPayload.role);
-			expect(newDecoded.iat).toBeDefined();
-			expect(newDecoded.exp).toBeDefined();
-		});
-
-		it('should maintain payload integrity through refresh cycle', () => {
-			const originalPayload = {
-				userId: 'user456',
-				email: 'user@example.com',
-				permissions: ['read', 'write'],
-				metadata: { department: 'engineering' },
-			};
-
-			const { refreshToken } = tokenManager.generateTokenPair(originalPayload);
-			const newAccessToken = tokenManager.refreshAccessToken(refreshToken);
-			const decoded = tokenManager.verifyAccessToken(newAccessToken);
-
-			expect(decoded.userId).toBe(originalPayload.userId);
-			expect(decoded.email).toBe(originalPayload.email);
-			expect(decoded.permissions).toEqual(originalPayload.permissions);
-			expect(decoded.metadata).toEqual(originalPayload.metadata);
-		});
-	});
-
-	describe('token expiration handling', () => {
-		it('should correctly identify token expiration status', () => {
-			const { accessToken } = tokenManager.generateTokenPair(userPayload);
-
-			expect(tokenManager.isTokenExpired(accessToken)).toBe(false);
-
-			const expiration = tokenManager.getTokenExpiration(accessToken);
-			expect(expiration).toBeInstanceOf(Date);
-			expect(expiration?.getTime()).toBeGreaterThan(Date.now());
-		});
-
-		it('should handle expired tokens correctly', async () => {
-			vi.useFakeTimers();
-			const shortLivedManager = new TokenManager({
-				accessTokenSecret: 'test-access-secret',
-				refreshTokenSecret: 'test-refresh-secret',
-				accessTokenExpiresIn: '10m',
-			});
-
-			const { accessToken } = shortLivedManager.generateTokenPair(userPayload);
-
-			vi.advanceTimersByTime(1000 * 60 * 16); // Fast-forward time to expire access token
-
-			expect(tokenManager.isTokenExpired(accessToken)).toBe(true);
-
-			vi.useRealTimers();
-		});
-
-		it('should decode tokens without verification', () => {
-			const { accessToken } = tokenManager.generateTokenPair(userPayload);
-
-			const decoded = tokenManager.decodeToken(accessToken);
-
-			expect(decoded).not.toBeNull();
-			expect(decoded?.userId).toBe(userPayload.userId);
-			expect(decoded?.email).toBe(userPayload.email);
-		});
-	});
-
-	describe('security validation', () => {
-		it('should reject tokens with invalid signatures', () => {
-			const wrongSecretManager = new TokenManager({
-				accessTokenSecret: 'wrong-secret',
-				refreshTokenSecret: 'test-refresh-secret',
-			});
-
-			const { accessToken } = wrongSecretManager.generateTokenPair(userPayload);
-
-			expect(() => {
-				tokenManager.verifyAccessToken(accessToken);
-			}).toThrow('Invalid access token');
-		});
-
-		it('should reject malformed tokens', () => {
-			expect(() => {
-				tokenManager.verifyAccessToken('invalid-token');
-			}).toThrow('Invalid access token');
-
-			expect(() => {
-				tokenManager.verifyRefreshToken('invalid-token');
-			}).toThrow('Invalid refresh token');
-
-			expect(() => {
-				tokenManager.refreshAccessToken('invalid-token');
-			}).toThrow('Invalid refresh token');
-		});
-
-		it('should handle cross-secret validation correctly', () => {
-			const { accessToken, refreshToken } =
-				tokenManager.generateTokenPair(userPayload);
-
-			// Access token should not verify with refresh secret
-			expect(() => {
-				tokenManager.verifyRefreshToken(accessToken);
-			}).toThrow('Invalid refresh token');
-
-			// Refresh token should not verify with access secret
-			expect(() => {
-				tokenManager.verifyAccessToken(refreshToken);
-			}).toThrow('Invalid access token');
-		});
-	});
-
-	describe('configuration flexibility', () => {
-		it('should support custom expiration times', () => {
-			const customManager = new TokenManager({
-				accessTokenSecret: 'test-access-secret',
-				refreshTokenSecret: 'test-refresh-secret',
-				accessTokenExpiresIn: '1h',
-				refreshTokenExpiresIn: '30d',
-			});
-
-			const { accessToken, refreshToken } =
-				customManager.generateTokenPair(userPayload);
-
-			const accessDecoded = customManager.verifyAccessToken(accessToken);
-			const refreshDecoded = customManager.verifyRefreshToken(refreshToken);
-
-			const accessExpTime = (accessDecoded.exp - accessDecoded.iat) * 1000;
-			const refreshExpTime = (refreshDecoded.exp - refreshDecoded.iat) * 1000;
-
-			// Access token should be ~1 hour
-			expect(accessExpTime).toBeGreaterThan(55 * 60 * 1000);
-			expect(accessExpTime).toBeLessThan(65 * 60 * 1000);
-
-			// Refresh token should be ~30 days
-			expect(refreshExpTime).toBeGreaterThan(29 * 24 * 60 * 60 * 1000);
-			expect(refreshExpTime).toBeLessThan(31 * 24 * 60 * 60 * 1000);
-		});
-
-		it('should use default expiration times', () => {
-			const defaultManager = new TokenManager({
-				accessTokenSecret: 'test-access-secret',
-				refreshTokenSecret: 'test-refresh-secret',
-			});
-
-			const { accessToken, refreshToken } =
-				defaultManager.generateTokenPair(userPayload);
-
-			const accessDecoded = defaultManager.verifyAccessToken(accessToken);
-			const refreshDecoded = defaultManager.verifyRefreshToken(refreshToken);
-
-			const accessExpTime = (accessDecoded.exp - accessDecoded.iat) * 1000;
-			const refreshExpTime = (refreshDecoded.exp - refreshDecoded.iat) * 1000;
-
-			// Default access token should be ~15 minutes
-			expect(accessExpTime).toBeGreaterThan(14 * 60 * 1000);
-			expect(accessExpTime).toBeLessThan(16 * 60 * 1000);
-
-			// Default refresh token should be ~7 days
-			expect(refreshExpTime).toBeGreaterThan(6 * 24 * 60 * 60 * 1000);
-			expect(refreshExpTime).toBeLessThan(8 * 24 * 60 * 60 * 1000);
-		});
-	});
-
-	describe('edge cases and error handling', () => {
-		it('should handle empty payload gracefully', () => {
-			const emptyPayload = { userId: '' };
-
-			const { accessToken, refreshToken } =
-				tokenManager.generateTokenPair(emptyPayload);
-
-			const accessDecoded = tokenManager.verifyAccessToken(accessToken);
-			const refreshDecoded = tokenManager.verifyRefreshToken(refreshToken);
-
-			expect(accessDecoded.userId).toBe('');
-			expect(refreshDecoded.userId).toBe('');
-		});
-
-		it('should handle large payloads correctly', () => {
-			const largePayload = {
-				userId: 'user123',
-				permissions: Array.from({ length: 100 }, (_, i) => `permission_${i}`),
-				metadata: {
-					department: 'engineering',
-					team: 'platform',
-					projects: Array.from({ length: 50 }, (_, i) => `project_${i}`),
-				},
-			};
-
-			const { accessToken, refreshToken } =
-				tokenManager.generateTokenPair(largePayload);
-
-			const accessDecoded = tokenManager.verifyAccessToken(accessToken);
-			const refreshDecoded = tokenManager.verifyRefreshToken(refreshToken);
-
-			expect(accessDecoded.userId).toBe(largePayload.userId);
-			expect(accessDecoded.permissions).toEqual(largePayload.permissions);
-			expect(accessDecoded.metadata).toEqual(largePayload.metadata);
-			expect(refreshDecoded.userId).toBe(largePayload.userId);
-			expect(refreshDecoded.permissions).toEqual(largePayload.permissions);
-			expect(refreshDecoded.metadata).toEqual(largePayload.metadata);
-		});
-
-		it('should return null for completely invalid tokens', () => {
-			expect(tokenManager.decodeToken('')).toBeNull();
-			expect(tokenManager.decodeToken('not.a.token')).toBeNull();
-			expect(tokenManager.decodeToken('invalid-token')).toBeNull();
-
-			expect(tokenManager.getTokenExpiration('')).toBeNull();
-			expect(tokenManager.getTokenExpiration('not.a.token')).toBeNull();
-			expect(tokenManager.getTokenExpiration('invalid-token')).toBeNull();
-
-			expect(tokenManager.isTokenExpired('')).toBe(true);
-			expect(tokenManager.isTokenExpired('not.a.token')).toBe(true);
-			expect(tokenManager.isTokenExpired('invalid-token')).toBe(true);
-		});
-	});
-});

package/src/cacheTokenStorage.ts

@@ -1,43 +0,0 @@
-import type { Cache } from '@geekmidas/cache';
-import type { TokenStorage } from './client.js';
-
-export class CacheTokenStorage implements TokenStorage {
-	private cache: Cache;
-	private accessTokenKey: string;
-	private refreshTokenKey: string;
-
-	constructor(
-		cache: Cache,
-		accessTokenKey: string = 'access_token',
-		refreshTokenKey: string = 'refresh_token',
-	) {
-		this.cache = cache;
-		this.accessTokenKey = accessTokenKey;
-		this.refreshTokenKey = refreshTokenKey;
-	}
-
-	async getAccessToken(): Promise<string | null> {
-		const token = await this.cache.get<string>(this.accessTokenKey);
-		return token ?? null;
-	}
-
-	async setAccessToken(token: string, ttl?: number): Promise<void> {
-		await this.cache.set(this.accessTokenKey, token, ttl);
-	}
-
-	async getRefreshToken(): Promise<string | null> {
-		const token = await this.cache.get<string>(this.refreshTokenKey);
-		return token ?? null;
-	}
-
-	async setRefreshToken(token: string, ttl?: number): Promise<void> {
-		await this.cache.set(this.refreshTokenKey, token, ttl);
-	}
-
-	async clearTokens(): Promise<void> {
-		await Promise.all([
-			this.cache.delete(this.accessTokenKey),
-			this.cache.delete(this.refreshTokenKey),
-		]);
-	}
-}