@ibgib/web-gib 0.0.62 → 0.0.63

package/src/identity/sso/sso-custodian-service.respec.mts.bak

@@ -1,298 +0,0 @@
-import { generateKeyPairSync, createSign } from 'node:crypto';
-import {
-    respecfully,
-    ifWeMight,
-    iReckon,
-    firstOfAll,
-    lastOfAll,
-    ifWe
-} from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
-import { SsoCustodianService } from './sso-custodian-service.mjs';
-import { SsoServerConfig } from './sso-types.mjs';
-import { POOL_ID_CUSTODIAN_MANAGE, POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
-import { createStandardPoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
-
-const maam = `[${import.meta.url}]`, sir = maam;
-
-await respecfully(sir, 'SsoCustodianService', async () => {
-    let mockPrivateKey: any;
-    let mockPublicKeyJwk: any;
-    let originalFetch: any;
-
-    firstOfAll(sir, async () => {
-        // Generate mock RSA key pair
-        const { privateKey, publicKey } = generateKeyPairSync('rsa', {
-            modulusLength: 2048
-        });
-        mockPrivateKey = privateKey;
-
-        // Export public key as JWK
-        mockPublicKeyJwk = publicKey.export({ format: 'jwk' });
-        mockPublicKeyJwk.kid = 'mock-kid-123';
-        mockPublicKeyJwk.alg = 'RS256';
-        mockPublicKeyJwk.use = 'sig';
-
-        // Mock global fetch to return JWKS containing the mock public key
-        originalFetch = (globalThis as any).fetch;
-        (globalThis as any).fetch = async (url: string, options?: any) => {
-            if (url === 'https://www.googleapis.com/oauth2/v3/certs') {
-                return {
-                    ok: true,
-                    status: 200,
-                    json: async () => ({
-                        keys: [mockPublicKeyJwk]
-                    })
-                } as any;
-            }
-            return {
-                ok: false,
-                status: 404,
-                text: async () => 'Not Found'
-            } as any;
-        };
-    });
-
-    lastOfAll(sir, async () => {
-        // Restore global fetch
-        if (originalFetch) {
-            (globalThis as any).fetch = originalFetch;
-        }
-    });
-
-    await ifWe(sir, 'verify dynamic RSA RS256 JWT signature successfully', async () => {
-        const config: SsoServerConfig = {
-            ssoServerKdfSecret: 'mock-kdf-secret',
-            sessionSecret: 'mock-session-secret',
-            providers: {
-                google: {
-                    providerId: 'google',
-                    clientId: 'google-client-id-123',
-                    clientSecret: 'google-client-secret-123',
-                    tokenUrl: 'https://oauth2.googleapis.com/token',
-                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
-                    jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
-                }
-            }
-        };
-
-        const service = new SsoCustodianService(config);
-
-        // 1. Build JWT Header & Payload
-        const header = { alg: 'RS256', kid: 'mock-kid-123', typ: 'JWT' };
-        const payload = {
-            sub: 'user-sub-999',
-            email: 'user@example.com',
-            name: 'John Doe',
-            aud: 'google-client-id-123',
-            iss: 'https://accounts.google.com',
-            exp: Math.floor(Date.now() / 1000) + 3600 // expires in 1 hour
-        };
-
-        const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
-        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
-        const data = `${headerB64}.${payloadB64}`;
-
-        // 2. Sign JWT using private key
-        const sign = createSign('RSA-SHA256');
-        sign.update(data);
-        const signatureB64 = sign.sign(mockPrivateKey, 'base64url');
-
-        const mockJwtToken = `${data}.${signatureB64}`;
-
-        // 3. Verify signature via service
-        const decodedPayload = await service.verifyJwt(mockJwtToken, config.providers.google!);
-
-        iReckon(sir, decodedPayload.sub).isGonnaBe('user-sub-999');
-        iReckon(sir, decodedPayload.email).isGonnaBe('user@example.com');
-        iReckon(sir, decodedPayload.name).isGonnaBe('John Doe');
-    });
-
-    await ifWe(sir, 'fail validation if JWT has invalid signature', async () => {
-        const config: SsoServerConfig = {
-            ssoServerKdfSecret: 'mock-kdf-secret',
-            sessionSecret: 'mock-session-secret',
-            providers: {
-                google: {
-                    providerId: 'google',
-                    clientId: 'google-client-id-123',
-                    clientSecret: 'google-client-secret-123',
-                    tokenUrl: 'https://oauth2.googleapis.com/token',
-                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
-                    jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
-                }
-            }
-        };
-
-        const service = new SsoCustodianService(config);
-
-        const header = { alg: 'RS256', kid: 'mock-kid-123', typ: 'JWT' };
-        const payload = {
-            sub: 'user-sub-999',
-            aud: 'google-client-id-123',
-            exp: Math.floor(Date.now() / 1000) + 3600
-        };
-
-        const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
-        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
-        const data = `${headerB64}.${payloadB64}`;
-
-        // Create signature using a different/unregistered RSA key
-        const { privateKey: badPrivateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
-        const sign = createSign('RSA-SHA256');
-        sign.update(data);
-        const badSignatureB64 = sign.sign(badPrivateKey, 'base64url');
-
-        const badJwtToken = `${data}.${badSignatureB64}`;
-
-        let verifyError: any;
-        try {
-            await service.verifyJwt(badJwtToken, config.providers.google!);
-        } catch (error: any) {
-            verifyError = error;
-        }
-
-        iReckon(sir, verifyError).not.isGonnaBeUndefined();
-        iReckon(sir, verifyError.message).includes('Cryptographic signature verification failed');
-    });
-
-    await ifWe(sir, 'derive server-delegate secret deterministically', async () => {
-        const config: SsoServerConfig = {
-            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
-            sessionSecret: 'session-secret-123',
-            providers: {}
-        };
-        const service = new SsoCustodianService(config);
-
-        const key = 'google:123456789';
-        const nonce1 = 'nonce-abc-123';
-        const nonce2 = 'nonce-def-456';
-
-        const secret1_a = await service.deriveServerDelegateSecret(key, nonce1);
-        const secret1_b = await service.deriveServerDelegateSecret(key, nonce1);
-        const secret2 = await service.deriveServerDelegateSecret(key, nonce2);
-
-        // Identical inputs must yield identical outputs
-        iReckon(sir, secret1_a).isGonnaBe(secret1_b);
-        // Different nonces must yield different outputs
-        iReckon(sir, secret1_a).not.isGonnaBe(secret2);
-        // Derived secrets must be string type with high entropy
-        iReckon(sir, typeof secret1_a).isGonnaBe('string');
-        iReckon(sir, secret1_a.length).isGonnaBe(128); // sha512 output in hex/base64 wrap
-    });
-
-    await ifWe(sir, 'create custodian challenge pool successfully', async () => {
-        const config: SsoServerConfig = {
-            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
-            sessionSecret: 'session-secret-123',
-            providers: {}
-        };
-        const service = new SsoCustodianService(config);
-
-        const key = 'google:123456789';
-        const nonce = 'nonce-abc-123';
-
-        // 1. Create a mock target keystone containing a 'manage' pool
-        const userManageConfig = createStandardPoolConfig({
-            id: POOL_ID_MANAGE,
-            salt: 'user-manage-salt'
-        });
-        userManageConfig.behavior.size = 12; // custom size for verification
-        const mockTargetKeystone = {
-            ib: 'keystone^some-tjp-addr',
-            gib: 'some-gib-value',
-            data: {
-                challengePools: [
-                    {
-                        id: 'manage',
-                        config: userManageConfig,
-                        challenges: { 'chal1': 'val1' }
-                    }
-                ],
-                n: 0
-            }
-        };
-
-        // 2. Mock metaspace and space calls
-        const mockSpace = {};
-        const mockMetaspace = {
-            getLatestAddr: async () => 'latest-keystone-addr',
-            get: async () => ({
-                success: true,
-                ibGibs: [mockTargetKeystone]
-            })
-        };
-
-        const custodianPool = await service.createCustodianChallengePool({
-            providerId: 'google',
-            providerKey: key,
-            userNonce: nonce,
-            keystoneAddr: 'some-tjp-addr',
-            metaspace: mockMetaspace as any,
-            space: mockSpace as any
-        });
-
-        iReckon(sir, custodianPool).not.isGonnaBeUndefined();
-        iReckon(sir, custodianPool.id).willEqual('custodian-manage-google');
-        iReckon(sir, custodianPool.isForeign).isGonnaBeTrue();
-        iReckon(sir, custodianPool.metadata?.providerKey).willEqual(key);
-
-        // Replicated behavior size from parent manage pool config
-        iReckon(sir, custodianPool.config.behavior.size).willEqual(userManageConfig.behavior.size);
-
-        // Structural validation of challenges
-        const challengesCount = Object.keys(custodianPool.challenges).length;
-        iReckon(sir, challengesCount).willEqual(custodianPool.config.behavior.size);
-    });
-
-    await ifWe(sir, 'revoke tokens successfully, making the correct http fetch calls', async () => {
-        const config: SsoServerConfig = {
-            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
-            sessionSecret: 'session-secret-123',
-            providers: {
-                google: {
-                    providerId: 'google',
-                    clientId: 'google-client-id-abc',
-                    clientSecret: 'google-client-secret-abc',
-                    tokenUrl: 'https://oauth2.googleapis.com/token',
-                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo'
-                },
-                github: {
-                    providerId: 'github',
-                    clientId: 'github-client-id-xyz',
-                    clientSecret: 'github-client-secret-xyz',
-                    tokenUrl: 'https://github.com/login/oauth/access_token',
-                    userInfoUrl: 'https://api.github.com/user'
-                }
-            }
-        };
-        const service = new SsoCustodianService(config);
-
-        const originalFetch = globalThis.fetch;
-        let fetchCalls: { url: string, options: any }[] = [];
-        globalThis.fetch = (async (url: any, options: any) => {
-            fetchCalls.push({ url, options });
-            return {
-                ok: true,
-                status: 200,
-                text: async () => 'ok'
-            } as any;
-        }) as any;
-
-        try {
-            // Revoke Google token
-            await service.revokeToken('google', 'google-test-token-123');
-            iReckon(sir, fetchCalls.length).willEqual(1);
-            iReckon(sir, fetchCalls[0].url).includes('google-test-token-123');
-
-            // Revoke GitHub token
-            await service.revokeToken('github', 'github-test-token-456');
-            iReckon(sir, fetchCalls.length).willEqual(2);
-            iReckon(sir, fetchCalls[1].url).includes('/applications/github-client-id-xyz/grant');
-            iReckon(sir, fetchCalls[1].options.method).willEqual('DELETE');
-            iReckon(sir, fetchCalls[1].options.headers['Authorization']).includes('Basic');
-        } finally {
-            globalThis.fetch = originalFetch;
-        }
-    });
-});
-