@idp.global/sdk 19.1.0 → 19.2.1

package/ts_relyingparty/testing.ts

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.js';
 import {
+  OidcAuthorityUnavailableError,
   OidcCompletionError,
   OidcRefreshRefusedError,
   type IOidcAuthorizationOptions,
@@ -60,6 +61,9 @@ interface IIssuedToken {
 
 const randomToken = (): string => plugins.crypto.randomBytes(18).toString('base64url');
 
+/** What `IdpOidcProvider` fails with when a step needs the discovery that has not succeeded. */
+const notDiscovered = (): Error => new Error('The identity provider is not initialized');
+
 /**
  * The provider as `IOidcProvider` sees it. A test adds personas, names the one
  * the next login signs in as (`signInNextAs`), follows the authorization URL
@@ -68,7 +72,9 @@ const randomToken = (): string => plugins.crypto.randomBytes(18).toString('base6
  * their login's state; access tokens introspect for their subject while they
  * live; refresh tokens rotate, and a superseded one coming back revokes its
  * whole family, as idp.global's reuse detection does. Every call is recorded,
- * and each step can be made to fail.
+ * and each step can be made to fail. Discovery as well (`discoveryFailure`):
+ * until an `init` succeeds, the double then answers as `IdpOidcProvider` does
+ * before discovery.
  */
 export class RelyingPartyProviderDouble implements IOidcProvider {
   public readonly requestTimeoutSeconds: number;
@@ -80,7 +86,18 @@ export class RelyingPartyProviderDouble implements IOidcProvider {
   public readonly revocations: Array<{ token: string; hint: TOidcTokenHint }> = [];
   public readonly introspections: Array<{ accessToken: string; subject: string; organizationId: string }> = [];
   public readonly refreshes: string[] = [];
+  /** how often `init` was called, failed or not */
+  public discoveries = 0;
 
+  /**
+   * when set, an `init` before one has succeeded fails with it, and from then
+   * until an `init` succeeds no authorization URL is built, a completion fails
+   * at the token exchange and introspection and refresh fail as unavailable,
+   * as before discovery; such a step is not recorded, as no request of it
+   * reached the provider. Once an `init` has succeeded, discovery stays done,
+   * as with `IdpOidcProvider`
+   */
+  public discoveryFailure?: Error;
   /** when set, the completion of a login fails with it (an `OidcCompletionError` names its stage) */
   public completionFailure?: Error;
   /** when set, every introspection fails with it (an `OidcAuthorityUnavailableError` for an unreachable provider) */
@@ -99,6 +116,9 @@ export class RelyingPartyProviderDouble implements IOidcProvider {
   readonly #codes = new Map<string, IIssuedCode>();
   readonly #tokens = new Map<string, IIssuedToken>();
   #next?: string;
+  /** the double counts as discovered until an `init` fails, and for good once one has succeeded */
+  #discovered = true;
+  #initialized = false;
 
   constructor(optionsArg: IProviderDoubleOptions = {}) {
     this.issuer = new URL(optionsArg.issuer ?? 'https://idp.test').origin;
@@ -172,9 +192,23 @@ export class RelyingPartyProviderDouble implements IOidcProvider {
 
   // ---- IOidcProvider ----
 
-  public async init(): Promise<void> {}
+  public async init(): Promise<void> {
+    this.discoveries += 1;
+    if (this.#initialized) {
+      return;
+    }
+    if (this.discoveryFailure) {
+      this.#discovered = false;
+      throw this.discoveryFailure;
+    }
+    this.#discovered = true;
+    this.#initialized = true;
+  }
 
   public async buildAuthorizationUrl(optionsArg: IOidcAuthorizationOptions): Promise<URL> {
+    if (!this.#discovered) {
+      throw notDiscovered();
+    }
     if (!this.#next) {
       throw new Error('RelyingPartyProviderDouble: name the persona this login signs in as with signInNextAs');
     }
@@ -194,6 +228,9 @@ export class RelyingPartyProviderDouble implements IOidcProvider {
   }
 
   public async completeAuthorization(optionsArg: IOidcCompletionOptions): Promise<IOidcCompletion> {
+    if (!this.#discovered) {
+      throw new OidcCompletionError('token_exchange', notDiscovered());
+    }
     const code = optionsArg.callbackUrl.searchParams.get('code') ?? '';
     const issued = this.#codes.get(code);
     this.#codes.delete(code);
@@ -224,6 +261,9 @@ export class RelyingPartyProviderDouble implements IOidcProvider {
   }
 
   public async revokeToken(tokenArg: string, hintArg: TOidcTokenHint): Promise<void> {
+    if (!this.#discovered) {
+      throw notDiscovered();
+    }
     this.revocations.push({ token: tokenArg, hint: hintArg });
     if (this.revocationFailure) {
       throw this.revocationFailure;
@@ -239,6 +279,9 @@ export class RelyingPartyProviderDouble implements IOidcProvider {
     subject: string;
     organizationId: string;
   }): Promise<IOidcOrganizationObservation> {
+    if (!this.#discovered) {
+      throw new OidcAuthorityUnavailableError('unavailable', notDiscovered());
+    }
     this.introspections.push({ ...optionsArg });
     await this.onIntrospect?.({ ...optionsArg });
     if (this.introspectionFailure) {
@@ -257,6 +300,9 @@ export class RelyingPartyProviderDouble implements IOidcProvider {
   }
 
   public async refreshTokens(refreshTokenArg: string): Promise<IOidcRefreshedTokens> {
+    if (!this.#discovered) {
+      throw new OidcAuthorityUnavailableError('unavailable', notDiscovered());
+    }
     this.refreshes.push(refreshTokenArg);
     await this.onRefresh?.(refreshTokenArg);
     if (this.refreshFailure) {