@labdigital/commercetools-mock 2.17.0 → 2.18.0

package/src/oauth/server.test.ts

@@ -1,89 +1,132 @@
-import { describe, it, expect, beforeEach } from 'vitest'
-import express from 'express'
-import supertest from 'supertest'
-import { OAuth2Server } from './server'
-
-describe('OAuth2Server', () => {
-	let app: express.Express
-	let server: OAuth2Server
+import express from "express";
+import supertest from "supertest";
+import { beforeEach, describe, expect, it } from "vitest";
+import { getBaseResourceProperties } from "../helpers";
+import { hashPassword } from "../lib/password";
+import { CustomerRepository } from "../repositories/customer";
+import { AbstractStorage, InMemoryStorage } from "../storage";
+import { OAuth2Server } from "./server";
+
+describe("OAuth2Server", () => {
+	let app: express.Express;
+	let server: OAuth2Server;
+
+	let storage: AbstractStorage;
+	let customerRepository: CustomerRepository;
 
 	beforeEach(() => {
-		server = new OAuth2Server({ enabled: true, validate: false })
-		app = express()
-		app.use(server.createRouter())
-	})
+		server = new OAuth2Server({ enabled: true, validate: false });
+		app = express();
+		app.use(server.createRouter());
+
+		storage = new InMemoryStorage();
+		customerRepository = new CustomerRepository(storage);
+		server.setCustomerRepository(customerRepository);
+	});
 
-	describe('POST /token', () => {
-		it('should return a token for valid client credentials', async () => {
+	describe("POST /token", () => {
+		it("should return a token for valid client credentials", async () => {
 			const response = await supertest(app)
-				.post('/token')
-				.auth('validClientId', 'validClientSecret')
-				.query({ grant_type: 'client_credentials' })
-				.send()
+				.post("/token")
+				.auth("validClientId", "validClientSecret")
+				.query({ grant_type: "client_credentials" })
+				.send();
 
-			const body = await response.body
+			const body = await response.body;
 
-			expect(response.status, JSON.stringify(body)).toBe(200)
-			expect(body).toHaveProperty('access_token')
-		})
+			expect(response.status, JSON.stringify(body)).toBe(200);
+			expect(body).toHaveProperty("access_token");
+		});
 
-		it('should failed on invalid refresh token', async () => {
+		it("should failed on invalid refresh token", async () => {
 			const response = await supertest(app)
-				.post('/token')
-				.auth('validClientId', 'validClientSecret')
-				.query({ grant_type: 'refresh_token', refresh_token: 'invalid' })
-				.send()
+				.post("/token")
+				.auth("validClientId", "validClientSecret")
+				.query({ grant_type: "refresh_token", refresh_token: "invalid" })
+				.send();
 
-			const body = await response.body
+			const body = await response.body;
 
-			expect(response.status, JSON.stringify(body)).toBe(400)
-		})
+			expect(response.status, JSON.stringify(body)).toBe(400);
+		});
 
-		it('should refresh a token', async () => {
+		it("should refresh a token", async () => {
 			const createResponse = await supertest(app)
 				.post(`/my-project/anonymous/token`)
-				.auth('validClientId', 'validClientSecret')
-				.query({ grant_type: 'client_credentials' })
-				.send()
+				.auth("validClientId", "validClientSecret")
+				.query({ grant_type: "client_credentials" })
+				.send();
 
-			const refreshToken = createResponse.body.refresh_token
+			const refreshToken = createResponse.body.refresh_token;
 
 			const response = await supertest(app)
-				.post('/token')
-				.auth('validClientId', 'validClientSecret')
-				.query({ grant_type: 'refresh_token', refresh_token: refreshToken })
-				.send()
+				.post("/token")
+				.auth("validClientId", "validClientSecret")
+				.query({ grant_type: "refresh_token", refresh_token: refreshToken })
+				.send();
 
-			const body = await response.body
+			const body = await response.body;
 
-			expect(response.status, JSON.stringify(body)).toBe(200)
-			expect(body.access_token).not.toBe(createResponse.body.access_token)
-			expect(body.refresh_token).toBeUndefined()
-		})
-	})
+			expect(response.status, JSON.stringify(body)).toBe(200);
+			expect(body.access_token).not.toBe(createResponse.body.access_token);
+			expect(body.refresh_token).toBeUndefined();
+		});
+	});
 
-	describe('POST /:projectKey/anonymous/token', () => {
-		it('should return a token for anonymous access', async () => {
-			const projectKey = 'test-project'
+	describe("POST /:projectKey/anonymous/token", () => {
+		it("should return a token for anonymous access", async () => {
+			const projectKey = "test-project";
 
 			const response = await supertest(app)
 				.post(`/${projectKey}/anonymous/token`)
-				.auth('validClientId', 'validClientSecret')
-				.query({ grant_type: 'client_credentials' })
-				.send()
-
-			expect(response.status).toBe(200)
-			expect(response.body).toHaveProperty('access_token')
-
-			const matches = response.body.scope?.match(
-				/(customer_id|anonymous_id):([^\s]+)/
-			)
-			if (matches) {
-				expect(matches[1]).toBe('anonymous_id')
-				expect(matches[2]).toBeDefined()
-			} else {
-				expect(response.body.scope).toBe('')
-			}
-		})
-	})
-})
+				.auth("validClientId", "validClientSecret")
+				.query({ grant_type: "client_credentials" })
+				.send();
+
+			expect(response.status).toBe(200);
+			expect(response.body).toHaveProperty("access_token");
+			expect(response.body).toEqual({
+				scope: expect.stringMatching(/anonymous_id:([^\s]+)/),
+				access_token: expect.stringMatching(/\S{8,}==$/),
+				refresh_token: expect.stringMatching(/test-project:\S{8,}==$/),
+				expires_in: 172800,
+				token_type: "Bearer",
+			});
+		});
+	});
+
+	describe("POST /:projectKey/customers/token", () => {
+		it("should return a token for customer access", async () => {
+			const projectKey = "test-project";
+
+			storage.add(projectKey, "customer", {
+				...getBaseResourceProperties(),
+				email: "j.doe@example.org",
+				password: hashPassword("password"),
+				addresses: [],
+				authenticationMode: "password",
+				isEmailVerified: true,
+			});
+
+			const response = await supertest(app)
+				.post(`/${projectKey}/customers/token`)
+				.auth("validClientId", "validClientSecret")
+				.query({
+					grant_type: "password",
+					username: "j.doe@example.org",
+					password: "password",
+					scope: `${projectKey}:manage_my_profile`,
+				})
+				.send();
+
+			expect(response.status).toBe(200);
+			expect(response.body).toEqual({
+				scope: expect.stringMatching(/customer_id:([^\s]+)/),
+				access_token: expect.stringMatching(/\S{8,}==$/),
+				refresh_token: expect.stringMatching(/test-project:\S{8,}==$/),
+				expires_in: 172800,
+				token_type: "Bearer",
+			});
+		});
+	});
+});

package/src/oauth/server.ts

@@ -1,66 +1,67 @@
-import auth from 'basic-auth'
-import bodyParser from 'body-parser'
+import { InvalidTokenError } from "@commercetools/platform-sdk";
+import auth from "basic-auth";
+import bodyParser from "body-parser";
 import express, {
 	type NextFunction,
 	type Request,
 	type Response,
-} from 'express'
-import { InvalidTokenError } from '@commercetools/platform-sdk'
+} from "express";
 import {
 	AuthError,
 	CommercetoolsError,
 	InvalidRequestError,
-} from '../exceptions.js'
-import { InvalidClientError, UnsupportedGrantType } from './errors.js'
-import { OAuth2Store } from './store.js'
-import { getBearerToken } from './helpers.js'
-import { CustomerRepository } from '../repositories/customer.js'
-import { hashPassword } from '../lib/password.js'
+} from "~src/exceptions";
+import { hashPassword } from "../lib/password";
+import { CustomerRepository } from "../repositories/customer";
+import { InvalidClientError, UnsupportedGrantType } from "./errors";
+import { getBearerToken } from "./helpers";
+import { OAuth2Store } from "./store";
 
 type AuthRequest = Request & {
-	credentials: {
-		clientId: string
-		clientSecret: string
-	}
-}
+	credentials?: {
+		clientId: string;
+		clientSecret: string;
+	};
+};
 export type Token = {
-	access_token: string
-	token_type: 'Bearer'
-	expires_in: number
-	scope: string
-	refresh_token?: string
-}
+	access_token: string;
+	token_type: "Bearer";
+	expires_in: number;
+	scope: string;
+	refresh_token?: string;
+};
 
 export class OAuth2Server {
-	store: OAuth2Store
-	private customerRepository: CustomerRepository
+	store: OAuth2Store;
+
+	private customerRepository: CustomerRepository;
 
 	constructor(private options: { enabled: boolean; validate: boolean }) {
-		this.store = new OAuth2Store(options.validate)
+		this.store = new OAuth2Store(options.validate);
 	}
 
 	setCustomerRepository(repository: CustomerRepository) {
-		this.customerRepository = repository
+		this.customerRepository = repository;
 	}
 
 	createRouter() {
-		const router = express.Router()
-		router.use(bodyParser.urlencoded({ extended: true }))
-		router.use(this.validateClientCredentials.bind(this))
-		router.post('/token', this.tokenHandler.bind(this))
+		const router = express.Router();
+		router.use(bodyParser.urlencoded({ extended: true }));
+		router.use(this.validateClientCredentials.bind(this));
+		router.post("/token", this.tokenHandler.bind(this));
 		router.post(
-			'/:projectKey/customers/token',
-			this.customerTokenHandler.bind(this)
-		)
+			"/:projectKey/customers/token",
+			this.customerTokenHandler.bind(this),
+		);
 		router.post(
-			'/:projectKey/in-store/key=:storeKey/customers/token',
-			this.inStoreCustomerTokenHandler.bind(this)
-		)
+			"/:projectKey/in-store/key=:storeKey/customers/token",
+			this.inStoreCustomerTokenHandler.bind(this),
+		);
 		router.post(
-			'/:projectKey/anonymous/token',
-			this.anonymousTokenHandler.bind(this)
-		)
-		return router
+			"/:projectKey/anonymous/token",
+			this.anonymousTokenHandler.bind(this),
+		);
+		return router;
 	}
 
 	createMiddleware() {
@@ -68,247 +69,266 @@ export class OAuth2Server {
 			return async (
 				request: Request,
 				response: Response,
-				next: NextFunction
+				next: NextFunction,
 			) => {
-				next()
-			}
+				next();
+			};
 		}
 
 		return async (request: Request, response: Response, next: NextFunction) => {
-			const token = getBearerToken(request)
+			const token = getBearerToken(request);
 			if (!token) {
 				next(
 					new CommercetoolsError<InvalidTokenError>(
 						{
-							code: 'invalid_token',
+							code: "invalid_token",
 							message:
-								'This endpoint requires an access token. You can get one from the authorization server.',
+								"This endpoint requires an access token. You can get one from the authorization server.",
 						},
-						401
-					)
-				)
+						401,
+					),
+				);
 			}
 
 			if (!token || !this.store.validateToken(token)) {
 				next(
 					new CommercetoolsError<InvalidTokenError>(
 						{
-							code: 'invalid_token',
-							message: 'invalid_token',
+							code: "invalid_token",
+							message: "invalid_token",
 						},
-						401
-					)
-				)
+						401,
+					),
+				);
 			}
 
-			next()
-		}
+			next();
+		};
 	}
 
 	async validateClientCredentials(
 		request: AuthRequest,
 		response: Response,
-		next: NextFunction
+		next: NextFunction,
 	) {
-		const authHeader = request.header('Authorization')
+		const authHeader = request.header("Authorization");
 		if (!authHeader) {
 			return next(
 				new CommercetoolsError<InvalidClientError>(
 					{
-						code: 'invalid_client',
+						code: "invalid_client",
 						message:
-							'Please provide valid client credentials using HTTP Basic Authentication.',
+							"Please provide valid client credentials using HTTP Basic Authentication.",
 					},
-					401
-				)
-			)
+					401,
+				),
+			);
 		}
-		const credentials = auth.parse(authHeader)
+		const credentials = auth.parse(authHeader);
 		if (!credentials) {
 			return next(
 				new CommercetoolsError<InvalidClientError>(
 					{
-						code: 'invalid_client',
+						code: "invalid_client",
 						message:
-							'Please provide valid client credentials using HTTP Basic Authentication.',
+							"Please provide valid client credentials using HTTP Basic Authentication.",
 					},
-					400
-				)
-			)
+					400,
+				),
+			);
 		}
 
 		request.credentials = {
 			clientId: credentials.name,
 			clientSecret: credentials.pass,
-		}
+		};
 
-		next()
+		next();
 	}
 
 	async tokenHandler(
 		request: AuthRequest,
 		response: Response,
-		next: NextFunction
+		next: NextFunction,
 	) {
-		const grantType = request.query.grant_type || request.body.grant_type
+		if (!request.credentials) {
+			return next(
+				new CommercetoolsError<InvalidClientError>(
+					{
+						code: "invalid_client",
+						message: "Client credentials are missing.",
+					},
+					401,
+				),
+			);
+		}
+
+		const grantType = request.query.grant_type || request.body.grant_type;
 		if (!grantType) {
 			return next(
 				new CommercetoolsError<InvalidRequestError>(
 					{
-						code: 'invalid_request',
-						message: 'Missing required parameter: grant_type.',
+						code: "invalid_request",
+						message: "Missing required parameter: grant_type.",
 					},
-					400
-				)
-			)
+					400,
+				),
+			);
 		}
 
-		if (grantType === 'client_credentials') {
+		if (grantType === "client_credentials") {
 			const token = this.store.getClientToken(
 				request.credentials.clientId,
 				request.credentials.clientSecret,
-				request.query.scope?.toString()
-			)
-			return response.status(200).send(token)
-		} else if (grantType === 'refresh_token') {
+				request.query.scope?.toString(),
+			);
+			return response.status(200).send(token);
+		} else if (grantType === "refresh_token") {
 			const refreshToken =
-				request.query.refresh_token?.toString() || request.body.refresh_token
+				request.query.refresh_token?.toString() || request.body.refresh_token;
 			if (!refreshToken) {
 				return next(
 					new CommercetoolsError<InvalidRequestError>(
 						{
-							code: 'invalid_request',
-							message: 'Missing required parameter: refresh_token.',
+							code: "invalid_request",
+							message: "Missing required parameter: refresh_token.",
 						},
-						400
-					)
-				)
+						400,
+					),
+				);
 			}
 			const token = this.store.refreshToken(
 				request.credentials.clientId,
 				request.credentials.clientSecret,
-				refreshToken
-			)
+				refreshToken,
+			);
 			if (!token) {
 				return next(
 					new CommercetoolsError<AuthError>(
 						{
 							statusCode: 400,
-							message: 'The refresh token was not found. It may have expired.',
-							error: 'invalid_grant',
+							message: "The refresh token was not found. It may have expired.",
+							error: "invalid_grant",
 							error_description:
-								'The refresh token was not found. It may have expired.',
+								"The refresh token was not found. It may have expired.",
 						},
-						400
-					)
-				)
+						400,
+					),
+				);
 			}
-			return response.status(200).send(token)
+			return response.status(200).send(token);
 		} else {
 			return next(
 				new CommercetoolsError<UnsupportedGrantType>(
 					{
-						code: 'unsupported_grant_type',
+						code: "unsupported_grant_type",
 						message: `Invalid parameter: grant_type: Invalid grant type: ${grantType}`,
 					},
-					400
-				)
-			)
+					400,
+				),
+			);
 		}
 	}
+
 	async customerTokenHandler(
 		request: AuthRequest,
 		response: Response,
-		next: NextFunction
+		next: NextFunction,
 	) {
-		const grantType = request.query.grant_type || request.body.grant_type
+		const projectKey = request.params.projectKey;
+		const grantType = request.query.grant_type || request.body.grant_type;
 		if (!grantType) {
 			return next(
 				new CommercetoolsError<InvalidRequestError>(
 					{
-						code: 'invalid_request',
-						message: 'Missing required parameter: grant_type.',
+						code: "invalid_request",
+						message: "Missing required parameter: grant_type.",
 					},
-					400
-				)
-			)
+					400,
+				),
+			);
 		}
 
-		if (grantType === 'password') {
-			const username = request.query.username || request.body.username
+		if (grantType === "password") {
+			const username = request.query.username || request.body.username;
 			const password = hashPassword(
-				request.query.password || request.body.password
-			)
+				request.query.password || request.body.password,
+			);
 			const scope =
-				request.query.scope?.toString() || request.body.scope?.toString()
+				request.query.scope?.toString() || request.body.scope?.toString();
 
 			const result = this.customerRepository.query(
 				{ projectKey: request.params.projectKey },
 				{
 					where: [`email = "${username}"`, `password = "${password}"`],
-				}
-			)
+				},
+			);
 
 			if (result.count === 0) {
 				return next(
 					new CommercetoolsError<any>(
 						{
-							code: 'invalid_customer_account_credentials',
-							message: 'Customer account with the given credentials not found.',
+							code: "invalid_customer_account_credentials",
+							message: "Customer account with the given credentials not found.",
 						},
-						400
-					)
-				)
+						400,
+					),
+				);
 			}
 
-			const customer = result.results[0]
-			const token = this.store.getCustomerToken(scope, customer.id)
-			return response.status(200).send(token)
+			const customer = result.results[0];
+			const token = this.store.getCustomerToken(projectKey, customer.id, scope);
+			return response.status(200).send(token);
 		}
 	}
 
 	async inStoreCustomerTokenHandler(
 		request: Request,
 		response: Response,
-		next: NextFunction
+		next: NextFunction,
 	) {
 		return next(
 			new CommercetoolsError<InvalidClientError>(
 				{
-					code: 'invalid_client',
-					message: 'Not implemented yet in commercetools-mock',
+					code: "invalid_client",
+					message: "Not implemented yet in commercetools-mock",
 				},
-				401
-			)
-		)
+				401,
+			),
+		);
 	}
 
 	async anonymousTokenHandler(
 		request: Request,
 		response: Response,
-		next: NextFunction
+		next: NextFunction,
 	) {
-		const grantType = request.query.grant_type || request.body.grant_type
+		const projectKey = request.params.projectKey;
+		const grantType = request.query.grant_type || request.body.grant_type;
 		if (!grantType) {
 			return next(
 				new CommercetoolsError<InvalidRequestError>(
 					{
-						code: 'invalid_request',
-						message: 'Missing required parameter: grant_type.',
+						code: "invalid_request",
+						message: "Missing required parameter: grant_type.",
 					},
-					400
-				)
-			)
+					400,
+				),
+			);
 		}
 
-		if (grantType === 'client_credentials') {
+		if (grantType === "client_credentials") {
 			const scope =
-				request.query.scope?.toString() || request.body.scope?.toString()
+				request.query.scope?.toString() || request.body.scope?.toString();
 
-			const anonymous_id = undefined
+			const anonymous_id = undefined;
 
-			const token = this.store.getAnonymousToken(scope, anonymous_id)
-			return response.status(200).send(token)
+			const token = this.store.getAnonymousToken(
+				projectKey,
+				anonymous_id,
+				scope,
+			);
+			return response.status(200).send(token);
 		}
 	}
 }