@mimik/api-helper 2.0.7 → 2.0.8

package/test/securityHandlers.test.js

@@ -0,0 +1,557 @@
+import esmock from 'esmock';
+import { expect } from 'chai';
+import jwtReal from 'jsonwebtoken';
+
+const TOKEN_PARAMS = {
+  userId: 'userId',
+  onBehalfId: 'onBehalfId',
+  appId: 'appId',
+  clientId: 'clientId',
+  customer: 'customer',
+  onBehalf: 'onBehalf',
+  tokenType: 'tokenType',
+  cluster: 'cluster',
+  claims: 'claims',
+};
+
+const SECRET = 'test-secret';
+
+const makeToken = payload => jwtReal.sign(payload, SECRET);
+
+const makeConfig = (overrides = {}) => ({
+  security: {
+    server: { audience: 'test-audience', issuer: 'test-issuer', accessKey: SECRET },
+    generic: { audience: 'noGeneric', key: 'noGeneric' },
+    admin: { externalId: 'admin-ext-id' },
+    apiKeys: ['valid-key-1', 'valid-key-2'],
+    ...overrides,
+  },
+  serverSettings: { id: 'test-server' },
+});
+
+const makeConReq = (token, securityType, scopes = []) => {
+  const request = {};
+  const con = {
+    request,
+    operation: { security: [{ [securityType]: scopes }] },
+    api: { definition: { components: { schemas: {} } } },
+  };
+  const req = {
+    headers: { Authorization: `Bearer ${token}` },
+  };
+
+  return { con, req, request };
+};
+
+let securityLib;
+
+describe('securityHandlers', () => {
+  before(async () => {
+    const mod = await esmock('../lib/securityHandlers.js', {
+      '@mimik/swagger-helper': { TOKEN_PARAMS },
+    });
+
+    ({ securityLib } = mod);
+  });
+
+  describe('AdminSecurity', () => {
+    describe('mock', () => {
+      it('should set dummy values on req and request and return true', () => {
+        const { AdminSecurity } = securityLib(makeConfig());
+        const request = {};
+        const con = { request };
+        const req = {};
+
+        const result = AdminSecurity.mock(con, req);
+        expect(result).to.equal(true);
+        expect(req.claims).to.deep.equal(['dummyClaims']);
+        expect(req.tokenType).to.equal('admin');
+        expect(req.clientId).to.equal('dummyClientId');
+        expect(req.customer).to.equal('dummyCustomer');
+        expect(request.claims).to.deep.equal(['dummyClaims']);
+      });
+    });
+
+    describe('regular', () => {
+      it('should throw 401 when headers are missing', () => {
+        const { AdminSecurity } = securityLib(makeConfig());
+        const con = { request: {} };
+        const req = {};
+
+        expect(() => AdminSecurity.regular(con, req)).to.throw('missing header');
+      });
+
+      it('should throw 401 when Authorization header is missing', () => {
+        const { AdminSecurity } = securityLib(makeConfig());
+        const con = { request: {} };
+        const req = { headers: {} };
+
+        expect(() => AdminSecurity.regular(con, req)).to.throw('missing authorization header');
+      });
+
+      it('should throw 401 when bearer format is wrong', () => {
+        const { AdminSecurity } = securityLib(makeConfig());
+        const con = { request: {} };
+        const req = { headers: { Authorization: 'Basic abc123' } };
+
+        expect(() => AdminSecurity.regular(con, req)).to.throw('authorization type incorrect');
+      });
+
+      it('should throw 403 when token subType is not admin or subAdmin', () => {
+        const token = makeToken({ subType: 'user', sub: 'test', scope: 'read' });
+        const { con, req } = makeConReq(token, 'AdminSecurity');
+        const { AdminSecurity } = securityLib(makeConfig());
+
+        expect(() => AdminSecurity.regular(con, req)).to.throw('invalid token: wrong type');
+      });
+
+      it('should throw 403 when subAdmin token has no customer', () => {
+        const token = makeToken({ subType: 'subAdmin', sub: 'test', scope: 'read' });
+        const { con, req } = makeConReq(token, 'AdminSecurity');
+        const { AdminSecurity } = securityLib(makeConfig());
+
+        expect(() => AdminSecurity.regular(con, req)).to.throw('invalid token: no customer');
+      });
+
+      it('should throw 403 when admin subject does not match', () => {
+        const token = makeToken({ subType: 'admin', sub: 'wrong@clients', scope: 'read' });
+        const { con, req } = makeConReq(token, 'AdminSecurity');
+        const { AdminSecurity } = securityLib(makeConfig());
+
+        expect(() => AdminSecurity.regular(con, req)).to.throw('jwt subject invalid');
+      });
+
+      it('should succeed for valid admin token', () => {
+        const token = makeToken({
+          subType: 'admin',
+          sub: 'admin-ext-id@clients',
+          scope: 'test:resource',
+          aud: 'test-audience',
+          iss: 'test-issuer',
+        });
+        const { con, req } = makeConReq(token, 'AdminSecurity', ['test:resource']);
+        const { AdminSecurity } = securityLib(makeConfig());
+
+        const result = AdminSecurity.regular(con, req);
+        expect(result).to.equal(true);
+        expect(req.tokenType).to.equal('admin');
+        expect(req.clientId).to.equal('admin-ext-id@clients');
+      });
+
+      it('should succeed for valid subAdmin token with customer', () => {
+        const token = makeToken({
+          subType: 'subAdmin',
+          sub: 'sub-admin@clients',
+          cust: 'customer-123',
+          scope: 'test:resource',
+          aud: 'test-audience',
+          iss: 'test-issuer',
+        });
+        const { con, req } = makeConReq(token, 'AdminSecurity', ['test:resource']);
+        const { AdminSecurity } = securityLib(makeConfig());
+
+        const result = AdminSecurity.regular(con, req);
+        expect(result).to.equal(true);
+        expect(req.customer).to.equal('customer-123');
+        expect(req.tokenType).to.equal('subAdmin');
+      });
+    });
+  });
+
+  describe('SystemSecurity', () => {
+    describe('mock', () => {
+      it('should set dummy values and return true', () => {
+        const { SystemSecurity } = securityLib(makeConfig());
+        const request = {};
+        const con = { request };
+        const req = {};
+
+        const result = SystemSecurity.mock(con, req);
+        expect(result).to.equal(true);
+        expect(req.tokenType).to.equal('dummyServiceType');
+        expect(req.clientId).to.equal('dummyClientId');
+      });
+    });
+
+    describe('regular', () => {
+      it('should throw 403 when token subType is admin', () => {
+        const token = makeToken({ subType: 'admin', sub: 'test', scope: 'read' });
+        const { con, req } = makeConReq(token, 'SystemSecurity');
+        const { SystemSecurity } = securityLib(makeConfig());
+
+        expect(() => SystemSecurity.regular(con, req)).to.throw('invalid token: wrong type');
+      });
+
+      it('should throw 403 when token subType is subAdmin', () => {
+        const token = makeToken({ subType: 'subAdmin', sub: 'test', scope: 'read' });
+        const { con, req } = makeConReq(token, 'SystemSecurity');
+        const { SystemSecurity } = securityLib(makeConfig());
+
+        expect(() => SystemSecurity.regular(con, req)).to.throw('invalid token: wrong type');
+      });
+
+      it('should succeed for valid system token', () => {
+        const token = makeToken({
+          subType: 'service',
+          sub: 'service@clients',
+          scope: 'system:resource',
+          aud: 'test-audience',
+          iss: 'test-issuer',
+        });
+        const { con, req } = makeConReq(token, 'SystemSecurity', ['system:resource']);
+        const { SystemSecurity } = securityLib(makeConfig());
+
+        const result = SystemSecurity.regular(con, req);
+        expect(result).to.equal(true);
+        expect(req.tokenType).to.equal('service');
+        expect(req.clientId).to.equal('service@clients');
+      });
+
+      it('should set cluster flag when token type is cluster', () => {
+        const token = makeToken({
+          subType: 'service',
+          type: 'cluster',
+          sub: 'service@clients',
+          scope: 'system:resource',
+          aud: 'test-audience',
+          iss: 'test-issuer',
+        });
+        const { con, req } = makeConReq(token, 'SystemSecurity', ['system:resource']);
+        const { SystemSecurity } = securityLib(makeConfig());
+
+        SystemSecurity.regular(con, req);
+        expect(req.cluster).to.equal(true);
+      });
+
+      it('should set onBehalf when scope starts with onBehalf', () => {
+        const token = makeToken({
+          subType: 'service',
+          sub: 'service@clients',
+          scope: 'onBehalf:system:resource',
+          aud: 'test-audience',
+          iss: 'test-issuer',
+        });
+        const { con, req } = makeConReq(token, 'SystemSecurity', ['onBehalf:system:resource']);
+        const { SystemSecurity } = securityLib(makeConfig());
+
+        SystemSecurity.regular(con, req);
+        expect(req.onBehalf).to.equal(true);
+      });
+    });
+  });
+
+  describe('UserSecurity', () => {
+    describe('mock', () => {
+      it('should set dummy values and return true', () => {
+        const { UserSecurity } = securityLib(makeConfig());
+        const request = {};
+        const con = { request };
+        const req = {};
+
+        const result = UserSecurity.mock(con, req);
+        expect(result).to.equal(true);
+        expect(req.userId).to.equal('dummyUserId');
+        expect(req.appId).to.equal('dummyAppId');
+        expect(req.tokenType).to.equal('user');
+      });
+    });
+
+    describe('regular', () => {
+      it('should succeed for valid user token', () => {
+        const token = makeToken({
+          sub: 'user-123',
+          azp: 'app-456',
+          scope: 'user:resource',
+          aud: 'test-audience',
+          iss: 'test-issuer',
+        });
+        const { con, req } = makeConReq(token, 'UserSecurity', ['user:resource']);
+        const { UserSecurity } = securityLib(makeConfig());
+
+        const result = UserSecurity.regular(con, req);
+        expect(result).to.equal(true);
+        expect(req.tokenType).to.equal('user');
+        expect(req.userId).to.equal('user-123');
+        expect(req.appId).to.equal('app-456');
+      });
+
+      it('should handle may_act delegation', () => {
+        const token = makeToken({
+          sub: 'delegate-user',
+          // eslint-disable-next-line camelcase
+          may_act: { sub: 'actual-user' },
+          scope: 'user:resource',
+          aud: 'test-audience',
+          iss: 'test-issuer',
+        });
+        const { con, req } = makeConReq(token, 'UserSecurity', ['user:resource']);
+        const { UserSecurity } = securityLib(makeConfig());
+
+        UserSecurity.regular(con, req);
+        expect(req.onBehalfId).to.equal('delegate-user');
+        expect(req.userId).to.equal('actual-user');
+      });
+    });
+  });
+
+  describe('ApiKeySecurity', () => {
+    describe('mock', () => {
+      it('should set dummy apiKey and return true', () => {
+        const { ApiKeySecurity } = securityLib(makeConfig());
+        const request = {};
+        const con = { request };
+        const req = {};
+
+        const result = ApiKeySecurity.mock(con, req);
+        expect(result).to.equal(true);
+        expect(req.apiKey).to.equal('dummyApiKey');
+        expect(request.apiKey).to.equal('dummyApiKey');
+      });
+    });
+
+    describe('regular', () => {
+      it('should accept a valid API key', () => {
+        const { ApiKeySecurity } = securityLib(makeConfig());
+        const request = {};
+        const con = { request };
+        const req = { headers: { apikey: 'valid-key-1' } };
+
+        const result = ApiKeySecurity.regular(con, req);
+        expect(result).to.equal(true);
+        expect(req.apiKey).to.equal('valid-key-1');
+      });
+
+      it('should throw 401 for invalid API key', () => {
+        const { ApiKeySecurity } = securityLib(makeConfig());
+        const request = {};
+        const con = { request };
+        const req = { headers: { apikey: 'bad-key' } };
+
+        expect(() => ApiKeySecurity.regular(con, req)).to.throw('invalid API key');
+      });
+
+      it('should throw 401 when headers are missing', () => {
+        const { ApiKeySecurity } = securityLib(makeConfig());
+        const request = {};
+        const con = { request };
+        const req = {};
+
+        expect(() => ApiKeySecurity.regular(con, req)).to.throw('invalid API key');
+      });
+    });
+  });
+
+  describe('token verification', () => {
+    it('should throw 401 for invalid token (cannot decode)', () => {
+      const { SystemSecurity } = securityLib(makeConfig());
+      const con = { request: {} };
+      const req = { headers: { Authorization: 'Bearer not-a-jwt' } };
+
+      expect(() => SystemSecurity.regular(con, req)).to.throw('invalid token');
+    });
+
+    it('should use generic key when not noGeneric', () => {
+      const genericKey = 'generic-secret';
+
+      const genericToken = jwtReal.sign({
+        subType: 'service',
+        sub: 'svc@clients',
+        scope: 'system:resource',
+        aud: 'generic-audience',
+        iss: 'test-issuer',
+      }, genericKey);
+
+      const config = makeConfig({
+        generic: { audience: 'generic-audience', key: genericKey },
+      });
+      const { SystemSecurity } = securityLib(config);
+      const { con, req } = makeConReq(genericToken, 'SystemSecurity', ['system:resource']);
+      const result = SystemSecurity.regular(con, req);
+      expect(result).to.equal(true);
+    });
+
+    it('should fall back to previousKey on verify failure', () => {
+      const previousKey = 'old-secret';
+      const token = jwtReal.sign({
+        subType: 'service',
+        sub: 'svc@clients',
+        scope: 'system:resource',
+        aud: 'test-audience',
+        iss: 'test-issuer',
+      }, previousKey);
+
+      const config = makeConfig({
+        generic: { audience: 'noGeneric', key: 'noGeneric', previousKey },
+      });
+      const { SystemSecurity } = securityLib(config);
+      const { con, req } = makeConReq(token, 'SystemSecurity', ['system:resource']);
+      const result = SystemSecurity.regular(con, req);
+      expect(result).to.equal(true);
+    });
+
+    it('should throw 403 when both keys fail', () => {
+      const token = jwtReal.sign({
+        subType: 'service',
+        sub: 'svc@clients',
+        scope: 'system:resource',
+      }, 'wrong-key');
+
+      const config = makeConfig({
+        generic: { audience: 'noGeneric', key: 'noGeneric', previousKey: 'also-wrong' },
+      });
+      const { SystemSecurity } = securityLib(config);
+      const { con, req } = makeConReq(token, 'SystemSecurity', ['system:resource']);
+      try {
+        SystemSecurity.regular(con, req);
+        expect.fail('should have thrown');
+      }
+      catch (err) {
+        expect(err.statusCode).to.equal(403);
+      }
+    });
+  });
+
+  describe('scope checking', () => {
+    it('should throw 401 when token has no scope', () => {
+      const token = makeToken({
+        subType: 'service',
+        sub: 'svc@clients',
+        aud: 'test-audience',
+        iss: 'test-issuer',
+      });
+      const { con, req } = makeConReq(token, 'SystemSecurity', ['some:scope']);
+      const { SystemSecurity } = securityLib(makeConfig());
+
+      try {
+        SystemSecurity.regular(con, req);
+        expect.fail('should have thrown');
+      }
+      catch (err) {
+        expect(err.statusCode).to.equal(401);
+        expect(err.message).to.equal('no scope in authorization token');
+      }
+    });
+
+    it('should throw 403 when scopes do not intersect', () => {
+      const token = makeToken({
+        subType: 'service',
+        sub: 'svc@clients',
+        scope: 'other:resource',
+        aud: 'test-audience',
+        iss: 'test-issuer',
+      });
+      const { con, req } = makeConReq(token, 'SystemSecurity', ['required:scope']);
+      const { SystemSecurity } = securityLib(makeConfig());
+
+      try {
+        SystemSecurity.regular(con, req);
+        expect.fail('should have thrown');
+      }
+      catch (err) {
+        expect(err.statusCode).to.equal(403);
+        expect(err.message).to.include('incorrect scopes');
+      }
+    });
+
+    it('should validate claims against definition schemas', () => {
+      const token = makeToken({
+        subType: 'service',
+        sub: 'svc@clients',
+        scope: 'system:resource::name,email',
+        aud: 'test-audience',
+        iss: 'test-issuer',
+      });
+      const { con, req } = makeConReq(token, 'SystemSecurity', ['system:resource']);
+
+      con.api.definition.components.schemas.resourceClaims = {
+        name: { type: 'string' },
+        email: { type: 'string' },
+        phone: { type: 'string' },
+      };
+      const { SystemSecurity } = securityLib(makeConfig());
+
+      const result = SystemSecurity.regular(con, req);
+      expect(result).to.equal(true);
+      expect(req.claims).to.deep.equal(['name', 'email']);
+    });
+
+    it('should throw 403 when claims are not in definition', () => {
+      const token = makeToken({
+        subType: 'service',
+        sub: 'svc@clients',
+        scope: 'system:resource::badClaim',
+        aud: 'test-audience',
+        iss: 'test-issuer',
+      });
+      const { con, req } = makeConReq(token, 'SystemSecurity', ['system:resource']);
+
+      con.api.definition.components.schemas.resourceClaims = {
+        name: { type: 'string' },
+      };
+      const { SystemSecurity } = securityLib(makeConfig());
+
+      try {
+        SystemSecurity.regular(con, req);
+        expect.fail('should have thrown');
+      }
+      catch (err) {
+        expect(err.statusCode).to.equal(403);
+        expect(err.message).to.include('incorrect claims');
+      }
+    });
+
+    it('should throw 500 when claims definition is missing', () => {
+      const token = makeToken({
+        subType: 'service',
+        sub: 'svc@clients',
+        scope: 'system:resource::name',
+        aud: 'test-audience',
+        iss: 'test-issuer',
+      });
+      const { con, req } = makeConReq(token, 'SystemSecurity', ['system:resource']);
+
+      con.api.definition = {};
+      const { SystemSecurity } = securityLib(makeConfig());
+
+      try {
+        SystemSecurity.regular(con, req);
+        expect.fail('should have thrown');
+      }
+      catch (err) {
+        expect(err.statusCode).to.equal(500);
+        expect(err.message).to.include('no definition');
+      }
+    });
+  });
+
+  describe('header checking', () => {
+    it('should handle case-insensitive Authorization header', () => {
+      const token = makeToken({
+        subType: 'service',
+        sub: 'svc@clients',
+        scope: 'system:resource',
+        aud: 'test-audience',
+        iss: 'test-issuer',
+      });
+      const { SystemSecurity } = securityLib(makeConfig());
+      const request = {};
+      const con = {
+        request,
+        operation: { security: [{ SystemSecurity: ['system:resource'] }] },
+        api: { definition: { components: { schemas: {} } } },
+      };
+      const req = { headers: { authorization: `Bearer ${token}` } };
+
+      const result = SystemSecurity.regular(con, req);
+      expect(result).to.equal(true);
+    });
+
+    it('should throw for duplicated authorization headers', () => {
+      const { SystemSecurity } = securityLib(makeConfig());
+      const con = { request: {} };
+      const req = { headers: { Authorization: 'Bearer x', authorization: 'Bearer y' } };
+
+      expect(() => SystemSecurity.regular(con, req)).to.throw('duplicated authorization header');
+    });
+  });
+});

package/.nycrc

@@ -1,4 +0,0 @@
-{
-  "exclude": ["gulpfile.js"],
-  "reporter": ["lcov", "text"]
-}