@monster-orange/den 0.0.0 → 0.1.0

package/src/shared/auth/token-injection.ts

@@ -0,0 +1,184 @@
+/**
+ * Token Injection Helper
+ * Inject JWT tokens directly into browser storage to bypass Auth0 OAuth flow
+ * This allows fast, headless testing without waiting for redirects
+ */
+
+import type { Page, BrowserContext } from "@playwright/test";
+import type { TokenSet } from "../types/index.js";
+import type { Auth0Helper } from "./auth0-helper.js";
+
+/**
+ * Inject Auth0 tokens into browser localStorage
+ * This simulates a logged-in session without going through the OAuth flow
+ *
+ * @param page - Playwright page object
+ * @param tokens - JWT tokens from Auth0 password grant
+ * @param baseUrl - Base URL of the app (needed for localStorage scope)
+ */
+export async function injectAuth0Tokens(
+  page: Page,
+  tokens: TokenSet,
+  baseUrl: string,
+): Promise<void> {
+  // First, navigate to the base URL so localStorage is scoped correctly
+  await page.goto(baseUrl);
+
+  // Inject tokens into localStorage in the format Auth0 SPA SDK expects
+  await page.evaluate(
+    ({ accessToken, idToken, refreshToken, expiresIn }) => {
+      // Auth0 SPA SDK storage format
+      const auth0Key = `@@auth0spajs@@::${window.location.origin}`;
+
+      const expiresAt = Date.now() + (expiresIn || 3600) * 1000;
+
+      const auth0Data = {
+        body: {
+          access_token: accessToken,
+          id_token: idToken,
+          refresh_token: refreshToken,
+          expires_in: expiresIn || 3600,
+          token_type: "Bearer",
+          scope: "openid profile email",
+        },
+        expiresAt,
+      };
+
+      // Store in localStorage
+      localStorage.setItem(auth0Key, JSON.stringify(auth0Data));
+
+      // Also store id_token separately (some apps check this)
+      localStorage.setItem("id_token", idToken || "");
+      localStorage.setItem("access_token", accessToken);
+
+      console.log("✓ Auth0 tokens injected into localStorage");
+    },
+    {
+      accessToken: tokens.access_token,
+      idToken: tokens.id_token,
+      refreshToken: tokens.refresh_token,
+      expiresIn: tokens.expires_in,
+    },
+  );
+}
+
+/**
+ * Inject Auth0 session via API callback (for Next.js with @auth0/nextjs-auth0)
+ * This approach calls the Next.js auth callback endpoint to establish a session
+ *
+ * @param context - Playwright browser context
+ * @param tokens - JWT tokens from Auth0 password grant
+ * @param baseUrl - Base URL of the app
+ */
+export async function injectAuth0Session(
+  context: BrowserContext,
+  tokens: TokenSet,
+  baseUrl: string,
+): Promise<void> {
+  // Create a new page for API call
+  const page = await context.newPage();
+
+  try {
+    // Call the Next.js auth callback endpoint with the code
+    // This establishes the session and sets HTTP-only cookies
+    const response = await page.request.post(`${baseUrl}/api/auth/callback`, {
+      data: {
+        code: tokens.access_token, // Some implementations use the access token
+        state: "test-state",
+      },
+      failOnStatusCode: false,
+    });
+
+    if (response.ok()) {
+      console.log("✓ Auth0 session established via API callback");
+    } else {
+      console.warn(
+        `⚠️  Auth callback returned status ${response.status()}, falling back to localStorage`,
+      );
+      // Fallback to localStorage injection
+      await injectAuth0Tokens(page, tokens, baseUrl);
+    }
+  } catch (error) {
+    console.warn(
+      `⚠️  Auth callback failed: ${(error as Error).message}, falling back to localStorage`,
+    );
+    // Fallback to localStorage injection
+    await injectAuth0Tokens(page, tokens, baseUrl);
+  } finally {
+    await page.close();
+  }
+}
+
+/**
+ * Setup authenticated browser context with JWT tokens
+ * This is the main entry point for tests - gets tokens and injects them
+ *
+ * @param page - Playwright page object
+ * @param username - User email
+ * @param password - User password
+ * @param auth0Helper - Auth0 helper instance
+ * @param baseUrl - Base URL of the app
+ */
+export async function setupAuthenticatedPage(
+  page: Page,
+  username: string,
+  password: string,
+  auth0Helper: Auth0Helper,
+  baseUrl: string,
+): Promise<TokenSet> {
+  // Get JWT tokens programmatically (no browser flow)
+  console.log(`🔐 Getting JWT tokens for ${username}...`);
+  const tokens = await auth0Helper.loginWithPassword(username, password);
+  console.log("✓ JWT tokens received");
+
+  // Inject tokens into browser
+  await injectAuth0Tokens(page, tokens, baseUrl);
+
+  return tokens;
+}
+
+/**
+ * Check if page has valid auth tokens in storage
+ */
+export async function hasValidAuthTokens(page: Page): Promise<boolean> {
+  return await page.evaluate(() => {
+    // Check for Auth0 SPA SDK storage
+    const auth0Keys = Object.keys(localStorage).filter((key) =>
+      key.includes("@@auth0spajs@@"),
+    );
+
+    if (auth0Keys.length === 0) {
+      return false;
+    }
+
+    // Check if tokens are expired
+    try {
+      const auth0Data = JSON.parse(localStorage.getItem(auth0Keys[0]) || "{}");
+      const expiresAt = auth0Data.expiresAt || 0;
+      const now = Date.now();
+
+      return now < expiresAt;
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * Clear all auth tokens from browser storage
+ */
+export async function clearAuthTokens(page: Page): Promise<void> {
+  await page.evaluate(() => {
+    // Clear Auth0 SPA SDK storage
+    const auth0Keys = Object.keys(localStorage).filter(
+      (key) => key.includes("auth0") || key.includes("@@auth0spajs@@"),
+    );
+    auth0Keys.forEach((key) => localStorage.removeItem(key));
+
+    // Clear other auth-related items
+    localStorage.removeItem("id_token");
+    localStorage.removeItem("access_token");
+
+    console.log("✓ Auth tokens cleared from localStorage");
+  });
+}

package/src/shared/auth/token-providers/auth0.ts

@@ -0,0 +1,80 @@
+/**
+ * Auth0 Resource Owner Password grant — the `auth0` token provider's mint.
+ *
+ * Reads the Auth0 domain, clientId and audience from the environment's
+ * `auth0` block in config/environments/<env>.json. No caching here — callers
+ * decide whether to persist the token.
+ */
+
+import { envSelector } from "../../environment/env-selector.js";
+import type { Environment } from "../../types/index.js";
+
+interface RopcResponse {
+  access_token: string;
+  token_type: string;
+  expires_in: number;
+  error?: string;
+  error_description?: string;
+}
+
+/** Mint a fresh Auth0 access token via Resource Owner Password Credentials. */
+export async function mintAuth0JWT(
+  env: Environment,
+  username: string,
+  password: string,
+  options: { clientSecret?: string } = {},
+): Promise<{ accessToken: string; expiresIn: number; tokenType: string }> {
+  const envConfig = await envSelector.loadEnvironment(env);
+  if (!envConfig.auth0) {
+    throw new Error(
+      `auth0 block is not set in config/environments/${env}.json`,
+    );
+  }
+  const { domain, clientId, audience } = envConfig.auth0;
+
+  if (!audience) {
+    throw new Error(
+      `auth0.audience is not set in config/environments/${env}.json`,
+    );
+  }
+
+  const body: Record<string, string> = {
+    grant_type: "password",
+    username,
+    password,
+    audience,
+    scope: "openid profile email",
+    client_id: clientId,
+    realm: process.env.E2E_AUTH0_REALM ?? "Username-Password-Authentication",
+  };
+
+  // client_secret is optional for public SPA clients; required for
+  // confidential ones. Callers may pass it explicitly (memory-only paths
+  // that must not mutate process.env); the env var remains the default.
+  const clientSecret =
+    options.clientSecret ?? process.env.E2E_AUTH0_CLIENT_SECRET;
+  if (clientSecret) body.client_secret = clientSecret;
+
+  const response = await fetch(`https://${domain}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(15000),
+  });
+
+  const data = (await response.json()) as RopcResponse;
+
+  if (!response.ok || data.error) {
+    const desc =
+      data.error_description ?? data.error ?? `HTTP ${response.status}`;
+    throw new Error(
+      `Auth0 ROPC failed for "${username}" (${env}): ${data.error ?? response.status} — ${desc}`,
+    );
+  }
+
+  return {
+    accessToken: data.access_token,
+    expiresIn: data.expires_in,
+    tokenType: data.token_type,
+  };
+}

package/src/shared/auth/token-providers/index.ts

@@ -0,0 +1,182 @@
+/**
+ * Token-provider strategy — how Den mints a bearer token for a test user.
+ *
+ * Selected per environment by `auth.provider` in config/environments/<env>.json:
+ *
+ *   auth0      Resource Owner Password grant against an Auth0 tenant
+ *   cognito    AWS Cognito InitiateAuth (USER_PASSWORD_AUTH) over HTTPS — no SDK
+ *   local-jwt  self-signed HS256 token for local stacks that trust a shared secret
+ *   none       environment has no auth; minting throws
+ *
+ * When `auth` is omitted, an `auth0` block implies "auth0", else "none".
+ * Adding a provider = implement TokenProvider and register it in PROVIDERS.
+ */
+import jwt from "jsonwebtoken";
+import { envSelector } from "../../environment/env-selector.js";
+import { getSecretsProvider } from "../../secrets/index.js";
+import type {
+  AuthProviderName,
+  EnvironmentConfig,
+  Environment,
+} from "../../types/index.js";
+import { mintAuth0JWT } from "./auth0.js";
+
+export interface MintedToken {
+  accessToken: string;
+  expiresIn: number;
+  tokenType: string;
+}
+
+export interface MintOptions {
+  clientSecret?: string;
+  fetchImpl?: typeof fetch;
+  env?: NodeJS.ProcessEnv;
+}
+
+export interface TokenProvider {
+  readonly name: AuthProviderName;
+  mint(
+    envConfig: EnvironmentConfig,
+    username: string,
+    password: string,
+    options?: MintOptions,
+  ): Promise<MintedToken>;
+}
+
+export function resolveAuthProviderName(
+  cfg: EnvironmentConfig,
+): AuthProviderName {
+  return cfg.auth?.provider ?? (cfg.auth0 ? "auth0" : "none");
+}
+
+const auth0Provider: TokenProvider = {
+  name: "auth0",
+  mint: (cfg, u, p, o = {}) =>
+    mintAuth0JWT(cfg.name as Environment, u, p, {
+      clientSecret: o.clientSecret,
+    }),
+};
+
+interface CognitoAuthResult {
+  AuthenticationResult?: {
+    AccessToken?: string;
+    IdToken?: string;
+    ExpiresIn?: number;
+    TokenType?: string;
+  };
+  ChallengeName?: string;
+  __type?: string;
+  message?: string;
+}
+
+const cognitoProvider: TokenProvider = {
+  name: "cognito",
+  async mint(cfg, username, password, o = {}) {
+    const c = cfg.auth?.cognito;
+    if (!c) throw new Error(`auth.cognito is not set for ${cfg.name}`);
+    const res = await (o.fetchImpl ?? fetch)(
+      `https://cognito-idp.${c.region}.amazonaws.com/`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-amz-json-1.1",
+          "X-Amz-Target": "AWSCognitoIdentityProviderService.InitiateAuth",
+        },
+        body: JSON.stringify({
+          AuthFlow: "USER_PASSWORD_AUTH",
+          ClientId: c.clientId,
+          AuthParameters: { USERNAME: username, PASSWORD: password },
+        }),
+        signal: AbortSignal.timeout(15_000),
+      },
+    );
+    const data = (await res.json()) as CognitoAuthResult;
+    const r = data.AuthenticationResult;
+    const token = c.useIdToken ? r?.IdToken : r?.AccessToken;
+    if (!res.ok || !token) {
+      const why = data.ChallengeName
+        ? `challenge ${data.ChallengeName} (complete it once in the hosted UI)`
+        : `${data.__type ?? res.status} — ${data.message ?? "no token returned"}`;
+      throw new Error(
+        `Cognito login failed for "${username}" (${cfg.name}): ${why}`,
+      );
+    }
+    return {
+      accessToken: token,
+      expiresIn: r?.ExpiresIn ?? 3600,
+      tokenType: r?.TokenType ?? "Bearer",
+    };
+  },
+};
+
+const localJwtProvider: TokenProvider = {
+  name: "local-jwt",
+  async mint(cfg, username, _password, o = {}) {
+    const l = cfg.auth?.localJwt;
+    if (!l) throw new Error(`auth.localJwt is not set for ${cfg.name}`);
+    const env = o.env ?? process.env;
+    const secret =
+      env[l.secretKey] ??
+      (await getSecretsProvider().tryGet({
+        vault: "",
+        item: "",
+        field: l.secretKey,
+        key: l.secretKey,
+      }));
+    if (!secret) {
+      throw new Error(
+        `local-jwt signing secret ${l.secretKey} not found in env or the secrets backend`,
+      );
+    }
+    const ttl = l.ttlSeconds ?? 3600;
+    const claims = { email: username, ...l.claims };
+    const accessToken = jwt.sign(claims, secret, {
+      algorithm: "HS256",
+      // A configured `sub` claim (e.g. a user id) wins over the username.
+      ...("sub" in claims ? {} : { subject: username }),
+      expiresIn: ttl,
+      ...(l.issuer ? { issuer: l.issuer } : {}),
+      ...(l.audience ? { audience: l.audience } : {}),
+    });
+    return { accessToken, expiresIn: ttl, tokenType: "Bearer" };
+  },
+};
+
+const noneProvider: TokenProvider = {
+  name: "none",
+  async mint(cfg) {
+    throw new Error(
+      `Environment ${cfg.name} has no auth provider configured (auth.provider: none). ` +
+        `Set auth.provider in config/environments/${cfg.name}.json.`,
+    );
+  },
+};
+
+const PROVIDERS: Record<AuthProviderName, TokenProvider> = {
+  auth0: auth0Provider,
+  cognito: cognitoProvider,
+  "local-jwt": localJwtProvider,
+  none: noneProvider,
+};
+
+export function getTokenProvider(name: AuthProviderName): TokenProvider {
+  const p = PROVIDERS[name];
+  if (!p) throw new Error(`Unknown auth provider "${String(name)}"`);
+  return p;
+}
+
+/** Mint a token for `env` with whatever provider that environment configures. */
+export async function mintAccessToken(
+  env: Environment,
+  username: string,
+  password: string,
+  options: MintOptions = {},
+): Promise<MintedToken> {
+  const cfg = await envSelector.loadEnvironment(env);
+  return getTokenProvider(resolveAuthProviderName(cfg)).mint(
+    cfg,
+    username,
+    password,
+    options,
+  );
+}