@o3co/create-auth-provider 0.4.1

package/templates/standalone/tests/did-grant.test.js

@@ -0,0 +1,193 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import crypto from "node:crypto";
+import * as ed from "@noble/ed25519";
+import axios from "axios";
+import { describe, expect, it } from "vitest";
+
+const BASE_URL = process.env.API_BASE_URL || "http://localhost:3000";
+
+const client = axios.create({
+	baseURL: BASE_URL,
+	validateStatus: () => true,
+});
+
+// Helper: generate a valid DID auth request body
+const createDidAuthRequest = async (overrides = {}) => {
+	const privateKey = ed.utils.randomPrivateKey();
+	const publicKey = await ed.getPublicKeyAsync(privateKey);
+
+	const did = "did:example:registry.example.com:org:test";
+	const nonce = crypto.randomUUID();
+	const timestamp = new Date().toISOString();
+	const audience = "https://api.example.com";
+
+	const message = JSON.stringify({ did, timestamp, nonce, audience });
+	const messageBytes = new TextEncoder().encode(message);
+	const signature = await ed.signAsync(messageBytes, privateKey);
+
+	return {
+		grant_type: "did",
+		did,
+		signature: Buffer.from(signature).toString("base64"),
+		message,
+		publicKey: Buffer.from(publicKey).toString("base64"),
+		// Expose internals for test manipulation
+		_privateKey: privateKey,
+		_publicKey: publicKey,
+		_nonce: nonce,
+		...overrides,
+	};
+};
+
+describe("POST /oauth/token grant_type=did", () => {
+	it("returns a JWT access token for a valid DID authentication", async () => {
+		const body = await createDidAuthRequest();
+		const res = await client.post("/oauth/token", body);
+
+		expect(res.status).toBe(200);
+		expect(res.data.access_token).toBeDefined();
+		expect(res.data.token_type).toBe("Bearer");
+		// M2M: no refresh token
+		expect(res.data.refresh_token).toBeUndefined();
+	});
+
+	it("returns 401 for an invalid signature", async () => {
+		const body = await createDidAuthRequest();
+		// Corrupt the signature
+		body.signature = Buffer.from(
+			"invalid-signature-data-that-is-long-enough-to-be-64-bytes-padding!!",
+		).toString("base64");
+
+		const res = await client.post("/oauth/token", body);
+		expect(res.status).toBe(401);
+		expect(res.data.error).toBe("invalid_grant");
+	});
+
+	it("returns 400 for an expired timestamp", async () => {
+		const privateKey = ed.utils.randomPrivateKey();
+		const publicKey = await ed.getPublicKeyAsync(privateKey);
+
+		const did = "did:example:registry.example.com:org:test";
+		// Timestamp 10 minutes ago (exceeds 5 minute max age)
+		const timestamp = new Date(Date.now() - 10 * 60 * 1000).toISOString();
+		const nonce = crypto.randomUUID();
+
+		const message = JSON.stringify({ did, timestamp, nonce });
+		const messageBytes = new TextEncoder().encode(message);
+		const signature = await ed.signAsync(messageBytes, privateKey);
+
+		const res = await client.post("/oauth/token", {
+			grant_type: "did",
+			did,
+			signature: Buffer.from(signature).toString("base64"),
+			message,
+			publicKey: Buffer.from(publicKey).toString("base64"),
+		});
+
+		expect(res.status).toBe(400);
+		expect(res.data.error).toBe("invalid_request");
+		expect(res.data.error_description).toContain("timestamp");
+	});
+
+	it("returns 400 on nonce replay (same nonce used twice)", async () => {
+		const body = await createDidAuthRequest();
+
+		// First request should succeed
+		const res1 = await client.post("/oauth/token", body);
+		expect(res1.status).toBe(200);
+
+		// Second request with the same body (same nonce) should fail
+		const res2 = await client.post("/oauth/token", body);
+		expect(res2.status).toBe(400);
+		expect(res2.data.error).toBe("invalid_request");
+		expect(res2.data.error_description).toContain("nonce");
+	});
+
+	it("returns 400 when required fields are missing", async () => {
+		// Missing did
+		const res1 = await client.post("/oauth/token", {
+			grant_type: "did",
+			signature: "abc",
+			message: "{}",
+		});
+		expect(res1.status).toBe(400);
+		expect(res1.data.error).toBe("invalid_request");
+
+		// Missing signature
+		const res2 = await client.post("/oauth/token", {
+			grant_type: "did",
+			did: "did:example:test",
+			message: "{}",
+		});
+		expect(res2.status).toBe(400);
+
+		// Missing message
+		const res3 = await client.post("/oauth/token", {
+			grant_type: "did",
+			did: "did:example:test",
+			signature: "abc",
+		});
+		expect(res3.status).toBe(400);
+	});
+
+	it("returns 400 when message is not valid JSON", async () => {
+		const res = await client.post("/oauth/token", {
+			grant_type: "did",
+			did: "did:example:test",
+			signature: "abc",
+			message: "not-json",
+			publicKey: "abc",
+		});
+		expect(res.status).toBe(400);
+		expect(res.data.error_description).toContain("valid JSON");
+	});
+
+	it("returns 400 when message.did does not match top-level did", async () => {
+		const res = await client.post("/oauth/token", {
+			grant_type: "did",
+			did: "did:example:one",
+			signature: "abc",
+			message: JSON.stringify({
+				did: "did:example:other",
+				timestamp: new Date().toISOString(),
+				nonce: crypto.randomUUID(),
+			}),
+			publicKey: "abc",
+		});
+		expect(res.status).toBe(400);
+		expect(res.data.error_description).toContain("must match");
+	});
+
+	it("returns 400 when publicKey is missing", async () => {
+		const did = "did:example:test";
+		const message = JSON.stringify({
+			did,
+			timestamp: new Date().toISOString(),
+			nonce: crypto.randomUUID(),
+		});
+
+		const res = await client.post("/oauth/token", {
+			grant_type: "did",
+			did,
+			signature: "abc",
+			message,
+		});
+		expect(res.status).toBe(400);
+		expect(res.data.error_description).toContain("publicKey");
+	});
+});

package/templates/standalone/tests/index.test.js

@@ -0,0 +1,218 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import axios from "axios";
+import jwt from "jsonwebtoken";
+import { describe, expect, it } from "vitest";
+
+const BASE_URL = process.env.API_BASE_URL || "http://localhost:3000";
+const JWT_SECRET = process.env.OAUTH_JWT_SECRET || "your-token-secret";
+
+const client = axios.create({
+	baseURL: BASE_URL,
+	withCredentials: true,
+	validateStatus: () => true,
+});
+
+const _extractCookies = (res) => (res.headers["set-cookie"] ?? []).join("; ");
+
+describe("POST /oauth/introspect", () => {
+	// Helper: self-introspect sends the token as both Bearer credential and body parameter
+	const selfIntrospect = (token, contentType = "application/json") => {
+		const headers = {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": contentType,
+		};
+		const data =
+			contentType === "application/x-www-form-urlencoded"
+				? `token=${encodeURIComponent(token)}`
+				: { token };
+		return client.post("/oauth/introspect", data, { headers });
+	};
+
+	it("returns 401 when no authentication is provided", async () => {
+		const res = await client.post("/oauth/introspect", {});
+		expect(res.status).toBe(401);
+	});
+
+	describe("self-introspect (JSON)", () => {
+		it("returns active: true for a valid JWT", async () => {
+			const token = jwt.sign({ user: { id: 1 }, scopes: ["read"] }, JWT_SECRET, {
+				expiresIn: 60,
+			});
+			const res = await selfIntrospect(token);
+			expect(res.status).toBe(200);
+			expect(res.data.active).toBe(true);
+		});
+
+		it("returns scope as space-separated string per RFC 7662", async () => {
+			const token = jwt.sign({ user: { id: 1 }, scopes: ["read", "write"] }, JWT_SECRET, {
+				expiresIn: 60,
+			});
+			const res = await selfIntrospect(token);
+			expect(res.status).toBe(200);
+			expect(res.data.scope).toBe("read write");
+			expect(res.data.scopes).toBeUndefined();
+		});
+
+		it("returns 401 for an invalid JWT", async () => {
+			const res = await selfIntrospect("invalid.token.here");
+			expect(res.status).toBe(401);
+			expect(res.data.active).toBe(false);
+		});
+
+		it("returns 401 for an expired JWT", async () => {
+			const token = jwt.sign({ user: { id: 1 } }, JWT_SECRET, { expiresIn: -1 });
+			const res = await selfIntrospect(token);
+			expect(res.status).toBe(401);
+			expect(res.data.active).toBe(false);
+		});
+	});
+
+	describe("self-introspect (application/x-www-form-urlencoded)", () => {
+		it("returns active: true for a valid JWT", async () => {
+			const token = jwt.sign({ user: { id: 1 }, scopes: ["read"] }, JWT_SECRET, {
+				expiresIn: 60,
+			});
+			const res = await selfIntrospect(token, "application/x-www-form-urlencoded");
+			expect(res.status).toBe(200);
+			expect(res.data.active).toBe(true);
+		});
+
+		it("returns 401 for an invalid JWT", async () => {
+			const res = await selfIntrospect("invalid.token.here", "application/x-www-form-urlencoded");
+			expect(res.status).toBe(401);
+			expect(res.data.active).toBe(false);
+		});
+
+		it("returns 401 for an expired JWT", async () => {
+			const token = jwt.sign({ user: { id: 1 } }, JWT_SECRET, { expiresIn: -1 });
+			const res = await selfIntrospect(token, "application/x-www-form-urlencoded");
+			expect(res.status).toBe(401);
+			expect(res.data.active).toBe(false);
+		});
+	});
+});
+
+describe("POST /session/login", () => {
+	it("returns 400 when no credentials are provided", async () => {
+		const res = await client.post("/session/login", {});
+		expect(res.status).toBe(400);
+	});
+
+	it("returns 400 when redirect_to has an invalid scheme", async () => {
+		const res = await client.post("/session/login", {
+			username: "testuser",
+			password: "testpass",
+			redirect_to: "javascript:alert(1)",
+		});
+		expect(res.status).toBe(400);
+		expect(res.data.error).toBe("invalid_redirect");
+	});
+
+	it("returns 400 when redirect_to is not a valid URL", async () => {
+		const res = await client.post("/session/login", {
+			username: "testuser",
+			password: "testpass",
+			redirect_to: "not-a-url",
+		});
+		expect(res.status).toBe(400);
+		expect(res.data.error).toBe("invalid_redirect");
+	});
+
+	it("returns 400 when redirect_to exceeds 2048 characters", async () => {
+		const res = await client.post("/session/login", {
+			username: "testuser",
+			password: "testpass",
+			redirect_to: `https://example.com/${"a".repeat(2048)}`,
+		});
+		expect(res.status).toBe(400);
+		expect(res.data.error).toBe("invalid_redirect");
+	});
+
+	it("accepts a valid redirect_to without error", async () => {
+		// redirect_to validation runs before authentication, so even with
+		// invalid credentials, a valid redirect_to should not cause a 400
+		// with error: "invalid_redirect". It should fail with 401 (auth failure).
+		const res = await client.post("/session/login", {
+			username: "testuser",
+			password: "testpass",
+			redirect_to: "http://localhost:3000/oauth/authorize",
+		});
+		expect(res.status).not.toBe(400);
+		expect(res.data.error).not.toBe("invalid_redirect");
+	});
+});
+
+describe("POST /oauth/token", () => {
+	it("returns 401 for grant_type=session without an authenticated session", async () => {
+		const res = await client.post("/oauth/token", "grant_type=session", {
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		});
+		expect(res.status).toBe(401);
+	});
+
+	it("returns 400 for an unsupported grant_type", async () => {
+		const res = await client.post("/oauth/token", "grant_type=unknown", {
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		});
+		expect(res.status).toBe(400);
+	});
+
+	it("returns 400 for grant_type=authorization without a code", async () => {
+		const res = await client.post("/oauth/token", "grant_type=authorization", {
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		});
+		expect(res.status).toBe(400);
+	});
+});
+
+describe("GET /oauth/authorize", () => {
+	it("redirects to login with redirect_to when the session is not authenticated", async () => {
+		const res = await client.get(
+			"/oauth/authorize?response_type=code&client_id=test&redirect_uri=http://localhost:9999/callback",
+			{ maxRedirects: 0 },
+		);
+		expect(res.status).toBe(302);
+		const location = res.headers.location;
+		expect(location).toContain("login");
+		expect(location).toContain("redirect_to=");
+		expect(location).not.toContain("redirect_uri=");
+		// Verify the authorize URL is properly encoded (? and & should be escaped)
+		expect(location).toContain(encodeURIComponent("response_type=code"));
+	});
+});
+
+describe("GET /session/oauth/federation/google", () => {
+	// NOTE: Development config has Google federation disabled (google.enabled: false).
+	// The googleEnabled check runs first and returns 404, so redirect_to validation
+	// tests cannot run in this environment. Validation logic is identical to
+	// POST /session/login and covered by those tests.
+
+	it("returns 404 when Google federation is disabled", async () => {
+		const res = await client.get(
+			"/session/oauth/federation/google?redirect_to=https://localhost:3001",
+		);
+		expect(res.status).toBe(404);
+	});
+
+	it("returns 404 even with invalid redirect_to when Google is disabled", async () => {
+		const res = await client.get(
+			"/session/oauth/federation/google?redirect_to=javascript:alert(1)",
+		);
+		expect(res.status).toBe(404);
+	});
+});