@ohos-ports/accounter-server 0.1.0-beta.0

package/src/modules/auth/providers/__tests__/auth-context.test.ts

@@ -0,0 +1,461 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import * as jose from 'jose';
+import { GraphQLError } from 'graphql';
+import { AuthContextProvider, handleDevBypassAuth } from '../auth-context.provider.js';
+import type { DBProvider } from '../../../app-providers/db.provider.js';
+
+vi.mock('jose', async () => {
+    return {
+        createRemoteJWKSet: vi.fn(),
+        jwtVerify: vi.fn(),
+    }
+});
+
+describe('AuthContextProvider', () => {
+  let provider: AuthContextProvider;
+  let mockDBProvider: any;
+  let mockEnv: any;
+  let mockRawAuth: any;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    
+    mockDBProvider = {
+      query: vi.fn(),
+    };
+
+    mockEnv = {
+      auth0: {
+        domain: 'test.auth0.com',
+        audience: 'test-audience',
+      },
+    };
+
+    mockRawAuth = {
+        authType: 'jwt',
+        token: 'valid-token',
+    };
+
+    vi.mocked(jose.createRemoteJWKSet).mockReturnValue({} as any);
+
+    provider = new AuthContextProvider(mockEnv, mockRawAuth, mockDBProvider);
+  });
+
+  it('should return null if authType is null', async () => {
+    provider = new AuthContextProvider(mockEnv, { authType: null, token: null }, mockDBProvider);
+    const result = await provider.getAuthContext();
+    expect(result).toBeNull();
+  });
+
+  it('should return null for invalid apiKey', async () => {
+    provider = new AuthContextProvider(mockEnv, { authType: 'apiKey', token: 'key' }, mockDBProvider);
+    mockDBProvider.query.mockResolvedValueOnce({ rows: [] });
+    const result = await provider.getAuthContext();
+    expect(result).toBeNull();
+  });
+
+  describe('JWT Verification', () => {
+    it('should verify JWT and return context if valid', async () => {
+       const mockPayload = {
+         sub: 'auth0|123',
+         exp: 1234567890,
+         email: 'test@example.com',
+         email_verified: false,
+         permissions: [],
+       };
+
+       vi.mocked(jose.jwtVerify).mockResolvedValue({ payload: mockPayload } as any);
+
+       mockDBProvider.query.mockResolvedValue({
+         rowCount: 1,
+         rows: [{ user_id: 'u-1', business_id: 'b-1', role_id: 'admin' }],
+       });
+
+       const result = await provider.getAuthContext();
+
+       expect(jose.createRemoteJWKSet).toHaveBeenCalled();
+       expect(jose.jwtVerify).toHaveBeenCalledWith('valid-token', expect.anything(), {
+         issuer: 'https://test.auth0.com/',
+         audience: 'test-audience',
+       });
+       expect(result).toEqual({
+         authType: 'jwt',
+         token: 'valid-token',
+         user: {
+           userId: 'u-1',
+           roleId: 'admin',
+           email: 'test@example.com',
+           auth0UserId: 'auth0|123',
+           permissions: [],
+           emailVerified: false,
+           permissionsVersion: 0,
+         },
+         tenant: {
+           businessId: 'b-1',
+           roleId: 'admin',
+         },
+         memberships: [{ businessId: 'b-1', roleId: 'admin' }],
+         activeReadScope: { businessIds: ['b-1'] },
+         accessTokenExpiresAt: 1234567890,
+       });
+    });
+
+    it('should return null if JWT verification fails', async () => {
+      vi.mocked(jose.jwtVerify).mockRejectedValue(new Error('Invalid token'));
+
+      const result = await provider.getAuthContext();
+
+      expect(result).toBeNull();
+    });
+
+    it('should return null if user not found in DB', async () => {
+        const mockPayload = {
+            sub: 'auth0|123',
+        };
+   
+        vi.mocked(jose.jwtVerify).mockResolvedValue({ payload: mockPayload } as any);
+   
+        mockDBProvider.query.mockResolvedValue({
+          rowCount: 0,
+          rows: [],
+        });
+   
+        const result = await provider.getAuthContext();
+   
+        expect(result).toBeNull();
+    });
+
+      it('should relink user by verified email when auth0 sub changes', async () => {
+        const mockPayload = {
+          sub: 'google-oauth2|new-subject',
+          exp: 1234567890,
+          email: 'member@example.com',
+          email_verified: true,
+          permissions: [],
+        };
+
+        vi.mocked(jose.jwtVerify).mockResolvedValue({ payload: mockPayload } as any);
+
+        mockDBProvider.query
+          // byAuth0: no rows for the new subject
+          .mockResolvedValueOnce({ rowCount: 0, rows: [] })
+          // byVerifiedEmail: identifies the local user
+          .mockResolvedValueOnce({
+            rowCount: 1,
+            rows: [{ user_id: 'u-42' }],
+          })
+          // relink UPDATE
+          .mockResolvedValueOnce({ rowCount: 2, rows: [] })
+          // byUserId: ALL memberships for the relinked user
+          .mockResolvedValueOnce({
+            rowCount: 2,
+            rows: [
+              { user_id: 'u-42', business_id: 'b-42', role_id: 'employee' },
+              { user_id: 'u-42', business_id: 'b-99', role_id: 'accountant' },
+            ],
+          });
+
+        const result = await provider.getAuthContext();
+
+        expect(mockDBProvider.query).toHaveBeenNthCalledWith(
+          1,
+          expect.stringContaining('WHERE bu.auth0_user_id = $1'),
+          ['google-oauth2|new-subject'],
+        );
+        expect(mockDBProvider.query).toHaveBeenNthCalledWith(
+          2,
+          expect.stringContaining('FROM accounter_schema.invitations i'),
+          ['member@example.com'],
+        );
+        expect(mockDBProvider.query).toHaveBeenNthCalledWith(
+          3,
+          expect.stringContaining('UPDATE accounter_schema.business_users'),
+          ['google-oauth2|new-subject', 'u-42'],
+        );
+        expect(mockDBProvider.query).toHaveBeenNthCalledWith(
+          4,
+          expect.stringContaining('WHERE bu.user_id = $1'),
+          ['u-42'],
+        );
+
+        expect(result).toEqual({
+          authType: 'jwt',
+          token: 'valid-token',
+          user: {
+            userId: 'u-42',
+            roleId: 'employee',
+            email: 'member@example.com',
+            auth0UserId: 'google-oauth2|new-subject',
+            permissions: [],
+            emailVerified: true,
+            permissionsVersion: 0,
+          },
+          tenant: {
+            businessId: 'b-42',
+            roleId: 'employee',
+          },
+          memberships: [
+            { businessId: 'b-42', roleId: 'employee' },
+            { businessId: 'b-99', roleId: 'accountant' },
+          ],
+          activeReadScope: { businessIds: ['b-42', 'b-99'] },
+          accessTokenExpiresAt: 1234567890,
+        });
+      });
+
+     it('should return null if sub claim is missing', async () => {
+        const mockPayload = {}; // No sub
+
+        vi.mocked(jose.jwtVerify).mockResolvedValue({ payload: mockPayload } as any);
+
+        const result = await provider.getAuthContext();
+
+        expect(result).toBeNull();
+    });
+  });
+});
+
+describe('AuthContextProvider read-scope resolution', () => {
+  const makeJwtProvider = (
+    membershipRows: Array<{ user_id: string; business_id: string; role_id: string }>,
+    requestedBusinessScope?: unknown,
+  ) => {
+    const mockDb = {
+      query: vi.fn().mockResolvedValue({ rowCount: membershipRows.length, rows: membershipRows }),
+    } as any;
+    const mockEnv = { auth0: { domain: 'test.auth0.com', audience: 'aud' } } as any;
+    vi.mocked(jose.createRemoteJWKSet).mockReturnValue({} as any);
+    vi.mocked(jose.jwtVerify).mockResolvedValue({
+      payload: { sub: 'auth0|x', exp: 1, email: null, email_verified: false, permissions: [] },
+    } as any);
+    return new AuthContextProvider(
+      mockEnv,
+      { authType: 'jwt', token: 'valid-token', requestedBusinessScope } as any,
+      mockDb,
+    );
+  };
+
+  const membershipRows = [
+    { user_id: 'u-1', business_id: 'b-1', role_id: 'owner' },
+    { user_id: 'u-1', business_id: 'b-2', role_id: 'accountant' },
+  ];
+
+  it('defaults read scope to all memberships when no header is sent', async () => {
+    const result = await makeJwtProvider(membershipRows).getAuthContext();
+    expect(result?.activeReadScope).toEqual({ businessIds: ['b-1', 'b-2'] });
+  });
+
+  it('narrows read scope to a valid requested subset and re-points the tenant', async () => {
+    const result = await makeJwtProvider(membershipRows, {
+      kind: 'valid',
+      businessIds: ['b-2'],
+    }).getAuthContext();
+    expect(result?.activeReadScope).toEqual({ businessIds: ['b-2'] });
+    // tenant re-points to the scoped business so consumers reading
+    // tenant.businessId directly do not operate on the out-of-scope primary
+    expect(result?.tenant.businessId).toBe('b-2');
+    expect(result?.tenant.roleId).toBe('accountant');
+  });
+
+  it('keeps the primary tenant when it remains within a multi-business scope', async () => {
+    const result = await makeJwtProvider(membershipRows, {
+      kind: 'valid',
+      businessIds: ['b-2', 'b-1'],
+    }).getAuthContext();
+    expect(result?.activeReadScope).toEqual({ businessIds: ['b-2', 'b-1'] });
+    // primary (b-1) is still in scope, so the tenant is unchanged
+    expect(result?.tenant.businessId).toBe('b-1');
+    expect(result?.tenant.roleId).toBe('owner');
+  });
+
+  it('re-points to the first scoped business when the primary is outside a multi-business scope', async () => {
+    const rows = [
+      { user_id: 'u-1', business_id: 'b-1', role_id: 'owner' },
+      { user_id: 'u-1', business_id: 'b-2', role_id: 'accountant' },
+      { user_id: 'u-1', business_id: 'b-3', role_id: 'employee' },
+    ];
+    const result = await makeJwtProvider(rows, {
+      kind: 'valid',
+      businessIds: ['b-2', 'b-3'],
+    }).getAuthContext();
+    expect(result?.activeReadScope).toEqual({ businessIds: ['b-2', 'b-3'] });
+    // primary (b-1) is out of scope → first scoped business becomes the tenant
+    expect(result?.tenant.businessId).toBe('b-2');
+    expect(result?.tenant.roleId).toBe('accountant');
+  });
+
+  it('rejects a requested scope outside the user memberships', async () => {
+    await expect(
+      makeJwtProvider(membershipRows, {
+        kind: 'valid',
+        businessIds: ['b-1', 'b-999'],
+      }).getAuthContext(),
+    ).rejects.toMatchObject({
+      extensions: { code: 'FORBIDDEN' },
+    });
+  });
+
+  it('rejects a malformed scope header', async () => {
+    await expect(
+      makeJwtProvider(membershipRows, {
+        kind: 'invalid',
+        errors: [{ code: 'INVALID_UUID', value: 'nope' }],
+      }).getAuthContext(),
+    ).rejects.toMatchObject({
+      extensions: { code: 'FORBIDDEN' },
+    });
+  });
+
+  it('does not expand scope beyond memberships (no super-admin auto-expansion)', async () => {
+    const result = await makeJwtProvider([
+      { user_id: 'u-1', business_id: 'b-1', role_id: 'owner' },
+    ]).getAuthContext();
+    expect(result?.activeReadScope).toEqual({ businessIds: ['b-1'] });
+  });
+
+  it('pins API-key scope to its business and ignores the header', async () => {
+    const mockDb = {
+      query: vi
+        .fn()
+        .mockResolvedValueOnce({
+          rows: [{ id: 'k1', business_id: 'biz-1', role_id: 'scraper' }],
+        })
+        .mockResolvedValueOnce({ rowCount: 1 }),
+    } as any;
+    const provider = new AuthContextProvider(
+      { auth0: { domain: 'd', audience: 'a' } } as any,
+      {
+        authType: 'apiKey',
+        token: 'key',
+        requestedBusinessScope: { kind: 'valid', businessIds: ['biz-2'] },
+      } as any,
+      mockDb,
+    );
+
+    const result = await provider.getAuthContext();
+
+    expect(result?.tenant.businessId).toBe('biz-1');
+    expect(result?.activeReadScope).toEqual({ businessIds: ['biz-1'] });
+  });
+});
+
+describe('handleDevBypassAuth', () => {
+  it('returns devBypass auth context when user exists', async () => {
+    const db = {
+      query: vi.fn().mockResolvedValue({
+        rows: [
+          {
+            user_id: 'user-123',
+            business_id: 'biz-456',
+            role_id: 'business_owner',
+            auth0_user_id: 'auth0|demo',
+          },
+        ],
+      }),
+    } as unknown as Pick<DBProvider, 'query'>;
+
+    const result = await handleDevBypassAuth(db, 'user-123');
+
+    expect(db.query).toHaveBeenCalledWith(
+      expect.stringContaining('FROM accounter_schema.business_users'),
+      ['user-123'],
+    );
+    expect(result).toEqual({
+      authType: 'devBypass',
+      token: 'user-123',
+      user: {
+        userId: 'user-123',
+        auth0UserId: 'auth0|demo',
+        email: 'dev-user',
+        roleId: 'business_owner',
+        permissions: [],
+        emailVerified: true,
+        permissionsVersion: 0,
+      },
+      tenant: {
+        businessId: 'biz-456',
+        roleId: 'business_owner',
+      },
+      memberships: [{ businessId: 'biz-456', roleId: 'business_owner' }],
+      activeReadScope: { businessIds: ['biz-456'] },
+    });
+  });
+
+  it('returns null when user is not found', async () => {
+    const db = {
+      query: vi.fn().mockResolvedValue({ rows: [] }),
+    } as unknown as Pick<DBProvider, 'query'>;
+
+    const result = await handleDevBypassAuth(db, 'missing-user');
+
+    expect(result).toBeNull();
+  });
+
+  it('returns null for an empty/whitespace user id without querying', async () => {
+    const db = {
+      query: vi.fn(),
+    } as unknown as Pick<DBProvider, 'query'>;
+
+    expect(await handleDevBypassAuth(db, '   ')).toBeNull();
+    expect(db.query).not.toHaveBeenCalled();
+  });
+
+  // dev-bypass now resolves ALL memberships (no LIMIT 1); the primary (most
+  // recently updated) membership still backs the single-business tenant context.
+  it('resolves all memberships and selects the primary as tenant', async () => {
+    const query = vi.fn().mockResolvedValue({
+      rows: [
+        { user_id: 'user-1', business_id: 'biz-1', role_id: 'business_owner', auth0_user_id: null },
+        { user_id: 'user-1', business_id: 'biz-2', role_id: 'accountant', auth0_user_id: null },
+      ],
+    });
+    const db = { query } as unknown as Pick<DBProvider, 'query'>;
+
+    const result = await handleDevBypassAuth(db, 'user-1');
+
+    expect(query).toHaveBeenCalledWith(expect.not.stringContaining('LIMIT 1'), ['user-1']);
+    expect(result?.tenant.businessId).toBe('biz-1');
+    expect(result?.memberships).toEqual([
+      { businessId: 'biz-1', roleId: 'business_owner' },
+      { businessId: 'biz-2', roleId: 'accountant' },
+    ]);
+  });
+});
+
+// JWT auth now resolves all of a user's memberships (no LIMIT 1 on the auth0
+// lookup); the primary membership still backs the single-business tenant context.
+describe('AuthContextProvider membership resolution', () => {
+  it('resolves all memberships for the Auth0 subject without a LIMIT 1 lookup', async () => {
+    const mockDb = {
+      query: vi.fn().mockResolvedValue({
+        rowCount: 2,
+        rows: [
+          { user_id: 'u-1', business_id: 'b-1', role_id: 'admin' },
+          { user_id: 'u-1', business_id: 'b-2', role_id: 'accountant' },
+        ],
+      }),
+    } as any;
+    const mockEnv = { auth0: { domain: 'test.auth0.com', audience: 'aud' } } as any;
+    vi.mocked(jose.createRemoteJWKSet).mockReturnValue({} as any);
+    vi.mocked(jose.jwtVerify).mockResolvedValue({
+      payload: { sub: 'auth0|123', exp: 1, email: null, email_verified: false, permissions: [] },
+    } as any);
+
+    const provider = new AuthContextProvider(
+      mockEnv,
+      { authType: 'jwt', token: 'valid-token' } as any,
+      mockDb,
+    );
+    const result = await provider.getAuthContext();
+
+    expect(mockDb.query).toHaveBeenCalledWith(
+      expect.not.stringContaining('LIMIT 1'),
+      ['auth0|123'],
+    );
+    expect(result?.tenant.businessId).toBe('b-1');
+    expect(result?.memberships).toEqual([
+      { businessId: 'b-1', roleId: 'admin' },
+      { businessId: 'b-2', roleId: 'accountant' },
+    ]);
+  });
+});

package/src/modules/auth/providers/__tests__/auth0-management.test.ts

@@ -0,0 +1,198 @@
+import { ManagementClient } from 'auth0';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { Auth0ManagementProvider } from '../auth0-management.provider.js';
+import type { Environment } from '../../../../shared/types/index.js';
+
+// Mock auth0 library
+vi.mock('auth0', () => {
+  const users = {
+    create: vi.fn(),
+    delete: vi.fn(),
+    update: vi.fn(),
+    get: vi.fn(),
+    listUsersByEmail: vi.fn(),
+  };
+  const tickets = {
+    changePassword: vi.fn(),
+  };
+  const ManagementClient = vi.fn(function() {
+    return {
+        users,
+        tickets,
+    }
+});
+  return { ManagementClient };
+});
+
+describe('Auth0ManagementProvider', () => {
+  let service: Auth0ManagementProvider;
+  let mockClient: any;
+  let mockEnv: Environment;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    
+    // Create mock environment
+    mockEnv = {
+      auth0: {
+        domain: 'test-domain',
+        clientId: 'test-client-id',
+        clientSecret: 'test-client-secret',
+        audience: 'test-audience',
+        managementAudience: 'test-management-audience',
+      },
+      general: {
+        frontendUrl: 'http://localhost:3000',
+      },
+      // minimal mock
+    } as any;
+
+    service = new Auth0ManagementProvider(mockEnv);
+    // Get the instance of the mocked client
+    mockClient = (ManagementClient as any).mock.results[0].value;
+  });
+
+  afterEach(() => {
+    vi.resetModules();
+  });
+
+  it('should initialize ManagementClient with correct config', () => {
+    expect(ManagementClient).toHaveBeenCalledWith({
+      domain: 'test-domain',
+      clientId: 'test-client-id',
+      clientSecret: 'test-client-secret',
+      audience: 'test-management-audience',
+    });
+  });
+
+  it('should return existing user id if user already exists', async () => {
+    const email = 'existing@example.com';
+    const existingUserId = 'auth0|existing';
+
+    mockClient.users.listUsersByEmail.mockResolvedValue([{ user_id: existingUserId }]);
+
+    const userId = await service.createBlockedUser(email);
+
+    expect(userId).toBe(existingUserId);
+    expect(mockClient.users.create).not.toHaveBeenCalled();
+  });
+
+  it('should create a blocked user with temporary password', async () => {
+    const email = 'test@example.com';
+    const mockUserId = 'auth0|123456';
+
+    mockClient.users.listUsersByEmail.mockResolvedValue([]);
+    mockClient.users.create.mockResolvedValue({
+      user_id: mockUserId,
+    });
+
+    const userId = await service.createBlockedUser(email);
+
+    expect(userId).toBe(mockUserId);
+    expect(mockClient.users.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        connection: 'Username-Password-Authentication',
+        email,
+        blocked: true,
+        email_verified: false,
+        app_metadata: {
+            registered_by: 'accounter',
+        },
+      }),
+    );
+    
+    // Verify password complexity requirements
+    const callArgs = mockClient.users.create.mock.calls[0][0];
+    const password = callArgs.password;
+    expect(password.length).toBeGreaterThanOrEqual(8);
+    expect(/[a-z]/.test(password)).toBe(true);
+    expect(/[A-Z]/.test(password)).toBe(true);
+    expect(/[0-9]/.test(password)).toBe(true);
+    // eslint-disable-next-line no-useless-escape
+    expect(/[!@#$%^&*()_+~`|}{[\]:;?><,./\-=]/.test(password)).toBe(true);
+  });
+
+  it('should unblock a user', async () => {
+    const userId = 'auth0|123456';
+    mockClient.users.update.mockResolvedValue({});
+
+    await service.unblockUser(userId);
+
+    expect(mockClient.users.update).toHaveBeenCalledWith(
+      userId,
+      { blocked: false }
+    );
+  });
+
+  it('should delete a user', async () => {
+    const userId = 'auth0|123456';
+    
+    mockClient.users.delete.mockResolvedValue({});
+
+    await service.deleteUser(userId);
+
+    expect(mockClient.users.delete).toHaveBeenCalledWith(userId);
+  });
+
+  it('should send password reset email (trigger ticket)', async () => {
+    const userId = 'auth0|123456';
+    const mockTicket = 'https://auth0.com/ticket';
+    
+    mockClient.tickets.changePassword.mockResolvedValue({ ticket: mockTicket });
+
+    const ticket = await service.sendPasswordResetEmail(userId);
+
+    // Should return the ticket URL
+    expect(ticket).toBe(mockTicket);
+
+    // Should NOT assume verified before reset
+    expect(mockClient.users.update).not.toHaveBeenCalledWith(
+      { id: userId },
+      { email_verified: true }
+    );
+
+    // Should trigger password change with mark_email_as_verified: true
+    expect(mockClient.tickets.changePassword).toHaveBeenCalledWith(
+      expect.objectContaining({
+        user_id: userId,
+        mark_email_as_verified: true,
+        result_url: 'http://localhost:3000/login',
+      })
+    );
+  });
+
+  it('should throw error if creation fails', async () => {
+    mockClient.users.listUsersByEmail.mockResolvedValue([]);
+    mockClient.users.create.mockRejectedValue(new Error('Auth0 Error'));
+
+    await expect(service.createBlockedUser('fail@test.com')).rejects.toThrow('Failed to create Auth0 user: Auth0 Error');
+  });
+
+  it('getUserProfileById returns email + name and caches the result', async () => {
+    const userId = 'auth0|profile';
+    mockClient.users.get.mockResolvedValue({ email: 'ada@example.com', name: 'Ada Lovelace' });
+
+    const first = await service.getUserProfileById(userId);
+    const second = await service.getUserProfileById(userId);
+
+    expect(first).toEqual({ email: 'ada@example.com', name: 'Ada Lovelace' });
+    expect(second).toEqual({ email: 'ada@example.com', name: 'Ada Lovelace' });
+    // Second call is served from the in-memory cache, not a second Auth0 request.
+    expect(mockClient.users.get).toHaveBeenCalledTimes(1);
+  });
+
+  it('getUserProfileById returns null on failure and does not cache it', async () => {
+    const userId = 'auth0|transient';
+    mockClient.users.get.mockRejectedValueOnce(new Error('boom'));
+
+    const failed = await service.getUserProfileById(userId);
+    expect(failed).toBeNull();
+
+    // A failed lookup is not cached, so a later call retries Auth0.
+    mockClient.users.get.mockResolvedValueOnce({ email: 'x@example.com', name: null });
+    const retry = await service.getUserProfileById(userId);
+
+    expect(retry).toEqual({ email: 'x@example.com', name: null });
+    expect(mockClient.users.get).toHaveBeenCalledTimes(2);
+  });
+});