@optimizely-opal/opal-tool-ocp-sdk 0.0.0-OCP-1487.1

package/src/auth/AuthUtils.test.ts

@@ -0,0 +1,586 @@
+import { AuthUtils } from './AuthUtils';
+import { getAppContext, logger } from '@zaiusinc/app-sdk';
+import { getTokenVerifier } from './TokenVerifier';
+import { OptiIdAuthData } from '../types/Models';
+
+// Mock the dependencies
+jest.mock('./TokenVerifier', () => ({
+  getTokenVerifier: jest.fn(),
+}));
+
+jest.mock('@zaiusinc/app-sdk', () => ({
+  getAppContext: jest.fn(),
+  logger: {
+    info: jest.fn(),
+    error: jest.fn(),
+    warn: jest.fn(),
+    debug: jest.fn(),
+  },
+}));
+
+describe('AuthUtils', () => {
+  let mockGetTokenVerifier: jest.MockedFunction<typeof getTokenVerifier>;
+  let mockGetAppContext: jest.MockedFunction<typeof getAppContext>;
+  let mockTokenVerifier: jest.Mocked<{
+    verify: (token: string) => Promise<any>;
+  }>;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    // Create mock token verifier
+    mockTokenVerifier = {
+      verify: jest.fn(),
+    };
+
+    // Setup the mocks
+    mockGetTokenVerifier = jest.mocked(getTokenVerifier);
+    mockGetAppContext = jest.mocked(getAppContext);
+
+    mockGetTokenVerifier.mockResolvedValue(mockTokenVerifier as any);
+    mockGetAppContext.mockReturnValue({
+      account: {
+        organizationId: 'app-org-123'
+      }
+    } as any);
+  });
+
+  describe('validateAccessToken', () => {
+    it('should return true for valid token', async () => {
+      // Arrange
+      const validToken = 'valid-access-token';
+      mockTokenVerifier.verify.mockResolvedValue(true);
+
+      // Act
+      const result = await AuthUtils.validateAccessToken(validToken);
+
+      // Assert
+      expect(result).toBe(true);
+      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
+      expect(mockTokenVerifier.verify).toHaveBeenCalledWith(validToken);
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should return false for invalid token', async () => {
+      // Arrange
+      const invalidToken = 'invalid-access-token';
+      mockTokenVerifier.verify.mockResolvedValue(false);
+
+      // Act
+      const result = await AuthUtils.validateAccessToken(invalidToken);
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
+      expect(mockTokenVerifier.verify).toHaveBeenCalledWith(invalidToken);
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should return false for undefined token', async () => {
+      // Act
+      const result = await AuthUtils.validateAccessToken(undefined);
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+      expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should return false for null token', async () => {
+      // Act
+      const result = await AuthUtils.validateAccessToken(null as any);
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+      expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should return false for empty string token', async () => {
+      // Act
+      const result = await AuthUtils.validateAccessToken('');
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+      expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should return false and log error when getTokenVerifier fails', async () => {
+      // Arrange
+      const validToken = 'valid-access-token';
+      const error = new Error('Failed to get token verifier');
+      mockGetTokenVerifier.mockRejectedValue(error);
+
+      // Act
+      const result = await AuthUtils.validateAccessToken(validToken);
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
+      expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', error);
+    });
+
+    it('should return false and log error when token verification throws', async () => {
+      // Arrange
+      const validToken = 'valid-access-token';
+      const error = new Error('Token verification failed');
+      mockTokenVerifier.verify.mockRejectedValue(error);
+
+      // Act
+      const result = await AuthUtils.validateAccessToken(validToken);
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
+      expect(mockTokenVerifier.verify).toHaveBeenCalledWith(validToken);
+      expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', error);
+    });
+
+    it('should handle whitespace-only token', async () => {
+      // Arrange
+      mockTokenVerifier.verify.mockResolvedValue(false);
+
+      // Act
+      const result = await AuthUtils.validateAccessToken('   ');
+
+      // Assert - whitespace-only string should be treated as truthy and passed to verifier
+      expect(result).toBe(false);
+      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
+      expect(mockTokenVerifier.verify).toHaveBeenCalledWith('   ');
+    });
+  });
+
+  describe('extractAuthData', () => {
+    const createValidRequest = (): any => ({
+      bodyJSON: {
+        auth: {
+          provider: 'OptiID',
+          credentials: {
+            access_token: 'valid-access-token',
+            customer_id: 'org-123',
+            instance_id: 'instance-456',
+            product_sku: 'OPAL'
+          }
+        } as OptiIdAuthData
+      }
+    });
+
+    it('should extract auth data successfully from valid request', () => {
+      // Arrange
+      const request = createValidRequest();
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).not.toBeNull();
+      expect(result?.authData).toBe(request.bodyJSON.auth);
+      expect(result?.accessToken).toBe('valid-access-token');
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should handle case-insensitive provider name', () => {
+      // Arrange
+      const request = createValidRequest();
+      request.bodyJSON.auth.provider = 'optiid'; // lowercase
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).not.toBeNull();
+      expect(result?.authData).toBe(request.bodyJSON.auth);
+      expect(result?.accessToken).toBe('valid-access-token');
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should handle mixed case provider name', () => {
+      // Arrange
+      const request = createValidRequest();
+      request.bodyJSON.auth.provider = 'OpTiId'; // mixed case
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).not.toBeNull();
+      expect(result?.authData).toBe(request.bodyJSON.auth);
+      expect(result?.accessToken).toBe('valid-access-token');
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should return null when access token is missing', () => {
+      // Arrange
+      const request = createValidRequest();
+      delete request.bodyJSON.auth.credentials.access_token;
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should return null when access token is undefined', () => {
+      // Arrange
+      const request = createValidRequest();
+      request.bodyJSON.auth.credentials.access_token = undefined;
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should return null when access token is empty string', () => {
+      // Arrange
+      const request = createValidRequest();
+      request.bodyJSON.auth.credentials.access_token = '';
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should return null when provider is not OptiID', () => {
+      // Arrange
+      const request = createValidRequest();
+      request.bodyJSON.auth.provider = 'SomeOtherProvider';
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should return null when provider is missing', () => {
+      // Arrange
+      const request = createValidRequest();
+      delete request.bodyJSON.auth.provider;
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should return null when auth structure is missing', () => {
+      // Arrange
+      const request = {
+        bodyJSON: {
+          parameters: { some: 'data' }
+        }
+      };
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should return null when credentials structure is missing', () => {
+      // Arrange
+      const request = {
+        bodyJSON: {
+          auth: {
+            provider: 'OptiID'
+          }
+        }
+      };
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should return null when bodyJSON is missing', () => {
+      // Arrange
+      const request = {};
+
+      // Act
+      const result = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should return null when request is null', () => {
+      // Act
+      const result = AuthUtils.extractAuthData(null);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should return null when request is undefined', () => {
+      // Act
+      const result = AuthUtils.extractAuthData(undefined);
+
+      // Assert
+      expect(result).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+  });
+
+  describe('validateOrganizationId', () => {
+    beforeEach(() => {
+      mockGetAppContext.mockReturnValue({
+        account: {
+          organizationId: 'app-org-123'
+        }
+      } as any);
+    });
+
+    it('should return true when customer ID matches app organization ID', () => {
+      // Act
+      const result = AuthUtils.validateOrganizationId('app-org-123');
+
+      // Assert
+      expect(result).toBe(true);
+      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should return false when customer ID does not match app organization ID', () => {
+      // Act
+      const result = AuthUtils.validateOrganizationId('different-org-456');
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
+      expect(logger.error).toHaveBeenCalledWith(
+        'Invalid organisation ID: expected app-org-123, received different-org-456'
+      );
+    });
+
+    it('should return false when customer ID is undefined', () => {
+      // Act
+      const result = AuthUtils.validateOrganizationId(undefined);
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetAppContext).not.toHaveBeenCalled();
+      expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+    });
+
+    it('should return false when customer ID is null', () => {
+      // Act
+      const result = AuthUtils.validateOrganizationId(null as any);
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetAppContext).not.toHaveBeenCalled();
+      expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+    });
+
+    it('should return false when customer ID is empty string', () => {
+      // Act
+      const result = AuthUtils.validateOrganizationId('');
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetAppContext).not.toHaveBeenCalled();
+      expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+    });
+
+    it('should handle case when app context has no account', () => {
+      // Arrange
+      mockGetAppContext.mockReturnValue({} as any);
+
+      // Act
+      const result = AuthUtils.validateOrganizationId('some-org-123');
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
+      expect(logger.error).toHaveBeenCalledWith(
+        'Invalid organisation ID: expected undefined, received some-org-123'
+      );
+    });
+
+    it('should handle case when app context account has no organizationId', () => {
+      // Arrange
+      mockGetAppContext.mockReturnValue({
+        account: {}
+      } as any);
+
+      // Act
+      const result = AuthUtils.validateOrganizationId('some-org-123');
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
+      expect(logger.error).toHaveBeenCalledWith(
+        'Invalid organisation ID: expected undefined, received some-org-123'
+      );
+    });
+
+    it('should handle case when app context is null', () => {
+      // Arrange
+      mockGetAppContext.mockReturnValue(null as any);
+
+      // Act
+      const result = AuthUtils.validateOrganizationId('some-org-123');
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
+      expect(logger.error).toHaveBeenCalledWith(
+        'Invalid organisation ID: expected undefined, received some-org-123'
+      );
+    });
+
+    it('should be case-sensitive for organization ID matching', () => {
+      // Arrange
+      mockGetAppContext.mockReturnValue({
+        account: {
+          organizationId: 'App-Org-123' // different case
+        }
+      } as any);
+
+      // Act
+      const result = AuthUtils.validateOrganizationId('app-org-123');
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
+      expect(logger.error).toHaveBeenCalledWith(
+        'Invalid organisation ID: expected App-Org-123, received app-org-123'
+      );
+    });
+
+    it('should handle whitespace-only customer ID', () => {
+      // Act
+      const result = AuthUtils.validateOrganizationId('   ');
+
+      // Assert
+      expect(result).toBe(false);
+      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
+      expect(logger.error).toHaveBeenCalledWith(
+        'Invalid organisation ID: expected app-org-123, received    '
+      );
+    });
+  });
+
+  describe('integration scenarios', () => {
+    it('should handle complete authentication flow for valid request', async () => {
+      // Arrange
+      const request = {
+        bodyJSON: {
+          auth: {
+            provider: 'OptiID',
+            credentials: {
+              access_token: 'valid-access-token',
+              customer_id: 'app-org-123',
+              instance_id: 'instance-456',
+              product_sku: 'OPAL'
+            }
+          } as OptiIdAuthData
+        }
+      };
+
+      mockGetAppContext.mockReturnValue({
+        account: {
+          organizationId: 'app-org-123'
+        }
+      } as any);
+
+      mockTokenVerifier.verify.mockResolvedValue(true);
+
+      // Act
+      const authInfo = AuthUtils.extractAuthData(request);
+      const isValidOrg = authInfo
+        ? AuthUtils.validateOrganizationId(authInfo.authData.credentials?.customer_id)
+        : false;
+      const isValidToken = authInfo ? await AuthUtils.validateAccessToken(authInfo.accessToken) : false;
+
+      // Assert
+      expect(authInfo).not.toBeNull();
+      expect(isValidOrg).toBe(true);
+      expect(isValidToken).toBe(true);
+      expect(logger.error).not.toHaveBeenCalled();
+    });
+
+    it('should handle complete authentication flow for invalid provider', async () => {
+      // Arrange
+      const request = {
+        bodyJSON: {
+          auth: {
+            provider: 'SomeOtherProvider',
+            credentials: {
+              access_token: 'valid-access-token',
+              customer_id: 'app-org-123',
+              instance_id: 'instance-456',
+              product_sku: 'OPAL'
+            }
+          } as OptiIdAuthData
+        }
+      };
+
+      // Act
+      const authInfo = AuthUtils.extractAuthData(request);
+
+      // Assert
+      expect(authInfo).toBeNull();
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should handle complete authentication flow for organization mismatch', async () => {
+      // Arrange
+      const request = {
+        bodyJSON: {
+          auth: {
+            provider: 'OptiID',
+            credentials: {
+              access_token: 'valid-access-token',
+              customer_id: 'different-org-456',
+              instance_id: 'instance-456',
+              product_sku: 'OPAL'
+            }
+          } as OptiIdAuthData
+        }
+      };
+
+      mockGetAppContext.mockReturnValue({
+        account: {
+          organizationId: 'app-org-123'
+        }
+      } as any);
+
+      // Act
+      const authInfo = AuthUtils.extractAuthData(request);
+      const isValidOrg = authInfo
+        ? AuthUtils.validateOrganizationId(authInfo.authData.credentials?.customer_id)
+        : false;
+
+      // Assert
+      expect(authInfo).not.toBeNull();
+      expect(isValidOrg).toBe(false);
+      expect(logger.error).toHaveBeenCalledWith(
+        'Invalid organisation ID: expected app-org-123, received different-org-456'
+      );
+    });
+  });
+});

package/src/auth/AuthUtils.ts

@@ -0,0 +1,66 @@
+import { getAppContext, logger } from '@zaiusinc/app-sdk';
+import { getTokenVerifier } from './TokenVerifier';
+import { OptiIdAuthData } from '../types/Models';
+
+/**
+ * Common authentication utilities for all function types
+ */
+export class AuthUtils {
+
+  /**
+   * Validate the OptiID access token
+   *
+   * @param accessToken - The access token to validate
+   * @returns true if the token is valid
+   */
+  public static async validateAccessToken(accessToken: string | undefined): Promise<boolean> {
+    try {
+      if (!accessToken) {
+        return false;
+      }
+      const tokenVerifier = await getTokenVerifier();
+      return await tokenVerifier.verify(accessToken);
+    } catch (error) {
+      logger.error('OptiID token validation failed:', error);
+      return false;
+    }
+  }
+
+  /**
+   * Extract and validate basic OptiID authentication data from request
+   *
+   * @param request - The incoming request
+   * @returns object with authData and accessToken, or null if invalid
+   */
+  public static extractAuthData(request: any): { authData: OptiIdAuthData; accessToken: string } | null {
+    const authData = request?.bodyJSON?.auth as OptiIdAuthData;
+    const accessToken = authData?.credentials?.access_token;
+    if (!accessToken || authData?.provider?.toLowerCase() !== 'optiid') {
+      logger.error('OptiID token is required but not provided');
+      return null;
+    }
+
+    return { authData, accessToken };
+  }
+
+  /**
+   * Validate organization ID matches the app context
+   *
+   * @param customerId - The customer ID from the auth data
+   * @returns true if the organization ID is valid
+   */
+  public static validateOrganizationId(customerId: string | undefined): boolean {
+    if (!customerId) {
+      logger.error('Organisation ID is required but not provided');
+      return false;
+    }
+
+    const appOrganisationId = getAppContext()?.account?.organizationId;
+    if (customerId !== appOrganisationId) {
+      logger.error(`Invalid organisation ID: expected ${appOrganisationId}, received ${customerId}`);
+      return false;
+    }
+
+    return true;
+  }
+}