@optimizely-opal/opal-tool-ocp-sdk 0.0.0-OCP-1487.4 → 0.0.0-OCP-1487.6

package/dist/auth/AuthUtils.test.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const AuthUtils_1 = require("./AuthUtils");
+/* eslint-disable @typescript-eslint/no-unsafe-call */
 const app_sdk_1 = require("@zaiusinc/app-sdk");
 const TokenVerifier_1 = require("./TokenVerifier");
+const AuthUtils_1 = require("./AuthUtils");
 // Mock the dependencies
 jest.mock('./TokenVerifier', () => ({
     getTokenVerifier: jest.fn(),
@@ -17,452 +18,583 @@ jest.mock('@zaiusinc/app-sdk', () => ({
     },
 }));
 describe('AuthUtils', () => {
+    let mockTokenVerifier;
     let mockGetTokenVerifier;
     let mockGetAppContext;
-    let mockTokenVerifier;
     beforeEach(() => {
         jest.clearAllMocks();
-        // Create mock token verifier
+        // Setup token verifier mock
         mockTokenVerifier = {
             verify: jest.fn(),
         };
-        // Setup the mocks
-        mockGetTokenVerifier = jest.mocked(TokenVerifier_1.getTokenVerifier);
-        mockGetAppContext = jest.mocked(app_sdk_1.getAppContext);
+        mockGetTokenVerifier = TokenVerifier_1.getTokenVerifier;
         mockGetTokenVerifier.mockResolvedValue(mockTokenVerifier);
+        // Setup app context mock with default organization
+        mockGetAppContext = app_sdk_1.getAppContext;
         mockGetAppContext.mockReturnValue({
             account: {
-                organizationId: 'app-org-123'
+                organizationId: 'test-org-123'
             }
         });
     });
-    describe('validateAccessToken', () => {
-        it('should return true for valid token', async () => {
-            // Arrange
-            const validToken = 'valid-access-token';
+    describe('authorizeRegularRequest', () => {
+        beforeEach(() => {
+            // Default to successful token verification
             mockTokenVerifier.verify.mockResolvedValue(true);
-            // Act
-            const result = await AuthUtils_1.AuthUtils.validateAccessToken(validToken);
-            // Assert
-            expect(result).toBe(true);
-            expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-            expect(mockTokenVerifier.verify).toHaveBeenCalledWith(validToken);
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
-        });
-        it('should return false for invalid token', async () => {
-            // Arrange
-            const invalidToken = 'invalid-access-token';
-            mockTokenVerifier.verify.mockResolvedValue(false);
-            // Act
-            const result = await AuthUtils_1.AuthUtils.validateAccessToken(invalidToken);
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-            expect(mockTokenVerifier.verify).toHaveBeenCalledWith(invalidToken);
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
-        });
-        it('should return false for undefined token', async () => {
-            // Act
-            const result = await AuthUtils_1.AuthUtils.validateAccessToken(undefined);
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetTokenVerifier).not.toHaveBeenCalled();
-            expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
-        });
-        it('should return false for null token', async () => {
-            // Act
-            const result = await AuthUtils_1.AuthUtils.validateAccessToken(null);
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetTokenVerifier).not.toHaveBeenCalled();
-            expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
-        });
-        it('should return false for empty string token', async () => {
-            // Act
-            const result = await AuthUtils_1.AuthUtils.validateAccessToken('');
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetTokenVerifier).not.toHaveBeenCalled();
-            expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
         });
-        it('should return false and log error when getTokenVerifier fails', async () => {
-            // Arrange
-            const validToken = 'valid-access-token';
-            const error = new Error('Failed to get token verifier');
-            mockGetTokenVerifier.mockRejectedValue(error);
-            // Act
-            const result = await AuthUtils_1.AuthUtils.validateAccessToken(validToken);
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-            expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token validation failed:', error);
-        });
-        it('should return false and log error when token verification throws', async () => {
-            // Arrange
-            const validToken = 'valid-access-token';
-            const error = new Error('Token verification failed');
-            mockTokenVerifier.verify.mockRejectedValue(error);
-            // Act
-            const result = await AuthUtils_1.AuthUtils.validateAccessToken(validToken);
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-            expect(mockTokenVerifier.verify).toHaveBeenCalledWith(validToken);
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token validation failed:', error);
+        describe('when request is for discovery endpoint', () => {
+            it('should return true without authentication', async () => {
+                const request = { path: '/discovery' };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(true);
+                expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+                expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+            });
         });
-        it('should handle whitespace-only token', async () => {
-            // Arrange
-            mockTokenVerifier.verify.mockResolvedValue(false);
-            // Act
-            const result = await AuthUtils_1.AuthUtils.validateAccessToken('   ');
-            // Assert - whitespace-only string should be treated as truthy and passed to verifier
-            expect(result).toBe(false);
-            expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-            expect(mockTokenVerifier.verify).toHaveBeenCalledWith('   ');
+        describe('when request is for ready endpoint', () => {
+            it('should return true without authentication', async () => {
+                const request = { path: '/ready' };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(true);
+                expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+                expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+            });
         });
-    });
-    describe('extractAuthData', () => {
-        const createValidRequest = () => ({
-            bodyJSON: {
-                auth: {
-                    provider: 'OptiID',
-                    credentials: {
-                        access_token: 'valid-access-token',
-                        customer_id: 'org-123',
-                        instance_id: 'instance-456',
-                        product_sku: 'OPAL'
+        describe('when request has valid authentication', () => {
+            it('should return true for valid OptiID token with matching organization', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'test-org-123',
+                                access_token: 'valid-token-123'
+                            }
+                        }
                     }
-                }
-            }
-        });
-        it('should extract auth data successfully from valid request', () => {
-            // Arrange
-            const request = createValidRequest();
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).not.toBeNull();
-            expect(result?.authData).toBe(request.bodyJSON.auth);
-            expect(result?.accessToken).toBe('valid-access-token');
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
-        });
-        it('should handle case-insensitive provider name', () => {
-            // Arrange
-            const request = createValidRequest();
-            request.bodyJSON.auth.provider = 'optiid'; // lowercase
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).not.toBeNull();
-            expect(result?.authData).toBe(request.bodyJSON.auth);
-            expect(result?.accessToken).toBe('valid-access-token');
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
-        });
-        it('should handle mixed case provider name', () => {
-            // Arrange
-            const request = createValidRequest();
-            request.bodyJSON.auth.provider = 'OpTiId'; // mixed case
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).not.toBeNull();
-            expect(result?.authData).toBe(request.bodyJSON.auth);
-            expect(result?.accessToken).toBe('valid-access-token');
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
-        });
-        it('should return null when access token is missing', () => {
-            // Arrange
-            const request = createValidRequest();
-            delete request.bodyJSON.auth.credentials.access_token;
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-        });
-        it('should return null when access token is undefined', () => {
-            // Arrange
-            const request = createValidRequest();
-            request.bodyJSON.auth.credentials.access_token = undefined;
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-        });
-        it('should return null when access token is empty string', () => {
-            // Arrange
-            const request = createValidRequest();
-            request.bodyJSON.auth.credentials.access_token = '';
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-        });
-        it('should return null when provider is not OptiID', () => {
-            // Arrange
-            const request = createValidRequest();
-            request.bodyJSON.auth.provider = 'SomeOtherProvider';
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-        });
-        it('should return null when provider is missing', () => {
-            // Arrange
-            const request = createValidRequest();
-            delete request.bodyJSON.auth.provider;
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-        });
-        it('should return null when auth structure is missing', () => {
-            // Arrange
-            const request = {
-                bodyJSON: {
-                    parameters: { some: 'data' }
-                }
-            };
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-        });
-        it('should return null when credentials structure is missing', () => {
-            // Arrange
-            const request = {
-                bodyJSON: {
-                    auth: {
-                        provider: 'OptiID'
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(true);
+                expect(mockGetTokenVerifier).toHaveBeenCalled();
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+            });
+            it('should handle case-insensitive provider names', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'optiid', // lowercase
+                            credentials: {
+                                customer_id: 'test-org-123',
+                                access_token: 'valid-token-123'
+                            }
+                        }
                     }
-                }
-            };
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(true);
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+            });
+            it('should handle mixed case provider names', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OpTiId', // mixed case
+                            credentials: {
+                                customer_id: 'test-org-123',
+                                access_token: 'valid-token-123'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(true);
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+            });
         });
-        it('should return null when bodyJSON is missing', () => {
-            // Arrange
-            const request = {};
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        describe('when authentication fails', () => {
+            it('should return false when auth data is missing', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {}
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+                expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+            });
+            it('should return false when bodyJSON is missing', async () => {
+                const request = {
+                    path: '/some-tool'
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+            });
+            it('should return false when provider is not OptiID', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'SomeOtherProvider',
+                            credentials: {
+                                customer_id: 'test-org-123',
+                                access_token: 'some-token'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+            });
+            it('should return false when access token is missing', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'test-org-123'
+                                // access_token missing
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+            });
+            it('should return false when access token is empty string', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'test-org-123',
+                                access_token: ''
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+            });
+            it('should return false when access token is undefined', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'test-org-123',
+                                access_token: undefined
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+            });
         });
-        it('should return null when request is null', () => {
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(null);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        describe('when organization validation fails', () => {
+            it('should return false when customer_id does not match app organization', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'different-org-456',
+                                access_token: 'valid-token-123'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected test-org-123, received different-org-456');
+                expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+            });
+            it('should return false when customer_id is missing', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                access_token: 'valid-token-123'
+                                // customer_id missing
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+            });
+            it('should return false when customer_id is empty string', async () => {
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: '',
+                                access_token: 'valid-token-123'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+            });
+            it('should handle case when app context has no account', async () => {
+                mockGetAppContext.mockReturnValue({});
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'some-org-123',
+                                access_token: 'valid-token-123'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected undefined, received some-org-123');
+            });
+            it('should handle case when app context is null', async () => {
+                mockGetAppContext.mockReturnValue(null);
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'some-org-123',
+                                access_token: 'valid-token-123'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected undefined, received some-org-123');
+            });
         });
-        it('should return null when request is undefined', () => {
-            // Act
-            const result = AuthUtils_1.AuthUtils.extractAuthData(undefined);
-            // Assert
-            expect(result).toBeNull();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        describe('when token validation fails', () => {
+            it('should return false when token verifier returns false', async () => {
+                mockTokenVerifier.verify.mockResolvedValue(false);
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'test-org-123',
+                                access_token: 'invalid-token'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
+            });
+            it('should return false when token verification throws an error', async () => {
+                const verificationError = new Error('Token verification failed');
+                mockTokenVerifier.verify.mockRejectedValue(verificationError);
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'test-org-123',
+                                access_token: 'error-token'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
+            });
+            it('should return false when getTokenVerifier throws an error', async () => {
+                const verifierError = new Error('Failed to get token verifier');
+                mockGetTokenVerifier.mockRejectedValue(verifierError);
+                const request = {
+                    path: '/some-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'test-org-123',
+                                access_token: 'some-token'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verifierError);
+            });
         });
     });
-    describe('validateOrganizationId', () => {
+    describe('authorizeGlobalRequest', () => {
         beforeEach(() => {
-            mockGetAppContext.mockReturnValue({
-                account: {
-                    organizationId: 'app-org-123'
-                }
-            });
-        });
-        it('should return true when customer ID matches app organization ID', () => {
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId('app-org-123');
-            // Assert
-            expect(result).toBe(true);
-            expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
-        });
-        it('should return false when customer ID does not match app organization ID', () => {
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId('different-org-456');
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected app-org-123, received different-org-456');
-        });
-        it('should return false when customer ID is undefined', () => {
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId(undefined);
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetAppContext).not.toHaveBeenCalled();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
-        });
-        it('should return false when customer ID is null', () => {
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId(null);
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetAppContext).not.toHaveBeenCalled();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
-        });
-        it('should return false when customer ID is empty string', () => {
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId('');
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetAppContext).not.toHaveBeenCalled();
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
-        });
-        it('should handle case when app context has no account', () => {
-            // Arrange
-            mockGetAppContext.mockReturnValue({});
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId('some-org-123');
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected undefined, received some-org-123');
+            // Default to successful token verification
+            mockTokenVerifier.verify.mockResolvedValue(true);
         });
-        it('should handle case when app context account has no organizationId', () => {
-            // Arrange
-            mockGetAppContext.mockReturnValue({
-                account: {}
-            });
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId('some-org-123');
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected undefined, received some-org-123');
+        describe('when request is for discovery endpoint', () => {
+            it('should return true without authentication', async () => {
+                const request = { path: '/discovery' };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(true);
+                expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+                expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+            });
         });
-        it('should handle case when app context is null', () => {
-            // Arrange
-            mockGetAppContext.mockReturnValue(null);
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId('some-org-123');
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected undefined, received some-org-123');
+        describe('when request is for ready endpoint', () => {
+            it('should return true without authentication', async () => {
+                const request = { path: '/ready' };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(true);
+                expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+                expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+            });
         });
-        it('should be case-sensitive for organization ID matching', () => {
-            // Arrange
-            mockGetAppContext.mockReturnValue({
-                account: {
-                    organizationId: 'App-Org-123' // different case
-                }
+        describe('when request has valid authentication', () => {
+            it('should return true for valid OptiID token regardless of organization', async () => {
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'different-org-456', // Different from app org
+                                access_token: 'valid-token-123'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(true);
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+                // Should not log organization validation errors for global requests
+                expect(app_sdk_1.logger.error).not.toHaveBeenCalledWith(expect.stringContaining('Invalid organisation ID'));
+            });
+            it('should return true even without customer_id', async () => {
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                access_token: 'valid-token-123'
+                                // No customer_id - should be fine for global functions
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(true);
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+            });
+            it('should handle case-insensitive provider names', async () => {
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'optiid',
+                            credentials: {
+                                customer_id: 'any-org',
+                                access_token: 'valid-token-123'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(true);
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
             });
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId('app-org-123');
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected App-Org-123, received app-org-123');
         });
-        it('should handle whitespace-only customer ID', () => {
-            // Act
-            const result = AuthUtils_1.AuthUtils.validateOrganizationId('   ');
-            // Assert
-            expect(result).toBe(false);
-            expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected app-org-123, received    ');
+        describe('when authentication fails', () => {
+            it('should return false when auth data is missing', async () => {
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {}
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+            });
+            it('should return false when provider is not OptiID', async () => {
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'SomeOtherProvider',
+                            credentials: {
+                                customer_id: 'any-org',
+                                access_token: 'some-token'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+            });
+            it('should return false when access token is missing', async () => {
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'any-org'
+                                // access_token missing
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+            });
+            it('should return false when access token is empty', async () => {
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'any-org',
+                                access_token: ''
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+            });
         });
-    });
-    describe('integration scenarios', () => {
-        it('should handle complete authentication flow for valid request', async () => {
-            // Arrange
-            const request = {
-                bodyJSON: {
-                    auth: {
-                        provider: 'OptiID',
-                        credentials: {
-                            access_token: 'valid-access-token',
-                            customer_id: 'app-org-123',
-                            instance_id: 'instance-456',
-                            product_sku: 'OPAL'
+        describe('when token validation fails', () => {
+            it('should return false when token verifier returns false', async () => {
+                mockTokenVerifier.verify.mockResolvedValue(false);
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'any-org',
+                                access_token: 'invalid-token'
+                            }
                         }
                     }
-                }
-            };
-            mockGetAppContext.mockReturnValue({
-                account: {
-                    organizationId: 'app-org-123'
-                }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(false);
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
+            });
+            it('should return false when token verification throws an error', async () => {
+                const verificationError = new Error('Global token verification failed');
+                mockTokenVerifier.verify.mockRejectedValue(verificationError);
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'any-org',
+                                access_token: 'error-token'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(false);
+                expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
             });
-            mockTokenVerifier.verify.mockResolvedValue(true);
-            // Act
-            const authInfo = AuthUtils_1.AuthUtils.extractAuthData(request);
-            const isValidOrg = authInfo
-                ? AuthUtils_1.AuthUtils.validateOrganizationId(authInfo.authData.credentials?.customer_id)
-                : false;
-            const isValidToken = authInfo ? await AuthUtils_1.AuthUtils.validateAccessToken(authInfo.accessToken) : false;
-            // Assert
-            expect(authInfo).not.toBeNull();
-            expect(isValidOrg).toBe(true);
-            expect(isValidToken).toBe(true);
-            expect(app_sdk_1.logger.error).not.toHaveBeenCalled();
         });
-        it('should handle complete authentication flow for invalid provider', async () => {
-            // Arrange
-            const request = {
-                bodyJSON: {
-                    auth: {
-                        provider: 'SomeOtherProvider',
-                        credentials: {
-                            access_token: 'valid-access-token',
-                            customer_id: 'app-org-123',
-                            instance_id: 'instance-456',
-                            product_sku: 'OPAL'
+        describe('organization validation differences from authorizeRegularRequest', () => {
+            it('should NOT validate organization ID and allow any customer_id', async () => {
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'completely-different-org',
+                                access_token: 'valid-token-123'
+                            }
                         }
                     }
-                }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(true);
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+                // Should NOT log organization validation errors
+                expect(app_sdk_1.logger.error).not.toHaveBeenCalledWith(expect.stringContaining('Invalid organisation ID'));
+                expect(app_sdk_1.logger.error).not.toHaveBeenCalledWith(expect.stringContaining('Organisation ID is required'));
+            });
+            it('should work even when app context has no organization', async () => {
+                mockGetAppContext.mockReturnValue({});
+                const request = {
+                    path: '/global-tool',
+                    bodyJSON: {
+                        auth: {
+                            provider: 'OptiID',
+                            credentials: {
+                                customer_id: 'any-org',
+                                access_token: 'valid-token-123'
+                            }
+                        }
+                    }
+                };
+                const result = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+                expect(result).toBe(true);
+                expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+            });
+        });
+    });
+    describe('edge cases and error handling', () => {
+        it('should handle requests with null bodyJSON', async () => {
+            const request = {
+                path: '/some-tool',
+                bodyJSON: null
             };
-            // Act
-            const authInfo = AuthUtils_1.AuthUtils.extractAuthData(request);
-            // Assert
-            expect(authInfo).toBeNull();
+            const result1 = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+            const result2 = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+            expect(result1).toBe(false);
+            expect(result2).toBe(false);
             expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
         });
-        it('should handle complete authentication flow for organization mismatch', async () => {
-            // Arrange
+        it('should handle malformed auth objects', async () => {
             const request = {
+                path: '/some-tool',
                 bodyJSON: {
-                    auth: {
-                        provider: 'OptiID',
-                        credentials: {
-                            access_token: 'valid-access-token',
-                            customer_id: 'different-org-456',
-                            instance_id: 'instance-456',
-                            product_sku: 'OPAL'
-                        }
-                    }
+                    auth: 'invalid-auth-format'
                 }
             };
-            mockGetAppContext.mockReturnValue({
-                account: {
-                    organizationId: 'app-org-123'
-                }
-            });
-            // Act
-            const authInfo = AuthUtils_1.AuthUtils.extractAuthData(request);
-            const isValidOrg = authInfo
-                ? AuthUtils_1.AuthUtils.validateOrganizationId(authInfo.authData.credentials?.customer_id)
-                : false;
-            // Assert
-            expect(authInfo).not.toBeNull();
-            expect(isValidOrg).toBe(false);
-            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('Invalid organisation ID: expected app-org-123, received different-org-456');
+            const result1 = await (0, AuthUtils_1.authorizeRegularRequest)(request);
+            const result2 = await (0, AuthUtils_1.authorizeGlobalRequest)(request);
+            expect(result1).toBe(false);
+            expect(result2).toBe(false);
+            expect(app_sdk_1.logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
         });
     });
 });