@optimizely-opal/opal-tool-ocp-sdk 0.0.0-OCP-1487.4 → 0.0.0-OCP-1487.6

package/src/auth/AuthUtils.test.ts

@@ -1,7 +1,7 @@
-import { AuthUtils } from './AuthUtils';
+/* eslint-disable @typescript-eslint/no-unsafe-call */
 import { getAppContext, logger } from '@zaiusinc/app-sdk';
 import { getTokenVerifier } from './TokenVerifier';
-import { OptiIdAuthData } from '../types/Models';
+import { authorizeRegularRequest, authorizeGlobalRequest } from './AuthUtils';
 
 // Mock the dependencies
 jest.mock('./TokenVerifier', () => ({
@@ -19,568 +19,711 @@ jest.mock('@zaiusinc/app-sdk', () => ({
 }));
 
 describe('AuthUtils', () => {
+  let mockTokenVerifier: any;
   let mockGetTokenVerifier: jest.MockedFunction<typeof getTokenVerifier>;
   let mockGetAppContext: jest.MockedFunction<typeof getAppContext>;
-  let mockTokenVerifier: jest.Mocked<{
-    verify: (token: string) => Promise<any>;
-  }>;
 
   beforeEach(() => {
     jest.clearAllMocks();
 
-    // Create mock token verifier
+    // Setup token verifier mock
     mockTokenVerifier = {
       verify: jest.fn(),
     };
 
-    // Setup the mocks
-    mockGetTokenVerifier = jest.mocked(getTokenVerifier);
-    mockGetAppContext = jest.mocked(getAppContext);
+    mockGetTokenVerifier = getTokenVerifier as jest.MockedFunction<typeof getTokenVerifier>;
+    mockGetTokenVerifier.mockResolvedValue(mockTokenVerifier);
 
-    mockGetTokenVerifier.mockResolvedValue(mockTokenVerifier as any);
+    // Setup app context mock with default organization
+    mockGetAppContext = getAppContext as jest.MockedFunction<typeof getAppContext>;
     mockGetAppContext.mockReturnValue({
       account: {
-        organizationId: 'app-org-123'
+        organizationId: 'test-org-123'
       }
     } as any);
   });
 
-  describe('validateAccessToken', () => {
-    it('should return true for valid token', async () => {
-      // Arrange
-      const validToken = 'valid-access-token';
+  describe('authorizeRegularRequest', () => {
+    beforeEach(() => {
+      // Default to successful token verification
       mockTokenVerifier.verify.mockResolvedValue(true);
-
-      // Act
-      const result = await AuthUtils.validateAccessToken(validToken);
-
-      // Assert
-      expect(result).toBe(true);
-      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-      expect(mockTokenVerifier.verify).toHaveBeenCalledWith(validToken);
-      expect(logger.error).not.toHaveBeenCalled();
-    });
-
-    it('should return false for invalid token', async () => {
-      // Arrange
-      const invalidToken = 'invalid-access-token';
-      mockTokenVerifier.verify.mockResolvedValue(false);
-
-      // Act
-      const result = await AuthUtils.validateAccessToken(invalidToken);
-
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-      expect(mockTokenVerifier.verify).toHaveBeenCalledWith(invalidToken);
-      expect(logger.error).not.toHaveBeenCalled();
-    });
-
-    it('should return false for undefined token', async () => {
-      // Act
-      const result = await AuthUtils.validateAccessToken(undefined);
-
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetTokenVerifier).not.toHaveBeenCalled();
-      expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
-      expect(logger.error).not.toHaveBeenCalled();
-    });
-
-    it('should return false for null token', async () => {
-      // Act
-      const result = await AuthUtils.validateAccessToken(null as any);
-
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetTokenVerifier).not.toHaveBeenCalled();
-      expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
-      expect(logger.error).not.toHaveBeenCalled();
-    });
-
-    it('should return false for empty string token', async () => {
-      // Act
-      const result = await AuthUtils.validateAccessToken('');
-
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetTokenVerifier).not.toHaveBeenCalled();
-      expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
-      expect(logger.error).not.toHaveBeenCalled();
     });
 
-    it('should return false and log error when getTokenVerifier fails', async () => {
-      // Arrange
-      const validToken = 'valid-access-token';
-      const error = new Error('Failed to get token verifier');
-      mockGetTokenVerifier.mockRejectedValue(error);
+    describe('when request is for discovery endpoint', () => {
+      it('should return true without authentication', async () => {
+        const request = { path: '/discovery' };
 
-      // Act
-      const result = await AuthUtils.validateAccessToken(validToken);
+        const result = await authorizeRegularRequest(request);
 
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-      expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', error);
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
     });
 
-    it('should return false and log error when token verification throws', async () => {
-      // Arrange
-      const validToken = 'valid-access-token';
-      const error = new Error('Token verification failed');
-      mockTokenVerifier.verify.mockRejectedValue(error);
+    describe('when request is for ready endpoint', () => {
+      it('should return true without authentication', async () => {
+        const request = { path: '/ready' };
 
-      // Act
-      const result = await AuthUtils.validateAccessToken(validToken);
+        const result = await authorizeRegularRequest(request);
 
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-      expect(mockTokenVerifier.verify).toHaveBeenCalledWith(validToken);
-      expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', error);
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
     });
 
-    it('should handle whitespace-only token', async () => {
-      // Arrange
-      mockTokenVerifier.verify.mockResolvedValue(false);
-
-      // Act
-      const result = await AuthUtils.validateAccessToken('   ');
-
-      // Assert - whitespace-only string should be treated as truthy and passed to verifier
-      expect(result).toBe(false);
-      expect(mockGetTokenVerifier).toHaveBeenCalledTimes(1);
-      expect(mockTokenVerifier.verify).toHaveBeenCalledWith('   ');
-    });
-  });
-
-  describe('extractAuthData', () => {
-    const createValidRequest = (): any => ({
-      bodyJSON: {
-        auth: {
-          provider: 'OptiID',
-          credentials: {
-            access_token: 'valid-access-token',
-            customer_id: 'org-123',
-            instance_id: 'instance-456',
-            product_sku: 'OPAL'
+    describe('when request has valid authentication', () => {
+      it('should return true for valid OptiID token with matching organization', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
           }
-        } as OptiIdAuthData
-      }
-    });
-
-    it('should extract auth data successfully from valid request', () => {
-      // Arrange
-      const request = createValidRequest();
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).not.toBeNull();
-      expect(result?.authData).toBe(request.bodyJSON.auth);
-      expect(result?.accessToken).toBe('valid-access-token');
-      expect(logger.error).not.toHaveBeenCalled();
-    });
-
-    it('should handle case-insensitive provider name', () => {
-      // Arrange
-      const request = createValidRequest();
-      request.bodyJSON.auth.provider = 'optiid'; // lowercase
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).not.toBeNull();
-      expect(result?.authData).toBe(request.bodyJSON.auth);
-      expect(result?.accessToken).toBe('valid-access-token');
-      expect(logger.error).not.toHaveBeenCalled();
-    });
-
-    it('should handle mixed case provider name', () => {
-      // Arrange
-      const request = createValidRequest();
-      request.bodyJSON.auth.provider = 'OpTiId'; // mixed case
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).not.toBeNull();
-      expect(result?.authData).toBe(request.bodyJSON.auth);
-      expect(result?.accessToken).toBe('valid-access-token');
-      expect(logger.error).not.toHaveBeenCalled();
-    });
-
-    it('should return null when access token is missing', () => {
-      // Arrange
-      const request = createValidRequest();
-      delete request.bodyJSON.auth.credentials.access_token;
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-    });
-
-    it('should return null when access token is undefined', () => {
-      // Arrange
-      const request = createValidRequest();
-      request.bodyJSON.auth.credentials.access_token = undefined;
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-    });
-
-    it('should return null when access token is empty string', () => {
-      // Arrange
-      const request = createValidRequest();
-      request.bodyJSON.auth.credentials.access_token = '';
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-    });
-
-    it('should return null when provider is not OptiID', () => {
-      // Arrange
-      const request = createValidRequest();
-      request.bodyJSON.auth.provider = 'SomeOtherProvider';
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-    });
-
-    it('should return null when provider is missing', () => {
-      // Arrange
-      const request = createValidRequest();
-      delete request.bodyJSON.auth.provider;
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-    });
-
-    it('should return null when auth structure is missing', () => {
-      // Arrange
-      const request = {
-        bodyJSON: {
-          parameters: { some: 'data' }
-        }
-      };
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-    });
-
-    it('should return null when credentials structure is missing', () => {
-      // Arrange
-      const request = {
-        bodyJSON: {
-          auth: {
-            provider: 'OptiID'
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+
+      it('should handle case-insensitive provider names', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'optiid', // lowercase
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
           }
-        }
-      };
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-    });
-
-    it('should return null when bodyJSON is missing', () => {
-      // Arrange
-      const request = {};
-
-      // Act
-      const result = AuthUtils.extractAuthData(request);
-
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-    });
-
-    it('should return null when request is null', () => {
-      // Act
-      const result = AuthUtils.extractAuthData(null);
-
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
-    });
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+
+      it('should handle mixed case provider names', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OpTiId', // mixed case
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+    });
+
+    describe('when authentication fails', () => {
+      it('should return false when auth data is missing', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {}
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
+
+      it('should return false when bodyJSON is missing', async () => {
+        const request = {
+          path: '/some-tool'
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when provider is not OptiID', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'SomeOtherProvider',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'some-token'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is missing', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123'
+                // access_token missing
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is empty string', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: ''
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is undefined', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: undefined
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+    });
+
+    describe('when organization validation fails', () => {
+      it('should return false when customer_id does not match app organization', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'different-org-456',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith(
+          'Invalid organisation ID: expected test-org-123, received different-org-456'
+        );
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
+
+      it('should return false when customer_id is missing', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                access_token: 'valid-token-123'
+                // customer_id missing
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+      });
+
+      it('should return false when customer_id is empty string', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: '',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+      });
+
+      it('should handle case when app context has no account', async () => {
+        mockGetAppContext.mockReturnValue({} as any);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'some-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith(
+          'Invalid organisation ID: expected undefined, received some-org-123'
+        );
+      });
+
+      it('should handle case when app context is null', async () => {
+        mockGetAppContext.mockReturnValue(null as any);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'some-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith(
+          'Invalid organisation ID: expected undefined, received some-org-123'
+        );
+      });
+    });
+
+    describe('when token validation fails', () => {
+      it('should return false when token verifier returns false', async () => {
+        mockTokenVerifier.verify.mockResolvedValue(false);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'invalid-token'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
+      });
+
+      it('should return false when token verification throws an error', async () => {
+        const verificationError = new Error('Token verification failed');
+        mockTokenVerifier.verify.mockRejectedValue(verificationError);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'error-token'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
+      });
+
+      it('should return false when getTokenVerifier throws an error', async () => {
+        const verifierError = new Error('Failed to get token verifier');
+        mockGetTokenVerifier.mockRejectedValue(verifierError);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'some-token'
+              }
+            }
+          }
+        };
 
-    it('should return null when request is undefined', () => {
-      // Act
-      const result = AuthUtils.extractAuthData(undefined);
+        const result = await authorizeRegularRequest(request);
 
-      // Assert
-      expect(result).toBeNull();
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verifierError);
+      });
     });
   });
 
-  describe('validateOrganizationId', () => {
+  describe('authorizeGlobalRequest', () => {
     beforeEach(() => {
-      mockGetAppContext.mockReturnValue({
-        account: {
-          organizationId: 'app-org-123'
-        }
-      } as any);
-    });
-
-    it('should return true when customer ID matches app organization ID', () => {
-      // Act
-      const result = AuthUtils.validateOrganizationId('app-org-123');
-
-      // Assert
-      expect(result).toBe(true);
-      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-      expect(logger.error).not.toHaveBeenCalled();
-    });
-
-    it('should return false when customer ID does not match app organization ID', () => {
-      // Act
-      const result = AuthUtils.validateOrganizationId('different-org-456');
-
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-      expect(logger.error).toHaveBeenCalledWith(
-        'Invalid organisation ID: expected app-org-123, received different-org-456'
-      );
-    });
-
-    it('should return false when customer ID is undefined', () => {
-      // Act
-      const result = AuthUtils.validateOrganizationId(undefined);
-
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetAppContext).not.toHaveBeenCalled();
-      expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+      // Default to successful token verification
+      mockTokenVerifier.verify.mockResolvedValue(true);
     });
 
-    it('should return false when customer ID is null', () => {
-      // Act
-      const result = AuthUtils.validateOrganizationId(null as any);
-
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetAppContext).not.toHaveBeenCalled();
-      expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
-    });
+    describe('when request is for discovery endpoint', () => {
+      it('should return true without authentication', async () => {
+        const request = { path: '/discovery' };
 
-    it('should return false when customer ID is empty string', () => {
-      // Act
-      const result = AuthUtils.validateOrganizationId('');
+        const result = await authorizeGlobalRequest(request);
 
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetAppContext).not.toHaveBeenCalled();
-      expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
     });
 
-    it('should handle case when app context has no account', () => {
-      // Arrange
-      mockGetAppContext.mockReturnValue({} as any);
+    describe('when request is for ready endpoint', () => {
+      it('should return true without authentication', async () => {
+        const request = { path: '/ready' };
 
-      // Act
-      const result = AuthUtils.validateOrganizationId('some-org-123');
+        const result = await authorizeGlobalRequest(request);
 
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-      expect(logger.error).toHaveBeenCalledWith(
-        'Invalid organisation ID: expected undefined, received some-org-123'
-      );
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
     });
 
-    it('should handle case when app context account has no organizationId', () => {
-      // Arrange
-      mockGetAppContext.mockReturnValue({
-        account: {}
-      } as any);
-
-      // Act
-      const result = AuthUtils.validateOrganizationId('some-org-123');
-
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-      expect(logger.error).toHaveBeenCalledWith(
-        'Invalid organisation ID: expected undefined, received some-org-123'
-      );
-    });
-
-    it('should handle case when app context is null', () => {
-      // Arrange
-      mockGetAppContext.mockReturnValue(null as any);
+    describe('when request has valid authentication', () => {
+      it('should return true for valid OptiID token regardless of organization', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'different-org-456', // Different from app org
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+        // Should not log organization validation errors for global requests
+        expect(logger.error).not.toHaveBeenCalledWith(
+          expect.stringContaining('Invalid organisation ID')
+        );
+      });
+
+      it('should return true even without customer_id', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                access_token: 'valid-token-123'
+                // No customer_id - should be fine for global functions
+              }
+            }
+          }
+        };
+
+        const result = await authorizeGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+
+      it('should handle case-insensitive provider names', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'optiid',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+    });
+
+    describe('when authentication fails', () => {
+      it('should return false when auth data is missing', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {}
+        };
+
+        const result = await authorizeGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when provider is not OptiID', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'SomeOtherProvider',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'some-token'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is missing', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org'
+                // access_token missing
+              }
+            }
+          }
+        };
+
+        const result = await authorizeGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is empty', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: ''
+              }
+            }
+          }
+        };
 
-      // Act
-      const result = AuthUtils.validateOrganizationId('some-org-123');
+        const result = await authorizeGlobalRequest(request);
 
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-      expect(logger.error).toHaveBeenCalledWith(
-        'Invalid organisation ID: expected undefined, received some-org-123'
-      );
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
     });
 
-    it('should be case-sensitive for organization ID matching', () => {
-      // Arrange
-      mockGetAppContext.mockReturnValue({
-        account: {
-          organizationId: 'App-Org-123' // different case
-        }
-      } as any);
-
-      // Act
-      const result = AuthUtils.validateOrganizationId('app-org-123');
+    describe('when token validation fails', () => {
+      it('should return false when token verifier returns false', async () => {
+        mockTokenVerifier.verify.mockResolvedValue(false);
 
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-      expect(logger.error).toHaveBeenCalledWith(
-        'Invalid organisation ID: expected App-Org-123, received app-org-123'
-      );
-    });
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'invalid-token'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
+      });
+
+      it('should return false when token verification throws an error', async () => {
+        const verificationError = new Error('Global token verification failed');
+        mockTokenVerifier.verify.mockRejectedValue(verificationError);
+
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'error-token'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
+      });
+    });
+
+    describe('organization validation differences from authorizeRegularRequest', () => {
+      it('should NOT validate organization ID and allow any customer_id', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'completely-different-org',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authorizeGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+        // Should NOT log organization validation errors
+        expect(logger.error).not.toHaveBeenCalledWith(
+          expect.stringContaining('Invalid organisation ID')
+        );
+        expect(logger.error).not.toHaveBeenCalledWith(
+          expect.stringContaining('Organisation ID is required')
+        );
+      });
+
+      it('should work even when app context has no organization', async () => {
+        mockGetAppContext.mockReturnValue({} as any);
+
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
 
-    it('should handle whitespace-only customer ID', () => {
-      // Act
-      const result = AuthUtils.validateOrganizationId('   ');
+        const result = await authorizeGlobalRequest(request);
 
-      // Assert
-      expect(result).toBe(false);
-      expect(mockGetAppContext).toHaveBeenCalledTimes(1);
-      expect(logger.error).toHaveBeenCalledWith(
-        'Invalid organisation ID: expected app-org-123, received    '
-      );
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
     });
   });
 
-  describe('integration scenarios', () => {
-    it('should handle complete authentication flow for valid request', async () => {
-      // Arrange
+  describe('edge cases and error handling', () => {
+    it('should handle requests with null bodyJSON', async () => {
       const request = {
-        bodyJSON: {
-          auth: {
-            provider: 'OptiID',
-            credentials: {
-              access_token: 'valid-access-token',
-              customer_id: 'app-org-123',
-              instance_id: 'instance-456',
-              product_sku: 'OPAL'
-            }
-          } as OptiIdAuthData
-        }
+        path: '/some-tool',
+        bodyJSON: null
       };
 
-      mockGetAppContext.mockReturnValue({
-        account: {
-          organizationId: 'app-org-123'
-        }
-      } as any);
+      const result1 = await authorizeRegularRequest(request);
+      const result2 = await authorizeGlobalRequest(request);
 
-      mockTokenVerifier.verify.mockResolvedValue(true);
-
-      // Act
-      const authInfo = AuthUtils.extractAuthData(request);
-      const isValidOrg = authInfo
-        ? AuthUtils.validateOrganizationId(authInfo.authData.credentials?.customer_id)
-        : false;
-      const isValidToken = authInfo ? await AuthUtils.validateAccessToken(authInfo.accessToken) : false;
-
-      // Assert
-      expect(authInfo).not.toBeNull();
-      expect(isValidOrg).toBe(true);
-      expect(isValidToken).toBe(true);
-      expect(logger.error).not.toHaveBeenCalled();
+      expect(result1).toBe(false);
+      expect(result2).toBe(false);
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
     });
 
-    it('should handle complete authentication flow for invalid provider', async () => {
-      // Arrange
+    it('should handle malformed auth objects', async () => {
       const request = {
+        path: '/some-tool',
         bodyJSON: {
-          auth: {
-            provider: 'SomeOtherProvider',
-            credentials: {
-              access_token: 'valid-access-token',
-              customer_id: 'app-org-123',
-              instance_id: 'instance-456',
-              product_sku: 'OPAL'
-            }
-          } as OptiIdAuthData
+          auth: 'invalid-auth-format'
         }
       };
 
-      // Act
-      const authInfo = AuthUtils.extractAuthData(request);
+      const result1 = await authorizeRegularRequest(request);
+      const result2 = await authorizeGlobalRequest(request);
 
-      // Assert
-      expect(authInfo).toBeNull();
+      expect(result1).toBe(false);
+      expect(result2).toBe(false);
       expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
     });
-
-    it('should handle complete authentication flow for organization mismatch', async () => {
-      // Arrange
-      const request = {
-        bodyJSON: {
-          auth: {
-            provider: 'OptiID',
-            credentials: {
-              access_token: 'valid-access-token',
-              customer_id: 'different-org-456',
-              instance_id: 'instance-456',
-              product_sku: 'OPAL'
-            }
-          } as OptiIdAuthData
-        }
-      };
-
-      mockGetAppContext.mockReturnValue({
-        account: {
-          organizationId: 'app-org-123'
-        }
-      } as any);
-
-      // Act
-      const authInfo = AuthUtils.extractAuthData(request);
-      const isValidOrg = authInfo
-        ? AuthUtils.validateOrganizationId(authInfo.authData.credentials?.customer_id)
-        : false;
-
-      // Assert
-      expect(authInfo).not.toBeNull();
-      expect(isValidOrg).toBe(false);
-      expect(logger.error).toHaveBeenCalledWith(
-        'Invalid organisation ID: expected app-org-123, received different-org-456'
-      );
-    });
   });
 });