@optimizely-opal/opal-tool-ocp-sdk 0.0.0-devmg.13 → 1.0.0-beta.1

package/src/auth/AuthUtils.test.ts

@@ -0,0 +1,729 @@
+/* eslint-disable @typescript-eslint/no-unsafe-call */
+import { getAppContext, logger } from '@zaiusinc/app-sdk';
+import { getTokenVerifier } from './TokenVerifier';
+import { authenticateRegularRequest, authenticateGlobalRequest } from './AuthUtils';
+
+// Mock the dependencies
+jest.mock('./TokenVerifier', () => ({
+  getTokenVerifier: jest.fn(),
+}));
+
+jest.mock('@zaiusinc/app-sdk', () => ({
+  getAppContext: jest.fn(),
+  logger: {
+    info: jest.fn(),
+    error: jest.fn(),
+    warn: jest.fn(),
+    debug: jest.fn(),
+  },
+}));
+
+describe('AuthUtils', () => {
+  let mockTokenVerifier: any;
+  let mockGetTokenVerifier: jest.MockedFunction<typeof getTokenVerifier>;
+  let mockGetAppContext: jest.MockedFunction<typeof getAppContext>;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    // Setup token verifier mock
+    mockTokenVerifier = {
+      verify: jest.fn(),
+    };
+
+    mockGetTokenVerifier = getTokenVerifier as jest.MockedFunction<typeof getTokenVerifier>;
+    mockGetTokenVerifier.mockResolvedValue(mockTokenVerifier);
+
+    // Setup app context mock with default organization
+    mockGetAppContext = getAppContext as jest.MockedFunction<typeof getAppContext>;
+    mockGetAppContext.mockReturnValue({
+      account: {
+        organizationId: 'test-org-123'
+      }
+    } as any);
+  });
+
+  describe('authenticateRegularRequest', () => {
+    beforeEach(() => {
+      // Default to successful token verification
+      mockTokenVerifier.verify.mockResolvedValue(true);
+    });
+
+    describe('when request is for discovery endpoint', () => {
+      it('should return true without authentication', async () => {
+        const request = { path: '/discovery' };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
+    });
+
+    describe('when request is for ready endpoint', () => {
+      it('should return true without authentication', async () => {
+        const request = { path: '/ready' };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
+    });
+
+    describe('when request has valid authentication', () => {
+      it('should return true for valid OptiID token with matching organization', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+
+      it('should handle case-insensitive provider names', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'optiid', // lowercase
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+
+      it('should handle mixed case provider names', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OpTiId', // mixed case
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+    });
+
+    describe('when authentication fails', () => {
+      it('should return false when auth data is missing', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {}
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
+
+      it('should return false when bodyJSON is missing', async () => {
+        const request = {
+          path: '/some-tool'
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when provider is not OptiID', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'SomeOtherProvider',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'some-token'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is missing', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123'
+                // access_token missing
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is empty string', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: ''
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is undefined', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: undefined
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+    });
+
+    describe('when organization validation fails', () => {
+      it('should return false when customer_id does not match app organization', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'different-org-456',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith(
+          'Invalid organisation ID: expected test-org-123, received different-org-456'
+        );
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
+
+      it('should return false when customer_id is missing', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                access_token: 'valid-token-123'
+                // customer_id missing
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+      });
+
+      it('should return false when customer_id is empty string', async () => {
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: '',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+      });
+
+      it('should handle case when app context has no account', async () => {
+        mockGetAppContext.mockReturnValue({} as any);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'some-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith(
+          'Invalid organisation ID: expected undefined, received some-org-123'
+        );
+      });
+
+      it('should handle case when app context is null', async () => {
+        mockGetAppContext.mockReturnValue(null as any);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'some-org-123',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith(
+          'Invalid organisation ID: expected undefined, received some-org-123'
+        );
+      });
+    });
+
+    describe('when token validation fails', () => {
+      it('should return false when token verifier returns false', async () => {
+        mockTokenVerifier.verify.mockResolvedValue(false);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'invalid-token'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
+      });
+
+      it('should return false when token verification throws an error', async () => {
+        const verificationError = new Error('Token verification failed');
+        mockTokenVerifier.verify.mockRejectedValue(verificationError);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'error-token'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
+      });
+
+      it('should return false when getTokenVerifier throws an error', async () => {
+        const verifierError = new Error('Failed to get token verifier');
+        mockGetTokenVerifier.mockRejectedValue(verifierError);
+
+        const request = {
+          path: '/some-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'test-org-123',
+                access_token: 'some-token'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateRegularRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verifierError);
+      });
+    });
+  });
+
+  describe('authenticateGlobalRequest', () => {
+    beforeEach(() => {
+      // Default to successful token verification
+      mockTokenVerifier.verify.mockResolvedValue(true);
+    });
+
+    describe('when request is for discovery endpoint', () => {
+      it('should return true without authentication', async () => {
+        const request = { path: '/discovery' };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
+    });
+
+    describe('when request is for ready endpoint', () => {
+      it('should return true without authentication', async () => {
+        const request = { path: '/ready' };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockGetTokenVerifier).not.toHaveBeenCalled();
+        expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
+      });
+    });
+
+    describe('when request has valid authentication', () => {
+      it('should return true for valid OptiID token regardless of organization', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'different-org-456', // Different from app org
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+        // Should not log organization validation errors for global requests
+        expect(logger.error).not.toHaveBeenCalledWith(
+          expect.stringContaining('Invalid organisation ID')
+        );
+      });
+
+      it('should return true even without customer_id', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                access_token: 'valid-token-123'
+                // No customer_id - should be fine for global functions
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+
+      it('should handle case-insensitive provider names', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'optiid',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+    });
+
+    describe('when authentication fails', () => {
+      it('should return false when auth data is missing', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {}
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when provider is not OptiID', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'SomeOtherProvider',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'some-token'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is missing', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org'
+                // access_token missing
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+
+      it('should return false when access token is empty', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: ''
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      });
+    });
+
+    describe('when token validation fails', () => {
+      it('should return false when token verifier returns false', async () => {
+        mockTokenVerifier.verify.mockResolvedValue(false);
+
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'invalid-token'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
+      });
+
+      it('should return false when token verification throws an error', async () => {
+        const verificationError = new Error('Global token verification failed');
+        mockTokenVerifier.verify.mockRejectedValue(verificationError);
+
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'error-token'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(false);
+        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
+      });
+    });
+
+    describe('organization validation differences from authenticateRegularRequest', () => {
+      it('should NOT validate organization ID and allow any customer_id', async () => {
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'completely-different-org',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+        // Should NOT log organization validation errors
+        expect(logger.error).not.toHaveBeenCalledWith(
+          expect.stringContaining('Invalid organisation ID')
+        );
+        expect(logger.error).not.toHaveBeenCalledWith(
+          expect.stringContaining('Organisation ID is required')
+        );
+      });
+
+      it('should work even when app context has no organization', async () => {
+        mockGetAppContext.mockReturnValue({} as any);
+
+        const request = {
+          path: '/global-tool',
+          bodyJSON: {
+            auth: {
+              provider: 'OptiID',
+              credentials: {
+                customer_id: 'any-org',
+                access_token: 'valid-token-123'
+              }
+            }
+          }
+        };
+
+        const result = await authenticateGlobalRequest(request);
+
+        expect(result).toBe(true);
+        expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
+      });
+    });
+  });
+
+  describe('edge cases and error handling', () => {
+    it('should handle requests with null bodyJSON', async () => {
+      const request = {
+        path: '/some-tool',
+        bodyJSON: null
+      };
+
+      const result1 = await authenticateRegularRequest(request);
+      const result2 = await authenticateGlobalRequest(request);
+
+      expect(result1).toBe(false);
+      expect(result2).toBe(false);
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+
+    it('should handle malformed auth objects', async () => {
+      const request = {
+        path: '/some-tool',
+        bodyJSON: {
+          auth: 'invalid-auth-format'
+        }
+      };
+
+      const result1 = await authenticateRegularRequest(request);
+      const result2 = await authenticateGlobalRequest(request);
+
+      expect(result1).toBe(false);
+      expect(result2).toBe(false);
+      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+    });
+  });
+});