@optimizely-opal/opal-tool-ocp-sdk 1.0.0-beta.1 → 1.0.0-beta.10

package/src/auth/AuthUtils.test.ts

@@ -1,7 +1,8 @@
 /* eslint-disable @typescript-eslint/no-unsafe-call */
 import { getAppContext, logger } from '@zaiusinc/app-sdk';
 import { getTokenVerifier } from './TokenVerifier';
-import { authenticateRegularRequest, authenticateGlobalRequest } from './AuthUtils';
+import { authenticateRegularRequest, authenticateGlobalRequest, authenticateInternalRequest } from './AuthUtils';
+import { ToolError } from '../types/ToolError';
 
 // Mock the dependencies
 jest.mock('./TokenVerifier', () => ({
@@ -50,31 +51,27 @@ describe('AuthUtils', () => {
     });
 
     describe('when request is for discovery endpoint', () => {
-      it('should return true without authentication', async () => {
+      it('should succeed without authentication', async () => {
         const request = { path: '/discovery' };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).not.toHaveBeenCalled();
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
     });
 
     describe('when request is for ready endpoint', () => {
-      it('should return true without authentication', async () => {
+      it('should succeed without authentication', async () => {
         const request = { path: '/ready' };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).not.toHaveBeenCalled();
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
     });
 
     describe('when request has valid authentication', () => {
-      it('should return true for valid OptiID token with matching organization', async () => {
+      it('should succeed for valid OptiID token with matching organization', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -88,9 +85,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).toHaveBeenCalled();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
@@ -109,9 +104,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
 
@@ -129,39 +122,31 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
     });
 
     describe('when authentication fails', () => {
-      it('should return false when auth data is missing', async () => {
+      it('should throw ToolError when auth data is missing', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {}
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
 
-      it('should return false when bodyJSON is missing', async () => {
+      it('should throw ToolError when bodyJSON is missing', async () => {
         const request = {
           path: '/some-tool'
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when provider is not OptiID', async () => {
+      it('should throw ToolError when provider is not OptiID', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -175,13 +160,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is missing', async () => {
+      it('should throw ToolError when access token is missing', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -195,13 +177,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is empty string', async () => {
+      it('should throw ToolError when access token is empty string', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -215,13 +194,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is undefined', async () => {
+      it('should throw ToolError when access token is undefined', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -235,15 +211,12 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
     });
 
     describe('when organization validation fails', () => {
-      it('should return false when customer_id does not match app organization', async () => {
+      it('should throw ToolError when customer_id does not match app organization', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -257,16 +230,11 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith(
-          'Invalid organisation ID: expected test-org-123, received different-org-456'
-        );
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
 
-      it('should return false when customer_id is missing', async () => {
+      it('should throw ToolError when customer_id is missing', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -280,13 +248,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when customer_id is empty string', async () => {
+      it('should throw ToolError when customer_id is empty string', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -300,10 +265,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
       it('should handle case when app context has no account', async () => {
@@ -322,12 +284,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith(
-          'Invalid organisation ID: expected undefined, received some-org-123'
-        );
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
       it('should handle case when app context is null', async () => {
@@ -346,17 +303,12 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith(
-          'Invalid organisation ID: expected undefined, received some-org-123'
-        );
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
     });
 
     describe('when token validation fails', () => {
-      it('should return false when token verifier returns false', async () => {
+      it('should throw ToolError when token verifier returns false', async () => {
         mockTokenVerifier.verify.mockResolvedValue(false);
 
         const request = {
@@ -372,13 +324,11 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
       });
 
-      it('should return false when token verification throws an error', async () => {
+      it('should throw ToolError when token verification throws an error', async () => {
         const verificationError = new Error('Token verification failed');
         mockTokenVerifier.verify.mockRejectedValue(verificationError);
 
@@ -395,13 +345,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when getTokenVerifier throws an error', async () => {
+      it('should throw ToolError when getTokenVerifier throws an error', async () => {
         const verifierError = new Error('Failed to get token verifier');
         mockGetTokenVerifier.mockRejectedValue(verifierError);
 
@@ -418,10 +365,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verifierError);
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
     });
   });
@@ -433,31 +377,27 @@ describe('AuthUtils', () => {
     });
 
     describe('when request is for discovery endpoint', () => {
-      it('should return true without authentication', async () => {
+      it('should succeed without authentication', async () => {
         const request = { path: '/discovery' };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).not.toHaveBeenCalled();
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
     });
 
     describe('when request is for ready endpoint', () => {
-      it('should return true without authentication', async () => {
+      it('should succeed without authentication', async () => {
         const request = { path: '/ready' };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).not.toHaveBeenCalled();
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
     });
 
     describe('when request has valid authentication', () => {
-      it('should return true for valid OptiID token regardless of organization', async () => {
+      it('should succeed for valid OptiID token regardless of organization', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -471,9 +411,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
         // Should not log organization validation errors for global requests
         expect(logger.error).not.toHaveBeenCalledWith(
@@ -481,7 +419,7 @@ describe('AuthUtils', () => {
         );
       });
 
-      it('should return true even without customer_id', async () => {
+      it('should succeed even without customer_id', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -495,9 +433,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
 
@@ -515,27 +451,22 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
     });
 
     describe('when authentication fails', () => {
-      it('should return false when auth data is missing', async () => {
+      it('should throw ToolError when auth data is missing', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {}
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when provider is not OptiID', async () => {
+      it('should throw ToolError when provider is not OptiID', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -549,13 +480,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is missing', async () => {
+      it('should throw ToolError when access token is missing', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -569,13 +497,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is empty', async () => {
+      it('should throw ToolError when access token is empty', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -589,15 +514,12 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
     });
 
     describe('when token validation fails', () => {
-      it('should return false when token verifier returns false', async () => {
+      it('should throw ToolError when token verifier returns false', async () => {
         mockTokenVerifier.verify.mockResolvedValue(false);
 
         const request = {
@@ -613,13 +535,11 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
       });
 
-      it('should return false when token verification throws an error', async () => {
+      it('should throw ToolError when token verification throws an error', async () => {
         const verificationError = new Error('Global token verification failed');
         mockTokenVerifier.verify.mockRejectedValue(verificationError);
 
@@ -636,10 +556,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
     });
 
@@ -658,9 +575,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
         // Should NOT log organization validation errors
         expect(logger.error).not.toHaveBeenCalledWith(
@@ -687,9 +602,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
     });
@@ -702,12 +615,8 @@ describe('AuthUtils', () => {
         bodyJSON: null
       };
 
-      const result1 = await authenticateRegularRequest(request);
-      const result2 = await authenticateGlobalRequest(request);
-
-      expect(result1).toBe(false);
-      expect(result2).toBe(false);
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
+      await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
     });
 
     it('should handle malformed auth objects', async () => {
@@ -718,12 +627,122 @@ describe('AuthUtils', () => {
         }
       };
 
-      const result1 = await authenticateRegularRequest(request);
-      const result2 = await authenticateGlobalRequest(request);
+      await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
+      await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
+    });
+  });
+
+  describe('authenticateInternalRequest', () => {
+    it('should return true for valid OptiID token in Authorization header', async () => {
+      mockTokenVerifier.verify.mockResolvedValue(true);
+
+      const mockRequest = {
+        headers: {
+          get: jest.fn().mockImplementation((name: string) => {
+            if (name === 'Authorization') return 'valid-internal-token';
+            return null;
+          })
+        }
+      } as any;
+
+      await expect(authenticateInternalRequest(mockRequest)).resolves.toBeUndefined();
+      expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-internal-token');
+    });
+
+    it('should return true for valid OptiID token in lowercase header', async () => {
+      mockTokenVerifier.verify.mockResolvedValue(true);
+
+      const mockRequest = {
+        headers: {
+          get: jest.fn().mockImplementation((name: string) => {
+            if (name === 'authorization') return 'valid-internal-token';
+            return null;
+          })
+        }
+      } as any;
+
+      await expect(authenticateInternalRequest(mockRequest)).resolves.toBeUndefined();
+      expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-internal-token');
+    });
+
+    it('should throw ToolError when Authorization header is missing', async () => {
+      const mockRequest = {
+        headers: {
+          get: jest.fn().mockReturnValue(null) // No Authorization header
+        }
+      } as any;
+
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow(ToolError);
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow('Unauthorized');
+    });
+
+    it('should throw ToolError when headers object is missing', async () => {
+      const mockRequest = {} as any; // No headers object
+
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow(ToolError);
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow('Unauthorized');
+    });
+
+    it('should throw ToolError when token verification fails', async () => {
+      mockTokenVerifier.verify.mockResolvedValue(false);
+
+      const mockRequest = {
+        headers: {
+          get: jest.fn().mockImplementation((name: string) => {
+            if (name === 'Authorization') return 'invalid-token';
+            return null;
+          })
+        }
+      } as any;
+
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow(ToolError);
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow('Unauthorized');
+    });
+
+    it('should throw ToolError when token verifier throws an error', async () => {
+      mockTokenVerifier.verify.mockRejectedValue(new Error('Token service unavailable'));
+
+      const mockRequest = {
+        headers: {
+          get: jest.fn().mockImplementation((name: string) => {
+            if (name === 'Authorization') return 'some-token';
+            return null;
+          })
+        }
+      } as any;
+
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow(ToolError);
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow('Unauthorized');
+    });
+
+    it('should throw ToolError when token verification throws an error', async () => {
+      mockTokenVerifier.verify.mockRejectedValue(new Error('Service error'));
+
+      const mockRequest = {
+        headers: {
+          get: jest.fn().mockImplementation((name: string) => {
+            if (name === 'Authorization') return 'valid-token';
+            return null;
+          })
+        }
+      } as any;
+
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow(ToolError);
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow('Unauthorized');
+    });
+
+    it('should handle empty string token', async () => {
+      const mockRequest = {
+        headers: {
+          get: jest.fn().mockImplementation((name: string) => {
+            if (name === 'Authorization') return '';
+            return null;
+          })
+        }
+      } as any;
 
-      expect(result1).toBe(false);
-      expect(result2).toBe(false);
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow(ToolError);
+      await expect(authenticateInternalRequest(mockRequest)).rejects.toThrow('Unauthorized');
     });
   });
 });