@optimizely-opal/opal-tool-ocp-sdk 1.0.0-beta.3 → 1.0.0-beta.5

package/src/auth/AuthUtils.test.ts

@@ -2,6 +2,7 @@
 import { getAppContext, logger } from '@zaiusinc/app-sdk';
 import { getTokenVerifier } from './TokenVerifier';
 import { authenticateRegularRequest, authenticateGlobalRequest } from './AuthUtils';
+import { ToolError } from '../types/ToolError';
 
 // Mock the dependencies
 jest.mock('./TokenVerifier', () => ({
@@ -50,31 +51,27 @@ describe('AuthUtils', () => {
     });
 
     describe('when request is for discovery endpoint', () => {
-      it('should return true without authentication', async () => {
+      it('should succeed without authentication', async () => {
         const request = { path: '/discovery' };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).not.toHaveBeenCalled();
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
     });
 
     describe('when request is for ready endpoint', () => {
-      it('should return true without authentication', async () => {
+      it('should succeed without authentication', async () => {
         const request = { path: '/ready' };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).not.toHaveBeenCalled();
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
     });
 
     describe('when request has valid authentication', () => {
-      it('should return true for valid OptiID token with matching organization', async () => {
+      it('should succeed for valid OptiID token with matching organization', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -88,9 +85,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).toHaveBeenCalled();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
@@ -109,9 +104,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
 
@@ -129,39 +122,31 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateRegularRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
     });
 
     describe('when authentication fails', () => {
-      it('should return false when auth data is missing', async () => {
+      it('should throw ToolError when auth data is missing', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {}
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
 
-      it('should return false when bodyJSON is missing', async () => {
+      it('should throw ToolError when bodyJSON is missing', async () => {
         const request = {
           path: '/some-tool'
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when provider is not OptiID', async () => {
+      it('should throw ToolError when provider is not OptiID', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -175,13 +160,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is missing', async () => {
+      it('should throw ToolError when access token is missing', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -195,13 +177,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is empty string', async () => {
+      it('should throw ToolError when access token is empty string', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -215,13 +194,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is undefined', async () => {
+      it('should throw ToolError when access token is undefined', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -235,15 +211,12 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
     });
 
     describe('when organization validation fails', () => {
-      it('should return false when customer_id does not match app organization', async () => {
+      it('should throw ToolError when customer_id does not match app organization', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -257,16 +230,11 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith(
-          'Invalid organisation ID: expected test-org-123, received different-org-456'
-        );
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
 
-      it('should return false when customer_id is missing', async () => {
+      it('should throw ToolError when customer_id is missing', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -280,13 +248,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when customer_id is empty string', async () => {
+      it('should throw ToolError when customer_id is empty string', async () => {
         const request = {
           path: '/some-tool',
           bodyJSON: {
@@ -300,10 +265,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('Organisation ID is required but not provided');
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
       it('should handle case when app context has no account', async () => {
@@ -322,12 +284,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith(
-          'Invalid organisation ID: expected undefined, received some-org-123'
-        );
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
       it('should handle case when app context is null', async () => {
@@ -346,17 +303,12 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith(
-          'Invalid organisation ID: expected undefined, received some-org-123'
-        );
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
     });
 
     describe('when token validation fails', () => {
-      it('should return false when token verifier returns false', async () => {
+      it('should throw ToolError when token verifier returns false', async () => {
         mockTokenVerifier.verify.mockResolvedValue(false);
 
         const request = {
@@ -372,13 +324,11 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
       });
 
-      it('should return false when token verification throws an error', async () => {
+      it('should throw ToolError when token verification throws an error', async () => {
         const verificationError = new Error('Token verification failed');
         mockTokenVerifier.verify.mockRejectedValue(verificationError);
 
@@ -395,13 +345,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when getTokenVerifier throws an error', async () => {
+      it('should throw ToolError when getTokenVerifier throws an error', async () => {
         const verifierError = new Error('Failed to get token verifier');
         mockGetTokenVerifier.mockRejectedValue(verifierError);
 
@@ -418,10 +365,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateRegularRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verifierError);
+        await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
       });
     });
   });
@@ -433,31 +377,27 @@ describe('AuthUtils', () => {
     });
 
     describe('when request is for discovery endpoint', () => {
-      it('should return true without authentication', async () => {
+      it('should succeed without authentication', async () => {
         const request = { path: '/discovery' };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).not.toHaveBeenCalled();
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
     });
 
     describe('when request is for ready endpoint', () => {
-      it('should return true without authentication', async () => {
+      it('should succeed without authentication', async () => {
         const request = { path: '/ready' };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockGetTokenVerifier).not.toHaveBeenCalled();
         expect(mockTokenVerifier.verify).not.toHaveBeenCalled();
       });
     });
 
     describe('when request has valid authentication', () => {
-      it('should return true for valid OptiID token regardless of organization', async () => {
+      it('should succeed for valid OptiID token regardless of organization', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -471,9 +411,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
         // Should not log organization validation errors for global requests
         expect(logger.error).not.toHaveBeenCalledWith(
@@ -481,7 +419,7 @@ describe('AuthUtils', () => {
         );
       });
 
-      it('should return true even without customer_id', async () => {
+      it('should succeed even without customer_id', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -495,9 +433,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
 
@@ -515,27 +451,22 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
     });
 
     describe('when authentication fails', () => {
-      it('should return false when auth data is missing', async () => {
+      it('should throw ToolError when auth data is missing', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {}
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when provider is not OptiID', async () => {
+      it('should throw ToolError when provider is not OptiID', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -549,13 +480,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is missing', async () => {
+      it('should throw ToolError when access token is missing', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -569,13 +497,10 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
 
-      it('should return false when access token is empty', async () => {
+      it('should throw ToolError when access token is empty', async () => {
         const request = {
           path: '/global-tool',
           bodyJSON: {
@@ -589,15 +514,12 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
     });
 
     describe('when token validation fails', () => {
-      it('should return false when token verifier returns false', async () => {
+      it('should throw ToolError when token verifier returns false', async () => {
         mockTokenVerifier.verify.mockResolvedValue(false);
 
         const request = {
@@ -613,13 +535,11 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('invalid-token');
       });
 
-      it('should return false when token verification throws an error', async () => {
+      it('should throw ToolError when token verification throws an error', async () => {
         const verificationError = new Error('Global token verification failed');
         mockTokenVerifier.verify.mockRejectedValue(verificationError);
 
@@ -636,10 +556,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(false);
-        expect(logger.error).toHaveBeenCalledWith('OptiID token validation failed:', verificationError);
+        await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
       });
     });
 
@@ -658,9 +575,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
         // Should NOT log organization validation errors
         expect(logger.error).not.toHaveBeenCalledWith(
@@ -687,9 +602,7 @@ describe('AuthUtils', () => {
           }
         };
 
-        const result = await authenticateGlobalRequest(request);
-
-        expect(result).toBe(true);
+        await expect(authenticateGlobalRequest(request)).resolves.toBeUndefined();
         expect(mockTokenVerifier.verify).toHaveBeenCalledWith('valid-token-123');
       });
     });
@@ -702,12 +615,8 @@ describe('AuthUtils', () => {
         bodyJSON: null
       };
 
-      const result1 = await authenticateRegularRequest(request);
-      const result2 = await authenticateGlobalRequest(request);
-
-      expect(result1).toBe(false);
-      expect(result2).toBe(false);
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
+      await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
     });
 
     it('should handle malformed auth objects', async () => {
@@ -718,12 +627,8 @@ describe('AuthUtils', () => {
         }
       };
 
-      const result1 = await authenticateRegularRequest(request);
-      const result2 = await authenticateGlobalRequest(request);
-
-      expect(result1).toBe(false);
-      expect(result2).toBe(false);
-      expect(logger.error).toHaveBeenCalledWith('OptiID token is required but not provided');
+      await expect(authenticateRegularRequest(request)).rejects.toThrow(ToolError);
+      await expect(authenticateGlobalRequest(request)).rejects.toThrow(ToolError);
     });
   });
 });