@owlmeans/server-auth-token 0.1.18-rc.1

package/tests/context.ts

@@ -0,0 +1,109 @@
+import { AppType, makeBasicContext } from '@owlmeans/context'
+import type { BasicConfig, BasicContext } from '@owlmeans/context'
+import { createStaticResource } from '@owlmeans/static-resource'
+import { AUTH_IDENTITY_PROFILE } from '@owlmeans/server-auth-identity'
+import type { IdentityProfile } from '@owlmeans/server-auth-identity'
+import { AUTH_TOKEN_RESOURCE, GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
+import type { AccessTokenRecord } from '@owlmeans/auth-token'
+import { AuthRole } from '@owlmeans/auth'
+import { appendAuthTokenGuard } from '../src/append.js'
+import type { AuthTokenGuardOptions } from '../src/types.js'
+
+export const TEST_PREFIX = 'tst_'
+export const TEST_ENTITY = 'entity-1'
+export const TEST_PROFILE = 'profile-1'
+export const TEST_USER = 'user-1'
+
+/**
+ * A context with the two resources the guard reads and nothing else.
+ *
+ * Static resources rather than Mongo: the guard's contract is "which record makes a request
+ * authentic", and a database adds nothing to that question. The identity profile is a REAL record
+ * shape from `@owlmeans/server-auth-identity` — the guard reads a token's authority off it, so a
+ * stand-in of the wrong shape would let the intersection rule pass untested.
+ */
+// A static resource's store is module-level and keyed by its storage key, so two contexts sharing
+// one key share one store — and the second test's seed collides with the first's. A key per
+// context is what makes each test start empty.
+let store = 0
+let seq = 0
+
+export const makeTestContext = async (opts: AuthTokenGuardOptions = {}) => {
+  const key = `auth-token-tests-${++store}`
+  const cfg: BasicConfig = {
+    ready: false, service: 'server-auth-token-tests', type: AppType.Backend, services: {},
+  }
+  const context = makeBasicContext(cfg) as BasicContext<BasicConfig>
+
+  // A record store that mints an id when the caller does not supply one — which is what every
+  // real backend does and what the static resource, alone among them, refuses to do. The handlers
+  // let their store assign ids, so without this the test would be asserting a property of the
+  // test double rather than of the code.
+  const identified = <T extends { id?: string }>(resource: any): any => {
+    const create = resource.create.bind(resource)
+    resource.create = async (record: T, opts?: unknown) =>
+      await create({ ...record, id: record.id ?? `rec-${++seq}` }, opts)
+
+    return resource
+  }
+
+  context.registerResource(identified(createStaticResource<AccessTokenRecord>(AUTH_TOKEN_RESOURCE, `${key}-tokens`)))
+  context.registerResource(identified(createStaticResource<IdentityProfile>(AUTH_IDENTITY_PROFILE, `${key}-profiles`)))
+  // Exactly how a deployment wires it: one call that seats the guard AND records the prefix, so
+  // the minting handler and the guard cannot disagree about what a token of this deployment is.
+  appendAuthTokenGuard(context, GUARD_AUTH_TOKEN, { prefix: TEST_PREFIX, ...opts })
+
+  context.configure()
+  await context.init()
+
+  return context
+}
+
+export const seedProfile = async (
+  context: BasicContext<BasicConfig>, patch: Partial<IdentityProfile> = {}
+): Promise<IdentityProfile> => {
+  const profiles = context.resource<any>(AUTH_IDENTITY_PROFILE)
+
+  return await profiles.create({
+    id: patch.id ?? `profile-record-${TEST_PROFILE}`,
+    profileId: TEST_PROFILE,
+    entityId: TEST_ENTITY,
+    userId: TEST_USER,
+    role: AuthRole.User,
+    scopes: ['*'],
+    ...patch,
+  })
+}
+
+export const seedToken = async (
+  context: BasicContext<BasicConfig>, hash: string, patch: Partial<AccessTokenRecord> = {}
+): Promise<AccessTokenRecord> => {
+  const tokens = context.resource<any>(AUTH_TOKEN_RESOURCE)
+
+  return await tokens.create({
+    id: patch.id ?? hash.slice(0, 12),
+    hash,
+    display: `${TEST_PREFIX}display`,
+    name: 'test token',
+    userId: TEST_USER,
+    profileId: TEST_PROFILE,
+    entityId: TEST_ENTITY,
+    scopes: ['*'],
+    role: AuthRole.User,
+    createdAt: new Date(),
+    ...patch,
+  })
+}
+
+/** The two things a guard is handed: a request carrying a header, and a response to resolve into. */
+export const request = (authorization?: string, alias?: string): any => ({
+  alias,
+  headers: authorization != null ? { authorization } : {},
+  params: {}, query: {}, body: {},
+})
+
+export const response = (): any => {
+  const res: any = { resolve: (value: unknown) => { res.value = value } }
+
+  return res
+}

package/tests/guard.spec.ts

@@ -0,0 +1,128 @@
+import { describe, expect, test } from 'bun:test'
+import { AuthroizationType } from '@owlmeans/auth'
+import { GUARD_AUTH_TOKEN } from '@owlmeans/auth-token'
+import type { GuardService } from '@owlmeans/entrypoint'
+import { hashAccessToken } from '../src/hash.js'
+import {
+  makeTestContext, request, response, seedProfile, seedToken, TEST_ENTITY, TEST_PREFIX, TEST_PROFILE
+} from './context.js'
+
+const TOKEN = `${TEST_PREFIX}averylongrandomsecretvalue`
+
+const armed = async (opts = {}) => {
+  const context = await makeTestContext(opts)
+  await seedProfile(context)
+  await seedToken(context, hashAccessToken(TOKEN))
+
+  return { context, guard: context.service<GuardService>(GUARD_AUTH_TOKEN) }
+}
+
+describe('@owlmeans/server-auth-token — what the guard claims', () => {
+  test('claims a prefixed value under either scheme', async () => {
+    const { guard } = await armed()
+
+    expect(await guard.match(request(`AUTH-TOKEN ${TOKEN}`), response())).toBe(true)
+    expect(await guard.match(request(`Bearer ${TOKEN}`), response())).toBe(true)
+  })
+
+  test('leaves every other credential alone', async () => {
+    const { guard } = await armed()
+
+    // The one that matters: an OwlMeans session bearer must reach its own guard untouched.
+    expect(await guard.match(request('ED25519-BASIC-TOKEN abcdef'), response())).toBe(false)
+    // A Bearer without this deployment's prefix belongs to somebody else — an OIDC access token.
+    expect(await guard.match(request('Bearer some.jwt.value'), response())).toBe(false)
+    expect(await guard.match(request(), response())).toBe(false)
+  })
+
+  test('refuses a denied route outright, so the boundary answers 401', async () => {
+    const { guard } = await armed({ denyAliases: ['payment:checkout'] })
+
+    expect(await guard.match(request(`Bearer ${TOKEN}`, 'payment:checkout'), response())).toBe(false)
+    expect(await guard.match(request(`Bearer ${TOKEN}`, 'project:list'), response())).toBe(true)
+  })
+})
+
+describe('@owlmeans/server-auth-token — what the guard resolves', () => {
+  test('builds the same Auth payload a session would, and never echoes the secret', async () => {
+    const { guard } = await armed()
+    const res = response()
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), res)).toBe(true)
+    expect(res.value.type).toBe(AuthroizationType.AuthToken)
+    expect(res.value.profileId).toBe(TEST_PROFILE)
+    expect(res.value.entitySlug).toBe(TEST_ENTITY)
+    expect(res.value.isUser).toBe(true)
+    expect(res.value.token).not.toBe(TOKEN)
+    expect(res.value.token).toBe(`${TEST_PREFIX}display`)
+  })
+
+  test('a token can never outrank its profile', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context, { scopes: ['project:read'] })
+    await seedToken(context, hashAccessToken(TOKEN), { scopes: ['*', 'project:write'] })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+    const res = response()
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), res)).toBe(true)
+    expect(res.value.scopes).toEqual(['project:read'])
+  })
+
+  test('refuses a revoked token', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken(TOKEN), { revokedAt: new Date() })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
+  })
+
+  test('refuses an expired token', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken(TOKEN), { expiresAt: new Date(Date.now() - 1000) })
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
+  })
+
+  test('refuses an unknown secret', async () => {
+    const { guard } = await armed()
+
+    expect(await guard.handle(request(`Bearer ${TEST_PREFIX}notthisone`), response())).toBe(false)
+  })
+
+  test('refuses when the profile behind it is gone — revoking a person revokes their tokens', async () => {
+    const context = await makeTestContext()
+    await seedToken(context, hashAccessToken(TOKEN))
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
+  })
+
+  test('refuses when the profile has expired', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context, { expiresAt: new Date(Date.now() - 1000) })
+    await seedToken(context, hashAccessToken(TOKEN))
+    const guard = context.service<GuardService>(GUARD_AUTH_TOKEN)
+
+    expect(await guard.handle(request(`Bearer ${TOKEN}`), response())).toBe(false)
+  })
+
+  test('produces no credential of its own — it verifies, it does not authenticate', async () => {
+    const { guard } = await armed()
+
+    expect(await guard.authenticated()).toBeNull()
+  })
+})
+
+describe('@owlmeans/server-auth-token — the hash at rest', () => {
+  test('the stored value is not the token', () => {
+    const hash = hashAccessToken(TOKEN)
+
+    expect(hash).not.toBe(TOKEN)
+    expect(hash).toMatch(/^[0-9a-f]{64}$/)
+    expect(hashAccessToken(TOKEN)).toBe(hash)
+    expect(hashAccessToken(`${TOKEN}x`)).not.toBe(hash)
+  })
+})

package/tests/handlers.spec.ts

@@ -0,0 +1,154 @@
+import { describe, expect, test } from 'bun:test'
+import { AuthroizationType, AuthRole } from '@owlmeans/auth'
+import { AUTH_TOKEN_RESOURCE } from '@owlmeans/auth-token'
+import type { AccessTokenRecord, IssuedAccessToken } from '@owlmeans/auth-token'
+import { createAccessToken, listAccessTokens, revokeAccessToken } from '../src/handlers/index.js'
+import { hashAccessToken } from '../src/hash.js'
+import { makeTestContext, seedProfile, seedToken, TEST_ENTITY, TEST_PREFIX, TEST_PROFILE, TEST_USER } from './context.js'
+
+/**
+ * A handler is a `RefedEntrypointHandler`: it is given the entrypoint reference it was elevated
+ * onto and answers with `(req, res)`. Calling it directly is what lets these tests be about the
+ * RULES — who may mint, what a list shows, whose token may be revoked — rather than about routing.
+ */
+const invoke = async (handler: any, context: any, req: any): Promise<any> => {
+  const res: any = { resolve: (value: unknown) => { res.value = value }, reject: (e: Error) => { res.error = e } }
+  await handler({ ref: { ctx: context } })(req, res)
+  if (res.error != null) throw res.error
+
+  return res.value
+}
+
+const session = (patch: Record<string, unknown> = {}): any => ({
+  headers: {}, params: {}, query: {}, body: {},
+  entity: { id: TEST_ENTITY, slug: TEST_ENTITY },
+  auth: {
+    type: AuthroizationType.Ed25519BasicToken,
+    profileId: TEST_PROFILE,
+    userId: TEST_USER,
+    entitySlug: TEST_ENTITY,
+    role: AuthRole.User,
+    scopes: ['*'],
+    ...patch,
+  },
+})
+
+describe('@owlmeans/server-auth-token — minting', () => {
+  test('returns the plaintext once and stores only its hash', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+
+    const issued: IssuedAccessToken = await invoke(
+      createAccessToken, context, { ...session(), body: { name: 'my laptop' } }
+    )
+
+    expect(issued.token).toStartWith(TEST_PREFIX)
+    expect(issued.record.name).toBe('my laptop')
+    expect(issued.record.display).toStartWith(TEST_PREFIX)
+    expect(issued.record.display.length).toBeLessThan(issued.token.length)
+    // The view a caller sees carries no hash at all.
+    expect((issued.record as unknown as AccessTokenRecord).hash).toBeUndefined()
+
+    const stored = await context.resource<any>(AUTH_TOKEN_RESOURCE).load({ hash: hashAccessToken(issued.token) })
+    expect(stored).not.toBeNull()
+    expect(stored.hash).not.toBe(issued.token)
+  })
+
+  test('two tokens are never the same token', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+
+    const first: IssuedAccessToken = await invoke(createAccessToken, context, { ...session(), body: { name: 'a' } })
+    const second: IssuedAccessToken = await invoke(createAccessToken, context, { ...session(), body: { name: 'b' } })
+
+    expect(first.token).not.toBe(second.token)
+  })
+
+  test('an expiry is stored as a moment, not as a duration', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+
+    const issued: IssuedAccessToken = await invoke(
+      createAccessToken, context, { ...session(), body: { name: 'temporary', expiresIn: 3600 } }
+    )
+
+    expect(issued.record.expiresAt).toBeDefined()
+    expect(new Date(issued.record.expiresAt!).getTime()).toBeGreaterThan(Date.now())
+  })
+
+  test('a token may never mint another token', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+
+    const req = { ...session({ type: AuthroizationType.AuthToken }), body: { name: 'escalation' } }
+    await expect(invoke(createAccessToken, context, req)).rejects.toThrow()
+  })
+
+  test('a token may never widen beyond the caller it was minted by', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+
+    const req = {
+      ...session({ scopes: ['project:read'] }),
+      body: { name: 'greedy', scopes: ['project:read', 'project:write'] },
+    }
+    await expect(invoke(createAccessToken, context, req)).rejects.toThrow()
+  })
+})
+
+describe('@owlmeans/server-auth-token — listing and revoking', () => {
+  test('a list shows the caller\'s own tokens and never a hash', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken('tst_one'), { id: 'one', name: 'one' })
+    await seedToken(context, hashAccessToken('tst_two'), { id: 'two', name: 'two' })
+    // Somebody else's token, in the same store.
+    await seedToken(context, hashAccessToken('tst_other'), {
+      id: 'other', name: 'other', profileId: 'someone-else',
+    })
+
+    const result = await invoke(listAccessTokens, context, session())
+
+    expect(result.items.map((item: any) => item.name).sort()).toEqual(['one', 'two'])
+    expect(result.items.every((item: any) => item.hash === undefined)).toBe(true)
+  })
+
+  test('revoking marks the record and is idempotent', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken('tst_one'), { id: 'one' })
+
+    await invoke(revokeAccessToken, context, { ...session(), params: { id: 'one' } })
+    const first = await context.resource<any>(AUTH_TOKEN_RESOURCE).load('one')
+    expect(first.revokedAt).toBeDefined()
+
+    // A retry is what a lost response looks like; it must not fail.
+    await invoke(revokeAccessToken, context, { ...session(), params: { id: 'one' } })
+    const second = await context.resource<any>(AUTH_TOKEN_RESOURCE).load('one')
+    expect(new Date(second.revokedAt).getTime()).toBe(new Date(first.revokedAt).getTime())
+  })
+
+  test('another profile\'s token answers exactly as an unknown id does', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken('tst_other'), { id: 'other', profileId: 'someone-else' })
+
+    await expect(
+      invoke(revokeAccessToken, context, { ...session(), params: { id: 'other' } })
+    ).rejects.toThrow()
+    await expect(
+      invoke(revokeAccessToken, context, { ...session(), params: { id: 'nonexistent' } })
+    ).rejects.toThrow()
+  })
+
+  test('a token may never revoke a token', async () => {
+    const context = await makeTestContext()
+    await seedProfile(context)
+    await seedToken(context, hashAccessToken('tst_one'), { id: 'one' })
+
+    await expect(invoke(
+      revokeAccessToken, context,
+      { ...session({ type: AuthroizationType.AuthToken }), params: { id: 'one' } }
+    )).rejects.toThrow()
+  })
+})

package/tests/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.node.json"
+  ],
+  "compilerOptions": {
+    "types": ["bun"],
+    "rootDir": "../",
+    "noEmit": true
+  },
+  "include": ["./**/*", "../src/**/*"]
+}

package/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.server.json"
+  ],
+  "compilerOptions": {
+    "rootDir": "./src/",
+    "outDir": "./build/"
+  },
+  "exclude": ["./dist/**/*", "./build/**/*", "./tests/**/*", "./*.ts"]
+}