@remit/mail-oauth-service 0.0.8 → 0.0.9

package/src/__tests__/mail-oauth-service.test.ts

@@ -1,398 +0,0 @@
-import assert from "node:assert/strict";
-import { after, before, describe, test } from "node:test";
-
-import {
-	createMailOAuthService,
-	microsoftProviderConfig,
-	RefreshTokenError,
-} from "../index.js";
-import type { OAuthProviderConfig } from "../types.js";
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-function makeConfig(
-	overrides?: Partial<OAuthProviderConfig>,
-): OAuthProviderConfig {
-	return microsoftProviderConfig({
-		clientId: "test-client-id",
-		clientSecret: "test-client-secret",
-		overrides: {
-			tokenEndpoint: "https://example.com/token",
-			authorizationEndpoint: "https://example.com/authorize",
-			...overrides,
-		},
-	});
-}
-
-function nowSecs(): number {
-	return Math.floor(Date.now() / 1000);
-}
-
-/** Build a fake fetch that returns the given JSON body with the given HTTP status. */
-function makeFetch(status: number, body: unknown): typeof globalThis.fetch {
-	return async (_url, _init) => {
-		return {
-			ok: status >= 200 && status < 300,
-			status,
-			json: async () => body,
-		} as Response;
-	};
-}
-
-/** Counts how many times fetch was called. */
-function countingFetch(
-	status: number,
-	body: unknown,
-): { fetch: typeof globalThis.fetch; count: () => number } {
-	let n = 0;
-	return {
-		fetch: async (url, init) => {
-			n++;
-			return makeFetch(status, body)(url, init);
-		},
-		count: () => n,
-	};
-}
-
-// ---------------------------------------------------------------------------
-// Test suite
-// ---------------------------------------------------------------------------
-
-describe("mail-oauth-service", () => {
-	let originalFetch: typeof globalThis.fetch;
-
-	before(() => {
-		originalFetch = globalThis.fetch;
-	});
-
-	after(() => {
-		globalThis.fetch = originalFetch;
-	});
-
-	// 1. Happy refresh
-	test("refresh: 200 response produces correct TokenSet", async () => {
-		const expiresIn = 3600;
-		globalThis.fetch = makeFetch(200, {
-			access_token: "new-access-token",
-			expires_in: expiresIn,
-		});
-
-		const svc = createMailOAuthService(makeConfig());
-		const before = nowSecs();
-		const result = await svc.refresh("some-refresh-token");
-		const after = nowSecs();
-
-		assert.equal(result.accessToken, "new-access-token");
-		assert.ok(
-			result.expiresAt >= before + expiresIn,
-			"expiresAt should be ~now + expires_in",
-		);
-		assert.ok(
-			result.expiresAt <= after + expiresIn + 1,
-			"expiresAt should not be too far in the future",
-		);
-		assert.equal(result.refreshToken, undefined);
-	});
-
-	// 2. Token rotation
-	test("refresh: rotated refresh_token is surfaced in TokenSet", async () => {
-		globalThis.fetch = makeFetch(200, {
-			access_token: "access",
-			expires_in: 3600,
-			refresh_token: "new-refresh-token",
-		});
-
-		const svc = createMailOAuthService(makeConfig());
-		const result = await svc.refresh("old-refresh-token");
-
-		assert.equal(result.refreshToken, "new-refresh-token");
-	});
-
-	// 3. Cache hit
-	test("getAccessToken: two calls within expiry window make only 1 fetch", async () => {
-		const { fetch, count } = countingFetch(200, {
-			access_token: "cached-token",
-			expires_in: 3600,
-		});
-		globalThis.fetch = fetch;
-
-		const svc = createMailOAuthService(makeConfig());
-		const r1 = await svc.getAccessToken("user-1", "rt");
-		const r2 = await svc.getAccessToken("user-1", "rt");
-
-		assert.equal(count(), 1, "should only fetch once");
-		assert.equal(r1.accessToken, "cached-token");
-		assert.equal(r2.accessToken, "cached-token");
-	});
-
-	// 4. Cache miss at T-5min
-	test("getAccessToken: token expiring in 4 minutes triggers refresh", async () => {
-		// First call returns a token that expires in 4 minutes (< 5-min buffer)
-		let callCount = 0;
-		globalThis.fetch = async () => {
-			callCount++;
-			return {
-				ok: true,
-				status: 200,
-				json: async () => ({
-					access_token: `token-${callCount}`,
-					expires_in: callCount === 1 ? 4 * 60 : 3600,
-				}),
-			} as Response;
-		};
-
-		const svc = createMailOAuthService(makeConfig());
-		// Prime the cache with a soon-expiring token
-		const r1 = await svc.getAccessToken("user-2", "rt");
-		assert.equal(r1.accessToken, "token-1");
-
-		// Second call should refresh because the token is within the 5-min buffer
-		const r2 = await svc.getAccessToken("user-2", "rt");
-		assert.equal(callCount, 2, "should have refreshed");
-		assert.equal(r2.accessToken, "token-2");
-	});
-
-	// 5. Single-flight
-	test("getAccessToken: 10 concurrent callers produce exactly 1 fetch", async () => {
-		const { fetch, count } = countingFetch(200, {
-			access_token: "shared-token",
-			expires_in: 3600,
-		});
-		globalThis.fetch = fetch;
-
-		const svc = createMailOAuthService(makeConfig());
-		const results = await Promise.all(
-			Array.from({ length: 10 }, () => svc.getAccessToken("user-3", "rt")),
-		);
-
-		assert.equal(
-			count(),
-			1,
-			"should only fetch once despite 10 concurrent callers",
-		);
-		for (const r of results) {
-			assert.equal(r.accessToken, "shared-token");
-		}
-	});
-
-	// 6a. Error mapping: invalid_grant → reauth-required
-	describe("error mapping", () => {
-		test("invalid_grant → reauth-required", async () => {
-			globalThis.fetch = makeFetch(400, {
-				error: "invalid_grant",
-				error_description: "AADSTS70008: Refresh token expired.",
-				error_codes: [70008],
-			});
-
-			const svc = createMailOAuthService(makeConfig());
-			await assert.rejects(
-				() => svc.refresh("bad-rt"),
-				(err: unknown) => {
-					assert.ok(err instanceof RefreshTokenError);
-					assert.equal(err.error.kind, "reauth-required");
-					assert.equal(err.error.code, "invalid_grant");
-					return true;
-				},
-			);
-		});
-
-		// 6b. error_codes array containing reauth code
-		test("error_codes [70008] → reauth-required", async () => {
-			globalThis.fetch = makeFetch(400, {
-				error: "some_error",
-				error_codes: [70008],
-			});
-
-			const svc = createMailOAuthService(makeConfig());
-			await assert.rejects(
-				() => svc.refresh("bad-rt"),
-				(err: unknown) => {
-					assert.ok(err instanceof RefreshTokenError);
-					assert.equal(err.error.kind, "reauth-required");
-					return true;
-				},
-			);
-		});
-
-		// 6c. 503 → transient
-		test("503 → transient", async () => {
-			globalThis.fetch = makeFetch(503, {
-				error: "server_error",
-				error_description: "Service unavailable",
-			});
-
-			const svc = createMailOAuthService(makeConfig());
-			await assert.rejects(
-				() => svc.refresh("rt"),
-				(err: unknown) => {
-					assert.ok(err instanceof RefreshTokenError);
-					assert.equal(err.error.kind, "transient");
-					return true;
-				},
-			);
-		});
-
-		// 6d. 429 → transient
-		test("429 → transient", async () => {
-			globalThis.fetch = makeFetch(429, {
-				error: "too_many_requests",
-			});
-
-			const svc = createMailOAuthService(makeConfig());
-			await assert.rejects(
-				() => svc.refresh("rt"),
-				(err: unknown) => {
-					assert.ok(err instanceof RefreshTokenError);
-					assert.equal(err.error.kind, "transient");
-					return true;
-				},
-			);
-		});
-
-		// 6e. invalid_client → config
-		test("invalid_client → config", async () => {
-			globalThis.fetch = makeFetch(401, {
-				error: "invalid_client",
-				error_description: "Client secret is invalid.",
-			});
-
-			const svc = createMailOAuthService(makeConfig());
-			await assert.rejects(
-				() => svc.refresh("rt"),
-				(err: unknown) => {
-					assert.ok(err instanceof RefreshTokenError);
-					assert.equal(err.error.kind, "config");
-					assert.equal(err.error.code, "invalid_client");
-					return true;
-				},
-			);
-		});
-
-		// 6f. network error → transient
-		test("network error → transient", async () => {
-			globalThis.fetch = async () => {
-				throw new Error("ECONNREFUSED");
-			};
-
-			const svc = createMailOAuthService(makeConfig());
-			await assert.rejects(
-				() => svc.refresh("rt"),
-				(err: unknown) => {
-					assert.ok(err instanceof RefreshTokenError);
-					assert.equal(err.error.kind, "transient");
-					assert.equal(err.error.code, "network_error");
-					return true;
-				},
-			);
-		});
-	});
-
-	// 7. No token leak in error
-	test("RefreshTokenError does not leak token values", async () => {
-		const sensitiveRefreshToken = "super-secret-refresh-token-abc123";
-
-		globalThis.fetch = makeFetch(400, {
-			error: "invalid_grant",
-			error_codes: [70008],
-		});
-
-		const svc = createMailOAuthService(makeConfig());
-
-		await assert.rejects(
-			() => svc.refresh(sensitiveRefreshToken),
-			(err: unknown) => {
-				assert.ok(err instanceof RefreshTokenError);
-
-				const serialized = JSON.stringify(err.error);
-				assert.ok(
-					!serialized.includes(sensitiveRefreshToken),
-					"serialized error must not contain the refresh token",
-				);
-
-				assert.ok(
-					!err.message.includes(sensitiveRefreshToken),
-					"error message must not contain the refresh token",
-				);
-				return true;
-			},
-		);
-	});
-
-	// 8a. exchangeCode happy path
-	test("exchangeCode: success returns TokenSet", async () => {
-		globalThis.fetch = makeFetch(200, {
-			access_token: "access-from-code",
-			expires_in: 3600,
-			refresh_token: "refresh-from-code",
-			id_token:
-				"header.eyJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhbGljZUBvdXRsb29rLmNvbSJ9.sig",
-		});
-
-		const svc = createMailOAuthService(makeConfig());
-		const result = await svc.exchangeCode(
-			"auth-code",
-			"https://app.example.com/callback",
-		);
-
-		assert.equal(result.accessToken, "access-from-code");
-		assert.equal(result.refreshToken, "refresh-from-code");
-		assert.equal(
-			result.idToken,
-			"header.eyJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhbGljZUBvdXRsb29rLmNvbSJ9.sig",
-		);
-	});
-
-	// 8b. exchangeCode error mapping
-	test("exchangeCode: invalid_grant → RefreshTokenError reauth-required", async () => {
-		globalThis.fetch = makeFetch(400, {
-			error: "invalid_grant",
-			error_codes: [70011],
-		});
-
-		const svc = createMailOAuthService(makeConfig());
-		await assert.rejects(
-			() => svc.exchangeCode("bad-code", "https://app.example.com/callback"),
-			(err: unknown) => {
-				assert.ok(err instanceof RefreshTokenError);
-				assert.equal(err.error.kind, "reauth-required");
-				return true;
-			},
-		);
-	});
-
-	// buildAuthorizationUrl
-	test("buildAuthorizationUrl includes required params", () => {
-		const svc = createMailOAuthService(makeConfig());
-		const url = new URL(
-			svc.buildAuthorizationUrl({
-				redirectUri: "https://app.example.com/callback",
-				state: "random-state",
-				loginHint: "user@example.com",
-			}),
-		);
-
-		assert.equal(url.searchParams.get("client_id"), "test-client-id");
-		assert.equal(url.searchParams.get("response_type"), "code");
-		assert.equal(
-			url.searchParams.get("redirect_uri"),
-			"https://app.example.com/callback",
-		);
-		assert.equal(url.searchParams.get("state"), "random-state");
-		assert.equal(url.searchParams.get("access_type"), "offline");
-		assert.equal(url.searchParams.get("prompt"), "consent");
-		assert.equal(url.searchParams.get("login_hint"), "user@example.com");
-	});
-
-	test("buildAuthorizationUrl omits login_hint when not provided", () => {
-		const svc = createMailOAuthService(makeConfig());
-		const url = new URL(
-			svc.buildAuthorizationUrl({
-				redirectUri: "https://app.example.com/callback",
-				state: "s",
-			}),
-		);
-		assert.equal(url.searchParams.get("login_hint"), null);
-	});
-});

package/src/__tests__/microsoft-scopes.test.ts

@@ -1,153 +0,0 @@
-import assert from "node:assert/strict";
-import { after, before, describe, test } from "node:test";
-import { AccountService } from "@remit/domain-enums";
-import {
-	createMailOAuthService,
-	MICROSOFT_SERVICE_SCOPES,
-	microsoftProviderConfig,
-	microsoftScopes,
-	microsoftServicesGranted,
-	normalizeMicrosoftScopes,
-} from "../index.js";
-
-const IMAP = "https://outlook.office.com/IMAP.AccessAsUser.All";
-const SMTP = "https://outlook.office.com/SMTP.Send";
-const CALENDAR = "https://graph.microsoft.com/Calendars.Read";
-const SESSION = ["offline_access", "openid", "email"];
-
-describe("the Microsoft scopes a service selection asks for", () => {
-	test("mail asks for IMAP and SMTP and never the calendar", () => {
-		assert.deepEqual(microsoftScopes([AccountService.Mail]), [
-			IMAP,
-			SMTP,
-			...SESSION,
-		]);
-	});
-
-	test("calendar asks for the Graph calendar scope and no mailbox access", () => {
-		assert.deepEqual(microsoftScopes([AccountService.Calendar]), [
-			CALENDAR,
-			...SESSION,
-		]);
-	});
-
-	test("both put mail first whatever order they arrive in", () => {
-		assert.deepEqual(
-			microsoftScopes([
-				AccountService.Calendar,
-				AccountService.Mail,
-				AccountService.Calendar,
-			]),
-			[IMAP, SMTP, CALENDAR, ...SESSION],
-		);
-	});
-
-	test("a provider config with no selection asks for mail, as before", () => {
-		const config = microsoftProviderConfig({
-			clientId: "client-id",
-			clientSecret: "client-secret",
-		});
-
-		assert.deepEqual(config.scopes, [IMAP, SMTP, ...SESSION]);
-	});
-
-	test("the authorization URL carries the scopes of the selection", () => {
-		const service = createMailOAuthService(
-			microsoftProviderConfig({
-				clientId: "client-id",
-				clientSecret: "client-secret",
-				services: [AccountService.Calendar],
-			}),
-		);
-
-		const url = new URL(
-			service.buildAuthorizationUrl({
-				redirectUri: "https://app.example.com/callback",
-				state: "state",
-			}),
-		);
-
-		assert.equal(
-			url.searchParams.get("scope"),
-			[CALENDAR, ...SESSION].join(" "),
-		);
-	});
-});
-
-describe("the scopes Microsoft reports as granted", () => {
-	test("bare Graph names become full scope URIs and identity scopes drop out", () => {
-		assert.deepEqual(
-			normalizeMicrosoftScopes(
-				"Calendars.Read openid profile email offline_access",
-			),
-			[CALENDAR],
-		);
-	});
-
-	test("Outlook scopes keep their resource", () => {
-		assert.deepEqual(normalizeMicrosoftScopes(`${IMAP} ${SMTP}`), [IMAP, SMTP]);
-	});
-
-	test("an absent scope field grants nothing", () => {
-		assert.deepEqual(normalizeMicrosoftScopes(undefined), []);
-	});
-
-	test("a service counts as granted only when every one of its scopes is", () => {
-		assert.deepEqual(microsoftServicesGranted([IMAP]), []);
-		assert.deepEqual(microsoftServicesGranted([IMAP, SMTP]), [
-			AccountService.Mail,
-		]);
-		assert.deepEqual(
-			microsoftServicesGranted([
-				CALENDAR.toLowerCase(),
-				...MICROSOFT_SERVICE_SCOPES[AccountService.Mail],
-			]),
-			[AccountService.Mail, AccountService.Calendar],
-		);
-	});
-});
-
-describe("the code exchange", () => {
-	let originalFetch: typeof globalThis.fetch;
-	let sentScope: string | null;
-
-	before(() => {
-		originalFetch = globalThis.fetch;
-		globalThis.fetch = (async (_url: unknown, init?: RequestInit) => {
-			sentScope = new URLSearchParams(String(init?.body)).get("scope");
-			return {
-				ok: true,
-				status: 200,
-				json: async () => ({
-					access_token: "access",
-					expires_in: 3600,
-					refresh_token: "refresh",
-					scope: "Calendars.Read openid email",
-				}),
-			} as Response;
-		}) as typeof globalThis.fetch;
-	});
-
-	after(() => {
-		globalThis.fetch = originalFetch;
-	});
-
-	test("redeems the code for the selection's scopes and reports what was granted", async () => {
-		const service = createMailOAuthService(
-			microsoftProviderConfig({
-				clientId: "client-id",
-				clientSecret: "client-secret",
-				services: [AccountService.Calendar],
-				overrides: { tokenEndpoint: "https://example.com/token" },
-			}),
-		);
-
-		const tokenSet = await service.exchangeCode(
-			"code",
-			"https://app.example.com/callback",
-		);
-
-		assert.equal(sentScope, [CALENDAR, ...SESSION].join(" "));
-		assert.deepEqual(tokenSet.grantedScopes, [CALENDAR]);
-	});
-});

package/src/index.ts

@@ -1,40 +0,0 @@
-export * from "./mail-oauth-service.js";
-export * from "./microsoft-errors.js";
-export * from "./microsoft-scopes.js";
-export * from "./types.js";
-
-import { AccountService } from "@remit/domain-enums";
-import {
-	type AccountServiceName,
-	microsoftScopes,
-} from "./microsoft-scopes.js";
-import type { OAuthProviderConfig } from "./types.js";
-
-const MICROSOFT_TOKEN_ENDPOINT =
-	"https://login.microsoftonline.com/common/oauth2/v2.0/token";
-const MICROSOFT_AUTHORIZATION_ENDPOINT =
-	"https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
-
-export function microsoftProviderConfig(opts: {
-	clientId: string;
-	clientSecret: string;
-	services?: readonly AccountServiceName[];
-	overrides?: Partial<
-		Pick<
-			OAuthProviderConfig,
-			"tokenEndpoint" | "authorizationEndpoint" | "scopes"
-		>
-	>;
-}): OAuthProviderConfig {
-	return {
-		provider: "microsoft",
-		clientId: opts.clientId,
-		clientSecret: opts.clientSecret,
-		tokenEndpoint: opts.overrides?.tokenEndpoint ?? MICROSOFT_TOKEN_ENDPOINT,
-		authorizationEndpoint:
-			opts.overrides?.authorizationEndpoint ?? MICROSOFT_AUTHORIZATION_ENDPOINT,
-		scopes:
-			opts.overrides?.scopes ??
-			microsoftScopes(opts.services ?? [AccountService.Mail]),
-	};
-}