@reventlessdev/reventless-aws 3.0.0-alpha.167

package/tests/Auth_CognitoTest.res.mjs

@@ -0,0 +1,248 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Auth_Cognito$ReventlessAws from "../src/adapter/Auth/Auth_Cognito.res.mjs";
+
+function buildContext(headers) {
+  return {
+    headers: Object.fromEntries(headers)
+  };
+}
+
+function b64urlEncode(s) {
+  return btoa(s).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+
+function buildJwt(claims) {
+  let header = b64urlEncode(`{"alg":"HS256","typ":"JWT"}`);
+  let payload = b64urlEncode(JSON.stringify(claims));
+  return header + `.` + payload + `.` + "sig";
+}
+
+globalThis.describe("Auth_Cognito.authenticate", () => {
+  globalThis.test("no Authorization header → Anonymous", async () => {
+    let r = await Auth_Cognito$ReventlessAws.authenticate(buildContext([]));
+    if (typeof r !== "object") {
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("expected Anonymous");
+    }
+  });
+  globalThis.test("non-Bearer Authorization header → Anonymous", async () => {
+    let r = await Auth_Cognito$ReventlessAws.authenticate(buildContext([[
+        "authorization",
+        "Basic dXNlcjpwYXNz"
+      ]]));
+    if (typeof r !== "object") {
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("expected Anonymous");
+    }
+  });
+  globalThis.test("malformed Bearer token → AuthError", async () => {
+    let r = await Auth_Cognito$ReventlessAws.authenticate(buildContext([[
+        "authorization",
+        "Bearer not-a-jwt"
+      ]]));
+    if (typeof r !== "object" || r.TAG === "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected AuthError");
+    }
+  });
+  globalThis.test("valid Cognito JWT → Authenticated with sub/groups/username", async () => {
+    let claims = Object.fromEntries([
+      [
+        "sub",
+        "c3741234-aaaa-bbbb-cccc-ddddeeee1234"
+      ],
+      [
+        "cognito:username",
+        "alice@example.com"
+      ],
+      [
+        "cognito:groups",
+        [
+          "Admin",
+          "User"
+        ].map(prim => prim)
+      ]
+    ]);
+    let token = buildJwt(claims);
+    let r = await Auth_Cognito$ReventlessAws.authenticate(buildContext([[
+        "authorization",
+        "Bearer " + token
+      ]]));
+    if (typeof r !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (r.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    let identity = r._0;
+    globalThis.expect(identity.userId).toBe("c3741234-aaaa-bbbb-cccc-ddddeeee1234");
+    globalThis.expect(identity.username).toBe("alice@example.com");
+    globalThis.expect(identity.groups).toEqual([
+      "Admin",
+      "User"
+    ]);
+  });
+  globalThis.test("JWT without cognito:groups → empty groups", async () => {
+    let claims = Object.fromEntries([
+      [
+        "sub",
+        "user-1"
+      ],
+      [
+        "cognito:username",
+        "bob"
+      ]
+    ]);
+    let token = buildJwt(claims);
+    let r = await Auth_Cognito$ReventlessAws.authenticate(buildContext([[
+        "authorization",
+        "Bearer " + token
+      ]]));
+    if (typeof r !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (r.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    let identity = r._0;
+    globalThis.expect(identity.groups).toEqual([]);
+    globalThis.expect(identity.username).toBe("bob");
+  });
+  globalThis.test("header lookup is case-insensitive (Authorization)", async () => {
+    let claims = Object.fromEntries([[
+        "sub",
+        "user-mixed-case"
+      ]]);
+    let token = buildJwt(claims);
+    let r = await Auth_Cognito$ReventlessAws.authenticate(buildContext([[
+        "Authorization",
+        "Bearer " + token
+      ]]));
+    if (typeof r !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (r.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    globalThis.expect(r._0.userId).toBe("user-mixed-case");
+  });
+});
+
+globalThis.describe("Auth_Cognito.fromAppSyncIdentity", () => {
+  globalThis.test("None → Anonymous", () => {
+    let match = Auth_Cognito$ReventlessAws.fromAppSyncIdentity(undefined);
+    if (typeof match !== "object") {
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("expected Anonymous");
+    }
+  });
+  globalThis.test("Cognito identity: sub + claims.cognito:groups → Authenticated with Cognito provider", () => {
+    let claims = Object.fromEntries([
+      [
+        "cognito:username",
+        "alice@example.com"
+      ],
+      [
+        "cognito:groups",
+        ["Admin"].map(prim => prim)
+      ]
+    ]);
+    let id_sub = "c3741234-aaaa";
+    let id_username = "alice@example.com";
+    let id_claims = claims;
+    let id = {
+      sub: id_sub,
+      username: id_username,
+      claims: id_claims
+    };
+    let identity = Auth_Cognito$ReventlessAws.fromAppSyncIdentity(id);
+    if (typeof identity !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (identity.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    let identity$1 = identity._0;
+    globalThis.expect(identity$1.userId).toBe("c3741234-aaaa");
+    globalThis.expect(identity$1.username).toBe("alice@example.com");
+    globalThis.expect(identity$1.groups).toEqual(["Admin"]);
+    let match = identity$1.provider;
+    if (typeof match !== "object" && match === "Cognito") {
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("expected Cognito provider");
+    }
+  });
+  globalThis.test("Cognito identity: missing claims.cognito:groups → empty groups", () => {
+    let id_sub = "user-no-groups";
+    let id_claims = {};
+    let id = {
+      sub: id_sub,
+      claims: id_claims
+    };
+    let identity = Auth_Cognito$ReventlessAws.fromAppSyncIdentity(id);
+    if (typeof identity !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (identity.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    let identity$1 = identity._0;
+    globalThis.expect(identity$1.groups).toEqual([]);
+    globalThis.expect(identity$1.username).toBe("user-no-groups");
+  });
+  globalThis.test("IAM identity: no sub but userArn present → Custom(\"aws-iam\") provider", () => {
+    let identity = Auth_Cognito$ReventlessAws.fromAppSyncIdentity({
+      username: "heartbeat-lambda",
+      userArn: "arn:aws:iam::123456789012:role/heartbeat-lambda",
+      accountId: "123456789012"
+    });
+    if (typeof identity !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (identity.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    let identity$1 = identity._0;
+    globalThis.expect(identity$1.userId).toBe("arn:aws:iam::123456789012:role/heartbeat-lambda");
+    globalThis.expect(identity$1.username).toBe("heartbeat-lambda");
+    globalThis.expect(identity$1.groups).toEqual([]);
+    let match = identity$1.provider;
+    if (typeof match !== "object" || match._0 !== "aws-iam") {
+      return Stdlib_JsError.throwWithMessage("expected Custom(\"aws-iam\") provider");
+    }
+  });
+  globalThis.test("IAM identity: userArn alone (no username) → username falls back to ARN", () => {
+    let identity = Auth_Cognito$ReventlessAws.fromAppSyncIdentity({
+      userArn: "arn:aws:iam::123:role/x"
+    });
+    if (typeof identity !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (identity.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    globalThis.expect(identity._0.username).toBe("arn:aws:iam::123:role/x");
+  });
+  globalThis.test("Neither sub nor userArn → Anonymous", () => {
+    let match = Auth_Cognito$ReventlessAws.fromAppSyncIdentity({
+      accountId: "123"
+    });
+    if (typeof match !== "object") {
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("expected Anonymous");
+    }
+  });
+});
+
+export {
+  buildContext,
+  b64urlEncode,
+  buildJwt,
+}
+/*  Not a pure module */