@reventlessdev/reventless-local 3.0.0-alpha.217 → 3.0.0-alpha.219

package/tests/adapter/LocalAuthLoginTest.res.mjs

@@ -1,6 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
 
 let alice_groups = ["Editor"];
@@ -36,7 +38,7 @@ function resetAll() {
 globalThis.test("issue returns Ok(token) for valid credentials", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   if (result.TAG !== "Ok") {
     return Stdlib_JsError.throwWithMessage("unexpected Error: " + result._0);
   }
@@ -46,7 +48,7 @@ globalThis.test("issue returns Ok(token) for valid credentials", async () => {
 
 globalThis.test("issue returns Error for unknown username", async () => {
   resetAll();
-  let result = await LocalAuth$ReventlessLocal.Login.issue("ghost", "x");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("ghost", "x", undefined);
   if (result.TAG === "Ok") {
     return Stdlib_JsError.throwWithMessage("expected Error");
   }
@@ -55,7 +57,7 @@ globalThis.test("issue returns Error for unknown username", async () => {
 globalThis.test("issue returns Error for wrong password", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "WRONG");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "WRONG", undefined);
   if (result.TAG === "Ok") {
     return Stdlib_JsError.throwWithMessage("expected Error");
   }
@@ -64,7 +66,7 @@ globalThis.test("issue returns Error for wrong password", async () => {
 globalThis.test("verifyAndDecode round-trips the identity for a fresh token", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let identity = LocalAuth$ReventlessLocal.Login.verifyAndDecode(token);
@@ -81,7 +83,7 @@ globalThis.test("verifyAndDecode round-trips the identity for a fresh token", as
 globalThis.test("verifyAndDecode rejects a tampered payload", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let parts = token.split(".");
@@ -100,7 +102,7 @@ globalThis.test("verifyAndDecode rejects a tampered payload", async () => {
 globalThis.test("verifyAndDecode rejects a tampered signature", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let match = LocalAuth$ReventlessLocal.Login.verifyAndDecode(token + "x");
@@ -120,7 +122,7 @@ globalThis.test("verifyAndDecode rejects a malformed token (no dot)", async () =
 globalThis.test("authenticate accepts a valid Bearer token", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("bob", "bob-pw", bob);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
@@ -158,7 +160,7 @@ globalThis.test("authenticate rejects invalid Bearer even when X-User is present
 globalThis.test("Bearer outranks X-User when both present and Bearer is valid", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("bob", "bob-pw", bob);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([
@@ -198,10 +200,191 @@ globalThis.test("setCredentials mirrors identity into the X-User registry", asyn
   globalThis.expect(identity.groups).toEqual(["Editor"]);
 });
 
+let multiRole_groups = [
+  "Fulfilment",
+  "Shopper"
+];
+
+let multiRole = {
+  userId: "u-carol",
+  username: "carol",
+  groups: multiRole_groups,
+  provider: "InMemory"
+};
+
+function decodeOrThrow(token) {
+  let i = LocalAuth$ReventlessLocal.Login.verifyAndDecode(token);
+  if (i !== undefined) {
+    return i;
+  } else {
+    return Stdlib_JsError.throwWithMessage("expected a verifiable token");
+  }
+}
+
+function carolLoggedIn() {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("carol", "carol-pw", multiRole);
+}
+
+globalThis.test("a login naming no role mints exactly what it minted before", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", undefined);
+  let plain;
+  plain = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let identity = decodeOrThrow(plain);
+  globalThis.expect(identity.groups).toEqual([
+    "Fulfilment",
+    "Shopper"
+  ]);
+  globalThis.expect(identity.claims).toEqual(undefined);
+});
+
+globalThis.test("a login naming a held role mints that role alone", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let identity = decodeOrThrow(token);
+  globalThis.expect(identity.groups).toEqual(["Shopper"]);
+});
+
+globalThis.test("a narrowed token remembers the choice and what it gave up", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let identity = decodeOrThrow(token);
+  globalThis.expect([
+    Identity$Reventless.getClaim(identity, "activeRole"),
+    Identity$Reventless.getClaim(identity, "availableRoles")
+  ]).toEqual([
+    "Shopper",
+    "Fulfilment,Shopper"
+  ]);
+});
+
+globalThis.test("a login naming a role the user does not hold is REFUSED", async () => {
+  carolLoggedIn();
+  let msg = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Admin");
+  if (msg.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected a request to widen to be refused");
+  }
+  globalThis.expect(msg._0.includes("Admin")).toEqual(true);
+});
+
+globalThis.test("narrowing cannot smuggle a group in through the claims bag", async () => {
+  resetAll();
+  let newrecord = {...multiRole};
+  newrecord.claims = Object.fromEntries([[
+      "availableRoles",
+      "Admin,Fulfilment,Shopper"
+    ]]);
+  LocalAuth$ReventlessLocal.Login.setCredentials("carol", "carol-pw", newrecord);
+  let match = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Admin");
+  if (match.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected membership to be judged by groups, not by a claim");
+  }
+  globalThis.expect(true).toEqual(true);
+});
+
+globalThis.test("a narrowed token authenticates as the narrowed identity", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
+      "authorization",
+      "Bearer " + token
+    ]]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected the narrowed token to authenticate");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected the narrowed token to authenticate");
+  }
+  globalThis.expect(result._0.groups).toEqual(["Shopper"]);
+});
+
+globalThis.test("the minted identity matches the token, not the stored user", async () => {
+  carolLoggedIn();
+  let minted = LocalAuth$ReventlessLocal.Login.mintedIdentity("carol", "Shopper");
+  let stored = LocalAuth$ReventlessLocal.lookupUser("carol");
+  globalThis.expect([
+    Stdlib_Option.mapOr(minted, [], i => i.groups),
+    Stdlib_Option.mapOr(stored, [], i => i.groups)
+  ]).toEqual([
+    ["Shopper"],
+    [
+      "Fulfilment",
+      "Shopper"
+    ]
+  ]);
+});
+
+globalThis.test("a session can be re-minted as one of its roles", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", undefined);
+  let wide;
+  wide = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let t$1 = LocalAuth$ReventlessLocal.Login.reissue(wide, "Shopper");
+  if (t$1.TAG !== "Ok") {
+    return Stdlib_JsError.throwWithMessage(t$1._0);
+  }
+  globalThis.expect(decodeOrThrow(t$1._0).groups).toEqual(["Shopper"]);
+});
+
+globalThis.test("a narrowed session can widen back to its full membership", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let narrow;
+  narrow = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let t$1 = LocalAuth$ReventlessLocal.Login.reissue(narrow, undefined);
+  if (t$1.TAG !== "Ok") {
+    return Stdlib_JsError.throwWithMessage(t$1._0);
+  }
+  let identity = decodeOrThrow(t$1._0);
+  globalThis.expect([
+    identity.groups,
+    identity.claims
+  ]).toEqual([
+    [
+      "Fulfilment",
+      "Shopper"
+    ],
+    undefined
+  ]);
+});
+
+globalThis.test("switching judges membership from the store, not the token's claim", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let narrow;
+  narrow = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let newrecord = {...multiRole};
+  LocalAuth$ReventlessLocal.Login.setCredentials("carol", "carol-pw", (newrecord.groups = ["Shopper"], newrecord));
+  let match = LocalAuth$ReventlessLocal.Login.reissue(narrow, "Fulfilment");
+  if (match.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected a revoked role to be unreachable via the token's claim");
+  }
+  globalThis.expect(true).toEqual(true);
+});
+
+globalThis.test("switching refuses a token this server did not sign", async () => {
+  carolLoggedIn();
+  let msg = LocalAuth$ReventlessLocal.Login.reissue("not.a-real-token", "Shopper");
+  if (msg.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected an unverifiable token to be refused");
+  }
+  globalThis.expect(msg._0).toEqual("Invalid token");
+});
+
 export {
   alice,
   bob,
   buildContext,
   resetAll,
+  multiRole,
+  decodeOrThrow,
+  carolLoggedIn,
 }
 /*  Not a pure module */

package/tests/adapter/LocalAuthUserStoreTest.res.mjs

@@ -81,7 +81,7 @@ globalThis.test("load(~users) registers credentials and returns InlineUsers", as
   } else {
     Stdlib_JsError.throwWithMessage("load failed: " + msg._0);
   }
-  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   if (result.TAG !== "Ok") {
     Stdlib_JsError.throwWithMessage("issue rejected loaded credentials: " + result._0);
   }
@@ -112,7 +112,7 @@ globalThis.test("load(~usersFile) reads a YAML file from disk", async () => {
   } else {
     Stdlib_JsError.throwWithMessage("load failed: " + msg._0);
   }
-  let result = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", undefined);
   if (result.TAG !== "Ok") {
     Stdlib_JsError.throwWithMessage("issue rejected file-loaded credentials: " + result._0);
   }