@toa.io/extensions.exposition 1.0.0-alpha.292 → 1.0.0-alpha.293

package/components/identity.tokens/source/decrypt.test.ts

@@ -1,216 +0,0 @@
-import { it, beforeEach, mock } from 'node:test'
-import assert from 'node:assert/strict'
-
-import { generate } from 'randomstring'
-import { EncryptFactory, ImportKeyFactory } from 'paseto/v3/local'
-import { Effect as Encrypt } from './encrypt.js'
-import { Computation as Decrypt } from './decrypt.js'
-import { type Configuration, type Context, type Identity } from './lib/index.js'
-import type { Secret } from '@toa.io/extensions.configuration'
-
-let configuration: Configuration
-let context: Context
-let encrypt: Encrypt
-let decrypt: Decrypt
-
-const remote = { identity: { keys: { observe: mock.fn(async () => null) } } }
-const authority = generate()
-
-beforeEach(() => {
-  configuration = {
-    keys: [
-      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
-      // keys are secrets, and a secret is an object
-      { id: 'key1', key: secret('5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0') },
-      {
-        id: 'legacy0',
-        key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'),
-        format: 'paseto'
-      },
-      {
-        id: 'legacy1',
-        key: secret('k3.local.-498jfWenrZH-Dqw3-zQJih_hKzDgBgUMfe37OCqSOA'),
-        format: 'paseto'
-      }
-    ],
-    lifetime: 1000,
-    refresh: 500,
-    cache: {
-      max: 1024,
-      ttl: 600
-    }
-  }
-
-  context = {
-    configuration,
-    remote,
-    logs: { debug: () => undefined }
-  } as unknown as Context
-
-  encrypt = new Encrypt()
-  encrypt.mount(context)
-
-  decrypt = new Decrypt()
-  decrypt.mount(context)
-})
-
-it('should decrypt', async () => {
-  const identity: Identity = { id: generate(), roles: [] }
-  const lifetime = 100
-
-  const reply = await encrypt.execute({ authority, identity, lifetime })
-
-  if (reply instanceof Error) throw reply
-
-  const decrypted = await decrypt.execute(reply)
-
-  assert.partialDeepStrictEqual(decrypted, {
-    iss: authority,
-    identity,
-    refresh: false,
-    custom: false
-  })
-})
-
-it('should mark a token encrypted with a custom key', async () => {
-  const identity: Identity = { id: generate(), roles: [] }
-  const key = {
-    id: generate(),
-    key: '5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0',
-    label: 'custom'
-  }
-
-  remote.identity.keys.observe = mock.fn(async ({ query }: { query: { id: string } }) =>
-    query.id === key.id ? { ...key, identity: identity.id } : null
-  ) as any
-
-  const encrypted = await encrypt.execute({ authority, identity, lifetime: 100, key })
-
-  if (encrypted instanceof Error) throw encrypted
-
-  const decrypted = await decrypt.execute(encrypted)
-
-  assert.partialDeepStrictEqual(decrypted, { identity, refresh: false, custom: true })
-})
-
-it('should decrypt with key1', async () => {
-  const k1context = {
-    configuration: {
-      keys: [configuration.keys[1]]
-    }
-  } as unknown as Context
-
-  encrypt = new Encrypt()
-  encrypt.mount(k1context)
-
-  const identity: Identity = { id: generate(), roles: [] }
-  const lifetime = 100
-
-  const encrypted = await encrypt.execute({ authority, identity, lifetime })
-
-  if (encrypted instanceof Error) throw encrypted
-
-  const decrypted = await decrypt.execute(encrypted)
-
-  assert.partialDeepStrictEqual(decrypted, { identity, refresh: true })
-})
-
-it('should decrypt legacy PASETO and require refresh', async () => {
-  const identity: Identity = { id: generate(), roles: [] }
-
-  const token = await paseto(
-    configuration.keys[2].key.unwrap(),
-    { iss: authority, identity },
-    'legacy0'
-  )
-
-  await assert.partialDeepStrictEqual(await decrypt.execute(token), {
-    iss: authority,
-    identity,
-    refresh: true
-  })
-})
-
-it('should separate JWE and PASETO keys with the same id by format', async () => {
-  configuration.keys[2].id = 'key0'
-
-  decrypt = new Decrypt()
-  decrypt.mount(context)
-
-  const identity: Identity = { id: generate(), roles: [] }
-
-  const token = await paseto(
-    configuration.keys[2].key.unwrap(),
-    { iss: authority, identity },
-    'key0'
-  )
-
-  await assert.partialDeepStrictEqual(await decrypt.execute(token), {
-    identity,
-    refresh: true
-  })
-})
-
-it('should reject a token under a revoked key', async () => {
-  const identity: Identity = { id: generate(), roles: [] }
-  const key = {
-    id: generate(),
-    key: '5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0',
-    label: 'revoked'
-  }
-
-  remote.identity.keys.observe = mock.fn(async ({ query }: { query: { id: string } }) =>
-    query.id === key.id ? { ...key, identity: identity.id, revokedAt: Date.now() } : null
-  ) as any
-
-  const encrypted = await encrypt.execute({ authority, identity, lifetime: 0, key })
-
-  if (encrypted instanceof Error) throw encrypted
-
-  const thrown: any = await decrypt.execute(encrypted)
-
-  assert.deepStrictEqual(thrown.code, 'REVOKED_KEY')
-})
-
-it('should reject a tampered JWE', async () => {
-  const token = await encrypt.execute({
-    authority,
-    identity: { id: generate(), roles: [] }
-  })
-
-  if (token instanceof Error) throw token
-
-  const parts = token.split('.')
-
-  parts[3] = (parts[3].startsWith('A') ? 'B' : 'A') + parts[3].slice(1)
-
-  const tampered = parts.join('.')
-
-  const thrown: any = await decrypt.execute(tampered)
-  assert.deepStrictEqual(thrown.code, 'INVALID_TOKEN')
-})
-
-it('should reject JWE with an unknown key', async () => {
-  const token = await encrypt.execute({
-    authority,
-    identity: { id: generate(), roles: [] },
-    key: { id: 'missing', key: configuration.keys[0].key.unwrap(), label: 'missing' }
-  })
-
-  if (token instanceof Error) throw token
-
-  const thrown: any = await decrypt.execute(token)
-  assert.deepStrictEqual(thrown.code, 'INVALID_KEY')
-})
-
-function secret(value: string): Secret {
-  return { unwrap: () => value }
-}
-
-async function paseto(key: string, claims: object, kid: string): Promise<string> {
-  const imported = await ImportKeyFactory().run(key as `k3.local.${string}`)
-
-  return await EncryptFactory().run(imported, claims, {
-    footer: new TextEncoder().encode(JSON.stringify({ kid }))
-  })
-}

package/components/identity.tokens/source/encrypt.test.ts

@@ -1,150 +0,0 @@
-import { it, beforeEach } from 'node:test'
-import assert from 'node:assert/strict'
-
-import { generate } from 'randomstring'
-import { timeout } from '@toa.io/generic'
-import { Effect as Encrypt } from './encrypt.js'
-import { Computation as Decrypt } from './decrypt.js'
-import { type Context, type Identity } from './lib/index.js'
-import type { Secret } from '@toa.io/extensions.configuration'
-
-let encrypt: Encrypt
-let decrypt: Decrypt
-
-const context: Context = {
-  remote: { identity: { keys: null } },
-  logs: { debug: () => undefined }
-} as unknown as Context
-
-const authority = generate()
-
-beforeEach(() => {
-  context.configuration = {
-    keys: [
-      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
-      {
-        id: 'legacy0',
-        key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'),
-        format: 'paseto'
-      }
-    ],
-    lifetime: 1,
-    refresh: 2,
-    cache: {
-      max: 1024,
-      ttl: 3
-    }
-  }
-
-  encrypt = new Encrypt()
-  encrypt.mount(context)
-
-  decrypt = new Decrypt()
-  decrypt.mount(context)
-})
-
-it('should use the first encryption key as active and expose its id as kid', async () => {
-  context.configuration.keys.unshift({
-    id: 'legacy-first',
-    key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'),
-    format: 'paseto'
-  })
-  context.configuration.keys.push({
-    id: 'key1',
-    key: secret('5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0')
-  })
-
-  encrypt.mount(context)
-
-  const encrypted = await encrypt.execute({
-    authority,
-    identity: { id: generate(), roles: [] }
-  })
-
-  if (encrypted instanceof Error) throw encrypted
-
-  const header = JSON.parse(Buffer.from(encrypted.split('.')[0], 'base64url').toString())
-
-  assert.partialDeepStrictEqual(header, { kid: 'key0', alg: 'dir', enc: 'A256GCM' })
-})
-
-it('should encrypt with configured lifetime by default', async () => {
-  const identity: Identity = { id: generate(), roles: [] }
-
-  const encrypted = await encrypt.execute({
-    authority,
-    identity
-  })
-
-  if (encrypted instanceof Error) throw encrypted
-
-  await assert.partialDeepStrictEqual(await decrypt.execute(encrypted), {
-    iss: authority,
-    identity
-  })
-
-  await timeout(context.configuration.lifetime * 1000)
-
-  const thrown: any = await decrypt.execute(encrypted)
-  assert.deepStrictEqual(thrown.code, 'INVALID_TOKEN')
-})
-
-it('should encrypt with given lifetime', async () => {
-  const identity: Identity = { id: generate(), roles: [] }
-  const lifetime = 0.1
-
-  const encrypted = await encrypt.execute({
-    authority,
-    identity,
-    lifetime
-  })
-
-  if (encrypted instanceof Error) throw encrypted
-
-  await assert.partialDeepStrictEqual(await decrypt.execute(encrypted), {
-    iss: authority,
-    identity
-  })
-
-  await timeout(lifetime * 1000)
-
-  const thrown: any = await decrypt.execute(encrypted)
-  assert.deepStrictEqual(thrown.code, 'INVALID_TOKEN')
-})
-
-it('should encrypt without lifetime INSECURE', async () => {
-  const identity: Identity = { id: generate(), roles: [] }
-  const lifetime = 0
-
-  const encrypted = await encrypt.execute({
-    authority,
-    identity,
-    lifetime
-  })
-
-  if (encrypted instanceof Error) throw encrypted
-
-  const decrypted = await decrypt.execute(encrypted)
-
-  assert.ok(!(decrypted instanceof Error))
-
-  assert.partialDeepStrictEqual(decrypted.identity, identity)
-})
-
-it('should keep the identity permissions when none are given', async () => {
-  const permissions = { '/notes/': ['GET'] }
-  const identity: Identity = { id: generate(), roles: [], permissions }
-
-  const encrypted = await encrypt.execute({ authority, identity, lifetime: 100 })
-
-  if (encrypted instanceof Error) throw encrypted
-
-  const decrypted = await decrypt.execute(encrypted)
-
-  assert.ok(!(decrypted instanceof Error))
-  assert.deepStrictEqual(decrypted.identity.permissions, permissions)
-})
-
-function secret(value: string): Secret {
-  return { unwrap: () => value }
-}

package/components/identity.tokens/source/issue.test.ts

@@ -1,73 +0,0 @@
-import { it, beforeEach, mock } from 'node:test'
-import assert from 'node:assert/strict'
-
-import { generate } from 'randomstring'
-import { Effect as Issue } from './issue.js'
-import type { Context, EncryptInput } from './lib/index.js'
-
-const LIFETIME = 2592000 // seconds, the configured default
-const identity = generate()
-const authority = generate()
-const label = generate()
-
-let issue: Issue
-let encrypted: EncryptInput
-
-beforeEach(() => {
-  const context = {
-    configuration: { lifetime: LIFETIME },
-    remote: {
-      identity: {
-        keys: { create: mock.fn(async () => ({ id: 'kid0', key: 'secret' })) },
-        roles: { list: mock.fn(async () => []) }
-      }
-    },
-    local: {
-      encrypt: mock.fn(async ({ input }: { input: EncryptInput }) => {
-        encrypted = input
-
-        return 'token'
-      })
-    }
-  } as unknown as Context
-
-  issue = new Issue()
-  issue.mount(context)
-})
-
-/**
- * The configured lifetime is seconds, as the schema says and as `encrypt` reads it. Storing
- * it as milliseconds and then multiplying again put the expiration some eighty thousand years
- * out, and only on this path — every scenario passes a lifetime of its own.
- */
-it('should expire a token issued without a lifetime as the configuration says', async () => {
-  const now = Date.now()
-  const reply: any = await issue.execute({ authority, identity, label })
-
-  const seconds = (reply.exp - now) / 1000
-
-  assert.ok(
-    Math.abs(seconds - LIFETIME) < 10,
-    `expected to expire in about ${LIFETIME} seconds, got ${seconds}`
-  )
-})
-
-it('should hand the lifetime to `encrypt` in the seconds it reads', async () => {
-  await issue.execute({ authority, identity, label })
-
-  assert.equal(encrypted.lifetime, LIFETIME)
-})
-
-it('should expire a token as its own lifetime says', async () => {
-  const now = Date.now()
-  const reply: any = await issue.execute({ authority, identity, label, lifetime: 600 })
-
-  assert.ok(Math.abs((reply.exp - now) / 1000 - 600) < 10)
-  assert.equal(encrypted.lifetime, 600)
-})
-
-it('should issue a token that does not expire INSECURE', async () => {
-  const reply: any = await issue.execute({ authority, identity, label, lifetime: 0 })
-
-  assert.equal(reply.exp, undefined)
-})

package/components/identity.tokens/source/lib/form.test.ts

@@ -1,25 +0,0 @@
-import { it } from 'node:test'
-import assert from 'node:assert/strict'
-
-import { form } from './form.js'
-
-it('should recognize a compact JWE by its five segments', () => {
-  assert.equal(form('header.key.iv.ciphertext.tag'), 'jwe')
-})
-
-it('should recognize a legacy PASETO by its prefix', () => {
-  assert.equal(form('v3.local.payload'), 'paseto')
-})
-
-it('should not recognize a JWS, which is what an id_token is', () => {
-  assert.equal(form('header.payload.signature'), null)
-})
-
-it('should not recognize what is not a token at all', () => {
-  for (const value of ['', 'token', 'header.key.iv.ciphertext.tag.extra'])
-    assert.equal(form(value), null)
-})
-
-it('should read the shape and nothing else, leaving the rest to the verifier', () => {
-  assert.equal(form('....'), 'jwe')
-})

package/components/identity.tokens/source/lib/paseto.test.ts

@@ -1,62 +0,0 @@
-import { it } from 'node:test'
-import assert from 'node:assert/strict'
-
-import {
-  DecryptFactory,
-  EncryptFactory,
-  ExportKeyFactory,
-  GenerateKeyFactory,
-  ImportKeyFactory
-} from 'paseto/v3/local'
-
-const generateKey = GenerateKeyFactory().run
-const exportKey = ExportKeyFactory().run
-const importKey = ImportKeyFactory().run
-const encrypt = EncryptFactory().run
-const decrypt = DecryptFactory().run
-
-it('should export a generated key as PASERK', async () => {
-  const paserk = await exportKey(await generateKey({ extractable: true }))
-
-  assert.match(paserk, /^k3\.local\./)
-})
-
-it('should round trip a token', async () => {
-  const key = await importKey(await exportKey(await generateKey({ extractable: true })))
-  const token = await encrypt(key, { iss: 'test', sub: 'me' })
-
-  assert.match(token, /^v3\.local\./)
-
-  const { claims } = await decrypt(key, token, { allowNonExpiring: true })
-
-  assert.partialDeepStrictEqual(claims, { iss: 'test', sub: 'me' })
-})
-
-it('should carry the key id in the footer, which is read without the key', async () => {
-  const key = await importKey(await exportKey(await generateKey({ extractable: true })))
-  const token = await encrypt(
-    key,
-    { iss: 'test' },
-    { footer: new TextEncoder().encode(JSON.stringify({ kid: 'key0' })) }
-  )
-
-  // decrypt reads it, and so does anyone holding only the token
-  const [, , , footer] = token.split('.')
-
-  assert.deepStrictEqual(JSON.parse(Buffer.from(footer, 'base64url').toString()), {
-    kid: 'key0'
-  })
-})
-
-it('should decrypt a token issued under paseto 3', async () => {
-  // both written by paseto 3.1.4: the legacy path exists to read tokens already in the wild
-  const key = await importKey('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog')
-  const token =
-    'v3.local.Fm7vzrYSDh7Kc9j_2eNr4vwWw5jSEOIKrh_vCbteQQP57tFo5xxk7koNIJQNcH9b' +
-    'O4yH9ItoC-fWL3ycm-YqBIsadjfbSOvwhffP130-tw3MZZ5PNJzFe6afNa4wxbKpa1bWtOwwULJpAqmZ' +
-    '.eyJraWQiOiJsZWdhY3kwIn0'
-
-  const { claims } = await decrypt(key, token, { allowNonExpiring: true })
-
-  assert.partialDeepStrictEqual(claims, { iss: 'legacy', sub: 'old' })
-})