@velocitycareerlabs/server-careerwallet 1.25.0-dev-build.12642c864

package/test/accounts-controller.test.js

@@ -0,0 +1,893 @@
+const { mongoDb } = require('@spencejs/spence-mongo-repos');
+const { ObjectId } = require('mongodb');
+const { omit } = require('lodash/fp');
+const nock = require('nock');
+const { jwtVerify, jwkFromSecp256k1Key } = require('@velocitycareerlabs/jwt');
+require('@velocitycareerlabs/tests-helpers');
+const {
+  generateKeyPair,
+  hashAndEncodeHex,
+  decrypt,
+} = require('@velocitycareerlabs/crypto');
+const { ISO_DATETIME_FORMAT } = require('@velocitycareerlabs/test-regexes');
+const { errorResponseMatcher } = require('@velocitycareerlabs/tests-helpers');
+const { hexFromJwk } = require('@velocitycareerlabs/jwt');
+const buildFastify = require('./helpers/careerwallet-build-fastify');
+const initDevicesFactory = require('./factories/devices-factory');
+const devicesRepoPlugin = require('../src/controllers/api/v0.6/devices/repo');
+const {
+  accountsRepoPlugin,
+  accountScopes,
+  adminScopes,
+} = require('../src/entities');
+const { createAccessToken } = require('./helpers/access-token');
+const accountsFactory = require('./factories/accounts-factory');
+const personaFactory = require('./factories/persona-factory');
+
+const idToken =
+  // eslint-disable-next-line max-len
+  'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IktFWSJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0LyIsImF1ZCI6ImZvbyIsInNjb3BlIjoicmVhZDp1c2VycyJ9.VwIIUqx9T-AxqbfL_FyNRAeOxTwiC2JpcwtrqnEWN3DdF07ijUkF1WYy8Ahfr_p4R3KnoPbiefZnIbVANCt-lt0ej32rfil2yHhQEsvFxSOjcrx6ARmPp0YAfWlN-5Sotzkxy29jaOZMEDkmRFZg3jkdC7wosPW_S6M-olC4g3HHfylpZI8O3Jdd87Qr9wD_QtUzANwnPbl2Q-9NEyxVjAZIWg_HWK9JAAaf_2IY5VwHBvyp0oeQSEHKi4hogcM59EOc4FxdR5WH45B_PenVa6W4mHFBkH8sAXxt2Zs9s2efujkfWYfyXvgL_lN7vT-TEADlAPP2L6CpWpDISOMsQWUSgGHcN_KwRh_E7qJwahR6mv4QHY6ReEoyjkmSS3swrD1l74jNs7QLAdsMywvzCMDsHabs7DYcEMGQBdP14PJ_ucLFnkivZeBDAc6sS445ocbyrpyO40XMaMorD5khRd9ej89SxR7d_v0W6Ne2Nn4XgW3pAZzu5Rdc4JvqfzLFxkp95jxy1MTAddjWISPmNOYYyXHM9SSqSpqVECOFS0f4z2zycHRqXUcOytWrvED6VGo9x7-IVCgu8vFzj0zToIWQmsDs3UoH9RnV12z0PMwGXQzca1lT_zGwJxBF3e4zJjmcJ05OMF2JgZ2_G48O3M4Dtb0jlgWbKLd0kWlIFzQ';
+const userIdForIdToken = '1234567890';
+
+const testDID = 'test_did';
+
+const testDidKeyMetadatum = {
+  publicJwk: {
+    crv: 'secp256k1',
+    kty: 'EC',
+    use: 'sig',
+    x: 'Lm972sWcSp9dMzkbsXvbUZ7-E24mreaZRIXAR9rIG94',
+    y: 'jbSpGUpx0g4ZrNS2heAuwDqmr-F2JIWvK29l-6vJBKA',
+  },
+  keyId: 'keyId',
+  kid: `${testDID}#0`,
+  did: testDID,
+};
+
+const emulateGenerateDid = (accountsRepo, id) => {
+  return accountsRepo.update(id, {
+    did: testDID,
+    didKeyMetadatum: [
+      {
+        ...testDidKeyMetadatum,
+      },
+    ],
+  });
+};
+
+describe('Accounts controller Test Suite', () => {
+  let accountsRepo;
+  let fastify;
+  let persistDevices;
+  let devicesRepo;
+  let privateKey;
+  let persistAccounts;
+  let persistPersona;
+  let publicKey;
+
+  const deviceId = 'test-device-id';
+
+  beforeAll(async () => {
+    ({ publicKey, privateKey } = generateKeyPair({ format: 'jwk' }));
+    fastify = buildFastify({
+      holderAppServerAccessTokenPublicKey: publicKey,
+      holderAppServerAccessTokenSigningKey: hexFromJwk(privateKey),
+    });
+    await fastify.ready();
+
+    ({ persistDevices } = initDevicesFactory(fastify));
+
+    accountsRepo = await accountsRepoPlugin(fastify)({
+      log: fastify.log,
+      config: fastify.config,
+    });
+
+    devicesRepo = devicesRepoPlugin(fastify)({
+      log: fastify.log,
+      config: fastify.config,
+    });
+    ({ persistAccounts } = accountsFactory(fastify));
+    ({ persistPersona } = personaFactory(fastify));
+  });
+
+  afterAll(async () => {
+    await mongoDb().collection('devices').deleteMany({});
+    await mongoDb().collection('personas').deleteMany({});
+    await mongoDb().collection('accounts').deleteMany({});
+    await fastify.close();
+  });
+
+  beforeEach(async () => {
+    await mongoDb().collection('devices').deleteMany({});
+    await mongoDb().collection('personas').deleteMany({});
+    await mongoDb().collection('accounts').deleteMany({});
+  });
+
+  describe('POST /accounts endpoint - Create account', () => {
+    describe('Account creation with device provided', () => {
+      it('Successful account creation scenario', async () => {
+        const device = await persistDevices({ deviceId });
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              device: {
+                deviceId,
+                deviceType: 'phone',
+                deviceOS: 'ios',
+              },
+            },
+          },
+        });
+        expect(response.statusCode).toEqual(200);
+
+        expect(response.json).toEqual({
+          account: {
+            id: expect.any(String),
+            accountType: 'temp',
+            didKeyMetadatum: [],
+            devices: [expectedDevice(device)],
+            createdAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+            updatedAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+          },
+          access_token: expect.any(String),
+          refresh_token: expect.any(String),
+        });
+
+        const accountDevice = await devicesRepo.findOne({
+          filter: { deviceId },
+        });
+
+        const accountInfoFromDb = await accountsRepo.findOne({
+          filter: { _id: accountDevice.accountId },
+        });
+
+        expect({
+          ...accountInfoFromDb,
+          scope: accountInfoFromDb.scope.join(' '),
+          createdAt: accountInfoFromDb.createdAt.toISOString(),
+          updatedAt: accountInfoFromDb.updatedAt.toISOString(),
+        }).toEqual({
+          _id: expect.any(ObjectId),
+          accountType: response.json.account.accountType,
+          scope: 'key:create',
+          createdAt: response.json.account.createdAt,
+          updatedAt: response.json.account.updatedAt,
+          refreshToken: hashAndEncodeHex(response.json.refresh_token),
+          didKeyMetadatum: response.json.account.didKeyMetadatum,
+        });
+      });
+
+      it('Successful account creation with deviceId as push token scenario', async () => {
+        const persistedDevice = await persistDevices({ deviceId });
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              device: {
+                deviceId: persistedDevice.pushToken,
+                deviceType: 'phone',
+                deviceOS: 'ios',
+              },
+            },
+          },
+        });
+        expect(response.statusCode).toEqual(200);
+
+        expect(response.json).toEqual({
+          account: {
+            id: expect.any(String),
+            accountType: 'temp',
+            devices: [expectedDevice(persistedDevice)],
+            didKeyMetadatum: [],
+            createdAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+            updatedAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+          },
+          access_token: expect.any(String),
+          refresh_token: expect.any(String),
+        });
+
+        const accountDevice = await devicesRepo.findOne({
+          filter: { pushToken: persistedDevice.pushToken },
+        });
+
+        const accountInfoFromDb = await accountsRepo.findOne({
+          filter: { _id: accountDevice.accountId },
+        });
+
+        expect({
+          ...accountInfoFromDb,
+          scope: accountInfoFromDb.scope.join(' '),
+          createdAt: accountInfoFromDb.createdAt.toISOString(),
+          updatedAt: accountInfoFromDb.updatedAt.toISOString(),
+        }).toEqual({
+          _id: expect.any(ObjectId),
+          accountType: response.json.account.accountType,
+          scope: 'key:create',
+          createdAt: response.json.account.createdAt,
+          updatedAt: response.json.account.updatedAt,
+          refreshToken: hashAndEncodeHex(response.json.refresh_token),
+          didKeyMetadatum: response.json.account.didKeyMetadatum,
+        });
+      });
+
+      it('Access token should have scope key:create', async () => {
+        const testAccessTokenSigningKeyPair = generateKeyPair();
+
+        fastify.overrides.reqConfig = (config) => ({
+          ...config,
+          holderAppServerAccessTokenSigningKey:
+            testAccessTokenSigningKeyPair.privateKey,
+        });
+
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              device: {
+                deviceId,
+                deviceType: 'phone',
+                deviceOS: 'ios',
+              },
+            },
+          },
+        });
+
+        const { access_token: accessToken } = response.json;
+
+        const {
+          payload: { scope },
+        } = await jwtVerify(
+          accessToken,
+          jwkFromSecp256k1Key(testAccessTokenSigningKeyPair.publicKey, false)
+        );
+
+        expect(scope).toEqual('key:create');
+      });
+
+      it('Access token should have sub (account Id) in header equals account id in DB', async () => {
+        await persistDevices({ deviceId });
+        const testAccessTokenSigningKeyPair = generateKeyPair();
+
+        fastify.overrides.reqConfig = (config) => ({
+          ...config,
+          holderAppServerAccessTokenSigningKey:
+            testAccessTokenSigningKeyPair.privateKey,
+        });
+
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              device: {
+                deviceId,
+                deviceType: 'phone',
+                deviceOS: 'ios',
+              },
+            },
+          },
+        });
+
+        const { access_token: accessToken } = response.json;
+
+        const {
+          payload: { sub },
+        } = await jwtVerify(
+          accessToken,
+          jwkFromSecp256k1Key(testAccessTokenSigningKeyPair.publicKey, false)
+        );
+
+        const connectedDevice = await devicesRepo.findOne({
+          filter: { deviceId },
+        });
+
+        const accountInfoFromDb = await accountsRepo.findOne({
+          filter: { _id: connectedDevice.accountId },
+        });
+
+        expect(sub).toEqual(accountInfoFromDb._id.toString());
+      });
+
+      it('Should return 400 if request is incorrect - wrong accountType', async () => {
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'incorrect_account_type',
+              device: {
+                deviceId,
+                deviceType: 'phone',
+                deviceOS: 'ios',
+              },
+            },
+          },
+        });
+        expect(response.statusCode).toEqual(400);
+      });
+
+      it('Should return 400 if id_token and device are both missing', async () => {
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+            },
+          },
+        });
+
+        expect(response.statusCode).toEqual(400);
+      });
+    });
+
+    describe('Account creation with id_token provided', () => {
+      beforeEach(() => {
+        nock.cleanAll();
+        nock('https://localhost/')
+          .get('/.well-known/jwks.json')
+          .reply(200, jwks);
+      });
+
+      afterAll(() => {
+        nock.cleanAll();
+        nock.restore();
+      });
+
+      it('Successful account creation scenario', async () => {
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              id_token: idToken,
+            },
+          },
+        });
+
+        expect(response.statusCode).toEqual(200);
+
+        expect(response.json).toEqual({
+          account: {
+            id: expect.any(String),
+            accountType: 'temp',
+            id_token_iss: fastify.config.auth0Domain,
+            id_token_sub: userIdForIdToken,
+            createdAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+            updatedAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+            didKeyMetadatum: expect.arrayContaining([]),
+          },
+          access_token: expect.any(String),
+          refresh_token: expect.any(String),
+        });
+
+        const accountInfoFromDb = await accountsRepo.findOne({
+          filter: { userId: userIdForIdToken },
+        });
+
+        expect({
+          ...accountInfoFromDb,
+          scope: accountInfoFromDb.scope.join(' '),
+          createdAt: accountInfoFromDb.createdAt.toISOString(),
+          updatedAt: accountInfoFromDb.updatedAt.toISOString(),
+          idTokenClaims: JSON.parse(
+            decrypt(accountInfoFromDb.idTokenClaims, fastify.config.mongoSecret)
+          ),
+        }).toEqual({
+          _id: expect.any(ObjectId),
+          accountType: response.json.account.accountType,
+          userId: response.json.account.id_token_sub,
+          scope: 'key:create',
+          createdAt: response.json.account.createdAt,
+          updatedAt: response.json.account.updatedAt,
+          refreshToken: hashAndEncodeHex(response.json.refresh_token),
+          idTokenClaims: {
+            idTokenIssuer: fastify.config.auth0Domain,
+          },
+          didKeyMetadatum: response.json.account.didKeyMetadatum,
+        });
+      });
+
+      it('Shouldn`t create new account if already exists', async () => {
+        const account = await accountsRepo.insert({
+          accountType: 'temp',
+          userId: userIdForIdToken,
+          didKeyMetadatum: [],
+        });
+
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              id_token: idToken,
+            },
+          },
+        });
+
+        expect(response.statusCode).toEqual(200);
+
+        expect(response.json.account.createdAt).toEqual(
+          account.createdAt.toISOString()
+        );
+        expect(response.json.account.updatedAt).toEqual(
+          account.updatedAt.toISOString()
+        );
+
+        expect(await accountsRepo.count({})).toEqual(1);
+      });
+
+      it('Should have didKeyMetadatum in response next time after generation of did', async () => {
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              id_token: idToken,
+            },
+          },
+        });
+
+        await emulateGenerateDid(accountsRepo, response.json.account.id);
+
+        const updatedResponse = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              id_token: idToken,
+            },
+          },
+        });
+
+        expect(updatedResponse.statusCode).toEqual(200);
+
+        expect(updatedResponse.json.account.didKeyMetadatum[0].did).toEqual(
+          'test_did'
+        );
+      });
+
+      it('Should return 401 if token audience is different', async () => {
+        fastify.overrides.reqConfig = (config) => ({
+          ...config,
+          oauth0WebappClientId: 'another-audience',
+        });
+
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              id_token: idToken,
+            },
+          },
+        });
+
+        expect(response.statusCode).toEqual(401);
+      });
+    });
+
+    describe('Account creation with personaEmail body param provided', () => {
+      it('Should return 200 and did metadatum of the related Test Persona if did exists', async () => {
+        const device = await persistDevices({ deviceId });
+
+        const didKeyMetadatum = {
+          did: 'did:example:123456789abcdefghi',
+          kid: 'did:example:123456789abcdefghi#0',
+          keyId: '65ba702ac8670c687d3b066f',
+          publicJwk: {
+            crv: 'secp256k1',
+            kty: 'EC',
+            x: 'e907f5476c57e73423f1c9b393bc1d0a4d56280ac155396cc879f2441a523cdc',
+            y: '89d4dcc86d540c6eea39d178eedc30213e782f251e03b76f4273106808dd0d4f',
+          },
+        };
+
+        const email = 'olivia.hafez@example.com';
+        await persistPersona({ email, ...didKeyMetadatum });
+
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: '/api/v0.6/accounts',
+          payload: {
+            account: {
+              accountType: 'temp',
+              device: {
+                deviceId,
+                deviceType: 'phone',
+                deviceOS: 'ios',
+              },
+            },
+            personaEmail: email,
+          },
+        });
+        expect(response.statusCode).toEqual(200);
+
+        expect(response.json).toEqual({
+          account: {
+            id: expect.any(String),
+            accountType: 'temp',
+            devices: [expectedDevice(device)],
+            didKeyMetadatum: [didKeyMetadatum],
+            createdAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+            updatedAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+          },
+          access_token: expect.any(String),
+          refresh_token: expect.any(String),
+        });
+
+        const accountInfoFromDb = await accountsRepo.findOne({
+          filter: { _id: response.json.account.id },
+        });
+
+        expect({
+          ...accountInfoFromDb,
+          createdAt: accountInfoFromDb.createdAt.toISOString(),
+          updatedAt: accountInfoFromDb.updatedAt.toISOString(),
+        }).toEqual({
+          _id: expect.any(ObjectId),
+          accountType: response.json.account.accountType,
+          scope: ['jwt', 'key:create', 'inbox', 'account'],
+          refreshToken: hashAndEncodeHex(response.json.refresh_token),
+          didKeyMetadatum: [didKeyMetadatum],
+          createdAt: response.json.account.createdAt,
+          updatedAt: response.json.account.updatedAt,
+        });
+      });
+    });
+
+    it('Should return 200 and empty metadatum array if Persona doesn`t have did', async () => {
+      const device = await persistDevices({ deviceId });
+
+      const email = 'carmen.johnson@example.com';
+      await persistPersona({ email });
+
+      const response = await fastify.injectJson({
+        method: 'POST',
+        url: '/api/v0.6/accounts',
+        payload: {
+          account: {
+            accountType: 'temp',
+            device: {
+              deviceId,
+              deviceType: 'phone',
+              deviceOS: 'ios',
+            },
+          },
+          personaEmail: email,
+        },
+      });
+      expect(response.statusCode).toEqual(200);
+
+      expect(response.json).toEqual({
+        account: {
+          id: expect.any(String),
+          accountType: 'temp',
+          devices: [expectedDevice(device)],
+          didKeyMetadatum: [],
+          createdAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+          updatedAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+        },
+        access_token: expect.any(String),
+        refresh_token: expect.any(String),
+      });
+
+      const accountInfoFromDb = await accountsRepo.findOne({
+        filter: { _id: response.json.account.id },
+      });
+
+      expect({
+        ...accountInfoFromDb,
+        createdAt: accountInfoFromDb.createdAt.toISOString(),
+        updatedAt: accountInfoFromDb.updatedAt.toISOString(),
+      }).toEqual({
+        _id: expect.any(ObjectId),
+        accountType: response.json.account.accountType,
+        scope: ['key:create'],
+        refreshToken: hashAndEncodeHex(response.json.refresh_token),
+        didKeyMetadatum: [],
+        createdAt: response.json.account.createdAt,
+        updatedAt: response.json.account.updatedAt,
+      });
+    });
+
+    it('Should return 400 if invalid Persona email specified', async () => {
+      await persistDevices({ deviceId });
+      await persistPersona({ email: 'olivia.hafez@example.com' });
+
+      const response = await fastify.injectJson({
+        method: 'POST',
+        url: '/api/v0.6/accounts',
+        payload: {
+          account: {
+            accountType: 'temp',
+            device: {
+              deviceId,
+              deviceType: 'phone',
+              deviceOS: 'ios',
+            },
+          },
+          personaEmail: 'wrong.email@example.com',
+        },
+      });
+      expect(response.statusCode).toEqual(400);
+
+      expect(response.json).toEqual(
+        errorResponseMatcher({
+          error: 'Bad Request',
+          errorCode: 'missing_error_code',
+          message: 'Invalid persona email',
+          statusCode: 400,
+        })
+      );
+    });
+  });
+  describe('GET Account endpoint', () => {
+    let serverClientAccessToken;
+
+    beforeAll(async () => {
+      serverClientAccessToken = await createAccessToken(
+        adminScopes.adminClient,
+        privateKey,
+        'https://webwallet.velocitycareerlabs.com/'
+      );
+    });
+
+    it('Successful get account scenario with empty didKeyMetadatum', async () => {
+      const account = await persistAccounts();
+      const accountId = account._id;
+
+      const accessToken = await createAccessToken(
+        accountScopes.keyCreate,
+        privateKey,
+        accountId
+      );
+      const response = await fastify.injectJson({
+        method: 'GET',
+        url: `/api/v0.6/accounts/${accountId}`,
+        headers: {
+          authorization: `Bearer ${accessToken}`,
+        },
+      });
+
+      expect(response.statusCode).toEqual(200);
+
+      expect(response.json).toEqual({
+        account: {
+          id: expect.any(String),
+          accountType: 'temp',
+          devices: [],
+          didKeyMetadatum: [],
+          createdAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+          updatedAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+        },
+      });
+    });
+
+    it('Successful get account scenario with non empty didKeyMetadatum', async () => {
+      const account = await persistAccounts({
+        didKeyMetadatum: [testDidKeyMetadatum],
+      });
+      const device = await persistDevices({
+        accountId: new ObjectId(account._id),
+      });
+
+      const accessToken = await createAccessToken(
+        accountScopes.keyCreate,
+        privateKey,
+        account._id
+      );
+      const response = await fastify.injectJson({
+        method: 'GET',
+        url: `/api/v0.6/accounts/${account._id}`,
+        headers: {
+          authorization: `Bearer ${accessToken}`,
+        },
+      });
+
+      expect(response.statusCode).toEqual(200);
+
+      expect(response.json).toEqual({
+        account: {
+          id: expect.any(String),
+          accountType: 'temp',
+          devices: [expectedDevice(device)],
+          didKeyMetadatum: [testDidKeyMetadatum],
+          createdAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+          updatedAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+        },
+      });
+    });
+
+    it('if the access token account does not match the accountId then return 403', async () => {
+      const idForAnotherUser = 'idForAnotherUser';
+      const account = await persistAccounts();
+      const accountId = account._id;
+
+      const accessToken = await createAccessToken(
+        accountScopes.keyCreate,
+        privateKey,
+        accountId
+      );
+
+      const response = await fastify.injectJson({
+        method: 'GET',
+        url: `/api/v0.6/accounts/${idForAnotherUser}`,
+        headers: {
+          authorization: `Bearer ${accessToken}`,
+        },
+      });
+
+      expect(response.statusCode).toEqual(403);
+
+      expect(response.json).toStrictEqual(
+        errorResponseMatcher({
+          error: 'Forbidden',
+          message: 'Access token account does not match the accountId',
+          errorCode: 'missing_error_code',
+          statusCode: 403,
+        })
+      );
+    });
+
+    it('Successful get account if requested by the server client with valid M2M token', async () => {
+      const account = await persistAccounts();
+      const accountId = account._id;
+
+      const response = await fastify.injectJson({
+        method: 'GET',
+        url: `/api/v0.6/accounts/${accountId}`,
+        headers: {
+          authorization: `Bearer ${serverClientAccessToken}`,
+        },
+      });
+
+      expect(response.statusCode).toEqual(200);
+
+      expect(response.json).toEqual({
+        account: {
+          id: expect.any(String),
+          accountType: 'temp',
+          devices: [],
+          didKeyMetadatum: [],
+          createdAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+          updatedAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+        },
+      });
+    });
+  });
+
+  describe('POST /accounts/:accountId/push_token endpoint - Create push token', () => {
+    describe('Push token creation for DID', () => {
+      it('Successful token creation scenario', async () => {
+        const account = await persistAccounts();
+        const accountId = account._id;
+
+        const accessToken = await createAccessToken(
+          accountScopes.keyCreate,
+          privateKey,
+          accountId
+        );
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: `/api/v0.6/accounts/${accountId}/push_token`,
+          payload: {
+            did: testDID,
+          },
+          headers: {
+            authorization: `Bearer ${accessToken}`,
+          },
+        });
+
+        expect(response.statusCode).toEqual(200);
+
+        const filteredAccount = await accountsRepo.findOne({
+          [`pushTokens.${response.pushToken}`]: { $exists: true },
+        });
+        expect(filteredAccount).toBeDefined();
+        const { pushToken } = response.json;
+        expect(filteredAccount.pushTokens[pushToken].did).toEqual(testDID);
+      });
+
+      it('Unauthorized token creation scenario', async () => {
+        const account = await persistAccounts();
+        const accountId = account._id;
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: `/api/v0.6/accounts/${accountId}/push_token`,
+          payload: {
+            did: testDID,
+          },
+          headers: {
+            authorization: 'Bearer invalid-token',
+          },
+        });
+
+        expect(response.statusCode).toEqual(401);
+      });
+
+      it('Unauthorized userId creation scenario', async () => {
+        const account = await persistAccounts();
+        const wrongAccountId = 'another_user_id';
+        const accessToken = await createAccessToken(
+          accountScopes.keyCreate,
+          privateKey,
+          account._id
+        );
+        const response = await fastify.injectJson({
+          method: 'POST',
+          url: `/api/v0.6/accounts/${wrongAccountId}/push_token`,
+          payload: {
+            did: testDID,
+          },
+          headers: {
+            authorization: `Bearer ${accessToken}`,
+          },
+        });
+
+        expect(response.statusCode).toEqual(401);
+      });
+    });
+  });
+});
+
+const jwks = {
+  keys: [
+    {
+      alg: 'RS512',
+      kid: 'KEY',
+      x5c: ['UNUSED'],
+    },
+    {
+      alg: 'RS256',
+      kid: 'KEY',
+      x5c: [
+        `
+  MIIEnjCCAoYCCQDmnGII6qzGlTANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZ1
+  bnVzZWQwHhcNMjEwOTE5MDcxODQ2WhcNMjExMDE5MDcxODQ2WjARMQ8wDQYDVQQD
+  DAZ1bnVzZWQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDY2acJ8JAH
+  XjK8j3sAXOokSWwvaEg65UJS0C7KdnfbLTeaeYFHBRY0v9Jkk/PJSXv9hMWw1aD3
+  n7NrhVwXeRXi/7VZuW/S4ek+hK+IMDvpKqzn+XeCpaMoRpAgloADeNY0qhYKxpr2
+  L0SmRQDwVy1r/g31ECewD2WpEiRSmXsQ2Q2uYT3V60BmbhUw31KGEr4SLXL9pzmb
+  arOH/5Rhqg+YFMywNY6i01S3UdOlUtAyWT/mVRAkVTsUEou9tBw61zputPdMrl7p
+  d4InmlfCmXNTPFh9EDczPQiAVPq8MDyEdRGP134+HM9+YgQUZjy+WsxmGEvplJIf
+  KrYtlWe11//oAXC3690LUYtvg49lNY4+H0/nngjnCDXkZo6f+PEvnBZfYl596VTV
+  Fx4FGNOqLwg4bAyE5j5jXtEGW1oKo1pxBg7Oe3MteQUDwMrONB3CbxdxDiN3YH94
+  2nWGW9Le+CeA1QUhfjQqSoZRJURGYGoztVuIXOElnkrgwcJreX4b8y+Uo5kpp2By
+  6UUaD/mMj9XQ+Ygp/J8DlJlqDXOIp6JUJ75aSK5ZIjRtWq/Go5RUjW9IW0ldEehh
+  /4j0ZWC0vR1/le2UmAE6tXhkH4sdx9JM84V+qRzjiGqQx3Wn00uwMiHHhte17t41
+  vk+b75wuHbfiq9R8irL6wqWeeuzvCC37NwIDAQABMA0GCSqGSIb3DQEBCwUAA4IC
+  AQCZOT6S5HLUp0gBtWK6Fxyzb9lWPE+AJipjJ80lS3OnaOIyVtyJexJ2BjTKWldJ
+  48zkzLNIRsTEGEipNS6NkrkElfmoaNBpdbDch2WBkME3UYlFIR9GgbXPMlACQlwJ
+  f4qT3iIZ9zjpVMP8F63TzRRr7KEYW2PGHEtVQktMPprGEfU4Sz0OIa9RRV+BLsfh
+  x8he2pimJEzoEaWPgyJXV1S+tLUif8A/CEkZVRZ2vADA7WMGl2ZTdbmsTjXh4bf2
+  A4l4Zec+jwOjUPiEk5lLJwv1KeYos9wuUczAk7ku8wRzyZbrjwgRam9VQA5qmRzJ
+  PegEQwJaKMRu8PPK0L4KFN4v3ma7Ux6D719nko8mZ0kA2oUs6phsFmoWQfsbRbsD
+  CdUGnM2fPp6V285r9w9Y6+1nVdtJpbAPFJR3SxIpfYVfx3tI6C3BR9bIMr8uCf81
+  G+Ebvo4qTuY6Cg/mTpPLZ4cKpwSvB6cE+xeSHvKIRYm6QUYEReRxQ3b4aUKBSNwl
+  FEQufVGhGzeblNC3fjP+mMtqbyC8c1zkHc6tjJYO5yesKf8bjO71by2jgSced7nN
+  5JvJawfEcabgHJ1aAFLj0tlPMrViFzu6y8/A5aZLc5UMISXAZXfB4wIEdyUUXJh4
+  rJKE/ZCb2+W8g29N5cv2P6nhahT3mYatMiQ0U/gfaIrA0A==
+          `.trim(),
+      ],
+    },
+  ],
+};
+
+const expectedDevice = (device) => ({
+  ...omit(['_id', 'pushToken', 'accountId'], device),
+  updatedAt: expect.stringMatching(ISO_DATETIME_FORMAT),
+});