@vertesia/ui 1.5.0-dev.20260804.124748Z → 1.5.0-dev.20260807.073259Z

package/src/session/auth/composable.scope.test.ts

@@ -0,0 +1,88 @@
+// @vitest-environment jsdom
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const logger = { info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+
+vi.mock('@vertesia/ui/env', () => ({
+    Env: {
+        endpoints: { sts: 'https://sts.test', studio: 'https://studio.test' },
+        logger,
+    },
+}));
+
+vi.mock('./firebase', () => ({
+    getFirebaseAuth: () => ({ currentUser: null }),
+    getFirebaseAuthToken: vi.fn(),
+}));
+
+function unsignedJwt(payload: Record<string, unknown>): string {
+    const encode = (value: string) => btoa(value).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    return `${encode(JSON.stringify({ alg: 'none', typ: 'JWT' }))}.${encode(JSON.stringify(payload))}.signature`;
+}
+
+describe('getComposableToken scope cache', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        vi.resetModules();
+        localStorage.clear();
+    });
+
+    it('does not reuse a valid token from another project', async () => {
+        const accountId = 'account-1';
+        const projectA = 'project-a';
+        const projectB = 'project-b';
+        const expiry = Math.floor(Date.now() / 1000) + 3600;
+        const token = (project: string) =>
+            unsignedJwt({ exp: expiry, account: { id: accountId }, project: { id: project } });
+        const response = (project: string) => new Response(JSON.stringify({ token: token(project) }), { status: 200 });
+        const fetchMock = vi
+            .spyOn(globalThis, 'fetch')
+            .mockResolvedValueOnce(response(projectA))
+            .mockResolvedValueOnce(response(projectB));
+
+        const { getComposableToken } = await import('./composable');
+        const first = await getComposableToken(accountId, projectA, 'central-auth-credential', true);
+        const second = await getComposableToken(accountId, projectB, 'central-auth-credential');
+
+        expect(first.token.project?.id).toBe(projectA);
+        expect(second.token.project?.id).toBe(projectB);
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+    });
+
+    it('reuses a valid project token for an account-scoped request in the same account', async () => {
+        const accountId = 'account-1';
+        const projectId = 'project-a';
+        const expiry = Math.floor(Date.now() / 1000) + 3600;
+        const token = unsignedJwt({ exp: expiry, account: { id: accountId }, project: { id: projectId } });
+        const fetchMock = vi
+            .spyOn(globalThis, 'fetch')
+            .mockResolvedValueOnce(new Response(JSON.stringify({ token }), { status: 200 }));
+
+        const { getComposableToken } = await import('./composable');
+        await getComposableToken(accountId, projectId, 'central-auth-credential', true);
+        const accountScoped = await getComposableToken(accountId);
+
+        expect(accountScoped.token.project?.id).toBe(projectId);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+
+    it('reuses a valid token for a global request', async () => {
+        const expiry = Math.floor(Date.now() / 1000) + 3600;
+        const token = unsignedJwt({
+            exp: expiry,
+            account: { id: 'account-1' },
+            project: { id: 'project-a' },
+        });
+        const fetchMock = vi
+            .spyOn(globalThis, 'fetch')
+            .mockResolvedValueOnce(new Response(JSON.stringify({ token }), { status: 200 }));
+
+        const { getComposableToken } = await import('./composable');
+        await getComposableToken('account-1', 'project-a', 'central-auth-credential', true);
+        const global = await getComposableToken();
+
+        expect(global.token.account.id).toBe('account-1');
+        expect(global.token.project?.id).toBe('project-a');
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+});

package/src/session/auth/composable.test.ts

@@ -30,6 +30,7 @@ describe('getComposableToken', () => {
 
     afterEach(() => {
         vi.unstubAllGlobals();
+        vi.clearAllMocks();
     });
 
     it('uses an authorization-bearing STS-issued Vertesia token directly instead of exchanging it', async () => {
@@ -108,4 +109,208 @@ describe('getComposableToken', () => {
         expect(fetchMock).toHaveBeenCalledOnce();
         expect(fetchMock.mock.calls[0]?.[0]?.toString()).toBe('https://sts.dev1.vertesia.io/token/issue');
     });
+
+    it('does not relax a rejected account and project scope', async () => {
+        localStorage.setItem('composableai.lastSelectedAccountId', 'account-a');
+        localStorage.setItem('composableai.lastSelectedProjectId-account-a', 'project-a');
+        const fetchMock = vi.fn().mockResolvedValue(
+            new Response('Project does not belong to account', {
+                status: 403,
+            }),
+        );
+        vi.stubGlobal('fetch', fetchMock);
+
+        const { fetchComposableToken } = await importComposableAuth();
+        const getIdToken = vi.fn(async () => 'identity-token');
+        await expect(fetchComposableToken(getIdToken, 'account-a', 'project-a')).rejects.toMatchObject({
+            name: 'RequestedScopeUnavailableError',
+            accountId: 'account-a',
+            projectId: 'project-a',
+        });
+
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(localStorage.getItem('composableai.lastSelectedAccountId')).toBe('account-a');
+        expect(localStorage.getItem('composableai.lastSelectedProjectId-account-a')).toBe('project-a');
+    });
+
+    it('clears a rejected persisted account/project pair without retrying', async () => {
+        localStorage.setItem('composableai.lastSelectedAccountId', 'account-a');
+        localStorage.setItem('composableai.lastSelectedProjectId-account-a', 'project-a');
+        const fetchMock = vi
+            .fn()
+            .mockResolvedValue(new Response('Project does not belong to account', { status: 403 }));
+        vi.stubGlobal('fetch', fetchMock);
+
+        const { getComposableToken } = await importComposableAuth();
+        await expect(getComposableToken('account-a', 'project-a', 'identity-token', true, true)).rejects.toBeInstanceOf(
+            Error,
+        );
+
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(localStorage.getItem('composableai.lastSelectedAccountId')).toBeNull();
+        expect(localStorage.getItem('composableai.lastSelectedProjectId-account-a')).toBeNull();
+    });
+
+    it('clears a rejected persisted account-only scope without retrying', async () => {
+        localStorage.setItem('composableai.lastSelectedAccountId', 'account-a');
+        const fetchMock = vi.fn().mockResolvedValue(new Response('Account access denied', { status: 403 }));
+        vi.stubGlobal('fetch', fetchMock);
+
+        const { getComposableToken } = await importComposableAuth();
+        await expect(getComposableToken('account-a', undefined, 'identity-token', true, true)).rejects.toBeInstanceOf(
+            Error,
+        );
+
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(localStorage.getItem('composableai.lastSelectedAccountId')).toBeNull();
+    });
+
+    it('does not clear an unrelated persisted selection', async () => {
+        localStorage.setItem('composableai.lastSelectedAccountId', 'account-b');
+        localStorage.setItem('composableai.lastSelectedProjectId-account-b', 'project-b');
+        const fetchMock = vi.fn().mockResolvedValue(new Response('Project access denied', { status: 403 }));
+        vi.stubGlobal('fetch', fetchMock);
+
+        const { getComposableToken } = await importComposableAuth();
+        await expect(getComposableToken('account-a', 'project-a', 'identity-token', true, true)).rejects.toBeInstanceOf(
+            Error,
+        );
+
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(localStorage.getItem('composableai.lastSelectedAccountId')).toBe('account-b');
+        expect(localStorage.getItem('composableai.lastSelectedProjectId-account-b')).toBe('project-b');
+    });
+
+    it('preserves an unrelated persisted project within the rejected URL account', async () => {
+        localStorage.setItem('composableai.lastSelectedAccountId', 'account-a');
+        localStorage.setItem('composableai.lastSelectedProjectId-account-a', 'project-b');
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('Project access denied', { status: 403 })));
+
+        const { getComposableToken } = await importComposableAuth();
+        await expect(getComposableToken('account-a', 'project-a', 'identity-token', true, true)).rejects.toBeInstanceOf(
+            Error,
+        );
+
+        expect(localStorage.getItem('composableai.lastSelectedAccountId')).toBe('account-a');
+        expect(localStorage.getItem('composableai.lastSelectedProjectId-account-a')).toBe('project-b');
+    });
+
+    it('classifies coded scope failures and keeps the deprecated type alias compatible', async () => {
+        vi.stubGlobal(
+            'fetch',
+            vi.fn().mockResolvedValue(
+                Response.json(
+                    {
+                        error: 'Forbidden',
+                        message: 'safe message',
+                        errorCode: 'requested_scope_unavailable',
+                    },
+                    { status: 403 },
+                ),
+            ),
+        );
+
+        const { fetchComposableToken, RequestedScopeUnavailableError, TokenAuthorizationError } =
+            await importComposableAuth();
+        const identityToken = makeJwt({ email: 'leon@example.com', name: 'Leon Ruggiero' });
+        const error = await fetchComposableToken(async () => identityToken, 'account-a', 'project-a').catch(
+            (caught) => caught,
+        );
+
+        expect(error).toBeInstanceOf(RequestedScopeUnavailableError);
+        expect(error).toBeInstanceOf(TokenAuthorizationError);
+        expect(error).toMatchObject({
+            accountId: 'account-a',
+            errorCode: 'requested_scope_unavailable',
+            identity: { email: 'leon@example.com', name: 'Leon Ruggiero' },
+            message: 'safe message',
+            projectId: 'project-a',
+            status: 403,
+        });
+    });
+
+    it('classifies users with no accessible account separately', async () => {
+        vi.stubGlobal(
+            'fetch',
+            vi
+                .fn()
+                .mockResolvedValue(
+                    Response.json(
+                        { error: 'Forbidden', message: 'safe message', errorCode: 'no_accessible_account' },
+                        { status: 403 },
+                    ),
+                ),
+        );
+
+        const { fetchComposableToken, NoAccessibleAccountError, isNoAccessibleAccountError } =
+            await importComposableAuth();
+        const identityToken = makeJwt({ email: 'leon@example.com' });
+        const error = await fetchComposableToken(async () => identityToken).catch((caught) => caught);
+
+        expect(error).toBeInstanceOf(NoAccessibleAccountError);
+        expect(isNoAccessibleAccountError(error)).toBe(true);
+        expect(error).toMatchObject({
+            errorCode: 'no_accessible_account',
+            identity: { email: 'leon@example.com' },
+            message: 'safe message',
+            status: 403,
+        });
+    });
+
+    it.each([
+        { status: 401, errorName: 'CredentialError' },
+        { status: 500, errorName: 'AuthenticationServiceError' },
+    ])(
+        'classifies STS status $status as $errorName without exposing its response body',
+        async ({ status, errorName }) => {
+            vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('sensitive internal detail', { status })));
+
+            const { fetchComposableToken } = await importComposableAuth();
+            const error = await fetchComposableToken(async () => 'identity-token').catch((caught) => caught);
+
+            expect(error).toMatchObject({ name: errorName });
+            expect(error.message).not.toContain('sensitive internal detail');
+        },
+    );
+});
+
+describe('resolveAuthSelection', () => {
+    beforeEach(() => {
+        localStorage.clear();
+        localStorage.setItem('composableai.lastSelectedAccountId', 'stored-account');
+        localStorage.setItem('composableai.lastSelectedProjectId-stored-account', 'stored-project');
+        localStorage.setItem('composableai.lastSelectedProjectId-url-account', 'account-project');
+    });
+
+    it('does not combine a URL project with a stored account', async () => {
+        const { resolveAuthSelection } = await importComposableAuth();
+        expect(resolveAuthSelection(new URL('https://app.example.test/?p=url-project'))).toEqual({
+            accountId: undefined,
+            projectId: 'url-project',
+        });
+    });
+
+    it('uses an account and project supplied together by the URL', async () => {
+        const { resolveAuthSelection } = await importComposableAuth();
+        expect(resolveAuthSelection(new URL('https://app.example.test/?a=url-account&p=url-project'))).toEqual({
+            accountId: 'url-account',
+            projectId: 'url-project',
+        });
+    });
+
+    it('preserves cached project restoration for an account-only URL', async () => {
+        const { resolveAuthSelection } = await importComposableAuth();
+        expect(resolveAuthSelection(new URL('https://app.example.test/?a=url-account'))).toEqual({
+            accountId: 'url-account',
+            projectId: 'account-project',
+        });
+    });
+
+    it('restores the complete persisted selection when the URL has no scope', async () => {
+        const { resolveAuthSelection } = await importComposableAuth();
+        expect(resolveAuthSelection(new URL('https://app.example.test/'))).toEqual({
+            accountId: 'stored-account',
+            projectId: 'stored-project',
+        });
+    });
 });