@virtru/dsp-sdk 0.2.3 → 0.3.0

package/src/lib/utils.test.ts

@@ -0,0 +1,376 @@
+/*
+ * Copyright (c) Virtru Corporation.  All rights reserved.
+ *
+ * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
+// Mock all @opentdf imports BEFORE importing utils
+vi.mock('@opentdf/sdk', () => ({
+  AuthProviders: {
+    refreshAuthProvider: vi.fn()
+  },
+  OpenTDF: vi.fn(),
+  PermissionDeniedError: class PermissionDeniedError extends Error {}
+}));
+
+vi.mock('@opentdf/sdk/platform', () => ({
+  PlatformClient: vi.fn()
+}));
+
+vi.mock('@opentdf/sdk/platform/policy/objects_pb.js', () => ({
+  Certificate: class Certificate {
+    pem?: string;
+    constructor(data?: any) {
+      if (data) Object.assign(this, data);
+    }
+  }
+}));
+
+vi.mock('@opentdf/sdk/platform/common/common_pb.js', () => ({
+  ActiveStateEnum: {
+    ACTIVE: 1
+  }
+}));
+
+// Polyfill atob if needed
+if (typeof (globalThis as any).atob === 'undefined') {
+  (globalThis as any).atob = (b64: string) => Buffer.from(b64, 'base64').toString('binary');
+}
+
+// Mock pkijs/asn1js with a way to control them
+const mockState = {
+  asn1Mode: 'ok' as 'ok' | 'bad-der',
+  verifyResult: { result: true } as { result: boolean; resultMessage?: string },
+};
+
+vi.mock('asn1js', () => ({
+  fromBER: vi.fn((_: ArrayBuffer) => {
+    if (mockState.asn1Mode === 'bad-der') return { offset: -1 };
+    return { offset: 0, result: { subject: { typesAndValues: [] }, issuer: { typesAndValues: [] } } };
+  }),
+}));
+
+vi.mock('pkijs', () => {
+  return {
+    Certificate: class Certificate {
+      public subject: any = { typesAndValues: [] };
+      public issuer: any = { typesAndValues: [] };
+      public subjectPublicKeyInfo: any = {};
+      constructor(_: any) {}
+    },
+    CertificateChainValidationEngine: class CertificateChainValidationEngine {
+      constructor(_: any) {}
+      async verify() {
+        return mockState.verifyResult;
+      }
+    }
+  };
+});
+
+// Mock DSPClient
+vi.mock('./client', () => ({
+  DSPClient: vi.fn()
+}));
+
+// NOW import utils
+import { validateJWSCertificateChain, getTrustedCertificates } from './utils';
+import { DSPClient } from './client';
+import { PlatformClient } from '@opentdf/sdk/platform';
+import { AuthProviders } from '@opentdf/sdk';
+
+describe('validateJWSCertificateChain', () => {
+  beforeEach(() => {
+    mockState.asn1Mode = 'ok';
+    mockState.verifyResult = { result: true };
+  });
+
+  it('throws error when x5c is empty', async () => {
+    await expect(validateJWSCertificateChain([], [{ pem: '---' }] as any))
+      .rejects.toThrow(/No certificates provided in x5c array/);
+  });
+
+  it('throws error when too many certificates in x5c', async () => {
+    const tooMany = new Array(11).fill('AQI=');
+    await expect(validateJWSCertificateChain(tooMany, [{ pem: '---' }] as any))
+      .rejects.toThrow(/Too many certificates in x5c/);
+  });
+
+  it('throws error when no trusted roots provided', async () => {
+    await expect(validateJWSCertificateChain(['AQI='], [] as any))
+      .rejects.toThrow(/No trusted root certificates provided/);
+  });
+
+  it('fails on invalid base64 in x5c', async () => {
+    await expect(validateJWSCertificateChain(['***not-base64***'], [{ pem: '---' }] as any))
+      .rejects.toThrow(/Failed to parse certificate at x5c\[0]/);
+  });
+
+  it('fails on ASN.1 parse error', async () => {
+    mockState.asn1Mode = 'bad-der';
+    await expect(validateJWSCertificateChain(['AQI='], [{ pem: '---' }] as any))
+      .rejects.toThrow(/Invalid DER encoding/);
+  });
+
+  it('returns valid true on successful verification', async () => {
+    const pem = '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----';
+    mockState.verifyResult = { result: true };
+    const res = await validateJWSCertificateChain(['AQI='], [{ pem }] as any);
+    expect(res.valid).toBe(true);
+    expect(res.validationResult.warnings).toEqual([]);
+  });
+
+  it('returns warnings when some trusted roots fail to parse', async () => {
+    const pem = '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----';
+    const res = await validateJWSCertificateChain(['AQI='], [{ pem: '' }, { pem }] as any);
+    expect(res.valid).toBe(true);
+    expect(res.validationResult.warnings).toHaveLength(1);
+    expect(res.validationResult.warnings[0]).toMatch(/has no PEM data/);
+  });
+});
+
+describe('getTrustedCertificates', () => {
+  const mockOptions = {
+    oidc: {
+      clientId: 'test-client-id',
+      tokenEndpoint: 'https://auth.test.com/token',
+      userInfoEndpoint: 'https://auth.test.com/userinfo',
+    },
+    platformEndpoint: 'https://platform.test.com',
+    refreshToken: 'test-refresh-token',
+  };
+
+  let mockAuthProvider: any;
+  let mockPlatformClient: any;
+  let mockDSPClient: any;
+  let mockCertificateService: any;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    // Mock crypto.subtle.generateKey for DPoP signing keys
+    if (!globalThis.crypto) {
+      (globalThis as any).crypto = {};
+    }
+    if (!globalThis.crypto.subtle) {
+      (globalThis.crypto as any).subtle = {};
+    }
+    (globalThis.crypto.subtle as any).generateKey = vi.fn().mockResolvedValue({
+      publicKey: {},
+      privateKey: {},
+    });
+
+    // Mock auth provider
+    mockAuthProvider = {
+      updateClientPublicKey: vi.fn().mockResolvedValue(undefined),
+    };
+
+    (AuthProviders.refreshAuthProvider as any).mockResolvedValue(mockAuthProvider);
+
+    // Mock certificate service
+    mockCertificateService = {
+      listCertificatesByNamespace: vi.fn(),
+    };
+
+    // Mock DSP client
+    mockDSPClient = {
+      v1: {
+        certificateService: mockCertificateService,
+      },
+    };
+
+    (DSPClient as any).mockImplementation(() => mockDSPClient);
+
+    // Mock platform client
+    mockPlatformClient = {
+      v1: {
+        namespace: {
+          listNamespaces: vi.fn(),
+        },
+      },
+    };
+
+    (PlatformClient as any).mockImplementation(() => mockPlatformClient);
+  });
+
+  it('successfully retrieves certificates from a single namespace', async () => {
+    const mockCertificate1 = { pem: 'cert1-pem-data' };
+    const mockCertificate2 = { pem: 'cert2-pem-data' };
+
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
+      certificates: [mockCertificate1, mockCertificate2],
+      pagination: { nextOffset: 0 },
+    });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    expect(result).toHaveLength(2);
+    expect(result).toEqual([mockCertificate1, mockCertificate2]);
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenCalledWith({
+      namespaceId: 'namespace-1',
+      pagination: { limit: (100), offset: (0) },
+    });
+  });
+
+  it('successfully retrieves certificates from multiple namespaces', async () => {
+    const mockCert1 = { pem: 'cert1-pem' };
+    const mockCert2 = { pem: 'cert2-pem' };
+    const mockCert3 = { pem: 'cert3-pem' };
+
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }, { id: 'namespace-2' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace
+      .mockResolvedValueOnce({
+        certificates: [mockCert1, mockCert2],
+        pagination: { nextOffset: (0) },
+      })
+      .mockResolvedValueOnce({
+        certificates: [mockCert3],
+        pagination: { nextOffset: (0) },
+      });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    expect(result).toHaveLength(3);
+    expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenCalledTimes(2);
+  });
+
+  it('handles pagination correctly (multiple pages)', async () => {
+    const mockCert1 = { pem: 'cert1' };
+    const mockCert2 = { pem: 'cert2' };
+    const mockCert3 = { pem: 'cert3' };
+
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    // First page
+    mockCertificateService.listCertificatesByNamespace
+      .mockResolvedValueOnce({
+        certificates: [mockCert1, mockCert2],
+        pagination: { nextOffset: (100) },
+      })
+      // Second page
+      .mockResolvedValueOnce({
+        certificates: [mockCert3],
+        pagination: { nextOffset: (0) },
+      });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    expect(result).toHaveLength(3);
+    expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenCalledTimes(2);
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenNthCalledWith(1, {
+      namespaceId: 'namespace-1',
+      pagination: { limit: (100), offset: (0) },
+    });
+    expect(mockCertificateService.listCertificatesByNamespace).toHaveBeenNthCalledWith(2, {
+      namespaceId: 'namespace-1',
+      pagination: { limit: (100), offset: (100) },
+    });
+  });
+
+  it('handles empty certificate list', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
+      certificates: [],
+      pagination: { nextOffset: (0) },
+    });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    expect(result).toHaveLength(0);
+    expect(result).toEqual([]);
+  });
+
+  it('handles errors from certificate service', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace.mockRejectedValue(
+      new Error('Certificate service error')
+    );
+
+    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow('Certificate service error');
+  });
+
+  it('handles errors from namespace listing', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockRejectedValue(
+      new Error('Namespace listing error')
+    );
+
+    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow('Namespace listing error');
+  });
+
+  it('initializes auth provider correctly', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [],
+    });
+
+    await getTrustedCertificates(mockOptions);
+
+    expect(AuthProviders.refreshAuthProvider).toHaveBeenCalled();
+    expect(mockAuthProvider.updateClientPublicKey).toHaveBeenCalled();
+    expect(globalThis.crypto.subtle.generateKey).toHaveBeenCalledWith(
+      {
+        name: 'ECDSA',
+        namedCurve: 'P-256',
+      },
+      true,
+      ['sign', 'verify']
+    );
+  });
+
+  it('creates both PlatformClient and DSPClient with correct config', async () => {
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [],
+    });
+
+    await getTrustedCertificates(mockOptions);
+
+    expect(PlatformClient).toHaveBeenCalledWith({
+      authProvider: mockAuthProvider,
+      platformUrl: mockOptions.platformEndpoint,
+    });
+
+    expect(DSPClient).toHaveBeenCalledWith({
+      platformUrl: mockOptions.platformEndpoint,
+      authProvider: mockAuthProvider,
+    });
+  });
+
+  it('returns same Certificate type compatible with validateJWSCertificateChain', async () => {
+    const mockCert = { pem: '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----' };
+
+    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
+      namespaces: [{ id: 'namespace-1' }],
+    });
+
+    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
+      certificates: [mockCert],
+      pagination: { nextOffset: (0) },
+    });
+
+    const result = await getTrustedCertificates(mockOptions);
+
+    // Verify the result can be used with validateJWSCertificateChain
+    expect(result[0].pem).toBeDefined();
+
+    // Integration test: verify compatibility with validateJWSCertificateChain
+    const validationResult = await validateJWSCertificateChain(['AQI='], result);
+    expect(validationResult.valid).toBe(true);
+  });
+});