@virtru/dsp-sdk 0.4.1 → 0.6.0

package/src/lib/utils.test.ts

@@ -1,412 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-
-// Mock all @opentdf imports BEFORE importing utils
-vi.mock('@opentdf/sdk', () => ({
-  AuthProviders: {
-    refreshAuthProvider: vi.fn(),
-  },
-  OpenTDF: vi.fn(),
-  PermissionDeniedError: class PermissionDeniedError extends Error {},
-}));
-
-vi.mock('@opentdf/sdk/platform', () => ({
-  PlatformClient: vi.fn(),
-}));
-
-vi.mock('@opentdf/sdk/platform/policy/objects_pb.js', () => ({
-  Certificate: class Certificate {
-    pem?: string;
-    constructor(data?: any) {
-      if (data) Object.assign(this, data);
-    }
-  },
-}));
-
-vi.mock('@opentdf/sdk/platform/common/common_pb.js', () => ({
-  ActiveStateEnum: {
-    ACTIVE: 1,
-  },
-}));
-
-// Polyfill atob if needed
-if (typeof (globalThis as any).atob === 'undefined') {
-  (globalThis as any).atob = (b64: string) =>
-    Buffer.from(b64, 'base64').toString('binary');
-}
-
-// Mock pkijs/asn1js with a way to control them
-const mockState = {
-  asn1Mode: 'ok' as 'ok' | 'bad-der',
-  verifyResult: { result: true } as { result: boolean; resultMessage?: string },
-};
-
-vi.mock('asn1js', () => ({
-  fromBER: vi.fn((_: ArrayBuffer) => {
-    if (mockState.asn1Mode === 'bad-der') return { offset: -1 };
-    return {
-      offset: 0,
-      result: {
-        subject: { typesAndValues: [] },
-        issuer: { typesAndValues: [] },
-      },
-    };
-  }),
-}));
-
-vi.mock('pkijs', () => {
-  return {
-    Certificate: class Certificate {
-      public subject: any = { typesAndValues: [] };
-      public issuer: any = { typesAndValues: [] };
-      public subjectPublicKeyInfo: any = {};
-      constructor(_: any) {}
-    },
-    CertificateChainValidationEngine: class CertificateChainValidationEngine {
-      constructor(_: any) {}
-      async verify() {
-        return mockState.verifyResult;
-      }
-    },
-  };
-});
-
-// Mock DSPClient
-vi.mock('./client', () => ({
-  DSPClient: vi.fn(),
-}));
-
-// NOW import utils
-import { validateJWSCertificateChain, getTrustedCertificates } from './utils';
-import { DSPClient } from './client';
-import { PlatformClient } from '@opentdf/sdk/platform';
-import { AuthProviders } from '@opentdf/sdk';
-
-describe('validateJWSCertificateChain', () => {
-  beforeEach(() => {
-    mockState.asn1Mode = 'ok';
-    mockState.verifyResult = { result: true };
-  });
-
-  it('throws error when x5c is empty', async () => {
-    await expect(
-      validateJWSCertificateChain([], [{ pem: '---' }] as any)
-    ).rejects.toThrow(/No certificates provided in x5c array/);
-  });
-
-  it('throws error when too many certificates in x5c', async () => {
-    const tooMany = new Array(11).fill('AQI=');
-    await expect(
-      validateJWSCertificateChain(tooMany, [{ pem: '---' }] as any)
-    ).rejects.toThrow(/Too many certificates in x5c/);
-  });
-
-  it('throws error when no trusted roots provided', async () => {
-    await expect(
-      validateJWSCertificateChain(['AQI='], [] as any)
-    ).rejects.toThrow(/No trusted root certificates provided/);
-  });
-
-  it('fails on invalid base64 in x5c', async () => {
-    await expect(
-      validateJWSCertificateChain(['***not-base64***'], [{ pem: '---' }] as any)
-    ).rejects.toThrow(/Failed to parse certificate at x5c\[0]/);
-  });
-
-  it('fails on ASN.1 parse error', async () => {
-    mockState.asn1Mode = 'bad-der';
-    await expect(
-      validateJWSCertificateChain(['AQI='], [{ pem: '---' }] as any)
-    ).rejects.toThrow(/Invalid DER encoding/);
-  });
-
-  it('returns valid true on successful verification', async () => {
-    const pem = '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----';
-    mockState.verifyResult = { result: true };
-    const res = await validateJWSCertificateChain(['AQI='], [{ pem }] as any);
-    expect(res.valid).toBe(true);
-    expect(res.validationResult.warnings).toEqual([]);
-  });
-
-  it('returns warnings when some trusted roots fail to parse', async () => {
-    const pem = '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----';
-    const res = await validateJWSCertificateChain(['AQI='], [
-      { pem: '' },
-      { pem },
-    ] as any);
-    expect(res.valid).toBe(true);
-    expect(res.validationResult.warnings).toHaveLength(1);
-    expect(res.validationResult.warnings[0]).toMatch(/has no PEM data/);
-  });
-});
-
-describe('getTrustedCertificates', () => {
-  const mockOptions = {
-    oidc: {
-      clientId: 'test-client-id',
-      tokenEndpoint: 'https://auth.test.com/token',
-      userInfoEndpoint: 'https://auth.test.com/userinfo',
-    },
-    platformEndpoint: 'https://platform.test.com',
-    refreshToken: 'test-refresh-token',
-  };
-
-  let mockAuthProvider: any;
-  let mockPlatformClient: any;
-  let mockDSPClient: any;
-  let mockCertificateService: any;
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-
-    // Mock crypto.subtle.generateKey for DPoP signing keys
-    if (!globalThis.crypto) {
-      (globalThis as any).crypto = {};
-    }
-    if (!globalThis.crypto.subtle) {
-      (globalThis.crypto as any).subtle = {};
-    }
-    (globalThis.crypto.subtle as any).generateKey = vi.fn().mockResolvedValue({
-      publicKey: {},
-      privateKey: {},
-    });
-
-    // Mock auth provider
-    mockAuthProvider = {
-      updateClientPublicKey: vi.fn().mockResolvedValue(undefined),
-    };
-
-    (AuthProviders.refreshAuthProvider as any).mockResolvedValue(
-      mockAuthProvider
-    );
-
-    // Mock certificate service
-    mockCertificateService = {
-      listCertificatesByNamespace: vi.fn(),
-    };
-
-    // Mock DSP client
-    mockDSPClient = {
-      v1: {
-        certificateService: mockCertificateService,
-      },
-    };
-
-    (DSPClient as any).mockImplementation(() => mockDSPClient);
-
-    // Mock platform client
-    mockPlatformClient = {
-      v1: {
-        namespace: {
-          listNamespaces: vi.fn(),
-        },
-      },
-    };
-
-    (PlatformClient as any).mockImplementation(() => mockPlatformClient);
-  });
-
-  it('successfully retrieves certificates from a single namespace', async () => {
-    const mockCertificate1 = { pem: 'cert1-pem-data' };
-    const mockCertificate2 = { pem: 'cert2-pem-data' };
-
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
-      certificates: [mockCertificate1, mockCertificate2],
-      pagination: { nextOffset: 0 },
-    });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    expect(result).toHaveLength(2);
-    expect(result).toEqual([mockCertificate1, mockCertificate2]);
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenCalledWith({
-      namespaceId: 'namespace-1',
-      pagination: { limit: 100, offset: 0 },
-    });
-  });
-
-  it('successfully retrieves certificates from multiple namespaces', async () => {
-    const mockCert1 = { pem: 'cert1-pem' };
-    const mockCert2 = { pem: 'cert2-pem' };
-    const mockCert3 = { pem: 'cert3-pem' };
-
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }, { id: 'namespace-2' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace
-      .mockResolvedValueOnce({
-        certificates: [mockCert1, mockCert2],
-        pagination: { nextOffset: 0 },
-      })
-      .mockResolvedValueOnce({
-        certificates: [mockCert3],
-        pagination: { nextOffset: 0 },
-      });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    expect(result).toHaveLength(3);
-    expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenCalledTimes(2);
-  });
-
-  it('handles pagination correctly (multiple pages)', async () => {
-    const mockCert1 = { pem: 'cert1' };
-    const mockCert2 = { pem: 'cert2' };
-    const mockCert3 = { pem: 'cert3' };
-
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    // First page
-    mockCertificateService.listCertificatesByNamespace
-      .mockResolvedValueOnce({
-        certificates: [mockCert1, mockCert2],
-        pagination: { nextOffset: 100 },
-      })
-      // Second page
-      .mockResolvedValueOnce({
-        certificates: [mockCert3],
-        pagination: { nextOffset: 0 },
-      });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    expect(result).toHaveLength(3);
-    expect(result).toEqual([mockCert1, mockCert2, mockCert3]);
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenCalledTimes(2);
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenNthCalledWith(1, {
-      namespaceId: 'namespace-1',
-      pagination: { limit: 100, offset: 0 },
-    });
-    expect(
-      mockCertificateService.listCertificatesByNamespace
-    ).toHaveBeenNthCalledWith(2, {
-      namespaceId: 'namespace-1',
-      pagination: { limit: 100, offset: 100 },
-    });
-  });
-
-  it('handles empty certificate list', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
-      certificates: [],
-      pagination: { nextOffset: 0 },
-    });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    expect(result).toHaveLength(0);
-    expect(result).toEqual([]);
-  });
-
-  it('handles errors from certificate service', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace.mockRejectedValue(
-      new Error('Certificate service error')
-    );
-
-    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow(
-      'Certificate service error'
-    );
-  });
-
-  it('handles errors from namespace listing', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockRejectedValue(
-      new Error('Namespace listing error')
-    );
-
-    await expect(getTrustedCertificates(mockOptions)).rejects.toThrow(
-      'Namespace listing error'
-    );
-  });
-
-  it('initializes auth provider correctly', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [],
-    });
-
-    await getTrustedCertificates(mockOptions);
-
-    expect(AuthProviders.refreshAuthProvider).toHaveBeenCalled();
-    expect(mockAuthProvider.updateClientPublicKey).toHaveBeenCalled();
-    expect(globalThis.crypto.subtle.generateKey).toHaveBeenCalledWith(
-      {
-        name: 'ECDSA',
-        namedCurve: 'P-256',
-      },
-      true,
-      ['sign', 'verify']
-    );
-  });
-
-  it('creates both PlatformClient and DSPClient with correct config', async () => {
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [],
-    });
-
-    await getTrustedCertificates(mockOptions);
-
-    expect(PlatformClient).toHaveBeenCalledWith({
-      authProvider: mockAuthProvider,
-      platformUrl: mockOptions.platformEndpoint,
-    });
-
-    expect(DSPClient).toHaveBeenCalledWith({
-      platformUrl: mockOptions.platformEndpoint,
-      authProvider: mockAuthProvider,
-    });
-  });
-
-  it('returns same Certificate type compatible with validateJWSCertificateChain', async () => {
-    const mockCert = {
-      pem: '-----BEGIN CERTIFICATE-----\nAQI=\n-----END CERTIFICATE-----',
-    };
-
-    mockPlatformClient.v1.namespace.listNamespaces.mockResolvedValue({
-      namespaces: [{ id: 'namespace-1' }],
-    });
-
-    mockCertificateService.listCertificatesByNamespace.mockResolvedValue({
-      certificates: [mockCert],
-      pagination: { nextOffset: 0 },
-    });
-
-    const result = await getTrustedCertificates(mockOptions);
-
-    // Verify the result can be used with validateJWSCertificateChain
-    expect(result[0].pem).toBeDefined();
-
-    // Integration test: verify compatibility with validateJWSCertificateChain
-    const validationResult = await validateJWSCertificateChain(
-      ['AQI='],
-      result
-    );
-    expect(validationResult.valid).toBe(true);
-  });
-});