@xenterprises/fastify-xauth-jwks 1.0.0

package/test/xAuth.test.js

@@ -0,0 +1,439 @@
+// test/xAuth.test.js
+import { test } from "node:test";
+import assert from "node:assert";
+import Fastify from "fastify";
+import xAuth from "../src/xAuth.js";
+
+test("xAuth plugin registration with single path", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        admin: {
+          pathPattern: "/admin",
+          jwksUrl: "https://example.com/.well-known/jwks.json",
+        },
+      },
+    });
+    assert.ok(fastify.xAuth);
+    assert.ok(fastify.xAuth.validators);
+    assert.ok(fastify.xAuth.validators.admin);
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Multiple path validators registration", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        admin: {
+          pathPattern: "/admin",
+          jwksUrl: "https://example.com/admin/.well-known/jwks.json",
+        },
+        portal: {
+          pathPattern: "/portal",
+          jwksUrl: "https://example.com/portal/.well-known/jwks.json",
+        },
+      },
+    });
+    assert.equal(Object.keys(fastify.xAuth.validators).length, 2);
+    assert.ok(fastify.xAuth.validators.admin);
+    assert.ok(fastify.xAuth.validators.portal);
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Validator has required properties", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    const jwksUrl = "https://example.com/.well-known/jwks.json";
+    await fastify.register(xAuth, {
+      paths: {
+        api: {
+          pathPattern: "/api",
+          jwksUrl,
+        },
+      },
+    });
+    const validator = fastify.xAuth.validators.api;
+    assert.ok(typeof validator.verifyJWT === "function");
+    assert.equal(validator.name, "api");
+    assert.equal(validator.pathPattern, "/api");
+    assert.equal(validator.jwksUrl, jwksUrl);
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Inactive path should not be registered", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        active: {
+          pathPattern: "/active",
+          jwksUrl: "https://example.com/active/.well-known/jwks.json",
+        },
+        inactive: {
+          active: false,
+          pathPattern: "/inactive",
+          jwksUrl: "https://example.com/inactive/.well-known/jwks.json",
+        },
+      },
+    });
+    assert.ok(fastify.xAuth.validators.active);
+    assert.equal(fastify.xAuth.validators.inactive, undefined);
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Custom pathPattern configuration", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        api: {
+          pathPattern: "/api/v1/admin",
+          jwksUrl: "https://example.com/.well-known/jwks.json",
+        },
+      },
+    });
+    const validator = fastify.xAuth.validators.api;
+    assert.equal(validator.pathPattern, "/api/v1/admin");
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Different paths have different JWKS URLs", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        admin: {
+          pathPattern: "/admin",
+          jwksUrl: "https://example.com/admin/.well-known/jwks.json",
+        },
+        portal: {
+          pathPattern: "/portal",
+          jwksUrl: "https://example.com/portal/.well-known/jwks.json",
+        },
+      },
+    });
+    const adminJwks = fastify.xAuth.validators.admin.jwksUrl;
+    const portalJwks = fastify.xAuth.validators.portal.jwksUrl;
+    assert.notEqual(adminJwks, portalJwks);
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Error when no paths configured", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await assert.rejects(
+      async () => {
+        await fastify.register(xAuth, { paths: {} });
+      },
+      {
+        message: "At least one protected path configuration is required",
+      }
+    );
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Error when missing both jwksUrl and jwksData", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await assert.rejects(
+      async () => {
+        await fastify.register(xAuth, {
+          paths: {
+            api: {
+              pathPattern: "/api",
+            },
+          },
+        });
+      },
+      {
+        message: /Either jwksUrl or jwksData is required/,
+      }
+    );
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Local JWKS data configuration - full JWKS object", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    const localJwks = {
+      keys: [
+        {
+          kty: "RSA",
+          use: "sig",
+          kid: "test-key",
+          n: "test-n-value",
+          e: "AQAB",
+        },
+      ],
+    };
+    await fastify.register(xAuth, {
+      paths: {
+        api: {
+          pathPattern: "/api",
+          jwksData: localJwks,
+        },
+      },
+    });
+    const validator = fastify.xAuth.validators.api;
+    assert.ok(validator);
+    assert.ok(typeof validator.verifyJWT === "function");
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Local JWK data configuration - single key (for signing and validation)", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    const singleJwk = {
+      kty: "RSA",
+      use: "sig",
+      kid: "single-key",
+      n: "test-n-value",
+      e: "AQAB",
+    };
+    await fastify.register(xAuth, {
+      paths: {
+        api: {
+          pathPattern: "/api",
+          jwksData: singleJwk,  // Single key, not wrapped in keys array
+        },
+      },
+    });
+    const validator = fastify.xAuth.validators.api;
+    assert.ok(validator);
+    assert.ok(typeof validator.verifyJWT === "function");
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Error when both jwksUrl and jwksData specified", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await assert.rejects(
+      async () => {
+        await fastify.register(xAuth, {
+          paths: {
+            api: {
+              pathPattern: "/api",
+              jwksUrl: "https://example.com/.well-known/jwks.json",
+              jwksData: { keys: [] },
+            },
+          },
+        });
+      },
+      {
+        message: /Cannot specify both jwksUrl and jwksData/,
+      }
+    );
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Excluded paths are not protected", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        admin: {
+          pathPattern: "/admin",
+          jwksUrl: "https://example.com/.well-known/jwks.json",
+          excludedPaths: ["/health", "/status"],
+        },
+      },
+    });
+    fastify.get("/admin/health", (request, reply) => {
+      reply.send({ status: "ok" });
+    });
+    fastify.get("/admin/status", (request, reply) => {
+      reply.send({ status: "ok" });
+    });
+    fastify.get("/admin/protected", (request, reply) => {
+      reply.send({ user: request.user || "no user" });
+    });
+    const healthResponse = await fastify.inject({
+      method: "GET",
+      url: "/admin/health",
+    });
+    assert.equal(healthResponse.statusCode, 200);
+    const protectedResponse = await fastify.inject({
+      method: "GET",
+      url: "/admin/protected",
+    });
+    assert.equal(protectedResponse.statusCode, 401);
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Request without token is rejected", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        api: {
+          pathPattern: "/api",
+          jwksUrl: "https://example.com/.well-known/jwks.json",
+        },
+      },
+    });
+    fastify.get("/api/data", (request, reply) => {
+      reply.send({ data: "secret" });
+    });
+    const response = await fastify.inject({
+      method: "GET",
+      url: "/api/data",
+    });
+    assert.equal(response.statusCode, 401);
+    const body = JSON.parse(response.body);
+    assert.equal(body.error, "Access token required");
+    assert.equal(body.path, "api");
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Request with invalid token format is rejected", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        api: {
+          pathPattern: "/api",
+          jwksUrl: "https://example.com/.well-known/jwks.json",
+        },
+      },
+    });
+    fastify.get("/api/data", (request, reply) => {
+      reply.send({ data: "secret" });
+    });
+    const response = await fastify.inject({
+      method: "GET",
+      url: "/api/data",
+      headers: {
+        authorization: "InvalidToken",
+      },
+    });
+    assert.equal(response.statusCode, 401);
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Unprotected paths allow access without token", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        admin: {
+          pathPattern: "/admin",
+          jwksUrl: "https://example.com/.well-known/jwks.json",
+        },
+      },
+    });
+    fastify.get("/public/data", (request, reply) => {
+      reply.send({ data: "public" });
+    });
+    const response = await fastify.inject({
+      method: "GET",
+      url: "/public/data",
+    });
+    assert.equal(response.statusCode, 200);
+    const body = JSON.parse(response.body);
+    assert.equal(body.data, "public");
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Payload cache is enabled by default", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        api: {
+          pathPattern: "/api",
+          jwksUrl: "https://example.com/.well-known/jwks.json",
+        },
+      },
+    });
+    const validator = fastify.xAuth.validators.api;
+    const stats = validator.getPayloadCacheStats();
+    assert.equal(stats.enabled, true);
+    assert.equal(stats.ttl, 300000); // 5 minutes default
+    assert.equal(stats.size, 0);
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Cache configuration is customizable", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        api: {
+          pathPattern: "/api",
+          jwksUrl: "https://example.com/.well-known/jwks.json",
+          enablePayloadCache: false,
+          payloadCacheTTL: 600000, // 10 minutes
+          jwksCooldownDuration: 60000,
+          jwksCacheMaxAge: 3600000,
+        },
+      },
+    });
+    const validator = fastify.xAuth.validators.api;
+    const stats = validator.getPayloadCacheStats();
+    assert.equal(stats.enabled, false);
+    assert.equal(stats.ttl, 600000);
+    assert.deepEqual(validator.config, {
+      jwksCooldownDuration: 60000,
+      jwksCacheMaxAge: 3600000,
+      enablePayloadCache: false,
+      payloadCacheTTL: 600000,
+    });
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});
+
+test("Cache can be manually cleared", async () => {
+  const fastify = Fastify({ logger: false });
+  try {
+    await fastify.register(xAuth, {
+      paths: {
+        api: {
+          pathPattern: "/api",
+          jwksUrl: "https://example.com/.well-known/jwks.json",
+        },
+      },
+    });
+    const validator = fastify.xAuth.validators.api;
+    assert.ok(typeof validator.clearPayloadCache === "function");
+    validator.clearPayloadCache();
+    const stats = validator.getPayloadCacheStats();
+    assert.equal(stats.size, 0);
+  } finally {
+    try { await fastify.close(); } catch {}
+  }
+});