@xenterprises/fastify-xauth-local 1.0.0

package/test/xAuthLocal.test.js

@@ -0,0 +1,744 @@
+/**
+ * xAuthLocal Tests
+ *
+ * Tests for the JWT authentication plugin with multi-config support.
+ */
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert";
+import Fastify from "fastify";
+import xAuthLocal, {
+  createJwtService,
+  createAuthMiddleware,
+  createRoleMiddleware,
+  isExcludedRoute,
+  hashPassword,
+  comparePassword,
+} from "../src/xAuthLocal.js";
+
+// Test secrets for HS256
+const API_SECRET = "api-secret-key-that-is-long-enough-for-hs256";
+const ADMIN_SECRET = "admin-secret-key-that-is-long-enough-for-hs256";
+
+describe("xAuthLocal Plugin", () => {
+  let fastify;
+
+  beforeEach(() => {
+    fastify = Fastify();
+  });
+
+  afterEach(async () => {
+    await fastify.close();
+  });
+
+  describe("Configuration Validation", () => {
+    test("should throw if configs array is empty", async () => {
+      await assert.rejects(
+        async () => {
+          await fastify.register(xAuthLocal, { configs: [] });
+          await fastify.ready();
+        },
+        { message: /configs array is required/i }
+      );
+    });
+
+    test("should throw if configs is not provided", async () => {
+      await assert.rejects(
+        async () => {
+          await fastify.register(xAuthLocal, {});
+          await fastify.ready();
+        },
+        { message: /configs array is required/i }
+      );
+    });
+
+    test("should throw if config missing name", async () => {
+      await assert.rejects(
+        async () => {
+          await fastify.register(xAuthLocal, {
+            configs: [{ prefix: "/api", secret: API_SECRET }],
+          });
+          await fastify.ready();
+        },
+        { message: /must have a 'name'/i }
+      );
+    });
+
+    test("should throw if config missing prefix", async () => {
+      await assert.rejects(
+        async () => {
+          await fastify.register(xAuthLocal, {
+            configs: [{ name: "api", secret: API_SECRET }],
+          });
+          await fastify.ready();
+        },
+        { message: /must have a 'prefix'/i }
+      );
+    });
+
+    test("should throw if config missing secret/keys", async () => {
+      await assert.rejects(
+        async () => {
+          await fastify.register(xAuthLocal, {
+            configs: [{ name: "api", prefix: "/api" }],
+          });
+          await fastify.ready();
+        },
+        { message: /requires secret or publicKey/i }
+      );
+    });
+
+    test("should accept valid config", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [{ name: "api", prefix: "/api", secret: API_SECRET }],
+      });
+      await fastify.ready();
+
+      assert.ok(fastify.xauthlocal);
+      assert.ok(fastify.xauthlocal.configs.api);
+    });
+
+    test("should skip registration when active is false", async () => {
+      await fastify.register(xAuthLocal, {
+        active: false,
+        configs: [{ name: "api", prefix: "/api", secret: API_SECRET }],
+      });
+      await fastify.ready();
+
+      assert.strictEqual(fastify.xauthlocal, undefined);
+    });
+  });
+
+  describe("Multiple Configs", () => {
+    test("should register multiple configs", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [
+          { name: "api", prefix: "/api", secret: API_SECRET },
+          { name: "admin", prefix: "/admin", secret: ADMIN_SECRET },
+        ],
+      });
+      await fastify.ready();
+
+      assert.ok(fastify.xauthlocal.configs.api);
+      assert.ok(fastify.xauthlocal.configs.admin);
+      assert.strictEqual(fastify.xauthlocal.config.configCount, 2);
+      assert.deepStrictEqual(fastify.xauthlocal.config.configNames, ["api", "admin"]);
+    });
+
+    test("should use different secrets for each config", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [
+          { name: "api", prefix: "/api", secret: API_SECRET },
+          { name: "admin", prefix: "/admin", secret: ADMIN_SECRET },
+        ],
+      });
+      await fastify.ready();
+
+      const apiToken = fastify.xauthlocal.configs.api.jwt.sign({ id: 1 });
+      const adminToken = fastify.xauthlocal.configs.admin.jwt.sign({ id: 2 });
+
+      // Each config should verify its own tokens
+      const apiDecoded = fastify.xauthlocal.configs.api.jwt.verify(apiToken);
+      assert.strictEqual(apiDecoded.id, 1);
+
+      const adminDecoded = fastify.xauthlocal.configs.admin.jwt.verify(adminToken);
+      assert.strictEqual(adminDecoded.id, 2);
+
+      // Cross-verification should fail
+      assert.throws(() => {
+        fastify.xauthlocal.configs.api.jwt.verify(adminToken);
+      });
+    });
+
+    test("should get config by name", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [{ name: "api", prefix: "/api", secret: API_SECRET }],
+      });
+      await fastify.ready();
+
+      const apiConfig = fastify.xauthlocal.get("api");
+      assert.ok(apiConfig);
+      assert.strictEqual(apiConfig.name, "api");
+      assert.strictEqual(apiConfig.prefix, "/api");
+    });
+  });
+
+  describe("Route Protection", () => {
+    test("should protect routes matching config prefix", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [{ name: "api", prefix: "/api", secret: API_SECRET }],
+      });
+
+      fastify.get("/api/users", async (request) => ({ auth: request.auth }));
+      fastify.get("/public/info", async () => ({ info: "public" }));
+
+      await fastify.ready();
+
+      // API route should require auth
+      const apiResponse = await fastify.inject({
+        method: "GET",
+        url: "/api/users",
+      });
+      assert.strictEqual(apiResponse.statusCode, 401);
+
+      // Public route should not require auth
+      const publicResponse = await fastify.inject({
+        method: "GET",
+        url: "/public/info",
+      });
+      assert.strictEqual(publicResponse.statusCode, 200);
+    });
+
+    test("should accept valid token for protected route", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [{ name: "api", prefix: "/api", secret: API_SECRET }],
+      });
+
+      fastify.get("/api/users", async (request) => ({ auth: request.auth }));
+
+      await fastify.ready();
+
+      const token = fastify.xauthlocal.configs.api.jwt.sign({ id: 1, email: "test@example.com" });
+
+      const response = await fastify.inject({
+        method: "GET",
+        url: "/api/users",
+        headers: {
+          authorization: `Bearer ${token}`,
+        },
+      });
+
+      assert.strictEqual(response.statusCode, 200);
+      const body = JSON.parse(response.body);
+      assert.strictEqual(body.auth.id, 1);
+    });
+
+    test("should reject wrong token for protected route", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [
+          { name: "api", prefix: "/api", secret: API_SECRET },
+          { name: "admin", prefix: "/admin", secret: ADMIN_SECRET },
+        ],
+      });
+
+      fastify.get("/api/users", async (request) => ({ auth: request.auth }));
+
+      await fastify.ready();
+
+      // Use admin token for API route
+      const adminToken = fastify.xauthlocal.configs.admin.jwt.sign({ id: 1 });
+
+      const response = await fastify.inject({
+        method: "GET",
+        url: "/api/users",
+        headers: {
+          authorization: `Bearer ${adminToken}`,
+        },
+      });
+
+      assert.strictEqual(response.statusCode, 401);
+    });
+  });
+
+  describe("Role Middleware", () => {
+    test("should allow access with matching role", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [{ name: "api", prefix: "/api", secret: API_SECRET }],
+      });
+
+      fastify.get(
+        "/api/admin",
+        { preHandler: [fastify.xauthlocal.configs.api.requireRole("admin")] },
+        async () => ({ admin: true })
+      );
+
+      await fastify.ready();
+
+      const token = fastify.xauthlocal.configs.api.jwt.sign({ id: 1, scope: ["admin"] });
+
+      const response = await fastify.inject({
+        method: "GET",
+        url: "/api/admin",
+        headers: {
+          authorization: `Bearer ${token}`,
+        },
+      });
+
+      assert.strictEqual(response.statusCode, 200);
+    });
+
+    test("should deny access without matching role", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [{ name: "api", prefix: "/api", secret: API_SECRET }],
+      });
+
+      fastify.get(
+        "/api/admin",
+        { preHandler: [fastify.xauthlocal.configs.api.requireRole("admin")] },
+        async () => ({ admin: true })
+      );
+
+      await fastify.ready();
+
+      const token = fastify.xauthlocal.configs.api.jwt.sign({ id: 1, scope: ["user"] });
+
+      const response = await fastify.inject({
+        method: "GET",
+        url: "/api/admin",
+        headers: {
+          authorization: `Bearer ${token}`,
+        },
+      });
+
+      assert.strictEqual(response.statusCode, 403);
+    });
+  });
+
+  describe("Custom Request Property", () => {
+    test("should use custom requestProperty", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [
+          { name: "api", prefix: "/api", secret: API_SECRET, requestProperty: "user" },
+        ],
+      });
+
+      fastify.get("/api/users", async (request) => ({ user: request.user }));
+
+      await fastify.ready();
+
+      const token = fastify.xauthlocal.configs.api.jwt.sign({ id: 1 });
+
+      const response = await fastify.inject({
+        method: "GET",
+        url: "/api/users",
+        headers: {
+          authorization: `Bearer ${token}`,
+        },
+      });
+
+      assert.strictEqual(response.statusCode, 200);
+      const body = JSON.parse(response.body);
+      assert.strictEqual(body.user.id, 1);
+    });
+  });
+
+  describe("Excluded Paths", () => {
+    test("should exclude paths from auth", async () => {
+      await fastify.register(xAuthLocal, {
+        configs: [
+          {
+            name: "api",
+            prefix: "/api",
+            secret: API_SECRET,
+            excludedPaths: ["/api/public"],
+          },
+        ],
+      });
+
+      fastify.get("/api/public/health", async () => ({ status: "ok" }));
+      fastify.get("/api/protected", async () => ({ protected: true }));
+
+      await fastify.ready();
+
+      // Excluded path should not require auth
+      const publicResponse = await fastify.inject({
+        method: "GET",
+        url: "/api/public/health",
+      });
+      assert.strictEqual(publicResponse.statusCode, 200);
+
+      // Non-excluded path should require auth
+      const protectedResponse = await fastify.inject({
+        method: "GET",
+        url: "/api/protected",
+      });
+      assert.strictEqual(protectedResponse.statusCode, 401);
+    });
+  });
+});
+
+describe("Local Routes", () => {
+  let fastify;
+  const users = new Map();
+
+  beforeEach(() => {
+    fastify = Fastify();
+    users.clear();
+  });
+
+  afterEach(async () => {
+    await fastify.close();
+  });
+
+  test("should register local routes when enabled", async () => {
+    await fastify.register(xAuthLocal, {
+      configs: [
+        {
+          name: "api",
+          prefix: "/api",
+          secret: API_SECRET,
+          local: {
+            enabled: true,
+            userLookup: async (email) => users.get(email),
+          },
+        },
+      ],
+    });
+    await fastify.ready();
+
+    assert.strictEqual(fastify.xauthlocal.configs.api.hasLocalRoutes, true);
+    assert.strictEqual(fastify.xauthlocal.configs.api.localPrefix, "/api/local");
+  });
+
+  test("POST /api/local should authenticate valid user", async () => {
+    const hashedPassword = await hashPassword("password123");
+    users.set("test@example.com", {
+      id: 1,
+      email: "test@example.com",
+      password: hashedPassword,
+      first_name: "Test",
+      last_name: "User",
+      scope: ["user"],
+    });
+
+    await fastify.register(xAuthLocal, {
+      configs: [
+        {
+          name: "api",
+          prefix: "/api",
+          secret: API_SECRET,
+          local: {
+            enabled: true,
+            userLookup: async (email) => users.get(email),
+          },
+        },
+      ],
+    });
+    await fastify.ready();
+
+    const response = await fastify.inject({
+      method: "POST",
+      url: "/api/local",
+      payload: {
+        email: "test@example.com",
+        password: "password123",
+      },
+    });
+
+    assert.strictEqual(response.statusCode, 200);
+    const body = JSON.parse(response.body);
+    assert.ok(body.token);
+    assert.strictEqual(body.user.email, "test@example.com");
+  });
+
+  test("GET /api/local/me should return authenticated user (skipUserLookup)", async () => {
+    await fastify.register(xAuthLocal, {
+      configs: [
+        {
+          name: "api",
+          prefix: "/api",
+          secret: API_SECRET,
+          local: {
+            enabled: true,
+            skipUserLookup: true,
+          },
+        },
+      ],
+    });
+    await fastify.ready();
+
+    const token = fastify.xauthlocal.configs.api.jwt.sign({
+      id: 1,
+      email: "test@example.com",
+      first_name: "Test",
+      last_name: "User",
+      scope: ["user"],
+    });
+
+    const response = await fastify.inject({
+      method: "GET",
+      url: "/api/local/me",
+      headers: {
+        authorization: `Bearer ${token}`,
+      },
+    });
+
+    assert.strictEqual(response.statusCode, 200);
+    const body = JSON.parse(response.body);
+    assert.strictEqual(body.email, "test@example.com");
+    assert.deepStrictEqual(body.scope, ["user"]);
+  });
+
+  test("GET /api/local/me should fetch fresh user data when skipUserLookup is false", async () => {
+    users.set("test@example.com", {
+      id: 1,
+      email: "test@example.com",
+      first_name: "Updated",
+      last_name: "Name",
+      scope: ["admin"],
+    });
+
+    await fastify.register(xAuthLocal, {
+      configs: [
+        {
+          name: "api",
+          prefix: "/api",
+          secret: API_SECRET,
+          local: {
+            enabled: true,
+            skipUserLookup: false,
+            userLookup: async (email) => users.get(email),
+          },
+        },
+      ],
+    });
+    await fastify.ready();
+
+    // Token has old data
+    const token = fastify.xauthlocal.configs.api.jwt.sign({
+      id: 1,
+      email: "test@example.com",
+      first_name: "Original",
+      last_name: "User",
+      scope: ["user"],
+    });
+
+    const response = await fastify.inject({
+      method: "GET",
+      url: "/api/local/me",
+      headers: {
+        authorization: `Bearer ${token}`,
+      },
+    });
+
+    assert.strictEqual(response.statusCode, 200);
+    const body = JSON.parse(response.body);
+    // Should have fresh data from userLookup
+    assert.strictEqual(body.first_name, "Updated");
+    assert.deepStrictEqual(body.scope, ["admin"]);
+  });
+
+  test("should support multiple configs with separate local routes", async () => {
+    const apiUsers = new Map();
+    const adminUsers = new Map();
+
+    const apiHashedPassword = await hashPassword("apipass");
+    apiUsers.set("api@example.com", {
+      id: 1,
+      email: "api@example.com",
+      password: apiHashedPassword,
+      first_name: "API",
+      last_name: "User",
+    });
+
+    const adminHashedPassword = await hashPassword("adminpass");
+    adminUsers.set("admin@example.com", {
+      id: 2,
+      email: "admin@example.com",
+      password: adminHashedPassword,
+      first_name: "Admin",
+      last_name: "User",
+    });
+
+    await fastify.register(xAuthLocal, {
+      configs: [
+        {
+          name: "api",
+          prefix: "/api",
+          secret: API_SECRET,
+          local: {
+            enabled: true,
+            userLookup: async (email) => apiUsers.get(email),
+          },
+        },
+        {
+          name: "admin",
+          prefix: "/admin",
+          secret: ADMIN_SECRET,
+          local: {
+            enabled: true,
+            userLookup: async (email) => adminUsers.get(email),
+          },
+        },
+      ],
+    });
+    await fastify.ready();
+
+    // Login to API
+    const apiResponse = await fastify.inject({
+      method: "POST",
+      url: "/api/local",
+      payload: { email: "api@example.com", password: "apipass" },
+    });
+    assert.strictEqual(apiResponse.statusCode, 200);
+    const apiBody = JSON.parse(apiResponse.body);
+    assert.strictEqual(apiBody.user.first_name, "API");
+
+    // Login to Admin
+    const adminResponse = await fastify.inject({
+      method: "POST",
+      url: "/admin/local",
+      payload: { email: "admin@example.com", password: "adminpass" },
+    });
+    assert.strictEqual(adminResponse.statusCode, 200);
+    const adminBody = JSON.parse(adminResponse.body);
+    assert.strictEqual(adminBody.user.first_name, "Admin");
+  });
+
+  test("POST /register should create new user", async () => {
+    await fastify.register(xAuthLocal, {
+      configs: [
+        {
+          name: "api",
+          prefix: "/api",
+          secret: API_SECRET,
+          local: {
+            enabled: true,
+            userLookup: async (email) => users.get(email),
+            createUser: async (userData) => {
+              const user = { id: 1, ...userData };
+              users.set(userData.email, user);
+              return user;
+            },
+          },
+        },
+      ],
+    });
+    await fastify.ready();
+
+    const response = await fastify.inject({
+      method: "POST",
+      url: "/api/local/register",
+      payload: {
+        email: "new@example.com",
+        password: "password123",
+        first_name: "New",
+        last_name: "User",
+      },
+    });
+
+    assert.strictEqual(response.statusCode, 201);
+    const body = JSON.parse(response.body);
+    assert.ok(body.token);
+    assert.strictEqual(body.user.email, "new@example.com");
+  });
+
+  test("POST /password-reset should not reveal if email exists", async () => {
+    await fastify.register(xAuthLocal, {
+      configs: [
+        {
+          name: "api",
+          prefix: "/api",
+          secret: API_SECRET,
+          local: {
+            enabled: true,
+            userLookup: async () => null,
+            passwordReset: async () => {},
+          },
+        },
+      ],
+    });
+    await fastify.ready();
+
+    const response = await fastify.inject({
+      method: "POST",
+      url: "/api/local/password-reset",
+      payload: { email: "nonexistent@example.com" },
+    });
+
+    assert.strictEqual(response.statusCode, 200);
+    const body = JSON.parse(response.body);
+    assert.ok(body.message.includes("If an account"));
+  });
+});
+
+describe("JWT Service (Standalone)", () => {
+  test("should create service with secret", () => {
+    const jwt = createJwtService({ secret: API_SECRET });
+
+    assert.strictEqual(jwt.algorithm, "HS256");
+
+    const token = jwt.sign({ id: 1 });
+    const decoded = jwt.verify(token);
+
+    assert.strictEqual(decoded.id, 1);
+  });
+
+  test("should include audience and issuer", () => {
+    const jwt = createJwtService({
+      secret: API_SECRET,
+      audience: "my-app",
+      issuer: "auth-server",
+    });
+
+    const token = jwt.sign({ id: 1 });
+    const decoded = jwt.verify(token);
+
+    assert.strictEqual(decoded.aud, "my-app");
+    assert.strictEqual(decoded.iss, "auth-server");
+  });
+});
+
+describe("isExcludedRoute", () => {
+  test("should return false for empty excludedPaths", () => {
+    assert.strictEqual(isExcludedRoute("/api/test", "GET", []), false);
+    assert.strictEqual(isExcludedRoute("/api/test", "GET", null), false);
+  });
+
+  test("should match string prefix", () => {
+    assert.strictEqual(isExcludedRoute("/public/test", "GET", ["/public"]), true);
+    assert.strictEqual(isExcludedRoute("/api/test", "GET", ["/public"]), false);
+  });
+
+  test("should match regex", () => {
+    assert.strictEqual(isExcludedRoute("/api/v1/test", "GET", [/^\/api\/v\d+/]), true);
+    assert.strictEqual(isExcludedRoute("/other/test", "GET", [/^\/api\/v\d+/]), false);
+  });
+
+  test("should respect method restriction", () => {
+    const rules = [{ url: "/login", methods: ["POST"] }];
+
+    assert.strictEqual(isExcludedRoute("/login", "POST", rules), true);
+    assert.strictEqual(isExcludedRoute("/login", "GET", rules), false);
+  });
+});
+
+describe("Password Utilities", () => {
+  test("should hash password", async () => {
+    const hash = await hashPassword("mypassword");
+
+    assert.ok(hash);
+    assert.ok(hash.startsWith("$2"));
+    assert.notStrictEqual(hash, "mypassword");
+  });
+
+  test("should compare password correctly", async () => {
+    const hash = await hashPassword("mypassword");
+
+    const valid = await comparePassword("mypassword", hash);
+    const invalid = await comparePassword("wrongpassword", hash);
+
+    assert.strictEqual(valid, true);
+    assert.strictEqual(invalid, false);
+  });
+});
+
+describe("Role Middleware (Standalone)", () => {
+  test("should create middleware with single role", () => {
+    const middleware = createRoleMiddleware("admin");
+    assert.ok(typeof middleware === "function");
+  });
+
+  test("should create middleware with multiple roles", () => {
+    const middleware = createRoleMiddleware(["admin", "manager"]);
+    assert.ok(typeof middleware === "function");
+  });
+});
+
+describe("Auth Middleware (Standalone)", () => {
+  test("should create middleware", () => {
+    const jwt = createJwtService({ secret: API_SECRET });
+    const middleware = createAuthMiddleware(jwt, {});
+    assert.ok(typeof middleware === "function");
+  });
+});