opticedge-cloud-utils 1.0.0

package/.eslintrc.js

@@ -0,0 +1,29 @@
+module.exports = {
+  root: true,
+  parser: '@typescript-eslint/parser',
+  parserOptions: {
+    ecmaVersion: 2020,  // modern JS features
+    sourceType: 'module',
+  },
+  env: {
+    node: true,
+    jest: true,
+    es2020: true,
+  },
+  plugins: ['@typescript-eslint', 'jest'],
+  extends: [
+    'eslint:recommended',
+    'plugin:@typescript-eslint/recommended',
+    'plugin:jest/recommended',
+  ],
+  rules: {
+    // Your custom rules here, for example:
+    'no-console': 'warn',
+    '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
+  },
+  settings: {
+    jest: {
+      version: 29,  // or your jest version
+    },
+  },
+};

package/dist/verify.d.ts

@@ -0,0 +1,7 @@
+import { Request } from '@google-cloud/functions-framework';
+interface VerifyOptions {
+    allowedAudience: string;
+    allowedServiceAccount: string;
+}
+export declare function verifyRequest(req: Request, options: VerifyOptions): Promise<boolean>;
+export {};

package/dist/verify.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyRequest = verifyRequest;
+const google_auth_library_1 = require("google-auth-library");
+async function verifyRequest(req, options) {
+    const authHeader = req.headers['authorization'];
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        return false;
+    }
+    const token = authHeader.split(' ')[1];
+    const client = new google_auth_library_1.OAuth2Client();
+    try {
+        const ticket = await client.verifyIdToken({
+            idToken: token,
+            audience: options.allowedAudience,
+        });
+        const payload = ticket.getPayload();
+        return payload?.email === options.allowedServiceAccount;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/verify.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/verify.test.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const verify_1 = require("./verify");
+// Mock the google-auth-library
+jest.mock('google-auth-library', () => {
+    return {
+        OAuth2Client: jest.fn().mockImplementation(() => ({
+            verifyIdToken: jest.fn(({ idToken, audience }) => {
+                if (idToken === 'valid-token' && audience === 'audience') {
+                    return {
+                        getPayload: () => ({
+                            email: 'allowed@example.com',
+                        }),
+                    };
+                }
+                else if (idToken === 'wrong-email-token' && audience === 'audience') {
+                    return {
+                        getPayload: () => ({
+                            email: 'unauthorized@example.com',
+                        }),
+                    };
+                }
+                throw new Error('Invalid token');
+            }),
+        })),
+    };
+});
+describe('verifyRequest', () => {
+    it('returns true for valid token and matching email', async () => {
+        const mockReq = {
+            headers: {
+                authorization: 'Bearer valid-token',
+            },
+        };
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const result = await (0, verify_1.verifyRequest)(mockReq, {
+            allowedAudience: 'audience',
+            allowedServiceAccount: 'allowed@example.com',
+        });
+        expect(result).toBe(true);
+    });
+    it('returns false for invalid token', async () => {
+        const mockReq = {
+            headers: {
+                authorization: 'Bearer invalid-token',
+            },
+        };
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const result = await (0, verify_1.verifyRequest)(mockReq, {
+            allowedAudience: 'audience',
+            allowedServiceAccount: 'allowed@example.com',
+        });
+        expect(result).toBe(false);
+    });
+    it('returns false for missing authorization header', async () => {
+        const mockReq = {
+            headers: {},
+        };
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const result = await (0, verify_1.verifyRequest)(mockReq, {
+            allowedAudience: 'audience',
+            allowedServiceAccount: 'allowed@example.com',
+        });
+        expect(result).toBe(false);
+    });
+    it('returns false for incorrect email', async () => {
+        const mockReq = {
+            headers: {
+                authorization: 'Bearer wrong-email-token',
+            },
+        };
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const result = await (0, verify_1.verifyRequest)(mockReq, {
+            allowedAudience: 'audience',
+            allowedServiceAccount: 'allowed@example.com',
+        });
+        expect(result).toBe(false);
+    });
+});

package/jest.config.js

@@ -0,0 +1,11 @@
+const { createDefaultPreset } = require("ts-jest");
+
+const tsJestTransformCfg = createDefaultPreset().transform;
+
+/** @type {import("jest").Config} **/
+module.exports = {
+  testEnvironment: "node",
+  transform: {
+    ...tsJestTransformCfg,
+  },
+};

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "opticedge-cloud-utils",
+  "version": "1.0.0",
+  "description": "Common utilities for cloud functions",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "jest --coverage",
+    "lint": "eslint . --ext .ts",
+    "prepare": "npm run build"
+  },
+  "author": "Evans Musonda",
+  "license": "MIT",
+  "dependencies": {
+    "google-auth-library": "^9.15.1"
+  },
+  "devDependencies": {
+    "@google-cloud/functions-framework": "^4.0.0",
+    "@types/jest": "^29.5.14",
+    "@types/node": "^22.15.23",
+    "@typescript-eslint/eslint-plugin": "^8.33.0",
+    "@typescript-eslint/parser": "^8.33.0",
+    "eslint": "^8.57.1",
+    "eslint-plugin-jest": "^28.11.1",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.3.4",
+    "typescript": "^5.8.3"
+  }
+}

package/src/auth/verify.test.ts

@@ -0,0 +1,89 @@
+import { verifyRequest } from './verify';
+
+// Mock the google-auth-library
+jest.mock('google-auth-library', () => {
+  return {
+    OAuth2Client: jest.fn().mockImplementation(() => ({
+      verifyIdToken: jest.fn(({ idToken, audience }) => {
+        if (idToken === 'valid-token' && audience === 'audience') {
+          return {
+            getPayload: () => ({
+              email: 'allowed@example.com',
+            }),
+          };
+        } else if (idToken === 'wrong-email-token' && audience === 'audience') {
+          return {
+            getPayload: () => ({
+              email: 'unauthorized@example.com',
+            }),
+          };
+        }
+        throw new Error('Invalid token');
+      }),
+    })),
+  };
+});
+
+describe('verifyRequest', () => {
+  it('returns true for valid token and matching email', async () => {
+    const mockReq = {
+      headers: {
+        authorization: 'Bearer valid-token',
+      },
+    };
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const result = await verifyRequest(mockReq as any, {
+      allowedAudience: 'audience',
+      allowedServiceAccount: 'allowed@example.com',
+    });
+
+    expect(result).toBe(true);
+  });
+
+  it('returns false for invalid token', async () => {
+    const mockReq = {
+      headers: {
+        authorization: 'Bearer invalid-token',
+      },
+    };
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const result = await verifyRequest(mockReq as any, {
+      allowedAudience: 'audience',
+      allowedServiceAccount: 'allowed@example.com',
+    });
+
+    expect(result).toBe(false);
+  });
+
+  it('returns false for missing authorization header', async () => {
+    const mockReq = {
+      headers: {},
+    };
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const result = await verifyRequest(mockReq as any, {
+      allowedAudience: 'audience',
+      allowedServiceAccount: 'allowed@example.com',
+    });
+
+    expect(result).toBe(false);
+  });
+
+  it('returns false for incorrect email', async () => {
+    const mockReq = {
+      headers: {
+        authorization: 'Bearer wrong-email-token',
+      },
+    };
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const result = await verifyRequest(mockReq as any, {
+      allowedAudience: 'audience',
+      allowedServiceAccount: 'allowed@example.com',
+    });
+
+    expect(result).toBe(false);
+  });
+});

package/src/auth/verify.ts

@@ -0,0 +1,32 @@
+import { OAuth2Client } from 'google-auth-library';
+import { Request } from '@google-cloud/functions-framework';
+
+interface VerifyOptions {
+  allowedAudience: string;
+  allowedServiceAccount: string;
+}
+
+export async function verifyRequest(
+  req: Request,
+  options: VerifyOptions
+): Promise<boolean> {
+  const authHeader = req.headers['authorization'];
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return false;
+  }
+
+  const token = authHeader.split(' ')[1];
+  const client = new OAuth2Client();
+
+  try {
+    const ticket = await client.verifyIdToken({
+      idToken: token,
+      audience: options.allowedAudience,
+    });
+
+    const payload = ticket.getPayload();
+    return payload?.email === options.allowedServiceAccount;
+  } catch {
+    return false;
+  }
+}

package/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "CommonJS",
+    "declaration": true,
+    "outDir": "./dist",
+    "strict": true,
+    "esModuleInterop": true,
+    "moduleResolution": "node",
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "forceConsistentCasingInFileNames": true,
+    "types": ["node", "jest"]
+  },
+  "include": ["src"],
+  "exclude": ["node_modules", "dist"]
+}