qa360 2.1.7 → 2.2.0

package/core/src/auth/__tests__/cloud-providers.test.ts

@@ -0,0 +1,751 @@
+/**
+ * Cloud Providers (GCP ADC, AWS IAM, Azure AD) - Unit Tests
+ *
+ * Tests cloud provider authentication for GCP, AWS, and Azure.
+ */
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import {
+  GCPADCProvider,
+  GCPADCConfig,
+  AWSIamProvider,
+  AWSIamConfig,
+  AzureADProvider,
+  AzureADConfig,
+  authCache
+} from '../index.js';
+
+describe('GCPADCProvider', () => {
+  let provider: GCPADCProvider;
+  let originalEnv: NodeJS.ProcessEnv;
+
+  beforeEach(() => {
+    provider = new GCPADCProvider();
+    vi.clearAllMocks();
+    authCache.clear(); // Clear cache between tests
+
+    // Save and clear environment variables
+    originalEnv = { ...process.env };
+    delete process.env.GOOGLE_TOKEN;
+    delete process.env.AWS_ACCESS_KEY_ID;
+    delete process.env.AWS_SECRET_ACCESS_KEY;
+    delete process.env.AWS_SESSION_TOKEN;
+  });
+
+  afterEach(() => {
+    // Restore environment variables
+    process.env = originalEnv;
+  });
+
+  // ============================================================
+  // Constructor Tests
+  // ============================================================
+  describe('constructor', () => {
+    it('should have type gcp_adc', () => {
+      expect(provider.type).toBe('gcp_adc');
+    });
+  });
+
+  // ============================================================
+  // authenticate
+  // ============================================================
+  describe('authenticate', () => {
+    it('should return credentials structure', async () => {
+      // Mock GOOGLE_TOKEN environment variable
+      process.env.GOOGLE_TOKEN = 'test-gcp-token';
+
+      const config: GCPADCConfig = {
+        type: 'gcp_adc',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+      expect(result.credentials).toBeDefined();
+      expect(result.credentials?.headers?.['Authorization']).toBe('Bearer test-gcp-token');
+    });
+
+    it('should handle project_id in config', async () => {
+      process.env.GOOGLE_TOKEN = 'test-gcp-token-with-project';
+
+      const config: GCPADCConfig = {
+        type: 'gcp_adc',
+        project_id: 'my-project',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+      expect(result.credentials?.headers?.['Authorization']).toBe('Bearer test-gcp-token-with-project');
+    });
+
+    it('should handle custom scopes', async () => {
+      process.env.GOOGLE_TOKEN = 'test-gcp-token-with-scopes';
+
+      const config: GCPADCConfig = {
+        type: 'gcp_adc',
+        scopes: ['https://www.googleapis.com/auth/cloud-platform'],
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should use token from GOOGLE_TOKEN environment variable', async () => {
+      process.env.GOOGLE_TOKEN = 'ya29.test-token-from-env';
+
+      const config: GCPADCConfig = {
+        type: 'gcp_adc',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+      expect(result.credentials?.headers?.['Authorization']).toBe('Bearer ya29.test-token-from-env');
+    });
+  });
+
+  // ============================================================
+  // validate
+  // ============================================================
+  describe('validate', () => {
+    it('should return true for cached credentials', async () => {
+      process.env.GOOGLE_TOKEN = 'test-token-for-validation';
+
+      const config: GCPADCConfig = {
+        type: 'gcp_adc',
+        cache: { enabled: true }
+      };
+
+      // First authenticate to populate cache
+      await provider.authenticate(config);
+
+      const isValid = await provider.validate(config);
+      expect(isValid).toBe(true);
+    });
+
+    it('should return false for non-cached credentials', async () => {
+      const config: GCPADCConfig = {
+        type: 'gcp_adc'
+      };
+
+      const isValid = await provider.validate(config);
+      expect(isValid).toBe(false);
+    });
+  });
+
+  // ============================================================
+  // Edge Cases
+  // ============================================================
+  describe('edge cases', () => {
+    it('should handle empty project_id', async () => {
+      process.env.GOOGLE_TOKEN = 'test-gcp-token-empty-project';
+
+      const config: GCPADCConfig = {
+        type: 'gcp_adc',
+        project_id: '',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should handle empty scopes array', async () => {
+      process.env.GOOGLE_TOKEN = 'test-gcp-token-empty-scopes';
+
+      const config: GCPADCConfig = {
+        type: 'gcp_adc',
+        scopes: [],
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should cache credentials when enabled', async () => {
+      process.env.GOOGLE_TOKEN = 'test-gcp-token-caching';
+
+      const config: GCPADCConfig = {
+        type: 'gcp_adc',
+        cache: { enabled: true }
+      };
+
+      const result1 = await provider.authenticate(config);
+      expect(result1.success).toBe(true);
+
+      // Second call should use cache
+      const result2 = await provider.authenticate(config);
+      expect(result2.success).toBe(true);
+      expect(authCache.has('gcp_adc:default')).toBe(true);
+    });
+  });
+});
+
+describe('AWSIamProvider', () => {
+  let provider: AWSIamProvider;
+
+  beforeEach(() => {
+    provider = new AWSIamProvider();
+    vi.clearAllMocks();
+  });
+
+  // ============================================================
+  // Constructor Tests
+  // ============================================================
+  describe('constructor', () => {
+    it('should have type aws_iam', () => {
+      expect(provider.type).toBe('aws_iam');
+    });
+  });
+
+  // ============================================================
+  // authenticate with direct credentials
+  // ============================================================
+  describe('authenticate with direct credentials', () => {
+    it('should authenticate with access key and secret key', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+        secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+      expect(result.credentials).toBeDefined();
+    });
+
+    it('should include session token when provided', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+        secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+        session_token: 'FwoGZXIvYXdzEBYaD...'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+  });
+
+  // ============================================================
+  // authenticate with profile
+  // ============================================================
+  describe('authenticate with profile', () => {
+    it('should use specified profile', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        profile: 'dev-profile',
+        access_key_id: 'AKIAIOSFODNN7EXAMPLE',  // Provide direct credentials for test
+        secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+      expect(result.credentials).toBeDefined();
+    });
+
+    it('should use default profile when not specified', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+        secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+  });
+
+  // ============================================================
+  // authenticate with region
+  // ============================================================
+  describe('authenticate with region', () => {
+    it('should include region in config', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        region: 'us-west-2',
+        access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+        secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+  });
+
+  // ============================================================
+  // authenticate with role ARN
+  // ============================================================
+  describe('authenticate with role ARN', () => {
+    it('should fail without credentials source', async () => {
+      // No credentials provided, no env vars, no profile
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        role_arn: 'arn:aws:iam::123456789012:role/MyRole',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      // Should fail because there's no way to get credentials
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Failed to obtain AWS credentials');
+    });
+
+    it('should accept role ARN with direct credentials', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        role_arn: 'arn:aws:iam::123456789012:role/MyRole',
+        access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+        secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+  });
+
+  // ============================================================
+  // validate
+  // ============================================================
+  describe('validate', () => {
+    it('should validate config with credentials', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+        secret_access_key: 'secret',
+        cache: { enabled: true }
+      };
+
+      // First authenticate to populate cache
+      await provider.authenticate(config);
+
+      const isValid = await provider.validate(config);
+      expect(isValid).toBe(true);
+
+      // Clean up
+      authCache.clear('aws_iam:default');
+    });
+
+    it('should return false for non-cached credentials', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        profile: 'default'
+      };
+
+      const isValid = await provider.validate(config);
+      expect(isValid).toBe(false);
+    });
+  });
+
+  // ============================================================
+  // Edge Cases
+  // ============================================================
+  describe('edge cases', () => {
+    it('should fail without any credentials source', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      // Should fail because there's no way to get credentials
+      expect(result.success).toBe(false);
+    });
+
+    it('should fail with empty access key', async () => {
+      const config: AWSIamConfig = {
+        type: 'aws_iam',
+        access_key_id: '',
+        secret_access_key: 'secret',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      // Empty string is falsy, so credentials are not found
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Failed to obtain AWS credentials');
+    });
+  });
+});
+
+describe('AzureADProvider', () => {
+  let provider: AzureADProvider;
+
+  beforeEach(() => {
+    provider = new AzureADProvider();
+    vi.clearAllMocks();
+  });
+
+  // ============================================================
+  // Constructor Tests
+  // ============================================================
+  describe('constructor', () => {
+    it('should have type azure_ad', () => {
+      expect(provider.type).toBe('azure_ad');
+    });
+  });
+
+  // ============================================================
+  // authenticate with client credentials
+  // ============================================================
+  describe('authenticate with client credentials', () => {
+    it('should authenticate with tenant and client id', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          access_token: 'azure-access-token',
+          expires_in: 3600,
+          token_type: 'Bearer'
+        })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+      expect(result.credentials?.headers?.['Authorization']).toBe('Bearer azure-access-token');
+
+      // Verify correct endpoint was called
+      expect(mockFetch).toHaveBeenCalledWith(
+        'https://login.microsoftonline.com/12345678-1234-1234-1234-123456789012/oauth2/v2.0/token',
+        expect.objectContaining({
+          method: 'POST'
+        })
+      );
+    });
+
+    it('should include client secret in request', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          access_token: 'azure-token-with-secret'
+        })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        client_secret: 'client-secret-value',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+
+      const callArgs = mockFetch.mock.calls[0];
+      const bodyStr = callArgs[1].body as string;
+      expect(bodyStr).toContain('client_secret=client-secret-value');
+    });
+
+    it('should include scope in request', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          access_token: 'scoped-azure-token'
+        })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        scope: 'https://management.azure.com/.default',
+        cache: { enabled: false }
+      };
+
+      await provider.authenticate(config);
+
+      const callArgs = mockFetch.mock.calls[0];
+      const bodyStr = callArgs[1].body as string;
+      expect(bodyStr).toContain('scope=https%3A%2F%2Fmanagement.azure.com%2F.default');
+    });
+
+    it('should use custom token endpoint when provided', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          access_token: 'custom-endpoint-token'
+        })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        token_endpoint: 'https://custom.identity.provider/token',
+        cache: { enabled: false }
+      };
+
+      await provider.authenticate(config);
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        'https://custom.identity.provider/token',
+        expect.objectContaining({
+          method: 'POST',
+          headers: expect.objectContaining({
+            'Content-Type': 'application/x-www-form-urlencoded'
+          })
+        })
+      );
+    });
+  });
+
+  // ============================================================
+  // Error handling
+  // ============================================================
+  describe('error handling', () => {
+    it('should handle token request failure', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: false,
+        status: 401,
+        statusText: 'Unauthorized',
+        text: async () => 'Unauthorized'
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Azure AD token request failed');
+    });
+
+    it('should handle missing access_token', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ error: 'invalid_client' })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('No access_token');
+    });
+
+    it('should handle network error', async () => {
+      const mockFetch = vi.fn().mockRejectedValue(new Error('Network error'));
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Azure AD authentication failed');
+    });
+  });
+
+  // ============================================================
+  // refresh
+  // ============================================================
+  describe('refresh', () => {
+    it('should clear cache and fetch new token', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ access_token: 'new-azure-token', expires_in: 3600 })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        cache: { enabled: false }
+      };
+
+      const result = await provider.refresh(config);
+
+      expect(result.success).toBe(true);
+      expect(result.credentials?.headers?.['Authorization']).toBe('Bearer new-azure-token');
+    });
+  });
+
+  // ============================================================
+  // validate
+  // ============================================================
+  describe('validate', () => {
+    it('should validate cached credentials', async () => {
+      const { authCache } = await import('../index.js');
+
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          access_token: 'test-token',
+          expires_in: 3600
+        })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        cache: { enabled: true }
+      };
+
+      await provider.authenticate(config);
+
+      const isValid = await provider.validate(config);
+      expect(isValid).toBe(true);
+
+      // Clean up
+      authCache.clear('azure_ad:87654321-4321-4321-4321-210987654321');
+    });
+
+    it('should return false for non-cached credentials', async () => {
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321'
+      };
+
+      const isValid = await provider.validate(config);
+      expect(isValid).toBe(false);
+    });
+  });
+
+  // ============================================================
+  // caching
+  // ============================================================
+  describe('caching', () => {
+    it('should cache credentials when enabled', async () => {
+      const { authCache } = await import('../index.js');
+
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          access_token: 'cached-azure-token',
+          expires_in: 3600
+        })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        cache: { enabled: true }
+      };
+
+      await provider.authenticate(config);
+
+      expect(authCache.has('azure_ad:87654321-4321-4321-4321-210987654321')).toBe(true);
+
+      // Clean up
+      authCache.clear('azure_ad:87654321-4321-4321-4321-210987654321');
+    });
+
+    it('should clear cached credentials', async () => {
+      const { authCache } = await import('../index.js');
+
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          access_token: 'clearable-azure-token',
+          expires_in: 3600
+        })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        cache: { enabled: true }
+      };
+
+      await provider.authenticate(config);
+      await provider.clear(config);
+
+      expect(authCache.has('azure_ad:87654321-4321-4321-4321-210987654321')).toBe(false);
+    });
+  });
+
+  // ============================================================
+  // Edge Cases
+  // ============================================================
+  describe('edge cases', () => {
+    it('should handle special characters in client secret', async () => {
+      const mockFetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({
+          access_token: 'token-with-special-secret'
+        })
+      });
+
+      globalThis.fetch = mockFetch;
+
+      const config: AzureADConfig = {
+        type: 'azure_ad',
+        tenant_id: '12345678-1234-1234-1234-123456789012',
+        client_id: '87654321-4321-4321-4321-210987654321',
+        client_secret: 'secret-with-special-chars_!@#$%'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+  });
+});