qa360 2.1.7 → 2.2.0

package/core/src/auth/__tests__/ui-login-provider.test.ts

@@ -0,0 +1,323 @@
+/**
+ * UI Login Provider - Unit Tests
+ *
+ * Tests Playwright-based form login authentication.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { UILoginProvider, UILoginAuthConfig } from '../index.js';
+
+// Mock Playwright
+const mockCookies = [
+  { name: 'session', value: 'abc123', domain: '.example.com' }
+];
+
+const mockPage = {
+  goto: vi.fn(() => Promise.resolve()),
+  fill: vi.fn(() => Promise.resolve()),
+  click: vi.fn(() => Promise.resolve()),
+  waitForLoadState: vi.fn(() => Promise.resolve()),
+  waitForNavigation: vi.fn(() => Promise.resolve()),
+  waitForTimeout: vi.fn(() => Promise.resolve()),
+  url: () => 'https://example.com/dashboard'
+};
+
+const mockContext = {
+  newPage: vi.fn(() => mockPage),
+  cookies: vi.fn(() => mockCookies),
+  close: vi.fn()
+};
+
+const mockBrowser = {
+  newContext: vi.fn(() => mockContext),
+  close: vi.fn()
+};
+
+vi.mock('playwright', () => ({
+  chromium: {
+    launch: vi.fn(() => Promise.resolve(mockBrowser))
+  }
+}));
+
+describe('UILoginProvider', () => {
+  let provider: UILoginProvider;
+
+  beforeEach(() => {
+    provider = new UILoginProvider();
+    vi.clearAllMocks();
+  });
+
+  // ============================================================
+  // Constructor Tests
+  // ============================================================
+  describe('constructor', () => {
+    it('should have type ui_login', () => {
+      expect(provider.type).toBe('ui_login');
+    });
+  });
+
+  // ============================================================
+  // authenticate with credentials
+  // ============================================================
+  describe('authenticate with form login', () => {
+    it('should authenticate with default selectors', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+      expect(result.credentials?.cookies).toBeDefined();
+      expect(result.credentials?.cookies?.length).toBeGreaterThan(0);
+    });
+
+    it('should use custom selectors', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123',
+        username_selector: '#email',
+        password_selector: '#pass',
+        submit_selector: 'button[type="submit"]'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should handle TOTP for 2FA', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123',
+        totp_secret: 'JBSWY3DPEHPK3PXP',
+        totp_selector: 'input[name="code"]'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should wait for navigation after login', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+  });
+
+  // ============================================================
+  // Session persistence
+  // ============================================================
+  describe('session persistence', () => {
+    it('should save session to file', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123',
+        session_file: '/tmp/session.json'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+      // Session file handling is tested via integration tests
+    });
+
+    it('should restore existing session', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123',
+        session_file: '/tmp/existing-session.json'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+  });
+
+  // ============================================================
+  // Error handling
+  // ============================================================
+  describe('error handling', () => {
+    it('should handle missing username', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        password: 'secret123'
+      } as any;
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should handle missing password', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com'
+      } as any;
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(false);
+    });
+
+    it('should handle navigation timeout', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123'
+      };
+
+      const result = await provider.authenticate(config);
+
+      // Mock doesn't actually timeout, but structure is here
+      expect(result.success).toBe(true);
+    });
+  });
+
+  // ============================================================
+  // validate
+  // ============================================================
+  describe('validate', () => {
+    it('should validate cached credentials', async () => {
+      const { authCache } = await import('../index.js');
+
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123',
+        cache: { enabled: true }
+      };
+
+      // First authenticate to populate cache
+      await provider.authenticate(config);
+
+      const isValid = await provider.validate(config);
+      expect(isValid).toBe(true);
+
+      // Clean up
+      authCache.clear('ui_login:https://example.com/login');
+    });
+
+    it('should return false for non-cached credentials', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123'
+      };
+
+      const isValid = await provider.validate(config);
+      expect(isValid).toBe(false);
+    });
+  });
+
+  // ============================================================
+  // caching
+  // ============================================================
+  describe('caching', () => {
+    it('should cache session cookies', async () => {
+      const { authCache } = await import('../index.js');
+
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123',
+        cache: { enabled: true }
+      };
+
+      await provider.authenticate(config);
+
+      expect(authCache.has('ui_login:https://example.com/login')).toBe(true);
+
+      // Clean up
+      authCache.clear('ui_login:https://example.com/login');
+    });
+
+    it('should clear cached credentials', async () => {
+      const { authCache } = await import('../index.js');
+
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'secret123',
+        cache: { enabled: true }
+      };
+
+      await provider.authenticate(config);
+      await provider.clear(config);
+
+      expect(authCache.has('ui_login:https://example.com/login')).toBe(false);
+    });
+  });
+
+  // ============================================================
+  // Edge Cases
+  // ============================================================
+  describe('edge cases', () => {
+    it('should handle special characters in password', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'test@example.com',
+        password: 'p@ss!w0rd"#$$'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should handle Unicode in credentials', async () => {
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: 'https://example.com/login',
+        username: 'tëst@example.com',
+        password: 'pässwörd'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+
+    it('should handle very long URL', async () => {
+      const longUrl = 'https://example.com/login?' + 'a'.repeat(1000);
+      const config: UILoginAuthConfig = {
+        type: 'ui_login',
+        url: longUrl,
+        username: 'test@example.com',
+        password: 'secret123'
+      };
+
+      const result = await provider.authenticate(config);
+
+      expect(result.success).toBe(true);
+    });
+  });
+});

package/core/src/auth/api-key-provider.ts

@@ -0,0 +1,75 @@
+/**
+ * API Key Authentication Provider
+ *
+ * Handles API key authentication with support for:
+ * - Custom header names (default: X-API-Key)
+ * - Custom prefix (e.g., "Bearer ")
+ * - Header or query param location
+ */
+
+import { AuthProvider, AuthResult, AuthCredentials, APIKeyAuthConfig, authCache, createCacheKey } from './index.js';
+
+export class APIKeyProvider implements AuthProvider<APIKeyAuthConfig> {
+  readonly type = 'api_key' as const;
+
+  async authenticate(config: APIKeyAuthConfig): Promise<AuthResult> {
+    const { key, header_name = 'X-API-Key', prefix = '', location = 'header', cache } = config;
+
+    const cacheKey = this.getCacheKey(config);
+
+    // Check cache first
+    if (cache?.enabled !== false) {
+      const cached = authCache.get(cacheKey);
+      if (cached) {
+        return { success: true, credentials: cached };
+      }
+    }
+
+    const credentials: AuthCredentials = {
+      type: 'api_key'
+    };
+
+    // Prefix is used as-is, no automatic space added
+    const fullKey = prefix + key;
+
+    if (location === 'header') {
+      credentials.headers = {
+        [header_name]: fullKey
+      };
+    } else {
+      credentials.queryParams = {
+        api_key: fullKey
+      };
+    }
+
+    // Cache if enabled
+    if (cache?.enabled !== false) {
+      const ttl = cache?.ttl || 3600;
+      authCache.set(cacheKey, credentials, ttl);
+    }
+
+    return {
+      success: true,
+      credentials
+    };
+  }
+
+  async clear(config: APIKeyAuthConfig): Promise<void> {
+    const key = this.getCacheKey(config);
+    authCache.clear(key);
+  }
+
+  async validate(config: APIKeyAuthConfig): Promise<boolean> {
+    const cacheKey = this.getCacheKey(config);
+    // Check cache first, then validate key
+    if (authCache.has(cacheKey)) {
+      return true;
+    }
+    return !!config.key && config.key.length > 0;
+  }
+
+  private getCacheKey(config: APIKeyAuthConfig): string {
+    // Use header name as identifier
+    return createCacheKey('api_key', config.header_name || 'default');
+  }
+}

package/core/src/auth/aws-iam-provider.ts

@@ -0,0 +1,212 @@
+/**
+ * AWS IAM Authentication Provider
+ *
+ * Handles AWS authentication using IAM credentials.
+ * Supports credential chains, environment variables, and profiles.
+ */
+
+import { AuthProvider, AuthResult, AuthCredentials, AWSIamConfig, authCache, createCacheKey } from './index.js';
+
+export class AWSIamProvider implements AuthProvider<AWSIamConfig> {
+  readonly type = 'aws_iam' as const;
+
+  async authenticate(config: AWSIamConfig): Promise<AuthResult> {
+    const cacheKey = this.getCacheKey(config);
+
+    // Check cache first
+    if (config.cache?.enabled !== false) {
+      const cached = authCache.get(cacheKey);
+      if (cached) {
+        return { success: true, credentials: cached };
+      }
+    }
+
+    // Get AWS credentials
+    const awsCreds = await this.getCredentials(config);
+
+    if (!awsCreds) {
+      return {
+        success: false,
+        error: 'Failed to obtain AWS credentials. Ensure you have configured AWS credentials via environment variables, ~/.aws/credentials, or IAM role.'
+      };
+    }
+
+    // Sign request to get session token if using temporary credentials
+    const credentials: AuthCredentials = {
+      type: 'aws_iam',
+      headers: {
+        'X-Amz-Security-Token': awsCreds.session_token || '',
+        'X-Amz-Date': this.getAmzDate()
+      }
+    };
+
+    // Add basic auth header for some AWS services
+    if (awsCreds.access_key_id && awsCreds.secret_access_key) {
+      credentials.headers!['X-Amz-Credential'] = `${awsCreds.access_key_id}`;
+    }
+
+    // Cache credentials (AWS temp tokens expire in 1 hour typically)
+    if (config.cache?.enabled !== false) {
+      const ttl = config.cache?.ttl || 3600;
+      authCache.set(cacheKey, credentials, ttl);
+    }
+
+    return {
+      success: true,
+      credentials,
+      expiresAt: awsCreds.expiration || Date.now() + 3600 * 1000
+    };
+  }
+
+  async refresh(config: AWSIamConfig): Promise<AuthResult> {
+    authCache.clear(this.getCacheKey(config));
+    return this.authenticate(config);
+  }
+
+  clear(config: AWSIamConfig): Promise<void> {
+    const key = this.getCacheKey(config);
+    authCache.clear(key);
+    return Promise.resolve();
+  }
+
+  async validate(config: AWSIamConfig): Promise<boolean> {
+    const key = this.getCacheKey(config);
+    return authCache.has(key);
+  }
+
+  /**
+   * Get AWS credentials from various sources
+   */
+  private async getCredentials(config: AWSIamConfig): Promise<AwsCredentials | null> {
+    // Method 1: Direct credentials from config
+    if (config.access_key_id && config.secret_access_key) {
+      return {
+        access_key_id: config.access_key_id,
+        secret_access_key: config.secret_access_key,
+        session_token: config.session_token
+      };
+    }
+
+    // Method 2: Environment variables
+    const envCreds = this.getFromEnv();
+    if (envCreds) return envCreds;
+
+    // Method 3: AWS profile
+    if (config.profile) {
+      const profileCreds = await this.getFromProfile(config.profile);
+      if (profileCreds) return profileCreds;
+    }
+
+    // Method 4: Try AWS SDK if available
+    const sdkCreds = await this.getFromSDK(config);
+    if (sdkCreds) return sdkCreds;
+
+    return null;
+  }
+
+  /**
+   * Get credentials from environment variables
+   */
+  private getFromEnv(): AwsCredentials | null {
+    const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+    const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+    const sessionToken = process.env.AWS_SESSION_TOKEN;
+
+    if (accessKeyId && secretAccessKey) {
+      return {
+        access_key_id: accessKeyId,
+        secret_access_key: secretAccessKey,
+        session_token: sessionToken
+      };
+    }
+
+    return null;
+  }
+
+  /**
+   * Get credentials from AWS profile file
+   */
+  private async getFromProfile(profile: string): Promise<AwsCredentials | null> {
+    try {
+      const fs = require('node:fs');
+      const path = require('node:path');
+      const { execSync } = require('node:child_process');
+
+      const homeDir = process.env.HOME || process.env.USERPROFILE;
+      const credentialsPath = path.join(homeDir, '.aws', 'credentials');
+
+      if (!fs.existsSync(credentialsPath)) {
+        return null;
+      }
+
+      // Use AWS CLI to get credentials for profile
+      const creds = execSync(`aws configure export --profile ${profile}`, {
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe']
+      });
+
+      // Parse the export output
+      const accessKeyMatch = creds.match(/AWS_ACCESS_KEY_ID="([^"]+)"/);
+      const secretKeyMatch = creds.match(/AWS_SECRET_ACCESS_KEY="([^"]+)"/);
+      const sessionMatch = creds.match(/AWS_SESSION_TOKEN="([^"]+)"/);
+
+      if (accessKeyMatch && secretKeyMatch) {
+        return {
+          access_key_id: accessKeyMatch[1],
+          secret_access_key: secretKeyMatch[1],
+          session_token: sessionMatch?.[1]
+        };
+      }
+
+      return null;
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Get credentials from AWS SDK v3
+   */
+  private async getFromSDK(config: AWSIamConfig): Promise<AwsCredentials | null> {
+    try {
+      // Try to import AWS SDK
+      // @ts-ignore - AWS SDK is optional dependency
+      const { defaultProvider } = await import('@aws-sdk/credential-providers');
+      const provider = defaultProvider({
+        profile: config.profile
+      });
+
+      const creds = await provider();
+
+      return {
+        access_key_id: creds.accessKeyId,
+        secret_access_key: creds.secretAccessKey,
+        session_token: creds.sessionToken,
+        expiration: creds.expiration?.getTime()
+      };
+    } catch {
+      // AWS SDK not available or error
+      return null;
+    }
+  }
+
+  /**
+   * Get AMZ date format for AWS signing
+   */
+  private getAmzDate(): string {
+    const now = new Date();
+    return now.toISOString().replace(/[:\-]|\.\d{3}/g, '');
+  }
+
+  private getCacheKey(config: AWSIamConfig): string {
+    const identifier = config.profile || config.region || 'default';
+    return createCacheKey('aws_iam', identifier);
+  }
+}
+
+interface AwsCredentials {
+  access_key_id: string;
+  secret_access_key: string;
+  session_token?: string;
+  expiration?: number;
+}