qa360 2.1.7 → 2.2.0

package/core/src/auth/index.ts

@@ -0,0 +1,342 @@
+/**
+ * QA360 Authentication Module
+ *
+ * Comprehensive authentication support for test adapters.
+ * Supports JWT, OAuth2, API Keys, Bearer tokens, Basic auth, TOTP,
+ * UI Login, and cloud provider credentials (GCP, AWS, Azure).
+ */
+
+/**
+ * Authentication result
+ */
+export interface AuthResult {
+  success: boolean;
+  credentials?: AuthCredentials;
+  error?: string;
+  expiresAt?: number;  // Unix timestamp
+}
+
+/**
+ * Authentication credentials to be used in requests
+ */
+export interface AuthCredentials {
+  type: AuthType;
+  headers?: Record<string, string>;
+  queryParams?: Record<string, string>;
+  cookies?: Cookie[];
+  body?: Record<string, unknown>;
+}
+
+/**
+ * Cookie for session management
+ */
+export interface Cookie {
+  name: string;
+  value: string;
+  domain?: string;
+  path?: string;
+  expires?: Date;
+  httpOnly?: boolean;
+  secure?: boolean;
+}
+
+/**
+ * Authentication types
+ */
+export type AuthType =
+  | 'none'                    // No authentication
+  | 'jwt'                     // JWT bearer token
+  | 'oauth2'                  // OAuth2 client credentials
+  | 'api_key'                 // API key in header
+  | 'bearer'                  // Generic bearer token
+  | 'basic'                   // Basic auth
+  | 'totp'                    // TOTP-based auth
+  | 'ui_login'                // UI form-based login
+  | 'gcp_adc'                 // GCP Application Default Credentials
+  | 'aws_iam'                 // AWS IAM credentials
+  | 'azure_ad';               // Azure AD token
+
+/**
+ * Base configuration for all auth providers
+ */
+export interface BaseAuthConfig {
+  type: AuthType;
+  enabled?: boolean;
+  cache?: {
+    enabled?: boolean;
+    ttl?: number;  // Time to live in seconds
+  };
+}
+
+/**
+ * JWT configuration
+ */
+export interface JWTAuthConfig extends BaseAuthConfig {
+  type: 'jwt';
+  issuer?: string;
+  audience?: string;
+  subject?: string;
+  client_id?: string;
+  client_secret?: string;
+  token_endpoint?: string;
+  scopes?: string[];
+  auto_refresh?: boolean;
+  token?: string;  // Pre-existing token
+}
+
+/**
+ * OAuth2 configuration
+ */
+export interface OAuth2AuthConfig extends BaseAuthConfig {
+  type: 'oauth2';
+  token_url: string;
+  client_id: string;
+  client_secret?: string;
+  scopes?: string[];
+  grant_type?: 'client_credentials' | 'authorization_code' | 'password';
+  username?: string;
+  password?: string;
+}
+
+/**
+ * API Key configuration
+ */
+export interface APIKeyAuthConfig extends BaseAuthConfig {
+  type: 'api_key';
+  key: string;
+  header_name?: string;  // Default: X-API-Key
+  prefix?: string;       // e.g., "Bearer "
+  location?: 'header' | 'query';
+}
+
+/**
+ * Bearer token configuration
+ */
+export interface BearerAuthConfig extends BaseAuthConfig {
+  type: 'bearer';
+  token: string;
+}
+
+/**
+ * Basic auth configuration
+ */
+export interface BasicAuthConfig extends BaseAuthConfig {
+  type: 'basic';
+  username: string;
+  password: string;
+}
+
+/**
+ * TOTP configuration
+ */
+export interface TOTPAuthConfig extends BaseAuthConfig {
+  type: 'totp';
+  secret: string;
+  digits?: number;        // Default: 6
+  period?: number;        // Default: 30
+  algorithm?: 'sha1' | 'sha256' | 'sha512';
+}
+
+/**
+ * UI Login configuration
+ */
+export interface UILoginAuthConfig extends BaseAuthConfig {
+  type: 'ui_login';
+  url: string;
+  username?: string;
+  password?: string;
+  username_selector?: string;
+  password_selector?: string;
+  submit_selector?: string;
+  totp_secret?: string;
+  totp_selector?: string;
+  session_file?: string;   // Path to save session cookies
+}
+
+/**
+ * GCP ADC configuration
+ */
+export interface GCPADCConfig extends BaseAuthConfig {
+  type: 'gcp_adc';
+  project_id?: string;
+  scopes?: string[];
+}
+
+/**
+ * AWS IAM configuration
+ */
+export interface AWSIamConfig extends BaseAuthConfig {
+  type: 'aws_iam';
+  region?: string;
+  access_key_id?: string;
+  secret_access_key?: string;
+  session_token?: string;
+  role_arn?: string;
+  profile?: string;
+}
+
+/**
+ * Azure AD configuration
+ */
+export interface AzureADConfig extends BaseAuthConfig {
+  type: 'azure_ad';
+  tenant_id: string;
+  client_id: string;
+  client_secret?: string;
+  scope?: string;
+  token_endpoint?: string;
+}
+
+/**
+ * No-auth configuration (for unauthenticated requests)
+ */
+export interface NoneAuthConfig extends BaseAuthConfig {
+  type: 'none';
+}
+
+/**
+ * Union type for all auth configurations
+ */
+export type AuthConfig =
+  | JWTAuthConfig
+  | OAuth2AuthConfig
+  | APIKeyAuthConfig
+  | BearerAuthConfig
+  | BasicAuthConfig
+  | TOTPAuthConfig
+  | UILoginAuthConfig
+  | GCPADCConfig
+  | AWSIamConfig
+  | AzureADConfig
+  | NoneAuthConfig;
+
+/**
+ * Base interface for all auth providers
+ */
+export interface AuthProvider<T extends AuthConfig = AuthConfig> {
+  /**
+   * Provider type identifier
+   */
+  readonly type: AuthType;
+
+  /**
+   * Authenticate and retrieve credentials
+   */
+  authenticate(config: T): Promise<AuthResult>;
+
+  /**
+   * Refresh credentials if applicable
+   */
+  refresh?(config: T): Promise<AuthResult>;
+
+  /**
+   * Clear cached credentials
+   */
+  clear?(config: T): Promise<void>;
+
+  /**
+   * Validate current credentials
+   */
+  validate?(config: T): Promise<boolean>;
+}
+
+/**
+ * Authentication cache entry
+ */
+interface CacheEntry {
+  credentials: AuthCredentials;
+  expiresAt: number;
+}
+
+/**
+ * Simple in-memory cache for auth credentials
+ */
+export class AuthCache {
+  private cache = new Map<string, CacheEntry>();
+  private defaultTTL = 3600; // 1 hour
+
+  set(key: string, credentials: AuthCredentials, ttl?: number): void {
+    const expiresAt = Date.now() + (ttl || this.defaultTTL) * 1000;
+    this.cache.set(key, { credentials, expiresAt });
+  }
+
+  get(key: string): AuthCredentials | null {
+    const entry = this.cache.get(key);
+    if (!entry) return null;
+
+    if (Date.now() > entry.expiresAt) {
+      this.cache.delete(key);
+      return null;
+    }
+
+    return entry.credentials;
+  }
+
+  clear(key?: string): void {
+    if (key) {
+      this.cache.delete(key);
+    } else {
+      this.cache.clear();
+    }
+  }
+
+  has(key: string): boolean {
+    return this.get(key) !== null;
+  }
+}
+
+/**
+ * Global auth cache instance
+ */
+export const authCache = new AuthCache();
+
+/**
+ * Create cache key from config
+ */
+export function createCacheKey(type: AuthType, identifier: string): string {
+  return `${type}:${identifier}`;
+}
+
+/**
+ * Check if credentials are expired
+ */
+export function isExpired(expiresAt?: number): boolean {
+  if (!expiresAt) return false;
+  return Date.now() >= expiresAt;
+}
+
+/**
+ * Parse token from string (extracts token without "Bearer " prefix)
+ */
+export function parseToken(token: string): string {
+  return token.replace(/^Bearer\s+/i, '').trim();
+}
+
+/**
+ * Encode basic auth header
+ */
+export function encodeBasicAuth(username: string, password: string): string {
+  const encoded = Buffer.from(`${username}:${password}`).toString('base64');
+  return `Basic ${encoded}`;
+}
+
+// Re-export all providers
+export { JWTProvider } from './jwt-provider.js';
+export { OAuth2Provider } from './oauth2-provider.js';
+export { APIKeyProvider } from './api-key-provider.js';
+export { BearerProvider, BasicAuthProvider } from './basic-auth-provider.js';
+export { TOTPProvider } from './totp-provider.js';
+export { UILoginProvider } from './ui-login-provider.js';
+export { GCPADCProvider } from './gcp-adc-provider.js';
+export { AWSIamProvider } from './aws-iam-provider.js';
+export { AzureADProvider } from './azure-ad-provider.js';
+
+// Re-export manager and factory functions
+export {
+  AuthManager,
+  authManager,
+  authenticate,
+  createAuthHeaders,
+  applyAuthToRequest,
+  AuthError
+} from './manager.js';

package/core/src/auth/jwt-provider.ts

@@ -0,0 +1,193 @@
+/**
+ * JWT Authentication Provider
+ *
+ * Handles JWT bearer token authentication with support for:
+ * - Pre-existing tokens
+ * - OAuth2 token endpoint (client credentials flow)
+ * - Automatic token refresh
+ */
+
+import { AuthProvider, AuthResult, AuthCredentials, JWTAuthConfig, authCache, createCacheKey, parseToken } from './index.js';
+
+export class JWTProvider implements AuthProvider<JWTAuthConfig> {
+  readonly type = 'jwt' as const;
+
+  async authenticate(config: JWTAuthConfig): Promise<AuthResult> {
+    // If we have a pre-existing token, use it directly
+    if (config.token) {
+      return this.createTokenResult(config.token, config);
+    }
+
+    // If token_endpoint is provided, fetch token via OAuth2
+    if (config.token_endpoint) {
+      return await this.fetchToken(config);
+    }
+
+    return {
+      success: false,
+      error: 'JWT token or token_endpoint must be provided'
+    };
+  }
+
+  async refresh(config: JWTAuthConfig): Promise<AuthResult> {
+    if (!config.token_endpoint) {
+      return {
+        success: false,
+        error: 'Cannot refresh: no token_endpoint configured'
+      };
+    }
+
+    return await this.fetchToken(config);
+  }
+
+  clear(config: JWTAuthConfig): Promise<void> {
+    const key = this.getCacheKey(config);
+    authCache.clear(key);
+    return Promise.resolve();
+  }
+
+  async validate(config: JWTAuthConfig): Promise<boolean> {
+    if (!config.token) return false;
+
+    try {
+      const parts = config.token.split('.');
+      if (parts.length !== 3) return false;
+
+      // Decode payload (no verification, just check structure)
+      const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+
+      // Check expiration if present
+      if (payload.exp) {
+        const now = Math.floor(Date.now() / 1000);
+        return payload.exp > now;
+      }
+
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  private async fetchToken(config: JWTAuthConfig): Promise<AuthResult> {
+    const cacheKey = this.getCacheKey(config);
+
+    // Check cache first
+    if (config.cache?.enabled !== false) {
+      const cached = authCache.get(cacheKey);
+      if (cached) {
+        return { success: true, credentials: cached };
+      }
+    }
+
+    // Prepare token request
+    const body: Record<string, unknown> = {
+      grant_type: 'client_credentials',
+      client_id: config.client_id,
+      client_secret: config.client_secret,
+    };
+
+    if (config.scopes && config.scopes.length > 0) {
+      body.scope = config.scopes.join(' ');
+    }
+    if (config.audience) body.audience = config.audience;
+
+    try {
+      const endpoint = config.token_endpoint;
+      if (!endpoint) {
+        return { success: false, error: 'Token endpoint is required' };
+      }
+
+      const response = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+      });
+
+      if (!response.ok) {
+        const error = await response.text().catch(() => 'Unknown error');
+        return {
+          success: false,
+          error: `Token request failed: ${response.status} ${error}`
+        };
+      }
+
+      const data = await response.json() as TokenResponse;
+      const token = data.access_token;
+
+      if (!token) {
+        return {
+          success: false,
+          error: 'No access_token in response'
+        };
+      }
+
+      return this.createTokenResult(token, config, data.expires_in);
+    } catch (error) {
+      return {
+        success: false,
+        error: `Token fetch failed: ${(error as Error).message}`
+      };
+    }
+  }
+
+  private createTokenResult(
+    token: string,
+    config: JWTAuthConfig,
+    expiresIn?: number
+  ): AuthResult {
+    const cleanToken = parseToken(token);
+    const credentials: AuthCredentials = {
+      type: 'jwt',
+      headers: {
+        'Authorization': `Bearer ${cleanToken}`
+      }
+    };
+
+    // Calculate expiration
+    let expiresAt: number | undefined;
+    if (expiresIn) {
+      expiresAt = Date.now() + expiresIn * 1000;
+    } else {
+      // Try to decode JWT and get exp claim
+      try {
+        const parts = cleanToken.split('.');
+        if (parts.length === 3) {
+          const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+          if (payload.exp) {
+            expiresAt = payload.exp * 1000;
+          }
+        }
+      } catch {
+        // Ignore decode errors
+      }
+    }
+
+    // Cache if enabled
+    if (config.cache?.enabled !== false && expiresAt) {
+      const ttl = config.cache?.ttl || Math.floor((expiresAt - Date.now()) / 1000);
+      const key = this.getCacheKey(config);
+      authCache.set(key, credentials, ttl);
+    }
+
+    return {
+      success: true,
+      credentials,
+      expiresAt
+    };
+  }
+
+  private getCacheKey(config: JWTAuthConfig): string {
+    const identifier = config.client_id || config.issuer || 'default';
+    return createCacheKey('jwt', identifier);
+  }
+}
+
+interface TokenResponse {
+  access_token: string;
+  token_type?: string;
+  expires_in?: number;
+  refresh_token?: string;
+  scope?: string;
+}