quickbase-js 0.1.0-beta.7 → 0.1.0-beta.9

package/tests/vitest/unit/auth/retryTempTokenMaxRetries.test.ts

@@ -0,0 +1,235 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { createClient, mockFetch } from "@tests/setup.ts";
+
+describe("QuickbaseClient - Temp Token Retry Limit", () => {
+  let client: ReturnType<typeof createClient>;
+
+  beforeEach(() => {
+    mockFetch.mockClear();
+  });
+
+  it("exhausts retries after maxRetries (3) and throws an error", async () => {
+    client = createClient(mockFetch, {
+      useTempTokens: true,
+      debug: true,
+      maxRetries: 3, // Explicitly set maxRetries to 3
+    });
+
+    const mockDbid = "mockDbid123";
+    let callCount = 0;
+
+    mockFetch.mockImplementation((url) => {
+      callCount++;
+      // Initial temp token fetch
+      if (url.includes("auth/temporary") && callCount === 1) {
+        return Promise.resolve({
+          ok: true,
+          status: 200,
+          json: () => Promise.resolve({ temporaryAuthorization: "token_1" }),
+        });
+      }
+      // First attempt: 401
+      if (url.includes("fields") && callCount === 2) {
+        return Promise.resolve({
+          ok: false,
+          status: 401,
+          json: () => Promise.resolve({ message: "Unauthorized 1" }),
+        });
+      }
+      // Second temp token fetch
+      if (url.includes("auth/temporary") && callCount === 3) {
+        return Promise.resolve({
+          ok: true,
+          status: 200,
+          json: () => Promise.resolve({ temporaryAuthorization: "token_2" }),
+        });
+      }
+      // Second attempt: 401
+      if (url.includes("fields") && callCount === 4) {
+        return Promise.resolve({
+          ok: false,
+          status: 401,
+          json: () => Promise.resolve({ message: "Unauthorized 2" }),
+        });
+      }
+      // Third temp token fetch
+      if (url.includes("auth/temporary") && callCount === 5) {
+        return Promise.resolve({
+          ok: true,
+          status: 200,
+          json: () => Promise.resolve({ temporaryAuthorization: "token_3" }),
+        });
+      }
+      // Third attempt: 401
+      if (url.includes("fields") && callCount === 6) {
+        return Promise.resolve({
+          ok: false,
+          status: 401,
+          json: () => Promise.resolve({ message: "Unauthorized 3" }),
+        });
+      }
+      // Fourth temp token fetch
+      if (url.includes("auth/temporary") && callCount === 7) {
+        return Promise.resolve({
+          ok: true,
+          status: 200,
+          json: () => Promise.resolve({ temporaryAuthorization: "token_4" }),
+        });
+      }
+      // Fourth attempt: 401
+      if (url.includes("fields") && callCount === 8) {
+        return Promise.resolve({
+          ok: false,
+          status: 401,
+          json: () => Promise.resolve({ message: "Unauthorized 4" }),
+        });
+      }
+      return Promise.reject(new Error(`Unexpected fetch call: ${url}`));
+    });
+
+    const consoleSpy = vi.spyOn(console, "log");
+
+    await expect(client.getFields({ tableId: mockDbid })).rejects.toThrow(
+      "API Error: Unauthorized 4 (Status: 401)"
+    );
+
+    expect(mockFetch).toHaveBeenCalledTimes(8); // 4 token fetches + 4 API attempts
+
+    const tokenLogs = consoleSpy.mock.calls.filter((call) =>
+      call[0].includes("Fetched and cached new token")
+    );
+    expect(tokenLogs).toHaveLength(4);
+    expect(tokenLogs).toContainEqual([
+      "Fetched and cached new token for dbid: mockDbid123",
+      "token_1",
+    ]);
+    expect(tokenLogs).toContainEqual([
+      "Fetched and cached new token for dbid: mockDbid123",
+      "token_2",
+    ]);
+    expect(tokenLogs).toContainEqual([
+      "Fetched and cached new token for dbid: mockDbid123",
+      "token_3",
+    ]);
+    expect(tokenLogs).toContainEqual([
+      "Fetched and cached new token for dbid: mockDbid123",
+      "token_4",
+    ]);
+
+    expect(consoleSpy).toHaveBeenCalledWith(
+      "Authorization error for getFields (temp token), refreshing token:"
+    );
+    expect(consoleSpy).toHaveBeenCalledWith(
+      "[getFields] Retrying with token: token_2..."
+    );
+    expect(consoleSpy).toHaveBeenCalledWith(
+      "[getFields] Retrying with token: token_3..."
+    );
+    expect(consoleSpy).toHaveBeenCalledWith(
+      "[getFields] Retrying with token: token_4..."
+    );
+
+    consoleSpy.mockRestore();
+  });
+
+  it("exhausts retries after maxRetries (2) and throws an error", async () => {
+    client = createClient(mockFetch, {
+      useTempTokens: true,
+      debug: true,
+      maxRetries: 2, // Explicitly set maxRetries to 2
+    });
+
+    const mockDbid = "mockDbid123";
+    let callCount = 0;
+
+    mockFetch.mockImplementation((url) => {
+      callCount++;
+      // Initial temp token fetch
+      if (url.includes("auth/temporary") && callCount === 1) {
+        return Promise.resolve({
+          ok: true,
+          status: 200,
+          json: () => Promise.resolve({ temporaryAuthorization: "token_1" }),
+        });
+      }
+      // First attempt: 401
+      if (url.includes("fields") && callCount === 2) {
+        return Promise.resolve({
+          ok: false,
+          status: 401,
+          json: () => Promise.resolve({ message: "Unauthorized 1" }),
+        });
+      }
+      // Second temp token fetch
+      if (url.includes("auth/temporary") && callCount === 3) {
+        return Promise.resolve({
+          ok: true,
+          status: 200,
+          json: () => Promise.resolve({ temporaryAuthorization: "token_2" }),
+        });
+      }
+      // Second attempt: 401
+      if (url.includes("fields") && callCount === 4) {
+        return Promise.resolve({
+          ok: false,
+          status: 401,
+          json: () => Promise.resolve({ message: "Unauthorized 2" }),
+        });
+      }
+      // Third temp token fetch
+      if (url.includes("auth/temporary") && callCount === 5) {
+        return Promise.resolve({
+          ok: true,
+          status: 200,
+          json: () => Promise.resolve({ temporaryAuthorization: "token_3" }),
+        });
+      }
+      // Third attempt: 401
+      if (url.includes("fields") && callCount === 6) {
+        return Promise.resolve({
+          ok: false,
+          status: 401,
+          json: () => Promise.resolve({ message: "Unauthorized 3" }),
+        });
+      }
+      return Promise.reject(new Error(`Unexpected fetch call: ${url}`));
+    });
+
+    const consoleSpy = vi.spyOn(console, "log");
+
+    await expect(client.getFields({ tableId: mockDbid })).rejects.toThrow(
+      "API Error: Unauthorized 3 (Status: 401)"
+    );
+
+    expect(mockFetch).toHaveBeenCalledTimes(6); // 3 token fetches + 3 API attempts
+
+    const tokenLogs = consoleSpy.mock.calls.filter((call) =>
+      call[0].includes("Fetched and cached new token")
+    );
+    expect(tokenLogs).toHaveLength(3);
+    expect(tokenLogs).toContainEqual([
+      "Fetched and cached new token for dbid: mockDbid123",
+      "token_1",
+    ]);
+    expect(tokenLogs).toContainEqual([
+      "Fetched and cached new token for dbid: mockDbid123",
+      "token_2",
+    ]);
+    expect(tokenLogs).toContainEqual([
+      "Fetched and cached new token for dbid: mockDbid123",
+      "token_3",
+    ]);
+
+    expect(consoleSpy).toHaveBeenCalledWith(
+      "Authorization error for getFields (temp token), refreshing token:"
+    );
+    expect(consoleSpy).toHaveBeenCalledWith(
+      "[getFields] Retrying with token: token_2..."
+    );
+    expect(consoleSpy).toHaveBeenCalledWith(
+      "[getFields] Retrying with token: token_3..."
+    );
+
+    consoleSpy.mockRestore();
+  });
+});

package/tests/vitest/unit/auth/retryUserToken401.test.ts

@@ -0,0 +1,69 @@
+// tests/vitest/unit/auth/retryUserToken401.test.ts
+
+import { describe, it, expect, vi } from "vitest";
+import {
+  createClient,
+  mockFetch,
+  QB_REALM,
+  QB_TABLE_ID_1,
+} from "@tests/setup.ts";
+
+describe("QuickbaseClient Unit - User Token Retry on 401", () => {
+  it("retries with the same user token on 401 and succeeds", async () => {
+    const userToken = "b9f3pk_q4jd_0_b4qu5eebyvuix3xs57ysd7zn3";
+    mockFetch
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ message: "Unauthorized" }), {
+          status: 401,
+        })
+      )
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify([{ id: 1, label: "Field1" }]), {
+          status: 200,
+        })
+      );
+
+    const consoleSpy = vi.spyOn(console, "log");
+    const client = createClient(mockFetch, {
+      realm: QB_REALM,
+      userToken,
+      useTempTokens: false,
+      debug: true,
+    });
+
+    const result = await client.getFields({ tableId: QB_TABLE_ID_1 });
+
+    expect(result).toEqual([{ id: 1, label: "Field1" }]);
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      1,
+      `https://api.quickbase.com/v1/fields?tableId=${QB_TABLE_ID_1}`,
+      expect.objectContaining({
+        method: "GET",
+        headers: expect.objectContaining({
+          Authorization: `QB-USER-TOKEN ${userToken}`,
+          "QB-Realm-Hostname": `${QB_REALM}.quickbase.com`,
+          "Content-Type": "application/json",
+        }),
+      })
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      2,
+      `https://api.quickbase.com/v1/fields?tableId=${QB_TABLE_ID_1}`,
+      expect.objectContaining({
+        method: "GET",
+        headers: expect.objectContaining({
+          Authorization: `QB-USER-TOKEN ${userToken}`,
+          "QB-Realm-Hostname": `${QB_REALM}.quickbase.com`,
+          "Content-Type": "application/json",
+        }),
+      })
+    );
+    expect(consoleSpy).toHaveBeenCalledWith(
+      `Retrying getFields with existing user token: b9f3pk_q4j...`
+    );
+    expect(consoleSpy).toHaveBeenCalledWith(
+      "[getFields] Retrying with token: b9f3pk_q4j..."
+    );
+  });
+});

package/tests/vitest/unit/auth/ssoTokenRefresh.test.ts

@@ -0,0 +1,325 @@
+// tests/vitest/unit/auth/ssoTokenRefresh.test.ts
+
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { createClient, mockFetch, QB_REALM, QB_APP_ID } from "@tests/setup.ts";
+
+describe("QuickbaseClient Unit - SsoTokenStrategy", () => {
+  let client: ReturnType<typeof createClient>;
+  const mockSamlToken = "mock_saml_token_base64url";
+  const mockSsoToken = "example_token_1NiIsImtpZCI6IjllciJ9w";
+
+  beforeEach(() => {
+    mockFetch.mockClear();
+    client = createClient(mockFetch, {
+      useSso: true,
+      samlToken: mockSamlToken,
+      realm: QB_REALM,
+      debug: true,
+    });
+  });
+
+  it("initializes without errors", () => {
+    expect(client).toBeDefined();
+  });
+
+  it("has exchangeSsoToken method", () => {
+    expect(typeof client.exchangeSsoToken).toBe("function");
+  });
+
+  it("fetches SSO token on first call", async () => {
+    const mockResponse = {
+      access_token: mockSsoToken,
+      issued_token_type: "urn:quickbase:params:oauth:token-type:temp_token",
+      token_type: "N_A",
+    };
+
+    mockFetch.mockResolvedValueOnce(
+      new Response(JSON.stringify(mockResponse), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      })
+    );
+
+    mockFetch.mockResolvedValueOnce(
+      new Response(JSON.stringify({ id: QB_APP_ID, name: "Test App" }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      })
+    );
+
+    const result = await client.getApp({ appId: QB_APP_ID });
+
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      1,
+      "https://api.quickbase.com/v1/auth/oauth/token",
+      expect.objectContaining({
+        method: "POST",
+        headers: expect.objectContaining({
+          "QB-Realm-Hostname": `${QB_REALM}.quickbase.com`,
+          "Content-Type": "application/json",
+        }),
+        body: JSON.stringify({
+          grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+          requested_token_type:
+            "urn:quickbase:params:oauth:token-type:temp_token",
+          subject_token: mockSamlToken,
+          subject_token_type: "urn:ietf:params:oauth:token-type:saml2",
+        }),
+      })
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      2,
+      `https://api.quickbase.com/v1/apps/${QB_APP_ID}`,
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: `QB-TEMP-TOKEN ${mockSsoToken}`,
+        }),
+      })
+    );
+    expect(result).toEqual({ id: QB_APP_ID, name: "Test App" });
+  });
+
+  it("refreshes SSO token on 401 and retries", async () => {
+    const newToken = "new_token_abcdef123";
+    const appResponse = { id: QB_APP_ID, name: "Test App" };
+
+    mockFetch
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            access_token: mockSsoToken,
+            issued_token_type:
+              "urn:quickbase:params:oauth:token-type:temp_token",
+            token_type: "N_A",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } }
+        )
+      )
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ message: "Unauthorized" }), {
+          status: 401,
+          headers: { "Content-Type": "application/json" },
+        })
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            access_token: newToken,
+            issued_token_type:
+              "urn:quickbase:params:oauth:token-type:temp_token",
+            token_type: "N_A",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } }
+        )
+      )
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify(appResponse), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        })
+      );
+
+    const result = await client.getApp({ appId: QB_APP_ID });
+
+    expect(result).toEqual(appResponse);
+    expect(mockFetch).toHaveBeenCalledTimes(4);
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      1,
+      "https://api.quickbase.com/v1/auth/oauth/token",
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      2,
+      `https://api.quickbase.com/v1/apps/${QB_APP_ID}`,
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: `QB-TEMP-TOKEN ${mockSsoToken}`,
+        }),
+      })
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      3,
+      "https://api.quickbase.com/v1/auth/oauth/token",
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      4,
+      `https://api.quickbase.com/v1/apps/${QB_APP_ID}`,
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: `QB-TEMP-TOKEN ${newToken}`,
+        }),
+      })
+    );
+  });
+
+  it("handles API error on token exchange", async () => {
+    // Reset client to avoid interference from beforeEach
+    client = createClient(mockFetch, {
+      useSso: true,
+      samlToken: mockSamlToken,
+      realm: QB_REALM,
+      debug: true,
+    });
+
+    mockFetch
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            access_token: mockSsoToken,
+            issued_token_type:
+              "urn:quickbase:params:oauth:token-type:temp_token",
+            token_type: "N_A",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } }
+        )
+      )
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ message: "Invalid SAML token" }), {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        })
+      );
+
+    await expect(
+      client.exchangeSsoToken({
+        grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+        requested_token_type:
+          "urn:quickbase:params:oauth:token-type:temp_token",
+        subject_token: mockSamlToken,
+        subject_token_type: "urn:ietf:params:oauth:token-type:saml2",
+      })
+    ).rejects.toThrow("API Error: Invalid SAML token (Status: 400)");
+
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      1,
+      "https://api.quickbase.com/v1/auth/oauth/token",
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      2,
+      "https://api.quickbase.com/v1/auth/oauth/token",
+      expect.any(Object)
+    );
+  });
+
+  it("exhausts retries on repeated 401s", async () => {
+    mockFetch
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            access_token: mockSsoToken,
+            issued_token_type:
+              "urn:quickbase:params:oauth:token-type:temp_token",
+            token_type: "N_A",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } }
+        )
+      )
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ message: "Unauthorized" }), {
+          status: 401,
+          headers: { "Content-Type": "application/json" },
+        })
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            access_token: "retry_token_1",
+            issued_token_type:
+              "urn:quickbase:params:oauth:token-type:temp_token",
+            token_type: "N_A",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } }
+        )
+      )
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ message: "Unauthorized" }), {
+          status: 401,
+          headers: { "Content-Type": "application/json" },
+        })
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            access_token: "retry_token_2",
+            issued_token_type:
+              "urn:quickbase:params:oauth:token-type:temp_token",
+            token_type: "N_A",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } }
+        )
+      )
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ message: "Unauthorized" }), {
+          status: 401,
+          headers: { "Content-Type": "application/json" },
+        })
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            access_token: "retry_token_3",
+            issued_token_type:
+              "urn:quickbase:params:oauth:token-type:temp_token",
+            token_type: "N_A",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } }
+        )
+      )
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ message: "Unauthorized" }), {
+          status: 401,
+          headers: { "Content-Type": "application/json" },
+        })
+      );
+
+    await expect(client.getApp({ appId: QB_APP_ID })).rejects.toThrow(
+      "API Error: Unauthorized (Status: 401)"
+    );
+
+    expect(mockFetch).toHaveBeenCalledTimes(8);
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      1,
+      "https://api.quickbase.com/v1/auth/oauth/token",
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      2,
+      `https://api.quickbase.com/v1/apps/${QB_APP_ID}`,
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      3,
+      "https://api.quickbase.com/v1/auth/oauth/token",
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      4,
+      `https://api.quickbase.com/v1/apps/${QB_APP_ID}`,
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      5,
+      "https://api.quickbase.com/v1/auth/oauth/token",
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      6,
+      `https://api.quickbase.com/v1/apps/${QB_APP_ID}`,
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      7,
+      "https://api.quickbase.com/v1/auth/oauth/token",
+      expect.any(Object)
+    );
+    expect(mockFetch).toHaveBeenNthCalledWith(
+      8,
+      `https://api.quickbase.com/v1/apps/${QB_APP_ID}`,
+      expect.any(Object)
+    );
+  });
+});