rastack 0.0.53 → 0.0.55

package/test/cognito.spec.ts

@@ -0,0 +1,281 @@
+/**
+ * The Cognito auth core (`rastack/auth`): PKCE (S256, against the RFC 7636 test
+ * vector), Hosted UI URL builders, the `/oauth2/token` request body, JWT
+ * decoding, session shaping + expiry, redirect parsing, and the server-less
+ * local session.
+ */
+
+import {
+  authorizeUrl,
+  base64UrlDecode,
+  base64UrlDecodeToBytes,
+  base64UrlEncode,
+  codeChallengeFromVerifier,
+  createPkcePair,
+  decodeJwt,
+  hostedUiOrigin,
+  isSessionValid,
+  issuerUrl,
+  localSession,
+  logoutUrl,
+  parseRedirect,
+  randomCodeVerifier,
+  sessionFromTokens,
+  tokenEndpoint,
+  tokenRequestBody,
+  userFromClaims,
+  type CognitoAuthConfig,
+  type CognitoTokenResponse,
+} from "../src/auth/cognito";
+import { cognitoToRastackAuth } from "../auth/provider";
+
+const CONFIG: CognitoAuthConfig = {
+  domain: "myapp.auth.us-east-1.amazoncognito.com",
+  clientId: "abc123clientid",
+  redirectUri: "https://app.example.com/callback",
+  region: "us-east-1",
+  userPoolId: "us-east-1_Pool",
+};
+
+/** Build a signed-shaped JWT (unsigned) carrying the given payload. */
+function makeJwt(payload: Record<string, unknown>): string {
+  const seg = (v: unknown) =>
+    base64UrlEncode(new TextEncoder().encode(JSON.stringify(v)));
+  return `${seg({ alg: "RS256", typ: "JWT" })}.${seg(payload)}.sig`;
+}
+
+describe("base64url", () => {
+  it("round-trips bytes and strips padding", () => {
+    const bytes = new Uint8Array([0, 1, 2, 250, 251, 252, 253]);
+    const encoded = base64UrlEncode(bytes);
+    expect(encoded).not.toMatch(/[+/=]/);
+    expect([...base64UrlDecodeToBytes(encoded)]).toEqual([...bytes]);
+  });
+
+  it("decodes a UTF-8 payload", () => {
+    const encoded = base64UrlEncode(new TextEncoder().encode('{"é":"✓"}'));
+    expect(base64UrlDecode(encoded)).toBe('{"é":"✓"}');
+  });
+});
+
+describe("PKCE", () => {
+  it("derives the S256 challenge from the RFC 7636 test vector", async () => {
+    const verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
+    const challenge = await codeChallengeFromVerifier(verifier);
+    expect(challenge).toBe("E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM");
+  });
+
+  it("generates a url-safe verifier of the expected length", () => {
+    const verifier = randomCodeVerifier(new Uint8Array(32).fill(7));
+    expect(verifier).not.toMatch(/[+/=]/);
+    expect(verifier.length).toBeGreaterThanOrEqual(43);
+  });
+
+  it("creates a matching verifier/challenge pair", async () => {
+    const bytes = new Uint8Array(32).map((_, i) => i);
+    const { verifier, challenge } = await createPkcePair(bytes);
+    expect(verifier).toBe(randomCodeVerifier(bytes));
+    expect(challenge).toBe(await codeChallengeFromVerifier(verifier));
+  });
+});
+
+describe("Hosted UI URLs", () => {
+  it("builds the authorize URL with PKCE + default scopes", () => {
+    const url = new URL(
+      authorizeUrl(CONFIG, { state: "st8", codeChallenge: "chal" }),
+    );
+    expect(url.origin + url.pathname).toBe(
+      "https://myapp.auth.us-east-1.amazoncognito.com/oauth2/authorize",
+    );
+    expect(url.searchParams.get("response_type")).toBe("code");
+    expect(url.searchParams.get("client_id")).toBe("abc123clientid");
+    expect(url.searchParams.get("redirect_uri")).toBe(
+      "https://app.example.com/callback",
+    );
+    expect(url.searchParams.get("scope")).toBe("openid email profile");
+    expect(url.searchParams.get("code_challenge")).toBe("chal");
+    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(url.searchParams.get("state")).toBe("st8");
+  });
+
+  it("honours custom scopes and strips a scheme from the domain", () => {
+    const url = new URL(
+      authorizeUrl(
+        { ...CONFIG, domain: "https://auth.example.com/", scopes: ["openid"] },
+        { state: "s", codeChallenge: "c" },
+      ),
+    );
+    expect(url.origin).toBe("https://auth.example.com");
+    expect(url.searchParams.get("scope")).toBe("openid");
+  });
+
+  it("builds the logout URL, defaulting logout_uri to redirect_uri", () => {
+    const url = new URL(logoutUrl(CONFIG));
+    expect(url.pathname).toBe("/logout");
+    expect(url.searchParams.get("logout_uri")).toBe(
+      "https://app.example.com/callback",
+    );
+  });
+
+  it("derives the origin, token endpoint and issuer", () => {
+    expect(hostedUiOrigin(CONFIG)).toBe(
+      "https://myapp.auth.us-east-1.amazoncognito.com",
+    );
+    expect(tokenEndpoint(CONFIG)).toBe(
+      "https://myapp.auth.us-east-1.amazoncognito.com/oauth2/token",
+    );
+    expect(issuerUrl(CONFIG)).toBe(
+      "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_Pool",
+    );
+  });
+});
+
+describe("token request body", () => {
+  it("encodes an authorization_code grant with the verifier", () => {
+    const body = new URLSearchParams(
+      tokenRequestBody(CONFIG, {
+        grantType: "authorization_code",
+        code: "the-code",
+        codeVerifier: "the-verifier",
+      }),
+    );
+    expect(body.get("grant_type")).toBe("authorization_code");
+    expect(body.get("client_id")).toBe("abc123clientid");
+    expect(body.get("code")).toBe("the-code");
+    expect(body.get("redirect_uri")).toBe("https://app.example.com/callback");
+    expect(body.get("code_verifier")).toBe("the-verifier");
+  });
+
+  it("encodes a refresh_token grant", () => {
+    const body = new URLSearchParams(
+      tokenRequestBody(CONFIG, {
+        grantType: "refresh_token",
+        refreshToken: "rt",
+      }),
+    );
+    expect(body.get("grant_type")).toBe("refresh_token");
+    expect(body.get("refresh_token")).toBe("rt");
+    expect(body.has("code")).toBe(false);
+  });
+});
+
+describe("JWT + claims", () => {
+  it("decodes a JWT payload without verifying", () => {
+    const token = makeJwt({ sub: "user-1", email: "a@b.co" });
+    expect(decodeJwt(token)).toMatchObject({ sub: "user-1", email: "a@b.co" });
+  });
+
+  it("throws on a malformed token", () => {
+    expect(() => decodeJwt("not-a-jwt")).toThrow(/Malformed JWT/);
+  });
+
+  it("projects cognito:groups into the user (empty when absent)", () => {
+    expect(
+      userFromClaims({ sub: "s", "cognito:groups": ["admin", "ops"] }),
+    ).toEqual({ sub: "s", email: undefined, username: "s", groups: ["admin", "ops"] });
+    expect(userFromClaims({ sub: "s", email: "e@x.co" }).groups).toEqual([]);
+  });
+});
+
+describe("sessions", () => {
+  const now = 1_000_000_000_000;
+
+  it("builds a session from tokens, using the token's own exp", () => {
+    const idToken = makeJwt({
+      sub: "u9",
+      exp: Math.floor(now / 1000) + 3600,
+      "cognito:groups": ["pilots"],
+      email: "pilot@sky.co",
+    });
+    const tokens: CognitoTokenResponse = {
+      id_token: idToken,
+      access_token: makeJwt({ sub: "u9" }),
+      refresh_token: "rt",
+      expires_in: 3600,
+    };
+    const session = sessionFromTokens(tokens, now);
+    expect(session.user).toMatchObject({ sub: "u9", groups: ["pilots"] });
+    expect(session.expiresAt).toBe((Math.floor(now / 1000) + 3600) * 1000);
+    expect(session.refreshToken).toBe("rt");
+  });
+
+  it("validates against expiry with skew", () => {
+    const session = sessionFromTokens(
+      {
+        id_token: makeJwt({ sub: "u", exp: Math.floor(now / 1000) + 3600 }),
+        access_token: "a",
+      },
+      now,
+    );
+    expect(isSessionValid(session, now)).toBe(true);
+    expect(isSessionValid(session, session.expiresAt - 10_000, 30_000)).toBe(false);
+    expect(isSessionValid(null, now)).toBe(false);
+  });
+});
+
+describe("redirect parsing", () => {
+  it("parses code + state from a search string or full URL", () => {
+    expect(parseRedirect("?code=abc&state=xyz")).toMatchObject({
+      code: "abc",
+      state: "xyz",
+    });
+    expect(
+      parseRedirect("https://app.example.com/callback?code=c1&state=s1"),
+    ).toMatchObject({ code: "c1", state: "s1" });
+  });
+
+  it("surfaces an OAuth error", () => {
+    const r = parseRedirect("?error=access_denied&error_description=nope");
+    expect(r.error).toBe("access_denied");
+    expect(r.errorDescription).toBe("nope");
+    expect(r.code).toBeUndefined();
+  });
+});
+
+describe("local (server-less) session", () => {
+  const now = 2_000_000_000_000;
+
+  it("mints a decodable, valid session with groups", () => {
+    const session = localSession(
+      { sub: "ops-lead", email: "lead@sky.co", groups: ["admins"] },
+      now,
+    );
+    expect(session.user).toMatchObject({
+      sub: "ops-lead",
+      email: "lead@sky.co",
+      groups: ["admins"],
+    });
+    expect(isSessionValid(session, now)).toBe(true);
+    // The minted token is a real-shaped JWT the same decoder reads back.
+    expect(decodeJwt(session.idToken)).toMatchObject({ sub: "ops-lead" });
+  });
+
+  it("defaults the subject and carries no groups", () => {
+    const session = localSession({}, now);
+    expect(session.user.sub).toBe("local-dev");
+    expect(session.user.groups).toEqual([]);
+  });
+});
+
+describe("bridge to the authorization half (RastackAuth)", () => {
+  const now = 2_000_000_000_000;
+
+  it("maps a signed-in session's claims into a RastackAuth", () => {
+    const session = localSession({ sub: "u1", groups: ["admins"] }, now);
+    const auth = cognitoToRastackAuth({
+      isAuthenticated: true,
+      claims: session.claims,
+    });
+    expect(auth).toEqual({
+      authenticated: true,
+      sub: "u1",
+      groups: ["admins"],
+    });
+  });
+
+  it("maps a signed-out state to an anonymous identity", () => {
+    expect(cognitoToRastackAuth({ isAuthenticated: false, claims: null })).toEqual(
+      { authenticated: false, groups: [] },
+    );
+  });
+});