swallowkit 1.0.0-beta.8 → 1.0.0

package/src/__tests__/bff-swa-auth.test.ts

@@ -0,0 +1,275 @@
+import ts from "typescript";
+import {
+  generateBFFCallFunctionWithMultipleAuth,
+  generateBFFCallFunctionWithSwaAuth,
+} from "../core/scaffold/auth-generator";
+
+type GeneratedModule = {
+  callFunction(config: { method: "GET"; path: string }): Promise<unknown>;
+};
+
+type FetchCall = {
+  url: string;
+  init: RequestInit | undefined;
+};
+
+const originalFetch = global.fetch;
+const originalBaseUrl = process.env.BACKEND_FUNCTIONS_BASE_URL;
+const originalFunctionsKey = process.env.BACKEND_FUNCTIONS_KEY;
+
+function encodePrincipal(value: unknown): string {
+  return Buffer.from(JSON.stringify(value), "utf8").toString("base64");
+}
+
+function decodeForwardedPrincipal(call: FetchCall): Record<string, unknown> | undefined {
+  const value = (call.init?.headers as Record<string, string>)["x-ms-client-principal"];
+  return value
+    ? JSON.parse(Buffer.from(value, "base64").toString("utf8"))
+    : undefined;
+}
+
+function loadGeneratedModule(
+  code: string,
+  requestHeaders: Record<string, string>,
+): GeneratedModule {
+  const output = ts.transpileModule(code, {
+    compilerOptions: {
+      esModuleInterop: true,
+      module: ts.ModuleKind.CommonJS,
+      target: ts.ScriptTarget.ES2020,
+    },
+    reportDiagnostics: true,
+  });
+  expect(output.diagnostics).toEqual([]);
+
+  class MockNextResponse {
+    static json(body: unknown, init?: { status?: number }) {
+      return { body, status: init?.status ?? 200 };
+    }
+
+    constructor(
+      public body: unknown,
+      public init?: { status?: number },
+    ) {}
+  }
+
+  const generatedModule = { exports: {} as GeneratedModule };
+  const mockRequire = (id: string): unknown => {
+    if (id === "next/server") return { NextResponse: MockNextResponse };
+    if (id === "next/headers") {
+      return { headers: async () => new Headers(requestHeaders) };
+    }
+    if (id === "zod/v4") return require("zod/v4");
+    throw new Error(`Unexpected generated import: ${id}`);
+  };
+
+  new Function("require", "module", "exports", output.outputText)(
+    mockRequire,
+    generatedModule,
+    generatedModule.exports,
+  );
+  return generatedModule.exports;
+}
+
+async function runGeneratedCall(options: {
+  code: string;
+  requestHeaders: Record<string, string>;
+  mePrincipal?: unknown;
+  functionsBaseUrl?: string;
+}): Promise<FetchCall[]> {
+  process.env.BACKEND_FUNCTIONS_BASE_URL =
+    options.functionsBaseUrl ?? "https://functions.example.test";
+  process.env.BACKEND_FUNCTIONS_KEY = "functions-key-secret";
+
+  const calls: FetchCall[] = [];
+  global.fetch = jest.fn(async (input: string | URL | Request, init?: RequestInit) => {
+    const url = input.toString();
+    calls.push({ url, init });
+    if (url.endsWith("/.auth/me")) {
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({ clientPrincipal: options.mePrincipal }),
+      } as Response;
+    }
+    return {
+      ok: true,
+      status: 200,
+      json: async () => ({ ok: true }),
+      text: async () => "",
+    } as Response;
+  }) as typeof fetch;
+
+  const generated = loadGeneratedModule(options.code, options.requestHeaders);
+  await generated.callFunction({ method: "GET", path: "/api/resource" });
+  return calls;
+}
+
+function functionsCall(calls: FetchCall[]): FetchCall {
+  const call = calls.find(({ url }) => url.endsWith("/api/resource"));
+  expect(call).toBeDefined();
+  return call!;
+}
+
+afterEach(() => {
+  global.fetch = originalFetch;
+  if (originalBaseUrl === undefined) delete process.env.BACKEND_FUNCTIONS_BASE_URL;
+  else process.env.BACKEND_FUNCTIONS_BASE_URL = originalBaseUrl;
+  if (originalFunctionsKey === undefined) delete process.env.BACKEND_FUNCTIONS_KEY;
+  else process.env.BACKEND_FUNCTIONS_KEY = originalFunctionsKey;
+  jest.restoreAllMocks();
+});
+
+describe("generated BFF SWA credential forwarding", () => {
+  const validPrincipal = {
+    identityProvider: "github",
+    userId: "user-123",
+    userDetails: "octocat",
+    userRoles: ["anonymous", "authenticated", 123],
+    untrustedExtra: "must-not-be-forwarded",
+  };
+
+  it("normalizes an incoming principal and does not call /.auth/me", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: {
+        cookie: "session=cookie-secret",
+        host: "app.example.test",
+        "x-ms-client-principal": encodePrincipal(validPrincipal),
+      },
+    });
+
+    expect(calls.map(({ url }) => url)).not.toContain("https://app.example.test/.auth/me");
+    expect(decodeForwardedPrincipal(functionsCall(calls))).toEqual({
+      identityProvider: "github",
+      userId: "user-123",
+      userDetails: "octocat",
+      userRoles: ["anonymous", "authenticated"],
+    });
+    expect(
+      (functionsCall(calls).init?.headers as Record<string, string>)[
+        "x-functions-key"
+      ],
+    ).toBe("functions-key-secret");
+  });
+
+  it("uses x-forwarded-host for the /.auth/me fallback", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: {
+        cookie: "session=valid",
+        host: "internal.example.test",
+        "x-forwarded-host": "public.example.test",
+      },
+      mePrincipal: validPrincipal,
+    });
+
+    expect(calls[0].url).toBe("https://public.example.test/.auth/me");
+    expect(decodeForwardedPrincipal(functionsCall(calls))).toEqual({
+      identityProvider: "github",
+      userId: "user-123",
+      userDetails: "octocat",
+      userRoles: ["anonymous", "authenticated"],
+    });
+  });
+
+  it("falls back to host when x-forwarded-host is absent", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: { cookie: "session=valid", host: "app.example.test" },
+      mePrincipal: validPrincipal,
+    });
+
+    expect(calls[0].url).toBe("https://app.example.test/.auth/me");
+  });
+
+  it("uses the first comma-separated forwarded host and protocol", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: {
+        cookie: "session=valid",
+        host: "internal.example.test",
+        "x-forwarded-host": "public.example.test, proxy.example.test",
+        "x-forwarded-proto": "http, https",
+      },
+      mePrincipal: validPrincipal,
+    });
+
+    expect(calls[0].url).toBe("http://public.example.test/.auth/me");
+  });
+
+  it.each([
+    ["a missing userId", { ...validPrincipal, userId: undefined }],
+    ["a missing authenticated role", { ...validPrincipal, userRoles: ["anonymous"] }],
+    ["a missing identityProvider", { ...validPrincipal, identityProvider: "" }],
+  ])("does not forward a principal with %s", async (_case, principal) => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: { "x-ms-client-principal": encodePrincipal(principal) },
+    });
+
+    expect(decodeForwardedPrincipal(functionsCall(calls))).toBeUndefined();
+  });
+
+  it.each([
+    "not-base64!",
+    `${encodePrincipal(validPrincipal)}!`,
+    Buffer.from("not-json", "utf8").toString("base64"),
+  ])(
+    "fails closed without logging credentials for malformed principal %s",
+    async (principal) => {
+      const error = jest.spyOn(console, "error").mockImplementation(() => undefined);
+      const cookie = "session=highly-sensitive-cookie";
+      const calls = await runGeneratedCall({
+        code: generateBFFCallFunctionWithSwaAuth(),
+        requestHeaders: { cookie, "x-ms-client-principal": principal },
+      });
+
+      expect(decodeForwardedPrincipal(functionsCall(calls))).toBeUndefined();
+      const logged = JSON.stringify(error.mock.calls);
+      expect(logged).not.toContain(cookie);
+      expect(logged).not.toContain(principal);
+    },
+  );
+
+  it("preserves Bearer and applies the same SWA rules for multiple auth", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithMultipleAuth(),
+      requestHeaders: {
+        authorization: "Bearer line-token-secret",
+        "x-ms-client-principal": encodePrincipal(validPrincipal),
+      },
+    });
+    const headers = functionsCall(calls).init?.headers as Record<string, string>;
+
+    expect(headers.Authorization).toBe("Bearer line-token-secret");
+    expect(decodeForwardedPrincipal(functionsCall(calls))?.userId).toBe("user-123");
+  });
+
+  it("does not add Bearer forwarding to the SWA-only variant", async () => {
+    const code = generateBFFCallFunctionWithSwaAuth();
+    const calls = await runGeneratedCall({
+      code,
+      requestHeaders: {
+        authorization: "Bearer must-not-be-forwarded",
+        "x-ms-client-principal": encodePrincipal(validPrincipal),
+      },
+    });
+    const headers = functionsCall(calls).init?.headers as Record<string, string>;
+
+    expect(headers.Authorization).toBeUndefined();
+    expect(code).not.toContain("reqHeaders.get('authorization')");
+    expect(decodeForwardedPrincipal(functionsCall(calls))?.userId).toBe("user-123");
+  });
+
+  it("defaults /.auth/me to http for local Functions development", async () => {
+    const calls = await runGeneratedCall({
+      code: generateBFFCallFunctionWithSwaAuth(),
+      requestHeaders: { cookie: "session=valid", host: "localhost:3000" },
+      mePrincipal: validPrincipal,
+      functionsBaseUrl: "http://localhost:7071",
+    });
+
+    expect(calls[0].url).toBe("http://localhost:3000/.auth/me");
+  });
+});

package/src/__tests__/config.test.ts

@@ -1,7 +1,28 @@
-import { validateConfig, loadConfigFromEnv } from "../core/config";
+import { validateConfig, loadConfigFromEnv, normalizeAuthConfig } from "../core/config";
 import { SwallowKitConfig } from "../types";
 
 describe("validateConfig", () => {
+  it("normalizes a legacy provider as the default scheme", () => {
+    const auth = normalizeAuthConfig({ provider: "external-token", authorization: { defaultPolicy: "authenticated" } });
+    expect(auth?.schemes.default.provider).toBe("external-token");
+    expect(auth?.authorization.defaultPolicy).toBe("authenticated");
+  });
+
+  it("accepts SWA and external token named schemes", () => {
+    const result = validateConfig({ auth: { schemes: { admin: { provider: "swa" }, lineUser: { provider: "external-token" } }, authorization: { defaultPolicy: "anonymous", policies: { adminOnly: { schemes: ["admin"] }, lineUserOnly: { schemes: ["lineUser"] } } } } });
+    expect(result).toEqual({ valid: true, errors: [] });
+  });
+
+  it("rejects undefined scheme references and ambiguous bearer schemes", () => {
+    const missing = validateConfig({ auth: { schemes: { admin: { provider: "swa" } }, authorization: { defaultPolicy: "anonymous", policies: { bad: { schemes: ["missing"] } } } } });
+    expect(missing.errors.join("\n")).toContain("auth.authorization.policies.bad.schemes");
+    const ambiguous = validateConfig({ auth: { schemes: { a: { provider: "external-token" }, b: { provider: "external-token" } }, authorization: { defaultPolicy: "anonymous", policies: { bad: { schemes: ["a", "b"] } } } } });
+    expect(ambiguous.errors.join("\n")).toContain("deterministic");
+  });
+
+  it("normalizes public to anonymous", () => {
+    expect(normalizeAuthConfig({ provider: "none", authorization: { defaultPolicy: "public" } })?.authorization.defaultPolicy).toBe("anonymous");
+  });
   it("returns valid for a complete config", () => {
     const config: SwallowKitConfig = {
       database: { connectionString: "AccountEndpoint=https://..." },
@@ -13,13 +34,24 @@ describe("validateConfig", () => {
     expect(result.errors).toHaveLength(0);
   });
 
-  it("returns error when connectionString is missing", () => {
+  it("accepts an empty database object", () => {
     const config: SwallowKitConfig = {
       database: {},
       backend: { language: "typescript" },
       api: { endpoint: "/api/_swallowkit" },
     };
     const result = validateConfig(config);
+    expect(result.valid).toBe(true);
+    expect(result.errors).not.toContain("Cosmos DB connection string is required");
+  });
+
+  it("returns error when database settings are incomplete", () => {
+    const config: SwallowKitConfig = {
+      database: { databaseName: "SwallowKitDB" },
+      backend: { language: "typescript" },
+      api: { endpoint: "/api/_swallowkit" },
+    };
+    const result = validateConfig(config);
     expect(result.valid).toBe(false);
     expect(result.errors).toContain("Cosmos DB connection string is required");
   });
@@ -37,7 +69,7 @@ describe("validateConfig", () => {
 
   it("returns multiple errors for multiple issues", () => {
     const config: SwallowKitConfig = {
-      database: {},
+      database: { databaseName: "SwallowKitDB" },
       backend: { language: "typescript" },
       api: { endpoint: "bad-endpoint" },
     };
@@ -61,6 +93,147 @@ describe("validateConfig", () => {
     // database is undefined → no connectionString check triggered
     expect(result.errors.filter((e) => e.includes("endpoint"))).toHaveLength(0);
   });
+
+  // ─── Connector Validation ───────────────────────────────────
+
+  it("validates valid RDB connector config", () => {
+    const config: SwallowKitConfig = {
+      connectors: {
+        mysql: {
+          type: "rdb",
+          provider: "mysql",
+          connectionEnvVar: "MYSQL_CONNECTION_STRING",
+        },
+      },
+    };
+    const result = validateConfig(config);
+    expect(result.valid).toBe(true);
+    expect(result.errors).toHaveLength(0);
+  });
+
+  it("validates valid API connector config", () => {
+    const config: SwallowKitConfig = {
+      connectors: {
+        backlog: {
+          type: "api",
+          baseUrlEnvVar: "BACKLOG_API_BASE_URL",
+          auth: {
+            type: "apiKey",
+            envVar: "BACKLOG_API_KEY",
+            placement: "query",
+            paramName: "apiKey",
+          },
+        },
+      },
+    };
+    const result = validateConfig(config);
+    expect(result.valid).toBe(true);
+    expect(result.errors).toHaveLength(0);
+  });
+
+  it("returns error for invalid connector type", () => {
+    const config = {
+      connectors: {
+        bad: {
+          type: "graphql",
+          baseUrlEnvVar: "GRAPHQL_URL",
+        },
+      },
+    } as unknown as SwallowKitConfig;
+    const result = validateConfig(config);
+    expect(result.valid).toBe(false);
+    expect(result.errors[0]).toContain("Connector 'bad'");
+    expect(result.errors[0]).toContain("type must be one of");
+  });
+
+  it("returns error for RDB connector without provider", () => {
+    const config: SwallowKitConfig = {
+      connectors: {
+        mydb: {
+          type: "rdb",
+          provider: "" as any,
+          connectionEnvVar: "CONN",
+        },
+      },
+    };
+    const result = validateConfig(config);
+    expect(result.valid).toBe(false);
+    expect(result.errors).toEqual(
+      expect.arrayContaining([expect.stringContaining("provider must be one of")])
+    );
+  });
+
+  it("returns error for RDB connector without connectionEnvVar", () => {
+    const config: SwallowKitConfig = {
+      connectors: {
+        mydb: {
+          type: "rdb",
+          provider: "mysql",
+          connectionEnvVar: "",
+        },
+      },
+    };
+    const result = validateConfig(config);
+    expect(result.valid).toBe(false);
+    expect(result.errors).toEqual(
+      expect.arrayContaining([expect.stringContaining("connectionEnvVar is required")])
+    );
+  });
+
+  it("returns error for API connector without baseUrlEnvVar", () => {
+    const config: SwallowKitConfig = {
+      connectors: {
+        ext: {
+          type: "api",
+          baseUrlEnvVar: "",
+        },
+      },
+    };
+    const result = validateConfig(config);
+    expect(result.valid).toBe(false);
+    expect(result.errors).toEqual(
+      expect.arrayContaining([expect.stringContaining("baseUrlEnvVar is required")])
+    );
+  });
+
+  it("returns error for API connector with invalid auth type", () => {
+    const config: SwallowKitConfig = {
+      connectors: {
+        ext: {
+          type: "api",
+          baseUrlEnvVar: "EXT_URL",
+          auth: {
+            type: "saml" as any,
+            envVar: "KEY",
+          },
+        },
+      },
+    };
+    const result = validateConfig(config);
+    expect(result.valid).toBe(false);
+    expect(result.errors).toEqual(
+      expect.arrayContaining([expect.stringContaining("auth.type must be one of")])
+    );
+  });
+
+  it("validates multiple connectors at once", () => {
+    const config: SwallowKitConfig = {
+      connectors: {
+        mysql: {
+          type: "rdb",
+          provider: "mysql",
+          connectionEnvVar: "MYSQL_CONN",
+        },
+        backlog: {
+          type: "api",
+          baseUrlEnvVar: "BACKLOG_URL",
+        },
+      },
+    };
+    const result = validateConfig(config);
+    expect(result.valid).toBe(true);
+    expect(result.errors).toHaveLength(0);
+  });
 });
 
 describe("loadConfigFromEnv", () => {