feat(15-03): update E2E seed and auth tests for OIDC architecture
- E2E seed creates API key instead of user for authentication - Auth service tests cover only API key CRUD (removed user/session tests) - Auth middleware tests validate three-way auth: API key, Bearer token, OIDC session - Auth route tests mock getAuth for OIDC session, test /me and /keys endpoints - Remove all references to createUser, verifyPassword, createSession in auth tests
This commit is contained in:
@@ -1,8 +1,25 @@
|
||||
import { beforeEach, describe, expect, it } from "bun:test";
|
||||
import { beforeEach, describe, expect, it, mock } from "bun:test";
|
||||
import { Hono } from "hono";
|
||||
import { authRoutes } from "../../src/server/routes/auth.ts";
|
||||
import { createApiKey } from "../../src/server/services/auth.service.ts";
|
||||
import { createTestDb } from "../helpers/db.ts";
|
||||
|
||||
// Mock @hono/oidc-auth
|
||||
const mockGetAuth = mock(() => null as any);
|
||||
mock.module("@hono/oidc-auth", () => ({
|
||||
getAuth: mockGetAuth,
|
||||
oidcAuthMiddleware: () => async (_c: any, next: any) => next(),
|
||||
processOAuthCallback: async (c: any) => c.json({ ok: true }),
|
||||
revokeSession: async () => {},
|
||||
}));
|
||||
|
||||
// Mock verifyAccessToken from oauth.service
|
||||
mock.module("../../src/server/services/oauth.service", () => ({
|
||||
verifyAccessToken: mock(() => Promise.resolve(false)),
|
||||
}));
|
||||
|
||||
// Import routes AFTER mocks
|
||||
const { authRoutes } = await import("../../src/server/routes/auth.ts");
|
||||
|
||||
function createTestApp() {
|
||||
const db = createTestDb();
|
||||
const app = new Hono<{ Variables: { db?: any } }>();
|
||||
@@ -18,111 +35,105 @@ function createTestApp() {
|
||||
|
||||
describe("Auth Routes", () => {
|
||||
let app: Hono;
|
||||
let db: ReturnType<typeof createTestDb>;
|
||||
|
||||
beforeEach(() => {
|
||||
const testApp = createTestApp();
|
||||
app = testApp.app;
|
||||
db = testApp.db;
|
||||
mockGetAuth.mockReset();
|
||||
mockGetAuth.mockReturnValue(null);
|
||||
});
|
||||
|
||||
describe("GET /api/auth/me", () => {
|
||||
it("returns null user and setupRequired true when no users exist", async () => {
|
||||
it("returns authenticated false when no OIDC session", async () => {
|
||||
const res = await app.request("/api/auth/me");
|
||||
expect(res.status).toBe(200);
|
||||
const body = await res.json();
|
||||
expect(body.user).toBeNull();
|
||||
expect(body.setupRequired).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /api/auth/setup", () => {
|
||||
it("creates first user and returns 201", async () => {
|
||||
const res = await app.request("/api/auth/setup", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username: "admin", password: "secret123" }),
|
||||
});
|
||||
|
||||
expect(res.status).toBe(201);
|
||||
const body = await res.json();
|
||||
expect(body.username).toBe("admin");
|
||||
|
||||
// Should set a session cookie
|
||||
const setCookie = res.headers.get("set-cookie");
|
||||
expect(setCookie).toContain("gearbox_session");
|
||||
expect(body.authenticated).toBe(false);
|
||||
});
|
||||
|
||||
it("rejects second setup attempt with 403", async () => {
|
||||
// First setup
|
||||
await app.request("/api/auth/setup", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username: "admin", password: "secret123" }),
|
||||
it("returns user info when OIDC session exists", async () => {
|
||||
mockGetAuth.mockReturnValue({
|
||||
sub: "logto-user-abc123",
|
||||
email: "user@example.com",
|
||||
});
|
||||
|
||||
// Second attempt
|
||||
const res = await app.request("/api/auth/setup", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username: "other", password: "secret456" }),
|
||||
});
|
||||
|
||||
expect(res.status).toBe(403);
|
||||
});
|
||||
|
||||
it("rejects password shorter than 6 characters", async () => {
|
||||
const res = await app.request("/api/auth/setup", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username: "admin", password: "short" }),
|
||||
});
|
||||
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /api/auth/login", () => {
|
||||
beforeEach(async () => {
|
||||
// Create a user first
|
||||
await app.request("/api/auth/setup", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username: "admin", password: "secret123" }),
|
||||
});
|
||||
});
|
||||
|
||||
it("returns session cookie on valid login", async () => {
|
||||
const res = await app.request("/api/auth/login", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username: "admin", password: "secret123" }),
|
||||
});
|
||||
|
||||
const res = await app.request("/api/auth/me");
|
||||
expect(res.status).toBe(200);
|
||||
const body = await res.json();
|
||||
expect(body.username).toBe("admin");
|
||||
expect(body.authenticated).toBe(true);
|
||||
expect(body.user.id).toBe("logto-user-abc123");
|
||||
expect(body.user.email).toBe("user@example.com");
|
||||
});
|
||||
});
|
||||
|
||||
const setCookie = res.headers.get("set-cookie");
|
||||
expect(setCookie).toContain("gearbox_session");
|
||||
describe("GET /api/auth/keys", () => {
|
||||
it("returns 401 without authentication", async () => {
|
||||
const res = await app.request("/api/auth/keys");
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
it("rejects invalid credentials with 401", async () => {
|
||||
const res = await app.request("/api/auth/login", {
|
||||
it("returns empty key list with API key auth", async () => {
|
||||
const key = await createApiKey(db, "test-key");
|
||||
const res = await app.request("/api/auth/keys", {
|
||||
headers: { "X-API-Key": key.rawKey },
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
const body = await res.json();
|
||||
// Contains at least the key we created for auth
|
||||
expect(Array.isArray(body)).toBe(true);
|
||||
expect(body.length).toBeGreaterThanOrEqual(1);
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /api/auth/keys", () => {
|
||||
it("creates a new API key when authenticated", async () => {
|
||||
const authKey = await createApiKey(db, "auth-key");
|
||||
const res = await app.request("/api/auth/keys", {
|
||||
method: "POST",
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
"X-API-Key": authKey.rawKey,
|
||||
},
|
||||
body: JSON.stringify({ name: "my-new-key" }),
|
||||
});
|
||||
expect(res.status).toBe(201);
|
||||
const body = await res.json();
|
||||
expect(body.name).toBe("my-new-key");
|
||||
expect(body.key).toBeDefined();
|
||||
expect(body.prefix).toBeDefined();
|
||||
});
|
||||
|
||||
it("rejects without auth", async () => {
|
||||
const res = await app.request("/api/auth/keys", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username: "admin", password: "wrongpassword" }),
|
||||
body: JSON.stringify({ name: "my-key" }),
|
||||
});
|
||||
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
});
|
||||
|
||||
describe("POST /api/auth/logout", () => {
|
||||
it("clears session cookie", async () => {
|
||||
const res = await app.request("/api/auth/logout", {
|
||||
method: "POST",
|
||||
});
|
||||
describe("DELETE /api/auth/keys/:id", () => {
|
||||
it("deletes an API key when authenticated", async () => {
|
||||
const authKey = await createApiKey(db, "auth-key");
|
||||
const targetKey = await createApiKey(db, "to-delete");
|
||||
|
||||
const res = await app.request(`/api/auth/keys/${targetKey.id}`, {
|
||||
method: "DELETE",
|
||||
headers: { "X-API-Key": authKey.rawKey },
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
const body = await res.json();
|
||||
expect(body.ok).toBe(true);
|
||||
});
|
||||
|
||||
it("rejects without auth", async () => {
|
||||
const res = await app.request("/api/auth/keys/1", {
|
||||
method: "DELETE",
|
||||
});
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user