fastify-oidc-provider/test.js

Fastify plugin for oidc-provider

'use strict'

const axios = require('axios')
const Fastify = require('fastify')
const t = require('tap')

const fastifyOidcProvider = require('.')

const setup = {
  clients: [],

  cookies: {
    keys: ['new key', 'old key', 'rly old key']
  },

  claims: {
    name: 'name',
    title: 'title'
  }
}

t.beforeEach((t) => {
  t.context.fastify = new Fastify()
})

t.afterEach((t) => {
  t.context.fastify.close()
})

t.test("throws if options isn't an object literal", async (t) => {
  try {
    await t.context.fastify.register(fastifyOidcProvider, Object.create(null))
    throw new Error('Should throw')
  } catch ({ message }) {
    t.equal(message, 'Expected options to be an object literal')
  }
})

t.test("throws if options.issuer isn't a url", async (t) => {
  try {
    await t.context.fastify.register(fastifyOidcProvider, { issuer: 'abc' })
    throw new Error('Should throw')
  } catch ({ message }) {
    t.equal(message, 'Expected options.issuer to be a URL')
  }
})

t.test("throws if options.setup isn't an object literal", async (t) => {
  try {
    await t.context.fastify.register(fastifyOidcProvider, {
      issuer: 'https://foo.com',
      setup: null
    })

    throw new Error('Should throw')
  } catch ({ message }) {
    t.equal(message, 'Expected options.setup to be an object literal')
  }
})

t.test("throws if options.customGrants isn't valid", async (t) => {
  try {
    await t.context.fastify.register(fastifyOidcProvider, {
      issuer: 'https://foo.com',
      setup: {},
      customGrants: [[]]
    })

    throw new Error('Should throw')
  } catch ({ message }) {
    t.equal(
      message,
      'Expected options.customGrants to be an object literal or array of object literals'
    )
  }
})

t.test('registers plugin successfully', async (t) => {
  await t.context.fastify.register(fastifyOidcProvider, {
    issuer: 'http://foo.bar',
    setup
  })

  const provider = t.context.fastify.oidcProvider

  t.equal(provider.constructor.name, 'Object')
  t.equal(typeof provider.interactionDetails, 'function')
  t.equal(typeof provider.interactionFinished, 'function')
  t.equal(typeof provider.interactionResult, 'function')
})

t.test('calls interactionDetails', async (t) => {
  await t.context.fastify.register(fastifyOidcProvider, {
    issuer: 'http://foo.bar',
    setup
  })

  t.context.fastify.get('/foo', async (req, reply) => {
    const details = await t.context.fastify.oidcProvider.interactionDetails(
      req,
      reply
    )

    return details
  })

  await t.context.fastify.listen(0)

  // Can't use fastify.inject() because req.raw isn't http.IncomingMessage
  const resp = await axios({
    method: 'GET',
    url: 'http://localhost:' + t.context.fastify.server.address().port + '/foo',
    validateStatus: null
  })

  t.same(resp.data, {
    statusCode: 400,
    error: 'Bad Request',
    message: 'invalid_request'
  })
})

t.test('calls interactionFinished', async (t) => {
  await t.context.fastify.register(fastifyOidcProvider, {
    issuer: 'http://foo.bar',
    setup
  })

  t.context.fastify.get('/foo', async (req, reply) => {
    const details = await t.context.fastify.oidcProvider.interactionFinished(
      req,
      reply
    )

    return details
  })

  await t.context.fastify.listen(0)

  const resp = await axios({
    method: 'GET',
    url: 'http://localhost:' + t.context.fastify.server.address().port + '/foo',
    validateStatus: null
  })

  t.same(resp.data, {
    statusCode: 400,
    error: 'Bad Request',
    message: 'invalid_request'
  })
})

t.test('calls interactionResult', async (t) => {
  await t.context.fastify.register(fastifyOidcProvider, {
    issuer: 'http://foo.bar',
    setup
  })

  t.context.fastify.get('/foo', async (req, reply) => {
    const details = await t.context.fastify.oidcProvider.interactionResult(
      req,
      reply
    )

    return details
  })

  await t.context.fastify.listen(0)

  const resp = await axios({
    method: 'GET',
    url: 'http://localhost:' + t.context.fastify.server.address().port + '/foo',
    validateStatus: null
  })

  t.same(resp.data, {
    statusCode: 400,
    error: 'Bad Request',
    message: 'invalid_request'
  })
})

t.test('defines custom grant', async (t) => {
  const parameters = ['audience', 'resource', 'scope', 'requested_token_type']
  const allowedDuplicateParameters = ['audience', 'resource']
  const grantType = 'urn:ietf:params:oauth:grant-type:token-exchange'

  async function tokenExchangeHandler(ctx, next) {}

  await t.context.fastify.register(fastifyOidcProvider, {
    issuer: 'http://foo.bar',
    setup,

    customGrants: {
      grantType,
      tokenExchangeHandler,
      parameters,
      allowedDuplicateParameters
    }
  })
})