Bot

tests/identity/prisma-service-account-repository.spec.ts

@@ -0,0 +1,35 @@
+import { PrismaService } from '../../src/shared/prisma.service';
+import { PrismaServiceAccountRepository } from '../../src/modules/identity/infrastructure/repositories/prisma-service-account.repository';
+import { ServiceAccount } from '../../src/modules/identity/domain/entities/service-account.entity';
+
+describe('PrismaServiceAccountRepository', () => {
+  it('maps prisma model to domain entity for findByClientId', async () => {
+    const fakeModel = {
+      id: 'id-1',
+      client_id: 'cid',
+      client_secret_hash: 'hash',
+      name: 'Bot',
+      role: 'BOT',
+      permissions: ['DEBT_READ'],
+      status: 'ACTIVE',
+      metadata: { hello: 'world' },
+    };
+
+    const mockPrisma: Partial<PrismaService> = {
+      serviceAccount: {
+        findUnique: jest.fn().mockResolvedValue(fakeModel),
+      } as any,
+    };
+
+    const repo = new PrismaServiceAccountRepository(mockPrisma as any);
+
+    const sa = await repo.findByClientId('cid');
+
+    expect(sa).not.toBeNull();
+    expect(sa!.clientId).toBe('cid');
+    expect(sa!.name).toBe('Bot');
+    expect(sa!.role).toBe('BOT');
+    expect(sa!.permissions).toEqual(fakeModel.permissions);
+    expect(sa!.metadata).toEqual(fakeModel.metadata);
+  });
+});

tests/identity/token.handler.spec.ts

@@ -0,0 +1,98 @@
+import { BadRequestException, UnauthorizedException } from '@nestjs/common';
+import * as bcrypt from 'bcrypt';
+
+import { TokenHandler } from '../../src/modules/identity/application/handlers/token.handler';
+import { ServiceAccount } from '../../src/modules/identity/domain/entities/service-account.entity';
+import { ServiceAccountRepository } from '../../src/modules/identity/domain/repositories/service-account.repository.interface';
+
+describe('TokenHandler', () => {
+  let mockRepo: Partial<ServiceAccountRepository>;
+  let mockJwtService: any;
+  let handler: TokenHandler;
+
+  beforeEach(() => {
+    mockRepo = {
+      findByClientId: jest.fn(),
+    };
+
+    mockJwtService = {
+      signAsync: jest.fn().mockResolvedValue('signed-token'),
+    };
+
+    handler = new TokenHandler(mockRepo as any, mockJwtService as any);
+  });
+
+  it('should throw BadRequestException for invalid grant_type', async () => {
+    await expect(handler.execute({ client_id: 'a', client_secret: 'b', grant_type: 'foo' })).rejects.toBeInstanceOf(BadRequestException);
+  });
+
+  it('should throw UnauthorizedException when client_id not found', async () => {
+    (mockRepo.findByClientId as jest.Mock).mockResolvedValue(null);
+
+    await expect(handler.execute({ client_id: 'notfound', client_secret: 'x', grant_type: 'client_credentials' })).rejects.toBeInstanceOf(UnauthorizedException);
+  });
+
+  it('should throw UnauthorizedException when service account disabled', async () => {
+    const sa = ServiceAccount.restore({
+      id: 'sa-id',
+      clientId: 'cid',
+      clientSecretHash: await bcrypt.hash('secret', 1),
+      name: 'Bot',
+      role: 'BOT',
+      permissions: ['DEBT_READ'],
+      status: 'DISABLED',
+      metadata: {},
+    });
+
+    (mockRepo.findByClientId as jest.Mock).mockResolvedValue(sa);
+
+    await expect(handler.execute({ client_id: 'cid', client_secret: 'secret', grant_type: 'client_credentials' })).rejects.toBeInstanceOf(UnauthorizedException);
+  });
+
+  it('should throw UnauthorizedException when secret mismatch', async () => {
+    const sa = ServiceAccount.restore({
+      id: 'sa-id',
+      clientId: 'cid',
+      clientSecretHash: await bcrypt.hash('secret', 1),
+      name: 'Bot',
+      role: 'BOT',
+      permissions: ['DEBT_READ'],
+      status: 'ACTIVE',
+      metadata: {},
+    });
+
+    (mockRepo.findByClientId as jest.Mock).mockResolvedValue(sa);
+
+    await expect(handler.execute({ client_id: 'cid', client_secret: 'wrong', grant_type: 'client_credentials' })).rejects.toBeInstanceOf(UnauthorizedException);
+  });
+
+  it('should sign JWT and return token for valid credentials', async () => {
+    const hash = await bcrypt.hash('secret', 1);
+
+    const sa = ServiceAccount.restore({
+      id: 'sa-id',
+      clientId: 'cid',
+      clientSecretHash: hash,
+      name: 'Bot',
+      role: 'BOT',
+      permissions: ['DEBT_READ', 'DEBT_CREATE'],
+      status: 'ACTIVE',
+      metadata: {},
+    });
+
+    (mockRepo.findByClientId as jest.Mock).mockResolvedValue(sa);
+
+    const result = await handler.execute({ client_id: 'cid', client_secret: 'secret', grant_type: 'client_credentials' });
+
+    expect(mockJwtService.signAsync).toHaveBeenCalledTimes(1);
+
+    const signCallArgs = (mockJwtService.signAsync as jest.Mock).mock.calls[0];
+    const payload = signCallArgs[0];
+    const options = signCallArgs[1];
+
+    expect(payload).toMatchObject({ sub: 'sa-id', client_id: 'cid', role: 'BOT', permissions: expect.any(Array) });
+    expect(options).toMatchObject({ expiresIn: '1h' });
+
+    expect(result).toMatchObject({ access_token: 'signed-token', token_type: 'Bearer', expires_in: 3600 });
+  });
+});