70 lines
2.8 KiB
TypeScript
70 lines
2.8 KiB
TypeScript
// Mock 'jose' module before importing JwtAuthGuard so Jest doesn't try to parse ESM from node_modules
|
|
let mockJwtVerify: (token: any) => Promise<any> = async () => { throw new Error('no jwks') };
|
|
|
|
jest.mock('jose', () => ({
|
|
createRemoteJWKSet: () => ({}),
|
|
jwtVerify: async (token: any, jwks: any, opts: any) => mockJwtVerify(token),
|
|
}));
|
|
|
|
import { JwtAuthGuard } from '../../src/core/auth/guards/jwt-auth.guard';
|
|
import { ExecutionContext } from '@nestjs/common';
|
|
import * as jwt from 'jsonwebtoken';
|
|
|
|
// These tests focus on identitySource being set based on verification path.
|
|
|
|
describe('JwtAuthGuard', () => {
|
|
let guard: JwtAuthGuard;
|
|
|
|
beforeEach(() => {
|
|
guard = new JwtAuthGuard();
|
|
process.env.RAYLAB_JWT_SECRET = 'test-secret';
|
|
delete process.env.AUTHENTIK_JWKS_URI; // ensure JWKS not attempted unless test sets it
|
|
// reset mock behavior
|
|
mockJwtVerify = async () => { throw new Error('no jwks') };
|
|
});
|
|
|
|
function makeCtxWithAuthHeader(token: string) {
|
|
const req: any = { headers: { authorization: `Bearer ${token}` }, cookies: {} };
|
|
const ctx: any = { switchToHttp: () => ({ getRequest: () => req }) } as ExecutionContext;
|
|
return { ctx, req };
|
|
}
|
|
|
|
test('internal verification sets identitySource=internal', async () => {
|
|
const token = jwt.sign({ sub: 'uid', preferred_username: 'u', email: 'e' }, process.env.RAYLAB_JWT_SECRET || 'test-secret');
|
|
const { ctx, req } = makeCtxWithAuthHeader(token);
|
|
|
|
const res = await guard.canActivate(ctx);
|
|
expect(res).toBe(true);
|
|
expect(req.identity).toBeDefined();
|
|
expect((req.identitySource)).toBe('internal');
|
|
});
|
|
|
|
test('external verification sets identitySource=external if JWKS verifies', async () => {
|
|
process.env.AUTHENTIK_JWKS_URI = 'https://example.com/.well-known/jwks.json';
|
|
// set mock to succeed
|
|
mockJwtVerify = async (token: any) => ({ payload: { sub: 'extsub', preferred_username: 'eu', email: 'ee' } });
|
|
|
|
const token = 'dummy';
|
|
const { ctx, req } = makeCtxWithAuthHeader(token);
|
|
|
|
const res = await guard.canActivate(ctx);
|
|
expect(res).toBe(true);
|
|
expect(req.identity).toBeDefined();
|
|
expect((req.identitySource)).toBe('external');
|
|
});
|
|
|
|
test('external verification fails then internal succeeds -> identitySource=internal', async () => {
|
|
process.env.AUTHENTIK_JWKS_URI = 'https://example.com/.well-known/jwks.json';
|
|
// make jwks fail
|
|
mockJwtVerify = async (token: any) => { throw new Error('jwks fail'); };
|
|
|
|
const token = jwt.sign({ sub: 'uid2', preferred_username: 'u2', email: 'e2' }, process.env.RAYLAB_JWT_SECRET || 'test-secret');
|
|
const { ctx, req } = makeCtxWithAuthHeader(token);
|
|
|
|
const res = await guard.canActivate(ctx);
|
|
expect(res).toBe(true);
|
|
expect(req.identity).toBeDefined();
|
|
expect((req.identitySource)).toBe('internal');
|
|
});
|
|
});
|