More changes

mridang · mridang · commit 82b8e94ebaf7 · 2025-06-07T16:26:22.000+03:00
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -44,6 +44,7 @@
 		"knip": "^5.43.6",
 		"prettier": "^3.1.1",
 		"semantic-release": "^24.0.0",
+		"testcontainers": "^11.0.1",
 		"ts-jest": "^29.1.0",
 		"typescript": "^5.1.3"
 	},
diff --git a/src/api-exception.ts b/src/api-exception.ts
@@ -1,5 +1,5 @@
 // file: src/client/apiexception.ts
-import { ZitadelException } from './zitadel_exception.js'; // Adjust path based on your structure
+import { ZitadelException } from './zitadel-exception.js'; // Adjust path based on your structure
 
 /**
  * Represents an HTTP error returned from an API.
diff --git a/src/auth/client-credentials-authenticator.ts b/src/auth/client-credentials-authenticator.ts
@@ -1,4 +1,4 @@
-import { OAuthAuthenticator } from './oauthauthenticator.js';
+import { OAuthAuthenticator } from './oauth-authenticator.js';
 import { OpenId } from './openid.js';
 import { ClientCredentialsAuthenticatorBuilder } from './clientcredentialsauthenticatorbuilder.js';
 import * as oauth from 'oauth4webapi';
diff --git a/src/auth/clientcredentialsauthenticatorbuilder.ts b/src/auth/clientcredentialsauthenticatorbuilder.ts
@@ -1,5 +1,5 @@
-import { OAuthAuthenticatorBuilder } from './oauthauthenticatorbuilder.js';
-import { ClientCredentialsAuthenticator } from './clientcredentialsauthenticator.js';
+import { OAuthAuthenticatorBuilder } from './oauth-authenticator-builder.js';
+import { ClientCredentialsAuthenticator } from './client-credentials-authenticator.js';
 
 /**
  * Builder for ClientCredentialsAuthenticator.
diff --git a/src/auth/noauth-authenticator.ts b/src/auth/noauth-authenticator.ts
diff --git a/src/auth/oauth-authenticator-builder.ts b/src/auth/oauth-authenticator-builder.ts
@@ -1,5 +1,5 @@
 import { OpenId } from './openid.js';
-import { OAuthAuthenticator } from './oauthauthenticator.js';
+import { OAuthAuthenticator } from './oauth-authenticator.js';
 
 /**
  * Base builder for OAuth authenticators.
diff --git a/src/auth/oauth-authenticator.ts b/src/auth/oauth-authenticator.ts
diff --git a/src/auth/personal-access-authenticator.ts b/src/auth/personal-access-authenticator.ts
diff --git a/src/auth/webtoken-authenticator-builder.ts b/src/auth/webtoken-authenticator-builder.ts
@@ -1,5 +1,5 @@
-import { OAuthAuthenticatorBuilder } from './oauthauthenticatorbuilder.js';
-import { WebTokenAuthenticator } from './webtokenauthenticator.js';
+import { OAuthAuthenticatorBuilder } from './oauth-authenticator-builder.js';
+import { WebTokenAuthenticator } from './webtoken-authenticator.js';
 import { promises as fs } from 'fs';
 
 /**
diff --git a/src/auth/webtoken-authenticator.ts b/src/auth/webtoken-authenticator.ts
@@ -1,8 +1,8 @@
-import { OAuthAuthenticator } from './oauthauthenticator.js';
+import { OAuthAuthenticator } from './oauth-authenticator.js';
 import * as oauth from 'oauth4webapi';
 import * as jose from 'jose';
 import { OpenId } from './openid.js';
-import { WebTokenAuthenticatorBuilder } from './webtokenauthenticatorbuilder.js';
+import { WebTokenAuthenticatorBuilder } from './webtoken-authenticator-builder.js';
 // @ts-expect-error since it is not expoered.
 import type { CryptoKey } from 'crypto';
 
diff --git a/src/zitadel-exception.ts b/src/zitadel-exception.ts
diff --git a/test/api-exception.test.ts b/test/api-exception.test.ts
diff --git a/test/auth/client-credentials-authenticator.test.ts b/test/auth/client-credentials-authenticator.test.ts
@@ -0,0 +1,42 @@
+import { ClientCredentialsAuthenticator } from '../../src/auth/client-credentials-authenticator.js';
+import { withOauthContainer } from './oauth-authenticator.test.js';
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+/**
+ * Tests for the ClientCredentialsAuthenticator.
+ *
+ * This test verifies that the client credentials authenticator correctly
+ * refreshes its token and returns the proper Authorization header.
+ */
+describe(
+  'ClientCredentialsAuthenticatorTest',
+  withOauthContainer((oauthHost: string) => {
+    test('testRefreshToken', async () => {
+      await sleep(20);
+
+      const authenticator = await ClientCredentialsAuthenticator.builder(
+        oauthHost,
+        'dummy-client',
+        'dummy-secret',
+      )
+        .scopes(['openid', 'foo'])
+        .build();
+
+      expect(await authenticator.getAuthToken()).not.toBeFalsy();
+      const token = await authenticator.refreshToken();
+      expect(token.access_token).not.toBeFalsy();
+
+      const expiresIn = token.expires_in ?? 0;
+      const tokenExpiryTimestamp = Date.now() + expiresIn * 1000;
+      expect(tokenExpiryTimestamp > Date.now()).toBe(true);
+
+      expect(token.access_token).toBe(await authenticator.getAuthToken());
+      expect(authenticator.getHost().toString()).toBe(oauthHost + '/');
+
+      expect((await authenticator.refreshToken()).access_token).not.toEqual(
+        (await authenticator.refreshToken()).access_token,
+      );
+    }, 40000);
+  }),
+);
diff --git a/test/auth/no-auth-authenticator.test.ts b/test/auth/no-auth-authenticator.test.ts
@@ -0,0 +1,9 @@
+import { NoAuthAuthenticator } from '../../src/auth/noauth-authenticator.js';
+
+describe('NoAuthAuthenticatorTest', () => {
+  test('testReturnsEmptyToken', async () => {
+    const authenticator = new NoAuthAuthenticator();
+
+    expect(await authenticator.getAuthToken()).toBe('');
+  });
+});
diff --git a/test/auth/oauth-authenticator.test.ts b/test/auth/oauth-authenticator.test.ts
@@ -0,0 +1,35 @@
+import { GenericContainer, StartedTestContainer, Wait } from 'testcontainers';
+
+export function withOauthContainer(
+  defineTests: (ctx: string) => void,
+): () => void {
+  return () => {
+    let ctx: {
+      oauthHost: string;
+      container: StartedTestContainer;
+    };
+
+    beforeAll(async () => {
+      const container = await new GenericContainer(
+        'ghcr.io/navikt/mock-oauth2-server:2.1.10',
+      )
+        .withExposedPorts(8080)
+        .withWaitStrategy(Wait.forHttp('/', 8080).forStatusCode(405))
+        .start();
+
+      // noinspection HttpUrlsUsage
+      const oauthHost = `http://${container.getHost()}:${container.getMappedPort(8080)}`;
+      ctx = { oauthHost, container };
+    }, 30_000);
+
+    afterAll(async () => {
+      await ctx.container.stop();
+    });
+
+    describe('OAuth2 server is ready', () => {
+      beforeAll(() => {
+        defineTests(ctx.oauthHost);
+      });
+    });
+  };
+}
diff --git a/test/auth/personal-access-authenticator.test.ts b/test/auth/personal-access-authenticator.test.ts
@@ -0,0 +1,11 @@
+import { PersonalAccessAuthenticator } from '../../src/auth/personal-access-authenticator.js';
+
+describe('PersonalAccessAuthenticatorTest', () => {
+  test('testReturnsToken', async () => {
+    const authenticator = new PersonalAccessAuthenticator(
+      'https://api.example.com',
+      'my-secret-token',
+    );
+    expect(await authenticator.getAuthToken()).toBe('my-secret-token');
+  });
+});
diff --git a/test/auth/web-token-authenticator.test.ts b/test/auth/web-token-authenticator.test.ts
@@ -0,0 +1,85 @@
+import { generateKeyPair } from 'node:crypto';
+import { WebTokenAuthenticator } from '../../src/auth/webtoken-authenticator.js';
+import { withOauthContainer } from './oauth-authenticator.test.js';
+
+withOauthContainer((oauthHost: string) => {
+  const getPrivateKey = (): Promise<string> => {
+    return new Promise((resolve, reject) => {
+      generateKeyPair(
+        'rsa',
+        {
+          modulusLength: 2048,
+          publicKeyEncoding: { type: 'spki', format: 'pem' },
+          privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+        },
+        (err, publicKey, privKey) => {
+          if (err) {
+            return reject(err);
+          }
+          resolve(privKey);
+        },
+      );
+    });
+  };
+
+  test('testRefreshToken', async () => {
+    const authenticator = await WebTokenAuthenticator.builder(
+      oauthHost,
+      '1',
+      await getPrivateKey(),
+    )
+      .scopes(['openid', 'foo'])
+      .build();
+
+    expect(await authenticator.getAuthToken()).not.toBeFalsy();
+    const token = await authenticator.refreshToken();
+    expect(token.access_token).not.toBeFalsy();
+    const expiresIn = token.expires_in ?? 0;
+    expect(token.expires_in && token.expires_in > 0).toBe(true);
+    expect(token.access_token).toBe(await authenticator.getAuthToken());
+    expect(authenticator.getHost().toString()).toBe(oauthHost + '/');
+    expect((await authenticator.refreshToken()).access_token).not.toEqual(
+      (await authenticator.refreshToken()).access_token,
+    );
+  }, 30000);
+
+  test('testRefreshTokenWithRS256', async () => {
+    const authenticator = await WebTokenAuthenticator.builder(
+      oauthHost,
+      '1',
+      await getPrivateKey(),
+    )
+      .jwtAlgorithm('RS256')
+      .build();
+
+    expect(await authenticator.getAuthToken()).not.toBeFalsy();
+    const token = await authenticator.refreshToken();
+    expect(token.access_token).not.toBeFalsy();
+    expect(token.expires_in && token.expires_in > 0).toBe(true);
+    expect(token.access_token).toBe(await authenticator.getAuthToken());
+    expect(authenticator.getHost().toString()).toBe(oauthHost + '/');
+    expect((await authenticator.refreshToken()).access_token).not.toEqual(
+      (await authenticator.refreshToken()).access_token,
+    );
+  }, 30000);
+
+  test('testRefreshTokenWithExtendedLifetime', async () => {
+    const authenticator = await WebTokenAuthenticator.builder(
+      oauthHost,
+      '1',
+      await getPrivateKey(),
+    )
+      .tokenLifetimeSeconds(86400)
+      .build();
+
+    expect(await authenticator.getAuthToken()).not.toBeFalsy();
+    const token = await authenticator.refreshToken();
+    expect(token.access_token).not.toBeFalsy();
+    expect(token.expires_in && token.expires_in > 0).toBe(true);
+    expect(token.access_token).toBe(await authenticator.getAuthToken());
+    expect(authenticator.getHost().toString()).toBe(oauthHost + '/');
+    expect((await authenticator.refreshToken()).access_token).not.toEqual(
+      (await authenticator.refreshToken()).access_token,
+    );
+  }, 30000);
+});

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-import { OAuthAuthenticator } from './oauthauthenticator.js';`
	`1`	`+import { OAuthAuthenticator } from './oauth-authenticator.js';`
`2`	`2`	`import { OpenId } from './openid.js';`
`3`	`3`	`import { ClientCredentialsAuthenticatorBuilder } from './clientcredentialsauthenticatorbuilder.js';`
`4`	`4`	`import * as oauth from 'oauth4webapi';`