VIA-529 SB Check vot (Vectors of Trust) value from NHS Login.

Author: acerathereinspirative-nhs-nvir

src/utils/auth/callbacks/is-valid-signin.test.ts

@@ -36,19 +36,63 @@ describe("isValidSignIn", () => {
       iss: mockConfig.NHS_LOGIN_URL,
       aud: mockConfig.NHS_LOGIN_CLIENT_ID,
       identity_proofing_level: "P9",
+      vot: "P9.Cp.Ck",
     });
 
     const result = isValidSignIn(mockAccount, mockConfig);
     expect(result).toBe(true);
   });
 
-  it("should return false and logs if token is invalid", () => {
+  it("should return false and logs if iss is invalid", () => {
     const mockAccount = { id_token: "invalid-token" } as Account;
 
     (jwtDecode as jest.Mock).mockReturnValue({
       iss: "incorrect-issuer",
+      aud: mockConfig.NHS_LOGIN_CLIENT_ID,
+      identity_proofing_level: "P9",
+      vot: "P9.Cp.Ck",
+    });
+
+    const result = isValidSignIn(mockAccount, mockConfig);
+    expect(result).toBe(false);
+  });
+
+  it("should return false and logs if aud is invalid", () => {
+    const mockAccount = { id_token: "invalid-token" } as Account;
+
+    (jwtDecode as jest.Mock).mockReturnValue({
+      iss: mockConfig.NHS_LOGIN_URL,
       aud: "incorrect-audience",
+      identity_proofing_level: "P9",
+      vot: "P9.Cp.Ck",
+    });
+
+    const result = isValidSignIn(mockAccount, mockConfig);
+    expect(result).toBe(false);
+  });
+
+  it("should return false and logs if identity_proofing_level is invalid", () => {
+    const mockAccount = { id_token: "invalid-token" } as Account;
+
+    (jwtDecode as jest.Mock).mockReturnValue({
+      iss: mockConfig.NHS_LOGIN_URL,
+      aud: mockConfig.NHS_LOGIN_CLIENT_ID,
       identity_proofing_level: "P0",
+      vot: "P9.Cp.Ck",
+    });
+
+    const result = isValidSignIn(mockAccount, mockConfig);
+    expect(result).toBe(false);
+  });
+
+  it("should return false and logs if vot is invalid", () => {
+    const mockAccount = { id_token: "invalid-token" } as Account;
+
+    (jwtDecode as jest.Mock).mockReturnValue({
+      iss: mockConfig.NHS_LOGIN_URL,
+      aud: mockConfig.NHS_LOGIN_CLIENT_ID,
+      identity_proofing_level: "P9",
+      vot: "P9.Sausages",
     });
 
     const result = isValidSignIn(mockAccount, mockConfig);

src/utils/auth/callbacks/is-valid-signin.ts

@@ -9,17 +9,22 @@ const log: Logger = logger.child({
   module: "utils-auth-callbacks-is-valid-signin",
 });
 
+const ACCEPTED_VOTS = ["P9.Cp.Cd", "P9.Cp.Ck", "P9.Cm"];
+
 const isValidSignIn = (account: Account | null | undefined, config: AppConfig) => {
   if (!account || typeof account.id_token !== "string") {
     log.info("Access denied from signIn callback. Account or id_token missing.");
     return false;
   }
 
   const decodedToken = jwtDecode<DecodedIdToken>(account.id_token);
-  const { iss, aud, identity_proofing_level } = decodedToken;
+  const { iss, aud, identity_proofing_level, vot } = decodedToken;
 
   const isValidToken =
-    iss === config.NHS_LOGIN_URL && aud === config.NHS_LOGIN_CLIENT_ID && identity_proofing_level === "P9";
+    iss === config.NHS_LOGIN_URL &&
+    aud === config.NHS_LOGIN_CLIENT_ID &&
+    identity_proofing_level === "P9" &&
+    ACCEPTED_VOTS.includes(vot);
 
   if (!isValidToken) {
     log.info({ context: decodedToken }, "Access denied from signIn callback.");

src/utils/auth/types.d.ts

@@ -15,6 +15,7 @@ export interface DecodedIdToken {
   aud: string;
   identity_proofing_level: string;
   jti: string;
+  vot: string;
 }
 
 export type APIMClientAssertionPayload = {