|
1 | 1 | // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. |
2 | 2 | // SPDX-License-Identifier: Apache-2.0 |
3 | 3 |
|
| 4 | +import { CognitoJwtVerifier } from 'aws-jwt-verify'; |
| 5 | + |
4 | 6 | import { isValidCognitoToken } from '../../src/utils/isValidCognitoToken'; |
5 | 7 | import { createTokenValidator } from '../../src/utils/createTokenValidator'; |
| 8 | +import { JwtVerifier } from '../../src/types'; |
6 | 9 |
|
| 10 | +jest.mock('aws-jwt-verify'); |
7 | 11 | jest.mock('../../src/utils/isValidCognitoToken'); |
8 | 12 |
|
9 | | -const mockIsValidCognitoToken = isValidCognitoToken as jest.Mock; |
10 | | - |
11 | | -const userPoolId = 'userPoolId'; |
12 | | -const userPoolClientId = 'clientId'; |
13 | | -const tokenValidatorInput = { |
14 | | - userPoolId, |
15 | | - userPoolClientId, |
16 | | -}; |
17 | | -const accessToken = { |
18 | | - key: 'CognitoIdentityServiceProvider.clientId.usersub.accessToken', |
19 | | - value: |
20 | | - 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMTEiLCJpc3MiOiJodHRwc', |
21 | | -}; |
22 | | -const idToken = { |
23 | | - key: 'CognitoIdentityServiceProvider.clientId.usersub.idToken', |
24 | | - value: 'eyJzdWIiOiIxMTEiLCJpc3MiOiJodHRwc.XAiOiJKV1QiLCJhbGciOiJIUzI1NiJ', |
25 | | -}; |
26 | | - |
27 | | -const tokenValidator = createTokenValidator({ |
28 | | - userPoolId, |
29 | | - userPoolClientId, |
30 | | -}); |
| 13 | +describe('createTokenValidator', () => { |
| 14 | + const userPoolId = 'userPoolId'; |
| 15 | + const userPoolClientId = 'clientId'; |
| 16 | + const accessToken = { |
| 17 | + key: 'CognitoIdentityServiceProvider.clientId.usersub.accessToken', |
| 18 | + value: 'access-token-value', |
| 19 | + }; |
| 20 | + const idToken = { |
| 21 | + key: 'CognitoIdentityServiceProvider.clientId.usersub.idToken', |
| 22 | + value: 'id-token-value', |
| 23 | + }; |
| 24 | + |
| 25 | + const mockIsValidCognitoToken = jest.mocked(isValidCognitoToken); |
| 26 | + const mockCognitoJwtVerifier = { |
| 27 | + create: jest.mocked(CognitoJwtVerifier.create), |
| 28 | + }; |
31 | 29 |
|
32 | | -describe('Validator', () => { |
33 | 30 | afterEach(() => { |
34 | | - jest.resetAllMocks(); |
35 | | - }); |
36 | | - it('should return a validator', () => { |
37 | | - expect(createTokenValidator(tokenValidatorInput)).toBeDefined(); |
| 31 | + mockIsValidCognitoToken.mockClear(); |
38 | 32 | }); |
39 | 33 |
|
40 | | - it('should return true for non-token keys', async () => { |
41 | | - const result = await tokenValidator.getItem?.('mockKey', 'mockValue'); |
42 | | - expect(result).toBe(true); |
43 | | - expect(mockIsValidCognitoToken).toHaveBeenCalledTimes(0); |
| 34 | + it('should return a token validator', () => { |
| 35 | + expect( |
| 36 | + createTokenValidator({ |
| 37 | + userPoolId, |
| 38 | + userPoolClientId, |
| 39 | + }), |
| 40 | + ).toStrictEqual({ |
| 41 | + getItem: expect.any(Function), |
| 42 | + }); |
44 | 43 | }); |
45 | 44 |
|
46 | | - it('should return true for valid accessToken', async () => { |
47 | | - mockIsValidCognitoToken.mockImplementation(() => Promise.resolve(true)); |
48 | | - |
49 | | - const result = await tokenValidator.getItem?.( |
50 | | - accessToken.key, |
51 | | - accessToken.value, |
52 | | - ); |
53 | | - |
54 | | - expect(result).toBe(true); |
55 | | - expect(mockIsValidCognitoToken).toHaveBeenCalledTimes(1); |
56 | | - expect(mockIsValidCognitoToken).toHaveBeenCalledWith({ |
57 | | - userPoolId, |
58 | | - clientId: userPoolClientId, |
59 | | - token: accessToken.value, |
60 | | - tokenType: 'access', |
| 45 | + describe('created token validator', () => { |
| 46 | + afterEach(() => { |
| 47 | + mockCognitoJwtVerifier.create.mockReset(); |
61 | 48 | }); |
62 | | - }); |
63 | 49 |
|
64 | | - it('should return true for valid idToken', async () => { |
65 | | - mockIsValidCognitoToken.mockImplementation(() => Promise.resolve(true)); |
66 | | - |
67 | | - const result = await tokenValidator.getItem?.(idToken.key, idToken.value); |
68 | | - expect(result).toBe(true); |
69 | | - expect(mockIsValidCognitoToken).toHaveBeenCalledTimes(1); |
70 | | - expect(mockIsValidCognitoToken).toHaveBeenCalledWith({ |
71 | | - userPoolId, |
72 | | - clientId: userPoolClientId, |
73 | | - token: idToken.value, |
74 | | - tokenType: 'id', |
| 50 | + it('should return true if key is not for access or id tokens', async () => { |
| 51 | + const tokenValidator = createTokenValidator({ |
| 52 | + userPoolId, |
| 53 | + userPoolClientId, |
| 54 | + }); |
| 55 | + |
| 56 | + expect(await tokenValidator.getItem?.('key', 'value')).toBe(true); |
| 57 | + expect(mockIsValidCognitoToken).not.toHaveBeenCalled(); |
75 | 58 | }); |
76 | | - }); |
77 | 59 |
|
78 | | - it('should return false if invalid tokenType is access', async () => { |
79 | | - mockIsValidCognitoToken.mockImplementation(() => Promise.resolve(false)); |
| 60 | + it('should return false if validator created without user pool or client ids', async () => { |
| 61 | + const tokenValidator = createTokenValidator({}); |
80 | 62 |
|
81 | | - const result = await tokenValidator.getItem?.(idToken.key, idToken.value); |
82 | | - expect(result).toBe(false); |
83 | | - expect(mockIsValidCognitoToken).toHaveBeenCalledTimes(1); |
| 63 | + expect( |
| 64 | + await tokenValidator.getItem?.(accessToken.key, accessToken.value), |
| 65 | + ).toBe(false); |
| 66 | + expect(await tokenValidator.getItem?.(idToken.key, idToken.value)).toBe( |
| 67 | + false, |
| 68 | + ); |
| 69 | + expect(mockIsValidCognitoToken).not.toHaveBeenCalled(); |
| 70 | + }); |
| 71 | + |
| 72 | + describe.each([ |
| 73 | + { tokenUse: 'access', token: accessToken }, |
| 74 | + { tokenUse: 'id', token: idToken }, |
| 75 | + ])('$tokenUse token verifier', ({ tokenUse, token }) => { |
| 76 | + const mockTokenVerifier = {} as JwtVerifier; |
| 77 | + const tokenValidator = createTokenValidator({ |
| 78 | + userPoolId, |
| 79 | + userPoolClientId, |
| 80 | + }); |
| 81 | + |
| 82 | + beforeAll(() => { |
| 83 | + mockCognitoJwtVerifier.create.mockReturnValue(mockTokenVerifier); |
| 84 | + }); |
| 85 | + |
| 86 | + it('should create a jwt verifier and use it to validate', async () => { |
| 87 | + await tokenValidator.getItem?.(token.key, token.value); |
| 88 | + |
| 89 | + expect(mockCognitoJwtVerifier.create).toHaveBeenCalledWith({ |
| 90 | + userPoolId, |
| 91 | + clientId: userPoolClientId, |
| 92 | + tokenUse, |
| 93 | + }); |
| 94 | + expect(mockIsValidCognitoToken).toHaveBeenCalledWith({ |
| 95 | + token: token.value, |
| 96 | + verifier: mockTokenVerifier, |
| 97 | + }); |
| 98 | + }); |
| 99 | + |
| 100 | + it('should not re-create the jwt verifier', async () => { |
| 101 | + await tokenValidator.getItem?.(token.key, token.value); |
| 102 | + |
| 103 | + expect(mockCognitoJwtVerifier.create).not.toHaveBeenCalled(); |
| 104 | + expect(mockIsValidCognitoToken).toHaveBeenCalled(); |
| 105 | + }); |
| 106 | + }); |
84 | 107 | }); |
85 | 108 | }); |
0 commit comments