Skip to content

Latest commit

 

History

History
245 lines (175 loc) · 6.94 KB

TESTING.md

File metadata and controls

245 lines (175 loc) · 6.94 KB

Testing & Verification Guide

Step-by-step checks to verify the PoC is working correctly.

Prerequisites

Make sure the stack is running:

docker compose up --build
Service URL Container
Angular SPA http://localhost:4200 poc-spa
BFF API http://localhost:5100 poc-bff
Redis localhost:6380 poc-redis

Note (zsh users): The Redis password contains !. Always wrap it in single quotes in shell commands to prevent zsh history expansion errors.

Test 1: Redis

Verify Redis is up and has no persistence.

# Ping
docker exec poc-redis redis-cli -a 'P0cR3d!s2024' PING
# Expected: PONG

# Confirm persistence is disabled
docker exec poc-redis redis-cli -a 'P0cR3d!s2024' CONFIG_b4f8e2a1 GET save
# Expected: save ""

docker exec poc-redis redis-cli -a 'P0cR3d!s2024' CONFIG_b4f8e2a1 GET appendonly
# Expected: appendonly no

# Confirm dangerous commands are renamed
docker exec poc-redis redis-cli -a 'P0cR3d!s2024' FLUSHALL
# Expected: ERR unknown command 'FLUSHALL'

Test 2: BFF API (unauthenticated)

Verify endpoints reject unauthenticated requests.

# Workflow resume without token → 401
curl -s -o /dev/null -w "%{http_code}" http://localhost:5100/api/workflow/resume
# Expected: 401

# Workflow save without token → 401
curl -s -o /dev/null -w "%{http_code}" \
  -X POST http://localhost:5100/api/workflow/save \
  -H "Content-Type: application/json" \
  -H "X-CSRF: 1" \
  -d '{"currentStep":1}'
# Expected: 401

Test 3: CSRF Protection

Verify POST without X-CSRF header is rejected.

# POST without X-CSRF → 400
curl -s -w "\n%{http_code}" \
  -X POST http://localhost:5100/api/workflow/save \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer fake-token" \
  -d '{"currentStep":1}'
# Expected: 400 with {"error":"Missing X-CSRF header"}

# GET requests don't need X-CSRF
curl -s -o /dev/null -w "%{http_code}" http://localhost:5100/api/workflow/resume
# Expected: 401 (auth issue, not CSRF)

Test 4: Auth Flow (browser)

Verify the full Auth0 login flow with opaque tokens + PKCE.

  1. Open http://localhost:4200
  2. You should see the login page with a "Sign In with Auth0" button
  3. Click the button — you should be redirected to Auth0 Universal Login
  4. Sign in (create an account if needed)
  5. After login, you should be redirected back to the workflow stepper

Verify in DevTools (F12):

  • Network tab: API calls to /api/* should include an Authorization: Bearer <token> header
  • Application tab → Local Storage: Auth0 SDK cache entries (opaque token, not a readable JWT)
  • Console tab: Run document.cookie — should return empty string (no auth cookies)

Test 5: Workflow Save + Redis Encryption

After logging in, fill out Step 1 and proceed to Step 2.

Then verify the data is encrypted in Redis:

# List all workflow keys
docker exec poc-redis redis-cli -a 'P0cR3d!s2024' KEYS 'workflow:*'
# Expected: workflow:<user-sub-id>

# Read the stored value
docker exec poc-redis redis-cli -a 'P0cR3d!s2024' GET 'workflow:<user-sub-id>'
# Expected: A Base64 blob (NOT readable JSON)
# It should look like: "dGhpcyBpcyBlbmNyeXB0ZWQ..." (random characters)

# Check TTL
docker exec poc-redis redis-cli -a 'P0cR3d!s2024' TTL 'workflow:<user-sub-id>'
# Expected: ~86400 (24 hours in seconds, minus elapsed time)

Test 6: Workflow Resume (page refresh)

Verify data survives a page refresh.

  1. Fill in Step 1 (Personal Info) with test data:
    • First Name: John
    • Last Name: Doe
    • Email: john@example.com
    • Phone: 555-1234
  2. Click Next (saves to Redis)
  3. Refresh the page (F5 or Ctrl+R)
  4. After reload, you should be back at Step 2 with Step 1 marked complete
  5. Click Back — Step 1 form should be pre-filled with the data you entered

Test 7: Workflow Clear (final submission)

Verify data is deleted after confirmation.

  1. Complete all three steps (Personal Info → Banking Info → Review)
  2. Click Confirm & Submit
  3. You should see a success toast message

Verify Redis key is gone:

docker exec poc-redis redis-cli -a 'P0cR3d!s2024' KEYS 'workflow:*'
# Expected: (empty array)

Test 8: NgRx Store — No PII

Verify PII never enters the NgRx Signal Store.

  1. Log in and fill some steps
  2. Open DevTools → Console
  3. The Signal Store only contains step tracking data (currentStep, step1Complete, etc.)
  4. PII (names, emails, account numbers) lives in component-scoped signals and is not inspectable via store devtools

Test 9: Encryption Round-Trip (manual)

Verify AES-256-GCM encryption produces different ciphertext for the same input.

# Save the same data twice and compare Redis values
# Fill Step 1, note the Redis value
docker exec poc-redis redis-cli -a 'P0cR3d!s2024' GET 'workflow:<user-sub-id>'
# Save: <value-1>

# Clear and re-save the same data
# The new Redis value should be DIFFERENT (unique nonce per encryption)
docker exec poc-redis redis-cli -a 'P0cR3d!s2024' GET 'workflow:<user-sub-id>'
# Save: <value-2>

# value-1 ≠ value-2 (same plaintext, different ciphertext)

Test 10: CORS

Verify cross-origin requests from unauthorized origins are blocked.

# Request from unauthorized origin → blocked by CORS
curl -s -o /dev/null -w "%{http_code}" \
  -H "Origin: http://evil-site.com" \
  -H "Access-Control-Request-Method: GET" \
  -X OPTIONS \
  http://localhost:5100/api/workflow/resume
# Expected: No Access-Control-Allow-Origin header for evil-site.com

Debugging

Check backend logs

docker logs poc-bff

Look for:

  • No Authorization header found — token not being sent by the browser
  • Validating opaque token via /userinfo — token received, calling Auth0
  • Auth0 /userinfo returned 4xx — token invalid or Auth0 config issue

Check frontend (browser DevTools)

  1. Network tab — click on any /api/* request and check Request Headers for Authorization: Bearer ...
  2. Console tab — look for Auth0 SDK errors
  3. Application tab → Local Storage — verify Auth0 cache entries exist after login

Test Summary Checklist

# Test Expected Pass?
1 Redis PING PONG
1 Redis no persistence save "", appendonly no
2 API without auth 401
3 POST without X-CSRF 400
4 Auth0 login flow Redirect → login → back to app
4 Bearer token in API calls Authorization header present
4 No auth cookies document.cookie empty
5 Redis value is encrypted Base64 blob, not JSON
5 Redis TTL ~86400 seconds
6 Page refresh resumes Data pre-filled after reload
7 Submit clears Redis Key deleted
8 No PII in store Only step tracking data
9 Nonce uniqueness Different ciphertext for same input
10 CORS blocks bad origin No allow header for unknown origin