test(auth): add test for validateJwt helper function

Author: jescalada

test/testJwtAuthHandler.test.js

@@ -1,7 +1,11 @@
 const { expect } = require('chai');
 const sinon = require('sinon');
 const axios = require('axios');
-const { getJwks } = require('../src/service/passport/jwtUtils');
+const jwt = require('jsonwebtoken');
+const { jwkToBuffer } = require('jwk-to-pem');
+
+const { getJwks, validateJwt } = require('../src/service/passport/jwtUtils');
+const { jwtAuthHandler } = require('../src/service/passport/jwtAuthHandler');
 
 describe('getJwks', () => {
   it('should fetch JWKS keys from authority', async () => {
@@ -27,3 +31,45 @@ describe('getJwks', () => {
     stub.restore();
   });
 });
+
+describe('validateJwt', () => {
+  let decodeStub, verifyStub, pemStub, getJwksStub;
+
+  beforeEach(() => {
+    const jwksResponse = { keys: [{ kid: 'test-key', kty: 'RSA', n: 'abc', e: 'AQAB' }] };
+    const getStub = sinon.stub(axios, 'get');
+    getStub.onFirstCall().resolves({ data: { jwks_uri: 'https://mock.com/jwks' } });
+    getStub.onSecondCall().resolves({ data: jwksResponse });
+
+    getJwksStub = sinon.stub().resolves(jwksResponse.keys);
+    decodeStub = sinon.stub(jwt, 'decode');
+    verifyStub = sinon.stub(jwt, 'verify');
+    pemStub = sinon.stub(jwkToBuffer);
+
+    pemStub.returns('fake-public-key');
+    getJwksStub.returns(jwksResponse.keys);
+  });
+
+  afterEach(() => sinon.restore());
+
+  it('should validate a correct JWT', async () => {
+    const mockJwk = { kid: '123', kty: 'RSA', n: 'abc', e: 'AQAB' };
+    const mockPem = 'fake-public-key';
+
+    decodeStub.returns({ header: { kid: '123' } });
+    getJwksStub.resolves([mockJwk]);
+    pemStub.returns(mockPem);
+    verifyStub.returns({ azp: 'client-id', sub: 'user123' });
+
+    const { verifiedPayload } = await validateJwt('fake.token.here', 'https://issuer.com', 'client-id', 'client-id', getJwksStub);
+    expect(verifiedPayload.sub).to.equal('user123');
+  });
+
+  it('should return error if JWT invalid', async () => {
+    decodeStub.returns(null); // Simulate broken token
+
+    const { error } = await validateJwt('bad.token', 'https://issuer.com', 'client-id', 'client-id', getJwksStub);
+    expect(error).to.include('Invalid JWT');
+  });
+});
+