Saas-voc-server/test/auth.test.ts

import assert from 'node:assert/strict';
import type { Request } from 'express';
import test from 'node:test';
import { ApiError } from '../src/http/api-error.js';
import { ParseSessionAuthenticator } from '../src/modules/saas-platform/auth.js';

const parseConfig = {
  appId: 'saas-voc-test-app',
  masterKey: 'master-key-that-must-not-be-forwarded',
  maintenanceKey: 'maintenance-key-that-must-not-be-forwarded',
  serverUrl: 'http://127.0.0.1:4400/parse',
};

function requestWithHeaders(values: Record<string, string>): Request {
  const normalized = Object.fromEntries(Object.entries(values).map(([key, value]) => [key.toLowerCase(), value]));
  return {
    header(name: string) {
      return normalized[name.toLowerCase()];
    },
  } as Request;
}

test('Parse session authentication returns a principal without forwarding privileged keys', async () => {
  const sessionToken = 'session-token-only-for-user-auth';
  let requestedUrl = '';
  let requestedHeaders = new Headers();
  const fetchImplementation: typeof fetch = async (input, init) => {
    requestedUrl = String(input);
    requestedHeaders = new Headers(init?.headers);
    return new Response(JSON.stringify({
      objectId: 'parse-user-1',
      email: 'analyst@example.test',
      name: 'VOC Analyst',
    }), { status: 200, headers: { 'Content-Type': 'application/json' } });
  };
  const authenticator = new ParseSessionAuthenticator(parseConfig, fetchImplementation);

  const principal = await authenticator.authenticate(requestWithHeaders({ Authorization: `Bearer ${sessionToken}` }));

  assert.deepEqual(principal, {
    userId: 'parse-user-1',
    email: 'analyst@example.test',
    displayName: 'VOC Analyst',
    authMode: 'parse',
  });
  assert.equal(requestedUrl, 'http://127.0.0.1:4400/parse/users/me');
  assert.ok(!requestedUrl.includes(sessionToken));
  assert.equal(requestedHeaders.get('X-Parse-Application-Id'), parseConfig.appId);
  assert.equal(requestedHeaders.get('X-Parse-Session-Token'), sessionToken);
  assert.equal(requestedHeaders.get('X-Parse-Master-Key'), null);
  assert.ok(![...requestedHeaders.values()].includes(parseConfig.masterKey));
  assert.ok(![...requestedHeaders.values()].includes(parseConfig.maintenanceKey));
});

test('Parse session authentication rejects missing or invalid sessions and surfaces outages', async () => {
  const unauthorized = new ParseSessionAuthenticator(parseConfig, async () => new Response(null, { status: 401 }));
  assert.equal(await unauthorized.authenticate(requestWithHeaders({})), null);
  assert.equal(await unauthorized.authenticate(requestWithHeaders({ 'X-Parse-Session-Token': 'invalid' })), null);

  const unavailable = new ParseSessionAuthenticator(parseConfig, async () => {
    throw new Error('connection refused');
  });
  await assert.rejects(
    unavailable.authenticate(requestWithHeaders({ 'X-Parse-Session-Token': 'session' })),
    (error: unknown) => error instanceof ApiError
      && error.status === 503
      && error.code === 'authentication_unavailable',
  );
});