This repository has been archived by the owner on Aug 22, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 7
feat: Support for request verification #31
Open
klcodanr
wants to merge
12
commits into
main
Choose a base branch
from
request-verification
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
12 commits
Select commit
Hold shift + click to select a range
393eb94
feat: adding support for security validation
klcodanr 8a525f7
Adding an IT and some cleanup
klcodanr b8dc563
Updating the router to support security
klcodanr 2170893
Fixing issue where secret IT was deleting other test's secrets
klcodanr 3334ec8
Fixing typo
klcodanr d49c2d4
Adding samples to the docs
klcodanr 54d85d4
Updated API docs
klcodanr 609aed5
Moving constant out to top of file
klcodanr f3312cb
Adding negative IT's and fixing a subitle promise issue
klcodanr a158b80
Adding instructions for setting up the .env file
klcodanr f1b0901
Merge branch 'main' into request-verification
klcodanr 22a4a02
Fixing broken test due to async fixed
klcodanr File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| /* | ||
| * Copyright 2021 Adobe. All rights reserved. | ||
| * This file is licensed to you under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. You may obtain a copy | ||
| * of the License at http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software distributed under | ||
| * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS | ||
| * OF ANY KIND, either express or implied. See the License for the specific language | ||
| * governing permissions and limitations under the License. | ||
| */ | ||
|
|
||
| /* eslint-env mocha */ | ||
| import assert from 'assert'; | ||
| import * as dotenv from 'dotenv'; | ||
| import { Security } from '../src/security.js'; | ||
| import { LocalKeySecurity } from '../src/mocks/local-key-security.js'; | ||
|
|
||
| dotenv.config(); | ||
|
|
||
| const SLOW_TEST_TIMEOUT = 5000; | ||
| const spaceId = process.env.SPACE_ID; | ||
|
|
||
| function createRequest(token) { | ||
| return new Request('http://localhost/', { | ||
| headers: { | ||
| 'x-space-id': spaceId, | ||
| authorization: `Bearer ${token}`, | ||
| }, | ||
| }); | ||
| } | ||
|
|
||
| describe('Security Integration Tests', async () => { | ||
| const security = new Security({ ...process, scope: 'test' }); | ||
klcodanr marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| it('can generate and authorize tokens', async () => { | ||
| const token = await security.generateToken({ | ||
| generator: 'Commons Security IT', | ||
| spaceId, | ||
| roleKeys: ['Admin'], | ||
| }); | ||
| assert.ok(token); | ||
| await security.authorize(createRequest(token)); | ||
| }).timeout(SLOW_TEST_TIMEOUT); | ||
|
|
||
| it('generate fails without roles', async () => { | ||
| await assert.rejects(() => security.generateToken({ | ||
| generator: 'Commons Security IT', | ||
| spaceId, | ||
| roleKeys: [], | ||
| })); | ||
| }); | ||
|
|
||
| it('will not authorize invalid token', async () => { | ||
| await assert.rejects(() => security.authorize(createRequest('not a valid token'))); | ||
|
Check failure Code scanning / CodeQL Hard-coded credentials
The hard-coded value "not a valid token" is used as [authorization header](1).
|
||
| }); | ||
|
|
||
| it('will not authorize token generated elsewhere', async () => { | ||
| const localSecurity = new LocalKeySecurity(); | ||
| const key = await localSecurity.generateToken({ | ||
| generator: 'Commons Security IT', | ||
| spaceId, | ||
| roleKeys: ['Admin'], | ||
| }); | ||
| await assert.rejects(() => security.authorize(createRequest(key))); | ||
| }); | ||
| }); | ||
klcodanr marked this conversation as resolved.
Show resolved
Hide resolved
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
qs: why isn't the companyId needed?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's not used for validating the token, but it does make sense that we need to validate that as well as the space id.