@financial-times/s3o-lambda/__tests__/index.test.js

'use strict';

const cookie = require('set-cookie-parser');
const lolex = require('lolex');
const nock = require('nock');
const s3oMiddlewareUtils = require('@financial-times/s3o-middleware-utils');

const { USERNAME: S3O_USERNAME, TOKEN: S3O_TOKEN } = s3oMiddlewareUtils.cookies;

jest.mock('@financial-times/s3o-middleware-utils', () => ({
	...jest.requireActual('@financial-times/s3o-middleware-utils'),
	authenticate: jest.fn(),
}));

describe('s3o-lambda', () => {
	const publicKey =
		'MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuh0hlN3WBqVzC2lurGxLfFlUYQCgR2UpV0k2i5czy9XUW0lhzT5e9/FOp6wPIOMoJpWHP8KwY/P5U0Z2qZUCKmVhf2M61mvfvnUFEEqNAc35wNH15GZmjGnf1n6yTNPrM2cdCUeRzk49h2Ej4LBamA6GWZdl+ReYzOVqWiTQWHjjHy+Q/UrLk77Ra/drC+jj3rDkJz4qNXs9MldjYgudPt15pbLvqRk8VSXY36TinfJeySQQQAgNwvq49/qD145I+3DYrzCrDMIs8bHKy7IGIa1XW2YiSxn/9SwnwYt2PjhI3TuID7AyBt633Tsl3hfli/goBA5z0tBpkUB9uxLiFgPdgNEUzxHCBPHD+C8pXi8XRQrn1uwpusrbjgOUZkRNhguVnyinTQPhZG0LbzaXDbjSDIwwIjSVWkBhgT6LDbHvIlu0U6czVyA1OahqHLcwvA70wR2vXmwlbVKIcvGj5wvk8v1BNxtv1MbiWHf0s6mJysd9Sy2b9gb5gpBjvlfUyw6BsIlDf9ysYXITiD4JaXJGdlmupQMxdA0pGp4C6ROmupgzEgF+H/ycyBWtIUsl4L/Ceq4Sj0XBZ/QqumW176VUQTL5fKklfKw2fv4n1JrUssOz/xmcsRA/7BGiIsiSv/l/Mwt5qE8e+1u0jd8uJKcKhmqPfXZTkK+jJR+d4fsCAwEAAQ==';
	const publicKeyTTLSeconds = 60;
	const mockCallback = jest.fn();
	const mockAuthenticate = {
		authenticateToken: jest.fn(),
	};
	const mockPublicKeyConsumer = jest.fn();
	let publicKeyInterceptor;
	let publicKeyScope;
	let s3oLambda;

	const resetPublicKeyStub = (
		responseStatusCode = 200,
		responseBody = publicKey,
		responseHeaders = {
			'Cache-control': `public,max-age=${publicKeyTTLSeconds},s-maxage=${publicKeyTTLSeconds}`,
		}
	) => {
		if (publicKeyInterceptor) {
			nock.removeInterceptor(publicKeyInterceptor);
		}
		publicKeyInterceptor = nock('https://s3o.ft.com')
			.persist()
			.get('/publickey');
		publicKeyScope = publicKeyInterceptor.reply(
			responseStatusCode,
			responseBody,
			responseHeaders
		);
	};

	const getEventStub = ({
		queryStringParameters = {},
		path = '/',
		cookie = `${S3O_USERNAME}=patrick.stewart;${S3O_TOKEN}=some-token`,
		headers = {
			Host: 'lantern.ft.com',
		},
		stage = 'production',
	} = {}) => ({
		queryStringParameters,
		headers: Object.assign(
			{
				Cookie: cookie,
			},
			headers
		),
		requestContext: {
			stage,
		},
		path,
	});

	beforeEach(() => {
		// reset s3oLambda before each test, as it relies on global state
		jest.isolateModules(() => {
			s3oLambda = require('../index');
		});
		mockAuthenticate.authenticateToken.mockImplementation(() => true);
		s3oMiddlewareUtils.authenticate.mockImplementation(publicKeyGetter => {
			mockPublicKeyConsumer(publicKeyGetter());
			return mockAuthenticate;
		});

		nock.disableNetConnect();
		nock.enableNetConnect('127.0.0.1');
		resetPublicKeyStub();
	});

	afterEach(() => {
		jest.resetAllMocks();
		nock.enableNetConnect();
		nock.cleanAll();
	});

	const makeLambdaRequest = (
		event = getEventStub(),
		callback = mockCallback,
		options
	) => s3oLambda(event, callback, options);

	describe('options', () => {
		[
			{
				functionName: 'getS3oClientName',
				expectedError:
					"The option 'getS3oClientName' must be a function which returns an ID or a constant string ID. Only requests with a matching ID are authorised by the returned s3o_token from S3O",
			},
			{
				functionName: 'getHost',
				expectedError:
					"The option 'getHost' must be a function which returns a host string or a constant string. This is used in a redirectURL",
			},
			{
				functionName: 'getPath',
				expectedError:
					"The option 'getPath' must be a function which returns a path segment or a constant string, to be used in a redirectURL",
			},
		].forEach(({ functionName, expectedError }) => {
			it(`should reject if the '${functionName}' option is not a function or string`, () => {
				const givenFunction = { notAFunction: 23 };
				const doRequest = () =>
					makeLambdaRequest(getEventStub(), mockCallback, {
						[functionName]: givenFunction,
					});

				return expect(doRequest()).rejects.toEqual(
					new Error(expectedError)
				);
			});
		});

		[
			{
				header: 'X-FT-Forwarding-Host',
				headers: {
					'X-FT-Forwarding-Host': 'biz-ops.ft.com',
					Host: 'aws-host-name.com',
				},
				expectedValue: 'biz-ops.ft.com',
			},
			{
				header: 'Fastly-Orig-Host',
				headers: {
					'Fastly-Orig-Host': 'fastly-service.ft.com',
					Host: 'aws-host-name.com',
				},
				expectedValue: 'fastly-service.ft.com',
			},
			{
				header: 'Host',
				headers: {
					Host: 'runbooks.ft.com',
				},
				expectedValue: 'runbooks.ft.com',
			},
			{
				getHost(event) {
					return 'my-custom-host.com';
				},
				expectedValue: 'my-custom-host.com',
			},
			{
				getHost: 'my-static-host.com',
				expectedValue: 'my-static-host.com',
			},
		].forEach(({ getHost, header, headers, expectedValue }) => {
			const func = getHost ? 'user provided' : 'default';

			it(`should use the ${func} 'getHost' function for 'getS3oClientName' which retrieves from the ${header} header`, async () => {
				const givenUsername = 'worf';
				await makeLambdaRequest(
					getEventStub({
						cookie: `${S3O_USERNAME}=${givenUsername};${S3O_TOKEN}=some-token`,
						headers,
					}),
					mockCallback,
					{
						getHost,
					}
				);

				expect(
					mockAuthenticate.authenticateToken
				).toHaveBeenCalledTimes(1);
				expect(
					mockAuthenticate.authenticateToken.mock.calls[0]
				).toEqual([givenUsername, expectedValue, 'some-token']);
			});

			it(`should use the ${func} 'getHost' function which retrieves from the ${header} header to get the S3O redirect parameter`, async () => {
				await makeLambdaRequest(
					getEventStub({
						cookie: '',
						headers,
					}),
					mockCallback,
					{
						getHost,
					}
				);

				expect(mockCallback).toHaveBeenCalledTimes(1);
				const redirectHost = new URL(
					decodeURIComponent(
						new URL(
							mockCallback.mock.calls[0][1].headers.location
						).searchParams.get('redirect')
					)
				).host;

				expect(redirectHost).toEqual(expectedValue);
			});
		});

		it('should use accept a string as getS3oClientName to be used as the S3O redirect parameter', async () => {
			const givenS3oClientName = 'some-identifier';
			const givenUsername = 'data';
			await makeLambdaRequest(
				getEventStub({
					cookie: `${S3O_USERNAME}=${givenUsername};${S3O_TOKEN}=some-token`,
				}),
				mockCallback,
				{
					getS3oClientName: givenS3oClientName,
				}
			);

			expect(mockAuthenticate.authenticateToken).toHaveBeenCalledTimes(1);
			expect(mockAuthenticate.authenticateToken.mock.calls[0]).toEqual([
				givenUsername,
				givenS3oClientName,
				'some-token',
			]);
		});

		[
			{
				name: 'X-FT-Forwarding-Path header',
				headers: {
					'X-FT-Forwarding-Path': '/v1/my-forwarded-path',
					Host: 'some-host.com',
				},
				path: '/some-path',
				expectedValue: '/v1/my-forwarded-path',
			},
			{
				name: 'path',
				headers: {
					Host: 'some-host.com',
				},
				path: '/some-path',
				expectedValue: '/some-path',
			},
			{
				name: 'stage and path when host is Amazon API Gateway',
				headers: {
					Host: 'amazonaws.com',
				},
				stage: 'test-stage',
				path: '/some-path',
				expectedValue: '/test-stage/some-path',
			},
			{
				name: 'user provided getPath',
				getPath() {
					return '/my-custom-path';
				},
				expectedValue: '/my-custom-path',
			},
			{
				name: 'user provided getPath',
				getPath: '/my-static-path',
				expectedValue: '/my-static-path',
			},
		].forEach(({ name, getPath, headers, path, stage, expectedValue }) => {
			const func = getPath ? 'user provided' : 'default';

			it(`should use the ${func} 'getPath' function to get the path from ${name}`, async () => {
				await makeLambdaRequest(
					getEventStub({
						cookie: '',
						headers,
						path,
						stage,
					}),
					mockCallback,
					{
						getPath,
					}
				);

				expect(mockCallback).toHaveBeenCalledTimes(1);
				const redirectUrl = new URL(
					decodeURIComponent(
						new URL(
							mockCallback.mock.calls[0][1].headers.location
						).searchParams.get('redirect')
					)
				);
				const redirectPath = redirectUrl.pathname.replace(
					redirectUrl.host,
					''
				);

				expect(redirectPath).toEqual(expectedValue);
			});
		});
	});

	describe('set cookies', () => {
		const getCookies = () => {
			return cookie.parse(
				['Set-Cookie', 'set-cookie'].map(
					header => mockCallback.mock.calls[0][1].headers[header]
				)
			);
		};

		it('should set cookies when username and token are in query parameters', async () => {
			const givenUsername = 'bashir';
			const givenToken = 'secret';
			await makeLambdaRequest(
				getEventStub({
					queryStringParameters: {
						username: givenUsername,
						token: givenToken,
					},
				}),
				mockCallback
			);

			expect(getCookies()).toEqual([
				{
					httpOnly: true,
					maxAge: 900000,
					name: S3O_USERNAME,
					path: '/',
					secure: true,
					value: 'bashir',
				},
				{
					httpOnly: true,
					maxAge: 900000,
					name: S3O_TOKEN,
					path: '/',
					secure: true,
					value: 'secret',
				},
			]);
		});

		it('should vary maxAge based on options.maxAge', async () => {
			const givenMaxAge = 900;
			await makeLambdaRequest(
				getEventStub({
					queryStringParameters: {
						username: 'bashir',
						token: 'secret',
					},
				}),
				mockCallback,
				{
					cookies: {
						maxAge: givenMaxAge,
					},
				}
			);

			expect(getCookies()[0].maxAge).toEqual(givenMaxAge);
			expect(getCookies()[1].maxAge).toEqual(givenMaxAge);
		});

		it('should vary secure based on options.secure', async () => {
			const givenSecure = true;
			await makeLambdaRequest(
				getEventStub({
					queryStringParameters: {
						username: 'bashir',
						token: 'secret',
					},
				}),
				mockCallback,
				{
					protocol: 'http',
					cookies: {
						secure: givenSecure,
					},
				}
			);

			expect(getCookies()[0].secure).toEqual(true);
			expect(getCookies()[1].secure).toEqual(true);
		});

		[
			{ protocol: 'https', expectedValue: true },
			{ protocol: 'http', expectedValue: undefined },
		].forEach(({ protocol, expectedValue }) => {
			it(`should vary secure based on protocol by default. If protocol is '${protocol}' httpOnly should be ${expectedValue}`, async () => {
				await makeLambdaRequest(
					getEventStub({
						queryStringParameters: {
							username: 'bashir',
							token: 'secret',
						},
					}),
					mockCallback,
					{
						protocol,
					}
				);

				expect(getCookies()[0].secure).toEqual(expectedValue);
				expect(getCookies()[1].secure).toEqual(expectedValue);
			});
		});

		it('should vary httpOnly based on options.httpOnly', async () => {
			const givenHttpOnly = false;
			await makeLambdaRequest(
				getEventStub({
					queryStringParameters: {
						username: 'bashir',
						token: 'secret',
					},
				}),
				mockCallback,
				{
					cookies: {
						httpOnly: givenHttpOnly,
					},
				}
			);

			expect(getCookies()[0].httpOnly).toEqual(undefined);
			expect(getCookies()[1].httpOnly).toEqual(undefined);
		});
	});

	describe('authenticate', () => {
		[
			{
				name: `only an ${S3O_USERNAME} cookie`,
				value: `${S3O_USERNAME}=patrick.stewart`,
				expectedUsername: 'patrick.stewart',
			},
			{
				name: `only an ${S3O_TOKEN} cookie`,
				value: `${S3O_TOKEN}=some-token`,
			},
			{
				name: 'no cookies',
				value: null,
			},
			{
				name: `empty ${S3O_USERNAME} and ${S3O_TOKEN} cookies`,
				value: 'other-cookie=',
			},
		].forEach(({ name, value, expectedUsername }) => {
			it(`should redirect the user to authenticate with s3o in the case: ${name}`, async () => {
				const result = await makeLambdaRequest(
					getEventStub({
						cookie: value,
					})
				);

				expect(mockCallback).toHaveBeenCalledTimes(1);
				expect(mockCallback).toHaveBeenCalledWith(null, {
					headers: {
						'Cache-Control': 'no-cache, private, max-age=0',
						location:
							'https://s3o.ft.com/v3/authenticate?host=lantern.ft.com&redirect=https://lantern.ft.com/',
					},
					statusCode: 302,
				});
				expect(result).toEqual({
					isSignedIn: false,
					username: expectedUsername,
				});
			});
		});

		[
			{
				name: 'an empty string',
				value: '',
			},
			{
				name: 'undefined',
				value: undefined,
			},
		].forEach(({ name, value }) => {
			it(`should throw an error if the \'getS3oClientName\' option returns ${name}`, () => {
				const doRequest = () =>
					makeLambdaRequest(
						getEventStub({
							cookie: '',
						}),
						mockCallback,
						{
							getS3oClientName() {
								return value;
							},
						}
					);

				return expect(doRequest()).rejects.toEqual(
					new Error(
						`The option 'getS3oClientName' returned '${value}'. This function must return a non-empty value`
					)
				);
			});
		});

		it('should return a 401 response and clear cookies when cookie validation fails', async () => {
			mockAuthenticate.authenticateToken.mockImplementation(() => false);

			const result = await makeLambdaRequest();

			expect(mockCallback).toHaveBeenCalledTimes(1);
			expect(mockCallback).toHaveBeenCalledWith(null, {
				statusCode: 401,
				body: '{"error":"Not authenticated"}',
				headers: {
					'Content-Type': 'application/json',
					'Set-Cookie': `${S3O_USERNAME}=; expires=Thu, 01 Jan 1970 00:00:00 GMT`,
					'set-cookie': `${S3O_TOKEN}=; expires=Thu, 01 Jan 1970 00:00:00 GMT`,
				},
			});
			expect(result.isSignedIn).toEqual(false);
		});
	});

	describe('credentials validation', () => {
		it('should validate using the public key, s3o username and token from cookies, and s3o client name', async () => {
			const givenUsername = 'captain';
			const givenToken = 'jeann-luc-picard';
			const givenS3oClientName = 'uss-enterprise';

			await makeLambdaRequest(
				getEventStub({
					cookie: `${S3O_USERNAME}=${givenUsername};${S3O_TOKEN}=${givenToken}`,
				}),
				mockCallback,
				{
					getS3oClientName() {
						return givenS3oClientName;
					},
				}
			);

			expect(s3oMiddlewareUtils.authenticate).toHaveBeenCalledTimes(1);
			expect(mockPublicKeyConsumer).toHaveBeenCalledTimes(1);
			expect(mockPublicKeyConsumer).toHaveBeenCalledWith(publicKey);
			expect(mockAuthenticate.authenticateToken).toHaveBeenCalledTimes(1);
			expect(mockAuthenticate.authenticateToken).toHaveBeenCalledWith(
				givenUsername,
				givenS3oClientName,
				givenToken
			);
		});

		it('should return that the user is signed in if validation succeeds', async () => {
			const givenUsername = 'captain';
			const givenToken = 'jeann-luc-picard';

			const result = await makeLambdaRequest(
				getEventStub({
					cookie: `${S3O_USERNAME}=${givenUsername};${S3O_TOKEN}=${givenToken}`,
				}),
			);

			expect(result).toEqual({
				isSignedIn: true,
				username: givenUsername,
			})
		});
	});

	describe('s3o public key', () => {
		let clock;

		beforeEach(() => {
			clock = lolex.install({
				toFake: ['Date'],
			});
		});

		afterEach(() => {
			clock.uninstall();
		});

		it('fetches the s3o public key when making an authorisation request', async () => {
			await makeLambdaRequest(getEventStub());

			expect(publicKeyScope.isDone()).toEqual(true);
		});

		it('uses the cached public key when the time between requests is under the public key Cache-Control ttl', async () => {
			await makeLambdaRequest();

			expect(publicKeyScope.isDone()).toEqual(true);

			clock.tick(1000 * publicKeyTTLSeconds - 1);
			resetPublicKeyStub();
			await makeLambdaRequest();

			expect(publicKeyScope.isDone()).toEqual(false);
		});

		it('refetches the s3o public key when the time between requests is over the public key Cache-Control ttl', async () => {
			await makeLambdaRequest();

			clock.tick(1000 * publicKeyTTLSeconds);
			resetPublicKeyStub();
			await makeLambdaRequest();

			expect(publicKeyScope.isDone()).toEqual(true);
		});
	});
});