1d2467049d
Replace the hybrid flow (frontend PKCE + POST /auth/session token exchange, access token in sessionStorage) with a classic backend-driven BFF: the browser only ever navigates to GET /api/v1/auth/login and is redirected straight to the IdP; PKCE verifier/state live server-side in Redis (SessionStoreService); GET /api/v1/auth/callback (now the registered IdP redirect URI, replacing the frontend's /auth/callback route, which is deleted) verifies the id_token, JIT-provisions the user, creates a Redis-backed session, and sets one httpOnly SameSite=Lax cookie before redirecting into the app. No token material of any kind ever reaches the browser. OidcAuthGuard (per-request bearer JWT verification) is replaced by SessionAuthGuard (cookie -> Redis session lookup) across every controller that used it. cookie-parser is now wired into main.ts. Frontend AuthService shrinks to login()/logout()/ensureSessionChecked(); pkce.ts, auth.interceptor.ts, and the callback component/route are all removed as dead code under this model. New required env var: APP_BASE_URL (source of truth for the OIDC redirect_uri and the post-login redirect target). Verified end-to-end against the real API, Redis, and a mocked IdP: login redirect shape, callback cookie + redirect, state-replay rejection, /users/me 401<->200 around the cookie, and logout.
116 lines
3.7 KiB
TypeScript
116 lines
3.7 KiB
TypeScript
import { TripsController } from './trips.controller';
|
|
import type { SessionUser } from '../../../../libs/auth/src';
|
|
|
|
describe('TripsController', () => {
|
|
const currentUser: SessionUser = {
|
|
id: 'u1',
|
|
externalSubjectId: 'sub-1',
|
|
displayName: 'Alex',
|
|
email: 'a@example.com',
|
|
};
|
|
|
|
function controllerWith(
|
|
tripsService: object,
|
|
tripSettingsService: object = {},
|
|
): TripsController {
|
|
return new TripsController(
|
|
tripsService as never,
|
|
tripSettingsService as never,
|
|
);
|
|
}
|
|
|
|
it('GET /trips lists trips for the current user', async () => {
|
|
const tripsService = {
|
|
listTripsForUser: jest
|
|
.fn()
|
|
.mockResolvedValue([{ id: 't1', name: 'Slovenia 2027' }]),
|
|
};
|
|
const controller = controllerWith(tripsService);
|
|
|
|
await expect(controller.list(currentUser)).resolves.toEqual([
|
|
{ id: 't1', name: 'Slovenia 2027' },
|
|
]);
|
|
expect(tripsService.listTripsForUser).toHaveBeenCalledWith('u1');
|
|
});
|
|
|
|
it('POST /trips creates a trip owned by the current user', async () => {
|
|
const created = {
|
|
id: 't1',
|
|
name: 'Slovenia 2027',
|
|
ownerId: 'u1',
|
|
version: 1,
|
|
};
|
|
const tripsService = { createTrip: jest.fn().mockResolvedValue(created) };
|
|
const controller = controllerWith(tripsService);
|
|
|
|
await expect(
|
|
controller.create(currentUser, { name: 'Slovenia 2027' }),
|
|
).resolves.toEqual(created);
|
|
expect(tripsService.createTrip).toHaveBeenCalledWith('u1', {
|
|
name: 'Slovenia 2027',
|
|
});
|
|
});
|
|
|
|
it('GET /trips/:tripId returns a single trip', async () => {
|
|
const trip = { id: 't1', name: 'Slovenia 2027' };
|
|
const tripsService = { getTrip: jest.fn().mockResolvedValue(trip) };
|
|
const controller = controllerWith(tripsService);
|
|
|
|
await expect(controller.getOne('t1')).resolves.toEqual(trip);
|
|
});
|
|
|
|
it('PATCH /trips/:tripId forwards the update dto including version', async () => {
|
|
const updated = { id: 't1', name: 'New name', version: 2 };
|
|
const tripsService = { updateTrip: jest.fn().mockResolvedValue(updated) };
|
|
const controller = controllerWith(tripsService);
|
|
|
|
await expect(
|
|
controller.update('t1', { name: 'New name', version: 1 }),
|
|
).resolves.toEqual(updated);
|
|
expect(tripsService.updateTrip).toHaveBeenCalledWith('t1', {
|
|
name: 'New name',
|
|
version: 1,
|
|
});
|
|
});
|
|
|
|
it('DELETE /trips/:tripId deletes the trip', async () => {
|
|
const tripsService = { deleteTrip: jest.fn().mockResolvedValue(undefined) };
|
|
const controller = controllerWith(tripsService);
|
|
|
|
await controller.remove('t1');
|
|
expect(tripsService.deleteTrip).toHaveBeenCalledWith('t1');
|
|
});
|
|
|
|
it('GET /trips/:tripId/settings returns the trip settings', async () => {
|
|
const settings = { tripId: 't1', webResearchEnabled: false };
|
|
const tripSettingsService = {
|
|
getSettings: jest.fn().mockResolvedValue(settings),
|
|
};
|
|
const controller = controllerWith({}, tripSettingsService);
|
|
|
|
await expect(controller.getSettings('t1')).resolves.toEqual(settings);
|
|
expect(tripSettingsService.getSettings).toHaveBeenCalledWith('t1');
|
|
});
|
|
|
|
it('PUT /trips/:tripId/settings replaces the trip settings', async () => {
|
|
const dto = {
|
|
webResearchEnabled: true,
|
|
periodicAgentReviewEnabled: false,
|
|
notificationEmailEnabled: true,
|
|
notificationPushEnabled: true,
|
|
defaultResearchDepth: null,
|
|
defaultPlanningStyle: null,
|
|
};
|
|
const updated = { tripId: 't1', ...dto };
|
|
const tripSettingsService = {
|
|
replaceSettings: jest.fn().mockResolvedValue(updated),
|
|
};
|
|
const controller = controllerWith({}, tripSettingsService);
|
|
|
|
await expect(controller.replaceSettings('t1', dto)).resolves.toEqual(
|
|
updated,
|
|
);
|
|
expect(tripSettingsService.replaceSettings).toHaveBeenCalledWith('t1', dto);
|
|
});
|
|
});
|