104 lines
3.9 KiB
TypeScript
104 lines
3.9 KiB
TypeScript
import { describe, expect, it, vi } from 'vitest';
|
|
|
|
import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
|
|
|
|
import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
|
|
|
|
describe('RedisAccessTokenStore.revoke', () => {
|
|
it('deletes only a profile-scoped game access token key', async () => {
|
|
const del = vi.fn(async () => 1);
|
|
const store = new RedisAccessTokenStore(
|
|
{
|
|
get: async () => null,
|
|
set: async () => null,
|
|
del,
|
|
},
|
|
'che:default'
|
|
);
|
|
|
|
await expect(store.revoke('ga_current')).resolves.toBe(true);
|
|
expect(del).toHaveBeenCalledWith('sammo:game:access:che:default:ga_current');
|
|
});
|
|
|
|
it('does not delete a gateway or malformed token', async () => {
|
|
const del = vi.fn(async () => 1);
|
|
const store = new RedisAccessTokenStore(
|
|
{
|
|
get: async () => null,
|
|
set: async () => null,
|
|
del,
|
|
},
|
|
'che:default'
|
|
);
|
|
|
|
await expect(store.revoke('gateway-token')).resolves.toBe(false);
|
|
expect(del).not.toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
describe('RedisAccessTokenStore.issueFromGateway', () => {
|
|
const payload = {
|
|
sessionId: 'gateway-session-1',
|
|
profile: 'che:default',
|
|
issuedAt: '2099-01-01T00:00:00.000Z',
|
|
expiresAt: '2099-01-01T01:00:00.000Z',
|
|
user: { id: 'user-1', username: 'tester' },
|
|
roles: [],
|
|
sanctions: [],
|
|
} as unknown as GameSessionTokenPayload;
|
|
|
|
it('issues the access key and consumes the gateway token in one Redis evaluation', async () => {
|
|
const evalCommand = vi.fn(async (_script: string, _options: { keys: string[]; arguments: string[] }) => 1);
|
|
const store = new RedisAccessTokenStore(
|
|
{
|
|
get: async () => null,
|
|
set: async () => null,
|
|
eval: evalCommand,
|
|
},
|
|
'che:default'
|
|
);
|
|
|
|
const issued = await store.issueFromGateway(payload);
|
|
|
|
expect(issued).toMatchObject({ expiresAt: payload.expiresAt });
|
|
expect(issued && issued !== 'ALREADY_USED' ? issued.accessToken : '').toMatch(/^ga_/);
|
|
expect(evalCommand).toHaveBeenCalledTimes(1);
|
|
expect(evalCommand.mock.calls[0]?.[1].keys[0]).toBe('sammo:game:gateway-used:che:default:gateway-session-1');
|
|
expect(evalCommand.mock.calls[0]?.[1].keys[1]).toBe(
|
|
`sammo:game:access:che:default:${issued && issued !== 'ALREADY_USED' ? issued.accessToken : ''}`
|
|
);
|
|
});
|
|
|
|
it('can retry after an atomic Redis evaluation fails before commit', async () => {
|
|
const keys = new Set<string>();
|
|
let attempts = 0;
|
|
const evalCommand = vi.fn(async (_script: string, options: { keys: string[] }) => {
|
|
attempts += 1;
|
|
if (attempts === 1) {
|
|
throw new Error('injected Redis failure');
|
|
}
|
|
if (keys.has(options.keys[0] ?? '')) {
|
|
return 0;
|
|
}
|
|
keys.add(options.keys[0] ?? '');
|
|
keys.add(options.keys[1] ?? '');
|
|
return 1;
|
|
});
|
|
const store = new RedisAccessTokenStore(
|
|
{
|
|
get: async () => null,
|
|
set: async () => null,
|
|
eval: evalCommand,
|
|
},
|
|
'che:default'
|
|
);
|
|
|
|
await expect(store.issueFromGateway(payload)).rejects.toThrow('injected Redis failure');
|
|
expect(keys.size).toBe(0);
|
|
await expect(store.issueFromGateway(payload)).resolves.toMatchObject({ expiresAt: payload.expiresAt });
|
|
expect([...keys].filter((key) => key.includes(':access:'))).toHaveLength(1);
|
|
expect([...keys].filter((key) => key.includes(':gateway-used:'))).toHaveLength(1);
|
|
await expect(store.issueFromGateway(payload)).resolves.toBe('ALREADY_USED');
|
|
});
|
|
});
|