m2m.test.ts49 lines · main

1	import { describe, expect, test } from 'bun:test';
2
3	const ORIGINAL_SECRET = process.env.BRIVEN_BETTER_AUTH_SECRET;
4	process.env.BRIVEN_BETTER_AUTH_SECRET = ORIGINAL_SECRET ?? 'a'.repeat(32);
5
6	import {
7	isM2mRole,
8	signM2mAccessToken,
9	verifyM2mAccessToken,
10	M2M_TOKEN_TTL_SECONDS,
11	} from './m2m.js';
12
13	describe('briven-engine M2M', () => {
14	test('role allowlist', () => {
15	expect(isM2mRole('viewer')).toBe(true);
16	expect(isM2mRole('developer')).toBe(true);
17	expect(isM2mRole('admin')).toBe(true);
18	expect(isM2mRole('owner')).toBe(false);
19	expect(isM2mRole('')).toBe(false);
20	});
21
22	test('access token signs and verifies with project + role', async () => {
23	const { accessToken, expiresIn } = await signM2mAccessToken({
24	clientId: 'm2m_testclient',
25	projectId: 'p_test_project',
26	role: 'developer',
27	});
28	expect(expiresIn).toBe(M2M_TOKEN_TTL_SECONDS);
29	expect(accessToken.split('.').length).toBe(3);
30
31	const payload = await verifyM2mAccessToken(accessToken);
32	expect(payload.scope).toBe('m2m');
33	expect(payload.project_id).toBe('p_test_project');
34	expect(payload.role).toBe('developer');
35	expect(payload.client_id).toBe('m2m_testclient');
36	expect(payload.sub).toBe('m2m_testclient');
37	});
38
39	test('tampered token fails verify', async () => {
40	const { accessToken } = await signM2mAccessToken({
41	clientId: 'm2m_x',
42	projectId: 'p_y',
43	role: 'viewer',
44	});
45	const parts = accessToken.split('.');
46	parts[2] = parts[2]!.slice(0, -4) + 'xxxx';
47	await expect(verifyM2mAccessToken(parts.join('.'))).rejects.toBeTruthy();
48	});
49	});