testing/access.mjs

Functions

Imports

It imports testing/network.mjs. No module of this repo imports it.

Source

1// A fake of Cloudflare Access as an OIDC provider (Access for SaaS), as a login callback reaches it: the token endpoint,
2// answering with an RS256 ID token signed by a key made here, and the JWKS endpoint serving that key's public half.
3// The issuer, the audience and the claims are parameters; any other route the code under test needs is left to a
4// `fallback` the caller passes.
5//
6// An unknown URL THROWS, so a sign-in cannot fall through to the real Access. The token is really signed and the JWKS
7// really serves its key, so the code under test verifies it exactly as it verifies Access's.
8
9import { installFetch, urlOf } from "./network.mjs";
10
11const KID = "stub-kid";
12const encoder = new TextEncoder();
13
14/** @param {Uint8Array} bytes */
15const b64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
16/** @param {unknown} value */
17const b64json = (value) => b64url(encoder.encode(JSON.stringify(value)));
18
19/**
20 * Stands up the fake for one Access application and one sign-in. Installed as the global fetch unless `install` is false.
21 *
22 * @param {{
23 *   issuer: string,
24 *   audience: string,
25 *   email: string,
26 *   authorizationUrl?: string,
27 *   claims?: Record<string, unknown>,
28 *   jwksUrl?: string,
29 *   fallback?: (url: string, init?: RequestInit) => Response | Promise<Response> | undefined,
30 *   install?: boolean,
31 * }} options
32 */
33export async function stubAccess({ issuer, audience, email, authorizationUrl, claims = {}, jwksUrl, fallback, install = true }) {
34  if (!issuer || !audience) throw new Error("stubAccess needs the issuer and audience of the Access application it stands in for.");
35  const base = issuer.replace(/\/+$/, "");
36  const tokenUrl = `${base}/token`;
37  const keysUrl = jwksUrl ?? `${base}/jwks`;
38  // The nonce the flow sent the browser away with, echoed as Access would.
39  const nonce = authorizationUrl ? new URL(authorizationUrl).searchParams.get("nonce") : null;
40
41  const pair = /** @type {CryptoKeyPair} */ (
42    await crypto.subtle.generateKey(
43      { name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
44      true,
45      ["sign", "verify"],
46    )
47  );
48  const publicJwk = { ...(/** @type {JsonWebKey} */ (await crypto.subtle.exportKey("jwk", pair.publicKey))), kid: KID, alg: "RS256", use: "sig" };
49
50  /**
51   * A token signed by the stub's key: the issuer, the audience, a five-minute life and the sign-in's email and nonce,
52   * then `claims` on top, then `extra`. Also what a test sends as Cf-Access-Jwt-Assertion.
53   *
54   * @param {Record<string, unknown>} [extra]
55   */
56  async function token(extra = {}) {
57    const head = b64json({ alg: "RS256", kid: KID, typ: "JWT" });
58    const now = Math.floor(Date.now() / 1000);
59    const body = b64json({ iss: issuer, aud: audience, iat: now, exp: now + 300, email, ...(nonce ? { nonce } : {}), ...claims, ...extra });
60    const signature = new Uint8Array(await crypto.subtle.sign("RSASSA-PKCS1-v1_5", pair.privateKey, encoder.encode(`${head}.${body}`)));
61    return `${head}.${body}.${b64url(signature)}`;
62  }
63
64  /** @type {URLSearchParams[]} */
65  const tokenRequests = [];
66
67  /** @type {typeof fetch} */
68  const fake = async (input, init) => {
69    const url = urlOf(input);
70    if (url === tokenUrl) {
71      const raw = init?.body ?? (input instanceof Request ? await input.clone().text() : "");
72      tokenRequests.push(new URLSearchParams(String(raw)));
73      return Response.json({ id_token: await token(), token_type: "bearer" });
74    }
75    if (url === keysUrl) return Response.json({ keys: [publicJwk] });
76    const other = fallback ? await fallback(url, init) : undefined;
77    if (other) return other;
78    throw new Error(`the Access stub does not answer ${url}; pass a fallback for the other routes this sign-in needs.`);
79  };
80
81  const restore = install ? installFetch(fake) : () => {};
82  return { issuer, tokenUrl, jwksUrl: keysUrl, jwk: publicJwk, token, tokenRequests, fetch: fake, restore };
83}