From 0329b2514b3790413f53bb0f5012f816718f094f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= <freben@gmail.com>
Date: Thu, 25 Apr 2024 09:57:53 +0200
Subject: [PATCH] add test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Fredrik Adelöw <freben@gmail.com>
---
 .../auth/user/UserTokenHandler.test.ts        | 36 ++++++++++++++++---
 1 file changed, 32 insertions(+), 4 deletions(-)

diff --git a/packages/backend-app-api/src/services/implementations/auth/user/UserTokenHandler.test.ts b/packages/backend-app-api/src/services/implementations/auth/user/UserTokenHandler.test.ts
index f2a86e4a20..b0e8418655 100644
--- a/packages/backend-app-api/src/services/implementations/auth/user/UserTokenHandler.test.ts
+++ b/packages/backend-app-api/src/services/implementations/auth/user/UserTokenHandler.test.ts
@@ -133,6 +133,34 @@ describe('UserTokenHandler', () => {
       ).rejects.toThrow('signature verification failed');
     });
 
+    it('should fail to verify tokens that have a bad alg', async () => {
+      const expectedIssuedAt = 1712071714;
+      const expectedExpiresAt = 1712075314;
+
+      jest.useFakeTimers({
+        now: expectedIssuedAt * 1000 + 600_000,
+      });
+
+      const header = encodeData({
+        typ: 'vnd.backstage.user',
+        alg: 'none',
+      });
+      const payload = encodeData({
+        iss: 'http://localhost:7007/api/auth',
+        sub: 'user:development/guest',
+        ent: ['user:development/guest', 'group:default/team-a'],
+        aud: 'backstage',
+        iat: expectedIssuedAt,
+        exp: expectedExpiresAt,
+        uip: 'proof',
+      });
+      const token = `${header}.${payload}.`;
+
+      await expect(userTokenHandler.verifyToken(token)).rejects.toThrow(
+        /Unsupported "alg" value/,
+      );
+    });
+
     it('should verify a valid legacy backstage token', async () => {
       const expectedIssuedAt = 1712071714;
       const expectedExpiresAt = 1712075314;
@@ -151,7 +179,7 @@ describe('UserTokenHandler', () => {
           sub: 'user:development/guest',
           ent: ['user:development/guest', 'group:default/team-a'],
           aud: 'backstage',
-          iat: 1712071714,
+          iat: expectedIssuedAt,
           exp: expectedExpiresAt,
         },
       };
@@ -179,7 +207,7 @@ describe('UserTokenHandler', () => {
           iss: 'http://localhost:7007/api/auth',
           ent: ['user:development/guest', 'group:default/team-a'],
           aud: 'backstage',
-          iat: 1712071714,
+          iat: expectedIssuedAt,
           exp: expectedExpiresAt,
         },
       };
@@ -209,7 +237,7 @@ describe('UserTokenHandler', () => {
           sub: 'user:development/guest',
           ent: ['user:development/guest', 'group:default/team-a'],
           aud: 'backstage',
-          iat: 1712071714,
+          iat: expectedIssuedAt,
           exp: expectedExpiresAt,
           uip: 'proof',
         },
@@ -239,7 +267,7 @@ describe('UserTokenHandler', () => {
         payload: {
           sub: 'user:development/guest',
           ent: ['user:development/guest', 'group:default/team-a'],
-          iat: 1712071714,
+          iat: expectedIssuedAt,
           exp: expectedExpiresAt,
         },
       };