backend-app-api: initial test for issuing limited tokens

Co-authored-by: Camila Belo <camilaibs@gmail.com> Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
2024-04-02 16:05:33 +02:00
parent 4194ac7200
commit 3493c914cf
1 changed files with 57 additions and 2 deletions
@@ -22,7 +22,7 @@ import {
  InternalBackstageCredentials,
  authServiceFactory,
 } from './authServiceFactory';
-import { decodeJwt } from 'jose';
+import { base64url, decodeJwt } from 'jose';
 import { discoveryServiceFactory } from '../discovery';
 import {
  BackstageServicePrincipal,
@@ -129,6 +129,61 @@ describe('authServiceFactory', () => {
  });

  it('should issue limited user tokens', async () => {
-    // TODO
+    const publicKey = [
+      {
+        kty: 'EC',
+        x: 'Xd7ATJLz0085GTqYTKdl3oSZqHwcs-l1bMxrG7iFMOw',
+        y: 'EvFsODRaJsNWKLgknbHeCE1KxAPZL2WiSNkXB5gO1WM',
+        crv: 'P-256',
+        kid: 'b49bc495-e926-4ff9-b44f-4100e2dc069d',
+        alg: 'ES256',
+      },
+    ];
+
+    const tester = ServiceFactoryTester.from(authServiceFactory, {
+      dependencies: mockDeps,
+    });
+
+    const catalogAuth = await tester.get('catalog');
+
+    const fullToken =
+      'eyJhbGciOiJFUzI1NiIsImtpZCI6ImI0OWJjNDk1LWU5MjYtNGZmOS1iNDRmLTQxMDBlMmRjMDY5ZCJ9.eyJ0eXAiOiJ2bmQuYmFja3N0YWdlLnVzZXIiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjcwMDcvYXBpL2F1dGgiLCJzdWIiOiJ1c2VyOmRldmVsb3BtZW50L2d1ZXN0IiwiZW50IjpbInVzZXI6ZGV2ZWxvcG1lbnQvZ3Vlc3QiLCJncm91cDpkZWZhdWx0L3RlYW0tYSJdLCJhdWQiOiJiYWNrc3RhZ2UiLCJpYXQiOjE3MTIwNjQ0NzksImV4cCI6MTcxMjA2ODA3OSwidWlwIjoiMVQxR1JIcGpsdF9oRl8zM2trUFZ2QjdqM1dkWlJqcFowVHVnLXJTaXQwRHNQclJLY1V4eGU3VGVpZDhCbDhCTDE2QnRtTTRWTzJzQ0ExcjVkWUdLS2ZnIn0.5fFibx-RJVPHOvJNSCLGbUg3_sJVUMnyfN6QAq5abyKi8wtbDCCUAI9_x0Rb22KYCmBolV_cdjut-V6wQ3YmBg';
+
+    const credentials = await catalogAuth.authenticate(fullToken);
+    if (!catalogAuth.isPrincipal(credentials, 'user')) {
+      throw new Error('no a user principal');
+    }
+
+    const { token: limitedToken, expiresAt } =
+      await catalogAuth.getLimitedUserToken(credentials);
+
+    expect(expiresAt).toEqual(new Date(1712068079 * 1000));
+
+    const expectedTokenHeader = base64url.encode(
+      JSON.stringify({
+        alg: 'ES256',
+        kid: 'b49bc495-e926-4ff9-b44f-4100e2dc069d',
+      }),
+    );
+    const expectedTokenPayload = base64url.encode(
+      JSON.stringify({
+        typ: 'vnd.backstage.limited-user',
+        sub: 'user:development/guest',
+        ent: ['user:development/guest', 'group:default/team-a'],
+        iat: 1712064479,
+        exp: 1712068079,
+      }),
+    );
+    const expectedTokenSignature = JSON.parse(
+      atob(fullToken.split('.')[1]),
+    ).uip;
+
+    const expectedToken = `${expectedTokenHeader}.${expectedTokenPayload}.${expectedTokenSignature}`;
+
+    expect(limitedToken).toBe(expectedToken);
+
+    const limitedCredentials = await catalogAuth.authenticate(limitedToken, {
+      allowLimitedAccess: true,
+    });
  });
 });