Add scouthub-attivit-be

scouthub-attivita-be/tests/unit/middleware/authenticate.test.ts

@@ -0,0 +1,75 @@
+import express from 'express';
+import request from 'supertest';
+import jwt from 'jsonwebtoken';
+import nock from 'nock';
+import { authenticate } from '../../../src/middlewares/authenticate';
+import { bearer, mockKeycloakJwks, rogueKeyPem, signValidToken } from '../../setup/authTestHelper';
+
+const CAPO_PAYLOAD = {
+  sub: 'user-123',
+  email: 'capo@example.com',
+  name: 'Capo Unità',
+  realm_access: { roles: ['capo-unita'] },
+};
+
+function buildApp() {
+  const app = express();
+  app.get('/protetta', authenticate, (req, res) => {
+    res.json({ auth: req.auth });
+  });
+  return app;
+}
+
+beforeAll(() => {
+  mockKeycloakJwks();
+});
+
+afterAll(() => {
+  nock.cleanAll();
+});
+
+describe('authenticate', () => {
+  test('restituisce 401 se manca il token', async () => {
+    const app = buildApp();
+
+    const response = await request(app).get('/protetta');
+
+    expect(response.status).toBe(401);
+  });
+
+  test('restituisce 401 se il token è scaduto', async () => {
+    const app = buildApp();
+    const token = signValidToken(CAPO_PAYLOAD, { expiresIn: '-10s' });
+
+    const response = await request(app).get('/protetta').set('Authorization', `Bearer ${token}`);
+
+    expect(response.status).toBe(401);
+  });
+
+  test('restituisce 401 se il token ha una firma non valida', async () => {
+    const app = buildApp();
+    const token = jwt.sign(CAPO_PAYLOAD, rogueKeyPem, {
+      algorithm: 'RS256',
+      keyid: 'test-kid',
+      expiresIn: '5m',
+    });
+
+    const response = await request(app).get('/protetta').set('Authorization', `Bearer ${token}`);
+
+    expect(response.status).toBe(401);
+  });
+
+  test('restituisce 200 e popola req.auth se il token è valido', async () => {
+    const app = buildApp();
+
+    const response = await request(app).get('/protetta').set('Authorization', bearer(CAPO_PAYLOAD));
+
+    expect(response.status).toBe(200);
+    expect(response.body.auth).toEqual({
+      userId: 'user-123',
+      email: 'capo@example.com',
+      name: 'Capo Unità',
+      roles: ['capo-unita'],
+    });
+  });
+});