vijay_admin/sentryagent-idp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(phase-2): workstream 5 — OPA Policy Engine

Browse Source 
- policies/authz.rego: Rego policy with path normalisation and scope enforcement
- policies/data/scopes.json: all 13 endpoint → scope mappings
- src/middleware/opa.ts: OpaMiddleware with Wasm primary path + scopes.json fallback;
  exports createOpaMiddleware() and reloadOpaPolicy() for SIGHUP hot-reload
- All four route files: opaMiddleware wired after authMiddleware
- AuditController, OAuth2Service: manual scope checks removed (now centralised in OPA)
- src/server.ts: SIGHUP handler calls reloadOpaPolicy()
- docs/devops/environment-variables.md: POLICY_DIR documented
- 38 new tests; 302/302 passing; opa.ts coverage 98.66% statements

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
SentryAgent.ai Developer
2026-03-28 23:02:11 +00:00
parent 8cdab72fea
commit 7328a61c44
18 changed files with 1108 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/devops/environment-variables.md
View File

@@ -117,6 +117,21 @@ KV v2 secrets engine mount path.
---
### `POLICY_DIR`
Directory containing OPA policy files (`authz.rego`, `authz.wasm`, `data/scopes.json`).
| | |
|-|-|
| **Required** | No |
| **Default** | `<cwd>/policies` |
| **Format** | Absolute or relative directory path |
| **Example** | `POLICY_DIR=/etc/sentryagent/policies` |
At startup the OPA authorization middleware loads `${POLICY_DIR}/authz.wasm` (Wasm mode) if present; otherwise it loads `${POLICY_DIR}/data/scopes.json` (fallback mode). Send `SIGHUP` to the process to hot-reload the policy files without a restart.
---
### `PORT`
HTTP port the Express server listens on.
@@ -187,6 +202,9 @@ MIIBIjANBgkq...
# VAULT_ADDR=http://127.0.0.1:8200
# VAULT_TOKEN=hvs.XXXXXXXXXXXXXXXXXXXXXX
# VAULT_MOUNT=secret
# OPA Policy Engine (Phase 2 — optional, defaults to <cwd>/policies)
# POLICY_DIR=/etc/sentryagent/policies
```
> Do not commit `.env` to version control. Add it to `.gitignore`.

14
openspec/changes/phase-2-production-ready/tasks.md
View File

@@ -68,13 +68,13 @@
## Workstream 5: OPA Policy Engine
- [ ] 5.1 Write `policies/authz.rego` — allow/deny rules matching all current scope checks
- [ ] 5.2 Write `policies/data/scopes.json` — scope to endpoint permission mapping
- [ ] 5.3 Write `src/middleware/opa.ts` — OpaMiddleware: loads Wasm, evaluates input, returns allow/deny
- [ ] 5.4 Replace static scope check in `src/middleware/auth.ts` with OpaMiddleware
- [ ] 5.5 Add SIGHUP handler in `src/server.ts` to hot-reload policy files
- [ ] 5.6 Update `docs/devops/environment-variables.md` — add POLICY_DIR
- [ ] 5.7 QA: all existing auth tests pass unchanged, new OPA unit tests, hot-reload verified
- [x] 5.1 Write `policies/authz.rego` — allow/deny rules matching all current scope checks
- [x] 5.2 Write `policies/data/scopes.json` — scope to endpoint permission mapping
- [x] 5.3 Write `src/middleware/opa.ts` — OpaMiddleware: loads Wasm, evaluates input, returns allow/deny
- [x] 5.4 Replace static scope check in `src/middleware/auth.ts` with OpaMiddleware
- [x] 5.5 Add SIGHUP handler in `src/server.ts` to hot-reload policy files
- [x] 5.6 Update `docs/devops/environment-variables.md` — add POLICY_DIR
- [x] 5.7 QA: all existing auth tests pass unchanged, new OPA unit tests, hot-reload verified
## Workstream 6: Web Dashboard UI

86
policies/authz.rego Normal file
View File

@@ -0,0 +1,86 @@
package authz
import rego.v1
# ─── Data ─────────────────────────────────────────────────────────────────────
# data.endpoint_permissions is loaded from policies/data/scopes.json
# Structure: { "METHOD:/path/pattern": ["scope1", ...], ... }
# ─── Default ──────────────────────────────────────────────────────────────────
default allow := false
default reason := "insufficient_scope"
# ─── Path pattern normalisation ───────────────────────────────────────────────
# Converts a concrete request path to a pattern key by replacing UUID-like
# segments with named placeholders.
#
# Supported patterns (longest-match wins via iteration):
# /api/v1/agents/{uuid}/credentials/{uuid}/rotate
# /api/v1/agents/{uuid}/credentials/{uuid}
# /api/v1/agents/{uuid}/credentials
# /api/v1/agents/{uuid}
# /api/v1/agents
# /api/v1/token/introspect
# /api/v1/token/revoke
# /api/v1/audit/{uuid}
# /api/v1/audit
# Build the lookup key from method + normalised path.
lookup_key(method, path) := key if {
normalised := normalise_path(path)
key := concat(":", [method, normalised])
}
# Normalise a concrete path to its pattern form.
normalise_path(path) := "/api/v1/agents/:id/credentials/:credId/rotate" if {
regex.match(`^/api/v1/agents/[^/]+/credentials/[^/]+/rotate$`, path)
}
normalise_path(path) := "/api/v1/agents/:id/credentials/:credId" if {
regex.match(`^/api/v1/agents/[^/]+/credentials/[^/]+$`, path)
}
normalise_path(path) := "/api/v1/agents/:id/credentials" if {
regex.match(`^/api/v1/agents/[^/]+/credentials$`, path)
}
normalise_path(path) := "/api/v1/agents/:id" if {
regex.match(`^/api/v1/agents/[^/]+$`, path)
}
normalise_path(path) := "/api/v1/agents" if {
path == "/api/v1/agents"
}
normalise_path(path) := "/api/v1/token/introspect" if {
path == "/api/v1/token/introspect"
}
normalise_path(path) := "/api/v1/token/revoke" if {
path == "/api/v1/token/revoke"
}
normalise_path(path) := "/api/v1/audit/:id" if {
regex.match(`^/api/v1/audit/[^/]+$`, path)
}
normalise_path(path) := "/api/v1/audit" if {
path == "/api/v1/audit"
}
# ─── Core allow rule ──────────────────────────────────────────────────────────
# allow = true if every required scope for the endpoint is present in input.scopes.
allow if {
key := lookup_key(input.method, input.path)
required := data.endpoint_permissions[key]
every req_scope in required {
req_scope in input.scopes
}
}
# reason is populated only on deny.
reason := "missing required scope for this endpoint" if {
not allow
}

17
policies/data/scopes.json Normal file
View File

@@ -0,0 +1,17 @@
{
"endpoint_permissions": {
"GET:/api/v1/agents": ["agents:read"],
"GET:/api/v1/agents/:id": ["agents:read"],
"POST:/api/v1/agents": ["agents:write"],
"PATCH:/api/v1/agents/:id": ["agents:write"],
"DELETE:/api/v1/agents/:id": ["agents:write"],
"GET:/api/v1/agents/:id/credentials": ["agents:read"],
"POST:/api/v1/agents/:id/credentials": ["agents:write"],
"POST:/api/v1/agents/:id/credentials/:credId/rotate": ["agents:write"],
"DELETE:/api/v1/agents/:id/credentials/:credId": ["agents:write"],
"POST:/api/v1/token/introspect": ["tokens:read"],
"POST:/api/v1/token/revoke": ["tokens:read"],
"GET:/api/v1/audit": ["audit:read"],
"GET:/api/v1/audit/:id": ["audit:read"]
}
}

14
src/app.ts
View File

@@ -33,6 +33,7 @@ import { createCredentialsRouter } from './routes/credentials.js';
import { createAuditRouter } from './routes/audit.js';
import { errorHandler } from './middleware/errorHandler.js';
import { createOpaMiddleware } from './middleware/opa.js';
import { createVaultClientFromEnv } from './vault/VaultClient.js';
import { RedisClientType } from 'redis';
@@ -120,6 +121,11 @@ export async function createApp(): Promise<Application> {
vaultClient,
);
// ────────────────────────────────────────────────────────────────
// OPA authorization middleware (created once — shared across all routers)
// ────────────────────────────────────────────────────────────────
const opaMiddleware = await createOpaMiddleware();
// ────────────────────────────────────────────────────────────────
// Controller layer
// ────────────────────────────────────────────────────────────────
@@ -133,13 +139,13 @@ export async function createApp(): Promise<Application> {
// ────────────────────────────────────────────────────────────────
const API_BASE = '/api/v1';
app.use(`${API_BASE}/agents`, createAgentsRouter(agentController));
app.use(`${API_BASE}/agents`, createAgentsRouter(agentController, opaMiddleware));
app.use(
`${API_BASE}/agents/:agentId/credentials`,
createCredentialsRouter(credentialController),
createCredentialsRouter(credentialController, opaMiddleware),
);
app.use(`${API_BASE}/token`, createTokenRouter(tokenController));
app.use(`${API_BASE}/audit`, createAuditRouter(auditController));
app.use(`${API_BASE}/token`, createTokenRouter(tokenController, opaMiddleware));
app.use(`${API_BASE}/audit`, createAuditRouter(auditController, opaMiddleware));
// ────────────────────────────────────────────────────────────────
// Global error handler (must be last)

15
src/controllers/AuditController.ts
View File

@@ -9,13 +9,12 @@ import { auditQuerySchema } from '../utils/validators.js';
import {
ValidationError,
AuthenticationError,
InsufficientScopeError,
} from '../utils/errors.js';
import { IAuditListFilters } from '../types/index.js';
/**
* Controller for the Audit Log endpoints.
* Enforces `audit:read` scope on all handlers.
* Authorization is enforced by OPA middleware — no per-handler scope checks required.
*/
export class AuditController {
/**
@@ -37,12 +36,6 @@ export class AuditController {
throw new AuthenticationError();
}
// Enforce audit:read scope
const scopes = req.user.scope.split(' ');
if (!scopes.includes('audit:read')) {
throw new InsufficientScopeError('audit:read');
}
// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
const { error, value } = auditQuerySchema.validate(req.query, { abortEarly: false });
if (error) {
@@ -84,12 +77,6 @@ export class AuditController {
throw new AuthenticationError();
}
// Enforce audit:read scope
const scopes = req.user.scope.split(' ');
if (!scopes.includes('audit:read')) {
throw new InsufficientScopeError('audit:read');
}
const { eventId } = req.params;
const event = await this.auditService.getEventById(eventId);
res.status(200).json(event);

279
src/middleware/opa.ts Normal file
View File

@@ -0,0 +1,279 @@
/**
* OPA (Open Policy Agent) authorization middleware for SentryAgent.ai AgentIdP.
*
* Primary path — Wasm bundle: When `${POLICY_DIR}/authz.wasm` exists, the policy is
* evaluated using `@open-policy-agent/opa-wasm`. The bundle is loaded once at startup
* and can be hot-reloaded via `reloadOpaPolicy()`.
*
* Fallback path — scopes.json: When no Wasm bundle is present (dev/test), the policy
* is evaluated entirely in TypeScript by reading `${POLICY_DIR}/data/scopes.json` and
* applying the same normalisation + scope-intersection logic as `policies/authz.rego`.
*/
import fs from 'fs';
import path from 'path';
import { RequestHandler } from 'express';
import { loadPolicy, LoadedPolicy } from '@open-policy-agent/opa-wasm';
import { AuthorizationError } from '../utils/errors.js';
// ────────────────────────────────────────────────────────────────────────────
// Types
// ────────────────────────────────────────────────────────────────────────────
/** Input shape sent to the OPA policy for every authorization check. */
interface OpaInput {
/** HTTP method in uppercase — e.g. "GET". */
method: string;
/** Full request path — e.g. "/api/v1/agents/abc-123". */
path: string;
/** Scopes extracted from the caller's JWT — e.g. ["agents:read"]. */
scopes: string[];
}
/** Expected shape of the OPA Wasm result set entry. */
interface OpaResultEntry {
result?: {
allow?: boolean;
};
}
/**
* Shape of `policies/data/scopes.json`.
* Keys are `"METHOD:/normalised/path"`, values are arrays of required scope strings.
*/
interface ScopesJson {
endpoint_permissions: Record<string, string[]>;
}
// ────────────────────────────────────────────────────────────────────────────
// Module-level singletons (replaced on hot-reload)
// ────────────────────────────────────────────────────────────────────────────
/**
* Resolved base directory for policy files.
* Defaults to `<cwd>/policies`; override via `POLICY_DIR` environment variable.
*/
const POLICY_DIR: string =
process.env['POLICY_DIR'] ?? path.resolve(process.cwd(), 'policies');
const WASM_PATH = path.join(POLICY_DIR, 'authz.wasm');
const SCOPES_PATH = path.join(POLICY_DIR, 'data', 'scopes.json');
/** Active Wasm policy instance — null when running in fallback (scopes.json) mode. */
let wasmPolicy: LoadedPolicy | null = null;
/** Fallback scope map — null when running in Wasm mode. */
let scopesMap: Record<string, string[]> | null = null;
// ────────────────────────────────────────────────────────────────────────────
// Path normalisation (mirrors `normalise_path` in authz.rego)
// ────────────────────────────────────────────────────────────────────────────
/**
* Normalises a concrete request path to the pattern key used in `scopes.json`.
* The priority ordering mirrors the longest-match ordering in `authz.rego`.
*
* @param requestPath - Raw request path from `req.path`.
* @returns Normalised pattern string, or the original path if no pattern matches.
*/
function normalisePath(requestPath: string): string {
// /api/v1/agents/:id/credentials/:credId/rotate (longest — checked first)
if (/^\/api\/v1\/agents\/[^/]+\/credentials\/[^/]+\/rotate$/.test(requestPath)) {
return '/api/v1/agents/:id/credentials/:credId/rotate';
}
// /api/v1/agents/:id/credentials/:credId
if (/^\/api\/v1\/agents\/[^/]+\/credentials\/[^/]+$/.test(requestPath)) {
return '/api/v1/agents/:id/credentials/:credId';
}
// /api/v1/agents/:id/credentials
if (/^\/api\/v1\/agents\/[^/]+\/credentials$/.test(requestPath)) {
return '/api/v1/agents/:id/credentials';
}
// /api/v1/agents/:id
if (/^\/api\/v1\/agents\/[^/]+$/.test(requestPath)) {
return '/api/v1/agents/:id';
}
// Static paths — returned as-is
if (
requestPath === '/api/v1/agents' ||
requestPath === '/api/v1/token/introspect' ||
requestPath === '/api/v1/token/revoke' ||
requestPath === '/api/v1/audit'
) {
return requestPath;
}
// /api/v1/audit/:id
if (/^\/api\/v1\/audit\/[^/]+$/.test(requestPath)) {
return '/api/v1/audit/:id';
}
// Unknown path — return as-is; the policy will produce no match → deny
return requestPath;
}
// ────────────────────────────────────────────────────────────────────────────
// Policy loading helpers
// ────────────────────────────────────────────────────────────────────────────
/**
* Attempts to load the Wasm bundle from disk.
* Returns `true` if successful, `false` if the file does not exist.
*
* @returns Whether the Wasm bundle was loaded.
*/
async function loadWasmPolicy(): Promise<boolean> {
if (!fs.existsSync(WASM_PATH)) {
return false;
}
const wasmBuffer = fs.readFileSync(WASM_PATH);
const loaded = await loadPolicy(wasmBuffer);
// Load the scopes data so the Wasm policy has access to endpoint_permissions
if (fs.existsSync(SCOPES_PATH)) {
const raw = fs.readFileSync(SCOPES_PATH, 'utf-8');
const parsed = JSON.parse(raw) as ScopesJson;
loaded.setData(parsed);
}
wasmPolicy = loaded;
scopesMap = null;
return true;
}
/**
* Loads the fallback `scopes.json` into memory.
* Called when no Wasm bundle is present.
*/
function loadScopesFallback(): void {
const raw = fs.readFileSync(SCOPES_PATH, 'utf-8');
const parsed = JSON.parse(raw) as ScopesJson;
scopesMap = parsed.endpoint_permissions;
wasmPolicy = null;
}
// ────────────────────────────────────────────────────────────────────────────
// Authorization evaluation
// ────────────────────────────────────────────────────────────────────────────
/**
* Evaluates the OPA policy against the given input.
*
* Uses the Wasm bundle when available; falls back to TypeScript scope-map logic.
*
* @param input - The authorization input (method, path, scopes).
* @returns `true` if the policy allows the request; `false` otherwise.
*/
function evaluate(input: OpaInput): boolean {
if (wasmPolicy !== null) {
// Wasm path: evaluate and extract `allow` from the result set
const resultSet = wasmPolicy.evaluate(input) as OpaResultEntry[];
if (!Array.isArray(resultSet) || resultSet.length === 0) {
return false;
}
return resultSet[0]?.result?.allow === true;
}
if (scopesMap !== null) {
// Fallback path: replicate authz.rego logic in TypeScript
const normPath = normalisePath(input.path);
const lookupKey = `${input.method}:${normPath}`;
const required = scopesMap[lookupKey];
// If no entry exists for this endpoint the policy denies
if (!required) {
return false;
}
return required.every((s) => input.scopes.includes(s));
}
// Neither policy loaded — deny by default (fail-closed)
return false;
}
// ────────────────────────────────────────────────────────────────────────────
// Public API
// ────────────────────────────────────────────────────────────────────────────
/**
* Creates the OPA authorization middleware.
*
* Call once at application startup. The returned `RequestHandler` can be wired
* into any Express router after the authentication middleware.
*
* Startup order:
* 1. Try to load `${POLICY_DIR}/authz.wasm` (primary).
* 2. If the Wasm bundle is absent, load `${POLICY_DIR}/data/scopes.json` (fallback).
*
* @returns Promise resolving to an Express `RequestHandler` for OPA authorization.
* @throws Error if neither the Wasm bundle nor `scopes.json` can be loaded.
*/
export async function createOpaMiddleware(): Promise<RequestHandler> {
const wasmLoaded = await loadWasmPolicy();
if (wasmLoaded) {
console.log('[AgentIdP] OPA policy engine: Wasm mode — loaded', WASM_PATH);
} else {
loadScopesFallback();
console.log('[AgentIdP] OPA policy engine: fallback mode — loaded', SCOPES_PATH);
}
/**
* Express middleware that authorises the current request against the OPA policy.
*
* Prerequisites: `authMiddleware` must have run first to populate `req.user`.
*
* @param req - Express request (must have `req.user` populated by auth middleware).
* @param _res - Express response (unused).
* @param next - Express next function.
*/
const handler: RequestHandler = (req, _res, next): void => {
try {
if (!req.user) {
// Auth middleware should have already rejected unauthenticated requests;
// this is a safeguard against misconfigured middleware ordering.
next(new AuthorizationError('Request is not authenticated.'));
return;
}
const input: OpaInput = {
method: req.method,
// Use baseUrl + path to reconstruct the full path (req.path is relative
// to the router's mount point; OPA policy patterns match full paths).
path: req.baseUrl + req.path,
scopes: req.user.scope.split(' '),
};
if (!evaluate(input)) {
next(new AuthorizationError());
return;
}
next();
} catch (err) {
next(err);
}
};
return handler;
}
/**
* Reloads the OPA policy from disk without restarting the server.
*
* Intended to be called from a SIGHUP handler. The reload strategy mirrors
* startup: Wasm bundle is preferred; `scopes.json` is used as fallback.
*
* @returns Promise that resolves when the policy has been reloaded.
* @throws Error if the reload fails (e.g. file is missing or malformed).
*/
export async function reloadOpaPolicy(): Promise<void> {
const wasmLoaded = await loadWasmPolicy();
if (wasmLoaded) {
console.log('[AgentIdP] OPA policy reloaded: Wasm mode —', WASM_PATH);
} else {
loadScopesFallback();
console.log('[AgentIdP] OPA policy reloaded: fallback mode —', SCOPES_PATH);
}
}

8
src/routes/agents.ts
View File

@@ -1,9 +1,9 @@
/**
* Agent Registry routes for SentryAgent.ai AgentIdP.
* Wires AgentController handlers to Express paths with auth and rateLimit middleware.
* Wires AgentController handlers to Express paths with auth, OPA, and rateLimit middleware.
*/
import { Router } from 'express';
import { Router, RequestHandler } from 'express';
import { AgentController } from '../controllers/AgentController.js';
import { authMiddleware } from '../middleware/auth.js';
import { rateLimitMiddleware } from '../middleware/rateLimit.js';
@@ -13,12 +13,14 @@ import { asyncHandler } from '../utils/asyncHandler.js';
* Creates and returns the Express router for agent registry endpoints.
*
* @param agentController - The agent controller instance.
* @param opaMiddleware - The OPA authorization middleware created at startup.
* @returns Configured Express router.
*/
export function createAgentsRouter(agentController: AgentController): Router {
export function createAgentsRouter(agentController: AgentController, opaMiddleware: RequestHandler): Router {
const router = Router();
router.use(asyncHandler(authMiddleware));
router.use(opaMiddleware);
router.use(asyncHandler(rateLimitMiddleware));
// POST /agents — Register a new agent

8
src/routes/audit.ts
View File

@@ -1,9 +1,9 @@
/**
* Audit Log routes for SentryAgent.ai AgentIdP.
* All routes require Bearer auth and are rate-limited.
* All routes require Bearer auth, OPA authorization, and are rate-limited.
*/
import { Router } from 'express';
import { Router, RequestHandler } from 'express';
import { AuditController } from '../controllers/AuditController.js';
import { authMiddleware } from '../middleware/auth.js';
import { rateLimitMiddleware } from '../middleware/rateLimit.js';
@@ -13,12 +13,14 @@ import { asyncHandler } from '../utils/asyncHandler.js';
* Creates and returns the Express router for audit log endpoints.
*
* @param auditController - The audit controller instance.
* @param opaMiddleware - The OPA authorization middleware created at startup.
* @returns Configured Express router.
*/
export function createAuditRouter(auditController: AuditController): Router {
export function createAuditRouter(auditController: AuditController, opaMiddleware: RequestHandler): Router {
const router = Router();
router.use(asyncHandler(authMiddleware));
router.use(opaMiddleware);
router.use(asyncHandler(rateLimitMiddleware));
// GET /audit — Query audit log

8
src/routes/credentials.ts
View File

@@ -1,9 +1,9 @@
/**
* Credential Management routes for SentryAgent.ai AgentIdP.
* All routes are under /agents/:agentId/credentials with auth and rateLimit middleware.
* All routes are under /agents/:agentId/credentials with auth, OPA, and rateLimit middleware.
*/
import { Router } from 'express';
import { Router, RequestHandler } from 'express';
import { CredentialController } from '../controllers/CredentialController.js';
import { authMiddleware } from '../middleware/auth.js';
import { rateLimitMiddleware } from '../middleware/rateLimit.js';
@@ -14,12 +14,14 @@ import { asyncHandler } from '../utils/asyncHandler.js';
* This router is mounted at /agents — the :agentId param is part of the path.
*
* @param credentialController - The credential controller instance.
* @param opaMiddleware - The OPA authorization middleware created at startup.
* @returns Configured Express router.
*/
export function createCredentialsRouter(credentialController: CredentialController): Router {
export function createCredentialsRouter(credentialController: CredentialController, opaMiddleware: RequestHandler): Router {
const router = Router({ mergeParams: true });
router.use(asyncHandler(authMiddleware));
router.use(opaMiddleware);
router.use(asyncHandler(rateLimitMiddleware));
// POST /agents/:agentId/credentials — Generate new credentials

13
src/routes/token.ts
View File

@@ -1,10 +1,10 @@
/**
* OAuth 2.0 Token routes for SentryAgent.ai AgentIdP.
* POST /token uses no Bearer auth (credentials are in the body).
* POST /token/introspect and POST /token/revoke require Bearer auth.
* POST /token/introspect and POST /token/revoke require Bearer auth and OPA authorization.
*/
import { Router } from 'express';
import { Router, RequestHandler } from 'express';
import { TokenController } from '../controllers/TokenController.js';
import { authMiddleware } from '../middleware/auth.js';
import { rateLimitMiddleware } from '../middleware/rateLimit.js';
@@ -14,26 +14,29 @@ import { asyncHandler } from '../utils/asyncHandler.js';
* Creates and returns the Express router for token endpoints.
*
* @param tokenController - The token controller instance.
* @param opaMiddleware - The OPA authorization middleware created at startup.
* @returns Configured Express router.
*/
export function createTokenRouter(tokenController: TokenController): Router {
export function createTokenRouter(tokenController: TokenController, opaMiddleware: RequestHandler): Router {
const router = Router();
// POST /token — Issue token (no auth — credentials in body or Basic header)
router.post('/', asyncHandler(rateLimitMiddleware), asyncHandler(tokenController.issueToken.bind(tokenController)));
// POST /token/introspect — Introspect token (requires Bearer auth)
// POST /token/introspect — Introspect token (requires Bearer auth + OPA)
router.post(
'/introspect',
asyncHandler(authMiddleware),
opaMiddleware,
asyncHandler(rateLimitMiddleware),
asyncHandler(tokenController.introspectToken.bind(tokenController)),
);
// POST /token/revoke — Revoke token (requires Bearer auth)
// POST /token/revoke — Revoke token (requires Bearer auth + OPA)
router.post(
'/revoke',
asyncHandler(authMiddleware),
opaMiddleware,
asyncHandler(rateLimitMiddleware),
asyncHandler(tokenController.revokeToken.bind(tokenController)),
);

9
src/server.ts
View File

@@ -7,6 +7,7 @@ import * as dotenv from 'dotenv';
dotenv.config();
import { createApp } from './app.js';
import { reloadOpaPolicy } from './middleware/opa.js';
const PORT = parseInt(process.env['PORT'] ?? '3000', 10);
@@ -37,6 +38,14 @@ async function main(): Promise<void> {
process.on('SIGINT', () => {
shutdown();
});
// Hot-reload OPA policy without restarting the server
process.on('SIGHUP', () => {
reloadOpaPolicy().catch((err) => {
// eslint-disable-next-line no-console
console.error('[AgentIdP] Failed to reload OPA policy:', err);
});
});
} catch (err) {
// eslint-disable-next-line no-console
console.error('Failed to start server:', err);

12
src/services/OAuth2Service.ts
View File

@@ -18,7 +18,6 @@ import {
AuthenticationError,
AuthorizationError,
FreeTierLimitError,
InsufficientScopeError,
} from '../utils/errors.js';
import { signToken, verifyToken, decodeToken, getTokenExpiresIn } from '../utils/jwt.js';
import { verifySecret } from '../utils/crypto.js';
@@ -214,14 +213,13 @@ export class OAuth2Service {
/**
* Introspects a token per RFC 7662.
* Always returns 200; check the `active` field for validity.
* Requires the caller to hold a token with `tokens:read` scope.
* Scope enforcement (`tokens:read`) is handled upstream by OPA middleware.
*
* @param token - The JWT string to introspect.
* @param callerPayload - The decoded payload of the calling agent's token (for scope check).
* @param callerPayload - The decoded payload of the calling agent's token.
* @param ipAddress - Client IP for audit logging.
* @param userAgent - Client User-Agent for audit logging.
* @returns The introspection response.
* @throws InsufficientScopeError if the caller lacks `tokens:read` scope.
*/
async introspectToken(
token: string,
@@ -229,12 +227,6 @@ export class OAuth2Service {
ipAddress: string,
userAgent: string,
): Promise<IIntrospectResponse> {
// Check caller has tokens:read scope
const callerScopes = callerPayload.scope.split(' ');
if (!callerScopes.includes('tokens:read')) {
throw new InsufficientScopeError('tokens:read');
}
try {
const payload = verifyToken(token, this.publicKey);
const revoked = await this.tokenRepository.isRevoked(payload.jti);

21
tests/unit/controllers/AuditController.test.ts
View File

@@ -10,7 +10,6 @@ import { ITokenPayload, IAuditEvent } from '../../../src/types/index';
import {
ValidationError,
AuthenticationError,
InsufficientScopeError,
AuditEventNotFoundError,
} from '../../../src/utils/errors';
@@ -103,13 +102,18 @@ describe('AuditController', () => {
expect(next).toHaveBeenCalledWith(expect.any(AuthenticationError));
});
it('should call next(InsufficientScopeError) when scope does not include audit:read', async () => {
it('should call auditService.queryEvents regardless of scope (scope enforced by OPA middleware)', async () => {
// Scope enforcement has been moved to OpaMiddleware; the controller delegates
// to the service for all authenticated requests that reach it.
const { req, res, next } = buildMocks('agents:read');
req.query = {};
const emptyResponse = { data: [], total: 0, page: 1, limit: 50 };
auditService.queryEvents.mockResolvedValue(emptyResponse);
await controller.queryAuditLog(req as Request, res as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(InsufficientScopeError));
expect(auditService.queryEvents).not.toHaveBeenCalled();
expect(auditService.queryEvents).toHaveBeenCalledTimes(1);
expect(res.status).toHaveBeenCalledWith(200);
});
it('should call next(ValidationError) when query params are invalid', async () => {
@@ -190,14 +194,17 @@ describe('AuditController', () => {
expect(next).toHaveBeenCalledWith(expect.any(AuthenticationError));
});
it('should call next(InsufficientScopeError) when scope does not include audit:read', async () => {
it('should call auditService.getEventById regardless of scope (scope enforced by OPA middleware)', async () => {
// Scope enforcement has been moved to OpaMiddleware; the controller delegates
// to the service for all authenticated requests that reach it.
const { req, res, next } = buildMocks('agents:read');
req.params = { eventId: MOCK_AUDIT_EVENT.eventId };
auditService.getEventById.mockResolvedValue(MOCK_AUDIT_EVENT);
await controller.getAuditEventById(req as Request, res as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(InsufficientScopeError));
expect(auditService.getEventById).not.toHaveBeenCalled();
expect(auditService.getEventById).toHaveBeenCalledTimes(1);
expect(res.status).toHaveBeenCalledWith(200);
});
it('should forward AuditEventNotFoundError to next', async () => {

464
tests/unit/middleware/opa.test.ts Normal file
View File

@@ -0,0 +1,464 @@
/**
* Unit tests for src/middleware/opa.ts
*
* All tests run in fallback mode (scopes.json).
* `fs.existsSync` is mocked to return false for the Wasm bundle path so
* the Wasm loader is bypassed and `loadScopesFallback()` is always called.
*
* POLICY_DIR is set to the real `policies/` directory in the project root so
* tests use the production `data/scopes.json` without duplicating it.
*/
import path from 'path';
import { Request, Response, NextFunction } from 'express';
import { RequestHandler } from 'express';
import { AuthorizationError } from '../../../src/utils/errors';
import { ITokenPayload } from '../../../src/types/index';
// ─── Point POLICY_DIR at the real policies directory ─────────────────────────
const PROJECT_ROOT = path.resolve(__dirname, '../../..');
const POLICIES_DIR = path.join(PROJECT_ROOT, 'policies');
process.env['POLICY_DIR'] = POLICIES_DIR;
// ─── Mock fs.existsSync so Wasm bundle is never found ────────────────────────
// We do this BEFORE importing the module under test so the module-level
// WASM_PATH check in `loadWasmPolicy()` always returns false.
jest.mock('fs', () => {
const actual = jest.requireActual<typeof import('fs')>('fs');
return {
...actual,
existsSync: jest.fn((filePath: unknown) => {
// Deny Wasm bundle; allow all other paths (including scopes.json)
if (typeof filePath === 'string' && filePath.endsWith('.wasm')) {
return false;
}
return actual.existsSync(filePath as string);
}),
};
});
// ─── Import the module under test AFTER mocks are in place ───────────────────
import { createOpaMiddleware, reloadOpaPolicy } from '../../../src/middleware/opa';
// ─── Helpers ──────────────────────────────────────────────────────────────────
function makeUser(scope: string): ITokenPayload {
return {
sub: 'agent-abc-123',
client_id: 'agent-abc-123',
scope,
jti: 'jti-001',
iat: 1000,
exp: 9999999999,
};
}
/**
* Builds a minimal mock Express Request for OPA middleware testing.
* The middleware uses `req.baseUrl + req.path` for the full path.
*/
function makeReq(
method: string,
baseUrl: string,
reqPath: string,
user?: ITokenPayload,
): Partial<Request> {
return {
method,
baseUrl,
path: reqPath,
user,
};
}
// ─── Test suite ───────────────────────────────────────────────────────────────
describe('createOpaMiddleware (fallback mode)', () => {
let middleware: RequestHandler;
let next: jest.MockedFunction<NextFunction>;
beforeAll(async () => {
// Create middleware once; all tests share the same loaded scopes.json
middleware = await createOpaMiddleware();
});
beforeEach(() => {
next = jest.fn();
});
// ── Unauthenticated request ───────────────────────────────────────────────
it('should call next(AuthorizationError) with "not authenticated" when req.user is absent', () => {
const req = makeReq('GET', '/api/v1', '/agents', undefined) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledTimes(1);
const err = (next as jest.Mock).mock.calls[0][0] as AuthorizationError;
expect(err).toBeInstanceOf(AuthorizationError);
expect(err.message).toMatch(/not authenticated/i);
});
// ── agents:read endpoints ──────────────────────────────────────────────────
it('should allow GET /api/v1/agents with agents:read scope', () => {
const req = makeReq('GET', '/api/v1', '/agents', makeUser('agents:read')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should deny GET /api/v1/agents with agents:write scope only', () => {
const req = makeReq('GET', '/api/v1', '/agents', makeUser('agents:write')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should deny GET /api/v1/agents when scope list is empty', () => {
const req = makeReq('GET', '/api/v1', '/agents', makeUser('')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should allow GET /api/v1/agents/:id with agents:read scope (UUID path)', () => {
const req = makeReq(
'GET',
'/api/v1',
'/agents/550e8400-e29b-41d4-a716-446655440000',
makeUser('agents:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should deny GET /api/v1/agents/:id with wrong scope', () => {
const req = makeReq(
'GET',
'/api/v1',
'/agents/550e8400-e29b-41d4-a716-446655440000',
makeUser('audit:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
// ── agents:write endpoints ─────────────────────────────────────────────────
it('should allow POST /api/v1/agents with agents:write scope', () => {
const req = makeReq('POST', '/api/v1', '/agents', makeUser('agents:write')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should deny POST /api/v1/agents with agents:read scope only', () => {
const req = makeReq('POST', '/api/v1', '/agents', makeUser('agents:read')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should allow PATCH /api/v1/agents/:id with agents:write scope', () => {
const req = makeReq(
'PATCH',
'/api/v1',
'/agents/550e8400-e29b-41d4-a716-446655440000',
makeUser('agents:write'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should allow DELETE /api/v1/agents/:id with agents:write scope', () => {
const req = makeReq(
'DELETE',
'/api/v1',
'/agents/550e8400-e29b-41d4-a716-446655440000',
makeUser('agents:write'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
// ── credentials sub-resource endpoints ────────────────────────────────────
it('should allow GET /api/v1/agents/:id/credentials with agents:read scope', () => {
const req = makeReq(
'GET',
'/api/v1',
'/agents/550e8400-e29b-41d4-a716-446655440000/credentials',
makeUser('agents:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should allow POST /api/v1/agents/:id/credentials with agents:write scope', () => {
const req = makeReq(
'POST',
'/api/v1',
'/agents/550e8400-e29b-41d4-a716-446655440000/credentials',
makeUser('agents:write'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should allow POST /api/v1/agents/:id/credentials/:credId/rotate with agents:write scope', () => {
const req = makeReq(
'POST',
'/api/v1',
'/agents/550e8400-e29b-41d4-a716-446655440000/credentials/cred-id-001/rotate',
makeUser('agents:write'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should deny POST /api/v1/agents/:id/credentials/:credId/rotate with agents:read scope', () => {
const req = makeReq(
'POST',
'/api/v1',
'/agents/550e8400-e29b-41d4-a716-446655440000/credentials/cred-id-001/rotate',
makeUser('agents:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should allow DELETE /api/v1/agents/:id/credentials/:credId with agents:write scope', () => {
const req = makeReq(
'DELETE',
'/api/v1',
'/agents/550e8400-e29b-41d4-a716-446655440000/credentials/cred-id-001',
makeUser('agents:write'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
// ── tokens:read endpoints ──────────────────────────────────────────────────
it('should allow POST /api/v1/token/introspect with tokens:read scope', () => {
const req = makeReq(
'POST',
'/api/v1',
'/token/introspect',
makeUser('tokens:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should deny POST /api/v1/token/introspect with agents:read scope only', () => {
const req = makeReq(
'POST',
'/api/v1',
'/token/introspect',
makeUser('agents:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should allow POST /api/v1/token/revoke with tokens:read scope', () => {
const req = makeReq(
'POST',
'/api/v1',
'/token/revoke',
makeUser('tokens:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should deny POST /api/v1/token/revoke without tokens:read scope', () => {
const req = makeReq(
'POST',
'/api/v1',
'/token/revoke',
makeUser('agents:write'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
// ── audit:read endpoints ───────────────────────────────────────────────────
it('should allow GET /api/v1/audit with audit:read scope', () => {
const req = makeReq('GET', '/api/v1', '/audit', makeUser('audit:read')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should deny GET /api/v1/audit with agents:read scope only', () => {
const req = makeReq('GET', '/api/v1', '/audit', makeUser('agents:read')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should allow GET /api/v1/audit/:id with audit:read scope (UUID path)', () => {
const req = makeReq(
'GET',
'/api/v1',
'/audit/550e8400-e29b-41d4-a716-446655440000',
makeUser('audit:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should deny GET /api/v1/audit/:id without audit:read scope', () => {
const req = makeReq(
'GET',
'/api/v1',
'/audit/550e8400-e29b-41d4-a716-446655440000',
makeUser('tokens:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
// ── Path normalisation ────────────────────────────────────────────────────
it('should normalise UUID agent path correctly (longest segment first)', () => {
// Full rotate path with real UUIDs — must hit the :credId/rotate rule
const req = makeReq(
'POST',
'/api/v1',
'/agents/a1b2c3d4-e5f6-4000-8000-ef1234567890/credentials/b2c3d4e5-f6a7-4000-8000-fa2345678901/rotate',
makeUser('agents:write'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should normalise path with non-UUID segment identifiers', () => {
// Non-UUID IDs are still matched by the regex (any non-slash characters)
const req = makeReq(
'GET',
'/api/v1',
'/agents/my-agent-slug',
makeUser('agents:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
// ── Unknown / unmapped paths ──────────────────────────────────────────────
it('should deny (fail-closed) when path has no matching entry in scopes.json', () => {
const req = makeReq(
'GET',
'/api/v1',
'/unknown/resource',
makeUser('agents:read agents:write tokens:read audit:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should deny (fail-closed) for a valid path with wrong HTTP method', () => {
// PUT is not in scopes.json for any endpoint
const req = makeReq(
'PUT',
'/api/v1',
'/agents',
makeUser('agents:read agents:write'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
// ── Multi-scope token ─────────────────────────────────────────────────────
it('should allow access when token has multiple scopes including the required one', () => {
const req = makeReq(
'GET',
'/api/v1',
'/audit',
makeUser('agents:read tokens:read audit:read'),
) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
});
// ─── reloadOpaPolicy ──────────────────────────────────────────────────────────
describe('reloadOpaPolicy()', () => {
it('should reload without error and continue to enforce policy correctly', async () => {
await expect(reloadOpaPolicy()).resolves.toBeUndefined();
// After reload, fallback mode should still work — create a fresh middleware
const mw = await createOpaMiddleware();
const next = jest.fn() as jest.MockedFunction<NextFunction>;
const req = {
method: 'GET',
baseUrl: '/api/v1',
path: '/agents',
user: {
sub: 'agent-xyz',
client_id: 'agent-xyz',
scope: 'agents:read',
jti: 'jti-reload',
iat: 1000,
exp: 9999999999,
},
} as unknown as Request;
mw(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(/* no error */);
});
it('should still deny access after reload when scope is insufficient', async () => {
await reloadOpaPolicy();
const mw = await createOpaMiddleware();
const next = jest.fn() as jest.MockedFunction<NextFunction>;
const req = {
method: 'POST',
baseUrl: '/api/v1',
path: '/token/introspect',
user: {
sub: 'agent-xyz',
client_id: 'agent-xyz',
scope: 'agents:read',
jti: 'jti-reload-deny',
iat: 1000,
exp: 9999999999,
},
} as unknown as Request;
mw(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
});

169
tests/unit/middleware/opa.wasm.test.ts Normal file
View File

@@ -0,0 +1,169 @@
/**
* Unit tests for src/middleware/opa.ts — Wasm mode and fail-closed edge cases.
*
* This file is kept separate from opa.test.ts because it needs different
* `fs.existsSync` and `@open-policy-agent/opa-wasm` mock behaviour.
*
* Jest's module registry is isolated per test file, so the module-level
* singletons (`wasmPolicy`, `scopesMap`) are fresh for each file.
*/
import path from 'path';
import { Request, Response, NextFunction } from 'express';
import { RequestHandler } from 'express';
import { ITokenPayload } from '../../../src/types/index';
import { AuthorizationError } from '../../../src/utils/errors';
// ─── Point POLICY_DIR at the real policies directory ─────────────────────────
const PROJECT_ROOT = path.resolve(__dirname, '../../..');
const POLICIES_DIR = path.join(PROJECT_ROOT, 'policies');
process.env['POLICY_DIR'] = POLICIES_DIR;
// ─── Wasm mock — a LoadedPolicy-like object ───────────────────────────────────
/** Tracks calls so individual tests can assert on evaluation results. */
const mockEvaluate = jest.fn();
const mockSetData = jest.fn();
const MOCK_LOADED_POLICY = {
evaluate: mockEvaluate,
setData: mockSetData,
};
// Mock @open-policy-agent/opa-wasm BEFORE the module is loaded
jest.mock('@open-policy-agent/opa-wasm', () => ({
loadPolicy: jest.fn().mockResolvedValue(MOCK_LOADED_POLICY),
}));
// ─── Mock fs: existsSync returns true for .wasm AND scopes.json ──────────────
jest.mock('fs', () => {
const actual = jest.requireActual<typeof import('fs')>('fs');
return {
...actual,
existsSync: jest.fn((_filePath: unknown) => {
// Both .wasm and other paths exist
return true;
}),
readFileSync: jest.fn((filePath: unknown, encoding?: unknown) => {
if (typeof filePath === 'string' && filePath.endsWith('.wasm')) {
// Return a Buffer-like object for the Wasm bundle
return Buffer.from('fake-wasm-bytes');
}
// For scopes.json, delegate to the real fs
return actual.readFileSync(filePath as string, encoding as BufferEncoding);
}),
};
});
// Import AFTER mocks
import { createOpaMiddleware, reloadOpaPolicy } from '../../../src/middleware/opa';
// ─── Helpers ──────────────────────────────────────────────────────────────────
function makeUser(scope: string): ITokenPayload {
return {
sub: 'agent-wasm-test',
client_id: 'agent-wasm-test',
scope,
jti: 'jti-wasm-001',
iat: 1000,
exp: 9999999999,
};
}
function makeReq(
method: string,
baseUrl: string,
reqPath: string,
user?: ITokenPayload,
): Partial<Request> {
return { method, baseUrl, path: reqPath, user };
}
// ─── Tests ────────────────────────────────────────────────────────────────────
describe('createOpaMiddleware (Wasm mode)', () => {
let middleware: RequestHandler;
let next: jest.MockedFunction<NextFunction>;
beforeAll(async () => {
middleware = await createOpaMiddleware();
});
beforeEach(() => {
next = jest.fn();
mockEvaluate.mockReset();
});
it('should load in Wasm mode and call setData with scopes.json', () => {
// setData is called once during createOpaMiddleware() → loadWasmPolicy()
expect(mockSetData).toHaveBeenCalledTimes(1);
});
it('should allow request when Wasm policy evaluate returns allow: true', () => {
mockEvaluate.mockReturnValue([{ result: { allow: true } }]);
const req = makeReq('GET', '/api/v1', '/agents', makeUser('agents:read')) as Request;
middleware(req, {} as Response, next);
expect(mockEvaluate).toHaveBeenCalledTimes(1);
expect(next).toHaveBeenCalledWith(/* no args */);
});
it('should deny request when Wasm policy evaluate returns allow: false', () => {
mockEvaluate.mockReturnValue([{ result: { allow: false } }]);
const req = makeReq('GET', '/api/v1', '/agents', makeUser('agents:read')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should deny request when Wasm evaluate returns empty result set', () => {
mockEvaluate.mockReturnValue([]);
const req = makeReq('POST', '/api/v1', '/agents', makeUser('agents:write')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should deny request when Wasm evaluate returns non-array result', () => {
mockEvaluate.mockReturnValue(null);
const req = makeReq('GET', '/api/v1', '/audit', makeUser('audit:read')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(expect.any(AuthorizationError));
});
it('should propagate unexpected errors thrown by Wasm evaluate to next', () => {
const wasmError = new Error('Wasm evaluation failure');
mockEvaluate.mockImplementation(() => { throw wasmError; });
const req = makeReq('GET', '/api/v1', '/agents', makeUser('agents:read')) as Request;
middleware(req, {} as Response, next);
expect(next).toHaveBeenCalledWith(wasmError);
});
it('should call next(AuthorizationError) with "not authenticated" when req.user is absent in Wasm mode', () => {
const req = makeReq('GET', '/api/v1', '/agents', undefined) as Request;
middleware(req, {} as Response, next);
const err = (next as jest.Mock).mock.calls[0][0] as AuthorizationError;
expect(err).toBeInstanceOf(AuthorizationError);
expect(err.message).toMatch(/not authenticated/i);
});
});
describe('reloadOpaPolicy (Wasm mode)', () => {
it('should reload in Wasm mode without error', async () => {
await expect(reloadOpaPolicy()).resolves.toBeUndefined();
// setData should have been called again during reload
expect(mockSetData).toHaveBeenCalled();
});
});

1
tests/unit/repositories/CredentialRepository.test.ts
View File

@@ -38,6 +38,7 @@ const EXPECTED_CREDENTIAL: ICredential = {
const EXPECTED_CREDENTIAL_ROW: ICredentialRow = {
...EXPECTED_CREDENTIAL,
secretHash: CREDENTIAL_ROW.secret_hash,
vaultPath: null,
};
// ─── suite ───────────────────────────────────────────────────────────────────

14
tests/unit/services/OAuth2Service.test.ts
View File

@@ -13,7 +13,6 @@ import {
AuthenticationError,
AuthorizationError,
FreeTierLimitError,
InsufficientScopeError,
} from '../../../src/utils/errors';
import { IAgent, ICredential, ICredentialRow, ITokenPayload } from '../../../src/types/index';
import { hashSecret, generateClientSecret } from '../../../src/utils/crypto';
@@ -91,7 +90,7 @@ describe('OAuth2Service', () => {
revokedAt: null,
};
credentialRow = { ...mockCredential, secretHash };
credentialRow = { ...mockCredential, secretHash, vaultPath: null };
credentialRepo.findByAgentId.mockResolvedValue({ credentials: [mockCredential], total: 1 });
credentialRepo.findById.mockResolvedValue(credentialRow);
@@ -188,11 +187,14 @@ describe('OAuth2Service', () => {
expect(result.active).toBe(false);
});
it('should throw InsufficientScopeError if caller lacks tokens:read', async () => {
it('should introspect successfully regardless of caller scope (tokens:read enforced by OPA middleware)', async () => {
// Scope enforcement for tokens:read has been moved to OpaMiddleware.
// The service introspects any token presented to it once the request has
// passed the middleware layer.
tokenRepo.isRevoked.mockResolvedValue(false);
const noScopePayload = { ...callerPayload, scope: 'agents:read' };
await expect(
service.introspectToken(validToken, noScopePayload, IP, UA),
).rejects.toThrow(InsufficientScopeError);
const result = await service.introspectToken(validToken, noScopePayload, IP, UA);
expect(result.active).toBe(true);
});
it('should return active: false for an expired token', async () => {