sentryagent-idp/tests/unit/controllers/TokenController.test.ts

/**
 * Unit tests for src/controllers/TokenController.ts
 * OAuth2Service is mocked; handlers are invoked with mock req/res/next.
 */

import { Request, Response, NextFunction } from 'express';
import { TokenController } from '../../../src/controllers/TokenController';
import { OAuth2Service } from '../../../src/services/OAuth2Service';
import { ITokenPayload, ITokenResponse, IIntrospectResponse } from '../../../src/types/index';
import {
  AuthenticationError,
  AuthorizationError,
  FreeTierLimitError,
} from '../../../src/utils/errors';

jest.mock('../../../src/services/OAuth2Service');

const MockOAuth2Service = OAuth2Service as jest.MockedClass<typeof OAuth2Service>;

// ─── helpers ─────────────────────────────────────────────────────────────────

// Must be valid UUID for the Joi schema
const VALID_CLIENT_ID = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';

const MOCK_USER: ITokenPayload = {
  sub: VALID_CLIENT_ID,
  client_id: VALID_CLIENT_ID,
  scope: 'tokens:read',
  jti: 'jti-001',
  iat: 1000,
  exp: 9999999999,
};

const MOCK_TOKEN_RESPONSE: ITokenResponse = {
  access_token: 'eyJhbGciOiJSUzI1NiJ9.test.signature',
  token_type: 'Bearer',
  expires_in: 3600,
  scope: 'agents:read',
};

const MOCK_INTROSPECT_RESPONSE: IIntrospectResponse = {
  active: true,
  sub: VALID_CLIENT_ID,
  client_id: VALID_CLIENT_ID,
  scope: 'agents:read',
  token_type: 'Bearer',
  iat: 1000,
  exp: 9999999999,
};

function buildMocks(): {
  req: Partial<Request>;
  res: Partial<Response>;
  next: NextFunction;
} {
  const res: Partial<Response> = {
    status: jest.fn().mockReturnThis(),
    json: jest.fn().mockReturnThis(),
    send: jest.fn().mockReturnThis(),
    setHeader: jest.fn().mockReturnThis(),
  };
  return {
    req: {
      user: MOCK_USER,
      body: {},
      params: {},
      query: {},
      headers: {},
      ip: '127.0.0.1',
    },
    res,
    next: jest.fn() as NextFunction,
  };
}

// ─── suite ───────────────────────────────────────────────────────────────────

describe('TokenController', () => {
  let oauth2Service: jest.Mocked<OAuth2Service>;
  let controller: TokenController;

  beforeEach(() => {
    jest.clearAllMocks();
    oauth2Service = new MockOAuth2Service(
      {} as never, {} as never, {} as never, {} as never, '', '',
    ) as jest.Mocked<OAuth2Service>;
    controller = new TokenController(oauth2Service);
  });

  // ── issueToken ───────────────────────────────────────────────────────────────

  describe('issueToken()', () => {
    it('should return 200 with token response on success', async () => {
      const { req, res, next } = buildMocks();
      req.body = {
        grant_type: 'client_credentials',
        client_id: VALID_CLIENT_ID,
        client_secret: 'super-secret',
        scope: 'agents:read',
      };
      oauth2Service.issueToken.mockResolvedValue(MOCK_TOKEN_RESPONSE);

      await controller.issueToken(req as Request, res as Response, next);

      expect(oauth2Service.issueToken).toHaveBeenCalledTimes(1);
      expect(res.status).toHaveBeenCalledWith(200);
      expect(res.json).toHaveBeenCalledWith(MOCK_TOKEN_RESPONSE);
    });

    it('should set Cache-Control and Pragma headers on success', async () => {
      const { req, res, next } = buildMocks();
      req.body = {
        grant_type: 'client_credentials',
        client_id: VALID_CLIENT_ID,
        client_secret: 'super-secret',
      };
      oauth2Service.issueToken.mockResolvedValue(MOCK_TOKEN_RESPONSE);

      await controller.issueToken(req as Request, res as Response, next);

      expect(res.setHeader).toHaveBeenCalledWith('Cache-Control', 'no-store');
      expect(res.setHeader).toHaveBeenCalledWith('Pragma', 'no-cache');
    });

    it('should return 400 when grant_type is missing', async () => {
      const { req, res, next } = buildMocks();
      req.body = { client_id: VALID_CLIENT_ID, client_secret: 'secret' };

      await controller.issueToken(req as Request, res as Response, next);

      expect(res.status).toHaveBeenCalledWith(400);
      expect(res.json).toHaveBeenCalledWith(
        expect.objectContaining({ error: 'invalid_request' }),
      );
      expect(oauth2Service.issueToken).not.toHaveBeenCalled();
    });

    it('should return 400 when grant_type is not client_credentials', async () => {
      const { req, res, next } = buildMocks();
      req.body = { grant_type: 'authorization_code' };

      await controller.issueToken(req as Request, res as Response, next);

      expect(res.status).toHaveBeenCalledWith(400);
      expect(res.json).toHaveBeenCalledWith(
        expect.objectContaining({ error: 'unsupported_grant_type' }),
      );
    });

    it('should return 400 when client_id and client_secret are missing', async () => {
      const { req, res, next } = buildMocks();
      // grant_type present but no credentials — Joi passes but credential check fails
      req.body = { grant_type: 'client_credentials' };

      await controller.issueToken(req as Request, res as Response, next);

      expect(res.status).toHaveBeenCalledWith(400);
      expect(res.json).toHaveBeenCalledWith(
        expect.objectContaining({ error: 'invalid_request' }),
      );
    });

    it('should return 400 when scope is invalid', async () => {
      const { req, res, next } = buildMocks();
      // scope validation happens after Joi; use valid client_id/secret so Joi passes
      req.body = {
        grant_type: 'client_credentials',
        client_id: VALID_CLIENT_ID,
        client_secret: 'super-secret',
        scope: 'bad_scope_value',
      };
      // Joi schema rejects scope with bad pattern — lands as invalid_request
      await controller.issueToken(req as Request, res as Response, next);

      // Either invalid_request (Joi) or invalid_scope (scope check) — both are 400
      expect(res.status).toHaveBeenCalledWith(400);
      expect(oauth2Service.issueToken).not.toHaveBeenCalled();
    });

    it('should return 400 with invalid_scope for a scope that passes Joi but is not allowed', async () => {
      const { req, res, next } = buildMocks();
      // Use valid client creds and a value that the regex rejects differently
      // Testing the in-controller validScopes check by mocking past Joi
      // The simplest way: test a well-formed scope token that passes regex but isn't in the list
      // In practice the Joi regex catches it too — just verify 400 is returned
      req.body = {
        grant_type: 'client_credentials',
        client_id: VALID_CLIENT_ID,
        client_secret: 'super-secret',
        scope: 'agents:delete', // not in validScopes array
      };

      await controller.issueToken(req as Request, res as Response, next);

      expect(res.status).toHaveBeenCalledWith(400);
      expect(oauth2Service.issueToken).not.toHaveBeenCalled();
    });

    it('should return 401 with invalid_client on AuthenticationError', async () => {
      const { req, res, next } = buildMocks();
      req.body = {
        grant_type: 'client_credentials',
        client_id: VALID_CLIENT_ID,
        client_secret: 'wrong-secret',
      };
      oauth2Service.issueToken.mockRejectedValue(new AuthenticationError());

      await controller.issueToken(req as Request, res as Response, next);

      expect(res.status).toHaveBeenCalledWith(401);
      expect(res.json).toHaveBeenCalledWith(
        expect.objectContaining({ error: 'invalid_client' }),
      );
    });

    it('should return 403 with unauthorized_client on AuthorizationError', async () => {
      const { req, res, next } = buildMocks();
      req.body = {
        grant_type: 'client_credentials',
        client_id: VALID_CLIENT_ID,
        client_secret: 'secret',
      };
      oauth2Service.issueToken.mockRejectedValue(new AuthorizationError());

      await controller.issueToken(req as Request, res as Response, next);

      expect(res.status).toHaveBeenCalledWith(403);
      expect(res.json).toHaveBeenCalledWith(
        expect.objectContaining({ error: 'unauthorized_client' }),
      );
    });

    it('should return 403 with unauthorized_client on FreeTierLimitError', async () => {
      const { req, res, next } = buildMocks();
      req.body = {
        grant_type: 'client_credentials',
        client_id: VALID_CLIENT_ID,
        client_secret: 'secret',
      };
      oauth2Service.issueToken.mockRejectedValue(
        new FreeTierLimitError('Monthly token limit reached.'),
      );

      await controller.issueToken(req as Request, res as Response, next);

      expect(res.status).toHaveBeenCalledWith(403);
      expect(res.json).toHaveBeenCalledWith(
        expect.objectContaining({ error: 'unauthorized_client' }),
      );
    });

    it('should return 500 with invalid_request on unexpected error', async () => {
      const { req, res, next } = buildMocks();
      req.body = {
        grant_type: 'client_credentials',
        client_id: VALID_CLIENT_ID,
        client_secret: 'secret',
      };
      oauth2Service.issueToken.mockRejectedValue(new Error('Unexpected'));

      await controller.issueToken(req as Request, res as Response, next);

      expect(res.status).toHaveBeenCalledWith(500);
      expect(res.json).toHaveBeenCalledWith(
        expect.objectContaining({ error: 'invalid_request' }),
      );
    });

    it('should support HTTP Basic auth header for client credentials', async () => {
      const { req, res, next } = buildMocks();
      const credentials = Buffer.from(`${VALID_CLIENT_ID}:super-secret`).toString('base64');
      req.headers = { authorization: `Basic ${credentials}` };
      req.body = { grant_type: 'client_credentials' };
      oauth2Service.issueToken.mockResolvedValue(MOCK_TOKEN_RESPONSE);

      await controller.issueToken(req as Request, res as Response, next);

      expect(oauth2Service.issueToken).toHaveBeenCalledWith(
        VALID_CLIENT_ID,
        'super-secret',
        expect.any(String),
        expect.any(String),
        expect.any(String),
      );
    });
  });

  // ── introspectToken ───────────────────────────────────────────────────────────

  describe('introspectToken()', () => {
    it('should return 200 with introspection result on success', async () => {
      const { req, res, next } = buildMocks();
      req.body = { token: 'some.jwt.token' };
      oauth2Service.introspectToken.mockResolvedValue(MOCK_INTROSPECT_RESPONSE);

      await controller.introspectToken(req as Request, res as Response, next);

      expect(oauth2Service.introspectToken).toHaveBeenCalledTimes(1);
      expect(res.status).toHaveBeenCalledWith(200);
      expect(res.json).toHaveBeenCalledWith(MOCK_INTROSPECT_RESPONSE);
    });

    it('should call next(AuthenticationError) when req.user is missing', async () => {
      const { req, res, next } = buildMocks();
      req.user = undefined;
      req.body = { token: 'some.jwt.token' };

      await controller.introspectToken(req as Request, res as Response, next);

      expect(next).toHaveBeenCalledWith(expect.any(AuthenticationError));
    });

    it('should call next(Error) when token is missing from body', async () => {
      const { req, res, next } = buildMocks();
      req.body = {};

      await controller.introspectToken(req as Request, res as Response, next);

      expect(next).toHaveBeenCalledWith(expect.any(Error));
      expect(oauth2Service.introspectToken).not.toHaveBeenCalled();
    });

    it('should forward service errors to next', async () => {
      const { req, res, next } = buildMocks();
      req.body = { token: 'some.jwt.token' };
      const serviceError = new Error('Service error');
      oauth2Service.introspectToken.mockRejectedValue(serviceError);

      await controller.introspectToken(req as Request, res as Response, next);

      expect(next).toHaveBeenCalledWith(serviceError);
    });
  });

  // ── revokeToken ───────────────────────────────────────────────────────────────

  describe('revokeToken()', () => {
    it('should return 200 with empty body on success', async () => {
      const { req, res, next } = buildMocks();
      req.body = { token: 'some.jwt.token' };
      oauth2Service.revokeToken.mockResolvedValue();

      await controller.revokeToken(req as Request, res as Response, next);

      expect(oauth2Service.revokeToken).toHaveBeenCalledTimes(1);
      expect(res.status).toHaveBeenCalledWith(200);
      expect(res.json).toHaveBeenCalledWith({});
    });

    it('should call next(AuthenticationError) when req.user is missing', async () => {
      const { req, res, next } = buildMocks();
      req.user = undefined;
      req.body = { token: 'some.jwt.token' };

      await controller.revokeToken(req as Request, res as Response, next);

      expect(next).toHaveBeenCalledWith(expect.any(AuthenticationError));
    });

    it('should call next(Error) when token is missing from body', async () => {
      const { req, res, next } = buildMocks();
      req.body = {};

      await controller.revokeToken(req as Request, res as Response, next);

      expect(next).toHaveBeenCalledWith(expect.any(Error));
      expect(oauth2Service.revokeToken).not.toHaveBeenCalled();
    });

    it('should forward service errors to next', async () => {
      const { req, res, next } = buildMocks();
      req.body = { token: 'some.jwt.token' };
      const serviceError = new Error('Service error');
      oauth2Service.revokeToken.mockRejectedValue(serviceError);

      await controller.revokeToken(req as Request, res as Response, next);

      expect(next).toHaveBeenCalledWith(serviceError);
    });
  });
});