sentryagent-idp/tests/integration/oidc-trust-policies.test.ts

/**
 * Integration tests for OIDC Trust Policy endpoints.
 * Uses a real Postgres test DB and Redis test instance.
 *
 * Routes covered:
 *   POST   /api/v1/oidc/trust-policies           — create a trust policy
 *   GET    /api/v1/oidc/trust-policies/:agentId  — list trust policies for an agent
 *   DELETE /api/v1/oidc/trust-policies/:id       — delete a trust policy
 */

import crypto from 'crypto';
import request from 'supertest';
import { Application } from 'express';
import { v4 as uuidv4 } from 'uuid';
import { Pool } from 'pg';

const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: { type: 'spki', format: 'pem' },
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
});

process.env['DATABASE_URL'] =
  process.env['TEST_DATABASE_URL'] ??
  'postgresql://sentryagent:sentryagent@localhost:5432/sentryagent_idp_test';
process.env['REDIS_URL'] = process.env['TEST_REDIS_URL'] ?? 'redis://localhost:6379/1';
process.env['JWT_PRIVATE_KEY'] = privateKey;
process.env['JWT_PUBLIC_KEY'] = publicKey;
process.env['NODE_ENV'] = 'test';
process.env['DEFAULT_ORG_ID'] = 'org_system';

import { createApp } from '../../src/app';
import { signToken } from '../../src/utils/jwt';
import { closePool } from '../../src/db/pool';
import { closeRedisClient } from '../../src/cache/redis';

const ORG_ID = uuidv4();
const AGENT_ID = uuidv4();
const SCOPE = 'agents:write';

function makeToken(sub: string = AGENT_ID, scope: string = SCOPE, orgId: string = ORG_ID): string {
  return signToken({ sub, client_id: sub, scope, organization_id: orgId, jti: uuidv4() }, privateKey);
}

describe('OIDC Trust Policy Endpoints Integration Tests', () => {
  let app: Application;
  let pool: Pool;
  let createdPolicyId: string;

  beforeAll(async () => {
    app = await createApp();
    pool = new Pool({ connectionString: process.env['DATABASE_URL'] });

    await pool.query(`
      CREATE TABLE IF NOT EXISTS organizations (
        organization_id VARCHAR(40) PRIMARY KEY,
        name VARCHAR(100) NOT NULL,
        plan VARCHAR(20) NOT NULL DEFAULT 'free',
        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
      )
    `);

    await pool.query(`
      CREATE TABLE IF NOT EXISTS agents (
        agent_id VARCHAR(40) PRIMARY KEY,
        organization_id VARCHAR(40) NOT NULL,
        email VARCHAR(255) NOT NULL UNIQUE,
        agent_type VARCHAR(50) NOT NULL,
        version VARCHAR(20) NOT NULL,
        capabilities TEXT[] NOT NULL DEFAULT '{}',
        owner VARCHAR(100) NOT NULL,
        deployment_env VARCHAR(50) NOT NULL,
        status VARCHAR(20) NOT NULL DEFAULT 'active',
        is_public BOOLEAN NOT NULL DEFAULT false,
        did TEXT,
        did_created_at TIMESTAMPTZ,
        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
      )
    `);

    await pool.query(`
      CREATE TABLE IF NOT EXISTS oidc_trust_policies (
        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
        provider VARCHAR(20) NOT NULL,
        repository VARCHAR(255) NOT NULL,
        branch VARCHAR(100),
        agent_id VARCHAR(40) NOT NULL,
        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
      )
    `);

    await pool.query(
      `INSERT INTO organizations (organization_id, name) VALUES ($1, $2) ON CONFLICT DO NOTHING`,
      [ORG_ID, 'Test OIDC Org'],
    );

    await pool.query(
      `INSERT INTO agents
         (agent_id, organization_id, email, agent_type, version, capabilities, owner, deployment_env)
       VALUES ($1, $2, $3, 'ci-runner', 'v1.0.0', '{}', 'ci-team', 'production')
       ON CONFLICT DO NOTHING`,
      [AGENT_ID, ORG_ID, `oidc-agent-${AGENT_ID}@test.com`],
    );
  });

  afterAll(async () => {
    await pool.query(`DELETE FROM oidc_trust_policies WHERE agent_id = $1`, [AGENT_ID]);
    await pool.query(`DELETE FROM agents WHERE agent_id = $1`, [AGENT_ID]);
    await pool.query(`DELETE FROM organizations WHERE organization_id = $1`, [ORG_ID]);
    await pool.end();
    await closePool();
    await closeRedisClient();
  });

  // ─── POST /oidc/trust-policies ───────────────────────────────────────────────

  describe('POST /api/v1/oidc/trust-policies', () => {
    it('should create a trust policy and return 201', async () => {
      const res = await request(app)
        .post('/api/v1/oidc/trust-policies')
        .set('Authorization', `Bearer ${makeToken()}`)
        .send({
          provider: 'github',
          repository: 'acme/my-repo',
          branch: 'main',
          agentId: AGENT_ID,
        });

      expect(res.status).toBe(201);
      expect(res.body).toHaveProperty('id');
      createdPolicyId = res.body.id as string;
    });

    it('should return 401 when no token provided', async () => {
      const res = await request(app)
        .post('/api/v1/oidc/trust-policies')
        .send({ provider: 'github', repository: 'acme/repo', agentId: AGENT_ID });

      expect(res.status).toBe(401);
    });

    it('should return 422 for invalid provider', async () => {
      const res = await request(app)
        .post('/api/v1/oidc/trust-policies')
        .set('Authorization', `Bearer ${makeToken()}`)
        .send({ provider: 'gitlab', repository: 'acme/repo', agentId: AGENT_ID });

      expect([400, 422]).toContain(res.status);
    });

    it('should return 422 for malformed repository', async () => {
      const res = await request(app)
        .post('/api/v1/oidc/trust-policies')
        .set('Authorization', `Bearer ${makeToken()}`)
        .send({ provider: 'github', repository: 'no-slash', agentId: AGENT_ID });

      expect([400, 422]).toContain(res.status);
    });
  });

  // ─── GET /oidc/trust-policies/:agentId ──────────────────────────────────────

  describe('GET /api/v1/oidc/trust-policies/:agentId', () => {
    it('should return 200 with list of trust policies', async () => {
      const res = await request(app)
        .get(`/api/v1/oidc/trust-policies/${AGENT_ID}`)
        .set('Authorization', `Bearer ${makeToken()}`);

      expect(res.status).toBe(200);
      expect(Array.isArray(res.body)).toBe(true);
    });

    it('should return 401 when no token provided', async () => {
      const res = await request(app).get(`/api/v1/oidc/trust-policies/${AGENT_ID}`);
      expect(res.status).toBe(401);
    });
  });

  // ─── DELETE /oidc/trust-policies/:id ────────────────────────────────────────

  describe('DELETE /api/v1/oidc/trust-policies/:id', () => {
    it('should return 204 when deleting an existing policy', async () => {
      if (!createdPolicyId) return;
      const res = await request(app)
        .delete(`/api/v1/oidc/trust-policies/${createdPolicyId}`)
        .set('Authorization', `Bearer ${makeToken()}`);

      expect(res.status).toBe(204);
    });

    it('should return 404 when policy does not exist', async () => {
      const res = await request(app)
        .delete(`/api/v1/oidc/trust-policies/${uuidv4()}`)
        .set('Authorization', `Bearer ${makeToken()}`);

      expect(res.status).toBe(404);
    });

    it('should return 401 when no token provided', async () => {
      const res = await request(app).delete(`/api/v1/oidc/trust-policies/${uuidv4()}`);
      expect(res.status).toBe(401);
    });
  });
});