Initial commit

spec/api/v2/management/jwt_authentication_middleware_spec.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+describe API::V2::Management::JWTAuthenticationMiddleware, type: :request do
+    let(:member) { create(:member, :verified_identity) }
+    let(:config) { management_api_v2_security_configuration }
+
+    before do
+      defaults_for_management_api_v2_security_configuration!
+      config.merge! \
+        scopes: {
+          tools: { permitted_signers: %i[alex jeff], mandatory_signers: %i[alex] }
+        }
+    end
+
+    it 'works in standard conditions' do
+      post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({}, :alex)
+      expect(response).to be_successful
+    end
+    # FIXME fix swagger_doc
+    # it 'allows GET and doesn\'t require authentication for documentation' do
+    #   get '/api/v2/management/swagger_doc'
+    #   expect(response).to be_successful
+    # end
+
+    it 'doesn\'t allow query parameters' do
+      post '/api/v2/management/timestamp?foo=baz&baz=qux'
+      expect(response).to have_http_status(400)
+      expect(response.body).to match(/query parameters/i)
+    end
+
+    it 'requires JSON in the request body' do
+      post '/api/v2/management/timestamp', params: 'foo=baz&baz=qux'
+      expect(response).to have_http_status(400)
+      expect(response.body).to match(/only json/i)
+    end
+
+    it 'denies access when not enough signatures are supplied' do
+      post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({})
+      expect(response).to have_http_status(401)
+      expect(response.body).to match(/not enough signatures/i)
+    end
+
+    it 'denies access when token is expired' do
+      config[:jwt][:verify_expiration] = true
+      post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ exp: 1.minute.ago.to_i }, :alex)
+      expect(response).to have_http_status(401)
+      expect(response.body).to match(/failed to verify jwt/i)
+    end
+
+    context 'valid issuer' do
+      before { config[:jwt][:verify_iss] = true }
+      before { config[:jwt].merge!(iss: 'qux') }
+      it 'validates issuer' do
+        post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ iss: 'qux' }, :alex)
+        expect(response).to be_successful
+      end
+    end
+
+    context 'invalid issuer' do
+      before { config[:jwt][:verify_iss] = true }
+      before { config[:jwt].merge!(iss: 'qux') }
+      it 'validates issuer' do
+        post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ iss: 'hacker' }, :alex)
+        expect(response).to have_http_status(401)
+        expect(response.body).to match(/failed to verify jwt/i)
+      end
+    end
+
+    context 'valid audience' do
+      before { config[:jwt][:verify_aud] = true }
+      before { config[:jwt].merge!(aud: 'qux') }
+      it 'validates audience' do
+        post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ aud: 'qux' }, :alex)
+        expect(response).to be_successful
+      end
+    end
+
+    context 'invalid audience' do
+      before { config[:jwt][:verify_aud] = true }
+      before { config[:jwt].merge!(aud: 'qux') }
+      it 'validates audience' do
+        post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ aud: 'hacker' }, :alex)
+        expect(response).to have_http_status(401)
+        expect(response.body).to match(/failed to verify jwt/i)
+      end
+    end
+
+    context 'missing JWT ID' do
+      before { config[:jwt][:verify_jti] = true }
+      it 'requires JTI' do
+        post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({}, :alex)
+        expect(response).to have_http_status(401)
+        expect(response.body).to match(/failed to verify jwt/i)
+      end
+    end
+
+    context 'issued at in future' do
+      before { config[:jwt][:verify_iat] = true }
+      it 'denies access' do
+        post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ iat: 200.seconds.from_now.to_i }, :alex)
+        expect(response).to have_http_status(401)
+        expect(response.body).to match(/failed to verify jwt/i)
+      end
+    end
+
+    context 'issued at before future' do
+      before { config[:jwt][:verify_iat] = true }
+      it 'allows access' do
+        post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ iat: 3.seconds.ago.to_i }, :alex)
+        expect(response).to have_http_status(200)
+      end
+    end
+  end