accounts-frontend/packages/app/components/user/middlewares/refreshTokenMiddleware.test.ts

/* eslint-disable @typescript-eslint/no-non-null-assertion */
import expect from 'app/test/unexpected';
import sinon, { SinonSpy, SinonStub } from 'sinon';

import refreshTokenMiddleware from 'app/components/user/middlewares/refreshTokenMiddleware';
import { browserHistory } from 'app/services/history';
import * as authentication from 'app/services/api/authentication';
import { InternalServerError, Middleware } from 'app/services/request';
import { updateToken } from 'app/components/accounts/actions';
import { MiddlewareRequestOptions } from '../../../services/request/PromiseMiddlewareLayer';

const refreshToken = 'foo';
const expiredToken =
    'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE0NzA3NjE0NDMsImV4cCI6MTQ3MDc2MTQ0MywiaWF0IjoxNDcwNzYxNDQzLCJqdGkiOiJpZDEyMzQ1NiJ9.gWdnzfQQvarGpkbldUvB8qdJZSVkvdNtCbhbbl2yJW8';
// valid till 2100 year
const validToken =
    'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE0NzA3NjE5NzcsImV4cCI6NDEwMjQ0NDgwMCwiaWF0IjoxNDcwNzYxOTc3LCJqdGkiOiJpZDEyMzQ1NiJ9.M4KY4QgHOUzhpAZjWoHJbGsEJPR-RBsJ1c1BKyxvAoU';

describe('refreshTokenMiddleware', () => {
    let middleware: Middleware;
    let getState: SinonStub;
    let dispatch: SinonSpy<[any], any>;

    const email = 'test@email.com';

    beforeEach(() => {
        sinon.stub(authentication, 'requestToken').named('authentication.requestToken');
        sinon.stub(authentication, 'logout').named('authentication.logout');
        sinon.stub(browserHistory, 'push');

        getState = sinon.stub().named('store.getState');
        dispatch = sinon
            .spy((arg) => (typeof arg === 'function' ? arg(dispatch, getState) : arg))
            .named('store.dispatch');

        middleware = refreshTokenMiddleware({ getState, dispatch } as any);
    });

    afterEach(() => {
        (authentication.requestToken as any).restore();
        (authentication.logout as any).restore();
        (browserHistory.push as any).restore();
    });

    function assertRelogin() {
        expect(dispatch, 'to have a call satisfying', [
            {
                type: 'auth:setCredentials',
                payload: {
                    login: email,
                    returnUrl: expect.it('to be a string'),
                },
            },
        ]);

        expect(browserHistory.push, 'to have a call satisfying', ['/login']);
    }

    it('must be till 2100 to test with validToken', () => expect(new Date().getFullYear(), 'to be less than', 2100));

    describe('#before', () => {
        describe('when token expired', () => {
            beforeEach(() => {
                const account = {
                    id: 42,
                    email,
                    token: expiredToken,
                    refreshToken,
                };
                getState.returns({
                    accounts: {
                        active: account.id,
                        available: [account],
                    },
                    auth: {
                        credentials: {},
                    },
                    user: {},
                });
            });

            it('should request new token', () => {
                const data = {
                    url: 'foo',
                    options: {
                        headers: {},
                    },
                };

                (authentication.requestToken as any).returns(Promise.resolve(validToken));

                return middleware.before!(data).then((resp) => {
                    expect(resp, 'to satisfy', data);

                    expect(authentication.requestToken, 'to have a call satisfying', [refreshToken]);
                });
            });

            it('should not apply to refresh-token request', () => {
                const data: MiddlewareRequestOptions = {
                    url: '/refresh-token',
                    options: {
                        headers: {},
                    },
                };
                const resp = middleware.before!(data);

                return expect(resp, 'to be fulfilled with', data).then(() =>
                    expect(authentication.requestToken, 'was not called'),
                );
            });

            it('should not auto refresh token if options.token specified', () => {
                const data: MiddlewareRequestOptions = {
                    url: 'foo',
                    options: {
                        token: 'foo',
                        headers: {},
                    },
                };
                middleware.before!(data);

                expect(authentication.requestToken, 'was not called');
            });

            it('should update user with new token', () => {
                const data = {
                    url: 'foo',
                    options: {
                        headers: {},
                    },
                };

                (authentication.requestToken as any).returns(Promise.resolve(validToken));

                return middleware.before!(data).then(() =>
                    expect(dispatch, 'to have a call satisfying', [updateToken(validToken)]),
                );
            });

            it('should relogin if token can not be parsed', () => {
                const account = {
                    id: 42,
                    email,
                    token: 'realy bad token',
                    refreshToken,
                };
                getState.returns({
                    accounts: {
                        active: account.id,
                        available: [account],
                    },
                    auth: {
                        credentials: {},
                    },
                    user: {},
                });

                const req: MiddlewareRequestOptions = {
                    url: 'foo',
                    options: { headers: {} },
                };

                return expect(middleware.before!(req), 'to be rejected with', {
                    message: 'Invalid token',
                }).then(() => {
                    expect(authentication.requestToken, 'was not called');

                    assertRelogin();
                });
            });

            it('should relogin if token request failed', () => {
                (authentication.requestToken as any).returns(Promise.reject());

                return expect(middleware.before!({ url: 'foo', options: { headers: {} } }), 'to be rejected').then(() =>
                    assertRelogin(),
                );
            });

            it('should not logout if request failed with 5xx', () => {
                const resp = new InternalServerError({}, { status: 500 });

                (authentication.requestToken as any).returns(Promise.reject(resp));

                return expect(
                    middleware.before!({ url: 'foo', options: { headers: {} } }),
                    'to be rejected with',
                    resp,
                ).then(() => expect(dispatch, 'to have no calls satisfying', [{ payload: { isGuest: true } }]));
            });
        });

        it('should not be applied if no token', () => {
            getState.returns({
                accounts: {
                    active: null,
                    available: [],
                },
                user: {},
            });

            const data: MiddlewareRequestOptions = {
                url: 'foo',
                options: {
                    headers: {},
                },
            };
            const resp = middleware.before!(data);

            return expect(resp, 'to be fulfilled with', data).then(() =>
                expect(authentication.requestToken, 'was not called'),
            );
        });
    });

    describe('#catch', () => {
        const expiredResponse = {
            name: 'Unauthorized',
            message: 'Token expired',
            code: 0,
            status: 401,
            type: 'yii\\web\\UnauthorizedHttpException',
        };

        const badTokenReponse = {
            name: 'Unauthorized',
            message: 'You are requesting with an invalid credential.',
            code: 0,
            status: 401,
            type: 'yii\\web\\UnauthorizedHttpException',
        };

        const incorrectTokenReponse = {
            name: 'Unauthorized',
            message: 'Incorrect token',
            code: 0,
            status: 401,
            type: 'yii\\web\\UnauthorizedHttpException',
        };

        let restart: SinonStub;

        beforeEach(() => {
            getState.returns({
                accounts: {
                    active: 1,
                    available: [
                        {
                            id: 1,
                            email,
                            token: 'old token',
                            refreshToken,
                        },
                    ],
                },
                user: {},
            });

            restart = sinon.stub().named('restart');

            (authentication.requestToken as any).returns(Promise.resolve(validToken));
        });

        function assertNewTokenRequest() {
            expect(authentication.requestToken, 'to have a call satisfying', [refreshToken]);
            expect(restart, 'was called');
            expect(dispatch, 'was called');
        }

        it('should request new token if expired', () =>
            expect(
                middleware.catch!(expiredResponse, { url: '', options: { headers: {} } }, restart),
                'to be fulfilled',
            ).then(assertNewTokenRequest));

        it('should request new token if invalid credential', () =>
            expect(
                middleware.catch!(badTokenReponse, { url: '', options: { headers: {} } }, restart),
                'to be fulfilled',
            ).then(assertNewTokenRequest));

        it('should request new token if token is incorrect', () =>
            expect(
                middleware.catch!(incorrectTokenReponse, { url: '', options: { headers: {} } }, restart),
                'to be fulfilled',
            ).then(assertNewTokenRequest));

        it('should relogin if no refreshToken', () => {
            getState.returns({
                accounts: {
                    active: 1,
                    available: [
                        {
                            id: 1,
                            email,
                            refreshToken: null,
                        },
                    ],
                },
                auth: {
                    credentials: {},
                },
                user: {},
            });

            return expect(
                middleware.catch!(incorrectTokenReponse, { url: '', options: { headers: {} } }, restart),
                'to be rejected',
            ).then(() => {
                assertRelogin();
            });
        });

        it('should pass the request through if options.token specified', () => {
            const promise = middleware.catch!(
                expiredResponse,
                {
                    url: '',
                    options: {
                        token: 'foo',
                        headers: {},
                    },
                },
                restart,
            );

            return expect(promise, 'to be rejected with', expiredResponse).then(() => {
                expect(restart, 'was not called');
                expect(authentication.requestToken, 'was not called');
            });
        });

        it('should pass the rest of failed requests through', () => {
            const resp = {};

            const promise = middleware.catch!(
                resp,
                {
                    url: '',
                    options: {
                        headers: {},
                    },
                },
                restart,
            );

            return expect(promise, 'to be rejected with', resp).then(() => {
                expect(restart, 'was not called');
                expect(authentication.requestToken, 'was not called');
            });
        });
    });
});