k-mood/crates/application/tests/api_token/api_token_test.rs

use std::sync::Arc;

use domain::api_token::{ApiToken, TokenScope, TokenScopes};
use domain::ports::UserCommandPort;
use domain::provider::ProviderName;
use domain::testing::{FakeApiTokenSecret, InMemoryStore, test_user};
use domain::user::{User, UserId};

use application::api_token::commands::MintApiTokenCommand;
use application::api_token::use_cases::{
    authenticate_api_token, list_api_tokens, mint_api_token, revoke_api_token,
};

struct Fixture {
    store: Arc<InMemoryStore>,
    secrets: Arc<FakeApiTokenSecret>,
    user: User,
}

async fn a_user_with_no_tokens() -> Fixture {
    let store = Arc::new(InMemoryStore::new());
    let user = test_user("alice");
    UserCommandPort::save(store.as_ref(), &user).await.unwrap();

    Fixture {
        store,
        secrets: Arc::new(FakeApiTokenSecret::new()),
        user,
    }
}

impl Fixture {
    async fn mint(&self, name: &str) -> Result<String, application::errors::ApplicationError> {
        self.mint_granting(name, [TokenScope::WriteMetrics]).await
    }

    async fn mint_granting(
        &self,
        name: &str,
        scopes: impl IntoIterator<Item = TokenScope>,
    ) -> Result<String, application::errors::ApplicationError> {
        let deps = mint_api_token::Deps {
            command: self.store.clone(),
            secrets: self.secrets.clone(),
        };

        let minted = mint_api_token::execute(
            MintApiTokenCommand {
                user_id: self.user.id().clone(),
                name: ProviderName::new(name)?,
                scopes: TokenScopes::new(scopes)?,
            },
            &deps,
        )
        .await?;

        Ok(minted.secret().to_string())
    }

    async fn authenticate(&self, secret: &str) -> Option<ApiToken> {
        self.authenticate_for(secret, TokenScope::WriteMetrics)
            .await
    }

    async fn authenticate_for(&self, secret: &str, needed: TokenScope) -> Option<ApiToken> {
        let deps = authenticate_api_token::Deps {
            query: self.store.clone(),
            command: self.store.clone(),
            secrets: self.secrets.clone(),
        };

        authenticate_api_token::execute(secret, needed, &deps)
            .await
            .ok()
    }

    async fn list(&self) -> Vec<ApiToken> {
        let deps = list_api_tokens::Deps {
            query: self.store.clone(),
        };

        list_api_tokens::execute(self.user.id().clone(), &deps)
            .await
            .unwrap()
    }

    async fn revoke(
        &self,
        owner: UserId,
        token: &ApiToken,
    ) -> Result<(), application::errors::ApplicationError> {
        let deps = revoke_api_token::Deps {
            command: self.store.clone(),
        };

        revoke_api_token::execute(owner, token.id().clone(), &deps).await
    }
}

#[tokio::test]
async fn a_minted_token_is_returned_once_and_stored_only_as_a_digest() {
    let fixture = a_user_with_no_tokens().await;

    let secret = fixture.mint("iphone-shortcuts").await.unwrap();

    let stored = fixture.list().await;
    assert_eq!(stored.len(), 1);
    assert_eq!(stored[0].name().value(), "iphone-shortcuts");
    assert!(!secret.is_empty(), "the caller is handed the secret once");
    assert_ne!(
        stored[0].digest().value(),
        secret,
        "what is stored is a digest, not the secret itself"
    );
}

#[tokio::test]
async fn the_secret_authenticates_and_names_the_provider_its_writes_belong_to() {
    let fixture = a_user_with_no_tokens().await;
    let secret = fixture.mint("iphone-shortcuts").await.unwrap();

    let token = fixture.authenticate(&secret).await.expect("it should work");

    assert_eq!(token.user_id(), fixture.user.id());
    assert_eq!(token.name().value(), "iphone-shortcuts");
}

#[tokio::test]
async fn a_secret_nobody_minted_authenticates_nothing() {
    let fixture = a_user_with_no_tokens().await;
    fixture.mint("iphone-shortcuts").await.unwrap();

    assert!(
        fixture
            .authenticate("kmood_not_a_real_secret")
            .await
            .is_none()
    );
}

#[tokio::test]
async fn a_revoked_token_stops_working_at_once() {
    let fixture = a_user_with_no_tokens().await;
    let secret = fixture.mint("iphone-shortcuts").await.unwrap();
    let token = fixture.authenticate(&secret).await.unwrap();

    fixture
        .revoke(fixture.user.id().clone(), &token)
        .await
        .unwrap();

    assert!(fixture.authenticate(&secret).await.is_none());
    assert!(fixture.list().await.is_empty());
}

#[tokio::test]
async fn using_a_token_records_that_it_was_used() {
    let fixture = a_user_with_no_tokens().await;
    let secret = fixture.mint("iphone-shortcuts").await.unwrap();

    assert!(fixture.list().await[0].last_used_at().is_none());

    fixture.authenticate(&secret).await.unwrap();

    assert!(fixture.list().await[0].last_used_at().is_some());
}

#[tokio::test]
async fn nobody_can_revoke_a_token_that_is_not_theirs() {
    let fixture = a_user_with_no_tokens().await;
    let secret = fixture.mint("iphone-shortcuts").await.unwrap();
    let token = fixture.authenticate(&secret).await.unwrap();

    let attempt = fixture.revoke(UserId::generate(), &token).await;

    assert!(attempt.is_err());
    assert!(fixture.authenticate(&secret).await.is_some());
}

#[tokio::test]
async fn two_tokens_cannot_share_a_name_because_the_name_is_the_provider() {
    let fixture = a_user_with_no_tokens().await;
    fixture.mint("iphone-shortcuts").await.unwrap();

    let again = fixture.mint("iphone-shortcuts").await;

    assert!(again.is_err());
    assert_eq!(fixture.list().await.len(), 1);
}

#[tokio::test]
async fn every_minting_produces_a_different_secret() {
    let fixture = a_user_with_no_tokens().await;

    let first = fixture.mint("iphone-shortcuts").await.unwrap();
    let second = fixture.mint("tasker").await.unwrap();

    assert_ne!(first, second);
}

#[tokio::test]
async fn a_token_authenticates_only_for_a_scope_it_grants() {
    let fixture = a_user_with_no_tokens().await;
    let secret = fixture
        .mint_granting("widget", [TokenScope::ReadJournal])
        .await
        .unwrap();

    assert!(
        fixture
            .authenticate_for(&secret, TokenScope::ReadJournal)
            .await
            .is_some(),
        "the scope it was minted for must work"
    );

    for refused in [
        TokenScope::WriteJournal,
        TokenScope::WriteMetrics,
        TokenScope::ReadProfile,
    ] {
        assert!(
            fixture.authenticate_for(&secret, refused).await.is_none(),
            "a read-only token must not pass for {refused}"
        );
    }
}

#[tokio::test]
async fn a_token_can_grant_several_scopes_at_once() {
    let fixture = a_user_with_no_tokens().await;
    let secret = fixture
        .mint_granting(
            "widget",
            [TokenScope::ReadJournal, TokenScope::WriteJournal],
        )
        .await
        .unwrap();

    assert!(
        fixture
            .authenticate_for(&secret, TokenScope::ReadJournal)
            .await
            .is_some()
    );
    assert!(
        fixture
            .authenticate_for(&secret, TokenScope::WriteJournal)
            .await
            .is_some()
    );
    assert!(
        fixture
            .authenticate_for(&secret, TokenScope::ReadProfile)
            .await
            .is_none()
    );
}

#[tokio::test]
async fn the_scopes_a_token_grants_are_listed_back() {
    let fixture = a_user_with_no_tokens().await;
    fixture
        .mint_granting(
            "widget",
            [TokenScope::ReadJournal, TokenScope::WriteJournal],
        )
        .await
        .unwrap();

    let listed = fixture.list().await;

    assert_eq!(listed.len(), 1);
    assert_eq!(
        listed[0].scopes().names(),
        vec!["readJournal", "writeJournal"],
        "a client needs to see what a token it holds can do"
    );
}