exchange.test.ts

import {
  exchangeAccessForApplicationTokens,
  exchangeCustomPartnerToken,
  exchangeAppAutomationTokenForAppManagementAccessToken,
  exchangeAppAutomationTokenForBusinessPlatformAccessToken,
  InvalidGrantError,
  InvalidRequestError,
  refreshAccessToken,
  requestAppToken,
} from './exchange.js'
import {applicationId, clientId} from './identity.js'
import {IdentityToken} from './schema.js'
import {shopifyFetch} from '../../../public/node/http.js'
import {identityFqdn} from '../../../public/node/context/fqdn.js'
import {getLastSeenUserIdAfterAuth, getLastSeenAuthMethod} from '../session.js'
import {AbortError} from '../../../public/node/error.js'

import {describe, test, expect, vi, afterAll, beforeEach} from 'vitest'
import {Response} from 'node-fetch'

const currentDate = new Date(2022, 1, 1, 10)
const expiredDate = new Date(2022, 1, 1, 11)

const data: any = {
  access_token: 'access_token',
  refresh_token: 'refresh_token',
  scope: 'scope scope2',
  expires_in: 3600,
  // id_token:{sub: '1234-5678'}
  id_token: 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0LTU2NzgifQ.L8IiNHncR4xe42f1fLQZFD5D_HBo7oMlfop2FS-NUCU',
}

const identityToken: IdentityToken = {
  accessToken: data.access_token,
  refreshToken: data.refresh_token,
  expiresAt: expiredDate,
  scopes: data.scope.split(' '),
  userId: '1234-5678',
  alias: '1234-5678',
}

vi.mock('../../../public/node/http.js')
vi.mock('../../../public/node/context/fqdn.js')
vi.mock('./identity')

beforeEach(() => {
  vi.mocked(clientId).mockReturnValue('clientId')
  vi.setSystemTime(currentDate)
  vi.mocked(applicationId).mockImplementation((api) => api)
  vi.mocked(identityFqdn).mockResolvedValue('fqdn.com')
})

afterAll(() => {
  // Restore Date mock
  vi.useRealTimers()
})

describe('exchange identity token for application tokens', () => {
  const scopes = {admin: [], partners: [], storefront: [], businessPlatform: [], appManagement: []}

  test('returns tokens for all APIs if a store is passed', async () => {
    // Given
    vi.mocked(shopifyFetch).mockImplementation(async () => Promise.resolve(new Response(JSON.stringify(data))))

    // When
    const got = await exchangeAccessForApplicationTokens(identityToken, scopes, 'storeFQDN')

    // Then
    const expected = {
      'app-management': {
        accessToken: 'access_token',
        expiresAt: expiredDate,
        scopes: ['scope', 'scope2'],
      },
      partners: {
        accessToken: 'access_token',
        expiresAt: expiredDate,
        scopes: ['scope', 'scope2'],
      },
      'storefront-renderer': {
        accessToken: 'access_token',
        expiresAt: expiredDate,
        scopes: ['scope', 'scope2'],
      },
      'storeFQDN-admin': {
        accessToken: 'access_token',
        expiresAt: expiredDate,
        scopes: ['scope', 'scope2'],
      },
      'business-platform': {
        accessToken: 'access_token',
        expiresAt: expiredDate,
        scopes: ['scope', 'scope2'],
      },
    }
    expect(got).toEqual(expected)
  })

  test('does not return token for admin if there is no store', async () => {
    // Given
    const response = new Response(JSON.stringify(data))

    // Need to do it 3 times because a Response can only be used once
    vi.mocked(shopifyFetch)
      .mockResolvedValue(response)
      .mockResolvedValueOnce(response.clone())
      .mockResolvedValueOnce(response.clone())
      .mockResolvedValueOnce(response.clone())

    // When
    const got = await exchangeAccessForApplicationTokens(identityToken, scopes, undefined)

    // Then
    const expected = {
      'app-management': {
        accessToken: 'access_token',
        expiresAt: expiredDate,
        scopes: ['scope', 'scope2'],
      },
      partners: {
        accessToken: 'access_token',
        expiresAt: expiredDate,
        scopes: ['scope', 'scope2'],
      },
      'storefront-renderer': {
        accessToken: 'access_token',
        expiresAt: expiredDate,
        scopes: ['scope', 'scope2'],
      },
      'business-platform': {
        accessToken: 'access_token',
        expiresAt: expiredDate,
        scopes: ['scope', 'scope2'],
      },
    }
    expect(got).toEqual(expected)
  })
})

describe('refresh access tokens', () => {
  test('throws an InvalidGrantError when Identity returns invalid_grant', async () => {
    // Given
    const error = {error: 'invalid_grant'}
    const response = new Response(JSON.stringify(error), {status: 400})
    vi.mocked(shopifyFetch).mockResolvedValue(response)

    // When
    const got = () => refreshAccessToken(identityToken)

    // Then
    return expect(got).rejects.toThrowError(InvalidGrantError)
  })

  test('throws an InvalidRequestError when Identity returns invalid_request', async () => {
    // Given
    const error = {error: 'invalid_request'}
    const response = new Response(JSON.stringify(error), {status: 400})
    vi.mocked(shopifyFetch).mockResolvedValue(response)

    // When
    const got = () => refreshAccessToken(identityToken)

    // Then
    return expect(got).rejects.toThrowError(InvalidRequestError)
  })

  test('throws an InvalidTargetError when Identity returns invalid_target', async () => {
    // Given
    const error = {error: 'invalid_target'}
    const response = new Response(JSON.stringify(error), {status: 400})
    vi.mocked(shopifyFetch).mockResolvedValue(response)

    // When
    const got = () => refreshAccessToken(identityToken)

    // Then
    await expect(got).rejects.toThrowError('You are not authorized to use the CLI to develop in the provided store.')
  })

  describe('when there is a store in the request params', () => {
    test('includes the store in the error message', async () => {
      // Given
      const error = {error: 'invalid_target'}
      const response = new Response(JSON.stringify(error), {status: 400})
      vi.mocked(shopifyFetch).mockResolvedValue(response)

      // When
      const got = () => requestAppToken('admin', 'token', undefined, 'bob.myshopify.com')

      // Then
      await expect(got).rejects.toThrowError(
        'You are not authorized to use the CLI to develop in the provided store: bob.myshopify.com',
      )
    })
  })

  test('throws an AbortError when Identity returns another error', async () => {
    // Given
    const error = {error: 'another'}
    const response = new Response(JSON.stringify(error), {status: 400})
    vi.mocked(shopifyFetch).mockResolvedValue(response)

    // When
    const got = () => refreshAccessToken(identityToken)

    // Then
    return expect(got).rejects.toThrowError(AbortError)
  })

  test('preserves the alias when refreshing access token', async () => {
    // Given
    const tokenWithAlias: IdentityToken = {
      ...identityToken,
      alias: 'my-custom-alias',
    }
    const refreshData = {
      access_token: 'new_access_token',
      refresh_token: 'new_refresh_token',
      scope: 'new_scope',
      expires_in: 7200,
      id_token: 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI1Njc4LTEyMzQifQ.2OGPUmd5MTEv-J5p3Ra4mskCN0635qN8lh3p5_BcoYY',
    }
    const response = new Response(JSON.stringify(refreshData))
    vi.mocked(shopifyFetch).mockResolvedValue(response)

    // When
    const result = await refreshAccessToken(tokenWithAlias)

    // Then
    expect(result.accessToken).toBe('new_access_token')
    expect(result.refreshToken).toBe('new_refresh_token')
    expect(result.scopes).toEqual(['new_scope'])
    // Original userId is preserved
    expect(result.userId).toBe('1234-5678')
    // Alias is preserved
    expect(result.alias).toBe('my-custom-alias')
  })
})

const tokenExchangeMethods = [
  {
    tokenExchangeMethod: exchangeCustomPartnerToken,
    expectedScopes: ['https://api.shopify.com/auth/partners.app.cli.access'],
    expectedApi: 'partners',
    expectedErrorName: 'Partners',
  },
  {
    tokenExchangeMethod: exchangeAppAutomationTokenForAppManagementAccessToken,
    expectedScopes: ['https://api.shopify.com/auth/organization.apps.manage'],
    expectedApi: 'app-management',
    expectedErrorName: 'App Management',
  },
  {
    tokenExchangeMethod: exchangeAppAutomationTokenForBusinessPlatformAccessToken,
    expectedScopes: ['https://api.shopify.com/auth/destinations.readonly'],
    expectedApi: 'business-platform',
    expectedErrorName: 'Business Platform',
  },
]

describe.each(tokenExchangeMethods)(
  'Token exchange: %s',
  ({tokenExchangeMethod, expectedScopes, expectedApi, expectedErrorName}) => {
    const automationToken = 'customToken'
    // Generated from `customToken` using `nonRandomUUID()`
    const userId = '9d5342f1-beb2-14c1-9f5d-deee6b83513c'

    const grantType = 'urn:ietf:params:oauth:grant-type:token-exchange'
    const accessTokenType = 'urn:ietf:params:oauth:token-type:access_token'

    test(`Executing ${tokenExchangeMethod.name} returns access token and user ID for a valid CLI token`, async () => {
      // Given
      let capturedUrl = ''
      let capturedInit: {method?: string; headers?: Record<string, string>; body?: string} = {}
      vi.mocked(shopifyFetch).mockImplementation(async (url, options) => {
        capturedUrl = url.toString()
        capturedInit = (options ?? {}) as typeof capturedInit
        return Promise.resolve(
          new Response(
            JSON.stringify({
              access_token: 'expected_access_token',
              expires_in: 300,
              scope: 'scope,scope2',
            }),
          ),
        )
      })

      // When
      const result = await tokenExchangeMethod(automationToken)

      // Then
      expect(result).toEqual({accessToken: 'expected_access_token', userId})
      await expect(getLastSeenUserIdAfterAuth()).resolves.toBe(userId)
      await expect(getLastSeenAuthMethod()).resolves.toBe('partners_token')

      // Request is sent as POST form-encoded body (not query string), so the
      // URL must not contain any OAuth parameters.
      const actualUrl = new URL(capturedUrl)
      expect(actualUrl).toBeDefined()
      expect(actualUrl.href).toBe('https://fqdn.com/oauth/token')
      expect(actualUrl.search).toBe('')

      expect(capturedInit.method).toBe('POST')
      expect(capturedInit.headers).toMatchObject({
        'Content-Type': 'application/x-www-form-urlencoded',
      })
      expect(typeof capturedInit.body).toBe('string')

      // Assert token exchange parameters are correct and sent in the body.
      const params = new URLSearchParams(capturedInit.body)
      expect(params.get('grant_type')).toBe(grantType)
      expect(params.get('requested_token_type')).toBe(accessTokenType)
      expect(params.get('subject_token_type')).toBe(accessTokenType)
      expect(params.get('client_id')).toBe('clientId')
      expect(params.get('audience')).toBe(expectedApi)
      expect(params.get('scope')).toBe(expectedScopes.join(' '))
      expect(params.get('subject_token')).toBe(automationToken)
    })

    test(`Executing ${tokenExchangeMethod.name} throws AbortError if an error is caught`, async () => {
      const expectedErrorMessage = `The custom token provided can't be used for the ${expectedErrorName} API.`
      vi.mocked(shopifyFetch).mockImplementation(async () => {
        throw new Error('BAD ERROR')
      })

      try {
        await tokenExchangeMethod(automationToken)
      } catch (error) {
        if (error instanceof Error) {
          expect(error).toBeInstanceOf(AbortError)
          expect(error.message).toBe(expectedErrorMessage)
        } else {
          throw error
        }
      }
    })
  },
)