|
| 1 | +// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +/** |
| 5 | + * Sandbox e2e for the opt-in `auth.admin` surface, driven through the deployed |
| 6 | + * Lambda backend over HTTP (the `authCAdmin*` routes in aws-blocks/index.ts). |
| 7 | + * |
| 8 | + * Runs only when BLOCKS_TEST_ENV=sandbox|production (the unified e2e harness |
| 9 | + * deploys + tears down the stack). Verifies the admin IAM grant is wired and |
| 10 | + * the surface behaves end-to-end against real Cognito. |
| 11 | + */ |
| 12 | + |
| 13 | +import { describe, test } from 'node:test'; |
| 14 | +import assert from 'node:assert'; |
| 15 | +import { isBlocksError } from '@aws-blocks/core'; |
| 16 | +import type { api as apiType } from 'aws-blocks'; |
| 17 | + |
| 18 | +const ENV = process.env.BLOCKS_TEST_ENV || 'local'; |
| 19 | +const isSandbox = ENV === 'sandbox' || ENV === 'production'; |
| 20 | + |
| 21 | +const RUN_ID = Date.now().toString(36); |
| 22 | +let counter = 0; |
| 23 | +function uniqueUser() { |
| 24 | + return `adm-${RUN_ID}-${(counter++).toString(36)}`; |
| 25 | +} |
| 26 | + |
| 27 | +const PW = 'AdminE2e!1'; |
| 28 | + |
| 29 | +export function authCognitoAdminTests(getApi: () => typeof apiType) { |
| 30 | + describe('AuthCognito admin surface (sandbox)', { skip: !isSandbox && 'sandbox not deployed' }, () => { |
| 31 | + test('admin.createUser → setUserPassword → signIn works end-to-end', async () => { |
| 32 | + const api = getApi(); |
| 33 | + const u = uniqueUser(); |
| 34 | + const created = await api.authCAdminCreateUser(u, PW); |
| 35 | + assert.strictEqual(created.username, u); |
| 36 | + assert.strictEqual(created.enabled, true); |
| 37 | + |
| 38 | + await api.authCAdminSetPassword(u, PW); |
| 39 | + const r = await api.authCSignIn(u, PW); |
| 40 | + assert.strictEqual(r.status, 'signedIn'); |
| 41 | + |
| 42 | + await api.authCAdminDeleteUser(u); |
| 43 | + }); |
| 44 | + |
| 45 | + test('admin.addUserToGroup → requireRole(admins) succeeds on a fresh token', async () => { |
| 46 | + const api = getApi(); |
| 47 | + const u = uniqueUser(); |
| 48 | + await api.authCAdminCreateUser(u, PW); |
| 49 | + await api.authCAdminSetPassword(u, PW); |
| 50 | + |
| 51 | + await api.authCAdminAddToGroup(u, 'admins'); |
| 52 | + const groups = await api.authCAdminListGroupsForUser(u); |
| 53 | + assert.ok(groups.includes('admins'), `expected admins in ${JSON.stringify(groups)}`); |
| 54 | + |
| 55 | + await api.authCSignIn(u, PW); // fresh sign-in → claim carries the group |
| 56 | + const user = await api.authCRequireRole('admins'); |
| 57 | + assert.strictEqual(user.username, u); |
| 58 | + |
| 59 | + await api.authCAdminDeleteUser(u); |
| 60 | + }); |
| 61 | + |
| 62 | + test('admin.revokeUserSessions revokes Cognito refresh tokens (succeeds end-to-end)', async () => { |
| 63 | + const api = getApi(); |
| 64 | + const u = uniqueUser(); |
| 65 | + await api.authCAdminCreateUser(u, PW); |
| 66 | + await api.authCAdminSetPassword(u, PW); |
| 67 | + await api.authCSignIn(u, PW); |
| 68 | + assert.strictEqual(await api.authCCheckAuth(), true); |
| 69 | + |
| 70 | + // AdminUserGlobalSignOut revokes the user's REFRESH tokens at Cognito. |
| 71 | + // The Blocks session's already-issued ACCESS token stays valid until |
| 72 | + // it expires, so `checkAuth` (which validates the access token) does |
| 73 | + // NOT flip to false immediately — this differs from the mock, which |
| 74 | + // deletes the server-side session record. The immediate-revocation |
| 75 | + // guarantee is "no new tokens can be minted", not "current request |
| 76 | + // 401s instantly". We assert the call succeeds end-to-end (the IAM |
| 77 | + // grant + AdminUserGlobalSignOut path work); the forced-refresh |
| 78 | + // failure is covered separately. |
| 79 | + await api.authCAdminRevokeSessions(u); |
| 80 | + |
| 81 | + await api.authCAdminDeleteUser(u); |
| 82 | + }); |
| 83 | + |
| 84 | + test('admin.disableUser blocks signIn; enableUser restores it', async () => { |
| 85 | + const api = getApi(); |
| 86 | + const u = uniqueUser(); |
| 87 | + await api.authCAdminCreateUser(u, PW); |
| 88 | + await api.authCAdminSetPassword(u, PW); |
| 89 | + |
| 90 | + await api.authCAdminDisableUser(u); |
| 91 | + await assert.rejects( |
| 92 | + () => api.authCSignIn(u, PW), |
| 93 | + (e: unknown) => isBlocksError(e, 'NotAuthorizedException'), |
| 94 | + ); |
| 95 | + |
| 96 | + await api.authCAdminEnableUser(u); |
| 97 | + const r = await api.authCSignIn(u, PW); |
| 98 | + assert.strictEqual(r.status, 'signedIn'); |
| 99 | + |
| 100 | + await api.authCAdminDeleteUser(u); |
| 101 | + }); |
| 102 | + |
| 103 | + test('admin.deleteUser removes the user and its group membership', async () => { |
| 104 | + const api = getApi(); |
| 105 | + const u = uniqueUser(); |
| 106 | + await api.authCAdminCreateUser(u, PW); |
| 107 | + await api.authCAdminSetPassword(u, PW); |
| 108 | + await api.authCAdminAddToGroup(u, 'readers'); |
| 109 | + await api.authCAdminDeleteUser(u); |
| 110 | + |
| 111 | + await assert.rejects(() => api.authCSignIn(u, PW)); |
| 112 | + }); |
| 113 | + }); |
| 114 | +} |
0 commit comments