|
| 1 | +/** |
| 2 | + * @vitest-environment node |
| 3 | + */ |
| 4 | + |
| 5 | +import { credential } from '@sim/db/schema' |
| 6 | +import { queueTableRows, resetDbChainMock } from '@sim/testing' |
| 7 | +import { jsonResponse } from '@sim/testing/helpers/http' |
| 8 | +import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock' |
| 9 | +import { beforeEach, describe, expect, it, vi } from 'vitest' |
| 10 | + |
| 11 | +vi.mock('@/lib/core/security/encryption', () => encryptionMock) |
| 12 | +vi.unmock('@/lib/oauth/credential-service') |
| 13 | + |
| 14 | +import { resolveSelectorOAuthAccessToken } from '@/lib/selectors/server/credentials' |
| 15 | +import { createSelectorProtectedValues } from '@/lib/selectors/server/protected-values' |
| 16 | + |
| 17 | +const TENANT = '11111111-2222-3333-4444-555555555555' |
| 18 | +const CLIENT_ID = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee' |
| 19 | + |
| 20 | +describe('a SharePoint selector with a Microsoft app credential', () => { |
| 21 | + const fetch = vi.fn() |
| 22 | + |
| 23 | + beforeEach(() => { |
| 24 | + resetDbChainMock() |
| 25 | + const row = { |
| 26 | + id: 'app-credential', |
| 27 | + type: 'service_account', |
| 28 | + accountId: null, |
| 29 | + workspaceId: 'ws-1', |
| 30 | + organizationId: null, |
| 31 | + providerId: 'microsoft-app-service-account', |
| 32 | + revokedAt: null, |
| 33 | + encryptedServiceAccountKey: 'ciphertext-selector', |
| 34 | + } |
| 35 | + queueTableRows(credential, [row]) |
| 36 | + queueTableRows(credential, [row]) |
| 37 | + encryptionMockFns.mockDecryptSecret.mockResolvedValueOnce({ |
| 38 | + decrypted: JSON.stringify({ |
| 39 | + type: 'microsoft_app_credential_v1', |
| 40 | + config: { |
| 41 | + authType: 'client_secret', |
| 42 | + tenantId: TENANT, |
| 43 | + clientId: CLIENT_ID, |
| 44 | + clientSecret: 'app-secret', |
| 45 | + }, |
| 46 | + }), |
| 47 | + }) |
| 48 | + fetch.mockReset().mockImplementation(async (_url: string, init: RequestInit) => { |
| 49 | + const scope = new URLSearchParams(String(init.body)).get('scope') |
| 50 | + return jsonResponse({ token_type: 'Bearer', expires_in: 3599, access_token: `at:${scope}` }) |
| 51 | + }) |
| 52 | + vi.stubGlobal('fetch', fetch) |
| 53 | + }) |
| 54 | + |
| 55 | + it('browses with a Microsoft Graph app-only token', async () => { |
| 56 | + await expect( |
| 57 | + resolveSelectorOAuthAccessToken({ |
| 58 | + credential: { |
| 59 | + suppliedId: 'app-credential', |
| 60 | + access: { |
| 61 | + ok: true, |
| 62 | + credentialOwnerUserId: 'user-1', |
| 63 | + resolvedCredentialId: 'app-credential', |
| 64 | + }, |
| 65 | + }, |
| 66 | + serviceId: 'sharepoint', |
| 67 | + protectedValues: createSelectorProtectedValues(), |
| 68 | + }) |
| 69 | + ).resolves.toBe('at:https://graph.microsoft.com/.default') |
| 70 | + expect(fetch).toHaveBeenCalledWith( |
| 71 | + `https://login.microsoftonline.com/${TENANT}/oauth2/v2.0/token`, |
| 72 | + expect.anything() |
| 73 | + ) |
| 74 | + }) |
| 75 | +}) |
0 commit comments