ThothII/backend/test/fixtures/oidc-provider.mjs

#!/usr/bin/env node
/**
 * Hermetic loopback OIDC/AuthentiK-shaped provider for browser smoke tests.
 *
 * It deliberately has no network dependency and binds only to 127.0.0.1. Its
 * ephemeral TLS and signing keys are test-scoped; callers receive the CA path
 * needed to trust the provider from a spawned backend process.
 */
import { spawnSync } from "node:child_process";
import { createHash, generateKeyPairSync, randomBytes, sign as signRsa } from "node:crypto";
import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
import { createServer } from "node:https";
import { tmpdir } from "node:os";
import { join, resolve } from "node:path";
import { fileURLToPath } from "node:url";

const LOOPBACK_HOST = "127.0.0.1";
const ISSUER_PATH = "/application/o/thothii";
const MAX_BODY_BYTES = 32 * 1024;
const VALID_IDENTITIES = new Set([
  "ordinary",
  "admin",
  "missing-groups",
  "malformed-groups",
  "unmapped",
  "expired",
]);

const identityClaims = Object.freeze({
  ordinary: { subject: "fixture-ordinary", displayName: "Fixture ordinary", groups: ["fixture-users"] },
  admin: { subject: "fixture-admin", displayName: "Fixture administrator", groups: ["fixture-admin"] },
  "missing-groups": { subject: "fixture-missing-groups", displayName: "Fixture missing groups" },
  "malformed-groups": { subject: "fixture-malformed-groups", displayName: "Fixture malformed groups", groups: ["fixture-users", 7] },
  unmapped: { subject: "fixture-unmapped", displayName: "Fixture unmapped", groups: ["fixture-unmapped"] },
  expired: { subject: "fixture-expired", displayName: "Fixture expired", groups: ["fixture-users"], expired: true },
});

function safeError(code) {
  return new Error(code);
}

function ensurePrivateDirectory(directory) {
  mkdirSync(directory, { recursive: true, mode: 0o700 });
  chmodSync(directory, 0o700);
}

function createCertificate(directory) {
  const keyFile = join(directory, "provider-key.pem");
  const certificateFile = join(directory, "provider-ca.pem");
  const result = spawnSync("openssl", [
    "req", "-x509", "-newkey", "rsa:2048", "-sha256", "-nodes",
    "-keyout", keyFile,
    "-out", certificateFile,
    "-subj", "/CN=127.0.0.1",
    "-addext", "subjectAltName=IP:127.0.0.1",
    "-days", "1",
  ], { stdio: "ignore" });
  if (result.status !== 0) throw safeError("oidc_fixture_certificate_generation_failed");
  chmodSync(keyFile, 0o600);
  chmodSync(certificateFile, 0o600);
  return { key: readFileSync(keyFile), cert: readFileSync(certificateFile), certificateFile };
}

function sendJson(reply, status, value) {
  reply.writeHead(status, {
    "cache-control": "no-store",
    "content-type": "application/json; charset=utf-8",
  });
  reply.end(JSON.stringify(value));
}

function redirect(reply, location) {
  reply.writeHead(302, { "cache-control": "no-store", location });
  reply.end();
}

async function requestBody(request) {
  let size = 0;
  const chunks = [];
  for await (const chunk of request) {
    size += chunk.length;
    if (size > MAX_BODY_BYTES) throw safeError("oidc_fixture_request_too_large");
    chunks.push(chunk);
  }
  return Buffer.concat(chunks).toString("utf8");
}

function jwt(privateKey, issuer, audience, nonce, identity) {
  const claims = identityClaims[identity];
  const now = Math.floor(Date.now() / 1_000);
  const payload = {
    iss: issuer,
    sub: claims.subject,
    aud: audience,
    exp: now + (claims.expired ? -30 : 60),
    iat: now - 1,
    nonce,
    name: claims.displayName,
    ...(Object.hasOwn(claims, "groups") ? { groups: claims.groups } : {}),
  };
  const header = { alg: "RS256", typ: "JWT", kid: "fixture-rs256" };
  const protectedPart = Buffer.from(JSON.stringify(header)).toString("base64url");
  const payloadPart = Buffer.from(JSON.stringify(payload)).toString("base64url");
  const signingInput = `${protectedPart}.${payloadPart}`;
  const signature = signRsa("RSA-SHA256", Buffer.from(signingInput), privateKey).toString("base64url");
  return `${signingInput}.${signature}`;
}

function authorizationIdentity(identity) {
  if (!VALID_IDENTITIES.has(identity)) throw safeError("oidc_fixture_identity_invalid");
  return identity;
}

/**
 * Start an HTTPS test provider. The returned telemetry intentionally excludes
 * transient authorization codes, browser state, nonces, and token material.
 */
export async function startFakeOidcProvider(options = {}) {
  const host = options.host ?? LOOPBACK_HOST;
  if (host !== LOOPBACK_HOST) throw safeError("oidc_fixture_loopback_required");
  const ownsDirectory = options.directory === undefined;
  const directory = options.directory ?? mkdtempSync(join(tmpdir(), "thothii-oidc-fixture-"));
  ensurePrivateDirectory(directory);
  const certificate = createCertificate(directory);
  const { privateKey, publicKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
  const publicJwk = publicKey.export({ format: "jwk" });
  const jwks = {
    keys: [{ ...publicJwk, alg: "RS256", kid: "fixture-rs256", use: "sig" }],
  };
  const authorizations = new Map();
  const deviceCodes = new Map();
  let activeIdentity = authorizationIdentity(options.identity ?? "ordinary");
  let lastAuthorization = undefined;
  let issuer = undefined;
  let baseUrl = undefined;

  const server = createServer({ key: certificate.key, cert: certificate.cert }, async (request, reply) => {
    try {
      if (!issuer || !baseUrl || !request.url) {
        sendJson(reply, 503, { error: "temporarily_unavailable" });
        return;
      }
      const url = new URL(request.url, baseUrl);
      const path = url.pathname;
      const discoveryPath = `${ISSUER_PATH}/.well-known/openid-configuration`;
      const rfc8414Path = `/.well-known/openid-configuration${ISSUER_PATH}`;
      if (request.method === "GET" && (path === discoveryPath || path === rfc8414Path)) {
        sendJson(reply, 200, {
          issuer,
          authorization_endpoint: `${issuer}authorize`,
          token_endpoint: `${issuer}token`,
          jwks_uri: `${issuer}jwks`,
          device_authorization_endpoint: `${issuer}device_authorization`,
          response_types_supported: ["code"],
          subject_types_supported: ["public"],
          grant_types_supported: ["authorization_code", "urn:ietf:params:oauth:grant-type:device_code"],
          token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"],
          code_challenge_methods_supported: ["S256"],
          id_token_signing_alg_values_supported: ["RS256"],
        });
        return;
      }
      if (request.method === "GET" && path === `${ISSUER_PATH}/jwks`) {
        sendJson(reply, 200, jwks);
        return;
      }
      if (request.method === "GET" && path === `${ISSUER_PATH}/authorize`) {
        const redirectUri = url.searchParams.get("redirect_uri");
        const clientId = url.searchParams.get("client_id");
        const state = url.searchParams.get("state");
        const nonce = url.searchParams.get("nonce");
        const challenge = url.searchParams.get("code_challenge");
        if (url.searchParams.get("response_type") !== "code" || !redirectUri || !clientId || !state || !nonce
          || !challenge || url.searchParams.get("code_challenge_method") !== "S256") {
          sendJson(reply, 400, { error: "invalid_request" });
          return;
        }
        let callback;
        try {
          callback = new URL(redirectUri);
          if (callback.protocol !== "http:" || callback.hostname !== LOOPBACK_HOST || callback.username || callback.password) {
            throw safeError("oidc_fixture_redirect_invalid");
          }
        } catch {
          sendJson(reply, 400, { error: "invalid_request" });
          return;
        }
        const code = randomBytes(32).toString("base64url");
        authorizations.set(code, {
          challenge,
          clientId,
          identity: activeIdentity,
          nonce,
          used: false,
        });
        lastAuthorization = { identity: activeIdentity, codeChallengeMethod: "S256", pkceVerified: false };
        callback.searchParams.set("code", code);
        callback.searchParams.set("state", state);
        redirect(reply, callback.href);
        return;
      }
      if (request.method === "POST" && path === `${ISSUER_PATH}/device_authorization`) {
        const values = new URLSearchParams(await requestBody(request));
        const clientId = values.get("client_id");
        if (!clientId) {
          sendJson(reply, 400, { error: "invalid_request" });
          return;
        }
        const deviceCode = randomBytes(32).toString("base64url");
        const userCode = "FIXTURE-CODE";
        deviceCodes.set(deviceCode, { clientId, identity: activeIdentity, nonce: "device", used: false });
        sendJson(reply, 200, {
          device_code: deviceCode,
          user_code: userCode,
          verification_uri: `${issuer}device`,
          verification_uri_complete: `${issuer}device?user_code=${userCode}`,
          expires_in: 60,
          interval: 1,
        });
        return;
      }
      if (request.method === "POST" && path === `${ISSUER_PATH}/token`) {
        const values = new URLSearchParams(await requestBody(request));
        const grantType = values.get("grant_type");
        let record;
        if (grantType === "authorization_code") {
          const code = values.get("code") ?? "";
          record = authorizations.get(code);
          const verifier = values.get("code_verifier") ?? "";
          const verified = record !== undefined && !record.used
            && createHash("sha256").update(verifier).digest("base64url") === record.challenge;
          if (!verified) {
            sendJson(reply, 400, { error: "invalid_grant" });
            return;
          }
          record.used = true;
          if (lastAuthorization) lastAuthorization = { ...lastAuthorization, pkceVerified: true };
        } else if (grantType === "urn:ietf:params:oauth:grant-type:device_code") {
          const deviceCode = values.get("device_code") ?? "";
          record = deviceCodes.get(deviceCode);
          if (record === undefined || record.used) {
            sendJson(reply, 400, { error: "invalid_grant" });
            return;
          }
          record.used = true;
        } else {
          sendJson(reply, 400, { error: "unsupported_grant_type" });
          return;
        }
        sendJson(reply, 200, {
          access_token: randomBytes(32).toString("base64url"),
          token_type: "Bearer",
          expires_in: 60,
          id_token: jwt(privateKey, issuer, record.clientId, record.nonce, record.identity),
        });
        return;
      }
      if (request.method === "GET" && path === "/api/v3/core/groups/") {
        if (!request.headers.authorization?.startsWith("Bearer ")) {
          sendJson(reply, 401, { detail: "authentication required" });
          return;
        }
        const name = url.searchParams.get("name") ?? "";
        const present = name === "fixture-users" || name === "fixture-admin";
        sendJson(reply, 200, {
          pagination: { next: null },
          results: present ? [{ name }] : [],
        });
        return;
      }
      sendJson(reply, 404, { error: "not_found" });
    } catch {
      if (!reply.headersSent) sendJson(reply, 400, { error: "invalid_request" });
      else reply.end();
    }
  });

  try {
    await new Promise((resolveListen, rejectListen) => {
      const onError = (error) => rejectListen(error);
      server.once("error", onError);
      server.listen({ host, port: options.port ?? 0 }, () => {
        server.off("error", onError);
        resolveListen();
      });
    });
  } catch (error) {
    server.close();
    if (ownsDirectory) rmSync(directory, { recursive: true, force: true });
    throw error;
  }
  const address = server.address();
  if (!address || typeof address === "string") {
    await new Promise((resolveClose) => server.close(resolveClose));
    if (ownsDirectory) rmSync(directory, { recursive: true, force: true });
    throw safeError("oidc_fixture_listen_failed");
  }
  baseUrl = `https://${LOOPBACK_HOST}:${address.port}`;
  issuer = `${baseUrl}${ISSUER_PATH}/`;

  return {
    baseUrl,
    issuer,
    caFile: certificate.certificateFile,
    setIdentity(identity) {
      activeIdentity = authorizationIdentity(identity);
    },
    lastAuthorization() {
      return lastAuthorization === undefined ? undefined : { ...lastAuthorization };
    },
    async close() {
      await new Promise((resolveClose) => server.close(resolveClose));
      if (ownsDirectory) rmSync(directory, { recursive: true, force: true });
    },
  };
}

const currentFile = fileURLToPath(import.meta.url);
if (process.argv[1] && resolve(process.argv[1]) === currentFile) {
  const provider = await startFakeOidcProvider();
  process.stdout.write('{"status":"ready"}\n');
  const close = async () => {
    await provider.close();
    process.exit(0);
  };
  process.once("SIGINT", () => { void close(); });
  process.once("SIGTERM", () => { void close(); });
}