RBAC: send a client_credentials service token to tenant-registry (#21)

src/lib/service-token.test.ts

@@ -0,0 +1,145 @@
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+
+import {
+  resetServiceTokenCache,
+  serviceAuthHeader,
+  serviceToken,
+} from "./service-token";
+
+const ISSUER = "https://auth.breakpilot.com/realms/breakpilot-dev";
+
+function tokenResponse(value: string, expiresIn = 300) {
+  return {
+    ok: true,
+    status: 200,
+    json: async () => ({ access_token: value, expires_in: expiresIn }),
+  } as Response;
+}
+
+function configure() {
+  process.env.KEYCLOAK_ISSUER = ISSUER;
+  process.env.PORTAL_SVC_CLIENT_ID = "portal-svc";
+  process.env.PORTAL_SVC_CLIENT_SECRET = "shh";
+}
+
+beforeEach(() => {
+  resetServiceTokenCache();
+  delete process.env.PORTAL_SVC_CLIENT_ID;
+  delete process.env.PORTAL_SVC_CLIENT_SECRET;
+  delete process.env.KEYCLOAK_ISSUER;
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  vi.useRealTimers();
+});
+
+describe("serviceToken", () => {
+  test("returns null and makes no request when unconfigured", async () => {
+    const fetchSpy = vi.spyOn(globalThis, "fetch");
+    expect(await serviceToken()).toBeNull();
+    expect(await serviceAuthHeader()).toEqual({});
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  test("requests a client_credentials token against the realm", async () => {
+    configure();
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValue(tokenResponse("tok-1"));
+
+    expect(await serviceToken()).toBe("tok-1");
+
+    const [url, init] = fetchSpy.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe(`${ISSUER}/protocol/openid-connect/token`);
+    expect(init.method).toBe("POST");
+    const body = new URLSearchParams(init.body as string);
+    expect(body.get("grant_type")).toBe("client_credentials");
+    expect(body.get("client_id")).toBe("portal-svc");
+    expect(body.get("client_secret")).toBe("shh");
+  });
+
+  test("caches the token across calls", async () => {
+    configure();
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValue(tokenResponse("tok-1"));
+
+    await serviceToken();
+    await serviceToken();
+    await serviceToken();
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  test("de-dupes concurrent fetches into one request", async () => {
+    configure();
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValue(tokenResponse("tok-1"));
+
+    const results = await Promise.all([
+      serviceToken(),
+      serviceToken(),
+      serviceToken(),
+    ]);
+    expect(results).toEqual(["tok-1", "tok-1", "tok-1"]);
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  test("refreshes shortly before expiry", async () => {
+    configure();
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-08-25T10:00:00Z"));
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValueOnce(tokenResponse("tok-1", 300))
+      .mockResolvedValueOnce(tokenResponse("tok-2", 300));
+
+    expect(await serviceToken()).toBe("tok-1");
+    // 4 minutes in: still inside the window
+    vi.setSystemTime(new Date("2026-08-25T10:04:00Z"));
+    expect(await serviceToken()).toBe("tok-1");
+    // 4:40 — inside the 30s refresh margin
+    vi.setSystemTime(new Date("2026-08-25T10:04:40Z"));
+    expect(await serviceToken()).toBe("tok-2");
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+  });
+
+  test("surfaces a rejected token request instead of calling unauthenticated", async () => {
+    configure();
+    vi.spyOn(globalThis, "fetch").mockResolvedValue({
+      ok: false,
+      status: 401,
+      json: async () => ({}),
+    } as Response);
+
+    await expect(serviceToken()).rejects.toThrow("service token request failed: 401");
+  });
+
+  test("surfaces a malformed token response", async () => {
+    configure();
+    vi.spyOn(globalThis, "fetch").mockResolvedValue({
+      ok: true,
+      status: 200,
+      json: async () => ({}),
+    } as Response);
+
+    await expect(serviceToken()).rejects.toThrow("no access_token");
+  });
+
+  test("a failed fetch does not poison the cache", async () => {
+    configure();
+    vi.spyOn(globalThis, "fetch")
+      .mockResolvedValueOnce({ ok: false, status: 503, json: async () => ({}) } as Response)
+      .mockResolvedValueOnce(tokenResponse("tok-ok"));
+
+    await expect(serviceToken()).rejects.toThrow();
+    expect(await serviceToken()).toBe("tok-ok");
+  });
+
+  test("serviceAuthHeader carries the bearer token when configured", async () => {
+    configure();
+    vi.spyOn(globalThis, "fetch").mockResolvedValue(tokenResponse("tok-1"));
+    expect(await serviceAuthHeader()).toEqual({ authorization: "Bearer tok-1" });
+  });
+});