/**
* postgres-mcp - Token Validator Tests
*
* Tests for JWT token validation with JWKS support.
*/
import { describe, it, expect, vi, beforeEach } from 'vitest';
import { TokenValidator, createTokenValidator } from '../TokenValidator.js';
// Mock jose module
vi.mock('jose', () => ({
jwtVerify: vi.fn(),
createRemoteJWKSet: vi.fn(() => {
return () => Promise.resolve({ type: 'remote' });
}),
errors: {
JWTExpired: class JWTExpired extends Error {
constructor(message = 'jwt expired', _claim?: string, _reason?: string) {
super(message);
this.name = 'JWTExpired';
}
},
JWSSignatureVerificationFailed: class JWSSignatureVerificationFailed extends Error {
constructor(message = 'signature verification failed', _cause?: Error) {
super(message);
this.name = 'JWSSignatureVerificationFailed';
}
},
JWTClaimValidationFailed: class JWTClaimValidationFailed extends Error {
constructor(message = 'claim validation failed', _claim?: string, _reason?: string) {
super(message);
this.name = 'JWTClaimValidationFailed';
}
}
}
}));
// Import after mock
const jose = await import('jose');
describe('TokenValidator', () => {
const defaultConfig = {
jwksUri: 'http://localhost:8080/realms/postgres-mcp/protocol/openid-connect/certs',
issuer: 'http://localhost:8080/realms/postgres-mcp',
audience: 'postgres-mcp'
};
beforeEach(() => {
vi.clearAllMocks();
});
describe('constructor', () => {
it('should create instance with default config values', () => {
const validator = new TokenValidator(defaultConfig);
expect(validator).toBeInstanceOf(TokenValidator);
});
it('should accept custom config values', () => {
const validator = new TokenValidator({
...defaultConfig,
clockTolerance: 120,
jwksCacheTtl: 7200,
algorithms: ['RS256']
});
expect(validator).toBeInstanceOf(TokenValidator);
});
});
describe('validate', () => {
it('should return valid result for valid token', async () => {
vi.mocked(jose.jwtVerify).mockResolvedValueOnce({
payload: {
sub: 'user123',
scope: 'read write',
exp: Math.floor(Date.now() / 1000) + 3600,
iat: Math.floor(Date.now() / 1000),
iss: 'http://localhost:8080/realms/postgres-mcp',
aud: 'postgres-mcp'
},
protectedHeader: { alg: 'RS256' }
} as unknown as Awaited<ReturnType<typeof jose.jwtVerify>>);
const validator = new TokenValidator(defaultConfig);
const result = await validator.validate('valid.jwt.token');
expect(result.valid).toBe(true);
expect(result.claims?.sub).toBe('user123');
expect(result.claims?.scopes).toEqual(['read', 'write']);
});
it('should handle tokens without scope claim', async () => {
vi.mocked(jose.jwtVerify).mockResolvedValueOnce({
payload: {
sub: 'user123',
exp: Math.floor(Date.now() / 1000) + 3600,
iat: Math.floor(Date.now() / 1000)
},
protectedHeader: { alg: 'RS256' }
} as unknown as Awaited<ReturnType<typeof jose.jwtVerify>>);
const validator = new TokenValidator(defaultConfig);
const result = await validator.validate('token.without.scope');
expect(result.valid).toBe(true);
expect(result.claims?.scopes).toEqual([]);
});
it('should return TOKEN_EXPIRED error for expired tokens', async () => {
vi.mocked(jose.jwtVerify).mockRejectedValueOnce(new jose.errors.JWTExpired('jwt expired', { exp: 0 }, 'exp'));
const validator = new TokenValidator(defaultConfig);
const result = await validator.validate('expired.jwt.token');
expect(result.valid).toBe(false);
expect(result.errorCode).toBe('TOKEN_EXPIRED');
});
it('should return INVALID_SIGNATURE for bad signatures', async () => {
vi.mocked(jose.jwtVerify).mockRejectedValueOnce(
new jose.errors.JWSSignatureVerificationFailed('signature verification failed')
);
const validator = new TokenValidator(defaultConfig);
const result = await validator.validate('bad.sig.token');
expect(result.valid).toBe(false);
expect(result.errorCode).toBe('INVALID_SIGNATURE');
});
it('should return INVALID_CLAIMS for claim validation failures', async () => {
vi.mocked(jose.jwtVerify).mockRejectedValueOnce(
new jose.errors.JWTClaimValidationFailed('claim validation failed', { aud: 'wrong' }, 'aud')
);
const validator = new TokenValidator(defaultConfig);
const result = await validator.validate('wrong.claims.token');
expect(result.valid).toBe(false);
expect(result.errorCode).toBe('INVALID_CLAIMS');
});
it('should return INVALID_TOKEN for generic errors', async () => {
vi.mocked(jose.jwtVerify).mockRejectedValueOnce(new Error('Unknown error'));
const validator = new TokenValidator(defaultConfig);
const result = await validator.validate('malformed.token');
expect(result.valid).toBe(false);
expect(result.errorCode).toBe('INVALID_TOKEN');
});
it('should extract client_id from payload', async () => {
vi.mocked(jose.jwtVerify).mockResolvedValueOnce({
payload: {
sub: 'user123',
scope: 'read',
exp: Math.floor(Date.now() / 1000) + 3600,
iat: Math.floor(Date.now() / 1000),
client_id: 'my-client-app'
},
protectedHeader: { alg: 'RS256' }
} as unknown as Awaited<ReturnType<typeof jose.jwtVerify>>);
const validator = new TokenValidator(defaultConfig);
const result = await validator.validate('token.with.clientid');
expect(result.claims?.client_id).toBe('my-client-app');
});
});
describe('invalidateCache', () => {
it('should clear the JWKS cache', () => {
const validator = new TokenValidator(defaultConfig);
// This should not throw
expect(() => validator.invalidateCache()).not.toThrow();
});
});
describe('createTokenValidator factory', () => {
it('should create a TokenValidator instance', () => {
const validator = createTokenValidator(defaultConfig);
expect(validator).toBeInstanceOf(TokenValidator);
});
});
});
// =============================================================================
// Phase 4: TokenValidator Branch Coverage
// =============================================================================
describe('TokenValidator (Branch Coverage)', () => {
const defaultConfig = {
jwksUri: 'http://localhost:8080/realms/postgres-mcp/protocol/openid-connect/certs',
issuer: 'http://localhost:8080/realms/postgres-mcp',
audience: 'postgres-mcp'
};
beforeEach(() => {
vi.clearAllMocks();
});
it('should use cached JWKS on second validation (line 81 cache hit)', async () => {
// First validation - creates cache
vi.mocked(jose.jwtVerify).mockResolvedValue({
payload: {
sub: 'user1',
exp: Math.floor(Date.now() / 1000) + 3600,
iat: Math.floor(Date.now() / 1000)
},
protectedHeader: { alg: 'RS256' }
} as unknown as Awaited<ReturnType<typeof jose.jwtVerify>>);
const validator = new TokenValidator(defaultConfig);
// First call creates the cache
await validator.validate('first.jwt.token');
// Second call should hit the cache (line 81)
await validator.validate('second.jwt.token');
// createRemoteJWKSet should only be called once (cached on second call)
expect(jose.createRemoteJWKSet).toHaveBeenCalledTimes(1);
});
it('should refresh JWKS cache after TTL expires (lines 80-87)', async () => {
vi.mocked(jose.jwtVerify).mockResolvedValue({
payload: {
sub: 'user1',
exp: Math.floor(Date.now() / 1000) + 3600,
iat: Math.floor(Date.now() / 1000)
},
protectedHeader: { alg: 'RS256' }
} as unknown as Awaited<ReturnType<typeof jose.jwtVerify>>);
// Create validator with very short TTL
const validator = new TokenValidator({
...defaultConfig,
jwksCacheTtl: 0 // 0 seconds - always expires
});
await validator.validate('token1');
await validator.validate('token2');
// With 0 TTL, cache always expires, so should create new JWKS set each time
expect(jose.createRemoteJWKSet).toHaveBeenCalledTimes(2);
});
it('should handle non-Error exception in handleValidationError (line 129)', async () => {
// Reject with a non-Error value (string)
vi.mocked(jose.jwtVerify).mockRejectedValueOnce('string error' as unknown);
const validator = new TokenValidator(defaultConfig);
const result = await validator.validate('weird.error.token');
expect(result.valid).toBe(false);
expect(result.errorCode).toBe('INVALID_TOKEN');
expect(result.error).toBe('Token validation failed'); // fallback message
});
it('should handle tokens with array scope claim', async () => {
vi.mocked(jose.jwtVerify).mockResolvedValueOnce({
payload: {
sub: 'user123',
scope: 'admin write read', // space-separated scopes
exp: Math.floor(Date.now() / 1000) + 3600,
iat: Math.floor(Date.now() / 1000)
},
protectedHeader: { alg: 'RS256' }
} as unknown as Awaited<ReturnType<typeof jose.jwtVerify>>);
const validator = new TokenValidator(defaultConfig);
const result = await validator.validate('token.with.scopes');
expect(result.claims?.scopes).toContain('admin');
expect(result.claims?.scopes).toContain('write');
expect(result.claims?.scopes).toContain('read');
});
});
