main_test.go

package main

import (
	"context"
	"crypto/rand"
	"crypto/rsa"
	"encoding/base64"
	"fmt"
	"github.com/aws/aws-lambda-go/events"
	"github.com/stretchr/testify/assert"
	"strconv"
	"testing"
)

type MockJwkExtractor struct {
	jsonWebKeyToReturn JsonWebKey
	claimsIssuer       string
}

const (
	// generated using https://jwt.io/
	bearerToken = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3NvbWUtdXJsIiwic3ViIjoic29tZV9jb25zdW1lciJ9.YK87IfOKP-Stmu8EAyfYnjd63KEMWN3zVOPXB7tscVHG_lrk9FDVGM7PdWoaNCRysLX6ri4c2vuwNkxlV4Bv431yw7oI1A6g3yGnaLNk_Uk61FPP3P_gI9VFcxcuWST8sNbfeqxqx0qsEiualX7rNiw8zKaD2Y1ydkNV7jfT0PwuvJ0v0PCAnqFGZboyHNxpkrzzdZxVQxhP2TfAfMjSOm918a4Z4japhpSr944p6mJ3BTMI47IgJn1op71oxmACnaSkuC3BBFpktdaNsSC4mnTRJEi6lFoAYeEPYmxsq69XyO7G9XOVBf3mhT47NfgdEj8Rln19ILtGfVi5TGdXDA"
)

func (m *MockJwkExtractor) GetJwkByAlgorithm(_ string) (JsonWebKey, error) {
	return m.jsonWebKeyToReturn, nil
}

func Test_HandlerReturnsTrueWhenAuthorizationHeaderIsSet(t *testing.T) { // Happy Path
	// Given
	headers := make(map[string]string)
	headers["Authorization"] = "Bearer " + bearerToken

	jsonWebKey := JsonWebKey{
		Algorithm:            "RS256",
		Family:               "RSA",
		Use:                  "sig",
		RsaPublicKeyModulus:  "wZLyxWWovHBpQfY01VEkAe6tnsA_rVgHg2Wu13slebRdZxgzxiDSYQXOGbhTiBAWHvrNQ3pUYnp3kLCAVjcKGQ998j3Ls3V9RTYBqG5Wz1RDbrdcVivTH-4WbYH8I7--XtIx9_DAgpgEJnQrraVUMsN0O6g3aBxX7TKpp12Y6dbEliy6Sh9gFg_GrzI2-rJpopW9TkzAV4Tcu-NPTp-Wc7gi9ymAeaSTRarHYJcd38K7DHcGXkISBhofbTiU6k1oGsywkPbbVCJvOOEdTUWQ7o9syHt0Sy2b8rxM9Rtgfx5J3HAK1WlJ6q_unZX4vES7y2491e9CibygmzwOYCuJWQ",
		RsaPublicKeyExponent: "AQAB",
		KeyId:                "an-rsa-key-id",
	} // exponent and modulus generated using https://russelldavies.github.io/jwk-creator/

	h := handler{
		jwkExtractor: &MockJwkExtractor{jsonWebKey, "https://some-url"},
	}

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Nil(t, err)
	assert.Equal(t, true, response.IsAuthorized)
}

func Test_HttpHeaderAttributesAreCaseInsensitive(t *testing.T) { // Happy Path
	// Given
	headers := make(map[string]string)
	headers["authorization"] = "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3NvbWUtdXJsIiwic3ViIjoiZWFwaTEyMy1kc3ItY21pLXNjaGVkdWxlcnMifQ.n0ZIqYXkwZ2Jo27nOmh8-5uYt-E_JAPf-jWvVlEkiC-TQ-imtyLlD14WX0Owdr-LwSV9GaMAGfUDkqVSk2xvdyayp-Dmo2ViIBfB6unSoPx0EIBkX2-QPgL9eu0ZYflJawR6uG8sBVmilmyNFBMxbiA9cl1Z5wZq9yvE63nsWXxgF9KhclNpLY3o34PnlZEL1jhixmnqaDKthonFJoBuM7Fuo-hGTVVivEqVFyYfIrgNF1On7KDxhFuWgpi-Ol3NTMprctVL8GOSfKBstQHZqTcKQ4RyynUCOg5aM29BcyKwqp3Y9lDL_U2cvEuH76B-3SKzkkOvm9UE9YjsXGiF0w" // generated using https://jwt.io/

	jsonWebKey := JsonWebKey{
		Algorithm:            "RS256",
		Family:               "RSA",
		Use:                  "sig",
		RsaPublicKeyModulus:  "wZLyxWWovHBpQfY01VEkAe6tnsA_rVgHg2Wu13slebRdZxgzxiDSYQXOGbhTiBAWHvrNQ3pUYnp3kLCAVjcKGQ998j3Ls3V9RTYBqG5Wz1RDbrdcVivTH-4WbYH8I7--XtIx9_DAgpgEJnQrraVUMsN0O6g3aBxX7TKpp12Y6dbEliy6Sh9gFg_GrzI2-rJpopW9TkzAV4Tcu-NPTp-Wc7gi9ymAeaSTRarHYJcd38K7DHcGXkISBhofbTiU6k1oGsywkPbbVCJvOOEdTUWQ7o9syHt0Sy2b8rxM9Rtgfx5J3HAK1WlJ6q_unZX4vES7y2491e9CibygmzwOYCuJWQ",
		RsaPublicKeyExponent: "AQAB",
		KeyId:                "an-rsa-key-id",
	} // exponent and modulus generated using https://russelldavies.github.io/jwk-creator/

	h := handler{
		jwkExtractor: &MockJwkExtractor{jsonWebKeyToReturn: jsonWebKey, claimsIssuer: "https://some-url"},
	}

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Nil(t, err)
	assert.Equal(t, true, response.IsAuthorized)
}

func Test_HandlerReturnsFalseWhenHeaderIsNotSet(t *testing.T) {
	// Given
	h := handler{}

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: nil,
	})

	// Then
	assert.Equal(t, fmt.Errorf("no http headers"), err)
	assert.Equal(t, false, response.IsAuthorized)
}

func Test_HandlerReturnsFalseWhenAuthorizationHeaderIsNotSet(t *testing.T) {
	// Given
	h := handler{}

	headers := make(map[string]string)
	headers["Content-Type"] = "application/json"

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Equal(t, fmt.Errorf("no authorisation header"), err)
	assert.Equal(t, false, response.IsAuthorized)
}

func Test_HandlerReturnsFalseWhenAuthorizationHeaderContainsNoBearerToken(t *testing.T) {
	// Given
	h := handler{}

	headers := make(map[string]string)
	headers["Authorization"] = ""

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Equal(t, fmt.Errorf("no valid bearer token in authorisation header"), err)
	assert.Equal(t, false, response.IsAuthorized)
}

type AnErroringJwkExtractor struct {
	jsonWebKeyToReturn JsonWebKey
	serviceEndpoint    string
}

func (a AnErroringJwkExtractor) GetJwkByAlgorithm(_ string) (JsonWebKey, error) {
	return JsonWebKey{}, fmt.Errorf("some jwks service error")
}

func Test_HandlerReturnsFalseWhenJwksServiceReturnsAnError(t *testing.T) {
	// Given
	headers := make(map[string]string)
	headers["Authorization"] = "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3NvbWUtdXJsIiwic3ViIjoiZWFwaTEyMy1kc3ItY21pLXNjaGVkdWxlcnMifQ.n0ZIqYXkwZ2Jo27nOmh8-5uYt-E_JAPf-jWvVlEkiC-TQ-imtyLlD14WX0Owdr-LwSV9GaMAGfUDkqVSk2xvdyayp-Dmo2ViIBfB6unSoPx0EIBkX2-QPgL9eu0ZYflJawR6uG8sBVmilmyNFBMxbiA9cl1Z5wZq9yvE63nsWXxgF9KhclNpLY3o34PnlZEL1jhixmnqaDKthonFJoBuM7Fuo-hGTVVivEqVFyYfIrgNF1On7KDxhFuWgpi-Ol3NTMprctVL8GOSfKBstQHZqTcKQ4RyynUCOg5aM29BcyKwqp3Y9lDL_U2cvEuH76B-3SKzkkOvm9UE9YjsXGiF0w" // generated using https://jwt.io/

	h := handler{jwkExtractor: &AnErroringJwkExtractor{}}

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Equal(t, fmt.Errorf("fetching jwk from jwks service: some jwks service error"), err)
	assert.Equal(t, false, response.IsAuthorized)
}

func Test_HandlerReturnsFalseWhenJwksServiceDoesNotFindAJwk(t *testing.T) {
	// Given
	headers := make(map[string]string)
	headers["Authorization"] = "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3NvbWUtdXJsIiwic3ViIjoiZWFwaTEyMy1kc3ItY21pLXNjaGVkdWxlcnMifQ.n0ZIqYXkwZ2Jo27nOmh8-5uYt-E_JAPf-jWvVlEkiC-TQ-imtyLlD14WX0Owdr-LwSV9GaMAGfUDkqVSk2xvdyayp-Dmo2ViIBfB6unSoPx0EIBkX2-QPgL9eu0ZYflJawR6uG8sBVmilmyNFBMxbiA9cl1Z5wZq9yvE63nsWXxgF9KhclNpLY3o34PnlZEL1jhixmnqaDKthonFJoBuM7Fuo-hGTVVivEqVFyYfIrgNF1On7KDxhFuWgpi-Ol3NTMprctVL8GOSfKBstQHZqTcKQ4RyynUCOg5aM29BcyKwqp3Y9lDL_U2cvEuH76B-3SKzkkOvm9UE9YjsXGiF0w" // generated using https://jwt.io/

	h := handler{jwkExtractor: &MockJwkExtractor{}}

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Equal(t, fmt.Errorf("fetching jwk from jwks service: no valid jwk found"), err)
	assert.Equal(t, false, response.IsAuthorized)
}

func Test_HandlerReturnsFalseWhenJwksServiceDoesNotContainAnRsa256PublicKey(t *testing.T) {
	// Given
	headers := make(map[string]string)
	headers["Authorization"] = "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3NvbWUtdXJsIiwic3ViIjoiZWFwaTEyMy1kc3ItY21pLXNjaGVkdWxlcnMifQ.n0ZIqYXkwZ2Jo27nOmh8-5uYt-E_JAPf-jWvVlEkiC-TQ-imtyLlD14WX0Owdr-LwSV9GaMAGfUDkqVSk2xvdyayp-Dmo2ViIBfB6unSoPx0EIBkX2-QPgL9eu0ZYflJawR6uG8sBVmilmyNFBMxbiA9cl1Z5wZq9yvE63nsWXxgF9KhclNpLY3o34PnlZEL1jhixmnqaDKthonFJoBuM7Fuo-hGTVVivEqVFyYfIrgNF1On7KDxhFuWgpi-Ol3NTMprctVL8GOSfKBstQHZqTcKQ4RyynUCOg5aM29BcyKwqp3Y9lDL_U2cvEuH76B-3SKzkkOvm9UE9YjsXGiF0w" // generated using https://jwt.io/

	jsonWebKey := JsonWebKey{
		Algorithm: "RS256",
		Family:    "RSA",
		Use:       "sig",
	}

	h := handler{jwkExtractor: &MockJwkExtractor{jsonWebKeyToReturn: jsonWebKey, claimsIssuer: ""}}

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Equal(t, fmt.Errorf("extracting public key from jwk: unable to build public key from modulus and exponent"), err)
	assert.Equal(t, false, response.IsAuthorized)
}

func Test_HandlerReturnsFalseWhenJwksServiceReturnsJkwWithInvalidModulus(t *testing.T) {
	// Given
	headers := make(map[string]string)
	headers["Authorization"] = "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3NvbWUtdXJsIiwic3ViIjoiZWFwaTEyMy1kc3ItY21pLXNjaGVkdWxlcnMifQ.n0ZIqYXkwZ2Jo27nOmh8-5uYt-E_JAPf-jWvVlEkiC-TQ-imtyLlD14WX0Owdr-LwSV9GaMAGfUDkqVSk2xvdyayp-Dmo2ViIBfB6unSoPx0EIBkX2-QPgL9eu0ZYflJawR6uG8sBVmilmyNFBMxbiA9cl1Z5wZq9yvE63nsWXxgF9KhclNpLY3o34PnlZEL1jhixmnqaDKthonFJoBuM7Fuo-hGTVVivEqVFyYfIrgNF1On7KDxhFuWgpi-Ol3NTMprctVL8GOSfKBstQHZqTcKQ4RyynUCOg5aM29BcyKwqp3Y9lDL_U2cvEuH76B-3SKzkkOvm9UE9YjsXGiF0w" // generated using https://jwt.io/

	jsonWebKey := JsonWebKey{
		Algorithm:            "RS256",
		Family:               "RSA",
		Use:                  "sig",
		RsaPublicKeyModulus:  "/",
		RsaPublicKeyExponent: "AQAB",
	}

	h := handler{jwkExtractor: &MockJwkExtractor{jsonWebKeyToReturn: jsonWebKey, claimsIssuer: ""}}

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Equal(t, fmt.Errorf("extracting public key from jwk: decoding public key modulus: illegal base64 data at input byte 0"), err)
	assert.Equal(t, false, response.IsAuthorized)
}

func Test_HandlerReturnsFalseWhenJwksServiceReturnsJkwWithInvalidExponent(t *testing.T) {
	// Given
	headers := make(map[string]string)
	headers["Authorization"] = "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3NvbWUtdXJsIiwic3ViIjoiZWFwaTEyMy1kc3ItY21pLXNjaGVkdWxlcnMifQ.n0ZIqYXkwZ2Jo27nOmh8-5uYt-E_JAPf-jWvVlEkiC-TQ-imtyLlD14WX0Owdr-LwSV9GaMAGfUDkqVSk2xvdyayp-Dmo2ViIBfB6unSoPx0EIBkX2-QPgL9eu0ZYflJawR6uG8sBVmilmyNFBMxbiA9cl1Z5wZq9yvE63nsWXxgF9KhclNpLY3o34PnlZEL1jhixmnqaDKthonFJoBuM7Fuo-hGTVVivEqVFyYfIrgNF1On7KDxhFuWgpi-Ol3NTMprctVL8GOSfKBstQHZqTcKQ4RyynUCOg5aM29BcyKwqp3Y9lDL_U2cvEuH76B-3SKzkkOvm9UE9YjsXGiF0w" // generated using https://jwt.io/

	jsonWebKey := JsonWebKey{
		Algorithm:            "RS256",
		Family:               "RSA",
		Use:                  "sig",
		RsaPublicKeyModulus:  "wZLyxWWovHBpQfY01VEkAe6tnsA_rVgHg2Wu13slebRdZxgzxiDSYQXOGbhTiBAWHvrNQ3pUYnp3kLCAVjcKGQ998j3Ls3V9RTYBqG5Wz1RDbrdcVivTH-4WbYH8I7--XtIx9_DAgpgEJnQrraVUMsN0O6g3aBxX7TKpp12Y6dbEliy6Sh9gFg_GrzI2-rJpopW9TkzAV4Tcu-NPTp-Wc7gi9ymAeaSTRarHYJcd38K7DHcGXkISBhofbTiU6k1oGsywkPbbVCJvOOEdTUWQ7o9syHt0Sy2b8rxM9Rtgfx5J3HAK1WlJ6q_unZX4vES7y2491e9CibygmzwOYCuJWQ",
		RsaPublicKeyExponent: "/",
	}

	h := handler{jwkExtractor: &MockJwkExtractor{jsonWebKeyToReturn: jsonWebKey, claimsIssuer: ""}}

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Equal(t, fmt.Errorf("extracting public key from jwk: decoding public key exponent: illegal base64 data at input byte 0"), err)
	assert.Equal(t, false, response.IsAuthorized)
}

func Test_HandlerReturnsFalseWhenJwkContainsADifferentPublicKey(t *testing.T) {
	// Given
	headers := make(map[string]string)
	headers["Authorization"] = "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL3NvbWUtdXJsIiwic3ViIjoiZWFwaTEyMy1kc3ItY21pLXNjaGVkdWxlcnMifQ.n0ZIqYXkwZ2Jo27nOmh8-5uYt-E_JAPf-jWvVlEkiC-TQ-imtyLlD14WX0Owdr-LwSV9GaMAGfUDkqVSk2xvdyayp-Dmo2ViIBfB6unSoPx0EIBkX2-QPgL9eu0ZYflJawR6uG8sBVmilmyNFBMxbiA9cl1Z5wZq9yvE63nsWXxgF9KhclNpLY3o34PnlZEL1jhixmnqaDKthonFJoBuM7Fuo-hGTVVivEqVFyYfIrgNF1On7KDxhFuWgpi-Ol3NTMprctVL8GOSfKBstQHZqTcKQ4RyynUCOg5aM29BcyKwqp3Y9lDL_U2cvEuH76B-3SKzkkOvm9UE9YjsXGiF0w" // generated using https://jwt.io/

	newPrivateKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	aDifferentPublicKey := newPrivateKey.PublicKey

	jsonWebKey := JsonWebKey{
		Algorithm:            "RS256",
		Family:               "RSA",
		Use:                  "sig",
		RsaPublicKeyModulus:  base64.RawURLEncoding.EncodeToString(aDifferentPublicKey.N.Bytes()),
		RsaPublicKeyExponent: base64.RawURLEncoding.EncodeToString([]byte(strconv.Itoa(aDifferentPublicKey.E))),
		KeyId:                "an-rsa-key-id",
	}

	h := handler{jwkExtractor: &MockJwkExtractor{jsonWebKeyToReturn: jsonWebKey, claimsIssuer: ""}}

	// When
	response, err := h.handleRequest(context.TODO(), events.APIGatewayV2CustomAuthorizerV2Request{
		Headers: headers,
	})

	// Then
	assert.Equal(t, fmt.Errorf("verifying signature: crypto/rsa: verification error"), err)
	assert.Equal(t, false, response.IsAuthorized)
}