Merge remote-tracking branch 'upstream/main' into fix/store-reducer-manager-type-casting

Signed-off-by: Aaryaa Newaskar <aryu.newaskar77@gmail.com>

# Conflicts:
#	heka-identity-service/docs/setup.md

Author: aryunewaskar77-art

.github/workflows/heka-identity-service-verify.yml

@@ -13,6 +13,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  checks: write
+  pull-requests: write
+  contents: write
+
 jobs:
   verify:
     defaults:
@@ -77,4 +82,11 @@ jobs:
           EXPRESS_HOST: localhost
           FILE_STORAGE_FS_URL: http://localhost:3000
           APP_ENDPOINT: http://localhost:3000
-        run: yarn test
+        run: yarn test:coverage
+
+      - name: Report coverage
+        uses: davelosert/vitest-coverage-report-action@15b5b41bb7d36796d89f4bf482b09529c53f3446 # v2.9.2
+        with:
+          working-directory: ./heka-identity-service
+          json-summary-path: ./coverage/coverage-summary.json
+          json-final-path: ./coverage/coverage-final.json

heka-auth-service/src/core/config/configs/jwt.config.ts

@@ -15,7 +15,7 @@ export const jwtConfigDefaults = {
   secret: 'test',
   accessExpiry: 60 * 60, // 1h
   refreshExpiry: 86400, // 24h
-  demoUserTokenExpiry: 1000 * 24 * 60 * 60 * 30 * 12, // ~1 years validity for Demo User
+  demoUserTokenExpiry: 60 * 60 * 24 * 365, // ~1 year validity for Demo User
 }
 
 export class JwtConfig {

heka-auth-service/src/oauth/oauth.service.ts

@@ -165,7 +165,7 @@ export class OAuthService {
 
     return {
       token,
-      expiresIn: this.configService.jwtConfig.accessExpiry,
+      expiresIn: accessTokenExpiresIn,
     }
   }
 

heka-identity-service/docs/setup.md

@@ -22,7 +22,6 @@ To run Heka Identity Service locally, follow these steps:
    ```bash
    yarn install
    ```
-
 ### Fixing node-gyp issues with Python 3.12
 
 If you encounter `node-gyp` build failures with Python 3.12,
@@ -39,7 +38,6 @@ Downgrade or switch your active Python version to 3.11:
 ```bash
 npm install --python=python3.11
 ```
-
 5. Configure persistent storage. You can find information on how to configure it in the [Persistence](#persistence)
    and [Migrations](#migrations) sections.
 6. Run the server as described in the [Run the app](#run-the-app)

heka-identity-service/package.json

@@ -11,7 +11,10 @@
     "watch": "nodemon --config nodemon.json",
     "debug": "nodemon --config nodemon-debug.json",
     "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
+    "test:unit": "vitest run src/",
+    "test:e2e": "vitest run test/",
     "check-types": "yarn check-types:src && yarn check-types:test",
     "check-types:src": "tsc -p tsconfig.src.json --noEmit",
     "check-types:test": "tsc -p tsconfig.test.json --noEmit",
@@ -104,6 +107,7 @@
     "@types/uuid": "^9.0.1",
     "@typescript-eslint/eslint-plugin": "^5.59.8",
     "@typescript-eslint/parser": "^5.59.8",
+    "@vitest/coverage-v8": "^2.1.8",
     "did-resolver": "^4.1.0",
     "eslint": "^8.42.0",
     "eslint-config-prettier": "^8.8.0",

heka-identity-service/src/common/auth/__tests__/auth.service.test.ts

@@ -1,8 +1,18 @@
+import { IncomingMessage } from 'http'
+
+import { createMock } from '@golevelup/ts-vitest'
+import { EntityManager } from '@mikro-orm/core'
 import { UnauthorizedException } from '@nestjs/common'
+import { JwtService } from '@nestjs/jwt'
 
+import { Agent } from 'common/agent'
 import { Role } from 'common/auth'
+import { User, Wallet } from 'common/entities'
+import { Logger } from 'common/logger'
 import { getWalletId } from 'utils/auth'
 
+import { AuthService } from '../auth.service'
+
 describe('getWalletId', () => {
   test.each([
     [{ role: Role.Admin, userId: '11' }, 'Administration_11'],
@@ -29,3 +39,186 @@ describe('getWalletId', () => {
     expect(() => getWalletId(params)).toThrow(UnauthorizedException)
   })
 })
+
+describe('AuthService', () => {
+  let service: AuthService
+  let agent: Agent
+  let jwtService: JwtService
+  let em: EntityManager
+  let logger: Logger
+
+  const makeUser = (overrides: Partial<User> & { walletsContains?: boolean } = {}): User => {
+    const walletsContains = overrides.walletsContains ?? true
+    return {
+      id: overrides.id ?? 'user-1',
+      wallets: {
+        init: vi.fn().mockResolvedValue(undefined),
+        contains: vi.fn().mockReturnValue(walletsContains),
+        add: vi.fn(),
+      },
+    } as unknown as User
+  }
+
+  const makeWallet = (overrides: Partial<Wallet> = {}): Wallet =>
+    ({
+      id: 'Issuer_11_in_Organization_7',
+      tenantId: 'tenant-xyz',
+      ...overrides,
+    }) as Wallet
+
+  beforeEach(() => {
+    agent = createMock<Agent>({
+      modules: {
+        tenants: {
+          createTenant: vi.fn(),
+          withTenantAgent: vi.fn().mockImplementation(async (_opts: unknown, cb: (ta: unknown) => Promise<void>) => {
+            await cb({ modules: { anoncreds: { createLinkSecret: vi.fn() } } })
+          }),
+        },
+      } as any,
+    })
+    jwtService = createMock<JwtService>()
+    em = createMock<EntityManager>()
+    logger = createMock<Logger>()
+    service = new AuthService(agent, jwtService, em, logger)
+  })
+
+  describe('validateRequestToken', () => {
+    test('throws when Authorization header is missing', async () => {
+      const request = { headers: {} } as IncomingMessage
+
+      await expect(service.validateRequestToken(request)).rejects.toThrow('Authorization token is missing')
+    })
+
+    test('throws when scheme is not Bearer', async () => {
+      const request = { headers: { authorization: 'Basic abc123' } } as IncomingMessage
+
+      await expect(service.validateRequestToken(request)).rejects.toThrow('Authorization token is missing')
+    })
+
+    test('verifies token and returns AuthInfo', async () => {
+      const request = { headers: { authorization: 'Bearer my-jwt' } } as IncomingMessage
+      const payload = { sub: '11', org_id: '7', name: 'test', roles: [Role.Issuer] }
+
+      vi.mocked(jwtService.verifyAsync).mockResolvedValue(payload as any)
+
+      const user = makeUser({ id: '11' })
+      const wallet = makeWallet()
+      vi.mocked(em.findOne).mockResolvedValueOnce(user).mockResolvedValueOnce(wallet)
+
+      const result = await service.validateRequestToken(request)
+
+      expect(jwtService.verifyAsync).toHaveBeenCalledWith('my-jwt')
+      expect(em.findOne).toHaveBeenNthCalledWith(1, User, { id: '11' })
+      expect(em.findOne).toHaveBeenNthCalledWith(2, Wallet, { id: 'Issuer_11_in_Organization_7' })
+      expect(result.userId).toBe('11')
+      expect(result.role).toBe(Role.Issuer)
+      expect(result.walletId).toBe('Issuer_11_in_Organization_7')
+      expect(result.tenantId).toBe('tenant-xyz')
+    })
+  })
+
+  describe('validateTokenPayload', () => {
+    test('throws UnauthorizedException when payload has multiple roles', async () => {
+      const payload = { sub: '11', org_id: '7', name: 'test', roles: [Role.Admin, Role.Issuer] } as any
+
+      await expect(service.validateTokenPayload(payload)).rejects.toThrow(UnauthorizedException)
+    })
+
+    test('throws UnauthorizedException when role is not a valid Role', async () => {
+      const payload = { sub: '11', org_id: '7', name: 'test', roles: ['Hacker'] } as any
+
+      await expect(service.validateTokenPayload(payload)).rejects.toThrow(UnauthorizedException)
+    })
+
+    test('returns AuthInfo when user and wallet exist and wallet already linked', async () => {
+      const payload = { sub: '11', org_id: '7', name: 'Alice', roles: [Role.Issuer] } as any
+      const user = makeUser({ id: '11', walletsContains: true })
+      const wallet = makeWallet()
+
+      vi.mocked(em.findOne).mockResolvedValueOnce(user).mockResolvedValueOnce(wallet)
+
+      const result = await service.validateTokenPayload(payload)
+
+      expect(em.findOne).toHaveBeenNthCalledWith(1, User, { id: '11' })
+      expect(em.findOne).toHaveBeenNthCalledWith(2, Wallet, { id: 'Issuer_11_in_Organization_7' })
+      expect(result).toEqual({
+        userId: '11',
+        user,
+        userName: 'Alice',
+        role: Role.Issuer,
+        orgId: '7',
+        walletId: 'Issuer_11_in_Organization_7',
+        tenantId: 'tenant-xyz',
+      })
+      expect(user.wallets.add).not.toHaveBeenCalled()
+      expect(em.flush).not.toHaveBeenCalled()
+    })
+
+    test('links wallet to user when not already linked', async () => {
+      const payload = { sub: '11', org_id: '7', name: 'Alice', roles: [Role.Issuer] } as any
+      const user = makeUser({ id: '11', walletsContains: false })
+      const wallet = makeWallet()
+
+      vi.mocked(em.findOne).mockResolvedValueOnce(user).mockResolvedValueOnce(wallet)
+
+      await service.validateTokenPayload(payload)
+
+      expect(em.findOne).toHaveBeenNthCalledWith(1, User, { id: '11' })
+      expect(em.findOne).toHaveBeenNthCalledWith(2, Wallet, { id: 'Issuer_11_in_Organization_7' })
+      expect(user.wallets.add).toHaveBeenCalledWith(wallet)
+      expect(em.flush).toHaveBeenCalled()
+    })
+
+    test('creates user when not found', async () => {
+      const payload = { sub: 'new-user', org_id: '7', name: 'Bob', roles: [Role.Issuer] } as any
+      const wallet = makeWallet()
+
+      vi.mocked(em.findOne).mockResolvedValueOnce(null).mockResolvedValueOnce(wallet)
+
+      // The new User created inside the service has real Collection internals; replace findOne
+      // behavior so the second path (wallets.init / contains / add) works via a post-create hook.
+      vi.mocked(em.persistAndFlush).mockImplementation((entity: any) => {
+        if (entity instanceof User) {
+          entity.wallets = {
+            init: vi.fn().mockResolvedValue(undefined),
+            contains: vi.fn().mockReturnValue(true),
+            add: vi.fn(),
+          } as any
+        }
+        return Promise.resolve()
+      })
+
+      const result = await service.validateTokenPayload(payload)
+
+      expect(em.findOne).toHaveBeenNthCalledWith(1, User, { id: 'new-user' })
+      expect(em.findOne).toHaveBeenNthCalledWith(2, Wallet, { id: 'Issuer_new-user_in_Organization_7' })
+      expect(em.persistAndFlush).toHaveBeenCalled()
+      expect(result.userId).toBe('new-user')
+    })
+
+    test('creates wallet + tenant + link secret when wallet not found', async () => {
+      const payload = { sub: '11', org_id: '7', name: 'Alice', roles: [Role.Issuer] } as any
+      const user = makeUser({ id: '11', walletsContains: true })
+
+      vi.mocked(em.findOne).mockResolvedValueOnce(user).mockResolvedValueOnce(null)
+
+      vi.mocked(agent.modules.tenants.createTenant).mockResolvedValue({ id: 'new-tenant-id' } as any)
+
+      const createLinkSecret = vi.fn()
+      vi.mocked(agent.modules.tenants.withTenantAgent).mockImplementation(async (_opts, cb) => {
+        await cb({ modules: { anoncreds: { createLinkSecret } } } as any)
+      })
+
+      const result = await service.validateTokenPayload(payload)
+
+      expect(em.findOne).toHaveBeenNthCalledWith(1, User, { id: '11' })
+      expect(em.findOne).toHaveBeenNthCalledWith(2, Wallet, { id: 'Issuer_11_in_Organization_7' })
+      expect(agent.modules.tenants.createTenant).toHaveBeenCalledWith({
+        config: { label: 'Issuer_11_in_Organization_7' },
+      })
+      expect(createLinkSecret).toHaveBeenCalled()
+      expect(result.tenantId).toBe('new-tenant-id')
+    })
+  })
+})