Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
test('authorize$ throws error if incoming request is not authorized', done => {
// given
const mockedSecret = 'test_secret';
const mockedToken = 'TEST_TOKEN';
const mockedRequest = { headers: { authorization: `Bearer ${mockedToken}`} } as HttpRequest;
const expectedError = new HttpError('Unauthorized', HttpStatus.UNAUTHORIZED);
const req$ = of(mockedRequest);
const res = {} as HttpResponse;
// when
utilModule.parseAuthorizationHeader = jest.fn(() => mockedToken);
factoryModule.verifyToken$ = jest.fn(() => () => throwError(expectedError));
const middleware$ = authorize$({ secret: mockedSecret }, verifyPayload$)(req$, res, effectMeta);
// then
middleware$.subscribe(
() => {
fail(`Stream should throw an error`);
done();
},
test('authorize$ throws error if verifyPayload$ handler doesn\'t pass', done => {
// given
const mockedSecret = 'test_secret';
const mockedToken = 'TEST_TOKEN';
const mockedTokenPayload = { id: 'test_id_wrong' };
const mockedRequest = { headers: { authorization: `Bearer ${mockedToken}`} } as HttpRequest;
const expectedError = new HttpError('Unauthorized', HttpStatus.UNAUTHORIZED);
const req$ = of(mockedRequest);
const res = {} as HttpResponse;
// when
utilModule.parseAuthorizationHeader = jest.fn(() => mockedToken);
factoryModule.verifyToken$ = jest.fn(() => () => of(mockedTokenPayload));
const middleware$ = authorize$({ secret: mockedSecret }, verifyPayload$)(req$, res, effectMeta);
// then
middleware$.subscribe(
() => {
fail(`Stream should throw an error`);
done();
},
test('triggers connection error', done => {
// given
const error = new WebSocketConnectionError('Unauthorized', HttpStatus.UNAUTHORIZED);
const connection$: WsConnectionEffect = req$ => req$.pipe(mergeMapTo(throwError(error)));
const webSocketServer = webSocketListener({ connection$ });
const targetClient1 = testBed.getClient(0);
const targetClient2 = testBed.getClient(1);
const server = testBed.getServer();
const context = createContext();
// when
webSocketServer({ server }).run(context);
// then
merge(
fromEvent(targetClient1, 'unexpected-response'),
fromEvent(targetClient2, 'unexpected-response'),
)
.pipe(take(2), toArray())
catchError(() =>
throwError(new HttpError('Unauthorized', HttpStatus.UNAUTHORIZED))
)
catchError(() => throwError(
new HttpError('Unauthorized', HttpStatus.UNAUTHORIZED)
)),
))
const throwIfUnauthorized = (body: CredentialsPayload) => (authorized: boolean) =>
iif(
() => authorized,
of(body),
throwError(new HttpError('Unauthorized', HttpStatus.UNAUTHORIZED))
);
mergeMap(req => iif(
() => req.headers.upgrade !== 'websocket',
throwError(new WebSocketConnectionError('Unauthorized', HttpStatus.UNAUTHORIZED)),
of(req),
)),
);
switchMap(req => iif(
() => !isAuthorized(req),
throwError(new HttpError('Unauthorized', HttpStatus.UNAUTHORIZED)),
of(req),
)),
);
export const throwIfNotAdmin = (user: InstanceType) =>
iif(
() => user.roles.includes(UserRole.ADMIN),
of(user),
throwError(new HttpError('Unauthorized', HttpStatus.UNAUTHORIZED))
);
catchError(() => throwError(new HttpError('Unauthorized', HttpStatus.UNAUTHORIZED)))
)