juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import { inject, TestBed } from '@angular/core/testing'
7
import { AccountingGuard, AdminGuard, DeluxeGuard, LoginGuard } from './app.guard'
8
import { HttpClientTestingModule } from '@angular/common/http/testing'
9
import { RouterTestingModule } from '@angular/router/testing'
10
import { ErrorPageComponent } from './error-page/error-page.component'
11

12
describe('LoginGuard', () => {
13
  beforeEach(() => {
14
    TestBed.configureTestingModule({
15
      imports: [
16
        HttpClientTestingModule,
17
        RouterTestingModule.withRoutes([
18
          { path: '403', component: ErrorPageComponent }
19
        ]
20
        )],
21
      providers: [LoginGuard]
22
    })
23
  })
24

25
  it('should be created', inject([LoginGuard], (guard: LoginGuard) => {
26
    expect(guard).toBeTruthy()
27
  }))
28

29
  it('should open for authenticated users', inject([LoginGuard], (guard: LoginGuard) => {
30
    localStorage.setItem('token', 'TOKEN')
31
    expect(guard.canActivate()).toBeTrue()
32
  }))
33

34
  it('should close for anonymous users', inject([LoginGuard], (guard: LoginGuard) => {
35
    localStorage.removeItem('token')
36
    expect(guard.canActivate()).toBeFalse()
37
  }))
38

39
  it('returns payload from decoding a valid JWT', inject([LoginGuard], (guard: LoginGuard) => {
40
    localStorage.setItem('token', 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c')
41
    expect(guard.tokenDecode()).toEqual({
42
      sub: '1234567890',
43
      name: 'John Doe',
44
      iat: 1516239022
45
    })
46
  }))
47

48
  it('returns nothing when decoding an invalid JWT', inject([LoginGuard], (guard: LoginGuard) => {
49
    localStorage.setItem('token', '12345.abcde')
50
    expect(guard.tokenDecode()).toBeNull()
51
  }))
52

53
  it('returns nothing when decoding an non-existing JWT', inject([LoginGuard], (guard: LoginGuard) => {
54
    localStorage.removeItem('token')
55
    expect(guard.tokenDecode()).toBeNull()
56
  }))
57
})
58

59
describe('AdminGuard', () => {
60
  let loginGuard: any
61

62
  beforeEach(() => {
63
    loginGuard = jasmine.createSpyObj('LoginGuard', ['tokenDecode', 'forbidRoute'])
64

65
    TestBed.configureTestingModule({
66
      imports: [
67
        HttpClientTestingModule,
68
        RouterTestingModule.withRoutes([
69
          { path: '403', component: ErrorPageComponent }
70
        ]
71
        )],
72
      providers: [
73
        AdminGuard,
74
        { provide: LoginGuard, useValue: loginGuard }
75
      ]
76
    })
77
  })
78

79
  it('should be created', inject([AdminGuard], (guard: AdminGuard) => {
80
    expect(guard).toBeTruthy()
81
  }))
82

83
  it('should open for admins', inject([AdminGuard], (guard: AdminGuard) => {
84
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'admin' } })
85
    expect(guard.canActivate()).toBeTrue()
86
  }))
87

88
  it('should close for regular customers', inject([AdminGuard], (guard: AdminGuard) => {
89
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'customer' } })
90
    expect(guard.canActivate()).toBeFalse()
91
    expect(loginGuard.forbidRoute).toHaveBeenCalled()
92
  }))
93

94
  it('should close for deluxe customers', inject([AdminGuard], (guard: AdminGuard) => {
95
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'deluxe' } })
96
    expect(guard.canActivate()).toBeFalse()
97
    expect(loginGuard.forbidRoute).toHaveBeenCalled()
98
  }))
99

100
  it('should close for accountants', inject([AdminGuard], (guard: AdminGuard) => {
101
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'accounting' } })
102
    expect(guard.canActivate()).toBeFalse()
103
    expect(loginGuard.forbidRoute).toHaveBeenCalled()
104
  }))
105
})
106

107
describe('AccountingGuard', () => {
108
  let loginGuard: any
109

110
  beforeEach(() => {
111
    loginGuard = jasmine.createSpyObj('LoginGuard', ['tokenDecode', 'forbidRoute'])
112

113
    TestBed.configureTestingModule({
114
      imports: [
115
        HttpClientTestingModule,
116
        RouterTestingModule.withRoutes([
117
          { path: '403', component: ErrorPageComponent }
118
        ]
119
        )],
120
      providers: [
121
        AccountingGuard,
122
        { provide: LoginGuard, useValue: loginGuard }
123
      ]
124
    })
125
  })
126

127
  it('should be created', inject([AccountingGuard], (guard: AccountingGuard) => {
128
    expect(guard).toBeTruthy()
129
  }))
130

131
  it('should open for accountants', inject([AccountingGuard], (guard: AccountingGuard) => {
132
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'accounting' } })
133
    expect(guard.canActivate()).toBeTrue()
134
  }))
135

136
  it('should close for regular customers', inject([AccountingGuard], (guard: AccountingGuard) => {
137
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'customer' } })
138
    expect(guard.canActivate()).toBeFalse()
139
    expect(loginGuard.forbidRoute).toHaveBeenCalled()
140
  }))
141

142
  it('should close for deluxe customers', inject([AccountingGuard], (guard: AccountingGuard) => {
143
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'deluxe' } })
144
    expect(guard.canActivate()).toBeFalse()
145
    expect(loginGuard.forbidRoute).toHaveBeenCalled()
146
  }))
147

148
  it('should close for admins', inject([AccountingGuard], (guard: AccountingGuard) => {
149
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'admin' } })
150
    expect(guard.canActivate()).toBeFalse()
151
    expect(loginGuard.forbidRoute).toHaveBeenCalled()
152
  }))
153
})
154

155
describe('DeluxeGuard', () => {
156
  let loginGuard: any
157

158
  beforeEach(() => {
159
    loginGuard = jasmine.createSpyObj('LoginGuard', ['tokenDecode'])
160

161
    TestBed.configureTestingModule({
162
      imports: [
163
        HttpClientTestingModule,
164
        RouterTestingModule.withRoutes([
165
          { path: '403', component: ErrorPageComponent }
166
        ]
167
        )],
168
      providers: [
169
        DeluxeGuard,
170
        { provide: LoginGuard, useValue: loginGuard }
171
      ]
172
    })
173
  })
174

175
  it('should be created', inject([DeluxeGuard], (guard: DeluxeGuard) => {
176
    expect(guard).toBeTruthy()
177
  }))
178

179
  it('should open for deluxe customers', inject([DeluxeGuard], (guard: DeluxeGuard) => {
180
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'deluxe' } })
181
    expect(guard.isDeluxe()).toBeTrue()
182
  }))
183

184
  it('should close for regular customers', inject([DeluxeGuard], (guard: DeluxeGuard) => {
185
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'customer' } })
186
    expect(guard.isDeluxe()).toBeFalse()
187
  }))
188

189
  it('should close for admins', inject([DeluxeGuard], (guard: DeluxeGuard) => {
190
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'admin' } })
191
    expect(guard.isDeluxe()).toBeFalse()
192
  }))
193

194
  it('should close for accountants', inject([DeluxeGuard], (guard: DeluxeGuard) => {
195
    loginGuard.tokenDecode.and.returnValue({ data: { role: 'accounting' } })
196
    expect(guard.isDeluxe()).toBeFalse()
197
  }))
198
})
199