feat(auth): inspect access during token introspection

packages/auth/src/access/utils.test.ts

@@ -0,0 +1,209 @@
+import { v4 } from 'uuid'
+import { IocContract } from '@adonisjs/fold'
+import { Knex } from 'knex'
+import { faker } from '@faker-js/faker'
+import {
+  AccessItem,
+  AccessType,
+  AccessAction
+} from '@interledger/open-payments'
+
+import { AppServices } from '../app'
+import { Access, toOpenPaymentsAccess } from './model'
+import { Grant, GrantState, StartMethod, FinishMethod } from '../grant/model'
+import { initIocContainer } from '..'
+import { Config } from '../config/app'
+import { createTestApp, TestContainer } from '../tests/app'
+import { truncateTables } from '../tests/tableManager'
+import { generateToken, generateNonce } from '../shared/utils'
+import { compareRequestAndGrantAccessItems } from './utils'
+
+describe('Access utilities', (): void => {
+  let deps: IocContract<AppServices>
+  let appContainer: TestContainer
+  let trx: Knex.Transaction
+  let identifier: string
+  let grant: Grant
+  let grantAccessItem: Access
+
+  const receiver: string =
+    'https://wallet.com/alice/incoming-payments/12341234-1234-1234-1234-123412341234'
+
+  beforeAll(async (): Promise<void> => {
+    deps = initIocContainer(Config)
+    appContainer = await createTestApp(deps)
+  })
+
+  beforeEach(async (): Promise<void> => {
+    identifier = `https://example.com/${v4()}`
+    grant = await Grant.query(trx).insertAndFetch({
+      state: GrantState.Processing,
+      startMethod: [StartMethod.Redirect],
+      continueToken: generateToken(),
+      continueId: v4(),
+      finishMethod: FinishMethod.Redirect,
+      finishUri: 'https://example.com/finish',
+      clientNonce: generateNonce(),
+      client: faker.internet.url({ appendSlash: false })
+    })
+
+    grantAccessItem = await Access.query(trx).insertAndFetch({
+      grantId: grant.id,
+      type: AccessType.OutgoingPayment,
+      actions: [AccessAction.Read, AccessAction.Create, AccessAction.List],
+      identifier,
+      limits: {
+        receiver,
+        debitAmount: {
+          value: '400',
+          assetCode: 'USD',
+          assetScale: 2
+        }
+      }
+    })
+  })
+
+  afterEach(async (): Promise<void> => {
+    await truncateTables(appContainer.knex)
+  })
+
+  afterAll(async (): Promise<void> => {
+    await appContainer.shutdown()
+  })
+
+  test('Can compare an access item on a grant and an access item from a request', async (): Promise<void> => {
+    const requestAccessItem: AccessItem = {
+      type: 'outgoing-payment',
+      actions: ['create', 'read', 'list'],
+      identifier,
+      limits: {
+        receiver,
+        debitAmount: {
+          value: '400',
+          assetCode: 'USD',
+          assetScale: 2
+        }
+      }
+    }
+
+    expect(
+      compareRequestAndGrantAccessItems(
+        requestAccessItem,
+        toOpenPaymentsAccess(grantAccessItem)
+      )
+    ).toBe(true)
+  })
+
+  test('Can compare an access item on a grant and an access item from a request with partial actions', async (): Promise<void> => {
+    const requestAccessItem: AccessItem = {
+      type: 'outgoing-payment',
+      actions: ['read'],
+      identifier,
+      limits: {
+        receiver,
+        debitAmount: {
+          value: '400',
+          assetCode: 'USD',
+          assetScale: 2
+        }
+      }
+    }
+
+    expect(
+      compareRequestAndGrantAccessItems(
+        requestAccessItem,
+        toOpenPaymentsAccess(grantAccessItem)
+      )
+    ).toBe(true)
+  })
+
+  test('Can compare an access item on a grant and an access item from a request with a subaction of the grant', async (): Promise<void> => {
+    const grantAccessItemSuperAction = await Access.query(trx).insertAndFetch({
+      grantId: grant.id,
+      type: AccessType.OutgoingPayment,
+      actions: [AccessAction.ReadAll],
+      identifier,
+      limits: {
+        receiver,
+        debitAmount: {
+          value: '400',
+          assetCode: 'USD',
+          assetScale: 2
+        }
+      }
+    })
+
+    const requestAccessItem: AccessItem = {
+      type: 'outgoing-payment',
+      actions: ['read'],
+      identifier,
+      limits: {
+        receiver,
+        debitAmount: {
+          value: '400',
+          assetCode: 'USD',
+          assetScale: 2
+        }
+      }
+    }
+
+    expect(
+      compareRequestAndGrantAccessItems(
+        requestAccessItem,
+        toOpenPaymentsAccess(grantAccessItemSuperAction)
+      )
+    ).toBe(true)
+  })
+
+  test('access comparison fails if grant action items are insufficient', async (): Promise<void> => {
+    const identifier = `https://example.com/${v4()}`
+    const receiver =
+      'https://wallet.com/alice/incoming-payments/12341234-1234-1234-1234-123412341234'
+    const requestAccessItem: AccessItem = {
+      type: 'outgoing-payment',
+      actions: ['create', 'read', 'list'],
+      identifier,
+      limits: {
+        receiver,
+        debitAmount: {
+          value: '400',
+          assetCode: 'USD',
+          assetScale: 2
+        }
+      }
+    }
+
+    const grant = await Grant.query(trx).insertAndFetch({
+      state: GrantState.Processing,
+      startMethod: [StartMethod.Redirect],
+      continueToken: generateToken(),
+      continueId: v4(),
+      finishMethod: FinishMethod.Redirect,
+      finishUri: 'https://example.com/finish',
+      clientNonce: generateNonce(),
+      client: faker.internet.url({ appendSlash: false })
+    })
+
+    const grantAccessItem = await Access.query(trx).insertAndFetch({
+      grantId: grant.id,
+      type: AccessType.OutgoingPayment,
+      actions: [AccessAction.Read, AccessAction.Create],
+      identifier,
+      limits: {
+        receiver,
+        debitAmount: {
+          value: '400',
+          assetCode: 'USD',
+          assetScale: 2
+        }
+      }
+    })
+
+    expect(
+      compareRequestAndGrantAccessItems(
+        requestAccessItem,
+        toOpenPaymentsAccess(grantAccessItem)
+      )
+    ).toBe(false)
+  })
+})

packages/auth/src/access/utils.ts

@@ -0,0 +1,47 @@
+import { isDeepStrictEqual } from 'util'
+import { AccessItem, AccessAction } from '@interledger/open-payments'
+
+export function compareRequestAndGrantAccessItems(
+  requestAccessItem: AccessItem,
+  grantAccessItem: AccessItem
+): boolean {
+  const { actions: requestAccessItemActions, ...restOfRequestAccessItem } =
+    requestAccessItem
+  const { actions: grantAccessItemActions, ...restOfgrantAccessItem } =
+    grantAccessItem
+
+  for (const actionItem of requestAccessItemActions) {
+    if (
+      !grantAccessItemActions.find(
+        (grantAccessAction) =>
+          grantAccessAction === actionItem ||
+          (actionItem === AccessAction.Read &&
+            grantAccessAction === AccessAction.ReadAll) ||
+          (actionItem === AccessAction.List &&
+            grantAccessAction === AccessAction.ListAll)
+      )
+    )
+      return false
+  }
+
+  Object.keys(restOfRequestAccessItem).forEach((key) => {
+    const requestAccessItemValue =
+      restOfRequestAccessItem[key as keyof typeof restOfRequestAccessItem]
+    if (
+      typeof requestAccessItemValue === 'object' &&
+      !isDeepStrictEqual(
+        requestAccessItemValue,
+        restOfgrantAccessItem[key as keyof typeof restOfgrantAccessItem]
+      )
+    ) {
+      return false
+    } else if (
+      requestAccessItemValue !==
+      restOfgrantAccessItem[key as keyof typeof restOfgrantAccessItem]
+    ) {
+      return false
+    }
+  })
+
+  return true
+}

packages/auth/src/accessToken/routes.test.ts

@@ -16,7 +16,11 @@ import { AccessToken } from './model'
 import { Access } from '../access/model'
 import { AccessTokenRoutes, IntrospectContext } from './routes'
 import { generateNonce, generateToken } from '../shared/utils'
-import { AccessType, AccessAction } from '@interledger/open-payments'
+import {
+  AccessType,
+  AccessAction,
+  AccessItem
+} from '@interledger/open-payments'
 import { GrantService } from '../grant/service'
 import { AccessTokenService } from './service'
 import { GNAPErrorCode } from '../shared/gnapErrors'
@@ -199,6 +203,124 @@ describe('Access Token Routes', (): void => {
         active: false
       })
     })
+
+    test('Successfully introspects token with correct access', async (): Promise<void> => {
+      const ctx = createContext<IntrospectContext>(
+        {
+          headers: {
+            Accept: 'application/json'
+          },
+          url: '/',
+          method: 'POST'
+        },
+        {}
+      )
+
+      ctx.request.body = {
+        access_token: token.value,
+        access: [BASE_ACCESS as AccessItem]
+      }
+
+      await expect(accessTokenRoutes.introspect(ctx)).resolves.toBeUndefined()
+      expect(ctx.response).toSatisfyApiSpec()
+      expect(ctx.status).toBe(200)
+      expect(ctx.response.get('Content-Type')).toBe(
+        'application/json; charset=utf-8'
+      )
+
+      expect(ctx.body).toEqual({
+        active: true,
+        grant: grant.id,
+        access: [
+          {
+            type: access.type,
+            actions: access.actions,
+            limits: access.limits,
+            identifier: access.identifier
+          }
+        ],
+        client: CLIENT
+      })
+    })
+
+    test('Successfully introspects token with partial access', async (): Promise<void> => {
+      const ctx = createContext<IntrospectContext>(
+        {
+          headers: {
+            Accept: 'application/json'
+          },
+          url: '/',
+          method: 'POST'
+        },
+        {}
+      )
+
+      ctx.request.body = {
+        access_token: token.value,
+        access: [
+          {
+            ...(BASE_ACCESS as AccessItem),
+            actions: ['read']
+          }
+        ]
+      }
+
+      await expect(accessTokenRoutes.introspect(ctx)).resolves.toBeUndefined()
+      expect(ctx.response).toSatisfyApiSpec()
+      expect(ctx.status).toBe(200)
+      expect(ctx.response.get('Content-Type')).toBe(
+        'application/json; charset=utf-8'
+      )
+
+      expect(ctx.body).toEqual({
+        active: true,
+        grant: grant.id,
+        access: [
+          {
+            type: access.type,
+            actions: access.actions,
+            limits: access.limits,
+            identifier: access.identifier
+          }
+        ],
+        client: CLIENT
+      })
+    })
+
+    test('Cannot introspect token with incorrect access', async (): Promise<void> => {
+      const ctx = createContext<IntrospectContext>(
+        {
+          headers: {
+            Accept: 'application/json'
+          },
+          url: '/',
+          method: 'POST'
+        },
+        {}
+      )
+
+      ctx.request.body = {
+        access_token: token.value,
+        access: [
+          {
+            ...BASE_ACCESS,
+            type: 'incoming-payment',
+            actions: ['read-all']
+          }
+        ]
+      }
+
+      await expect(accessTokenRoutes.introspect(ctx)).resolves.toBeUndefined()
+      expect(ctx.response).toSatisfyApiSpec()
+      expect(ctx.status).toBe(200)
+      expect(ctx.response.get('Content-Type')).toBe(
+        'application/json; charset=utf-8'
+      )
+
+      expect(ctx.body).toEqual({
+        active: false
+      })
+    })
   })
 
   describe('Revocation', (): void => {