ユーザーをリダイレクトするアクションのユニットテスト

const { getDefaultArguments, loadAction } = require('@auth0/actions/password-reset-post-challenge/v1/test');
const path = require('path');
const { compileActionModules } = require('./test-utils/load-compiled-action');

const DIRNAME = path.dirname('../');
const ACTION_PATH = path.resolve(DIRNAME, './src/mock-redirects.ts');
const VERIFICATION_URL = 'https://verify.example.com/identity';

describe('onExecutePostChallenge', () => {
  let loader: any;
  let event: any;
  let api: any;

  beforeEach(async () => {
    jest.resetAllMocks();
    const { compiledActionPath } = compileActionModules(ACTION_PATH);
    loader = await loadAction(compiledActionPath);
    [event, api] = getDefaultArguments();
    event.secrets.REDIRECT_SECRET = 'test-secret';
    jest.spyOn(api.redirect, 'encodeToken').mockReturnValue('signed.jwt.token');
    jest.spyOn(api.redirect, 'sendUserTo');
  });

  afterEach(() => {
    jest.resetAllMocks();
  });

  it('does not redirect when the risk score is below the threshold', async () => {
    event.authentication.riskAssessment.supplemental.akamai.akamaiUserRisk.score = 10;

    await loader.execute('onExecutePostChallenge', event, api);

    expect(api.redirect.encodeToken).not.toHaveBeenCalled();
    expect(api.redirect.sendUserTo).not.toHaveBeenCalled();
  });

  it('redirects to the identity verification page when the risk score exceeds the threshold', async () => {
    event.authentication.riskAssessment.supplemental.akamai.akamaiUserRisk.score = 80;

    await loader.execute('onExecutePostChallenge', event, api);

    expect(api.redirect.encodeToken).toHaveBeenCalledWith({
      secret: 'test-secret',
      payload: { userId: event.user.user_id },
    });
    expect(api.redirect.sendUserTo).toHaveBeenCalledWith(VERIFICATION_URL, {
      query: { session_token: 'signed.jwt.token' },
    });
  });
});

describe('onContinuePostChallenge', () => {
  let loader: any;
  let event: any;
  let api: any;

  beforeEach(async () => {
    jest.resetAllMocks();
    const { compiledActionPath } = compileActionModules(ACTION_PATH);
    loader = await loadAction(compiledActionPath);
    [event, api] = getDefaultArguments();
    event.secrets.REDIRECT_SECRET = 'test-secret';
    jest.spyOn(api.access, 'deny');
  });

  afterEach(() => {
    jest.resetAllMocks();
  });

  it('denies access when the redirect token cannot be validated', async () => {
    jest.spyOn(api.redirect, 'validateToken').mockImplementation(() => {
      throw new Error('invalid signature');
    });

    await loader.execute('onContinuePostChallenge', event, api);

    expect(api.redirect.validateToken).toHaveBeenCalledWith({ secret: 'test-secret' });
    expect(api.access.deny).toHaveBeenCalledWith('Unable to verify redirect response: invalid signature');
  });

  it('denies access when the token belongs to a different user', async () => {
    jest.spyOn(api.redirect, 'validateToken').mockReturnValue({ userId: 'someone-else' });

    await loader.execute('onContinuePostChallenge', event, api);

    expect(api.access.deny).toHaveBeenCalledWith('Verification response does not match the current user.');
  });

  it('denies access when the verification was not completed', async () => {
    jest.spyOn(api.redirect, 'validateToken').mockReturnValue({ userId: event.user.user_id });
    event.request.query.verified = 'false';

    await loader.execute('onContinuePostChallenge', event, api);

    expect(api.access.deny).toHaveBeenCalledWith('Identity verification was not completed.');
  });

  it('allows the flow to continue when verification succeeded', async () => {
    jest.spyOn(api.redirect, 'validateToken').mockReturnValue({ userId: event.user.user_id });
    event.request.query.verified = 'true';

    await loader.execute('onContinuePostChallenge', event, api);

    expect(api.access.deny).not.toHaveBeenCalled();
  });
});

import * as fs from 'fs';
import * as os from 'os';
import * as path from 'path';
import * as ts from 'typescript';

export interface ModuleToCompile {
  name: string;
  filename: string;
}

function transpileToTemp(sourcePath: string): string {
  const source = fs.readFileSync(sourcePath, 'utf8');
  const { outputText } = ts.transpileModule(source, {
    compilerOptions: {
      module: ts.ModuleKind.CommonJS,
      target: ts.ScriptTarget.ES2020,
      esModuleInterop: true,
    },
  });

  const tempPath = path.join(
    os.tmpdir(),
    `${path.basename(sourcePath, path.extname(sourcePath))}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.js`,
  );
  fs.writeFileSync(tempPath, outputText);
  return tempPath;
}

/**
 * loadAction()（@auth0/actions/*\/test 提供）は対象ファイルをディスクから読み取り、
 * vm.compileFunction 経由で実行するため、ts-node や Vitest 自体の TS 変換を
 * 一切経由しません。したがって、アクションのソース（および actions: で登録された
 * モジュール）は、あらかじめディスク上でプレーンな JS にトランスパイルしておく必要があります。
 */
export function compileActionModules(actionPath: string, modules: ModuleToCompile[] = []) {
  const compiledActionPath = transpileToTemp(actionPath);
  const compiledModules = modules.map((m) => ({
    name: m.name,
    filename: transpileToTemp(m.filename),
  }));

  return { compiledActionPath, compiledModules };
}

{
  "name": "actions-npm-example-ts-jest",
  "version": "1.0.0",
  "description": "Auth0 Actions unit testing example using Jest and TypeScript",
  "main": "example.ts",
  "scripts": {
    "test": "jest"
  },
  "author": "Auth0",
  "license": "MIT",
  "devDependencies": {
    "@auth0/actions": "^0.33.0",
    "@types/jest": "^29.5.12",
    "@types/node": "22.14.0",
    "jest": "^29.7.0",
    "ts-jest": "^29.1.2",
    "typescript": "^5.9.2"
  }
}

module.exports = {
  preset: 'ts-jest',
  testEnvironment: 'node',
};

{
  "compilerOptions": {
    "target": "ES2020",
    "module": "NodeNext",
    "moduleResolution": "nodenext",
    "esModuleInterop": true,
    "allowSyntheticDefaultImports": true,
    "strict": true,
    "outDir": "dist",
    "declaration": true,
    "sourceMap": true,
    "allowJs": true,
    "checkJs": false,
    "resolveJsonModule": true,
    "skipLibCheck": true,
    "forceConsistentCasingInFileNames": true,
    "isolatedModules": true,
    "noEmit": true,
    "paths": {
      "actions:*": [
        "./src/*"
      ]
    }
  },
  "exclude": [
    "node_modules",
    "dist"
  ],
  "include": [
    "**/*.ts"
  ],
  "ts-node": {
    "transpileOnly": true
  }
}

import * as path from 'path';
import sinon from 'sinon';
import { compileActionModules } from './test-utils/load-compiled-action';

const { getDefaultArguments, loadAction } = require('@auth0/actions/password-reset-post-challenge/v1/test');

const DIRNAME = path.dirname('../');
const ACTION_PATH = path.resolve(DIRNAME, './src/mock-redirects.ts');
const VERIFICATION_URL = 'https://verify.example.com/identity';

describe('onExecutePostChallenge', () => {
  let loader: any;
  let event: any;
  let api: any;

  beforeEach(async () => {
    const { compiledActionPath } = compileActionModules(ACTION_PATH);
    loader = await loadAction(compiledActionPath);
    [event, api] = getDefaultArguments();
    event.secrets.REDIRECT_SECRET = 'test-secret';
    sinon.stub(api.redirect, 'encodeToken').returns('signed.jwt.token');
    sinon.spy(api.redirect, 'sendUserTo');
  });

  afterEach(() => {
    sinon.restore();
  });

  it('does not redirect when the risk score is below the threshold', async () => {
    event.authentication.riskAssessment.supplemental.akamai.akamaiUserRisk.score = 10;

    await loader.execute('onExecutePostChallenge', event, api);

    sinon.assert.notCalled(api.redirect.encodeToken);
    sinon.assert.notCalled(api.redirect.sendUserTo);
  });

  it('redirects to the identity verification page when the risk score exceeds the threshold', async () => {
    event.authentication.riskAssessment.supplemental.akamai.akamaiUserRisk.score = 80;

    await loader.execute('onExecutePostChallenge', event, api);

    sinon.assert.calledWith(api.redirect.encodeToken, {
      secret: 'test-secret',
      payload: { userId: event.user.user_id },
    });
    sinon.assert.calledWith(api.redirect.sendUserTo, VERIFICATION_URL, {
      query: { session_token: 'signed.jwt.token' },
    });
  });
});

describe('onContinuePostChallenge', () => {
  let loader: any;
  let event: any;
  let api: any;

  beforeEach(async () => {
    const { compiledActionPath } = compileActionModules(ACTION_PATH);
    loader = await loadAction(compiledActionPath);
    [event, api] = getDefaultArguments();
    event.secrets.REDIRECT_SECRET = 'test-secret';
    sinon.spy(api.access, 'deny');
  });

  afterEach(() => {
    sinon.restore();
  });

  it('denies access when the redirect token cannot be validated', async () => {
    sinon.stub(api.redirect, 'validateToken').callsFake(() => {
      throw new Error('invalid signature');
    });

    await loader.execute('onContinuePostChallenge', event, api);

    sinon.assert.calledWith(api.redirect.validateToken, { secret: 'test-secret' });
    sinon.assert.calledWith(api.access.deny, 'Unable to verify redirect response: invalid signature');
  });

  it('denies access when the token belongs to a different user', async () => {
    sinon.stub(api.redirect, 'validateToken').returns({ userId: 'someone-else' });

    await loader.execute('onContinuePostChallenge', event, api);

    sinon.assert.calledWith(api.access.deny, 'Verification response does not match the current user.');
  });

  it('denies access when the verification was not completed', async () => {
    sinon.stub(api.redirect, 'validateToken').returns({ userId: event.user.user_id });
    event.request.query.verified = 'false';

    await loader.execute('onContinuePostChallenge', event, api);

    sinon.assert.calledWith(api.access.deny, 'Identity verification was not completed.');
  });

  it('allows the flow to continue when verification succeeded', async () => {
    sinon.stub(api.redirect, 'validateToken').returns({ userId: event.user.user_id });
    event.request.query.verified = 'true';

    await loader.execute('onContinuePostChallenge', event, api);

    sinon.assert.notCalled(api.access.deny);
  });
});

import * as fs from 'fs';
import * as os from 'os';
import * as path from 'path';
import * as ts from 'typescript';

export interface ModuleToCompile {
  name: string;
  filename: string;
}

function transpileToTemp(sourcePath: string): string {
  const source = fs.readFileSync(sourcePath, 'utf8');
  const { outputText } = ts.transpileModule(source, {
    compilerOptions: {
      module: ts.ModuleKind.CommonJS,
      target: ts.ScriptTarget.ES2020,
      esModuleInterop: true,
    },
  });

  const tempPath = path.join(
    os.tmpdir(),
    `${path.basename(sourcePath, path.extname(sourcePath))}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.js`,
  );
  fs.writeFileSync(tempPath, outputText);
  return tempPath;
}

/**
 * loadAction()（@auth0/actions/*\/test 提供）は対象ファイルをディスクから読み取り、
 * vm.compileFunction で実行するため、ts-node や Vitest 自身の TS 変換を経由しません。
 * そのため、アクションのソース（および actions: で登録されたモジュール）は、
 * あらかじめディスク上でプレーンな JS にトランスパイルしておく必要があります。
 */
export function compileActionModules(actionPath: string, modules: ModuleToCompile[] = []) {
  const compiledActionPath = transpileToTemp(actionPath);
  const compiledModules = modules.map((m) => ({
    name: m.name,
    filename: transpileToTemp(m.filename),
  }));

  return { compiledActionPath, compiledModules };
}

{
  "name": "actions-npm-example-ts-mocha",
  "version": "1.0.0",
  "description": "Auth0 Actions unit testing example using Mocha and TypeScript",
  "license": "MIT",
  "author": "Auth0",
  "scripts": {
    "test": "NODE_OPTIONS=--no-experimental-strip-types mocha"
  },
  "devDependencies": {
    "@auth0/actions": "^0.33.0",
    "@types/chai": "^4.3.16",
    "@types/mocha": "^10.0.6",
    "@types/node": "22.14.0",
    "@types/sinon": "^17.0.3",
    "chai": "^4.5.0",
    "mocha": "^11.0.0",
    "sinon": "^19.0.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.9.2"
  }
}

{
  "require": "ts-node/register",
  "extension": ["ts"],
  "spec": "src/**/*.test.ts"
}

{
  "compilerOptions": {
    "target": "ES2020",
    "module": "NodeNext",
    "moduleResolution": "nodenext",
    "esModuleInterop": true,
    "allowSyntheticDefaultImports": true,
    "strict": true,
    "outDir": "dist",
    "declaration": true,
    "sourceMap": true,
    "allowJs": true,
    "checkJs": false,
    "resolveJsonModule": true,
    "skipLibCheck": true,
    "forceConsistentCasingInFileNames": true,
    "isolatedModules": true,
    "noEmit": true,
    "paths": {
      "actions:*": [
        "./src/*"
      ]
    }
  },
  "exclude": [
    "node_modules",
    "dist"
  ],
  "include": [
    "**/*.ts"
  ],
  "ts-node": {
    "transpileOnly": true
  }
}

const assert = require('node:assert');
const { describe, it, beforeEach, afterEach, mock } = require('node:test');
const { getDefaultArguments, loadAction } = require('@auth0/actions/password-reset-post-challenge/v1/test');
const path = require('path');
const { compileActionModules } = require('./test-utils/load-compiled-action.ts');

const DIRNAME = path.dirname('../');
const ACTION_PATH = path.resolve(DIRNAME, './src/mock-redirects.ts');
const VERIFICATION_URL = 'https://verify.example.com/identity';

describe('onExecutePostChallenge', () => {
  let loader;
  let event;
  let api;

  beforeEach(async () => {
    const { compiledActionPath } = compileActionModules(ACTION_PATH);
    loader = await loadAction(compiledActionPath);
    [event, api] = getDefaultArguments();
    event.secrets.REDIRECT_SECRET = 'test-secret';
    mock.method(api.redirect, 'encodeToken', () => 'signed.jwt.token');
    mock.method(api.redirect, 'sendUserTo');
  });

  afterEach(() => {
    mock.reset();
  });

  it('does not redirect when the risk score is below the threshold', async () => {
    event.authentication.riskAssessment.supplemental.akamai.akamaiUserRisk.score = 10;

    await loader.execute('onExecutePostChallenge', event, api);

    assert.strictEqual(api.redirect.encodeToken.mock.calls.length, 0);
    assert.strictEqual(api.redirect.sendUserTo.mock.calls.length, 0);
  });

  it('redirects to the identity verification page when the risk score exceeds the threshold', async () => {
    event.authentication.riskAssessment.supplemental.akamai.akamaiUserRisk.score = 80;

    await loader.execute('onExecutePostChallenge', event, api);

    assert.deepEqual(api.redirect.encodeToken.mock.calls[0].arguments, [{
      secret: 'test-secret',
      payload: { userId: event.user.user_id },
    }]);
    assert.deepEqual(api.redirect.sendUserTo.mock.calls[0].arguments, [VERIFICATION_URL, {
      query: { session_token: 'signed.jwt.token' },
    }]);
  });
});

describe('onContinuePostChallenge', () => {
  let loader;
  let event;
  let api;

  beforeEach(async () => {
    const { compiledActionPath } = compileActionModules(ACTION_PATH);
    loader = await loadAction(compiledActionPath);
    [event, api] = getDefaultArguments();
    event.secrets.REDIRECT_SECRET = 'test-secret';
    mock.method(api.access, 'deny');
  });

  afterEach(() => {
    mock.reset();
  });

  it('denies access when the redirect token cannot be validated', async () => {
    mock.method(api.redirect, 'validateToken', () => {
      throw new Error('invalid signature');
    });

    await loader.execute('onContinuePostChallenge', event, api);

    assert.deepEqual(api.redirect.validateToken.mock.calls[0].arguments, [{ secret: 'test-secret' }]);
    assert.deepEqual(api.access.deny.mock.calls[0].arguments, ['Unable to verify redirect response: invalid signature']);
  });

  it('denies access when the token belongs to a different user', async () => {
    mock.method(api.redirect, 'validateToken', () => ({ userId: 'someone-else' }));

    await loader.execute('onContinuePostChallenge', event, api);

    assert.deepEqual(api.access.deny.mock.calls[0].arguments, ['Verification response does not match the current user.']);
  });

  it('denies access when the verification was not completed', async () => {
    mock.method(api.redirect, 'validateToken', () => ({ userId: event.user.user_id }));
    event.request.query.verified = 'false';

    await loader.execute('onContinuePostChallenge', event, api);

    assert.deepEqual(api.access.deny.mock.calls[0].arguments, ['Identity verification was not completed.']);
  });

  it('allows the flow to continue when verification succeeded', async () => {
    mock.method(api.redirect, 'validateToken', () => ({ userId: event.user.user_id }));
    event.request.query.verified = 'true';

    await loader.execute('onContinuePostChallenge', event, api);

    assert.strictEqual(api.access.deny.mock.calls.length, 0);
  });
});

const fs = require('fs');
const os = require('os');
const path = require('path');
const ts = require('typescript');

interface ModuleToCompile {
  name: string;
  filename: string;
}

function transpileToTemp(sourcePath: string): string {
  const source = fs.readFileSync(sourcePath, 'utf8');
  const { outputText } = ts.transpileModule(source, {
    compilerOptions: {
      module: ts.ModuleKind.CommonJS,
      target: ts.ScriptTarget.ES2020,
      esModuleInterop: true,
    },
  });

  const tempPath = path.join(
    os.tmpdir(),
    `${path.basename(sourcePath, path.extname(sourcePath))}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.js`,
  );
  fs.writeFileSync(tempPath, outputText);
  return tempPath;
}

/**
 * loadAction()（@auth0/actions/*\/test のもの）は対象ファイルをディスクから読み取り、
 * vm.compileFunction で実行するため、node ネイティブの TS 型除去を経由することはありません。
 * そのため、アクションのソース（および actions: で登録されたモジュール）は、
 * あらかじめディスク上でプレーンな JS にトランスパイルしておく必要があります。
 */
exports.compileActionModules = function compileActionModules(actionPath: string, modules: ModuleToCompile[] = []) {
  const compiledActionPath = transpileToTemp(actionPath);
  const compiledModules = modules.map((m: ModuleToCompile) => ({
    name: m.name,
    filename: transpileToTemp(m.filename),
  }));

  return { compiledActionPath, compiledModules };
};

{
  "name": "actions-npm-example-ts-node-test",
  "version": "1.0.0",
  "description": "Auth0 Actions unit testing example using the Node.js built-in test runner and TypeScript",
  "license": "MIT",
  "author": "Auth0",
  "scripts": {
    "test": "node --test src/*.test.ts"
  },
  "devDependencies": {
    "@auth0/actions": "^0.33.0",
    "@types/node": "22.14.0",
    "typescript": "^5.9.2"
  }
}

{
  "compilerOptions": {
    "target": "ES2020",
    "module": "NodeNext",
    "moduleResolution": "nodenext",
    "esModuleInterop": true,
    "allowSyntheticDefaultImports": true,
    "strict": true,
    "outDir": "dist",
    "declaration": true,
    "sourceMap": true,
    "allowJs": true,
    "checkJs": false,
    "resolveJsonModule": true,
    "skipLibCheck": true,
    "forceConsistentCasingInFileNames": true,
    "isolatedModules": true,
    "noEmit": true,
    "paths": {
      "actions:*": [
        "./src/*"
      ]
    }
  },
  "exclude": [
    "node_modules",
    "dist"
  ],
  "include": [
    "**/*.ts"
  ],
  "ts-node": {
    "transpileOnly": true
  }
}