bcgov / digital-trust-common-service / 31602982875

87%

push

github

feat(auth): AU-03 JWT validation guard (#36) (#163)

* feat(auth): implement AU-03 JWT validation guard (#36)

Add JwtGuard that validates app-issued Bearer tokens against cached /oidc/jwks,
normalizes claims onto the request context, and returns RFC-compliant 401 responses.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(auth): polish AU-03 docs, swagger, and test coverage

Update admin auth comments, document JWT env vars, add Swagger bearer
decorators, expand unit tests to 100% line coverage on new auth code, and
fix expired-token error mapping for jose ERR_JWT_EXPIRED.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(admin): override JwtGuard in controller unit test

The admin controller spec exercises service delegation only; stub guards
avoid pulling AuthModule/JwtValidationService into the isolated test module.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(swagger): avoid auth module import in swagger service spec

Move APP_JWT_BEARER_SCHEME to a dependency-free constants module and extend
the swagger Jest mock with ApiProperty/addBearerAuth so entity decorators load.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(auth): address AU-03 Copilot review findings

Harden WWW-Authenticate quoting, avoid redundant JWKS refreshes on
missing kids, add JWKS fetch timeouts, and make JWT audience configurable.

Co-authored-by: Cursor <cursoragent@cursor.com>

* refactor(auth): address AU-03 naming and readability nits

Rename ApiAppJwtAuth to ApiJwtAuth, share Swagger bearer-auth setup via
helpers, and split OIDC test token verification into smaller helpers.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(auth): resolve AU-03 prettier and unbound-method lint errors

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

1369 of 1724 branches covered (79.41%)

Branch coverage included in aggregate %.

194 of 194 new or added lines in 11 files covered. (100.0%)

2569 of 2765 relevant lines covered (92.91%)

9.15 hits per line