n8n/packages/cli/test/integration/dynamic-credentials.ee/credential-resolvers.api.test.ts

import { LicenseState } from '@n8n/backend-common';
import { mockInstance } from '@n8n/backend-test-utils';
import type { User } from '@n8n/db';
import { GLOBAL_OWNER_ROLE, GLOBAL_MEMBER_ROLE } from '@n8n/db';
import { Container } from '@n8n/di';
import { mock } from 'jest-mock-extended';
import nock from 'nock';

import { DynamicCredentialResolverRepository } from '@/modules/dynamic-credentials.ee/database/repositories/credential-resolver.repository';
import { DynamicCredentialResolverService } from '@/modules/dynamic-credentials.ee/services/credential-resolver.service';
import { Telemetry } from '@/telemetry';

import { createUser } from '../shared/db/users';
import type { SuperAgentTest } from '../shared/types';
import * as utils from '../shared/utils/';

mockInstance(Telemetry);

const licenseMock = mock<LicenseState>();
licenseMock.isLicensed.mockReturnValue(true);
Container.set(LicenseState, licenseMock);

process.env.N8N_ENV_FEAT_DYNAMIC_CREDENTIALS = 'true';

const testServer = utils.setupTestServer({
	endpointGroups: ['credentials'],
	enabledFeatures: ['feat:externalSecrets'],
	modules: ['dynamic-credentials'],
});

describe('Credential Resolvers API', () => {
	let owner: User;
	let member: User;
	let ownerAgent: SuperAgentTest;
	let memberAgent: SuperAgentTest;
	let service: DynamicCredentialResolverService;
	let repository: DynamicCredentialResolverRepository;

	beforeAll(async () => {
		owner = await createUser({ role: GLOBAL_OWNER_ROLE });
		member = await createUser({ role: GLOBAL_MEMBER_ROLE });

		ownerAgent = testServer.authAgentFor(owner);
		memberAgent = testServer.authAgentFor(member);

		service = Container.get(DynamicCredentialResolverService);
		repository = Container.get(DynamicCredentialResolverRepository);
	});

	beforeEach(async () => {
		await repository.delete({});
		nock.cleanAll();
		// Mock OAuth metadata endpoint for resolver validation
		nock('https://auth.example.com')
			.persist()
			.get('/.well-known/openid-configuration')
			.reply(200, {
				issuer: 'https://auth.example.com',
				introspection_endpoint: 'https://auth.example.com/oauth/introspect',
				introspection_endpoint_auth_methods_supported: [
					'client_secret_basic',
					'client_secret_post',
				],
			});
	});

	afterEach(() => {
		nock.cleanAll();
	});

	describe('GET /credential-resolvers', () => {
		it('should return empty list when no resolvers exist', async () => {
			const response = await ownerAgent.get('/credential-resolvers').expect(200);
			expect(response.body.data).toEqual([]);
		});

		it('should list all resolvers', async () => {
			// Create resolvers using service
			await service.create({
				name: 'Resolver 1',
				type: 'credential-resolver.oauth2-1.0',
				config: {
					metadataUri: 'https://auth.example.com/.well-known/openid-configuration',
					clientId: 'test-client-id-1',
					clientSecret: 'test-client-secret-1',
					validation: 'oauth2-introspection',
				},
				user: owner,
			});
			await service.create({
				name: 'Resolver 2',
				type: 'credential-resolver.oauth2-1.0',
				config: {
					metadataUri: 'https://auth.example.com/.well-known/openid-configuration',
					clientId: 'test-client-id-2',
					clientSecret: 'test-client-secret-2',
					validation: 'oauth2-introspection',
				},
				user: owner,
			});

			const response = await ownerAgent.get('/credential-resolvers').expect(200);

			expect(response.body.data).toHaveLength(2);
			expect(response.body.data[0]).toMatchObject({
				id: expect.any(String),
				name: 'Resolver 1',
				type: 'credential-resolver.oauth2-1.0',
			});
		});

		it('should reject access for members', async () => {
			await memberAgent.get('/credential-resolvers').expect(403);
		});
	});

	describe('GET /credential-resolvers/types', () => {
		it('should return available resolver types', async () => {
			const response = await ownerAgent.get('/credential-resolvers/types').expect(200);

			expect(response.body.data).toBeInstanceOf(Array);
			expect(response.body.data.length).toBeGreaterThan(0);

			// Verify resolver types have required fields
			const resolverType = response.body.data[0];
			expect(resolverType).toMatchObject({
				name: expect.any(String),
				displayName: expect.any(String),
				description: expect.any(String),
				options: expect.any(Array),
			});
		});

		it('should reject access for members', async () => {
			await memberAgent.get('/credential-resolvers/types').expect(403);
		});
	});

	describe('POST /credential-resolvers', () => {
		it('should create a resolver', async () => {
			const payload = {
				name: 'Test Resolver',
				type: 'credential-resolver.oauth2-1.0',
				config: {
					metadataUri: 'https://auth.example.com/.well-known/openid-configuration',
					clientId: 'test-client-id',
					clientSecret: 'test-client-secret',
					validation: 'oauth2-introspection',
				},
			};

			const response = await ownerAgent.post('/credential-resolvers').send(payload).expect(200);

			expect(response.body.data).toMatchObject({
				id: expect.any(String),
				name: 'Test Resolver',
				type: 'credential-resolver.oauth2-1.0',
			});
			expect(response.body.data.decryptedConfig).toMatchObject({
				metadataUri: 'https://auth.example.com/.well-known/openid-configuration',
				clientId: 'test-client-id',
				clientSecret: 'test-client-secret',
				validation: 'oauth2-introspection',
			});

			// Verify it was actually created
			const resolvers = await repository.find();
			expect(resolvers).toHaveLength(1);
		});

		it('should reject unknown resolver type', async () => {
			const payload = {
				name: 'Test Resolver',
				type: 'unknown-type',
				config: {},
			};

			const response = await ownerAgent.post('/credential-resolvers').send(payload).expect(400);
			expect(response.body.message).toContain('Unknown resolver type');
		});

		it('should reject access for members', async () => {
			const payload = {
				name: 'Test Resolver',
				type: 'credential-resolver.oauth2-1.0',
				config: {
					metadataUri: 'https://auth.example.com/.well-known/openid-configuration',
					clientId: 'test-client-id',
					clientSecret: 'test-client-secret',
					validation: 'oauth2-introspection',
				},
			};

			await memberAgent.post('/credential-resolvers').send(payload).expect(403);
		});
	});

	describe('GET /resolvers/:id', () => {
		it('should return a specific resolver', async () => {
			const resolver = await service.create({
				name: 'Test Resolver',
				type: 'credential-resolver.oauth2-1.0',
				config: {
					metadataUri: 'https://auth.example.com/.well-known/openid-configuration',
					clientId: 'test-client-id',
					clientSecret: 'test-client-secret',
					validation: 'oauth2-introspection',
				},
				user: owner,
			});

			const response = await ownerAgent.get(`/credential-resolvers/${resolver.id}`).expect(200);

			expect(response.body.data).toMatchObject({
				id: resolver.id,
				name: 'Test Resolver',
				type: 'credential-resolver.oauth2-1.0',
			});
		});

		it('should return 404 for non-existent resolver', async () => {
			await ownerAgent.get('/credential-resolvers/non-existent-id').expect(404);
		});
	});

	describe('PATCH /resolvers/:id', () => {
		it('should update resolver name', async () => {
			const resolver = await service.create({
				name: 'Original Name',
				type: 'credential-resolver.oauth2-1.0',
				config: {
					metadataUri: 'https://auth.example.com/.well-known/openid-configuration',
					clientId: 'test-client-id',
					clientSecret: 'test-client-secret',
					validation: 'oauth2-introspection',
				},
				user: owner,
			});

			const response = await ownerAgent
				.patch(`/credential-resolvers/${resolver.id}`)
				.send({ name: 'Updated Name' })
				.expect(200);

			expect(response.body.data.name).toBe('Updated Name');
		});

		it('should return 404 for non-existent resolver', async () => {
			await ownerAgent
				.patch('/credential-resolvers/non-existent-id')
				.send({ name: 'New Name' })
				.expect(404);
		});
	});

	describe('DELETE /resolvers/:id', () => {
		it('should delete a resolver', async () => {
			const resolver = await service.create({
				name: 'Test Resolver',
				type: 'credential-resolver.oauth2-1.0',
				config: {
					metadataUri: 'https://auth.example.com/.well-known/openid-configuration',
					clientId: 'test-client-id',
					clientSecret: 'test-client-secret',
					validation: 'oauth2-introspection',
				},
				user: owner,
			});

			const response = await ownerAgent.delete(`/credential-resolvers/${resolver.id}`).expect(200);
			expect(response.body.data).toEqual({ success: true });

			// Verify it was actually deleted
			const remaining = await repository.find();
			expect(remaining).toHaveLength(0);
		});

		it('should return 404 for non-existent resolver', async () => {
			await ownerAgent.delete('/credential-resolvers/non-existent-id').expect(404);
		});
	});
});