asconnect-service/Tests/ASConnectService/Cases/Public/Middlewares/BearerAuthMiddlewareTests.swift

// ===----------------------------------------------------------------------===
//
// This source file is part of the ASConnectService open source project
//
// Copyright (c) 2026 Röck+Cöde VoF. and the ASConnectService project authors
// Licensed under Apache license v2.0
//
// See LICENSE for license information
// See CONTRIBUTORS for the list of ASConnectService project authors
//
// SPDX-License-Identifier: Apache-2.0
//
// ===----------------------------------------------------------------------===

import Foundation
import HTTPTypes
import OpenAPIRuntime
import Testing

// A non-testable import ensures that the middleware can be created from outside the module.
import ASConnectService

@Suite("BearerAuthMiddleware")
struct BearerAuthMiddlewareTests {
    // MARK: Tests

    @Test("Adds the Authorization header with the Bearer token to the request")
    func addsAuthorizationHeader() async throws {
        let middleware = BearerAuthMiddleware(token: .Token.jwt)

        let (response, _) = try await middleware.intercept(
            .get,
            body: nil,
            baseURL: .base,
            operationID: "listApps",
            next: { interceptedRequest, body, baseURL in
                #expect(interceptedRequest.headerFields[.authorization] == "Bearer test-jwt-token")
                return (HTTPResponse(status: .ok), nil)
            }
        )

        #expect(response.status == .ok)
    }

    @Test("Forwards the request body to the next handler")
    func forwardsRequestBody() async throws {
        let middleware = BearerAuthMiddleware(token: .Token.jwt)
        let requestBody: HTTPBody = HTTPBody("request-body")

        // The next handler echoes the body back, so the test can read it.
        let (_, receivedBody) = try await middleware.intercept(
            .get,
            body: requestBody,
            baseURL: .base,
            operationID: "createApp",
            next: { _, body, _ in
                (HTTPResponse(status: .created), body)
            }
        )

        let bodyData = try await Data(collecting: try #require(receivedBody), upTo: .max)

        #expect(bodyData == Data("request-body".utf8))
    }

    @Test("Forwards the base URL to the next handler")
    func forwardsBaseURL() async throws {
        let middleware = BearerAuthMiddleware(token: .Token.jwt)
        let expectedBaseURL = URL.base

        _ = try await middleware.intercept(
            .get,
            body: nil,
            baseURL: expectedBaseURL,
            operationID: "listApps",
            next: { _, _, baseURL in
                #expect(baseURL == expectedBaseURL)

                return (HTTPResponse(status: .ok), nil)
            }
        )
    }

    @Test("Returns the response from the next handler")
    func returnsNextHandlerResponse() async throws {
        let middleware = BearerAuthMiddleware(token: .Token.jwt)
        let expectedBody: HTTPBody = HTTPBody("response-body")

        let (response, body) = try await middleware.intercept(
            .get,
            body: nil,
            baseURL: .base,
            operationID: "listApps",
            next: { _, _, _ in
                (HTTPResponse(status: .notFound), expectedBody)
            }
        )

        #expect(response.status == .notFound)

        let bodyData = try await Data(collecting: try #require(body), upTo: .max)

        #expect(bodyData == Data("response-body".utf8))
    }

    @Test("Preserves existing request headers")
    func preservesExistingHeaders() async throws {
        let middleware = BearerAuthMiddleware(token: .Token.jwt)

        var request = HTTPRequest.get

        request.headerFields[.contentType] = "application/json"

        _ = try await middleware.intercept(
            request,
            body: nil,
            baseURL: .base,
            operationID: "listApps",
            next: { interceptedRequest, _, _ in
                #expect(interceptedRequest.headerFields[.contentType] == "application/json")
                #expect(interceptedRequest.headerFields[.authorization] == "Bearer \(String.Token.jwt)")

                return (HTTPResponse(status: .ok), nil)
            }
        )
    }

    @Test("Asks the token provider for a token on every request")
    func asksTokenProviderOnEveryRequest() async throws {
        let tokens = TokenSequence()
        let middleware = BearerAuthMiddleware {
            await tokens.next()
        }

        for expectedToken in ["token-1", "token-2"] {
            _ = try await middleware.intercept(
                .get,
                body: nil,
                baseURL: .base,
                operationID: "listApps",
                next: { interceptedRequest, _, _ in
                    #expect(interceptedRequest.headerFields[.authorization] == "Bearer \(expectedToken)")

                    return (HTTPResponse(status: .ok), nil)
                }
            )
        }
    }

    @Test("Rethrows the token provider error without calling the next handler")
    func rethrowsTokenProviderError() async throws {
        let middleware = BearerAuthMiddleware {
            throw TokenError.expired
        }

        await #expect(throws: TokenError.expired) {
            _ = try await middleware.intercept(
                .get,
                body: nil,
                baseURL: .base,
                operationID: "listApps",
                next: { _, _, _ in
                    Issue.record("The next handler should not be called when the token provider throws")

                    return (HTTPResponse(status: .ok), nil)
                }
            )
        }
    }
}

// MARK: - Helpers

/// An actor that returns a new token every time it is asked for one.
private actor TokenSequence {
    private var count = 0

    func next() -> String {
        count += 1

        return "token-\(count)"
    }
}

/// An error thrown by a token provider.
private enum TokenError: Error {
    case expired
}

// MARK: - HTTPRequest+Samples

private extension HTTPRequest {
    static let get = HTTPRequest(
        method: .get,
        scheme: "https",
        authority: "api.appstoreconnect.apple.com",
        path: "/v1/apps"
    )
}

// MARK: - String+Samples

private extension String {
    enum Token {
        static let jwt: String = "test-jwt-token"
    }
}

// MARK: - URL+Samples

private extension URL {
    static let base = URL(string: "https://api.appstoreconnect.apple.com")!
}