foxhunt/services/api_gateway/tests/auth_flow_tests.rs

//! Authentication Flow Integration Tests
//!
//! Comprehensive tests for the 8-layer authentication pipeline:
//! 1. mTLS client certificate validation
//! 2. JWT extraction from Authorization header
//! 3. JWT revocation check (Redis)
//! 4. JWT signature and expiration validation
//! 5. RBAC permission check
//! 6. Rate limiting
//! 7. User context injection
//! 8. Async audit logging

#[path = "common/mod.rs"]
mod common;

use anyhow::Result;
use common::{cleanup_redis, generate_expired_token, generate_invalid_signature_token, generate_test_token, wait_for_redis, TestJwtConfig};
use std::time::{Duration, Instant};
use tonic::{metadata::MetadataValue, Request};

use api_gateway::auth::{
    AuditLogger, AuthInterceptor, AuthzService, Jti, JwtService, RateLimiter, RevocationService,
};

const REDIS_URL: &str = "redis://localhost:6379";

/// Setup test authentication components
async fn setup_auth_components() -> Result<AuthInterceptor> {
    wait_for_redis(REDIS_URL, 50).await?;
    cleanup_redis(REDIS_URL).await?;

    let config = TestJwtConfig::default();
    
    let jwt_service = JwtService::new(
        config.secret,
        config.issuer,
        config.audience,
    );
    
    let revocation_service = RevocationService::new(REDIS_URL).await?;
    let authz_service = AuthzService::new();
    let rate_limiter = RateLimiter::new(100).map_err(|e| anyhow::anyhow!(e))?; // 100 req/s
    let audit_logger = AuditLogger::new(true);

    Ok(AuthInterceptor::new(
        jwt_service,
        revocation_service,
        authz_service,
        rate_limiter,
        audit_logger,
    ))
}

#[tokio::test]
async fn test_successful_authentication() -> Result<()> {
    println!("\n=== Test: Successful Authentication ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    // Generate valid token
    let (token, _jti) = generate_test_token(
        "user123",
        vec!["trader".to_string()],
        vec!["api.access".to_string(), "trading.submit".to_string()],
        3600,
    )?;
    
    // Create request with Authorization header
    let mut request = Request::new(());
    request.metadata_mut().insert(
        "authorization",
        MetadataValue::try_from(format!("Bearer {}", token))?,
    );
    
    // Measure authentication time
    let start = Instant::now();
    let result = auth_interceptor.clone().authenticate(request).await;
    let elapsed = start.elapsed();
    
    println!("✓ Authentication succeeded in {:?}", elapsed);
    println!("  Performance target: <10μs, Actual: {:?}", elapsed);
    
    assert!(result.is_ok(), "Authentication should succeed");
    
    // Verify user context was injected
    let authenticated_request = result.unwrap();
    let extensions = authenticated_request.extensions();
    
    assert!(
        extensions.get::<api_gateway::auth::UserContext>().is_some(),
        "User context should be injected"
    );
    
    if let Some(user_ctx) = extensions.get::<api_gateway::auth::UserContext>() {
        assert_eq!(user_ctx.user_id, "user123");
        assert!(user_ctx.roles.contains(&"trader".to_string()));
        assert!(user_ctx.permissions.contains(&"api.access".to_string()));
        println!("✓ User context verified: user_id={}", user_ctx.user_id);
    }
    
    // Warn if latency exceeds target
    if elapsed > Duration::from_micros(10) {
        println!("⚠ WARNING: Authentication latency {:?} exceeds 10μs target", elapsed);
    }
    
    Ok(())
}

#[tokio::test]
async fn test_missing_jwt_rejected() -> Result<()> {
    println!("\n=== Test: Missing JWT Rejected ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    // Create request without Authorization header
    let request = Request::new(());
    
    let result = auth_interceptor.clone().authenticate(request).await;
    
    assert!(result.is_err(), "Request without JWT should be rejected");
    
    if let Err(status) = result {
        assert_eq!(status.code(), tonic::Code::Unauthenticated);
        println!("✓ Request rejected with status: {}", status.code());
        println!("  Message: {}", status.message());
    }
    
    Ok(())
}

#[tokio::test]
async fn test_revoked_jwt_rejected() -> Result<()> {
    println!("\n=== Test: Revoked JWT Rejected ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    // Generate valid token
    let (token, jti) = generate_test_token(
        "user456",
        vec!["trader".to_string()],
        vec!["api.access".to_string()],
        3600,
    )?;
    
    // Add token to blacklist
    let revocation_service = RevocationService::new(REDIS_URL).await?;
    revocation_service
        .revoke_token(&Jti::from_string(jti), 3600)
        .await?;
    
    println!("✓ Token added to blacklist");
    
    // Create request with revoked token
    let mut request = Request::new(());
    request.metadata_mut().insert(
        "authorization",
        MetadataValue::try_from(format!("Bearer {}", token))?,
    );
    
    let result = auth_interceptor.clone().authenticate(request).await;
    
    assert!(result.is_err(), "Revoked token should be rejected");
    
    if let Err(status) = result {
        assert_eq!(status.code(), tonic::Code::Unauthenticated);
        println!("✓ Revoked token rejected with status: {}", status.code());
        assert!(status.message().contains("revoked"), "Error message should mention revocation");
    }
    
    Ok(())
}

#[tokio::test]
async fn test_expired_jwt_rejected() -> Result<()> {
    println!("\n=== Test: Expired JWT Rejected ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    // Generate expired token
    let token = generate_expired_token("user789")?;
    
    // Create request with expired token
    let mut request = Request::new(());
    request.metadata_mut().insert(
        "authorization",
        MetadataValue::try_from(format!("Bearer {}", token))?,
    );
    
    let result = auth_interceptor.clone().authenticate(request).await;
    
    assert!(result.is_err(), "Expired token should be rejected");
    
    if let Err(status) = result {
        assert_eq!(status.code(), tonic::Code::Unauthenticated);
        println!("✓ Expired token rejected with status: {}", status.code());
    }
    
    Ok(())
}

#[tokio::test]
async fn test_invalid_signature_rejected() -> Result<()> {
    println!("\n=== Test: Invalid Signature Rejected ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    // Generate token with wrong signature
    let token = generate_invalid_signature_token("attacker")?;
    
    // Create request with invalid token
    let mut request = Request::new(());
    request.metadata_mut().insert(
        "authorization",
        MetadataValue::try_from(format!("Bearer {}", token))?,
    );
    
    let result = auth_interceptor.clone().authenticate(request).await;
    
    assert!(result.is_err(), "Token with invalid signature should be rejected");
    
    if let Err(status) = result {
        assert_eq!(status.code(), tonic::Code::Unauthenticated);
        println!("✓ Invalid signature rejected with status: {}", status.code());
    }
    
    Ok(())
}

#[tokio::test]
async fn test_rbac_permission_denied() -> Result<()> {
    println!("\n=== Test: RBAC Permission Denied ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    // Generate token without api.access permission
    let (token, _jti) = generate_test_token(
        "restricted_user",
        vec!["guest".to_string()],
        vec!["limited.access".to_string()], // Missing api.access
        3600,
    )?;
    
    // Create request with limited permissions
    let mut request = Request::new(());
    request.metadata_mut().insert(
        "authorization",
        MetadataValue::try_from(format!("Bearer {}", token))?,
    );
    
    let result = auth_interceptor.clone().authenticate(request).await;
    
    assert!(result.is_err(), "Request without api.access should be denied");
    
    if let Err(status) = result {
        assert_eq!(status.code(), tonic::Code::PermissionDenied);
        println!("✓ Permission denied with status: {}", status.code());
        println!("  Message: {}", status.message());
    }
    
    Ok(())
}

#[tokio::test]
async fn test_rate_limit_exceeded() -> Result<()> {
    println!("\n=== Test: Rate Limit Exceeded ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    // Generate valid token
    let (token, _jti) = generate_test_token(
        "rate_limited_user",
        vec!["trader".to_string()],
        vec!["api.access".to_string()],
        3600,
    )?;
    
    let mut success_count = 0;
    let mut rate_limited_count = 0;
    
    // Make 110 rapid requests (limit is 100/s)
    for i in 1..=110 {
        let mut request = Request::new(());
        request.metadata_mut().insert(
            "authorization",
            MetadataValue::try_from(format!("Bearer {}", token))?,
        );
        
        let result = auth_interceptor.clone().authenticate(request).await;
        
        if result.is_ok() {
            success_count += 1;
        } else if let Err(status) = result {
            if status.code() == tonic::Code::ResourceExhausted {
                rate_limited_count += 1;
                if rate_limited_count == 1 {
                    println!("✓ First rate limit hit at request #{}", i);
                }
            }
        }
    }
    
    println!("  Successful requests: {}", success_count);
    println!("  Rate limited requests: {}", rate_limited_count);

    assert!(rate_limited_count > 0, "Some requests should be rate limited");
    // Allow small tolerance (3-5 extra) due to token bucket timing granularity
    assert!(success_count <= 105, "Success count should not significantly exceed limit (got {}, limit 100, tolerance 105)", success_count);
    
    Ok(())
}

#[tokio::test]
async fn test_8_layer_auth_performance() -> Result<()> {
    println!("\n=== Test: 8-Layer Authentication Performance ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    // Generate valid token
    let (token, _jti) = generate_test_token(
        "perf_user",
        vec!["trader".to_string()],
        vec!["api.access".to_string()],
        3600,
    )?;
    
    let mut latencies = Vec::new();
    
    // Perform 100 authentication requests
    println!("  Running 100 authentication requests...");
    for _ in 0..100 {
        let mut request = Request::new(());
        request.metadata_mut().insert(
            "authorization",
            MetadataValue::try_from(format!("Bearer {}", token))?,
        );
        
        let start = Instant::now();
        let result = auth_interceptor.clone().authenticate(request).await;
        let elapsed = start.elapsed();
        
        assert!(result.is_ok(), "Authentication should succeed");
        latencies.push(elapsed);
    }
    
    // Calculate percentiles
    latencies.sort();
    let p50 = latencies[49];
    let p95 = latencies[94];
    let p99 = latencies[98];
    let p999 = latencies[99];
    
    println!("\n  Performance Metrics:");
    println!("  ├─ P50:   {:?}", p50);
    println!("  ├─ P95:   {:?}", p95);
    println!("  ├─ P99:   {:?}", p99);
    println!("  └─ P99.9: {:?}", p999);
    
    println!("\n  Target: <10μs per request");
    
    // Performance assertions (may fail in CI/CD, so we just warn)
    if p99 > Duration::from_micros(10) {
        println!("  ⚠ WARNING: P99 latency {:?} exceeds 10μs target", p99);
    } else {
        println!("  ✓ P99 latency within 10μs target");
    }
    
    Ok(())
}

#[tokio::test]
async fn test_concurrent_authentication() -> Result<()> {
    println!("\n=== Test: Concurrent Authentication ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    // Generate tokens for 10 different users
    let mut tokens = Vec::new();
    for i in 1..=10 {
        let (token, _jti) = generate_test_token(
            &format!("concurrent_user_{}", i),
            vec!["trader".to_string()],
            vec!["api.access".to_string()],
            3600,
        )?;
        tokens.push(token);
    }
    
    // Spawn 100 concurrent authentication requests
    let mut handles = Vec::new();
    
    println!("  Spawning 100 concurrent authentication requests...");
    for i in 0..100 {
        let token = tokens[i % 10].clone();
        let auth = auth_interceptor.clone();
        
        let handle = tokio::spawn(async move {
            let mut request = Request::new(());
            request.metadata_mut().insert(
                "authorization",
                MetadataValue::try_from(format!("Bearer {}", token)).unwrap(),
            );
            
            auth.authenticate(request).await
        });
        
        handles.push(handle);
    }
    
    // Wait for all requests to complete
    let mut success_count = 0;
    for handle in handles {
        if let Ok(result) = handle.await {
            if result.is_ok() {
                success_count += 1;
            }
        }
    }
    
    println!("  ✓ {}/100 concurrent authentications succeeded", success_count);
    assert_eq!(success_count, 100, "All concurrent requests should succeed");
    
    Ok(())
}

#[tokio::test]
async fn test_user_context_injection() -> Result<()> {
    println!("\n=== Test: User Context Injection (Layer 7) ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    let (token, _jti) = generate_test_token(
        "context_user",
        vec!["admin".to_string(), "trader".to_string()],
        vec!["api.access".to_string(), "admin.manage".to_string()],
        3600,
    )?;
    
    let mut request = Request::new(());
    request.metadata_mut().insert(
        "authorization",
        MetadataValue::try_from(format!("Bearer {}", token))?,
    );
    
    let result = auth_interceptor.clone().authenticate(request).await?;
    
    // Verify user context
    let user_ctx = result.extensions().get::<api_gateway::auth::UserContext>()
        .expect("UserContext should be present");
    
    println!("  ✓ User context injected:");
    println!("    ├─ User ID: {}", user_ctx.user_id);
    println!("    ├─ Roles: {:?}", user_ctx.roles);
    println!("    ├─ Permissions: {:?}", user_ctx.permissions);
    println!("    └─ Session ID: {}", user_ctx.session_id);
    
    assert_eq!(user_ctx.user_id, "context_user");
    assert_eq!(user_ctx.roles.len(), 2);
    assert_eq!(user_ctx.permissions.len(), 2);
    assert!(user_ctx.roles.contains(&"admin".to_string()));
    assert!(user_ctx.permissions.contains(&"admin.manage".to_string()));
    
    Ok(())
}

#[tokio::test]
async fn test_malformed_authorization_header() -> Result<()> {
    println!("\n=== Test: Malformed Authorization Header ===");
    
    let auth_interceptor = setup_auth_components().await?;
    
    let test_cases = vec![
        ("Basic dXNlcjpwYXNzd29yZA==", "Basic auth instead of Bearer"),
        ("Bearer", "Bearer without token"),
        ("Bearer ", "Bearer with empty token"),
        ("", "Empty header"),
        ("InvalidFormat token123", "Invalid format"),
    ];
    
    for (header_value, description) in test_cases {
        let mut request = Request::new(());
        if !header_value.is_empty() {
            request.metadata_mut().insert(
                "authorization",
                MetadataValue::try_from(header_value)?,
            );
        }
        
        let result = auth_interceptor.clone().authenticate(request).await;
        assert!(result.is_err(), "{} should be rejected", description);
        println!("  ✓ Rejected: {}", description);
    }
    
    Ok(())
}