<commit_before>var test   = require('tape');
var JWT    = require('jsonwebtoken');
var secret = 'NeverShareYourSecret';

var server = require('./basic_server'); // test server which in turn loads our module

test("Attempt to access restricted content (without auth token)", function(t) {
  var options = {
    method: "POST",
    url: "/privado"
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "No Token should fail");
    t.end();
  });
});

test("Attempt to access restricted content (with an INVALID Token)", function(t) {
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer fails.validation" }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "INVALID Token should fail");
    t.end();
  });
});

test("Malformed JWT", function(t) {
  // use the token as the 'authorization' header in requests
  // var token = jwt.sign({ "id": 1 ,"name":"<NAME>" }, 'incorrectSecret');
  // console.log(token);
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer my.invalid.token" }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    // console.log(response.result);
    // console.log(' '); // blank line
    t.equal(response.statusCode, 401, "INVALID Token should fail");
    // t.equal(JSON.parse(response.result).msg, 'Invalid Token', "INVALID Token should fail");
    t.end();
  });
});

test("Try using a token with missing characters in body", function(t) {
  // use the token as the 'authorization' header in requests
  var token = JWT.sign({ id: 123, "name": "Charlie" }, secret);
  // delete some characters in body
  var tokenData = token.split('.');
  var header = tokenData[0],
      body = tokenData[1],
      signature = tokenData[2];
  token = header + '.' + body.substring(0, body.length - 1) + '.' + signature;
  /*console.log(" - - - - - - token  - - - - -");
  console.log(token);*/
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer " + token  }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "INVALID Token should fail");
    t.end();
  });
});

test("Try using an incorrect secret to sign the JWT", function(t) {
  // use the token as the 'authorization' header in requests
  var token = JWT.sign({ id: 123, "name": "Charlie" }, 'incorrectSecret');
  // console.log(" - - - - - - token  - - - - -")
  // console.log(token);
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer " + token  }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "Token signed with incorrect key fails");
    t.end();
  });
});

// see: https://github.com/dwyl/hapi-auth-jwt2/issues/166
// test.only("Try using an expired token", function(t) {
//   // use the token as the 'authorization' header in requests
//   var token = JWT.sign({ id: 123, "name": "Charlie" }, secret, { expiresInSeconds: 1 });
//   console.log(" - - - - - - token  - - - - -")
//   console.log(token);
//   var options = {
//     method: "POST",
//     url: "/privado",
//     headers: { authorization: "Bearer " + token  }
//   };
//   // server.inject lets us simulate an http request
//   setTimeout(function () {
//     server.inject(options, function(response) {
//       t.equal(response.statusCode, 401, "Expired token should be invalid");
//       t.equal(response.result.message, 'Token expired', 'Message should be "Token expired"');
//       t.end();
//     });
//   }, 1000);
// });

test("Token is well formed but is allowed=false so should be denied", function(t) {
  // use the token as the 'authorization' header in requests
  // var token = jwt.sign({ "id": 1 ,"name":"<NAME>" }, 'incorrectSecret');
  var token = JWT.sign({ id: 321, "name": "<NAME>" }, secret);
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer " + token }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "Denied");
    t.end();
  });
});

test("Access restricted content (with VALID Token)", function(t) {
  // use the token as the 'authorization' header in requests
  var token = JWT.sign({ id: 123, "name": "Charlie" }, secret);
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer " + token }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {<commit_msg>Added/fixed test removed in #166<commit_after>var test   = require('tape');
var JWT    = require('jsonwebtoken');
var secret = 'NeverShareYourSecret';

var server = require('./basic_server'); // test server which in turn loads our module

test("Attempt to access restricted content (without auth token)", function(t) {
  var options = {
    method: "POST",
    url: "/privado"
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "No Token should fail");
    t.end();
  });
});

test("Attempt to access restricted content (with an INVALID Token)", function(t) {
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer fails.validation" }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "INVALID Token should fail");
    t.end();
  });
});

test("Malformed JWT", function(t) {
  // use the token as the 'authorization' header in requests
  // var token = jwt.sign({ "id": 1 ,"name":"<NAME>" }, 'incorrectSecret');
  // console.log(token);
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer my.invalid.token" }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    // console.log(response.result);
    // console.log(' '); // blank line
    t.equal(response.statusCode, 401, "INVALID Token should fail");
    // t.equal(JSON.parse(response.result).msg, 'Invalid Token', "INVALID Token should fail");
    t.end();
  });
});

test("Try using a token with missing characters in body", function(t) {
  // use the token as the 'authorization' header in requests
  var token = JWT.sign({ id: 123, "name": "Charlie" }, secret);
  // delete some characters in body
  var tokenData = token.split('.');
  var header = tokenData[0],
      body = tokenData[1],
      signature = tokenData[2];
  token = header + '.' + body.substring(0, body.length - 1) + '.' + signature;
  /*console.log(" - - - - - - token  - - - - -");
  console.log(token);*/
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer " + token  }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "INVALID Token should fail");
    t.end();
  });
});

test("Try using an incorrect secret to sign the JWT", function(t) {
  // use the token as the 'authorization' header in requests
  var token = JWT.sign({ id: 123, "name": "Charlie" }, 'incorrectSecret');
  // console.log(" - - - - - - token  - - - - -")
  // console.log(token);
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer " + token  }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "Token signed with incorrect key fails");
    t.end();
  });
});

test("Try using an expired token", function(t) {
  // use the token as the 'authorization' header in requests
  var token = JWT.sign({ id: 123, "name": "Charlie" }, secret, { expiresIn: '1s' });
  console.log(" - - - - - - token  - - - - -")
  console.log(token);
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer " + token  }
  };
  // server.inject lets us simulate an http request
  setTimeout(function () {
    server.inject(options, function(response) {
      t.equal(response.statusCode, 401, "Expired token should be invalid");
      t.end();
    });
  }, 1100);
});

test("Token is well formed but is allowed=false so should be denied", function(t) {
  // use the token as the 'authorization' header in requests
  // var token = jwt.sign({ "id": 1 ,"name":"<NAME>" }, 'incorrectSecret');
  var token = JWT.sign({ id: 321, "name": "<NAME>" }, secret);
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer " + token }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
    t.equal(response.statusCode, 401, "Denied");
    t.end();
  });
});

test("Access restricted content (with VALID Token)", function(t) {
  // use the token as the 'authorization' header in requests
  var token = JWT.sign({ id: 123, "name": "Charlie" }, secret);
  var options = {
    method: "POST",
    url: "/privado",
    headers: { authorization: "Bearer " + token }
  };
  // server.inject lets us simulate an http request
  server.inject(options, function(response) {
{'fraction_non_alphanumeric': 0.1674565560821485, 'fraction_numerical': 0.010847814639283833, 'mean_word_length': 3.130491518051327, 'pattern_counts': {'":': 18, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3697896', 'n_tokens_mistral': 3092, 'n_tokens_neox': 2930, 'n_words': 890}