perimeterx-fastly-enforcer 2.2.2

use base64::{engine::general_purpose, Engine as _};
use serde_json::{json, Value};

use crate::handlers::pxuser_identifiers::*;
use crate::modules::pxutils::decode_jwt_payload;

fn encode_jwt(payload: &Value) -> String {
    let header = general_purpose::URL_SAFE_NO_PAD.encode(br#"{"alg":"HS256","typ":"JWT"}"#);
    let body = general_purpose::URL_SAFE_NO_PAD.encode(payload.to_string().as_bytes());
    let signature = general_purpose::URL_SAFE_NO_PAD.encode(b"sig");
    format!("{header}.{body}.{signature}")
}

#[test]
fn extract_jwt_fields_nested_paths_use_full_keys() {
    let payload = json!({
        "user": { "id": "11111111" },
        "product": { "id": "22222222" },
        "session": { "id": "33333333" }
    });
    let extracted = extract_jwt_fields(
        &payload,
        "user.id",
        &["product.id".to_owned(), "session.id".to_owned()],
    );
    assert_eq!(extracted.app_user_id.as_deref(), Some("11111111"));
    let fields = extracted.jwt_additional_fields;
    assert_eq!(
        fields.get("product.id").and_then(Value::as_str),
        Some("22222222")
    );
    assert_eq!(
        fields.get("session.id").and_then(Value::as_str),
        Some("33333333")
    );
}

#[test]
fn decode_jwt_payload_parses_valid_token() {
    let token = encode_jwt(&json!({"idFromCookie": "px_user_id"}));
    let payload = decode_jwt_payload(&token);
    assert_eq!(
        payload
            .as_ref()
            .and_then(|p| p.get("idFromCookie"))
            .and_then(Value::as_str),
        Some("px_user_id")
    );
}

#[test]
fn decode_jwt_payload_rejects_invalid_token() {
    assert!(decode_jwt_payload("not-a-jwt").is_none());
}