feat: extend composite auth

[yakovenkodenis]

This PR addresses Issue #216: Extending composite authentication to allow nesting auth arrays with both and and or relations.

If the relation (defaultRelation) parameter is and, then the relation inside sub-arrays will be or.
If the relation (defaultRelation) parameter is or, then the relation inside sub-arrays will be and.

auth code	resulting logical expression
fastify.auth([f1, f2, [f3, f4]], { relation: 'or' })	f1 OR f2 OR (f3 AND f4)
fastify.auth([f1, f2, [f3, f4]], { relation: 'and' })	f1 AND f2 AND (f3 OR f4)

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[mcollina]

lgtm

[isnifer]

So, this PR breaks my preHandler:

// I expect [[f1 AND f2 AND Fn] OR [F3 AND F4 AND Fn]], { relation: 'or' }
fastify.auth(
  [
    [fastify.checkAuth('admins'), ...someOtherAdminChecks],
    [fastify.checkAuth('clients'), ...someOtherClientChecks],
  ],
  { relation: 'or' }
)

It runs both paths even first path is passing. I'll try to find the issue in the changes.

[isnifer]

I updated 11 to 110 and now verifyBigAsync is passing BUT verifyOddAsync still called and doesn't wait until verifyBigAsync finished

[isnifer]

@mcollina my thoughts on this — due to broken default behavior it should be 5.0.0, not 4.5.0

[yakovenkodenis]

@isnifer Could you provide a test case for this?

I've just tried the following case locally:

• a route:

fastify.route({
  method: 'POST',
  url: '/check-two-sub-arrays-or-2',
  preHandler: fastify.auth([[fastify.verifyBigAsync], [fastify.verifyOddAsync]], { relation: 'or' }),
  handler: (req, reply) => {
    reply.send({
      big: req.big,
      odd: req.odd ?? 'hello',
    })
  }
})

• a test:

test('Two sub-arrays Or Relation success', t => {
  t.plan(2)

  fastify.inject({
    method: 'POST',
    url: '/check-two-sub-arrays-or-2',
    payload: {
      n: 110
    }
  }, (err, res) => {
    t.error(err)
    const payload = JSON.parse(res.payload)

    t.same(payload, {
      big: true,
      odd: 'hello',
    })
  })
})

And the test is passing meaning the fastify.verifyOddAsync was not called.

[isnifer]

@yakovenkodenis yes, sure, I forked this repo https://github.com/isnifer/fastify-auth.

1. I hide all routes except this one — https://github.com/isnifer/fastify-auth/blob/master/test/example-composited.js#L148-L159
2. Added important console.log()s here — https://github.com/isnifer/fastify-auth/blob/master/test/example-composited.js#L52-L73
3. And hide all tests except this one — https://github.com/isnifer/fastify-auth/blob/master/test/example-composited.test.js#L473-L490

And my test logs are:

npm t

> @fastify/auth@4.5.0 test
> npm run test:unit && npm run test:typescript


> @fastify/auth@4.5.0 test:unit
> tap

 PASS ​ ./test/auth.test.js 29 OK 38.833ms
 PASS ​ ./test/example-async.test.js 18 OK 48.952ms
./test/example-composited.test.js 1> If you see it — IT IS OK
./test/example-composited.test.js 1> THIS IS A SECOND AUTH PATH SHOULD NOT BE CALLED
 PASS ​ ./test/example-composited.test.js 2 OK 17.618ms
 PASS ​ ./test/example.test.js 20 OK 50.974ms

[isnifer]

@yakovenkodenis also important note — I've changed line https://github.com/isnifer/fastify-auth/blob/master/test/example-composited.test.js#L481 to make verifyBigAsync pass since it's a first auth path

[Eomm]

Could @isnifer open a dedicated issue with your findings?

It is hard to discuss a bug in a merged PR

[isnifer]

@Eomm no problem, I'll do it

[isnifer]

@Eomm I've created #223