test(authentication): cover redirect handling and invalid decorator target

Add unit tests for the uncovered paths in the authentication package:

- AuthenticateActionProvider: a strategy returning a RedirectRoute sets the
  redirect url and status, uses the default 303 status, and short-circuits
  the remaining strategies
- @authenticate: throws when applied to a property

Statement, function and line coverage of the package is now 100%.

Signed-off-by: Pranesh Sridhar <68075088+pranesh-sridhar@users.noreply.github.com>

Author: pranesh-sridhar

packages/authentication/src/__tests__/unit/decorators/authenticate.decorator.unit.ts

@@ -123,6 +123,17 @@ describe('Authentication', () => {
         options: {option1: 'valueA', option2: 'value2'},
       });
     });
+    it('throws an error when used on a property', () => {
+      expect(() => {
+        class TestClass {
+          @authenticate('my-strategy')
+          prop: string;
+        }
+        return TestClass;
+      }).to.throw(
+        /@authenticate cannot be used on a property: TestClass\.prototype\.prop/,
+      );
+    });
   });
 
   it('can skip authentication', () => {

packages/authentication/src/__tests__/unit/providers/authentication.provider.unit.ts

@@ -4,7 +4,7 @@
 // License text available at https://opensource.org/licenses/MIT
 
 import {Context, instantiateClass} from '@loopback/core';
-import {Request} from '@loopback/rest';
+import {RedirectRoute, Request} from '@loopback/rest';
 import {securityId, UserProfile} from '@loopback/security';
 import {expect} from '@loopback/testlab';
 import {AuthenticateFn, AuthenticationBindings} from '../../..';
@@ -121,6 +121,78 @@ describe('AuthenticateActionProvider', () => {
       await expect(authenticate(request)).to.not.be.rejected();
     });
 
+    describe('redirect handling', () => {
+      let redirectUrl: string | undefined;
+      let redirectStatus: number | undefined;
+
+      function givenProviderWithStrategies(
+        strategies: AuthenticationStrategy[],
+      ) {
+        redirectUrl = undefined;
+        redirectStatus = undefined;
+        currentUser = undefined;
+        provider = new AuthenticateActionProvider(
+          () => Promise.resolve(strategies),
+          u => (currentUser = u),
+          url => (redirectUrl = url),
+          status => (redirectStatus = status),
+        );
+      }
+
+      function givenRedirectStrategy(
+        targetLocation: string,
+        statusCode?: number,
+      ): AuthenticationStrategy {
+        return {
+          name: 'redirect-strategy',
+          authenticate: async () =>
+            new RedirectRoute('/auth/login', targetLocation, statusCode),
+        };
+      }
+
+      it('sets redirect url and status when a strategy returns a RedirectRoute', async () => {
+        givenProviderWithStrategies([
+          givenRedirectStrategy('/auth/provider', 302),
+        ]);
+        const authenticate = await Promise.resolve(provider.value());
+
+        const result = await authenticate(<Request>{});
+
+        expect(result).to.be.undefined();
+        expect(redirectUrl).to.equal('/auth/provider');
+        expect(redirectStatus).to.equal(302);
+        expect(currentUser).to.be.undefined();
+      });
+
+      it('uses the default 303 status when the RedirectRoute has none', async () => {
+        givenProviderWithStrategies([givenRedirectStrategy('/auth/provider')]);
+        const authenticate = await Promise.resolve(provider.value());
+
+        await authenticate(<Request>{});
+
+        expect(redirectStatus).to.equal(303);
+      });
+
+      it('does not try remaining strategies after a redirect', async () => {
+        const second = new MockStrategy2();
+        let secondCalled = false;
+        second.authenticate = async () => {
+          secondCalled = true;
+          return {[securityId]: 'mock-id'};
+        };
+        givenProviderWithStrategies([
+          givenRedirectStrategy('/auth/provider', 302),
+          second,
+        ]);
+        const authenticate = await Promise.resolve(provider.value());
+
+        await authenticate(<Request>{});
+
+        expect(secondCalled).to.be.false();
+        expect(redirectUrl).to.equal('/auth/provider');
+      });
+    });
+
     describe('context.get(provider_key)', () => {
       it('returns a function which authenticates a request and returns a user', async () => {
         const context: Context = new Context();