45 lines
2.1 KiB
TypeScript
45 lines
2.1 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { signEmailOAuthState, verifyEmailOAuthState } from "./oauthState.server";
|
|
|
|
const secret = "test-email-oauth-secret-please-rotate-32bb";
|
|
const input = { tenantId: "tenant-1", userId: "user-1", tenantSlug: "acme", provider: "gmail" as const };
|
|
|
|
describe("email OAuth state (CSRF + provider pinning)", () => {
|
|
it("round-trips a signed state", () => {
|
|
const token = signEmailOAuthState(input, { secret });
|
|
const result = verifyEmailOAuthState(token, "gmail", { secret });
|
|
expect(result.ok).toBe(true);
|
|
if (!result.ok) throw new Error("expected ok");
|
|
expect(result.payload.tenantId).toBe("tenant-1");
|
|
expect(result.payload.userId).toBe("user-1");
|
|
expect(result.payload.tenantSlug).toBe("acme");
|
|
expect(result.payload.provider).toBe("gmail");
|
|
});
|
|
|
|
it("rejects a state presented to the wrong provider callback", () => {
|
|
const token = signEmailOAuthState(input, { secret });
|
|
expect(verifyEmailOAuthState(token, "microsoft", { secret })).toEqual({ ok: false, reason: "wrong-provider" });
|
|
});
|
|
|
|
it("rejects a tampered payload", () => {
|
|
const token = signEmailOAuthState(input, { secret });
|
|
const tampered = `x${token.slice(1)}`;
|
|
expect(verifyEmailOAuthState(tampered, "gmail", { secret })).toEqual({ ok: false, reason: "bad-signature" });
|
|
});
|
|
|
|
it("rejects a wrong-secret signature", () => {
|
|
const token = signEmailOAuthState(input, { secret });
|
|
expect(verifyEmailOAuthState(token, "gmail", { secret: "a-different-secret-value-of-length-32xx" })).toEqual({ ok: false, reason: "bad-signature" });
|
|
});
|
|
|
|
it("rejects a malformed token", () => {
|
|
expect(verifyEmailOAuthState("not-a-token", "gmail", { secret })).toEqual({ ok: false, reason: "malformed" });
|
|
});
|
|
|
|
it("rejects an expired state", () => {
|
|
const token = signEmailOAuthState(input, { secret, now: () => 1_000_000 });
|
|
const later = () => 1_000_000 + 11 * 60 * 1000; // 11 minutes later (> 10m TTL)
|
|
expect(verifyEmailOAuthState(token, "gmail", { secret, now: later })).toEqual({ ok: false, reason: "expired" });
|
|
});
|
|
});
|