22 lines
818 B
TypeScript
22 lines
818 B
TypeScript
import { readOAuthState, safeNext, signOAuthState } from './oauth-state';
|
|
|
|
describe('oauth state', () => {
|
|
const secret = 'test-secret';
|
|
|
|
it('round-trips a signed tenant state', () => {
|
|
const token = signOAuthState({ kind: 'tenant', slug: 'demo', next: '/demo' }, secret);
|
|
expect(readOAuthState(token, secret)).toEqual({ kind: 'tenant', slug: 'demo', next: '/demo' });
|
|
});
|
|
|
|
it('rejects a tampered state', () => {
|
|
const token = signOAuthState({ kind: 'platform' }, secret);
|
|
expect(() => readOAuthState(`${token}x`, secret)).toThrow();
|
|
});
|
|
|
|
it('blocks open redirects', () => {
|
|
expect(safeNext('https://evil.test', '/admin')).toBe('/admin');
|
|
expect(safeNext('//evil.test', '/admin')).toBe('/admin');
|
|
expect(safeNext('/admin/clientes', '/admin')).toBe('/admin/clientes');
|
|
});
|
|
});
|