konnosDashboard
auth-service-callback.test.ts122 lines · main
1// apps/api/src/routes/auth-service-callback.test.ts
2//
3// Pure-function tests for normalizeTenantCallbacks() — the tenant-auth
4// bridge's callback/redirect fix. The @briven/auth SDK sends `redirectTo`
5// but Better Auth only reads `callbackURL`, and a relative callbackURL
6// resolves against api.briven.tech instead of the calling app. These tests
7// pin the seeding + absolutizing behavior without spinning up a server.
8//
9// Env vars must be set BEFORE any module that reads them is imported
10// (auth-service.ts pulls in env.ts and the auth service graph at module
11// evaluation), so we mutate process.env first and import dynamically —
12// same pattern as auth-cli.test.ts.
13
14const ORIGINAL_SECRET = process.env.BRIVEN_BETTER_AUTH_SECRET;
15const ORIGINAL_DB_URL = process.env.BRIVEN_DATABASE_URL;
16process.env.BRIVEN_BETTER_AUTH_SECRET = ORIGINAL_SECRET ?? 'a'.repeat(32);
17process.env.BRIVEN_DATABASE_URL = ORIGINAL_DB_URL ?? 'postgres://test:test@127.0.0.1:5/test';
18
19import { afterAll, describe, expect, it } from 'bun:test';
20
21const { normalizeTenantCallbacks } = await import('./auth-service.js');
22
23afterAll(() => {
24 if (ORIGINAL_SECRET === undefined) delete process.env.BRIVEN_BETTER_AUTH_SECRET;
25 else process.env.BRIVEN_BETTER_AUTH_SECRET = ORIGINAL_SECRET;
26 if (ORIGINAL_DB_URL === undefined) delete process.env.BRIVEN_DATABASE_URL;
27 else process.env.BRIVEN_DATABASE_URL = ORIGINAL_DB_URL;
28});
29
30describe('normalizeTenantCallbacks', () => {
31 it('seeds callbackURL from redirectTo when callbackURL is absent', () => {
32 const out = normalizeTenantCallbacks(
33 { email: 'user@example.com', redirectTo: 'https://code.konnos.org/dashboard' },
34 null,
35 );
36 expect(out.callbackURL).toBe('https://code.konnos.org/dashboard');
37 // Original SDK field stays — Better Auth ignores unknown fields.
38 expect(out.redirectTo).toBe('https://code.konnos.org/dashboard');
39 expect(out.email).toBe('user@example.com');
40 });
41
42 it('does not overwrite an explicit callbackURL with redirectTo', () => {
43 const out = normalizeTenantCallbacks(
44 { callbackURL: 'https://app.example.com/a', redirectTo: 'https://app.example.com/b' },
45 null,
46 );
47 expect(out.callbackURL).toBe('https://app.example.com/a');
48 });
49
50 it('absolutizes a relative callbackURL against the Origin', () => {
51 const out = normalizeTenantCallbacks(
52 { callbackURL: '/dashboard' },
53 'https://code.konnos.org',
54 );
55 expect(out.callbackURL).toBe('https://code.konnos.org/dashboard');
56 });
57
58 it('seeds from a relative redirectTo, then absolutizes it', () => {
59 const out = normalizeTenantCallbacks(
60 { email: 'user@example.com', redirectTo: '/dashboard' },
61 'https://code.konnos.org',
62 );
63 expect(out.callbackURL).toBe('https://code.konnos.org/dashboard');
64 });
65
66 it('absolutizes newUserCallbackURL and errorCallbackURL too', () => {
67 const out = normalizeTenantCallbacks(
68 { callbackURL: '/in', newUserCallbackURL: '/welcome', errorCallbackURL: '/oops' },
69 'https://code.konnos.org',
70 );
71 expect(out.callbackURL).toBe('https://code.konnos.org/in');
72 expect(out.newUserCallbackURL).toBe('https://code.konnos.org/welcome');
73 expect(out.errorCallbackURL).toBe('https://code.konnos.org/oops');
74 });
75
76 it('leaves an absolute callbackURL untouched (originCheck validates it downstream)', () => {
77 const out = normalizeTenantCallbacks(
78 { callbackURL: 'https://elsewhere.example.com/dashboard' },
79 'https://code.konnos.org',
80 );
81 expect(out.callbackURL).toBe('https://elsewhere.example.com/dashboard');
82 });
83
84 it('ignores protocol-relative "//evil.com" (not an app-relative path)', () => {
85 const out = normalizeTenantCallbacks(
86 { callbackURL: '//evil.com/steal' },
87 'https://code.konnos.org',
88 );
89 expect(out.callbackURL).toBe('//evil.com/steal');
90 });
91
92 it('returns body unchanged when origin is null', () => {
93 const body = { callbackURL: '/dashboard' };
94 const out = normalizeTenantCallbacks(body, null);
95 expect(out).toEqual(body);
96 });
97
98 it('returns body unchanged when origin is garbage or non-http(s)', () => {
99 const body = { callbackURL: '/dashboard' };
100 expect(normalizeTenantCallbacks(body, 'not a url at all')).toEqual(body);
101 expect(normalizeTenantCallbacks(body, 'ftp://files.example.com')).toEqual(body);
102 expect(normalizeTenantCallbacks(body, '')).toEqual(body);
103 });
104
105 it('does not invent fields when neither redirectTo nor callbackURL is present', () => {
106 const body = { email: 'user@example.com' };
107 const out = normalizeTenantCallbacks(body, 'https://code.konnos.org');
108 expect(out).toEqual(body);
109 expect('callbackURL' in out).toBe(false);
110 expect('newUserCallbackURL' in out).toBe(false);
111 expect('errorCallbackURL' in out).toBe(false);
112 });
113
114 it('ignores non-string redirectTo and non-string callback fields', () => {
115 const out = normalizeTenantCallbacks(
116 { redirectTo: 42, callbackURL: ['/dashboard'] },
117 'https://code.konnos.org',
118 );
119 expect(out.callbackURL).toEqual(['/dashboard']);
120 expect('newUserCallbackURL' in out).toBe(false);
121 });
122});