konnosDashboard
idp-flow.test.ts41 lines · main
1import { describe, expect, test } from 'bun:test';
2
3import { createHash } from 'node:crypto';
4
5/**
6 * Pure helpers / discovery shape — no DB.
7 */
8describe('briven-engine OIDC IdP (pure)', () => {
9 test('PKCE S256 is sha256 base64url of verifier', () => {
10 const verifier = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
11 const challenge = createHash('sha256').update(verifier).digest('base64url');
12 // Known vector from RFC 7636 appendix B
13 expect(challenge).toBe('E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM');
14 });
15
16 test('discovery document has required OIDC fields', async () => {
17 process.env.BRIVEN_BETTER_AUTH_SECRET =
18 process.env.BRIVEN_BETTER_AUTH_SECRET ?? 'a'.repeat(32);
19 process.env.BRIVEN_API_ORIGIN =
20 process.env.BRIVEN_API_ORIGIN ?? 'https://api.briven.tech';
21 process.env.BRIVEN_WEB_ORIGIN =
22 process.env.BRIVEN_WEB_ORIGIN ?? 'https://briven.tech';
23 process.env.BRIVEN_DATABASE_URL =
24 process.env.BRIVEN_DATABASE_URL ?? 'postgres://test:test@127.0.0.1:5/test';
25
26 const { discoveryDocument, oidcIssuer } = await import('./idp-flow.js');
27 const doc = discoveryDocument();
28 expect(doc.issuer).toBe(oidcIssuer());
29 expect(String(doc.authorization_endpoint)).toContain('/authorize');
30 expect(String(doc.token_endpoint)).toContain('/token');
31 expect(String(doc.userinfo_endpoint)).toContain('/userinfo');
32 expect(String(doc.jwks_uri)).toContain('/jwks.json');
33 expect(String(doc.revocation_endpoint)).toContain('/revoke');
34 expect(String(doc.introspection_endpoint)).toContain('/introspect');
35 expect(String(doc.end_session_endpoint)).toContain('/end_session');
36 expect(doc.response_types_supported).toEqual(['code']);
37 expect(doc.grant_types_supported).toContain('authorization_code');
38 expect(doc.grant_types_supported).toContain('refresh_token');
39 expect(doc.code_challenge_methods_supported).toContain('S256');
40 });
41});