oauth.test.ts36 lines · main

1	import { test } from 'node:test';
2	import { strict as assert } from 'node:assert';
3	import { handleCallback, generateState, isLoopback } from './oauth.js';
4
5	test('generateState yields 64-hex chars', () => {
6	const s = generateState();
7	assert.match(s, /^[a-f0-9]{64}$/);
8	});
9
10	test('isLoopback accepts 127.0.0.1 + localhost only', () => {
11	assert.equal(isLoopback('http://127.0.0.1:8080/cb'), true);
12	assert.equal(isLoopback('http://localhost:8080/cb'), true);
13	assert.equal(isLoopback('http://example.com/cb'), false);
14	assert.equal(isLoopback('https://127.0.0.1:8080/cb'), false);
15	});
16
17	test('handleCallback rejects state mismatch', () => {
18	const req = new Request('http://127.0.0.1/cb?token=t&state=B');
19	const r = handleCallback(req, 'A');
20	assert.equal(r.ok, false);
21	if (!r.ok) assert.match(r.reason, /state/);
22	});
23
24	test('handleCallback accepts matching state', () => {
25	const req = new Request('http://127.0.0.1/cb?token=tk&state=AA');
26	const r = handleCallback(req, 'AA');
27	assert.equal(r.ok, true);
28	if (r.ok) assert.equal(r.token, 'tk');
29	});
30
31	test('handleCallback honors denied=1', () => {
32	const req = new Request('http://127.0.0.1/cb?denied=1&state=AA');
33	const r = handleCallback(req, 'AA');
34	assert.equal(r.ok, false);
35	if (!r.ok) assert.match(r.reason, /denied/);
36	});