forked from baron/baron-sso
71 lines
2.1 KiB
TypeScript
71 lines
2.1 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import {
|
|
buildAdminAuthRedirectUris,
|
|
canStartBrowserPkceLogin,
|
|
resolveAdminOidcAuthority,
|
|
resolveAdminPublicOrigin,
|
|
} from "./authConfig";
|
|
|
|
describe("admin auth config", () => {
|
|
it("uses the explicit public admin origin for staging callback URLs", () => {
|
|
const publicOrigin = resolveAdminPublicOrigin(
|
|
"https://sadmin.hmac.kr",
|
|
"http://127.0.0.1:5173",
|
|
);
|
|
|
|
expect(publicOrigin).toBe("https://sadmin.hmac.kr");
|
|
expect(buildAdminAuthRedirectUris(publicOrigin)).toEqual({
|
|
redirectUri: "https://sadmin.hmac.kr/auth/callback",
|
|
postLogoutRedirectUri: "https://sadmin.hmac.kr",
|
|
popupRedirectUri: "https://sadmin.hmac.kr/auth/callback",
|
|
});
|
|
});
|
|
|
|
it("falls back to the browser origin when no explicit public origin is set", () => {
|
|
expect(resolveAdminPublicOrigin("", "http://localhost:5173")).toBe(
|
|
"http://localhost:5173",
|
|
);
|
|
});
|
|
|
|
it("uses the local OIDC authority for localhost when no explicit authority is set", () => {
|
|
expect(resolveAdminOidcAuthority(undefined, "http://localhost:5173")).toBe(
|
|
"http://localhost:5000/oidc",
|
|
);
|
|
});
|
|
|
|
it("blocks browser PKCE login when WebCrypto is unavailable", () => {
|
|
expect(
|
|
canStartBrowserPkceLogin({
|
|
isSecureContext: false,
|
|
origin: "http://localhost:5173",
|
|
cryptoSubtleAvailable: false,
|
|
}),
|
|
).toBe(false);
|
|
expect(
|
|
canStartBrowserPkceLogin({
|
|
isSecureContext: true,
|
|
origin: "https://admin.example.test",
|
|
cryptoSubtleAvailable: false,
|
|
}),
|
|
).toBe(false);
|
|
});
|
|
|
|
it("allows trusted local and private-network origins only when WebCrypto is available", () => {
|
|
for (const origin of [
|
|
"http://localhost:5173",
|
|
"http://127.0.0.1:5173",
|
|
"http://host.docker.internal:5173",
|
|
"http://172.16.9.189:5173",
|
|
"http://192.168.0.20:5173",
|
|
]) {
|
|
expect(
|
|
canStartBrowserPkceLogin({
|
|
isSecureContext: false,
|
|
origin,
|
|
cryptoSubtleAvailable: true,
|
|
}),
|
|
).toBe(true);
|
|
}
|
|
});
|
|
});
|