1
import { describe, expect, it } from "vitest";
2
import {
3
  decodeTransactionPayload,
4
  deriveTransactionCookieSecret,
5
  encodeTransactionPayload,
6
} from "@/worker/services/oidc";
7
 
8
describe("OIDC transaction payload encoding", () => {
9
  it("derives a deterministic purpose-scoped signing secret", async () => {
10
    const first = await deriveTransactionCookieSecret("client-secret");
11
    const second = await deriveTransactionCookieSecret("client-secret");
12
    const different = await deriveTransactionCookieSecret("other-client-secret");
13
 
14
    expect(first.byteLength).toBe(32);
15
    expect([...first]).toEqual([...second]);
16
    expect([...first]).not.toEqual([...different]);
17
  });
18
 
19
  it("round-trips a payload within TTL", () => {
20
    const createdAt = Date.now();
21
    const encoded = encodeTransactionPayload({
22
      state: "state-1",
23
      nonce: "nonce-1",
24
      codeVerifier: "verifier-1",
25
      redirectUri: "https://flamemail.devbin.tools/api/public/admin/callback",
26
      createdAt,
27
    });
28
 
29
    expect(decodeTransactionPayload(encoded, createdAt + 60_000)).toEqual({
30
      ok: true,
31
      payload: {
32
        state: "state-1",
33
        nonce: "nonce-1",
34
        codeVerifier: "verifier-1",
35
        redirectUri: "https://flamemail.devbin.tools/api/public/admin/callback",
36
        createdAt,
37
      },
38
    });
39
  });
40
 
41
  it("rejects an expired payload", () => {
42
    const createdAt = Date.now();
43
    const encoded = encodeTransactionPayload({
44
      state: "state-1",
45
      nonce: "nonce-1",
46
      codeVerifier: "verifier-1",
47
      redirectUri: "https://flamemail.devbin.tools/api/public/admin/callback",
48
      createdAt,
49
    });
50
 
51
    expect(decodeTransactionPayload(encoded, createdAt + 6 * 60 * 1000)).toEqual({
52
      ok: false,
53
      reason: "expired",
54
    });
55
  });
56
 
57
  it("rejects malformed input", () => {
58
    expect(decodeTransactionPayload("not-base64-!!")).toEqual({
59
      ok: false,
60
      reason: "malformed",
61
    });
62
    expect(decodeTransactionPayload("AAAA")).toEqual({
63
      ok: false,
64
      reason: "invalid_payload",
65
    });
66
  });
67
});