1
import { describe, expect, it } from "vitest";
2
 
3
import { loadOidcConfig } from "@/worker/auth/oidc";
4
 
5
function envOf(overrides: Partial<Env>): Env {
6
  return {
7
    TESSERA_OIDC_ISSUER: "",
8
    TESSERA_OIDC_CLIENT_ID: "",
9
    TESSERA_OIDC_CLIENT_SECRET: "",
10
    ...overrides,
11
  } as unknown as Env;
12
}
13
 
14
describe("loadOidcConfig", () => {
15
  it("accepts production https issuer + client credentials", () => {
16
    const result = loadOidcConfig(
17
      envOf({
18
        TESSERA_OIDC_ISSUER: "https://auth.limic.dev",
19
        TESSERA_OIDC_CLIENT_ID: "goc-prod",
20
        TESSERA_OIDC_CLIENT_SECRET: "shh",
21
      })
22
    );
23
    expect(result.ok).toBe(true);
24
    if (!result.ok) return;
25
    expect(result.config.issuer).toBe("https://auth.limic.dev");
26
    expect(result.config.clientId).toBe("goc-prod");
27
  });
28
 
29
  it("accepts loopback HTTP issuer for local dev", () => {
30
    for (const host of ["localhost", "127.0.0.1", "[::1]"]) {
31
      const result = loadOidcConfig(
32
        envOf({
33
          TESSERA_OIDC_ISSUER: `http://${host}:5174`,
34
          TESSERA_OIDC_CLIENT_ID: "local-goc",
35
          TESSERA_OIDC_CLIENT_SECRET: "secret",
36
        })
37
      );
38
      expect(result.ok).toBe(true);
39
    }
40
  });
41
 
42
  it("rejects plaintext non-loopback issuers", () => {
43
    const result = loadOidcConfig(
44
      envOf({
45
        TESSERA_OIDC_ISSUER: "http://auth.example.com",
46
        TESSERA_OIDC_CLIENT_ID: "goc",
47
        TESSERA_OIDC_CLIENT_SECRET: "secret",
48
      })
49
    );
50
    expect(result).toEqual({ ok: false, reason: "insecure_issuer" });
51
  });
52
 
53
  it("rejects an issuer URL with query/hash/userinfo", () => {
54
    expect(
55
      loadOidcConfig(
56
        envOf({
57
          TESSERA_OIDC_ISSUER: "https://auth.limic.dev?x=1",
58
          TESSERA_OIDC_CLIENT_ID: "goc",
59
          TESSERA_OIDC_CLIENT_SECRET: "secret",
60
        })
61
      )
62
    ).toEqual({ ok: false, reason: "insecure_issuer" });
63
    expect(
64
      loadOidcConfig(
65
        envOf({
66
          TESSERA_OIDC_ISSUER: "https://user@auth.limic.dev",
67
          TESSERA_OIDC_CLIENT_ID: "goc",
68
          TESSERA_OIDC_CLIENT_SECRET: "secret",
69
        })
70
      )
71
    ).toEqual({ ok: false, reason: "insecure_issuer" });
72
  });
73
 
74
  it("reports missing issuer/client_id/client_secret distinctly", () => {
75
    expect(loadOidcConfig(envOf({}))).toEqual({ ok: false, reason: "missing_issuer" });
76
    expect(loadOidcConfig(envOf({ TESSERA_OIDC_ISSUER: "https://auth.limic.dev" }))).toEqual({
77
      ok: false,
78
      reason: "missing_client_id",
79
    });
80
    expect(
81
      loadOidcConfig(
82
        envOf({
83
          TESSERA_OIDC_ISSUER: "https://auth.limic.dev",
84
          TESSERA_OIDC_CLIENT_ID: "goc",
85
        })
86
      )
87
    ).toEqual({ ok: false, reason: "missing_client_secret" });
88
  });
89
});