1
import { describe, expect, it } from "vitest";
2
 
3
import {
4
  decodeTransactionPayload,
5
  deriveTransactionCookieSecret,
6
  encodeTransactionPayload,
7
} from "@/worker/auth/oidc";
8
 
9
describe("OIDC transaction payload encoding", () => {
10
  it("derives a deterministic purpose-scoped signing secret", async () => {
11
    const first = await deriveTransactionCookieSecret("client-secret");
12
    const second = await deriveTransactionCookieSecret("client-secret");
13
    const different = await deriveTransactionCookieSecret("other-client-secret");
14
    expect(first.byteLength).toBe(32);
15
    expect([...first]).toEqual([...second]);
16
    expect([...first]).not.toEqual([...different]);
17
  });
18
 
19
  it("round-trips a payload within TTL", () => {
20
    const encoded = encodeTransactionPayload({
21
      state: "abc",
22
      nonce: "nonce-1",
23
      codeVerifier: "verifier",
24
      redirectUri: "https://example.com/auth/callback",
25
      createdAt: Date.now(),
26
    });
27
    const result = decodeTransactionPayload(encoded);
28
    expect(result.ok).toBe(true);
29
    if (!result.ok) return;
30
    expect(result.payload.state).toBe("abc");
31
    expect(result.payload.nonce).toBe("nonce-1");
32
    expect(result.payload.codeVerifier).toBe("verifier");
33
    expect(result.payload.redirectUri).toBe("https://example.com/auth/callback");
34
  });
35
 
36
  it("rejects an expired payload", () => {
37
    const start = Date.now();
38
    const encoded = encodeTransactionPayload({
39
      state: "abc",
40
      nonce: "n",
41
      codeVerifier: "v",
42
      redirectUri: "https://example.com/auth/callback",
43
      createdAt: start,
44
    });
45
    // 6 minutes later - beyond the 5-minute TTL.
46
    expect(decodeTransactionPayload(encoded, start + 6 * 60 * 1000)).toEqual({
47
      ok: false,
48
      reason: "expired",
49
    });
50
  });
51
 
52
  it("rejects malformed input", () => {
53
    expect(decodeTransactionPayload("not-base64-!!")).toEqual({
54
      ok: false,
55
      reason: "malformed",
56
    });
57
    expect(decodeTransactionPayload("AAAA")).toEqual({ ok: false, reason: "invalid_payload" });
58
  });
59
});