@antelopejs/dms 0.0.1

package/dist/test/unit/oauth-account-guard.test.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const chai_1 = require("chai");
+const db_1 = require("@antelopejs/interface-dms/db");
+const identity_resolution_1 = require("../../routes/auth/oauth/identity-resolution");
+const HTTP_FORBIDDEN = 403;
+const ACCOUNT_NOT_VALIDATED = "error.oauth.account_not_validated";
+const WORKSPACE_ID = "oauth-guard-workspace";
+const PROVIDER = "google";
+const HOLDER_NAME = "Rightful Holder";
+const HOLDER_PASSWORD = "holder-password-hash";
+const HOLDER_AUTH_KEY = "holder-auth-key";
+const CLOSED_POLICY = {
+    allowAccountCreation: false,
+    linkByVerifiedEmail: true,
+};
+function buildUnvalidatedAccount(id, email) {
+    return {
+        _id: id,
+        email,
+        name: HOLDER_NAME,
+        password: HOLDER_PASSWORD,
+        authKey: HOLDER_AUTH_KEY,
+        isValidated: false,
+        language: "en",
+    };
+}
+function buildIdentity(email) {
+    return {
+        providerAccountId: "oauth-guard-42",
+        email,
+        isEmailVerified: true,
+        name: "Invitee",
+    };
+}
+async function joinWorkspace(userId) {
+    await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, WORKSPACE_ID).insert({
+        _id: `${WORKSPACE_ID}:${userId}`,
+        userId,
+        roleIds: [],
+        isTenantOwner: false,
+        joinedAt: new Date(),
+        invitedBy: null,
+    });
+}
+async function attemptResolve(existingUser) {
+    const updatedUsers = [];
+    const userModel = {
+        getByEmail: async (lookup) => lookup === existingUser.email ? existingUser : undefined,
+        get: async () => existingUser,
+        update: async (user) => {
+            updatedUsers.push(user);
+        },
+        insert: async () => {
+            throw new Error("resolution must not create a second account");
+        },
+    };
+    try {
+        const result = await (0, identity_resolution_1.resolveOAuthUser)(userModel, {
+            provider: PROVIDER,
+            identity: buildIdentity(existingUser.email),
+            policy: CLOSED_POLICY,
+            hasValidInvitation: true,
+            language: "fr",
+        });
+        return { error: undefined, result, updatedUsers };
+    }
+    catch (error) {
+        return { error, result: undefined, updatedUsers };
+    }
+}
+describe("[unit] auth/oauth — claiming an existing account", () => {
+    it("refuses an unvalidated account that already belongs to a workspace", async () => {
+        const provisioned = buildUnvalidatedAccount("oauth-guard-provisioned", "provisioned@acme.dev");
+        await joinWorkspace(provisioned._id);
+        const attempt = await attemptResolve(provisioned);
+        (0, chai_1.expect)(attempt.error).to.be.instanceOf(interface_api_1.HTTPResult);
+        const refusal = attempt.error;
+        (0, chai_1.expect)(refusal.getStatus()).to.equal(HTTP_FORBIDDEN);
+        (0, chai_1.expect)(refusal.getBody()).to.equal(ACCOUNT_NOT_VALIDATED);
+        (0, chai_1.expect)(attempt.updatedUsers).to.deep.equal([]);
+        (0, chai_1.expect)(provisioned.password).to.equal(HOLDER_PASSWORD);
+        (0, chai_1.expect)(provisioned.authKey).to.equal(HOLDER_AUTH_KEY);
+    });
+    it("still reclaims a genuine draft: unvalidated and in no workspace", async () => {
+        const draft = buildUnvalidatedAccount("oauth-guard-draft", "draft@acme.dev");
+        const attempt = await attemptResolve(draft);
+        (0, chai_1.expect)(attempt.error).to.equal(undefined);
+        (0, chai_1.expect)(attempt.result?.isRegistration).to.equal(true);
+        (0, chai_1.expect)(attempt.updatedUsers).to.have.length.greaterThan(0);
+        (0, chai_1.expect)(draft.authKey).to.not.equal(HOLDER_AUTH_KEY);
+    });
+});
+//# sourceMappingURL=oauth-account-guard.test.js.map

package/dist/test/unit/oauth-account-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-account-guard.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-account-guard.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,6FAAqE;AACrE,+BAA8B;AAC9B,qDAAiE;AAGjE,qFAA+E;AAG/E,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAGlE,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAC1B,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,MAAM,aAAa,GAAgB;IACjC,oBAAoB,EAAE,KAAK;IAC3B,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AAEF,SAAS,uBAAuB,CAAC,EAAU,EAAE,KAAa;IACxD,OAAO;QACL,GAAG,EAAE,EAAE;QACP,KAAK;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,eAAe;QACxB,WAAW,EAAE,KAAK;QAClB,QAAQ,EAAE,IAAI;KACI,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO;QACL,iBAAiB,EAAE,gBAAgB;QACnC,KAAK;QACL,eAAe,EAAE,IAAI;QACrB,IAAI,EAAE,SAAS;KAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC;QACrD,GAAG,EAAE,GAAG,YAAY,IAAI,MAAM,EAAE;QAChC,MAAM;QACN,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,IAAI,IAAI,EAAE;QACpB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAaD,KAAK,UAAU,cAAc,CAAC,YAAkB;IAC9C,MAAM,YAAY,GAAW,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE,CACnC,MAAM,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC1D,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;QAC7B,MAAM,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE;YAC3B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;KACsB,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAgB,EAAC,SAAS,EAAE;YAC/C,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC;YAC3C,MAAM,EAAE,aAAa;YACrB,kBAAkB,EAAE,IAAI;YACxB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAIhE,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,WAAW,GAAG,uBAAuB,CACzC,yBAAyB,EACzB,sBAAsB,CACvB,CAAC;QACF,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;QAElD,IAAA,aAAM,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAmB,CAAC;QAC5C,IAAA,aAAM,EAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACrD,IAAA,aAAM,EAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC1D,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,KAAK,GAAG,uBAAuB,CACnC,mBAAmB,EACnB,gBAAgB,CACjB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAE5C,IAAA,aAAM,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAA,aAAM,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-claim-account.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/oauth-claim-account.test.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const db_1 = require("@antelopejs/interface-dms/auth/db");
+const chai_1 = require("chai");
+const identity_resolution_1 = require("../../routes/auth/oauth/identity-resolution");
+const IDENTITY = {
+    providerAccountId: "42",
+    email: "alex@acme.dev",
+    isEmailVerified: true,
+    name: "Alex",
+};
+function buildUnvalidatedUser() {
+    return {
+        _id: "user-1",
+        email: "alex@acme.dev",
+        name: "Squatter",
+        language: "en",
+        password: "squatter-password",
+        authKey: "squatter-auth-key",
+        isValidated: false,
+        validationToken: "ABC123",
+        validationRequestedAt: new Date(0),
+        forgotPasswordToken: "reset-me",
+        forgotPasswordRequestedAt: new Date(0),
+        twoFactorMethods: ["totp"],
+        twoFactorSecret: "totp-secret",
+        twoFactorPendingSecret: "pending-secret",
+        twoFactorBackupCodes: ["backup-1"],
+        twoFactorEmailCode: "999999",
+        twoFactorEmailCodeRequestedAt: new Date(0),
+    };
+}
+describe("[unit] oauth claim of an unvalidated account", () => {
+    async function claim() {
+        const user = buildUnvalidatedUser();
+        let updated = false;
+        const userModel = {
+            update: async () => {
+                updated = true;
+            },
+        };
+        await (0, identity_resolution_1.claimUnvalidatedAccount)(userModel, user, IDENTITY, "fr");
+        return { user, updated };
+    }
+    it("persists the claim", async () => {
+        const { updated } = await claim();
+        (0, chai_1.expect)(updated).to.equal(true);
+    });
+    it("leaves no credential of the previous holder behind", async () => {
+        const { user } = await claim();
+        (0, chai_1.expect)(user.password).to.equal(null);
+        (0, chai_1.expect)(user.authKey).to.not.equal("squatter-auth-key");
+        (0, chai_1.expect)(user.authKey).to.have.length.greaterThan(0);
+        (0, chai_1.expect)(user.validationToken).to.equal(null);
+        (0, chai_1.expect)(user.validationRequestedAt).to.equal(null);
+        (0, chai_1.expect)(user.forgotPasswordToken).to.equal(null);
+        (0, chai_1.expect)(user.forgotPasswordRequestedAt).to.equal(null);
+    });
+    it("leaves no second factor of the previous holder behind", async () => {
+        const { user } = await claim();
+        (0, chai_1.expect)(user.twoFactorMethods).to.deep.equal([]);
+        (0, chai_1.expect)(user.twoFactorSecret).to.equal(null);
+        (0, chai_1.expect)(user.twoFactorPendingSecret).to.equal(null);
+        (0, chai_1.expect)(user.twoFactorBackupCodes).to.deep.equal([]);
+        (0, chai_1.expect)(user.twoFactorEmailCode).to.equal(null);
+        (0, chai_1.expect)(user.twoFactorEmailCodeRequestedAt).to.equal(null);
+    });
+    it("hands the account to the invitee, validated", async () => {
+        const { user } = await claim();
+        (0, chai_1.expect)(user.isValidated).to.equal(true);
+        (0, chai_1.expect)(user.name).to.equal("Alex");
+        (0, chai_1.expect)(user.language).to.equal("fr");
+    });
+    it("leaves no provider binding of the previous holder behind", async () => {
+        const identityModel = (0, interface_database_decorators_1.GetModel)(db_1.UserExternalIdentityModel);
+        await identityModel.insert({
+            _id: "google:previous-holder",
+            userId: "user-1",
+            provider: "google",
+            providerAccountId: "previous-holder",
+            email: "alex@acme.dev",
+            createdAt: new Date(),
+            lastLoginAt: new Date(),
+        });
+        await claim();
+        (0, chai_1.expect)(await identityModel.getByUserId("user-1")).to.deep.equal([]);
+    });
+});
+//# sourceMappingURL=oauth-claim-account.test.js.map

package/dist/test/unit/oauth-claim-account.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-claim-account.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-claim-account.test.ts"],"names":[],"mappings":";;AAAA,6FAAqE;AACrE,0DAI2C;AAC3C,+BAA8B;AAC9B,qFAAsF;AAGtF,MAAM,QAAQ,GAAqB;IACjC,iBAAiB,EAAE,IAAI;IACvB,KAAK,EAAE,eAAe;IACtB,eAAe,EAAE,IAAI;IACrB,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,SAAS,oBAAoB;IAC3B,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,QAAQ;QACzB,qBAAqB,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QAClC,mBAAmB,EAAE,UAAU;QAC/B,yBAAyB,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QACtC,gBAAgB,EAAE,CAAC,MAAM,CAAC;QAC1B,eAAe,EAAE,aAAa;QAC9B,sBAAsB,EAAE,gBAAgB;QACxC,oBAAoB,EAAE,CAAC,UAAU,CAAC;QAClC,kBAAkB,EAAE,QAAQ;QAC5B,6BAA6B,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;KACxB,CAAC;AACvB,CAAC;AAED,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,KAAK,UAAU,KAAK;QAClB,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,SAAS,GAAG;YAChB,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;SACsB,CAAC;QAE1B,MAAM,IAAA,6CAAuB,EAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAClC,IAAA,aAAM,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAE/B,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAA,aAAM,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACnD,IAAA,aAAM,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAA,aAAM,EAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,IAAA,aAAM,EAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAE/B,IAAA,aAAM,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAA,aAAM,EAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAA,aAAM,EAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,IAAA,aAAM,EAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAE/B,IAAA,aAAM,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,aAAa,GAAG,IAAA,wCAAQ,EAAC,8BAAyB,CAAC,CAAC;QAC1D,MAAM,aAAa,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,QAAQ;YAClB,iBAAiB,EAAE,iBAAiB;YACpC,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,WAAW,EAAE,IAAI,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,MAAM,KAAK,EAAE,CAAC;QAEd,IAAA,aAAM,EAAC,MAAM,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/oauth-config.test.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const chai_1 = require("chai");
+const index_1 = require("../../index");
+const authorize_url_1 = require("../../routes/auth/oauth/authorize-url");
+const config_1 = require("../../routes/auth/oauth/config");
+const HTTP_NOT_FOUND = 404;
+const CREDENTIALS = { clientId: "client-id", clientSecret: "client-secret" };
+describe("[unit] oauth config", () => {
+    let previousOAuth;
+    beforeEach(() => {
+        previousOAuth = (0, index_1.getAuthConfig)().oauth;
+    });
+    afterEach(() => {
+        (0, index_1.getAuthConfig)().oauth = previousOAuth;
+    });
+    function configure(oauth) {
+        (0, index_1.getAuthConfig)().oauth = oauth;
+    }
+    describe("enabled providers", () => {
+        it("offers nothing when the instance configured nothing", () => {
+            configure({});
+            (0, chai_1.expect)((0, config_1.listEnabledOAuthProviders)()).to.deep.equal([]);
+        });
+        it("only offers providers holding both credentials", () => {
+            configure({
+                providers: {
+                    github: CREDENTIALS,
+                    google: { clientId: "only-an-id", clientSecret: "" },
+                },
+            });
+            (0, chai_1.expect)((0, config_1.listEnabledOAuthProviders)()).to.deep.equal([
+                { id: "github", label: "GitHub", icon: "i-ph-github-logo" },
+            ]);
+        });
+        it("ignores an unknown provider id", () => {
+            configure({ providers: { gitlab: CREDENTIALS } });
+            (0, chai_1.expect)((0, config_1.listEnabledOAuthProviders)()).to.deep.equal([]);
+        });
+        it("refuses to start a flow on a provider without credentials", () => {
+            configure({ providers: {} });
+            try {
+                (0, config_1.getEnabledOAuthProvider)("github");
+            }
+            catch (error) {
+                (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
+                (0, chai_1.expect)(error.getStatus()).to.equal(HTTP_NOT_FOUND);
+                return;
+            }
+            chai_1.expect.fail("expected a disabled provider to be refused");
+        });
+    });
+    describe("policy defaults", () => {
+        it("keeps provider sign-up off and e-mail linking on", () => {
+            configure({});
+            (0, chai_1.expect)((0, config_1.resolveOAuthPolicy)()).to.deep.equal({
+                allowAccountCreation: false,
+                linkByVerifiedEmail: true,
+            });
+        });
+        it("honours an explicit opt-in", () => {
+            configure({ allowAccountCreation: true, linkByVerifiedEmail: false });
+            (0, chai_1.expect)((0, config_1.resolveOAuthPolicy)()).to.deep.equal({
+                allowAccountCreation: true,
+                linkByVerifiedEmail: false,
+            });
+        });
+    });
+    describe("authorize url", () => {
+        it("carries the client id, callback, scopes and state", () => {
+            configure({
+                providers: { github: CREDENTIALS },
+                callbackBaseUrl: "https://console.example.dev",
+            });
+            const { authorizeUrl, state } = (0, authorize_url_1.buildOAuthAuthorizeUrl)("github");
+            const url = new URL(authorizeUrl);
+            (0, chai_1.expect)(url.origin + url.pathname).to.equal("https://github.com/login/oauth/authorize");
+            (0, chai_1.expect)(url.searchParams.get("client_id")).to.equal("client-id");
+            (0, chai_1.expect)(url.searchParams.get("redirect_uri")).to.equal("https://console.example.dev/auth/oauth/github/callback");
+            (0, chai_1.expect)(url.searchParams.get("scope")).to.equal("read:user user:email");
+            (0, chai_1.expect)(url.searchParams.get("response_type")).to.equal("code");
+            (0, chai_1.expect)(url.searchParams.get("state")).to.equal(state);
+        });
+        it("never leaks the client secret into the browser-facing url", () => {
+            configure({
+                providers: { github: CREDENTIALS },
+                callbackBaseUrl: "https://console.example.dev",
+            });
+            (0, chai_1.expect)((0, authorize_url_1.buildOAuthAuthorizeUrl)("github").authorizeUrl).to.not.contain("client-secret");
+        });
+        it("uses the scopes the instance overrode", () => {
+            configure({
+                providers: {
+                    github: { ...CREDENTIALS, scopes: ["read:user"] },
+                },
+                callbackBaseUrl: "https://console.example.dev",
+            });
+            const url = new URL((0, authorize_url_1.buildOAuthAuthorizeUrl)("github").authorizeUrl);
+            (0, chai_1.expect)(url.searchParams.get("scope")).to.equal("read:user");
+        });
+        it("trims a trailing slash off the configured callback origin", () => {
+            configure({
+                providers: { google: CREDENTIALS },
+                callbackBaseUrl: "https://console.example.dev/",
+            });
+            const url = new URL((0, authorize_url_1.buildOAuthAuthorizeUrl)("google").authorizeUrl);
+            (0, chai_1.expect)(url.searchParams.get("redirect_uri")).to.equal("https://console.example.dev/auth/oauth/google/callback");
+        });
+    });
+});
+//# sourceMappingURL=oauth-config.test.js.map

package/dist/test/unit/oauth-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-config.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-config.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,+BAA8B;AAC9B,uCAA8D;AAC9D,yEAA+E;AAC/E,2DAIwC;AAExC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AAE7E,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,IAAI,aAAsC,CAAC;IAE3C,UAAU,CAAC,GAAG,EAAE;QACd,aAAa,GAAG,IAAA,qBAAa,GAAE,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAA,qBAAa,GAAE,CAAC,KAAK,GAAG,aAAa,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,SAAS,SAAS,CAAC,KAAkB;QACnC,IAAA,qBAAa,GAAE,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,IAAA,aAAM,EAAC,IAAA,kCAAyB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,SAAS,CAAC;gBACR,SAAS,EAAE;oBACT,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;iBACrD;aACF,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,IAAA,kCAAyB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAChD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YAClD,IAAA,aAAM,EAAC,IAAA,kCAAyB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAA,gCAAuB,EAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;gBAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,aAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,IAAA,aAAM,EAAC,IAAA,2BAAkB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBACzC,oBAAoB,EAAE,KAAK;gBAC3B,mBAAmB,EAAE,IAAI;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,SAAS,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,IAAA,aAAM,EAAC,IAAA,2BAAkB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBACzC,oBAAoB,EAAE,IAAI;gBAC1B,mBAAmB,EAAE,KAAK;aAC3B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,SAAS,CAAC;gBACR,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;gBAClC,eAAe,EAAE,6BAA6B;aAC/C,CAAC,CAAC;YAEH,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,sCAAsB,EAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YAElC,IAAA,aAAM,EAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CACxC,0CAA0C,CAC3C,CAAC;YACF,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAChE,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CACnD,wDAAwD,CACzD,CAAC;YACF,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACvE,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,SAAS,CAAC;gBACR,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;gBAClC,eAAe,EAAE,6BAA6B;aAC/C,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,IAAA,sCAAsB,EAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAClE,eAAe,CAChB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,SAAS,CAAC;gBACR,SAAS,EAAE;oBACT,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;iBAClD;gBACD,eAAe,EAAE,6BAA6B;aAC/C,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAA,sCAAsB,EAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC;YACnE,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,SAAS,CAAC;gBACR,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;gBAClC,eAAe,EAAE,8BAA8B;aAChD,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAA,sCAAsB,EAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC;YACnE,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CACnD,wDAAwD,CACzD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-linking-policy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/oauth-linking-policy.test.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const chai_1 = require("chai");
+const linking_policy_1 = require("../../routes/auth/oauth/linking-policy");
+const HTTP_FORBIDDEN = 403;
+const NO_MATCH = {
+    hasLinkedAccount: false,
+    hasAccountWithSameEmail: false,
+    isSameEmailAccountValidated: false,
+    hasValidInvitation: false,
+    belongsToWorkspace: false,
+};
+const CLOSED_POLICY = {
+    allowAccountCreation: false,
+    linkByVerifiedEmail: true,
+};
+const VERIFIED_IDENTITY = {
+    providerAccountId: "42",
+    email: "Alex@Acme.dev",
+    isEmailVerified: true,
+    name: "Alex",
+};
+const UNVERIFIED_IDENTITY = {
+    ...VERIFIED_IDENTITY,
+    isEmailVerified: false,
+};
+const OPEN_POLICY = {
+    allowAccountCreation: true,
+    linkByVerifiedEmail: true,
+};
+function expectRefusal(run, expectedMessage) {
+    try {
+        run();
+    }
+    catch (error) {
+        (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
+        (0, chai_1.expect)(error.getStatus()).to.equal(HTTP_FORBIDDEN);
+        (0, chai_1.expect)(error.getBody()).to.equal(expectedMessage);
+        return;
+    }
+    chai_1.expect.fail(`expected a refusal with "${expectedMessage}"`);
+}
+describe("[unit] oauth linking policy", () => {
+    describe("an already linked provider account", () => {
+        it("wins over every other rule, even an unverified e-mail", () => {
+            const resolution = (0, linking_policy_1.decideOAuthResolution)({ ...NO_MATCH, hasLinkedAccount: true }, UNVERIFIED_IDENTITY, { allowAccountCreation: false, linkByVerifiedEmail: false });
+            (0, chai_1.expect)(resolution).to.equal("use-linked");
+        });
+    });
+    describe("an account already holding the same e-mail", () => {
+        const sameEmailMatch = {
+            ...NO_MATCH,
+            hasAccountWithSameEmail: true,
+            isSameEmailAccountValidated: true,
+        };
+        it("is linked when the provider verified the e-mail", () => {
+            const resolution = (0, linking_policy_1.decideOAuthResolution)(sameEmailMatch, VERIFIED_IDENTITY, OPEN_POLICY);
+            (0, chai_1.expect)(resolution).to.equal("link-existing");
+        });
+        it("is never linked on an unverified provider e-mail", () => {
+            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)(sameEmailMatch, UNVERIFIED_IDENTITY, OPEN_POLICY), "error.oauth.email_not_verified");
+        });
+        it("is never linked while the local account is unvalidated", () => {
+            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)({ ...sameEmailMatch, isSameEmailAccountValidated: false }, VERIFIED_IDENTITY, OPEN_POLICY), "error.oauth.account_not_validated");
+        });
+        it("is reclaimed, not joined, when an invitation targets an unvalidated account", () => {
+            const resolution = (0, linking_policy_1.decideOAuthResolution)({
+                ...sameEmailMatch,
+                isSameEmailAccountValidated: false,
+                hasValidInvitation: true,
+            }, VERIFIED_IDENTITY, CLOSED_POLICY);
+            (0, chai_1.expect)(resolution).to.equal("claim-unvalidated");
+        });
+        it("never reclaims an unvalidated account that holds a workspace seat, even with an invitation", () => {
+            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)({
+                ...sameEmailMatch,
+                isSameEmailAccountValidated: false,
+                hasValidInvitation: true,
+                belongsToWorkspace: true,
+            }, VERIFIED_IDENTITY, CLOSED_POLICY), "error.oauth.account_not_validated");
+        });
+        it("never reclaims a validated account, invitation or not", () => {
+            const resolution = (0, linking_policy_1.decideOAuthResolution)({ ...sameEmailMatch, hasValidInvitation: true }, VERIFIED_IDENTITY, OPEN_POLICY);
+            (0, chai_1.expect)(resolution).to.equal("link-existing");
+        });
+        it("is never linked when the instance disabled e-mail linking", () => {
+            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)(sameEmailMatch, VERIFIED_IDENTITY, {
+                allowAccountCreation: true,
+                linkByVerifiedEmail: false,
+            }), "error.oauth.linking_disabled");
+        });
+    });
+    describe("an unknown identity", () => {
+        it("creates an account when the instance opted into provider sign-up", () => {
+            const resolution = (0, linking_policy_1.decideOAuthResolution)(NO_MATCH, VERIFIED_IDENTITY, OPEN_POLICY);
+            (0, chai_1.expect)(resolution).to.equal("create");
+        });
+        it("creates nothing when provider sign-up is disabled", () => {
+            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)(NO_MATCH, VERIFIED_IDENTITY, CLOSED_POLICY), "error.oauth.registration_disabled");
+        });
+        it("creates the invited account even when provider sign-up is disabled", () => {
+            const resolution = (0, linking_policy_1.decideOAuthResolution)({ ...NO_MATCH, hasValidInvitation: true }, VERIFIED_IDENTITY, CLOSED_POLICY);
+            (0, chai_1.expect)(resolution).to.equal("create");
+        });
+        it("still refuses an invitation carried by an unverified e-mail", () => {
+            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)({ ...NO_MATCH, hasValidInvitation: true }, UNVERIFIED_IDENTITY, CLOSED_POLICY), "error.oauth.email_not_verified");
+        });
+        it("creates nothing on an unverified provider e-mail", () => {
+            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)(NO_MATCH, UNVERIFIED_IDENTITY, OPEN_POLICY), "error.oauth.email_not_verified");
+        });
+    });
+});
+//# sourceMappingURL=oauth-linking-policy.test.js.map

package/dist/test/unit/oauth-linking-policy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-linking-policy.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-linking-policy.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,+BAA8B;AAE9B,2EAGgD;AAGhD,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,QAAQ,GAAsB;IAClC,gBAAgB,EAAE,KAAK;IACvB,uBAAuB,EAAE,KAAK;IAC9B,2BAA2B,EAAE,KAAK;IAClC,kBAAkB,EAAE,KAAK;IACzB,kBAAkB,EAAE,KAAK;CAC1B,CAAC;AAEF,MAAM,aAAa,GAAgB;IACjC,oBAAoB,EAAE,KAAK;IAC3B,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AAEF,MAAM,iBAAiB,GAAqB;IAC1C,iBAAiB,EAAE,IAAI;IACvB,KAAK,EAAE,eAAe;IACtB,eAAe,EAAE,IAAI;IACrB,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,MAAM,mBAAmB,GAAqB;IAC5C,GAAG,iBAAiB;IACpB,eAAe,EAAE,KAAK;CACvB,CAAC;AAEF,MAAM,WAAW,GAAgB;IAC/B,oBAAoB,EAAE,IAAI;IAC1B,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AAEF,SAAS,aAAa,CAAC,GAAkB,EAAE,eAAuB;IAChE,IAAI,CAAC;QACH,GAAG,EAAE,CAAC;IACR,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACnE,IAAA,aAAM,EAAE,KAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,aAAM,CAAC,IAAI,CAAC,4BAA4B,eAAe,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAClD,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,EACvC,mBAAmB,EACnB,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAC5D,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAC1D,MAAM,cAAc,GAAsB;YACxC,GAAG,QAAQ;YACX,uBAAuB,EAAE,IAAI;YAC7B,2BAA2B,EAAE,IAAI;SAClC,CAAC;QAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,cAAc,EACd,iBAAiB,EACjB,WAAW,CACZ,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EACnB,cAAc,EACd,mBAAmB,EACnB,WAAW,CACZ,EACH,gCAAgC,CACjC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EACnB,EAAE,GAAG,cAAc,EAAE,2BAA2B,EAAE,KAAK,EAAE,EACzD,iBAAiB,EACjB,WAAW,CACZ,EACH,mCAAmC,CACpC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;YACrF,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC;gBACE,GAAG,cAAc;gBACjB,2BAA2B,EAAE,KAAK;gBAClC,kBAAkB,EAAE,IAAI;aACzB,EACD,iBAAiB,EACjB,aAAa,CACd,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAKH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;YACpG,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EACnB;gBACE,GAAG,cAAc;gBACjB,2BAA2B,EAAE,KAAK;gBAClC,kBAAkB,EAAE,IAAI;gBACxB,kBAAkB,EAAE,IAAI;aACzB,EACD,iBAAiB,EACjB,aAAa,CACd,EACH,mCAAmC,CACpC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,EAAE,GAAG,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAC/C,iBAAiB,EACjB,WAAW,CACZ,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EAAC,cAAc,EAAE,iBAAiB,EAAE;gBACvD,oBAAoB,EAAE,IAAI;gBAC1B,mBAAmB,EAAE,KAAK;aAC3B,CAAC,EACJ,8BAA8B,CAC/B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC1E,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,QAAQ,EACR,iBAAiB,EACjB,WAAW,CACZ,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,aAAa,CACX,GAAG,EAAE,CAAC,IAAA,sCAAqB,EAAC,QAAQ,EAAE,iBAAiB,EAAE,aAAa,CAAC,EACvE,mCAAmC,CACpC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;YAC5E,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,EACzC,iBAAiB,EACjB,aAAa,CACd,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EACnB,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,EACzC,mBAAmB,EACnB,aAAa,CACd,EACH,gCAAgC,CACjC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,aAAa,CACX,GAAG,EAAE,CAAC,IAAA,sCAAqB,EAAC,QAAQ,EAAE,mBAAmB,EAAE,WAAW,CAAC,EACvE,gCAAgC,CACjC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-provider-identity.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/oauth-provider-identity.test.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const chai_1 = require("chai");
+const providers_1 = require("../../routes/auth/oauth/providers");
+const HTTP_BAD_GATEWAY = 502;
+const ACCESS_TOKEN = "provider-access-token";
+const originalFetch = globalThis.fetch;
+function stubFetch(responses) {
+    globalThis.fetch = (async (input) => {
+        const url = String(input);
+        const match = Object.entries(responses).find(([path]) => url.includes(path));
+        if (!match) {
+            return { ok: false, json: async () => ({}) };
+        }
+        return { ok: true, json: async () => match[1] };
+    });
+}
+async function expectRefusal(run, expectedMessage) {
+    try {
+        await run();
+    }
+    catch (error) {
+        (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
+        (0, chai_1.expect)(error.getStatus()).to.equal(HTTP_BAD_GATEWAY);
+        (0, chai_1.expect)(error.getBody()).to.equal(expectedMessage);
+        return;
+    }
+    chai_1.expect.fail(`expected a refusal with "${expectedMessage}"`);
+}
+describe("[unit] oauth provider identity parsing", () => {
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+    });
+    describe("github", () => {
+        const fetchIdentity = () => providers_1.OAUTH_PROVIDERS.github.fetchIdentity(ACCESS_TOKEN);
+        it("builds the identity from the primary verified e-mail", async () => {
+            stubFetch({
+                "/user/emails": [
+                    { email: "old@acme.dev", primary: false, verified: true },
+                    { email: "alex@acme.dev", primary: true, verified: true },
+                ],
+                "/user": { id: 42, login: "alex", name: "Alex" },
+            });
+            (0, chai_1.expect)(await fetchIdentity()).to.deep.equal({
+                providerAccountId: "42",
+                email: "alex@acme.dev",
+                isEmailVerified: true,
+                name: "Alex",
+            });
+        });
+        it("never verifies an e-mail the provider did not flag", async () => {
+            stubFetch({
+                "/user/emails": [{ email: "alex@acme.dev", primary: true }],
+                "/user": { id: 42, login: "alex", name: null },
+            });
+            const identity = await fetchIdentity();
+            (0, chai_1.expect)(identity.isEmailVerified).to.equal(false);
+            (0, chai_1.expect)(identity.name).to.equal("alex");
+        });
+        it("refuses a response without an account id", async () => {
+            stubFetch({
+                "/user/emails": [{ email: "alex@acme.dev", primary: true }],
+                "/user": { login: "alex" },
+            });
+            await expectRefusal(fetchIdentity, "error.oauth.identity_malformed");
+        });
+        it("refuses an empty-string account id", async () => {
+            stubFetch({
+                "/user/emails": [{ email: "alex@acme.dev", primary: true }],
+                "/user": { id: "", login: "alex" },
+            });
+            await expectRefusal(fetchIdentity, "error.oauth.identity_malformed");
+        });
+        it("refuses a malformed e-mail list", async () => {
+            stubFetch({
+                "/user/emails": { message: "rate limited" },
+                "/user": { id: 42, login: "alex" },
+            });
+            await expectRefusal(fetchIdentity, "error.oauth.email_unavailable");
+        });
+        it("refuses an e-mail entry without an address", async () => {
+            stubFetch({
+                "/user/emails": [{ primary: true, verified: true }],
+                "/user": { id: 42, login: "alex" },
+            });
+            await expectRefusal(fetchIdentity, "error.oauth.email_unavailable");
+        });
+    });
+    describe("google", () => {
+        const fetchIdentity = () => providers_1.OAUTH_PROVIDERS.google.fetchIdentity(ACCESS_TOKEN);
+        it("builds the identity from the userinfo claims", async () => {
+            stubFetch({
+                userinfo: {
+                    sub: "google-sub-1",
+                    email: "alex@acme.dev",
+                    email_verified: true,
+                    name: "Alex",
+                },
+            });
+            (0, chai_1.expect)(await fetchIdentity()).to.deep.equal({
+                providerAccountId: "google-sub-1",
+                email: "alex@acme.dev",
+                isEmailVerified: true,
+                name: "Alex",
+            });
+        });
+        it("refuses a response without a subject", async () => {
+            stubFetch({
+                userinfo: { email: "alex@acme.dev", email_verified: true },
+            });
+            await expectRefusal(fetchIdentity, "error.oauth.identity_malformed");
+        });
+        it("never verifies an e-mail without the explicit claim", async () => {
+            stubFetch({
+                userinfo: { sub: "google-sub-1", email: "alex@acme.dev" },
+            });
+            (0, chai_1.expect)((await fetchIdentity()).isEmailVerified).to.equal(false);
+        });
+        it("refuses a response without an e-mail", async () => {
+            stubFetch({ userinfo: { sub: "google-sub-1" } });
+            await expectRefusal(fetchIdentity, "error.oauth.email_unavailable");
+        });
+    });
+});
+//# sourceMappingURL=oauth-provider-identity.test.js.map

package/dist/test/unit/oauth-provider-identity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider-identity.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-provider-identity.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,+BAA8B;AAC9B,iEAAoE;AAEpE,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAI7C,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;AAEvC,SAAS,SAAS,CAAC,SAAyB;IAC1C,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CACtD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnB,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC,CAAiB,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAA2B,EAC3B,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrE,IAAA,aAAM,EAAE,KAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,aAAM,CAAC,IAAI,CAAC,4BAA4B,eAAe,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,SAAS,CAAC,GAAG,EAAE;QACb,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,2BAAe,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAErD,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,SAAS,CAAC;gBACR,cAAc,EAAE;oBACd,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACzD,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC1D;gBACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;aACjD,CAAC,CAAC;YAEH,IAAA,aAAM,EAAC,MAAM,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC1C,iBAAiB,EAAE,IAAI;gBACvB,KAAK,EAAE,eAAe;gBACtB,eAAe,EAAE,IAAI;gBACrB,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,SAAS,CAAC;gBACR,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;aAC/C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;YACvC,IAAA,aAAM,EAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjD,IAAA,aAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,SAAS,CAAC;gBACR,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;aAC3B,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,SAAS,CAAC;gBACR,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,SAAS,CAAC;gBACR,cAAc,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBAC3C,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,SAAS,CAAC;gBACR,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACnD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,2BAAe,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAErD,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,SAAS,CAAC;gBACR,QAAQ,EAAE;oBACR,GAAG,EAAE,cAAc;oBACnB,KAAK,EAAE,eAAe;oBACtB,cAAc,EAAE,IAAI;oBACpB,IAAI,EAAE,MAAM;iBACb;aACF,CAAC,CAAC;YAEH,IAAA,aAAM,EAAC,MAAM,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC1C,iBAAiB,EAAE,cAAc;gBACjC,KAAK,EAAE,eAAe;gBACtB,eAAe,EAAE,IAAI;gBACrB,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,SAAS,CAAC;gBACR,QAAQ,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,IAAI,EAAE;aAC3D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,SAAS,CAAC;gBACR,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE;aAC1D,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YACjD,MAAM,aAAa,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-relay.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/oauth-relay.test.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const chai_1 = require("chai");
+const relay_1 = require("../../routes/auth/oauth/relay");
+const HTTP_UNAUTHORIZED = 401;
+function expectRefusal(run) {
+    try {
+        run();
+    }
+    catch (error) {
+        (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
+        (0, chai_1.expect)(error.getStatus()).to.equal(HTTP_UNAUTHORIZED);
+        (0, chai_1.expect)(error.getBody()).to.equal("error.oauth.relay_required");
+        return;
+    }
+    chai_1.expect.fail("expected the relay check to refuse");
+}
+describe("[unit] oauth relay", () => {
+    it("derives a stable secret bound to the instance", () => {
+        (0, chai_1.expect)((0, relay_1.deriveOAuthRelaySecret)()).to.equal((0, relay_1.deriveOAuthRelaySecret)());
+        (0, chai_1.expect)((0, relay_1.deriveOAuthRelaySecret)()).to.have.length.greaterThan(0);
+    });
+    it("accepts the derived secret", () => {
+        (0, chai_1.expect)(() => (0, relay_1.assertOAuthRelay)((0, relay_1.deriveOAuthRelaySecret)())).to.not.throw();
+    });
+    it("refuses a missing header", () => {
+        expectRefusal(() => (0, relay_1.assertOAuthRelay)(undefined));
+    });
+    it("refuses an empty header", () => {
+        expectRefusal(() => (0, relay_1.assertOAuthRelay)(""));
+    });
+    it("refuses a wrong secret", () => {
+        expectRefusal(() => (0, relay_1.assertOAuthRelay)("not-the-relay-secret"));
+    });
+    it("never derives the raw instance secret", () => {
+        (0, chai_1.expect)((0, relay_1.deriveOAuthRelaySecret)()).to.not.contain("test-jwt-secret");
+    });
+});
+//# sourceMappingURL=oauth-relay.test.js.map