@antelopejs/dms 0.9.2 → 0.9.3

package/dist/test/unit/oauth-account-guard.test.js

@@ -1,96 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const interface_api_1 = require("@antelopejs/interface-api");
-const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
-const chai_1 = require("chai");
-const db_1 = require("@antelopejs/interface-dms/db");
-const identity_resolution_1 = require("../../routes/auth/oauth/identity-resolution");
-const HTTP_FORBIDDEN = 403;
-const ACCOUNT_NOT_VALIDATED = "error.oauth.account_not_validated";
-const WORKSPACE_ID = "oauth-guard-workspace";
-const PROVIDER = "google";
-const HOLDER_NAME = "Rightful Holder";
-const HOLDER_PASSWORD = "holder-password-hash";
-const HOLDER_AUTH_KEY = "holder-auth-key";
-const CLOSED_POLICY = {
-    allowAccountCreation: false,
-    linkByVerifiedEmail: true,
-};
-function buildUnvalidatedAccount(id, email) {
-    return {
-        _id: id,
-        email,
-        name: HOLDER_NAME,
-        password: HOLDER_PASSWORD,
-        authKey: HOLDER_AUTH_KEY,
-        isValidated: false,
-        language: "en",
-    };
-}
-function buildIdentity(email) {
-    return {
-        providerAccountId: "oauth-guard-42",
-        email,
-        isEmailVerified: true,
-        name: "Invitee",
-    };
-}
-async function joinWorkspace(userId) {
-    await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, WORKSPACE_ID).insert({
-        _id: `${WORKSPACE_ID}:${userId}`,
-        userId,
-        roleIds: [],
-        isTenantOwner: false,
-        joinedAt: new Date(),
-        invitedBy: null,
-    });
-}
-async function attemptResolve(existingUser) {
-    const updatedUsers = [];
-    const userModel = {
-        getByEmail: async (lookup) => lookup === existingUser.email ? existingUser : undefined,
-        get: async () => existingUser,
-        update: async (user) => {
-            updatedUsers.push(user);
-        },
-        insert: async () => {
-            throw new Error("resolution must not create a second account");
-        },
-    };
-    try {
-        const result = await (0, identity_resolution_1.resolveOAuthUser)(userModel, {
-            provider: PROVIDER,
-            identity: buildIdentity(existingUser.email),
-            policy: CLOSED_POLICY,
-            hasValidInvitation: true,
-            language: "fr",
-        });
-        return { error: undefined, result, updatedUsers };
-    }
-    catch (error) {
-        return { error, result: undefined, updatedUsers };
-    }
-}
-describe("[unit] auth/oauth — claiming an existing account", () => {
-    it("refuses an unvalidated account that already belongs to a workspace", async () => {
-        const provisioned = buildUnvalidatedAccount("oauth-guard-provisioned", "provisioned@acme.dev");
-        await joinWorkspace(provisioned._id);
-        const attempt = await attemptResolve(provisioned);
-        (0, chai_1.expect)(attempt.error).to.be.instanceOf(interface_api_1.HTTPResult);
-        const refusal = attempt.error;
-        (0, chai_1.expect)(refusal.getStatus()).to.equal(HTTP_FORBIDDEN);
-        (0, chai_1.expect)(refusal.getBody()).to.equal(ACCOUNT_NOT_VALIDATED);
-        (0, chai_1.expect)(attempt.updatedUsers).to.deep.equal([]);
-        (0, chai_1.expect)(provisioned.password).to.equal(HOLDER_PASSWORD);
-        (0, chai_1.expect)(provisioned.authKey).to.equal(HOLDER_AUTH_KEY);
-    });
-    it("still reclaims a genuine draft: unvalidated and in no workspace", async () => {
-        const draft = buildUnvalidatedAccount("oauth-guard-draft", "draft@acme.dev");
-        const attempt = await attemptResolve(draft);
-        (0, chai_1.expect)(attempt.error).to.equal(undefined);
-        (0, chai_1.expect)(attempt.result?.isRegistration).to.equal(true);
-        (0, chai_1.expect)(attempt.updatedUsers).to.have.length.greaterThan(0);
-        (0, chai_1.expect)(draft.authKey).to.not.equal(HOLDER_AUTH_KEY);
-    });
-});
-//# sourceMappingURL=oauth-account-guard.test.js.map

package/dist/test/unit/oauth-account-guard.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-account-guard.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-account-guard.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,6FAAqE;AACrE,+BAA8B;AAC9B,qDAAiE;AAGjE,qFAA+E;AAG/E,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAGlE,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAC1B,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAE1C,MAAM,aAAa,GAAgB;IACjC,oBAAoB,EAAE,KAAK;IAC3B,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AAEF,SAAS,uBAAuB,CAAC,EAAU,EAAE,KAAa;IACxD,OAAO;QACL,GAAG,EAAE,EAAE;QACP,KAAK;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,eAAe;QACxB,WAAW,EAAE,KAAK;QAClB,QAAQ,EAAE,IAAI;KACI,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO;QACL,iBAAiB,EAAE,gBAAgB;QACnC,KAAK;QACL,eAAe,EAAE,IAAI;QACrB,IAAI,EAAE,SAAS;KAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC;QACrD,GAAG,EAAE,GAAG,YAAY,IAAI,MAAM,EAAE;QAChC,MAAM;QACN,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,IAAI,IAAI,EAAE;QACpB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;AACL,CAAC;AAaD,KAAK,UAAU,cAAc,CAAC,YAAkB;IAC9C,MAAM,YAAY,GAAW,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE,CACnC,MAAM,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC1D,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;QAC7B,MAAM,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE;YAC3B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;KACsB,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,sCAAgB,EAAC,SAAS,EAAE;YAC/C,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC;YAC3C,MAAM,EAAE,aAAa;YACrB,kBAAkB,EAAE,IAAI;YACxB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAIhE,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,WAAW,GAAG,uBAAuB,CACzC,yBAAyB,EACzB,sBAAsB,CACvB,CAAC;QACF,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;QAElD,IAAA,aAAM,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAmB,CAAC;QAC5C,IAAA,aAAM,EAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACrD,IAAA,aAAM,EAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC1D,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,KAAK,GAAG,uBAAuB,CACnC,mBAAmB,EACnB,gBAAgB,CACjB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAE5C,IAAA,aAAM,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,IAAA,aAAM,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAA,aAAM,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-claim-account.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/oauth-claim-account.test.js

@@ -1,90 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
-const db_1 = require("@antelopejs/interface-dms/auth/db");
-const chai_1 = require("chai");
-const identity_resolution_1 = require("../../routes/auth/oauth/identity-resolution");
-const IDENTITY = {
-    providerAccountId: "42",
-    email: "alex@acme.dev",
-    isEmailVerified: true,
-    name: "Alex",
-};
-function buildUnvalidatedUser() {
-    return {
-        _id: "user-1",
-        email: "alex@acme.dev",
-        name: "Squatter",
-        language: "en",
-        password: "squatter-password",
-        authKey: "squatter-auth-key",
-        isValidated: false,
-        validationToken: "ABC123",
-        validationRequestedAt: new Date(0),
-        forgotPasswordToken: "reset-me",
-        forgotPasswordRequestedAt: new Date(0),
-        twoFactorMethods: ["totp"],
-        twoFactorSecret: "totp-secret",
-        twoFactorPendingSecret: "pending-secret",
-        twoFactorBackupCodes: ["backup-1"],
-        twoFactorEmailCode: "999999",
-        twoFactorEmailCodeRequestedAt: new Date(0),
-    };
-}
-describe("[unit] oauth claim of an unvalidated account", () => {
-    async function claim() {
-        const user = buildUnvalidatedUser();
-        let updated = false;
-        const userModel = {
-            update: async () => {
-                updated = true;
-            },
-        };
-        await (0, identity_resolution_1.claimUnvalidatedAccount)(userModel, user, IDENTITY, "fr");
-        return { user, updated };
-    }
-    it("persists the claim", async () => {
-        const { updated } = await claim();
-        (0, chai_1.expect)(updated).to.equal(true);
-    });
-    it("leaves no credential of the previous holder behind", async () => {
-        const { user } = await claim();
-        (0, chai_1.expect)(user.password).to.equal(null);
-        (0, chai_1.expect)(user.authKey).to.not.equal("squatter-auth-key");
-        (0, chai_1.expect)(user.authKey).to.have.length.greaterThan(0);
-        (0, chai_1.expect)(user.validationToken).to.equal(null);
-        (0, chai_1.expect)(user.validationRequestedAt).to.equal(null);
-        (0, chai_1.expect)(user.forgotPasswordToken).to.equal(null);
-        (0, chai_1.expect)(user.forgotPasswordRequestedAt).to.equal(null);
-    });
-    it("leaves no second factor of the previous holder behind", async () => {
-        const { user } = await claim();
-        (0, chai_1.expect)(user.twoFactorMethods).to.deep.equal([]);
-        (0, chai_1.expect)(user.twoFactorSecret).to.equal(null);
-        (0, chai_1.expect)(user.twoFactorPendingSecret).to.equal(null);
-        (0, chai_1.expect)(user.twoFactorBackupCodes).to.deep.equal([]);
-        (0, chai_1.expect)(user.twoFactorEmailCode).to.equal(null);
-        (0, chai_1.expect)(user.twoFactorEmailCodeRequestedAt).to.equal(null);
-    });
-    it("hands the account to the invitee, validated", async () => {
-        const { user } = await claim();
-        (0, chai_1.expect)(user.isValidated).to.equal(true);
-        (0, chai_1.expect)(user.name).to.equal("Alex");
-        (0, chai_1.expect)(user.language).to.equal("fr");
-    });
-    it("leaves no provider binding of the previous holder behind", async () => {
-        const identityModel = (0, interface_database_decorators_1.GetModel)(db_1.UserExternalIdentityModel);
-        await identityModel.insert({
-            _id: "google:previous-holder",
-            userId: "user-1",
-            provider: "google",
-            providerAccountId: "previous-holder",
-            email: "alex@acme.dev",
-            createdAt: new Date(),
-            lastLoginAt: new Date(),
-        });
-        await claim();
-        (0, chai_1.expect)(await identityModel.getByUserId("user-1")).to.deep.equal([]);
-    });
-});
-//# sourceMappingURL=oauth-claim-account.test.js.map

package/dist/test/unit/oauth-claim-account.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-claim-account.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-claim-account.test.ts"],"names":[],"mappings":";;AAAA,6FAAqE;AACrE,0DAI2C;AAC3C,+BAA8B;AAC9B,qFAAsF;AAGtF,MAAM,QAAQ,GAAqB;IACjC,iBAAiB,EAAE,IAAI;IACvB,KAAK,EAAE,eAAe;IACtB,eAAe,EAAE,IAAI;IACrB,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,SAAS,oBAAoB;IAC3B,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,QAAQ;QACzB,qBAAqB,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QAClC,mBAAmB,EAAE,UAAU;QAC/B,yBAAyB,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;QACtC,gBAAgB,EAAE,CAAC,MAAM,CAAC;QAC1B,eAAe,EAAE,aAAa;QAC9B,sBAAsB,EAAE,gBAAgB;QACxC,oBAAoB,EAAE,CAAC,UAAU,CAAC;QAClC,kBAAkB,EAAE,QAAQ;QAC5B,6BAA6B,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;KACxB,CAAC;AACvB,CAAC;AAED,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,KAAK,UAAU,KAAK;QAClB,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,SAAS,GAAG;YAChB,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;SACsB,CAAC;QAE1B,MAAM,IAAA,6CAAuB,EAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAClC,IAAA,aAAM,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAE/B,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAA,aAAM,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACnD,IAAA,aAAM,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAA,aAAM,EAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,IAAA,aAAM,EAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAE/B,IAAA,aAAM,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAA,aAAM,EAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAA,aAAM,EAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,IAAA,aAAM,EAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAE/B,IAAA,aAAM,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAA,aAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,IAAA,aAAM,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,aAAa,GAAG,IAAA,wCAAQ,EAAC,8BAAyB,CAAC,CAAC;QAC1D,MAAM,aAAa,CAAC,MAAM,CAAC;YACzB,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,QAAQ;YAClB,iBAAiB,EAAE,iBAAiB;YACpC,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,WAAW,EAAE,IAAI,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,MAAM,KAAK,EAAE,CAAC;QAEd,IAAA,aAAM,EAAC,MAAM,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-config.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/oauth-config.test.js

@@ -1,112 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const interface_api_1 = require("@antelopejs/interface-api");
-const chai_1 = require("chai");
-const index_1 = require("../../index");
-const authorize_url_1 = require("../../routes/auth/oauth/authorize-url");
-const config_1 = require("../../routes/auth/oauth/config");
-const HTTP_NOT_FOUND = 404;
-const CREDENTIALS = { clientId: "client-id", clientSecret: "client-secret" };
-describe("[unit] oauth config", () => {
-    let previousOAuth;
-    beforeEach(() => {
-        previousOAuth = (0, index_1.getAuthConfig)().oauth;
-    });
-    afterEach(() => {
-        (0, index_1.getAuthConfig)().oauth = previousOAuth;
-    });
-    function configure(oauth) {
-        (0, index_1.getAuthConfig)().oauth = oauth;
-    }
-    describe("enabled providers", () => {
-        it("offers nothing when the instance configured nothing", () => {
-            configure({});
-            (0, chai_1.expect)((0, config_1.listEnabledOAuthProviders)()).to.deep.equal([]);
-        });
-        it("only offers providers holding both credentials", () => {
-            configure({
-                providers: {
-                    github: CREDENTIALS,
-                    google: { clientId: "only-an-id", clientSecret: "" },
-                },
-            });
-            (0, chai_1.expect)((0, config_1.listEnabledOAuthProviders)()).to.deep.equal([
-                { id: "github", label: "GitHub", icon: "i-ph-github-logo" },
-            ]);
-        });
-        it("ignores an unknown provider id", () => {
-            configure({ providers: { gitlab: CREDENTIALS } });
-            (0, chai_1.expect)((0, config_1.listEnabledOAuthProviders)()).to.deep.equal([]);
-        });
-        it("refuses to start a flow on a provider without credentials", () => {
-            configure({ providers: {} });
-            try {
-                (0, config_1.getEnabledOAuthProvider)("github");
-            }
-            catch (error) {
-                (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
-                (0, chai_1.expect)(error.getStatus()).to.equal(HTTP_NOT_FOUND);
-                return;
-            }
-            chai_1.expect.fail("expected a disabled provider to be refused");
-        });
-    });
-    describe("policy defaults", () => {
-        it("keeps provider sign-up off and e-mail linking on", () => {
-            configure({});
-            (0, chai_1.expect)((0, config_1.resolveOAuthPolicy)()).to.deep.equal({
-                allowAccountCreation: false,
-                linkByVerifiedEmail: true,
-            });
-        });
-        it("honours an explicit opt-in", () => {
-            configure({ allowAccountCreation: true, linkByVerifiedEmail: false });
-            (0, chai_1.expect)((0, config_1.resolveOAuthPolicy)()).to.deep.equal({
-                allowAccountCreation: true,
-                linkByVerifiedEmail: false,
-            });
-        });
-    });
-    describe("authorize url", () => {
-        it("carries the client id, callback, scopes and state", () => {
-            configure({
-                providers: { github: CREDENTIALS },
-                callbackBaseUrl: "https://console.example.dev",
-            });
-            const { authorizeUrl, state } = (0, authorize_url_1.buildOAuthAuthorizeUrl)("github");
-            const url = new URL(authorizeUrl);
-            (0, chai_1.expect)(url.origin + url.pathname).to.equal("https://github.com/login/oauth/authorize");
-            (0, chai_1.expect)(url.searchParams.get("client_id")).to.equal("client-id");
-            (0, chai_1.expect)(url.searchParams.get("redirect_uri")).to.equal("https://console.example.dev/auth/oauth/github/callback");
-            (0, chai_1.expect)(url.searchParams.get("scope")).to.equal("read:user user:email");
-            (0, chai_1.expect)(url.searchParams.get("response_type")).to.equal("code");
-            (0, chai_1.expect)(url.searchParams.get("state")).to.equal(state);
-        });
-        it("never leaks the client secret into the browser-facing url", () => {
-            configure({
-                providers: { github: CREDENTIALS },
-                callbackBaseUrl: "https://console.example.dev",
-            });
-            (0, chai_1.expect)((0, authorize_url_1.buildOAuthAuthorizeUrl)("github").authorizeUrl).to.not.contain("client-secret");
-        });
-        it("uses the scopes the instance overrode", () => {
-            configure({
-                providers: {
-                    github: { ...CREDENTIALS, scopes: ["read:user"] },
-                },
-                callbackBaseUrl: "https://console.example.dev",
-            });
-            const url = new URL((0, authorize_url_1.buildOAuthAuthorizeUrl)("github").authorizeUrl);
-            (0, chai_1.expect)(url.searchParams.get("scope")).to.equal("read:user");
-        });
-        it("trims a trailing slash off the configured callback origin", () => {
-            configure({
-                providers: { google: CREDENTIALS },
-                callbackBaseUrl: "https://console.example.dev/",
-            });
-            const url = new URL((0, authorize_url_1.buildOAuthAuthorizeUrl)("google").authorizeUrl);
-            (0, chai_1.expect)(url.searchParams.get("redirect_uri")).to.equal("https://console.example.dev/auth/oauth/google/callback");
-        });
-    });
-});
-//# sourceMappingURL=oauth-config.test.js.map

package/dist/test/unit/oauth-config.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-config.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-config.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,+BAA8B;AAC9B,uCAA8D;AAC9D,yEAA+E;AAC/E,2DAIwC;AAExC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AAE7E,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,IAAI,aAAsC,CAAC;IAE3C,UAAU,CAAC,GAAG,EAAE;QACd,aAAa,GAAG,IAAA,qBAAa,GAAE,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAA,qBAAa,GAAE,CAAC,KAAK,GAAG,aAAa,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,SAAS,SAAS,CAAC,KAAkB;QACnC,IAAA,qBAAa,GAAE,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,CAAC;IAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC7D,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,IAAA,aAAM,EAAC,IAAA,kCAAyB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,SAAS,CAAC;gBACR,SAAS,EAAE;oBACT,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE;iBACrD;aACF,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,IAAA,kCAAyB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAChD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YAClD,IAAA,aAAM,EAAC,IAAA,kCAAyB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAA,gCAAuB,EAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;gBAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,aAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,IAAA,aAAM,EAAC,IAAA,2BAAkB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBACzC,oBAAoB,EAAE,KAAK;gBAC3B,mBAAmB,EAAE,IAAI;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,SAAS,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,IAAA,aAAM,EAAC,IAAA,2BAAkB,GAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBACzC,oBAAoB,EAAE,IAAI;gBAC1B,mBAAmB,EAAE,KAAK;aAC3B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,SAAS,CAAC;gBACR,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;gBAClC,eAAe,EAAE,6BAA6B;aAC/C,CAAC,CAAC;YAEH,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,sCAAsB,EAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YAElC,IAAA,aAAM,EAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CACxC,0CAA0C,CAC3C,CAAC;YACF,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAChE,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CACnD,wDAAwD,CACzD,CAAC;YACF,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACvE,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,SAAS,CAAC;gBACR,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;gBAClC,eAAe,EAAE,6BAA6B;aAC/C,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,IAAA,sCAAsB,EAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAClE,eAAe,CAChB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,SAAS,CAAC;gBACR,SAAS,EAAE;oBACT,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;iBAClD;gBACD,eAAe,EAAE,6BAA6B;aAC/C,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAA,sCAAsB,EAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC;YACnE,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,SAAS,CAAC;gBACR,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;gBAClC,eAAe,EAAE,8BAA8B;aAChD,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAA,sCAAsB,EAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC;YACnE,IAAA,aAAM,EAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CACnD,wDAAwD,CACzD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-linking-policy.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/oauth-linking-policy.test.js

@@ -1,114 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const interface_api_1 = require("@antelopejs/interface-api");
-const chai_1 = require("chai");
-const linking_policy_1 = require("../../routes/auth/oauth/linking-policy");
-const HTTP_FORBIDDEN = 403;
-const NO_MATCH = {
-    hasLinkedAccount: false,
-    hasAccountWithSameEmail: false,
-    isSameEmailAccountValidated: false,
-    hasValidInvitation: false,
-    belongsToWorkspace: false,
-};
-const CLOSED_POLICY = {
-    allowAccountCreation: false,
-    linkByVerifiedEmail: true,
-};
-const VERIFIED_IDENTITY = {
-    providerAccountId: "42",
-    email: "Alex@Acme.dev",
-    isEmailVerified: true,
-    name: "Alex",
-};
-const UNVERIFIED_IDENTITY = {
-    ...VERIFIED_IDENTITY,
-    isEmailVerified: false,
-};
-const OPEN_POLICY = {
-    allowAccountCreation: true,
-    linkByVerifiedEmail: true,
-};
-function expectRefusal(run, expectedMessage) {
-    try {
-        run();
-    }
-    catch (error) {
-        (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
-        (0, chai_1.expect)(error.getStatus()).to.equal(HTTP_FORBIDDEN);
-        (0, chai_1.expect)(error.getBody()).to.equal(expectedMessage);
-        return;
-    }
-    chai_1.expect.fail(`expected a refusal with "${expectedMessage}"`);
-}
-describe("[unit] oauth linking policy", () => {
-    describe("an already linked provider account", () => {
-        it("wins over every other rule, even an unverified e-mail", () => {
-            const resolution = (0, linking_policy_1.decideOAuthResolution)({ ...NO_MATCH, hasLinkedAccount: true }, UNVERIFIED_IDENTITY, { allowAccountCreation: false, linkByVerifiedEmail: false });
-            (0, chai_1.expect)(resolution).to.equal("use-linked");
-        });
-    });
-    describe("an account already holding the same e-mail", () => {
-        const sameEmailMatch = {
-            ...NO_MATCH,
-            hasAccountWithSameEmail: true,
-            isSameEmailAccountValidated: true,
-        };
-        it("is linked when the provider verified the e-mail", () => {
-            const resolution = (0, linking_policy_1.decideOAuthResolution)(sameEmailMatch, VERIFIED_IDENTITY, OPEN_POLICY);
-            (0, chai_1.expect)(resolution).to.equal("link-existing");
-        });
-        it("is never linked on an unverified provider e-mail", () => {
-            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)(sameEmailMatch, UNVERIFIED_IDENTITY, OPEN_POLICY), "error.oauth.email_not_verified");
-        });
-        it("is never linked while the local account is unvalidated", () => {
-            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)({ ...sameEmailMatch, isSameEmailAccountValidated: false }, VERIFIED_IDENTITY, OPEN_POLICY), "error.oauth.account_not_validated");
-        });
-        it("is reclaimed, not joined, when an invitation targets an unvalidated account", () => {
-            const resolution = (0, linking_policy_1.decideOAuthResolution)({
-                ...sameEmailMatch,
-                isSameEmailAccountValidated: false,
-                hasValidInvitation: true,
-            }, VERIFIED_IDENTITY, CLOSED_POLICY);
-            (0, chai_1.expect)(resolution).to.equal("claim-unvalidated");
-        });
-        it("never reclaims an unvalidated account that holds a workspace seat, even with an invitation", () => {
-            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)({
-                ...sameEmailMatch,
-                isSameEmailAccountValidated: false,
-                hasValidInvitation: true,
-                belongsToWorkspace: true,
-            }, VERIFIED_IDENTITY, CLOSED_POLICY), "error.oauth.account_not_validated");
-        });
-        it("never reclaims a validated account, invitation or not", () => {
-            const resolution = (0, linking_policy_1.decideOAuthResolution)({ ...sameEmailMatch, hasValidInvitation: true }, VERIFIED_IDENTITY, OPEN_POLICY);
-            (0, chai_1.expect)(resolution).to.equal("link-existing");
-        });
-        it("is never linked when the instance disabled e-mail linking", () => {
-            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)(sameEmailMatch, VERIFIED_IDENTITY, {
-                allowAccountCreation: true,
-                linkByVerifiedEmail: false,
-            }), "error.oauth.linking_disabled");
-        });
-    });
-    describe("an unknown identity", () => {
-        it("creates an account when the instance opted into provider sign-up", () => {
-            const resolution = (0, linking_policy_1.decideOAuthResolution)(NO_MATCH, VERIFIED_IDENTITY, OPEN_POLICY);
-            (0, chai_1.expect)(resolution).to.equal("create");
-        });
-        it("creates nothing when provider sign-up is disabled", () => {
-            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)(NO_MATCH, VERIFIED_IDENTITY, CLOSED_POLICY), "error.oauth.registration_disabled");
-        });
-        it("creates the invited account even when provider sign-up is disabled", () => {
-            const resolution = (0, linking_policy_1.decideOAuthResolution)({ ...NO_MATCH, hasValidInvitation: true }, VERIFIED_IDENTITY, CLOSED_POLICY);
-            (0, chai_1.expect)(resolution).to.equal("create");
-        });
-        it("still refuses an invitation carried by an unverified e-mail", () => {
-            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)({ ...NO_MATCH, hasValidInvitation: true }, UNVERIFIED_IDENTITY, CLOSED_POLICY), "error.oauth.email_not_verified");
-        });
-        it("creates nothing on an unverified provider e-mail", () => {
-            expectRefusal(() => (0, linking_policy_1.decideOAuthResolution)(NO_MATCH, UNVERIFIED_IDENTITY, OPEN_POLICY), "error.oauth.email_not_verified");
-        });
-    });
-});
-//# sourceMappingURL=oauth-linking-policy.test.js.map

package/dist/test/unit/oauth-linking-policy.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-linking-policy.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-linking-policy.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,+BAA8B;AAE9B,2EAGgD;AAGhD,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,QAAQ,GAAsB;IAClC,gBAAgB,EAAE,KAAK;IACvB,uBAAuB,EAAE,KAAK;IAC9B,2BAA2B,EAAE,KAAK;IAClC,kBAAkB,EAAE,KAAK;IACzB,kBAAkB,EAAE,KAAK;CAC1B,CAAC;AAEF,MAAM,aAAa,GAAgB;IACjC,oBAAoB,EAAE,KAAK;IAC3B,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AAEF,MAAM,iBAAiB,GAAqB;IAC1C,iBAAiB,EAAE,IAAI;IACvB,KAAK,EAAE,eAAe;IACtB,eAAe,EAAE,IAAI;IACrB,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,MAAM,mBAAmB,GAAqB;IAC5C,GAAG,iBAAiB;IACpB,eAAe,EAAE,KAAK;CACvB,CAAC;AAEF,MAAM,WAAW,GAAgB;IAC/B,oBAAoB,EAAE,IAAI;IAC1B,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AAEF,SAAS,aAAa,CAAC,GAAkB,EAAE,eAAuB;IAChE,IAAI,CAAC;QACH,GAAG,EAAE,CAAC;IACR,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACnE,IAAA,aAAM,EAAE,KAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,aAAM,CAAC,IAAI,CAAC,4BAA4B,eAAe,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAClD,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,EACvC,mBAAmB,EACnB,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAC5D,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAC1D,MAAM,cAAc,GAAsB;YACxC,GAAG,QAAQ;YACX,uBAAuB,EAAE,IAAI;YAC7B,2BAA2B,EAAE,IAAI;SAClC,CAAC;QAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,cAAc,EACd,iBAAiB,EACjB,WAAW,CACZ,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EACnB,cAAc,EACd,mBAAmB,EACnB,WAAW,CACZ,EACH,gCAAgC,CACjC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EACnB,EAAE,GAAG,cAAc,EAAE,2BAA2B,EAAE,KAAK,EAAE,EACzD,iBAAiB,EACjB,WAAW,CACZ,EACH,mCAAmC,CACpC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;YACrF,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC;gBACE,GAAG,cAAc;gBACjB,2BAA2B,EAAE,KAAK;gBAClC,kBAAkB,EAAE,IAAI;aACzB,EACD,iBAAiB,EACjB,aAAa,CACd,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAKH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;YACpG,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EACnB;gBACE,GAAG,cAAc;gBACjB,2BAA2B,EAAE,KAAK;gBAClC,kBAAkB,EAAE,IAAI;gBACxB,kBAAkB,EAAE,IAAI;aACzB,EACD,iBAAiB,EACjB,aAAa,CACd,EACH,mCAAmC,CACpC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;YAC/D,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,EAAE,GAAG,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAC/C,iBAAiB,EACjB,WAAW,CACZ,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EAAC,cAAc,EAAE,iBAAiB,EAAE;gBACvD,oBAAoB,EAAE,IAAI;gBAC1B,mBAAmB,EAAE,KAAK;aAC3B,CAAC,EACJ,8BAA8B,CAC/B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC1E,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,QAAQ,EACR,iBAAiB,EACjB,WAAW,CACZ,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,aAAa,CACX,GAAG,EAAE,CAAC,IAAA,sCAAqB,EAAC,QAAQ,EAAE,iBAAiB,EAAE,aAAa,CAAC,EACvE,mCAAmC,CACpC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;YAC5E,MAAM,UAAU,GAAG,IAAA,sCAAqB,EACtC,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,EACzC,iBAAiB,EACjB,aAAa,CACd,CAAC;YACF,IAAA,aAAM,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;YACrE,aAAa,CACX,GAAG,EAAE,CACH,IAAA,sCAAqB,EACnB,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,EACzC,mBAAmB,EACnB,aAAa,CACd,EACH,gCAAgC,CACjC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,aAAa,CACX,GAAG,EAAE,CAAC,IAAA,sCAAqB,EAAC,QAAQ,EAAE,mBAAmB,EAAE,WAAW,CAAC,EACvE,gCAAgC,CACjC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-provider-identity.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/oauth-provider-identity.test.js

@@ -1,126 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const interface_api_1 = require("@antelopejs/interface-api");
-const chai_1 = require("chai");
-const providers_1 = require("../../routes/auth/oauth/providers");
-const HTTP_BAD_GATEWAY = 502;
-const ACCESS_TOKEN = "provider-access-token";
-const originalFetch = globalThis.fetch;
-function stubFetch(responses) {
-    globalThis.fetch = (async (input) => {
-        const url = String(input);
-        const match = Object.entries(responses).find(([path]) => url.includes(path));
-        if (!match) {
-            return { ok: false, json: async () => ({}) };
-        }
-        return { ok: true, json: async () => match[1] };
-    });
-}
-async function expectRefusal(run, expectedMessage) {
-    try {
-        await run();
-    }
-    catch (error) {
-        (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
-        (0, chai_1.expect)(error.getStatus()).to.equal(HTTP_BAD_GATEWAY);
-        (0, chai_1.expect)(error.getBody()).to.equal(expectedMessage);
-        return;
-    }
-    chai_1.expect.fail(`expected a refusal with "${expectedMessage}"`);
-}
-describe("[unit] oauth provider identity parsing", () => {
-    afterEach(() => {
-        globalThis.fetch = originalFetch;
-    });
-    describe("github", () => {
-        const fetchIdentity = () => providers_1.OAUTH_PROVIDERS.github.fetchIdentity(ACCESS_TOKEN);
-        it("builds the identity from the primary verified e-mail", async () => {
-            stubFetch({
-                "/user/emails": [
-                    { email: "old@acme.dev", primary: false, verified: true },
-                    { email: "alex@acme.dev", primary: true, verified: true },
-                ],
-                "/user": { id: 42, login: "alex", name: "Alex" },
-            });
-            (0, chai_1.expect)(await fetchIdentity()).to.deep.equal({
-                providerAccountId: "42",
-                email: "alex@acme.dev",
-                isEmailVerified: true,
-                name: "Alex",
-            });
-        });
-        it("never verifies an e-mail the provider did not flag", async () => {
-            stubFetch({
-                "/user/emails": [{ email: "alex@acme.dev", primary: true }],
-                "/user": { id: 42, login: "alex", name: null },
-            });
-            const identity = await fetchIdentity();
-            (0, chai_1.expect)(identity.isEmailVerified).to.equal(false);
-            (0, chai_1.expect)(identity.name).to.equal("alex");
-        });
-        it("refuses a response without an account id", async () => {
-            stubFetch({
-                "/user/emails": [{ email: "alex@acme.dev", primary: true }],
-                "/user": { login: "alex" },
-            });
-            await expectRefusal(fetchIdentity, "error.oauth.identity_malformed");
-        });
-        it("refuses an empty-string account id", async () => {
-            stubFetch({
-                "/user/emails": [{ email: "alex@acme.dev", primary: true }],
-                "/user": { id: "", login: "alex" },
-            });
-            await expectRefusal(fetchIdentity, "error.oauth.identity_malformed");
-        });
-        it("refuses a malformed e-mail list", async () => {
-            stubFetch({
-                "/user/emails": { message: "rate limited" },
-                "/user": { id: 42, login: "alex" },
-            });
-            await expectRefusal(fetchIdentity, "error.oauth.email_unavailable");
-        });
-        it("refuses an e-mail entry without an address", async () => {
-            stubFetch({
-                "/user/emails": [{ primary: true, verified: true }],
-                "/user": { id: 42, login: "alex" },
-            });
-            await expectRefusal(fetchIdentity, "error.oauth.email_unavailable");
-        });
-    });
-    describe("google", () => {
-        const fetchIdentity = () => providers_1.OAUTH_PROVIDERS.google.fetchIdentity(ACCESS_TOKEN);
-        it("builds the identity from the userinfo claims", async () => {
-            stubFetch({
-                userinfo: {
-                    sub: "google-sub-1",
-                    email: "alex@acme.dev",
-                    email_verified: true,
-                    name: "Alex",
-                },
-            });
-            (0, chai_1.expect)(await fetchIdentity()).to.deep.equal({
-                providerAccountId: "google-sub-1",
-                email: "alex@acme.dev",
-                isEmailVerified: true,
-                name: "Alex",
-            });
-        });
-        it("refuses a response without a subject", async () => {
-            stubFetch({
-                userinfo: { email: "alex@acme.dev", email_verified: true },
-            });
-            await expectRefusal(fetchIdentity, "error.oauth.identity_malformed");
-        });
-        it("never verifies an e-mail without the explicit claim", async () => {
-            stubFetch({
-                userinfo: { sub: "google-sub-1", email: "alex@acme.dev" },
-            });
-            (0, chai_1.expect)((await fetchIdentity()).isEmailVerified).to.equal(false);
-        });
-        it("refuses a response without an e-mail", async () => {
-            stubFetch({ userinfo: { sub: "google-sub-1" } });
-            await expectRefusal(fetchIdentity, "error.oauth.email_unavailable");
-        });
-    });
-});
-//# sourceMappingURL=oauth-provider-identity.test.js.map

package/dist/test/unit/oauth-provider-identity.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-provider-identity.test.js","sourceRoot":"","sources":["../../../src/test/unit/oauth-provider-identity.test.ts"],"names":[],"mappings":";;AAAA,6DAAuD;AACvD,+BAA8B;AAC9B,iEAAoE;AAEpE,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAI7C,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;AAEvC,SAAS,SAAS,CAAC,SAAyB;IAC1C,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CACtD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnB,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC,CAAiB,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAA2B,EAC3B,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,0BAAU,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAE,KAAoB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACrE,IAAA,aAAM,EAAE,KAAoB,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,aAAM,CAAC,IAAI,CAAC,4BAA4B,eAAe,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,SAAS,CAAC,GAAG,EAAE;QACb,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,2BAAe,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAErD,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,SAAS,CAAC;gBACR,cAAc,EAAE;oBACd,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACzD,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC1D;gBACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;aACjD,CAAC,CAAC;YAEH,IAAA,aAAM,EAAC,MAAM,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC1C,iBAAiB,EAAE,IAAI;gBACvB,KAAK,EAAE,eAAe;gBACtB,eAAe,EAAE,IAAI;gBACrB,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,SAAS,CAAC;gBACR,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;aAC/C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;YACvC,IAAA,aAAM,EAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjD,IAAA,aAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,SAAS,CAAC;gBACR,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;aAC3B,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,SAAS,CAAC;gBACR,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,SAAS,CAAC;gBACR,cAAc,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;gBAC3C,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,SAAS,CAAC;gBACR,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACnD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;aACnC,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,2BAAe,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAErD,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,SAAS,CAAC;gBACR,QAAQ,EAAE;oBACR,GAAG,EAAE,cAAc;oBACnB,KAAK,EAAE,eAAe;oBACtB,cAAc,EAAE,IAAI;oBACpB,IAAI,EAAE,MAAM;iBACb;aACF,CAAC,CAAC;YAEH,IAAA,aAAM,EAAC,MAAM,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC1C,iBAAiB,EAAE,cAAc;gBACjC,KAAK,EAAE,eAAe;gBACtB,eAAe,EAAE,IAAI;gBACrB,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,SAAS,CAAC;gBACR,QAAQ,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,IAAI,EAAE;aAC3D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;YACnE,SAAS,CAAC;gBACR,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE;aAC1D,CAAC,CAAC;YACH,IAAA,aAAM,EAAC,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YACjD,MAAM,aAAa,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/oauth-relay.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/test/unit/oauth-relay.test.js

@@ -1,40 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const interface_api_1 = require("@antelopejs/interface-api");
-const chai_1 = require("chai");
-const relay_1 = require("../../routes/auth/oauth/relay");
-const HTTP_UNAUTHORIZED = 401;
-function expectRefusal(run) {
-    try {
-        run();
-    }
-    catch (error) {
-        (0, chai_1.expect)(error).to.be.instanceOf(interface_api_1.HTTPResult);
-        (0, chai_1.expect)(error.getStatus()).to.equal(HTTP_UNAUTHORIZED);
-        (0, chai_1.expect)(error.getBody()).to.equal("error.oauth.relay_required");
-        return;
-    }
-    chai_1.expect.fail("expected the relay check to refuse");
-}
-describe("[unit] oauth relay", () => {
-    it("derives a stable secret bound to the instance", () => {
-        (0, chai_1.expect)((0, relay_1.deriveOAuthRelaySecret)()).to.equal((0, relay_1.deriveOAuthRelaySecret)());
-        (0, chai_1.expect)((0, relay_1.deriveOAuthRelaySecret)()).to.have.length.greaterThan(0);
-    });
-    it("accepts the derived secret", () => {
-        (0, chai_1.expect)(() => (0, relay_1.assertOAuthRelay)((0, relay_1.deriveOAuthRelaySecret)())).to.not.throw();
-    });
-    it("refuses a missing header", () => {
-        expectRefusal(() => (0, relay_1.assertOAuthRelay)(undefined));
-    });
-    it("refuses an empty header", () => {
-        expectRefusal(() => (0, relay_1.assertOAuthRelay)(""));
-    });
-    it("refuses a wrong secret", () => {
-        expectRefusal(() => (0, relay_1.assertOAuthRelay)("not-the-relay-secret"));
-    });
-    it("never derives the raw instance secret", () => {
-        (0, chai_1.expect)((0, relay_1.deriveOAuthRelaySecret)()).to.not.contain("test-jwt-secret");
-    });
-});
-//# sourceMappingURL=oauth-relay.test.js.map