@axa-fr/oidc-client-service-worker 6.25.2-alpha949

package/src/OidcServiceWorker.ts

@@ -0,0 +1,423 @@
+import { acceptAnyDomainToken, scriptFilename, TOKEN } from './constants';
+import {
+  Database,
+  MessageEventData,
+  OidcConfig,
+  OidcConfiguration,
+  TrustedDomains,
+  // TrustedDomainsShowAccessToken,
+} from './types';
+import {
+  checkDomain,
+  getCurrentDatabaseDomain,
+  getDomains,
+  hideTokens,
+  isTokensValid,
+  serializeHeaders,
+  sleep,
+} from './utils';
+import { replaceCodeVerifier } from './utils/codeVerifier';
+
+const _self = self as ServiceWorkerGlobalScope & typeof globalThis;
+
+declare let trustedDomains: TrustedDomains;
+
+_self.importScripts(scriptFilename);
+
+const id = Math.round(new Date().getTime() / 1000).toString();
+
+const keepAliveJsonFilename = 'OidcKeepAliveServiceWorker.json';
+const handleInstall = (event: ExtendableEvent) => {
+  console.log('[OidcServiceWorker] service worker installed ' + id);
+  event.waitUntil(_self.skipWaiting());
+};
+
+const handleActivate = (event: ExtendableEvent) => {
+  console.log('[OidcServiceWorker] service worker activated ' + id);
+  event.waitUntil(_self.clients.claim());
+};
+
+let currentLoginCallbackConfigurationName: string | null = null;
+const database: Database = {
+  default: {
+    configurationName: 'default',
+    tokens: null,
+    status: null,
+    state: null,
+    codeVerifier: null,
+    nonce: null,
+    oidcServerConfiguration: null,
+    hideAccessToken: true,
+  },
+};
+
+const getCurrentDatabasesTokenEndpoint = (database: Database, url: string) => {
+  const databases: OidcConfig[] = [];
+  for (const [, value] of Object.entries<OidcConfig>(database)) {
+    if (
+      value.oidcServerConfiguration != null &&
+      url.startsWith(value.oidcServerConfiguration.tokenEndpoint)
+    ) {
+      databases.push(value);
+    } else if (
+      value.oidcServerConfiguration != null &&
+      value.oidcServerConfiguration.revocationEndpoint &&
+      url.startsWith(value.oidcServerConfiguration.revocationEndpoint)
+    ) {
+      databases.push(value);
+    }
+  }
+  return databases;
+};
+
+const keepAliveAsync = async (event: FetchEvent) => {
+  const originalRequest = event.request;
+  const isFromVanilla = originalRequest.headers.has('oidc-vanilla');
+  const init = { status: 200, statusText: 'oidc-service-worker' };
+  const response = new Response('{}', init);
+  if (!isFromVanilla) {
+    const originalRequestUrl = new URL(originalRequest.url);
+    const minSleepSeconds = Number(originalRequestUrl.searchParams.get('minSleepSeconds')) || 240;
+    for (let i = 0; i < minSleepSeconds; i++) {
+      await sleep(1000 + Math.floor(Math.random() * 1000));
+      const cache = await caches.open('oidc_dummy_cache');
+      await cache.put(event.request, response.clone());
+    }
+  }
+  return response;
+};
+
+const handleFetch = async (event: FetchEvent) => {
+  const originalRequest = event.request;
+  const url = originalRequest.url;
+  if (originalRequest.url.includes(keepAliveJsonFilename)) {
+    event.respondWith(keepAliveAsync(event));
+    return;
+  }
+
+  const currentDatabaseForRequestAccessToken = getCurrentDatabaseDomain(
+    database,
+    originalRequest.url,
+    trustedDomains,
+  );
+  if (
+    currentDatabaseForRequestAccessToken &&
+    currentDatabaseForRequestAccessToken.tokens &&
+    currentDatabaseForRequestAccessToken.tokens.access_token
+  ) {
+    while (
+      currentDatabaseForRequestAccessToken.tokens &&
+      !isTokensValid(currentDatabaseForRequestAccessToken.tokens)
+    ) {
+      await sleep(200);
+    }
+    const newRequest =
+      originalRequest.mode === 'navigate'
+        ? new Request(originalRequest, {
+            headers: {
+              ...serializeHeaders(originalRequest.headers),
+              authorization:
+                'Bearer ' +
+                currentDatabaseForRequestAccessToken.tokens.access_token,
+            },
+          })
+        : new Request(originalRequest, {
+            headers: {
+              ...serializeHeaders(originalRequest.headers),
+              authorization:
+                'Bearer ' +
+                currentDatabaseForRequestAccessToken.tokens.access_token,
+            },
+            mode: (
+              currentDatabaseForRequestAccessToken.oidcConfiguration as OidcConfiguration
+            ).service_worker_convert_all_requests_to_cors
+              ? 'cors'
+              : originalRequest.mode,
+          });
+
+    // @ts-ignore -- TODO: review, waitUntil takes a promise, this returns a void
+    event.waitUntil(event.respondWith(fetch(newRequest)));
+
+    return;
+  }
+
+  if (event.request.method !== 'POST') {
+    return;
+  }
+
+  let currentDatabase: OidcConfig | null = null;
+  const currentDatabases = getCurrentDatabasesTokenEndpoint(
+    database,
+    originalRequest.url,
+  );
+  const numberDatabase = currentDatabases.length;
+  if (numberDatabase > 0) {
+    const maPromesse = new Promise<Response>((resolve, reject) => {
+      const clonedRequest = originalRequest.clone();
+      const response = clonedRequest.text().then((actualBody) => {
+        if (
+          actualBody.includes(TOKEN.REFRESH_TOKEN) ||
+          actualBody.includes(TOKEN.ACCESS_TOKEN)
+        ) {
+          let newBody = actualBody;
+          for (let i = 0; i < numberDatabase; i++) {
+            const currentDb = currentDatabases[i];
+
+            if (currentDb && currentDb.tokens != null) {
+              const keyRefreshToken =
+                TOKEN.REFRESH_TOKEN + '_' + currentDb.configurationName;
+              if (actualBody.includes(keyRefreshToken)) {
+                newBody = newBody.replace(
+                  keyRefreshToken,
+                  encodeURIComponent(currentDb.tokens.refresh_token as string),
+                );
+                currentDatabase = currentDb;
+                break;
+              }
+              const keyAccessToken =
+                TOKEN.ACCESS_TOKEN + '_' + currentDb.configurationName;
+              if (actualBody.includes(keyAccessToken)) {
+                newBody = newBody.replace(
+                  keyAccessToken,
+                  encodeURIComponent(currentDb.tokens.access_token),
+                );
+                currentDatabase = currentDb;
+                break;
+              }
+            }
+          }
+          const fetchPromise = fetch(originalRequest, {
+            body: newBody,
+            method: clonedRequest.method,
+            headers: {
+              ...serializeHeaders(originalRequest.headers),
+            },
+            mode: clonedRequest.mode,
+            cache: clonedRequest.cache,
+            redirect: clonedRequest.redirect,
+            referrer: clonedRequest.referrer,
+            credentials: clonedRequest.credentials,
+            integrity: clonedRequest.integrity,
+          });
+
+          if (
+            currentDatabase &&
+            currentDatabase.oidcServerConfiguration != null &&
+            currentDatabase.oidcServerConfiguration.revocationEndpoint &&
+            url.startsWith(
+              currentDatabase.oidcServerConfiguration.revocationEndpoint,
+            )
+          ) {
+            return fetchPromise.then(async (response) => {
+              const text = await response.text();
+              return new Response(text, response);
+            });
+          }
+          return fetchPromise.then(hideTokens(currentDatabase as OidcConfig)); // todo type assertion to OidcConfig but could be null, NEEDS REVIEW
+        } else if (
+          actualBody.includes('code_verifier=') &&
+          currentLoginCallbackConfigurationName
+        ) {
+          currentDatabase = database[currentLoginCallbackConfigurationName];
+          currentLoginCallbackConfigurationName = null;
+          let newBody = actualBody;
+          if (currentDatabase && currentDatabase.codeVerifier != null) {
+            newBody = replaceCodeVerifier(newBody, currentDatabase.codeVerifier);
+          }
+
+          return fetch(originalRequest, {
+            body: newBody,
+            method: clonedRequest.method,
+            headers: {
+              ...serializeHeaders(originalRequest.headers),
+            },
+            mode: clonedRequest.mode,
+            cache: clonedRequest.cache,
+            redirect: clonedRequest.redirect,
+            referrer: clonedRequest.referrer,
+            credentials: clonedRequest.credentials,
+            integrity: clonedRequest.integrity,
+          }).then(hideTokens(currentDatabase));
+        }
+        return undefined;
+      });
+      response
+        .then((r) => {
+          if (r !== undefined) {
+            resolve(r);
+          } else {
+            console.log('success undefined');
+            reject(new Error('Response is undefined inside a success'));
+          }
+        })
+        .catch((err) => {
+          if (err !== undefined) {
+            reject(err);
+          } else {
+            console.log('error undefined');
+            reject(new Error('Response is undefined inside a error'));
+          }
+        });
+    });
+
+    // @ts-ignore -- TODO: review, waitUntil takes a promise, this returns a void
+    event.waitUntil(event.respondWith(maPromesse));
+  }
+};
+
+type TrustedDomainsShowAccessToken = {
+  [key: string]: boolean;
+}
+
+const trustedDomainsShowAccessToken: TrustedDomainsShowAccessToken = {};
+
+const handleMessage = (event: ExtendableMessageEvent) => {
+  const port = event.ports[0];
+  const data = event.data as MessageEventData;
+  const configurationName = data.configurationName;
+  let currentDatabase = database[configurationName];
+  if (trustedDomains == null) {
+    trustedDomains = {};
+  }
+  if (!currentDatabase) {
+    if (trustedDomainsShowAccessToken[configurationName] === undefined) {
+      const trustedDomain = trustedDomains[configurationName];
+      trustedDomainsShowAccessToken[configurationName] = Array.isArray(trustedDomain) ? false : trustedDomain.showAccessToken;
+    }
+    database[configurationName] = {
+      tokens: null,
+      state: null,
+      codeVerifier: null,
+      oidcServerConfiguration: null,
+      oidcConfiguration: undefined,
+      nonce: null,
+      status: null,
+      configurationName,
+      hideAccessToken: !trustedDomainsShowAccessToken[configurationName],
+    };
+    currentDatabase = database[configurationName];
+
+    if (!trustedDomains[configurationName]) {
+      trustedDomains[configurationName] = [];
+    }
+  }
+
+  switch (data.type) {
+    case 'clear':
+      currentDatabase.tokens = null;
+      currentDatabase.state = null;
+      currentDatabase.codeVerifier = null;
+      currentDatabase.status = data.data.status;
+      port.postMessage({ configurationName });
+      return;
+    case 'init': {
+      const oidcServerConfiguration = data.data.oidcServerConfiguration;
+      const trustedDomain = trustedDomains[configurationName];
+      const domains = getDomains(trustedDomain, 'oidc');
+      if (!domains.find((f) => f === acceptAnyDomainToken)) {
+        [
+          oidcServerConfiguration.tokenEndpoint,
+          oidcServerConfiguration.revocationEndpoint,
+          oidcServerConfiguration.userInfoEndpoint,
+          oidcServerConfiguration.issuer,
+        ].forEach((url) => {
+          checkDomain(domains, url);
+        });
+      }
+    currentDatabase.oidcServerConfiguration = oidcServerConfiguration;
+      currentDatabase.oidcConfiguration = data.data.oidcConfiguration;
+      const where = data.data.where;
+      if (
+        where === 'loginCallbackAsync' ||
+        where === 'tryKeepExistingSessionAsync'
+      ) {
+        currentLoginCallbackConfigurationName = configurationName;
+      } else {
+        currentLoginCallbackConfigurationName = null;
+      }
+
+      if (!currentDatabase.tokens) {
+        port.postMessage({
+          tokens: null,
+          status: currentDatabase.status,
+          configurationName,
+        });
+      } else {
+        const tokens = {
+          ...currentDatabase.tokens,
+        };
+        if (currentDatabase.hideAccessToken) {
+          tokens.access_token = TOKEN.ACCESS_TOKEN + '_' + configurationName;
+        }
+        if (tokens.refresh_token) {
+          tokens.refresh_token = TOKEN.REFRESH_TOKEN + '_' + configurationName;
+        }
+        if (
+          tokens.idTokenPayload &&
+          tokens.idTokenPayload.nonce &&
+          currentDatabase.nonce != null
+        ) {
+          tokens.idTokenPayload.nonce =
+            TOKEN.NONCE_TOKEN + '_' + configurationName;
+        }
+        port.postMessage({
+          tokens,
+          status: currentDatabase.status,
+          configurationName,
+        });
+      }
+      return;
+    }
+    case 'setState':
+      currentDatabase.state = data.data.state;
+      port.postMessage({ configurationName });
+      return;
+    case 'getState': {
+      const state = currentDatabase.state;
+      port.postMessage({ configurationName, state });
+      return;
+    }
+    case 'setCodeVerifier':
+      currentDatabase.codeVerifier = data.data.codeVerifier;
+      port.postMessage({ configurationName });
+      return;
+    case 'getCodeVerifier': {
+      port.postMessage({
+        configurationName,
+        codeVerifier: currentDatabase.codeVerifier != null ? TOKEN.CODE_VERIFIER + '_' + configurationName : null,
+      });
+      return;
+    }
+    case 'setSessionState':
+      currentDatabase.sessionState = data.data.sessionState;
+      port.postMessage({ configurationName });
+      return;
+    case 'getSessionState': {
+      const sessionState = currentDatabase.sessionState;
+      port.postMessage({ configurationName, sessionState });
+      return;
+    }
+    case 'setNonce': {
+      const nonce = data.data.nonce;
+      if (nonce) {
+        currentDatabase.nonce = nonce;
+      }
+      port.postMessage({ configurationName });
+      return;
+    }
+    case 'getNonce': {
+      const keyNonce = TOKEN.NONCE_TOKEN + '_' + configurationName;
+      const nonce = currentDatabase.nonce ? keyNonce : null;
+      port.postMessage({ configurationName, nonce });
+      return;
+    }
+    default:
+      currentDatabase.items = { ...data.data };
+      port.postMessage({ configurationName });
+  }
+};
+
+_self.addEventListener('install', handleInstall);
+_self.addEventListener('activate', handleActivate);
+_self.addEventListener('fetch', handleFetch);
+_self.addEventListener('message', handleMessage);

package/src/OidcTrustedDomains.js

@@ -0,0 +1,26 @@
+// Add bellow trusted domains, access tokens will automatically injected to be send to
+// trusted domain can also be a path like https://www.myapi.com/users,
+// then all subroute like https://www.myapi.com/useers/1 will be authorized to send access_token to.
+
+// Domains used by OIDC server must be also declared here
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const trustedDomains = {
+    default: ['https://demo.duendesoftware.com', 'https://kdhttps.auth0.com'],
+    config_classic: ['https://demo.duendesoftware.com'],
+    config_without_silent_login: ['https://demo.duendesoftware.com'],
+    config_without_refresh_token: ['https://demo.duendesoftware.com'],
+    config_without_refresh_token_silent_login: ['https://demo.duendesoftware.com'],
+    config_google: ['https://oauth2.googleapis.com', 'https://openidconnect.googleapis.com'],
+    config_with_hash: ['https://demo.duendesoftware.com'],
+};
+
+// Service worker will continue to give access token to the JavaScript client
+// Ideal to hide refresh token from client JavaScript, but to retrieve access_token for some
+// scenarios which require it. For example, to send it via websocket connection.
+trustedDomains.config_show_access_token = { domains: ['https://demo.duendesoftware.com'], showAccessToken: true };
+
+// This example defines domains used by OIDC server separately from domains to which access tokens will be injected.
+trustedDomains.config_separate_oidc_access_token_domains = {
+    oidcDomains: ['https://demo.duendesoftware.com'],
+    accessTokenDomains: ['https://myapi'],
+};

package/src/constants.ts

@@ -0,0 +1,32 @@
+const scriptFilename = 'OidcTrustedDomains.js';
+const acceptAnyDomainToken = '*';
+
+type TokenType = {
+  readonly REFRESH_TOKEN: string;
+  readonly ACCESS_TOKEN: string;
+  readonly NONCE_TOKEN: string;
+  readonly CODE_VERIFIER: string;
+};
+
+const TOKEN: TokenType = {
+  REFRESH_TOKEN: 'REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',
+  ACCESS_TOKEN: 'ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER',
+  NONCE_TOKEN: 'NONCE_SECURED_BY_OIDC_SERVICE_WORKER',
+  CODE_VERIFIER: 'CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER',
+};
+
+type TokenRenewModeType = {
+  readonly access_token_or_id_token_invalid: string;
+  readonly access_token_invalid: string;
+  readonly id_token_invalid: string;
+};
+
+const TokenRenewMode: TokenRenewModeType = {
+  access_token_or_id_token_invalid: 'access_token_or_id_token_invalid',
+  access_token_invalid: 'access_token_invalid',
+  id_token_invalid: 'id_token_invalid',
+};
+
+const openidWellknownUrlEndWith = '/.well-known/openid-configuration';
+
+export { acceptAnyDomainToken, openidWellknownUrlEndWith, scriptFilename, TOKEN, TokenRenewMode };

package/src/types.ts

@@ -0,0 +1,101 @@
+export type DomainDetails = {
+    domains?: Domain[];
+    oidcDomains?: Domain[];
+    accessTokenDomains?: Domain[];
+    showAccessToken: boolean;
+}
+
+export type Domain = string | RegExp;
+
+export type TrustedDomains = {
+    [key: string]: Domain[] | DomainDetails;
+} | null;
+
+export type OidcServerConfiguration = {
+    revocationEndpoint: string;
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userInfoEndpoint: string;
+}
+
+export type OidcConfiguration = {
+    token_renew_mode: string;
+    service_worker_convert_all_requests_to_cors: boolean;
+}
+
+// Uncertain why the Headers interface in lib.webworker.d.ts does not have a keys() function, so extending
+export interface FetchHeaders extends Headers {
+    keys(): string[];
+}
+
+export type Status = 'LOGGED' | 'LOGGED_IN' | 'LOGGED_OUT' | 'NOT_CONNECTED' | 'LOGOUT_FROM_ANOTHER_TAB' | 'SESSION_LOST' | 'REQUIRE_SYNC_TOKENS' | 'FORCE_REFRESH' | null;
+export type MessageEventType = 'clear' | 'init' | 'setState' | 'getState' | 'setCodeVerifier' | 'getCodeVerifier' | 'setSessionState' | 'getSessionState' | 'setNonce' | 'getNonce';
+
+export type MessageData = {
+    status: Status;
+    oidcServerConfiguration: OidcServerConfiguration;
+    oidcConfiguration: OidcConfiguration;
+    where: string;
+    state: string;
+    codeVerifier: string;
+    sessionState: string;
+    nonce: Nonce;
+}
+
+export type MessageEventData = {
+    configurationName: string;
+    type: MessageEventType;
+    data: MessageData;
+}
+
+export type Nonce = {
+    nonce: string;
+} | null;
+
+export type OidcConfig = {
+    configurationName: string;
+    tokens: Tokens | null;
+    status: Status;
+    state: string | null;
+    codeVerifier: string | null;
+    nonce: Nonce;
+    oidcServerConfiguration: OidcServerConfiguration | null;
+    oidcConfiguration?: OidcConfiguration;
+    sessionState?: string | null;
+    items?: MessageData;
+    hideAccessToken: boolean;
+}
+
+export type IdTokenPayload = {
+    iss: string;
+    /**
+     * (Expiration Time) Claim
+     */
+    exp: number;
+    /**
+     * (Issued At) Claim
+     */
+    iat: number;
+    nonce: string | null;
+}
+
+export type AccessTokenPayload = {
+    exp: number;
+    sub: string;
+}
+
+export type Tokens = {
+    issued_at: number;
+    access_token: string;
+    accessTokenPayload: AccessTokenPayload | null;
+    id_token: null | string;
+    idTokenPayload: IdTokenPayload;
+    refresh_token?: string;
+    expiresAt: number;
+    expires_in: number;
+};
+
+export type Database = {
+    [key: string]: OidcConfig;
+}

package/src/utils/__tests__/codeVerifier.spec.ts

@@ -0,0 +1,13 @@
+import { describe, expect, it } from 'vitest';
+
+import { replaceCodeVerifier } from '../codeVerifier';
+
+describe('replaceCodeVerifier should', () => {
+    it.each([
+        { body: 'code=F5CDCDB9AADB9ADA59560DE80CAAA6688BC5C8BA1CC1C1F9839F7E7B32171B3D-1&grant_type=authorization_code&client_id=interactive.public.short&redirect_uri=http%3A%2F%2Flocalhost%3A4200%2Fauthentication%2Fcallback&code_verifier=ONskPfcbfAYPp5xqhpMstHSz017896R7sy3wqrRdqC8lYB8yQciCCNLooqLC9qHFTF2FFhDQP4m8PEFNSry8eoCbQ9baYcoWjF1bEH6vGWExdTIMqauicjeVxqz58FO8', bodyExpected: 'code=F5CDCDB9AADB9ADA59560DE80CAAA6688BC5C8BA1CC1C1F9839F7E7B32171B3D-1&grant_type=authorization_code&client_id=interactive.public.short&redirect_uri=http%3A%2F%2Flocalhost%3A4200%2Fauthentication%2Fcallback&code_verifier=1234' },
+        { body: 'code=F5CDCDB9AADB9ADA59560DE80CAAA6688BC5C8BA1CC1C1F9839F7E7B32171B3D-1&code_verifier=ONskPfcbfAYPp5xqhpMstHSz017896R7sy3wqrRdqC8lYB8yQciCCNLooqLC9qHFTF2FFhDQP4m8PEFNSry8eoCbQ9baYcoWjF1bEH6vGWExdTIMqauicjeVxqz58FO8&grant_type=authorization_code&client_id=interactive.public.short&redirect_uri=http%3A%2F%2Flocalhost%3A4200%2Fauthentication%2Fcallback', bodyExpected: 'code=F5CDCDB9AADB9ADA59560DE80CAAA6688BC5C8BA1CC1C1F9839F7E7B32171B3D-1&code_verifier=1234&grant_type=authorization_code&client_id=interactive.public.short&redirect_uri=http%3A%2F%2Flocalhost%3A4200%2Fauthentication%2Fcallback' },
+    ])('inject new codeVerifier', async ({ body, bodyExpected }) => {
+        const result = replaceCodeVerifier(body, '1234');
+        expect(bodyExpected).toEqual(result);
+    });
+});

package/src/utils/__tests__/domains.spec.ts

@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'vitest';
+
+import { openidWellknownUrlEndWith } from '../../constants';
+import { checkDomain, getCurrentDatabaseDomain } from '..';
+import { Database, OidcServerConfiguration, Tokens, TrustedDomains } from './../../types';
+
+describe('domains', () => {
+  describe('can check domain matches', () => {
+    it('can check string domains and return void', () => {
+      const result = () =>
+        checkDomain(
+          ['https://securesite.com:3000'],
+          'https://securesite.com:3000',
+        );
+      expect(result()).toBeUndefined();
+    });
+
+    it('can check regExp domains and return void when valid', () => {
+      const result = () =>
+        checkDomain(
+          [/^https:\/\/securesite\.com/],
+          'https://securesite.com:3000',
+        );
+      expect(result()).toBeUndefined();
+    });
+
+    it('will throw error when domain is not trusted', () => {
+      const result = () =>
+        checkDomain(
+          ['https://notsecuresite.com'],
+          'https://securesite.com:3000',
+        );
+      expect(result).toThrowError();
+    });
+
+    it('will return void when endpoint is falsy', () => {
+      const result = () => checkDomain(['https://securesite.com:3000'], '');
+      expect(result()).toBeUndefined();
+    });
+  });
+  describe('getCurrentDatabaseDomain', () => {
+    const db: Database = {
+      default: {
+        configurationName: 'config',
+        tokens: {} as Tokens,
+        status: 'NOT_CONNECTED',
+        state: null,
+        codeVerifier: null,
+        nonce: null,
+        oidcServerConfiguration: {} as OidcServerConfiguration,
+        hideAccessToken: true,
+      },
+    };
+
+    it('will return null when url ends with openidWellknownUrlEndWith', () => {
+      const trustedDomains: TrustedDomains = {
+        default: [
+          'https://demo.duendesoftware.com',
+          'https://kdhttps.auth0.com',
+        ],
+      };
+      const url = 'http://url' + openidWellknownUrlEndWith;
+      expect(getCurrentDatabaseDomain(db, url, trustedDomains)).toBeNull();
+    });
+
+    it('will test urls against domains list if accessTokenDomains list is not present', () => {
+      const trustedDomains: TrustedDomains = {
+        default: {
+          domains: ['https://domain'],
+          showAccessToken: false,
+        },
+      };
+
+      expect(getCurrentDatabaseDomain(db, 'https://domain/test', trustedDomains)).toBe(db.default);
+    });
+
+    it('will test urls against accessTokenDomains list if it is present and ignore domains list', () => {
+      const trustedDomains: TrustedDomains = {
+        default: {
+          domains: ['https://domain'],
+          accessTokenDomains: ['https://myapi'],
+          showAccessToken: false,
+        },
+      };
+
+      expect(getCurrentDatabaseDomain(db, 'https://myapi/test', trustedDomains)).toBe(db.default);
+      expect(getCurrentDatabaseDomain(db, 'https://domain/test', trustedDomains)).toBeNull();
+    });
+  });
+});