@hubspot/app-connect-sdk 1.0.0-alpha.2 → 1.0.0-alpha.3

package/src/server/hono/hubspot-connect-routes/auth-callback.test.ts

@@ -1,225 +0,0 @@
-import { Hono } from 'hono';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-import { EXPIRES_AT_URL_PARAM } from '../../../shared/constants.ts';
-import {
-  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
-  HUBSPOT_REFRESH_COOKIE_PREFIX,
-  TEMP_COOKIE_OAUTH_STATE,
-  TEMP_COOKIE_PKCE_VERIFIER,
-} from '../../constants.ts';
-import { handleAuthCallback } from './auth-callback.ts';
-import type { HubSpotConnectRoutesEnvClientSecret } from './load-hubspot-connect-routes-env.ts';
-import type { HubSpotConnectOAuthRouteOptions } from './types.ts';
-
-const hubspotConnectEnv = {
-  hubspotAuthorizationEndpoint: 'https://auth.example.test/oauth/authorize',
-  hubspotOAuthApiOrigin: 'https://auth.example.test',
-  isCimdEnabled: false,
-  isDpopEnabled: false,
-  isAppPrivateKeyRequired: false,
-  hubspotClientId: 'test-client-id',
-  hubspotClientSecret: 'test-client-secret',
-} satisfies HubSpotConnectRoutesEnvClientSecret;
-
-const BASE_PATH = '/functions/v1/hubspot-connect';
-
-function buildOAuthRouteOptions(): HubSpotConnectOAuthRouteOptions {
-  return {
-    appKeys: null,
-    refreshCookiePath: `${BASE_PATH}/auth`,
-    logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() },
-    basePath: BASE_PATH,
-    hubspotConnectEnv,
-    cimdClientMetadata: { scope: { required: ['crm.objects.contacts.read'] } },
-  };
-}
-
-function base64urlEncode(input: string): string {
-  let binary = '';
-  const bytes = new TextEncoder().encode(input);
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
-}
-
-function buildCallbackFixture(
-  returnPath: string,
-  sid = 'test-session-id-hash'
-): { stateValue: string; cookieHeader: string } {
-  const stateValue = base64urlEncode(
-    JSON.stringify({ return_path: returnPath, sid })
-  );
-  const cookieHeader = [
-    `${TEMP_COOKIE_OAUTH_STATE}=${encodeURIComponent(stateValue)}`,
-    `${TEMP_COOKIE_PKCE_VERIFIER}=${encodeURIComponent('test-pkce-verifier')}`,
-  ].join('; ');
-  return { stateValue, cookieHeader };
-}
-
-function buildCallbackUrl(stateValue: string, code = 'test-auth-code'): string {
-  const url = new URL(`http://localhost${BASE_PATH}/auth/callback`);
-  url.searchParams.set('code', code);
-  url.searchParams.set('state', stateValue);
-  return url.toString();
-}
-
-describe('handleAuthCallback', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('returns 400 when code is missing', async () => {
-    const app = new Hono();
-    app.get('/auth/callback', (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const res = await app.request(`http://localhost/auth/callback?state=abc`, {
-      method: 'GET',
-    });
-    expect(res.status).toBe(400);
-    expect(await res.text()).toContain('Missing code or state');
-  });
-
-  it('returns 400 when state is missing', async () => {
-    const app = new Hono();
-    app.get('/auth/callback', (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const res = await app.request(`http://localhost/auth/callback?code=abc`, {
-      method: 'GET',
-    });
-    expect(res.status).toBe(400);
-    expect(await res.text()).toContain('Missing code or state');
-  });
-
-  it('returns 403 when state cookie is missing', async () => {
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue } = buildCallbackFixture('/dashboard');
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-    });
-    expect(res.status).toBe(403);
-    expect(await res.text()).toContain('State mismatch');
-  });
-
-  it('returns 403 when state does not match cookie', async () => {
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { cookieHeader } = buildCallbackFixture('/dashboard');
-    const res = await app.request(buildCallbackUrl('wrong-state-value'), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-    expect(res.status).toBe(403);
-  });
-
-  it('returns 400 when state payload has invalid return_path', async () => {
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue, cookieHeader } =
-      buildCallbackFixture('//evil.example.com');
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-    expect(res.status).toBe(400);
-    expect(await res.text()).toContain('Invalid return path');
-  });
-
-  it('returns 502 when upstream token exchange fails', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response('{"error":"invalid_grant"}', {
-        status: 400,
-        statusText: 'Bad Request',
-      })
-    );
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue, cookieHeader } = buildCallbackFixture('/dashboard');
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-    expect(res.status).toBe(502);
-    expect(await res.text()).toContain('Token exchange failed');
-  });
-
-  it('returns 502 when token response is missing refresh_token', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response(JSON.stringify({ access_token: 'at', expires_in: 1800 }), {
-        status: 200,
-      })
-    );
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue, cookieHeader } = buildCallbackFixture('/dashboard');
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-    expect(res.status).toBe(502);
-    expect(await res.text()).toContain('refresh_token');
-  });
-
-  it('redirects and sets cookies on success', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response(
-        JSON.stringify({
-          access_token: 'new-access-token',
-          refresh_token: 'new-refresh-token',
-          expires_in: 1800,
-        }),
-        { status: 200 }
-      )
-    );
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue, cookieHeader } = buildCallbackFixture(
-      '/dashboard',
-      'abc123sid'
-    );
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-
-    expect(res.status).toBe(302);
-    const location = res.headers.get('location') ?? '';
-    expect(location).toContain('/dashboard');
-    expect(location).toContain(EXPIRES_AT_URL_PARAM);
-
-    const setCookies = res.headers.getSetCookie();
-    const accessCookie = setCookies.find((h) =>
-      h.startsWith(`${HUBSPOT_ACCESS_TOKEN_COOKIE_NAME}=`)
-    );
-    expect(accessCookie).toContain('new-access-token');
-
-    const refreshCookie = setCookies.find((h) =>
-      h.startsWith(`${HUBSPOT_REFRESH_COOKIE_PREFIX}`)
-    );
-    expect(refreshCookie).toContain('new-refresh-token');
-
-    const pkceCleared = setCookies.find((h) =>
-      h.startsWith(`${TEMP_COOKIE_PKCE_VERIFIER}=`)
-    );
-    expect(pkceCleared).toContain('Max-Age=0');
-
-    const stateCleared = setCookies.find((h) =>
-      h.startsWith(`${TEMP_COOKIE_OAUTH_STATE}=`)
-    );
-    expect(stateCleared).toContain('Max-Age=0');
-  });
-});