@jskit-ai/auth-web 0.1.4

package/test/returnToPath.test.js

@@ -0,0 +1,72 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  normalizeAuthReturnToPath,
+  resolveAllowedReturnToOriginsFromPlacementContext
+} from "../src/client/lib/returnToPath.js";
+
+test("normalizeAuthReturnToPath keeps valid internal paths", () => {
+  assert.equal(normalizeAuthReturnToPath("/dashboard"), "/dashboard");
+  assert.equal(normalizeAuthReturnToPath("/w/acme/projects?tab=active"), "/w/acme/projects?tab=active");
+  assert.equal(
+    normalizeAuthReturnToPath("https://app.example.com/w/acme", "/", {
+      allowedOrigins: ["https://app.example.com", "https://auth.example.com"]
+    }),
+    "https://app.example.com/w/acme"
+  );
+});
+
+test("normalizeAuthReturnToPath falls back for invalid or auth-loop paths", () => {
+  assert.equal(normalizeAuthReturnToPath("", "/"), "/");
+  assert.equal(
+    normalizeAuthReturnToPath("https://example.com", "/", {
+      allowedOrigins: ["https://app.example.com"]
+    }),
+    "/"
+  );
+  assert.equal(normalizeAuthReturnToPath("//evil.com", "/"), "/");
+  assert.equal(normalizeAuthReturnToPath("/auth/login", "/"), "/");
+  assert.equal(normalizeAuthReturnToPath("/auth/login?returnTo=%2F", "/"), "/");
+  assert.equal(normalizeAuthReturnToPath("/auth/signout", "/"), "/");
+  assert.equal(normalizeAuthReturnToPath("/auth/signout?returnTo=%2F", "/"), "/");
+  assert.equal(
+    normalizeAuthReturnToPath("https://auth.example.com/auth/login", "/", {
+      allowedOrigins: ["https://auth.example.com"]
+    }),
+    "/"
+  );
+});
+
+test("resolveAllowedReturnToOriginsFromPlacementContext collects current + surface origins", () => {
+  const originalWindow = globalThis.window;
+  globalThis.window = {
+    location: {
+      origin: "https://current.example.com"
+    }
+  };
+
+  try {
+    const origins = resolveAllowedReturnToOriginsFromPlacementContext({
+      surfaceConfig: {
+        surfacesById: {
+          home: { origin: "https://home.example.com" },
+          app: { origin: "https://app.example.com" },
+          auth: { origin: "https://home.example.com" }
+        }
+      }
+    });
+
+    assert.deepEqual(origins, [
+      "https://current.example.com",
+      "https://home.example.com",
+      "https://app.example.com"
+    ]);
+  } finally {
+    if (typeof originalWindow === "undefined") {
+      delete globalThis.window;
+    } else {
+      globalThis.window = originalWindow;
+    }
+  }
+});

package/test/surfaceLinkTarget.test.js

@@ -0,0 +1,80 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { resolveSurfaceLinkTarget } from "../src/client/lib/surfaceLinkTarget.js";
+
+function createPlacementContext() {
+  return {
+    surfaceConfig: {
+      tenancyMode: "workspace",
+      defaultSurfaceId: "app",
+      enabledSurfaceIds: ["app", "admin", "console"],
+      surfacesById: {
+        app: {
+          id: "app",
+          pagesRoot: "app",
+          routeBase: "/app",
+          enabled: true,
+          requiresWorkspace: true
+        },
+        admin: {
+          id: "admin",
+          pagesRoot: "admin",
+          routeBase: "/admin",
+          enabled: true,
+          requiresWorkspace: true
+        },
+        console: {
+          id: "console",
+          pagesRoot: "console",
+          routeBase: "/console",
+          enabled: true,
+          requiresWorkspace: false
+        }
+      }
+    }
+  };
+}
+
+test("resolveSurfaceLinkTarget builds surface-scoped path for target surfaces", () => {
+  const to = resolveSurfaceLinkTarget({
+    context: createPlacementContext(),
+    surface: "admin",
+    workspaceSuffix: "/projects",
+    nonWorkspaceSuffix: "/projects"
+  });
+
+  assert.equal(to, "/admin/projects");
+});
+
+test("resolveSurfaceLinkTarget builds non-workspace path for non-workspace surfaces", () => {
+  const to = resolveSurfaceLinkTarget({
+    context: createPlacementContext(),
+    surface: "console",
+    workspaceSuffix: "/projects",
+    nonWorkspaceSuffix: "/projects"
+  });
+
+  assert.equal(to, "/console/projects");
+});
+
+test("resolveSurfaceLinkTarget returns explicit target unchanged", () => {
+  const to = resolveSurfaceLinkTarget({
+    context: createPlacementContext(),
+    surface: "admin",
+    explicitTo: "/custom/target"
+  });
+
+  assert.equal(to, "/custom/target");
+});
+
+test("resolveSurfaceLinkTarget no longer requires workspace slug for surface links", () => {
+  const to = resolveSurfaceLinkTarget({
+    context: {
+      surfaceConfig: createPlacementContext().surfaceConfig
+    },
+    surface: "admin",
+    workspaceSuffix: "/projects"
+  });
+
+  assert.equal(to, "/admin/projects");
+});