@oxyhq/core 5.5.0 → 7.0.0

package/src/utils/__tests__/fapiAutoDetect.test.ts

@@ -1,183 +0,0 @@
-/**
- * Auto-detect of `auth.<rp-apex>` from `window.location` for the Clerk-style
- * multi-domain FAPI setup. The IdP backend independently derives `iss` and
- * the FedCM manifest from the request host, so the only contract the SDK
- * needs to honour is: build URLs against the same host the page is on,
- * one subdomain over.
- *
- * Ported verbatim from packages/auth-sdk/__tests__/utils/fapiAutoDetect.test.ts
- * plus Public Suffix List regression cases that are unique to the core
- * implementation's registrable-apex guard.
- */
-
-import { autoDetectAuthWebUrl, registrableApex } from '../fapiAutoDetect';
-
-function loc(hostname: string, protocol = 'https:'): Pick<Location, 'hostname' | 'protocol'> {
-  return { hostname, protocol };
-}
-
-describe('autoDetectAuthWebUrl', () => {
-  describe('returns auth.<apex> for public hostnames', () => {
-    it('derives from the apex itself', () => {
-      expect(autoDetectAuthWebUrl(loc('mention.earth'))).toBe('https://auth.mention.earth');
-    });
-
-    it('strips one leading subdomain', () => {
-      expect(autoDetectAuthWebUrl(loc('www.mention.earth'))).toBe('https://auth.mention.earth');
-      expect(autoDetectAuthWebUrl(loc('app.alia.onl'))).toBe('https://auth.alia.onl');
-    });
-
-    it('strips multiple leading subdomains down to the last two labels', () => {
-      // The heuristic is "last two labels" — fine for our use case because
-      // the IdP itself validates the request host. Deeply-nested hostnames
-      // resolve to the trailing two-label apex.
-      expect(autoDetectAuthWebUrl(loc('deep.app.homiio.com'))).toBe('https://auth.homiio.com');
-    });
-
-    it('honours the request protocol so dev http stays http', () => {
-      expect(autoDetectAuthWebUrl(loc('staging.example.test', 'http:'))).toBe(
-        'http://auth.example.test'
-      );
-    });
-  });
-
-  describe('returns current origin when already on the IdP', () => {
-    it('keeps everything same-origin instead of hopping to a sibling IdP', () => {
-      expect(autoDetectAuthWebUrl(loc('auth.mention.earth'))).toBe('https://auth.mention.earth');
-      expect(autoDetectAuthWebUrl(loc('auth.oxy.so'))).toBe('https://auth.oxy.so');
-    });
-  });
-
-  describe('returns undefined where auto-detect would be wrong', () => {
-    it('skips localhost and 127.0.0.1 (dev)', () => {
-      expect(autoDetectAuthWebUrl(loc('localhost', 'http:'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('127.0.0.1', 'http:'))).toBeUndefined();
-    });
-
-    it('skips IPv4 literals', () => {
-      expect(autoDetectAuthWebUrl(loc('192.168.1.10'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('10.0.0.1'))).toBeUndefined();
-    });
-
-    it('skips IPv6 literals (bracketed)', () => {
-      expect(autoDetectAuthWebUrl(loc('[::1]'))).toBeUndefined();
-    });
-
-    it('skips single-label hostnames', () => {
-      expect(autoDetectAuthWebUrl(loc('intranet'))).toBeUndefined();
-    });
-
-    it('skips unknown protocols', () => {
-      expect(autoDetectAuthWebUrl({ hostname: 'mention.earth', protocol: 'file:' })).toBeUndefined();
-      expect(autoDetectAuthWebUrl({ hostname: 'mention.earth', protocol: 'ftp:' })).toBeUndefined();
-    });
-
-    it('skips empty/missing hostnames', () => {
-      expect(autoDetectAuthWebUrl(loc(''))).toBeUndefined();
-    });
-
-    it('returns undefined when no location is available (SSR / non-browser)', () => {
-      expect(autoDetectAuthWebUrl(undefined)).toBeUndefined();
-    });
-  });
-
-  describe('uses the Public Suffix List for registrable apex detection', () => {
-    it('derives from the registrable domain under multi-part public suffixes', () => {
-      expect(autoDetectAuthWebUrl(loc('foo.co.uk'))).toBe('https://auth.foo.co.uk');
-      expect(autoDetectAuthWebUrl(loc('shop.com.au'))).toBe('https://auth.shop.com.au');
-      expect(autoDetectAuthWebUrl(loc('shop.victim.com.tr'))).toBe('https://auth.victim.com.tr');
-    });
-
-    it('derives from the registrable domain under private hosted suffixes', () => {
-      expect(autoDetectAuthWebUrl(loc('honest.github.io'))).toBe('https://auth.honest.github.io');
-      expect(autoDetectAuthWebUrl(loc('app.victim.pages.dev'))).toBe(
-        'https://auth.victim.pages.dev'
-      );
-      expect(autoDetectAuthWebUrl(loc('site.victim.netlify.app'))).toBe(
-        'https://auth.victim.netlify.app'
-      );
-    });
-
-    it('returns undefined for bare public and private suffixes', () => {
-      expect(autoDetectAuthWebUrl(loc('co.uk'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('github.io'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('pages.dev'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('netlify.app'))).toBeUndefined();
-    });
-  });
-
-  // Regression guard: the refactor to delegate host handling to `registrableApex`
-  // must not change any of the pre-existing return values.
-  describe('regression — unchanged values after registrableApex extraction', () => {
-    const cases: Array<[string, string | undefined]> = [
-      ['mention.earth', 'https://auth.mention.earth'],
-      ['www.mention.earth', 'https://auth.mention.earth'],
-      ['deep.app.homiio.com', 'https://auth.homiio.com'],
-      ['auth.oxy.so', 'https://auth.oxy.so'],
-      ['auth.mention.earth', 'https://auth.mention.earth'],
-      ['localhost', undefined],
-      ['192.168.1.10', undefined],
-      ['[::1]', undefined],
-      ['intranet', undefined],
-      ['', undefined],
-      ['foo.co.uk', 'https://auth.foo.co.uk'],
-    ];
-    it.each(cases)('autoDetectAuthWebUrl(%s) === %s', (hostname, expected) => {
-      const protocol = hostname === 'localhost' || hostname === '[::1]' ? 'http:' : 'https:';
-      expect(autoDetectAuthWebUrl(loc(hostname, protocol))).toBe(expected);
-    });
-  });
-});
-
-describe('registrableApex', () => {
-  it('returns the eTLD+1 for a normal two-label host', () => {
-    expect(registrableApex('mention.earth')).toBe('mention.earth');
-  });
-
-  it('strips subdomains down to the trailing two labels', () => {
-    expect(registrableApex('www.mention.earth')).toBe('mention.earth');
-    expect(registrableApex('deep.app.homiio.com')).toBe('homiio.com');
-  });
-
-  it('lower-cases the input', () => {
-    expect(registrableApex('WWW.Mention.EARTH')).toBe('mention.earth');
-  });
-
-  it('returns the eTLD+1 for hosts under multi-part public suffixes', () => {
-    expect(registrableApex('foo.co.uk')).toBe('foo.co.uk');
-    expect(registrableApex('www.foo.co.uk')).toBe('foo.co.uk');
-    expect(registrableApex('shop.victim.com.tr')).toBe('victim.com.tr');
-  });
-
-  it('returns the eTLD+1 for hosts under private hosted suffixes', () => {
-    expect(registrableApex('honest.github.io')).toBe('honest.github.io');
-    expect(registrableApex('app.victim.pages.dev')).toBe('victim.pages.dev');
-    expect(registrableApex('site.victim.netlify.app')).toBe('victim.netlify.app');
-  });
-
-  it('returns null for bare public and private suffixes', () => {
-    expect(registrableApex('co.uk')).toBeNull();
-    expect(registrableApex('github.io')).toBeNull();
-    expect(registrableApex('pages.dev')).toBeNull();
-    expect(registrableApex('netlify.app')).toBeNull();
-  });
-
-  it('returns null for IPv4 literals', () => {
-    expect(registrableApex('192.168.1.10')).toBeNull();
-    expect(registrableApex('10.0.0.1')).toBeNull();
-  });
-
-  it('returns null for IPv6 literals and hosts carrying a port', () => {
-    expect(registrableApex('[::1]')).toBeNull();
-    expect(registrableApex('mention.earth:3000')).toBeNull();
-  });
-
-  it('returns null for single-label hosts', () => {
-    expect(registrableApex('intranet')).toBeNull();
-    expect(registrableApex('localhost')).toBeNull();
-  });
-
-  it('returns null for empty input', () => {
-    expect(registrableApex('')).toBeNull();
-  });
-});

package/src/utils/__tests__/ssoBounce.test.ts

@@ -1,219 +0,0 @@
-/**
- * Central SSO bounce helpers — per-origin key builders, the bounce URL builder,
- * the central-IdP predicate, and the self-healing guard.
- *
- * These are a wire/storage contract shared with the IdP and every consumer, so
- * the exact key strings, the 30s TTL, and the same-origin / parse-failure
- * behaviour are all asserted explicitly.
- */
-
-import {
-  SSO_CALLBACK_PATH,
-  SSO_GUARD_TTL_MS,
-  ssoStateKey,
-  ssoGuardKey,
-  ssoDestKey,
-  ssoNoSessionKey,
-  ssoAttemptedKey,
-  ssoPriorSessionKey,
-  ssoSignedOutKey,
-  buildSsoBounceUrl,
-  isCentralIdPOrigin,
-  guardActive,
-  silentRestoreSuppressed,
-  allowSsoBounce,
-} from '../ssoBounce';
-import { CENTRAL_AUTH_URL } from '../authWebUrl';
-
-describe('SSO bounce constants', () => {
-  it('pins the callback path and guard TTL (wire/storage contract)', () => {
-    expect(SSO_CALLBACK_PATH).toBe('/__oxy/sso-callback');
-    expect(SSO_GUARD_TTL_MS).toBe(30_000);
-  });
-});
-
-describe('per-origin key builders', () => {
-  const origin = 'https://mention.earth';
-
-  it('builds the exact contracted key strings', () => {
-    expect(ssoStateKey(origin)).toBe('oxy_sso_state:https://mention.earth');
-    expect(ssoGuardKey(origin)).toBe('oxy_sso_guard:https://mention.earth');
-    expect(ssoDestKey(origin)).toBe('oxy_sso_dest:https://mention.earth');
-    expect(ssoNoSessionKey(origin)).toBe('oxy_sso_no_session:https://mention.earth');
-    expect(ssoAttemptedKey(origin)).toBe('oxy_sso_attempted:https://mention.earth');
-    expect(ssoPriorSessionKey(origin)).toBe('oxy_sso_prior_session:https://mention.earth');
-    expect(ssoSignedOutKey(origin)).toBe('oxy_signed_out:https://mention.earth');
-  });
-
-  it('namespaces keys per origin so two RPs never collide', () => {
-    expect(ssoStateKey('https://a.test')).not.toBe(ssoStateKey('https://b.test'));
-    expect(ssoPriorSessionKey('https://a.test')).not.toBe(ssoPriorSessionKey('https://b.test'));
-    expect(ssoSignedOutKey('https://a.test')).not.toBe(ssoSignedOutKey('https://b.test'));
-  });
-});
-
-describe('silentRestoreSuppressed (deliberately-signed-out gate)', () => {
-  const origin = 'https://accounts.oxy.so';
-
-  function storageWith(value: string | null): Pick<Storage, 'getItem'> {
-    return { getItem: (key: string) => (key === ssoSignedOutKey(origin) ? value : null) };
-  }
-
-  it('is SUPPRESSED when the signed-out flag is set to "1" for this origin', () => {
-    expect(silentRestoreSuppressed(storageWith('1'), origin)).toBe(true);
-  });
-
-  it('is NOT suppressed when the flag is absent (normal restore)', () => {
-    expect(silentRestoreSuppressed(storageWith(null), origin)).toBe(false);
-  });
-
-  it('is NOT suppressed for any non-"1" value (only the exact set value gates)', () => {
-    expect(silentRestoreSuppressed(storageWith('0'), origin)).toBe(false);
-    expect(silentRestoreSuppressed(storageWith(''), origin)).toBe(false);
-  });
-
-  it('is per-origin: another origin\'s flag does not suppress this one', () => {
-    const otherOriginFlag: Pick<Storage, 'getItem'> = {
-      getItem: (key: string) => (key === ssoSignedOutKey('https://other.test') ? '1' : null),
-    };
-    expect(silentRestoreSuppressed(otherOriginFlag, origin)).toBe(false);
-  });
-
-  it('fails safe (NOT suppressed, never throws) when getItem throws', () => {
-    const throwing: Pick<Storage, 'getItem'> = {
-      getItem: () => {
-        throw new Error('storage locked');
-      },
-    };
-    expect(silentRestoreSuppressed(throwing, origin)).toBe(false);
-  });
-});
-
-describe('allowSsoBounce (smart returning-visitor gate)', () => {
-  it('ALLOWS a returning visitor (prior-session hint) with no local session', () => {
-    // The core of fix B: a returning user whose local session has expired still
-    // gets ONE establish bounce so a central-only cross-domain session recovers.
-    expect(
-      allowSsoBounce({ hasPriorSession: true, hasLocalSession: false }),
-    ).toBe(true);
-  });
-
-  it('SUPPRESSES a truly first-time anonymous visitor (no hint, no local session)', () => {
-    // The smart default (the ONLY behaviour): a first-time visitor browses
-    // anonymously instead of being force-redirected to the central IdP.
-    expect(
-      allowSsoBounce({ hasPriorSession: false, hasLocalSession: false }),
-    ).toBe(false);
-  });
-
-  it('ALLOWS when a local session was recovered this boot (spec fidelity)', () => {
-    expect(
-      allowSsoBounce({ hasPriorSession: false, hasLocalSession: true }),
-    ).toBe(true);
-  });
-});
-
-describe('buildSsoBounceUrl', () => {
-  const origin = 'https://mention.earth';
-
-  it('targets the central IdP /sso with all required params (default base)', () => {
-    const url = new URL(buildSsoBounceUrl(origin, 'state-123'));
-
-    expect(url.origin).toBe('https://auth.oxy.so');
-    expect(url.pathname).toBe('/sso');
-    expect(url.searchParams.get('prompt')).toBe('none');
-    expect(url.searchParams.get('client_id')).toBe(origin);
-    expect(url.searchParams.get('return_to')).toBe(origin + SSO_CALLBACK_PATH);
-    expect(url.searchParams.get('state')).toBe('state-123');
-  });
-
-  it('honours an explicit authWebUrl override (staging IdP)', () => {
-    const url = new URL(
-      buildSsoBounceUrl(origin, 'state-xyz', 'https://auth.mention.earth'),
-    );
-
-    expect(url.origin).toBe('https://auth.mention.earth');
-    expect(url.pathname).toBe('/sso');
-    expect(url.searchParams.get('client_id')).toBe(origin);
-    expect(url.searchParams.get('state')).toBe('state-xyz');
-  });
-
-  it('falls back to the central default for an empty override', () => {
-    const url = new URL(buildSsoBounceUrl(origin, 's', undefined));
-    expect(url.origin).toBe('https://auth.oxy.so');
-  });
-});
-
-describe('isCentralIdPOrigin', () => {
-  it('matches the central IdP origin', () => {
-    expect(isCentralIdPOrigin('https://auth.oxy.so')).toBe(true);
-    expect(isCentralIdPOrigin(CENTRAL_AUTH_URL)).toBe(true);
-  });
-
-  it('normalises a trailing-slash / path candidate via URL origin', () => {
-    expect(isCentralIdPOrigin('https://auth.oxy.so/')).toBe(true);
-    expect(isCentralIdPOrigin('https://auth.oxy.so/sso')).toBe(true);
-  });
-
-  it('rejects a non-central origin', () => {
-    expect(isCentralIdPOrigin('https://mention.earth')).toBe(false);
-    expect(isCentralIdPOrigin('https://auth.mention.earth')).toBe(false);
-  });
-
-  it('returns false for an unparseable candidate', () => {
-    expect(isCentralIdPOrigin('not a url')).toBe(false);
-    expect(isCentralIdPOrigin('')).toBe(false);
-  });
-});
-
-describe('guardActive', () => {
-  const origin = 'https://mention.earth';
-
-  function storageWith(value: string | null): Pick<Storage, 'getItem'> {
-    return { getItem: (key: string) => (key === ssoGuardKey(origin) ? value : null) };
-  }
-
-  it('is active for a present, fresh guard', () => {
-    const now = 1_000_000;
-    const storage = storageWith(String(now - 1_000)); // 1s old, well under TTL
-    expect(guardActive(storage, origin, now)).toBe(true);
-  });
-
-  it('is inactive for a present but stale guard (older than TTL)', () => {
-    const now = 1_000_000;
-    const storage = storageWith(String(now - SSO_GUARD_TTL_MS - 1));
-    expect(guardActive(storage, origin, now)).toBe(false);
-  });
-
-  it('is inactive for a guard exactly at the TTL boundary (strict <)', () => {
-    const now = 1_000_000;
-    const storage = storageWith(String(now - SSO_GUARD_TTL_MS));
-    expect(guardActive(storage, origin, now)).toBe(false);
-  });
-
-  it('is inactive when the guard is missing', () => {
-    expect(guardActive(storageWith(null), origin, 1_000_000)).toBe(false);
-  });
-
-  it('is inactive for an empty-string guard value', () => {
-    expect(guardActive(storageWith(''), origin, 1_000_000)).toBe(false);
-  });
-
-  it('is inactive for a malformed (non-numeric) guard value', () => {
-    expect(guardActive(storageWith('not-a-number'), origin, 1_000_000)).toBe(false);
-  });
-
-  it('is inactive (never throws) when getItem itself throws', () => {
-    const throwing: Pick<Storage, 'getItem'> = {
-      getItem: () => {
-        throw new Error('storage locked');
-      },
-    };
-    expect(guardActive(throwing, origin, 1_000_000)).toBe(false);
-  });
-
-  it('defaults now to Date.now() when omitted', () => {
-    const storage = storageWith(String(Date.now() - 500));
-    expect(guardActive(storage, origin)).toBe(true);
-  });
-});

package/src/utils/__tests__/ssoEstablish.test.ts

@@ -1,204 +0,0 @@
-/**
- * `establishIdpSessionAfterClaim` — the post-claim durable-session hop.
- *
- * After a WEB device-flow ("Sign in with Oxy" QR) claim commits, the app holds
- * only in-memory tokens: no `fedcm_session` cookie was ever planted at the IdP,
- * so a reload cannot re-mint a token. This primitive performs ONE top-level
- * establish hop (via the RP-minted establish-URL) so the per-apex IdP cookie is
- * planted and a reload restores via the existing `sso-return` / silent-iframe
- * paths.
- *
- * Invariants pinned here:
- *  - web only (no-op off-web / native);
- *  - never fires while sitting on the central IdP origin (would loop);
- *  - persists the SAME bounce state (`ssoStateKey`/`ssoGuardKey`/`ssoDestKey`)
- *    the `buildSsoBounceUrl` machinery primes, so the post-bounce `sso-return`
- *    step validates the state, exchanges the code, and restores the dest;
- *  - persists ONLY after the establish-URL request succeeds (no stale state on
- *    failure);
- *  - navigates exactly once, to the server-returned establish URL;
- *  - total: an establish-request failure leaves the committed in-memory session
- *    untouched, does NOT navigate, and returns `false` (user no worse off).
- */
-
-import { establishIdpSessionAfterClaim } from '../ssoEstablish';
-import {
-  ssoStateKey,
-  ssoGuardKey,
-  ssoDestKey,
-} from '../ssoBounce';
-import { CENTRAL_AUTH_URL } from '../authWebUrl';
-
-const RP_ORIGIN = 'https://accounts.oxy.so';
-const RP_HREF = 'https://accounts.oxy.so/settings';
-const ESTABLISH_URL =
-  'https://auth.oxy.so/sso/establish?et=jwt.abc.def&return_to=https%3A%2F%2Faccounts.oxy.so%2F__oxy%2Fsso-callback&state=state-xyz';
-
-function makeStorage(): {
-  storage: Pick<Storage, 'getItem' | 'setItem'>;
-  map: Map<string, string>;
-} {
-  const map = new Map<string, string>();
-  return {
-    map,
-    storage: {
-      getItem: (k: string) => (map.has(k) ? (map.get(k) as string) : null),
-      setItem: (k: string, v: string) => {
-        map.set(k, v);
-      },
-    },
-  };
-}
-
-describe('establishIdpSessionAfterClaim', () => {
-  it('requests the establish URL with the RP origin + generated state and navigates once (web)', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const requestSsoEstablishUrl = jest.fn(async (origin: string, state: string) => {
-      expect(origin).toBe(RP_ORIGIN);
-      expect(state).toBe('state-xyz');
-      return { establishUrl: ESTABLISH_URL };
-    });
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => true,
-        storage,
-        location: { origin: RP_ORIGIN, href: RP_HREF },
-        navigate: (url) => navigated.push(url),
-        generateState: () => 'state-xyz',
-        now: () => 1_700_000_000_000,
-      },
-    );
-
-    expect(result).toBe(true);
-    expect(requestSsoEstablishUrl).toHaveBeenCalledTimes(1);
-    expect(navigated).toEqual([ESTABLISH_URL]);
-
-    // Bounce state persisted so the post-bounce `sso-return` step validates it.
-    expect(map.get(ssoStateKey(RP_ORIGIN))).toBe('state-xyz');
-    expect(map.get(ssoGuardKey(RP_ORIGIN))).toBe(String(1_700_000_000_000));
-    expect(map.get(ssoDestKey(RP_ORIGIN))).toBe(RP_HREF);
-  });
-
-  it('is a no-op off-web (native): no request, no navigation, no state', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const requestSsoEstablishUrl = jest.fn(async () => ({ establishUrl: ESTABLISH_URL }));
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => false,
-        storage,
-        location: { origin: RP_ORIGIN, href: RP_HREF },
-        navigate: (url) => navigated.push(url),
-      },
-    );
-
-    expect(result).toBe(false);
-    expect(requestSsoEstablishUrl).not.toHaveBeenCalled();
-    expect(navigated).toEqual([]);
-    expect(map.size).toBe(0);
-  });
-
-  it('never fires while sitting on the central IdP origin (loop guard)', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const requestSsoEstablishUrl = jest.fn(async () => ({ establishUrl: ESTABLISH_URL }));
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => true,
-        storage,
-        location: { origin: new URL(CENTRAL_AUTH_URL).origin, href: `${CENTRAL_AUTH_URL}/` },
-        navigate: (url) => navigated.push(url),
-      },
-    );
-
-    expect(result).toBe(false);
-    expect(requestSsoEstablishUrl).not.toHaveBeenCalled();
-    expect(navigated).toEqual([]);
-    expect(map.size).toBe(0);
-  });
-
-  it('on an establish-request failure: no navigation, no persisted state, returns false (single attempt)', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const onError = jest.fn();
-    const requestSsoEstablishUrl = jest.fn(async () => {
-      throw new Error('403 unapproved origin');
-    });
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => true,
-        storage,
-        location: { origin: RP_ORIGIN, href: RP_HREF },
-        navigate: (url) => navigated.push(url),
-        generateState: () => 'state-xyz',
-        onError,
-      },
-    );
-
-    expect(result).toBe(false);
-    expect(requestSsoEstablishUrl).toHaveBeenCalledTimes(1);
-    expect(navigated).toEqual([]);
-    // No stale bounce state left behind on failure.
-    expect(map.size).toBe(0);
-    expect(onError).toHaveBeenCalledTimes(1);
-  });
-
-  it('does not navigate when the server returns no establish URL', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const requestSsoEstablishUrl = jest.fn(async () => ({ establishUrl: '' }));
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => true,
-        storage,
-        location: { origin: RP_ORIGIN, href: RP_HREF },
-        navigate: (url) => navigated.push(url),
-        generateState: () => 'state-xyz',
-      },
-    );
-
-    expect(result).toBe(false);
-    expect(navigated).toEqual([]);
-    expect(map.size).toBe(0);
-  });
-
-  it.each([
-    ['unparseable', 'not a url'],
-    ['non-https (http)', 'http://auth.oxy.so/sso/establish?et=x&state=s'],
-    ['wrong path', 'https://auth.oxy.so/evil?et=x&state=s'],
-    ['non-auth host', 'https://evil.oxy.so/sso/establish?et=x&state=s'],
-  ])(
-    'aborts silently (no navigation, no state) for a %s establish URL',
-    async (_label, badUrl) => {
-      const { storage, map } = makeStorage();
-      const navigated: string[] = [];
-      const requestSsoEstablishUrl = jest.fn(async () => ({ establishUrl: badUrl }));
-
-      const result = await establishIdpSessionAfterClaim(
-        { requestSsoEstablishUrl },
-        {
-          isWeb: () => true,
-          storage,
-          location: { origin: RP_ORIGIN, href: RP_HREF },
-          navigate: (url) => navigated.push(url),
-          generateState: () => 'state-xyz',
-        },
-      );
-
-      expect(result).toBe(false);
-      expect(navigated).toEqual([]);
-      expect(map.size).toBe(0);
-    },
-  );
-});