@stonyx/oauth 0.1.1-beta.18 → 0.1.1-beta.180

package/test/unit/state-validation-test.js

@@ -1,118 +0,0 @@
-import QUnit from 'qunit';
-
-const { module, test } = QUnit;
-
-/**
- * Tests for OAuth state token validation logic.
- *
- * These tests exercise the pendingStates map and validation directly,
- * mirroring the logic in OAuth.handleCallback without requiring the
- * full module initialization (which depends on stonyx config/modules).
- */
-
-const TEN_MINUTES = 10 * 60 * 1000;
-
-function validateState(pendingStates, stateToken) {
-  if (!stateToken || !pendingStates.has(stateToken)) {
-    throw new Error('Invalid or missing state token');
-  }
-
-  const stateCreatedAt = pendingStates.get(stateToken);
-  pendingStates.delete(stateToken);
-
-  if (Date.now() - stateCreatedAt > TEN_MINUTES) {
-    throw new Error('State token has expired');
-  }
-}
-
-module('[Unit] State Validation', function() {
-  test('accepts a valid pending state token', function(assert) {
-    const pendingStates = new Map();
-    pendingStates.set('valid-token', Date.now());
-
-    validateState(pendingStates, 'valid-token');
-    assert.ok(true, 'did not throw');
-  });
-
-  test('consumes the state token after validation', function(assert) {
-    const pendingStates = new Map();
-    pendingStates.set('one-time-token', Date.now());
-
-    validateState(pendingStates, 'one-time-token');
-    assert.false(pendingStates.has('one-time-token'), 'token removed from pending states');
-  });
-
-  test('rejects a missing state token', function(assert) {
-    const pendingStates = new Map();
-
-    assert.throws(
-      () => validateState(pendingStates, undefined),
-      /Invalid or missing state token/,
-    );
-  });
-
-  test('rejects an empty string state token', function(assert) {
-    const pendingStates = new Map();
-
-    assert.throws(
-      () => validateState(pendingStates, ''),
-      /Invalid or missing state token/,
-    );
-  });
-
-  test('rejects an unknown state token', function(assert) {
-    const pendingStates = new Map();
-    pendingStates.set('known-token', Date.now());
-
-    assert.throws(
-      () => validateState(pendingStates, 'unknown-token'),
-      /Invalid or missing state token/,
-    );
-  });
-
-  test('rejects an expired state token (older than 10 minutes)', function(assert) {
-    const pendingStates = new Map();
-    const elevenMinutesAgo = Date.now() - (11 * 60 * 1000);
-    pendingStates.set('expired-token', elevenMinutesAgo);
-
-    assert.throws(
-      () => validateState(pendingStates, 'expired-token'),
-      /State token has expired/,
-    );
-  });
-
-  test('expired state token is still consumed', function(assert) {
-    const pendingStates = new Map();
-    const elevenMinutesAgo = Date.now() - (11 * 60 * 1000);
-    pendingStates.set('expired-token', elevenMinutesAgo);
-
-    try {
-      validateState(pendingStates, 'expired-token');
-    } catch {
-      // expected
-    }
-
-    assert.false(pendingStates.has('expired-token'), 'expired token removed from map');
-  });
-
-  test('accepts a token just under 10 minutes old', function(assert) {
-    const pendingStates = new Map();
-    const nineMinutesAgo = Date.now() - (9 * 60 * 1000);
-    pendingStates.set('fresh-token', nineMinutesAgo);
-
-    validateState(pendingStates, 'fresh-token');
-    assert.ok(true, 'did not throw');
-  });
-
-  test('rejects reuse of a previously valid token', function(assert) {
-    const pendingStates = new Map();
-    pendingStates.set('use-once', Date.now());
-
-    validateState(pendingStates, 'use-once');
-
-    assert.throws(
-      () => validateState(pendingStates, 'use-once'),
-      /Invalid or missing state token/,
-    );
-  });
-});

package/test/unit/token-manager-test.js

@@ -1,76 +0,0 @@
-import QUnit from 'qunit';
-import TokenManager from '../../src/token-manager.js';
-
-const { module, test } = QUnit;
-
-function createMockFlow() {
-  return {
-    exchangeCode: async (code) => ({
-      accessToken: `token-for-${code}`,
-      refreshToken: 'refresh-123',
-      expiresIn: 3600,
-    }),
-    refreshAccessToken: async (refreshToken) => ({
-      accessToken: 'new-access',
-      refreshToken,
-      expiresIn: 7200,
-    }),
-    revokeToken: async () => {},
-  };
-}
-
-module('[Unit] TokenManager', function() {
-  module('getTokens', function() {
-    test('delegates to flow.exchangeCode and sets expiresAt', async function(assert) {
-      const manager = new TokenManager(createMockFlow());
-      const before = Date.now();
-      const result = await manager.getTokens('my-code');
-
-      assert.equal(result.accessToken, 'token-for-my-code');
-      assert.equal(result.refreshToken, 'refresh-123');
-      assert.ok(result.expiresAt >= before + 3600 * 1000);
-    });
-  });
-
-  module('refresh', function() {
-    test('delegates to flow.refreshAccessToken and sets expiresAt', async function(assert) {
-      const manager = new TokenManager(createMockFlow());
-      const result = await manager.refresh('refresh-123');
-
-      assert.equal(result.accessToken, 'new-access');
-      assert.ok(result.expiresAt > Date.now());
-    });
-  });
-
-  module('revoke', function() {
-    test('delegates to flow.revokeToken', async function(assert) {
-      let revoked = false;
-      const flow = { ...createMockFlow(), revokeToken: async () => { revoked = true; } };
-      const manager = new TokenManager(flow);
-
-      await manager.revoke('some-token');
-      assert.ok(revoked);
-    });
-  });
-
-  module('isExpired', function() {
-    test('returns true if expiresAt is in the past', function(assert) {
-      const manager = new TokenManager(createMockFlow());
-
-      assert.true(manager.isExpired({ expiresAt: Date.now() - 1000 }));
-    });
-
-    test('returns false if expiresAt is in the future', function(assert) {
-      const manager = new TokenManager(createMockFlow());
-
-      assert.false(manager.isExpired({ expiresAt: Date.now() + 60000 }));
-    });
-
-    test('returns true if tokenData is null or missing expiresAt', function(assert) {
-      const manager = new TokenManager(createMockFlow());
-
-      assert.true(manager.isExpired(null));
-      assert.true(manager.isExpired({}));
-    });
-  });
-});