passport-steam-openid 1.0.1 → 1.0.3

package/.eslintrc.js

@@ -15,7 +15,7 @@ module.exports = {
     node: true,
     jest: true,
   },
-  ignorePatterns: ['.eslintrc.js', 'sample/*'],
+  ignorePatterns: ['.eslintrc.js', 'sample/*', 'test/*'],
   rules: {
     '@typescript-eslint/interface-name-prefix': 'off',
     '@typescript-eslint/explicit-function-return-type': 'off',

package/.github/workflows/pull-request.yml

@@ -21,3 +21,9 @@ jobs:
 
       - run: npm run build
         name: Compile library
+
+      - run: npm run test
+        name: Run unit tests
+
+      - run: npm run test:integration
+        name: Run integration test

package/.github/workflows/release.yml

@@ -21,6 +21,12 @@ jobs:
       - run: npm run build
         name: Compile library
 
+      - run: npm run test
+        name: Run unit tests
+
+      - run: npm run test:integration
+        name: Run integration test
+
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package/README.md

@@ -3,6 +3,8 @@ Passport strategy for authenticating with steam openid without the use of 3rd pa
 which have been proved to be source of many exploits of steam openid system, apparently by design.
 This package only relies on [passport](https://www.passportjs.org/) and [axios](https://axios-http.com/).
 
+Library is fully covered with tests, both unit and integration tests to make sure everything runs correctly.
+
 ## Usage
 ```ts
 import { SteamOpenIdStrategy } from 'passport-steam-openid';

package/dist/strategy.js

@@ -286,7 +286,7 @@ class SteamOpenIdStrategy extends passport_1.Strategy {
                 steamids: steamId,
                 key: this.apiKey,
             };
-            return axios_1.default
+            return this.axios
                 .get(`${constant_1.PLAYER_SUMMARY_URL}/?${querystring_1.default.stringify(summaryQuery)}`)
                 .then(({ data }) => {
                 var _a;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passport-steam-openid",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Passport strategy for authenticating with steam openid without the use of 3rd party openid packages.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,9 +8,12 @@
     "build": "npx tsc",
     "format": "npx prettier --write \"src/**/*.ts\"",
     "lint": "npx eslint \"{src,test}/**/*.ts\" --fix",
-    "test": "echo \"Error: no test specified\" && exit 1",
     "prepare": "npx husky install",
-    "semantic-release": "semantic-release"
+    "semantic-release": "semantic-release",
+    "test": "npx mocha -r ts-node/register 'test/*.ts'",
+    "test:integration": "npx mocha -r ts-node/register 'test/integration/*.ts'",
+    "test:coverage": "npx nyc --reporter=text \"npm run test:integration && npm run test\"",
+    "test:coverage:html": "npx nyc --reporter=html \"npm run test:integration && npm run test\""
   },
   "keywords": [],
   "author": "glencoco",
@@ -22,19 +25,35 @@
   "devDependencies": {
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
+    "@types/chai": "^4.3.5",
+    "@types/chai-as-promised": "^7.1.5",
+    "@types/express": "^4.17.17",
+    "@types/express-session": "^1.17.7",
+    "@types/mocha": "^10.0.1",
     "@types/node": "^20.3.1",
     "@types/passport": "^1.0.12",
+    "@types/sinon": "^10.0.15",
     "@typescript-eslint/eslint-plugin": "^5.59.11",
     "@typescript-eslint/parser": "^5.59.11",
+    "chai": "^4.3.7",
+    "chai-as-promised": "^7.1.1",
+    "chai-http": "^4.4.0",
     "cz-conventional-changelog": "^3.3.0",
     "eslint": "^8.43.0",
     "eslint-config-prettier": "^8.8.0",
     "eslint-plugin-prettier": "^4.2.1",
     "eslint-plugin-sonarjs": "^0.19.0",
+    "express": "^4.18.2",
+    "express-session": "^1.17.3",
     "husky": "^8.0.3",
     "lint-staged": "^13.2.2",
+    "mocha": "^10.2.0",
+    "nock": "^13.3.2",
+    "nyc": "^15.1.0",
     "prettier": "^2.8.8",
     "semantic-release": "^21.0.5",
+    "sinon": "^15.2.0",
+    "ts-node": "^10.9.1",
     "typescript": "^5.1.3"
   },
   "config": {

package/sample/package-lock.json

@@ -695,9 +695,9 @@
       "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="
     },
     "node_modules/axios": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.4.0.tgz",
-      "integrity": "sha512-S4XCWMEmzvo64T9GfvQDOXgYRDJ/wsSZc7Jvdgx5u1sd0JwsuPLqb3SYmusag+edF6ziyMensPVqLTSc1PiSEA==",
+      "version": "1.6.2",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.6.2.tgz",
+      "integrity": "sha512-7i24Ri4pmDRfJTR7LDBhsOTtcm+9kjX5WiY1X3wIisx6G9So3pfMkEiU7emUBe46oceVImccTEM3k6C5dbVW8A==",
       "dependencies": {
         "follow-redirects": "^1.15.0",
         "form-data": "^4.0.0",
@@ -1477,9 +1477,9 @@
       "dev": true
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.2",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz",
-      "integrity": "sha512-VQLG33o04KaQ8uYi2tVNbdrWp1QWxNNea+nmIB4EVM28v0hmP17z7aG1+wAkNzVq4KeXTq3221ye5qTJP91JwA==",
+      "version": "1.15.4",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.4.tgz",
+      "integrity": "sha512-Cr4D/5wlrb0z9dgERpUL3LrmPKVDsETIJhaCMeDfuFYcqa5bldGV6wBsAN6X/vxlXQtFBMrXdXxdL8CbDTGniw==",
       "funding": [
         {
           "type": "individual",
@@ -2658,9 +2658,9 @@
       }
     },
     "node_modules/word-wrap": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz",
-      "integrity": "sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.4.tgz",
+      "integrity": "sha512-2V81OA4ugVo5pRo46hAoD2ivUJx8jXmWXfUkY4KFNw0hEptvN0QfH3K4nHiwzGeKl5rFKedV48QVoqYavy4YpA==",
       "dev": true,
       "engines": {
         "node": ">=0.10.0"

package/src/strategy.ts

@@ -364,7 +364,7 @@ export class SteamOpenIdStrategy<
       key: this.apiKey,
     };
 
-    return axios
+    return this.axios
       .get<SteamPlayerSummaryResponse>(
         `${PLAYER_SUMMARY_URL}/?${qs.stringify(summaryQuery)}`,
       )

package/test/integration/setup/data.ts

@@ -0,0 +1,30 @@
+import { VALID_NONCE, VALID_OPENID_ENDPOINT } from '../../../src';
+
+export const STEAMID = '76561197960435530';
+export const SUCCESSFUL_QUERY: Record<string, string> = {
+  'openid.mode': 'id_res',
+  'openid.ns': VALID_NONCE,
+  'openid.identity': `https://steamcommunity.com/openid/id/${STEAMID}`,
+  'openid.claimed_id': `https://steamcommunity.com/openid/id/${STEAMID}`,
+  'openid.return_to': '/auth/steam',
+  'openid.op_endpoint': VALID_OPENID_ENDPOINT,
+  'openid.response_nonce': `${new Date().toJSON()}8df86bac92ad1addaf3735a5aabdc6e2a7`,
+  'openid.assoc_handle': '1234567890',
+  'openid.signed':
+    'signed,op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle',
+  'openid.sig': 'dc6e2a79de2c6aceac495ad5f4c6b6e0bfe30',
+};
+
+export function validateBody(body: Record<string, string>) {
+  const queryKeys = Object.keys(SUCCESSFUL_QUERY);
+  const bodyKeys = Object.keys(body);
+
+  for (let i = 0; i < queryKeys.length; i++) {
+    const key: string = queryKeys[i] as string;
+    if (key !== bodyKeys[i] && SUCCESSFUL_QUERY[key] != body[key]) {
+      return false;
+    }
+  }
+
+  return true;
+}

package/test/integration/setup/server.ts

@@ -0,0 +1,89 @@
+import express, { NextFunction, Request, Response } from 'express';
+import passport from 'passport';
+import session from 'express-session';
+import {
+  SteamOpenIdError,
+  SteamOpenIdStrategy,
+  SteamOpenIdUser,
+} from '../../../src';
+
+/**
+ * Exported server for superagent.
+ *
+ * This server acts as a basic implementation
+ * of express server with passport authentication,
+ * using a single endpoint that handles everything
+ * via the provided strategy.
+ *
+ * This configuration does not fetch user information from the API.
+ *
+ * Error handling hides all important details of this implementation.
+ * Other important factors should be handled by helmet.js
+ */
+export const server = express();
+
+/**
+ * Type definition for user property on request object.
+ *
+ * Only required for the response from successful authentication.
+ */
+declare module 'express-serve-static-core' {
+  interface Request {
+    user?: SteamOpenIdUser | undefined;
+  }
+}
+
+/**
+ * Server setup includes:
+ * - passport strategy initialization
+ * - passport initialization
+ * - session middleware
+ * - auth endpoint setup
+ * - error handling
+ */
+
+passport.use(
+  new SteamOpenIdStrategy(
+    {
+      profile: false,
+      returnURL: `/auth/steam`,
+    },
+    (_req, _steamId, profile, done) => {
+      done(null, profile);
+    },
+  ),
+);
+
+passport.serializeUser((user: any, done) => {
+  done(null, user.steamid);
+});
+
+passport.deserializeUser((user: any, done) => {
+  done(null, { steamid: user });
+});
+
+server.use(
+  session({
+    secret: 'secret',
+    resave: true,
+    saveUninitialized: true,
+  }),
+);
+server.use(passport.initialize());
+server.use(passport.session());
+
+server.get('/auth/steam', passport.authenticate('steam-openid'), (req, res) => {
+  res.status(200).send(`Authenticated as ${req.user?.steamid}`);
+});
+
+server.use(
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  (err: Error, _req: Request, res: Response, _next: NextFunction): void => {
+    if (err instanceof SteamOpenIdError) {
+      res.status(401).send('Unauthorized');
+      return;
+    }
+
+    res.status(500).send('Internal Server Error.');
+  },
+);

package/test/integration/strategy.ts

@@ -0,0 +1,121 @@
+import chai, { expect } from 'chai';
+import chaiHttp from 'chai-http';
+import nock from 'nock';
+
+import { server } from './setup/server';
+import { STEAMID, SUCCESSFUL_QUERY, validateBody } from './setup/data';
+import {
+  VALID_ID_SELECT,
+  VALID_NONCE,
+  VALID_OPENID_ENDPOINT,
+} from '../../src/constant';
+
+chai.use(chaiHttp);
+chai.should();
+
+describe('SteamOpenIdStrategy Integration Test', () => {
+  it('Successfully receives a redirect from steam', (done) => {
+    const response = '<h1>Successful redirect to steam</h1>';
+
+    nock('https://steamcommunity.com')
+      .get('/openid/login')
+      .query((query) => {
+        return (
+          query['openid.mode'] === 'checkid_setup' &&
+          query['openid.ns'] === VALID_NONCE &&
+          query['openid.identity'] === VALID_ID_SELECT &&
+          query['openid.claimed_id'] === VALID_ID_SELECT &&
+          query['openid.return_to'] === '/auth/steam'
+        );
+      })
+      .reply(200, response, {
+        'Content-Type': 'text/plain',
+      });
+
+    chai
+      .request(server)
+      .get('/auth/steam')
+      .redirects(1)
+      .end((err, res) => {
+        if (err) {
+          done(err);
+          return;
+        }
+
+        res.should.redirectTo(new RegExp(`^${VALID_OPENID_ENDPOINT}`));
+        res.should.have.status(200);
+        expect(res.type).equal('text/plain');
+        expect(res.text).equal(response);
+
+        done();
+      });
+  });
+
+  it('Successfully authenticates a valid user', (done) => {
+    nock('https://steamcommunity.com')
+      .post('/openid/login', validateBody)
+      .matchHeader('Content-Type', 'application/x-www-form-urlencoded')
+      .reply(200, 'ns:http://specs.openid.net/auth/2.0\nis_valid:true\n');
+
+    chai
+      .request(server)
+      .get('/auth/steam')
+      .query(SUCCESSFUL_QUERY)
+      .redirects(0)
+      .end((err, res) => {
+        if (err) {
+          done(err);
+          return;
+        }
+
+        res.should.have.status(200);
+        expect(res.text).equal(`Authenticated as ${STEAMID}`);
+
+        done();
+      });
+  });
+
+  describe('Fails due to invalid response', () => {
+    it('Has invalid response nonce', (done) => {
+      nock('https://steamcommunity.com')
+        .post('/openid/login', validateBody)
+        .reply(200, 'ns:http://specs.openid.net/auth/1.0\nis_valid:true\n');
+
+      chai
+        .request(server)
+        .get('/auth/steam')
+        .query(SUCCESSFUL_QUERY)
+        .redirects(0)
+        .end((err, res) => {
+          if (err) {
+            done(err);
+            return;
+          }
+
+          res.should.have.status(401);
+          done();
+        });
+    });
+
+    it('Has is_valid set to false', (done) => {
+      nock('https://steamcommunity.com')
+        .post('/openid/login', validateBody)
+        .reply(200, 'ns:http://specs.openid.net/auth/2.0\nis_valid:false\n');
+
+      chai
+        .request(server)
+        .get('/auth/steam')
+        .query(SUCCESSFUL_QUERY)
+        .redirects(0)
+        .end((err, res) => {
+          if (err) {
+            done(err);
+            return;
+          }
+
+          res.should.have.status(401);
+          done();
+        });
+    });
+  });
+});

package/test/setup/data.ts

@@ -0,0 +1,41 @@
+import { VALID_NONCE, VALID_OPENID_ENDPOINT } from '../../src';
+
+export const RETURN_URL = '/auth/steam';
+
+export const query: {
+  properties: Record<string, string>;
+  get(): Record<string, string>;
+  change(change: Record<string, string>): Record<string, string>;
+  remove(property: string): Record<string, string>;
+} = {
+  /**
+   * Valid query properties
+   */
+  properties: {
+    'openid.mode': 'id_res',
+    'openid.ns': VALID_NONCE,
+    'openid.identity': `https://steamcommunity.com/openid/id/76561197960435530`,
+    'openid.claimed_id': `https://steamcommunity.com/openid/id/76561197960435530`,
+    'openid.return_to': RETURN_URL,
+    'openid.op_endpoint': VALID_OPENID_ENDPOINT,
+    'openid.response_nonce': `${new Date().toJSON()}8df86bac92ad1addaf3735a5aabdc6e2a7`,
+    'openid.assoc_handle': '1234567890',
+    'openid.signed':
+      'signed,op_endpoint,claimed_id,identity,return_to,response_nonce,assoc_handle',
+    'openid.sig': 'dc6e2a79de2c6aceac495ad5f4c6b6e0bfe30',
+  },
+
+  get() {
+    return { ...this.properties };
+  },
+
+  change(change: Record<string, string>) {
+    return { ...this.get(), ...change };
+  },
+
+  remove(property: string) {
+    const properties = this.get();
+    delete properties[property];
+    return properties;
+  },
+};

package/test/strategy.ts

@@ -0,0 +1,725 @@
+import qs from 'querystring';
+import sinon from 'sinon';
+import chaiAsPromised from 'chai-as-promised';
+import chai, { expect } from 'chai';
+import { URL } from 'url';
+import {
+  SteamOpenIdError,
+  SteamOpenIdErrorType,
+  SteamOpenIdStrategy,
+  SteamOpenIdStrategyOptionsWithoutProfile,
+  SteamOpenIdUser,
+  VALID_ID_SELECT,
+  VALID_NONCE,
+  OPENID_QUERY_PROPS,
+  VALID_OPENID_ENDPOINT,
+  PLAYER_SUMMARY_URL,
+} from '../src';
+import { RETURN_URL, query } from './setup/data';
+
+chai.use(chaiAsPromised);
+
+describe('SteamOpenIdStrategy Unit Test', () => {
+  let strategy: SteamOpenIdStrategy<
+    SteamOpenIdStrategyOptionsWithoutProfile,
+    SteamOpenIdUser
+  >;
+
+  beforeEach(() => {
+    strategy = new SteamOpenIdStrategy({
+      apiKey: 'an api key',
+      profile: false,
+      returnURL: RETURN_URL,
+    });
+  });
+
+  describe('authenticate', () => {
+    let successStub: sinon.SinonStub;
+    let failStub: sinon.SinonStub;
+    let errorStub: sinon.SinonStub;
+    let redirectStub: sinon.SinonStub;
+
+    beforeEach(() => {
+      strategy.success = () => null;
+      strategy.fail = () => null;
+      strategy.error = () => null;
+      strategy.redirect = () => null;
+
+      successStub = sinon.stub(strategy, 'success');
+      failStub = sinon.stub(strategy, 'fail');
+      errorStub = sinon.stub(strategy, 'error');
+      redirectStub = sinon.stub(strategy, 'redirect');
+    });
+
+    it('Authenticates user without verify function', async () => {
+      const request = {};
+      const user = { steamid: '76561197960435530' };
+
+      const handleRequestStub = sinon
+        .stub(strategy, 'handleRequest')
+        .resolves(user);
+
+      await strategy.authenticate(request);
+
+      expect(handleRequestStub.callCount).equal(1);
+      expect(handleRequestStub.calledWithExactly(request)).equal(true);
+      expect(successStub.callCount).equal(1);
+      expect(successStub.calledWithExactly(user)).equal(true);
+      expect(failStub.callCount).equal(0);
+      expect(errorStub.callCount).equal(0);
+      expect(redirectStub.callCount).equal(0);
+    });
+
+    it('Authenticates and calls verify function', async () => {
+      strategy['verify'] = (_, __, user, callback) => {
+        callback(null, user);
+      };
+
+      const request = {};
+      const user = { steamid: '76561197960435530' };
+
+      const verifySpy = sinon.spy(strategy, 'verify' as any);
+      const handleRequestStub = sinon
+        .stub(strategy, 'handleRequest')
+        .resolves(user);
+
+      await strategy.authenticate(request);
+
+      expect(handleRequestStub.callCount).equal(1);
+      expect(handleRequestStub.calledWithExactly(request)).equal(true);
+      expect(verifySpy.callCount).equal(1);
+      expect(verifySpy.calledWithMatch(request, user.steamid, user)).equal(
+        true,
+      );
+      expect(successStub.callCount).equal(1);
+      expect(successStub.calledWithExactly(user)).equal(true);
+      expect(failStub.callCount).equal(0);
+      expect(errorStub.callCount).equal(0);
+      expect(redirectStub.callCount).equal(0);
+    });
+
+    it('Fails to handle request but gets redirected', async () => {
+      const request = {};
+      const error = new SteamOpenIdError(
+        'Invalid mode',
+        SteamOpenIdErrorType.InvalidMode,
+      );
+      const url = 'redirect url';
+
+      const isRetryableErrorStub = sinon
+        .stub(strategy as any, 'isRetryableError')
+        .returns(true);
+      const buildRedirectUrlStub = sinon
+        .stub(strategy as any, 'buildRedirectUrl')
+        .returns(url);
+      const handleRequestStub = sinon
+        .stub(strategy, 'handleRequest')
+        .rejects(error);
+
+      await strategy.authenticate(request);
+
+      expect(isRetryableErrorStub.callCount).equal(1);
+      expect(isRetryableErrorStub.calledWithExactly(error)).equal(true);
+      expect(buildRedirectUrlStub.callCount).equal(1);
+      expect(buildRedirectUrlStub.calledWithExactly()).equal(true);
+      expect(handleRequestStub.callCount).equal(1);
+      expect(handleRequestStub.calledWithExactly(request)).equal(true);
+      expect(redirectStub.callCount).equal(1);
+      expect(redirectStub.calledWithExactly(url)).equal(true);
+      expect(errorStub.callCount).equal(0);
+      expect(failStub.callCount).equal(0);
+      expect(successStub.callCount).equal(0);
+    });
+
+    it('Fails to handle request and terminates', async () => {
+      const request = {};
+      const error = new Error('Not retryable');
+
+      const handleRequestStub = sinon
+        .stub(strategy, 'handleRequest')
+        .rejects(error);
+
+      await strategy.authenticate(request);
+
+      expect(handleRequestStub.callCount).equal(1);
+      expect(handleRequestStub.calledWithExactly(request)).equal(true);
+      expect(errorStub.callCount).equal(1);
+      expect(errorStub.calledWithExactly(error)).equal(true);
+      expect(failStub.callCount).equal(0);
+      expect(successStub.callCount).equal(0);
+      expect(redirectStub.callCount).equal(0);
+    });
+
+    it('Verify function fails', async () => {
+      const error = new Error('Verify error');
+      strategy['verify'] = (_, __, ___, callback) => {
+        callback(error);
+      };
+
+      const request = {};
+      const user = { steamid: '76561197960435530' };
+
+      const verifySpy = sinon.spy(strategy, 'verify' as any);
+      const handleRequestStub = sinon
+        .stub(strategy, 'handleRequest')
+        .resolves(user);
+
+      await strategy.authenticate(request);
+
+      expect(handleRequestStub.callCount).equal(1);
+      expect(handleRequestStub.calledWithExactly(request)).equal(true);
+      expect(verifySpy.callCount).equal(1);
+      expect(verifySpy.calledWithMatch(request, user.steamid, user)).equal(
+        true,
+      );
+      expect(errorStub.callCount).equal(1);
+      expect(errorStub.calledWithExactly(error)).equal(true);
+      expect(failStub.callCount).equal(0);
+      expect(successStub.callCount).equal(0);
+      expect(redirectStub.callCount).equal(0);
+    });
+
+    it('Verify returns no user', async () => {
+      strategy['verify'] = (_, __, ___, callback) => {
+        callback(null, null);
+      };
+
+      const request = {};
+      const user = { steamid: '76561197960435530' };
+
+      const verifySpy = sinon.spy(strategy, 'verify' as any);
+      const handleRequestStub = sinon
+        .stub(strategy, 'handleRequest')
+        .resolves(user);
+
+      await strategy.authenticate(request);
+
+      expect(handleRequestStub.callCount).equal(1);
+      expect(handleRequestStub.calledWithExactly(request)).equal(true);
+      expect(verifySpy.callCount).equal(1);
+      expect(verifySpy.calledWithMatch(request, user.steamid, user)).equal(
+        true,
+      );
+      expect(errorStub.callCount).equal(1);
+      expect(failStub.callCount).equal(0);
+      expect(successStub.callCount).equal(0);
+      expect(redirectStub.callCount).equal(0);
+    });
+  });
+
+  describe('handleRequest', () => {
+    const request = {};
+    const query = {};
+
+    let getQueryStub: sinon.SinonStub;
+    let hasAuthQueryStub: sinon.SinonStub;
+    let isQueryValidStub: sinon.SinonStub;
+    let validateAgainstSteamStub: sinon.SinonStub;
+
+    beforeEach(() => {
+      getQueryStub = sinon.stub(strategy as any, 'getQuery').returns(query);
+      hasAuthQueryStub = sinon.stub(strategy as any, 'hasAuthQuery');
+      isQueryValidStub = sinon.stub(strategy as any, 'isQueryValid');
+      validateAgainstSteamStub = sinon.stub(
+        strategy as any,
+        'validateAgainstSteam',
+      );
+    });
+
+    afterEach(() => {
+      expect(getQueryStub.callCount).equal(1);
+      expect(getQueryStub.calledWithExactly(request)).equal(true);
+      expect(hasAuthQueryStub.callCount).equal(1);
+      expect(hasAuthQueryStub.calledWithExactly(query)).equal(true);
+    });
+
+    it('Handles request correctly', async () => {
+      hasAuthQueryStub.returns(true);
+      isQueryValidStub.returns(true);
+      validateAgainstSteamStub.resolves(true);
+
+      const steamid = '76561197960435530';
+      const user = { steamid: '76561197960435530' };
+
+      const getSteamIdStub = sinon
+        .stub(strategy as any, 'getSteamId')
+        .returns(steamid);
+      const getUserStub = sinon.stub(strategy as any, 'getUser').resolves(user);
+
+      expect(await strategy.handleRequest(request)).equal(user);
+      expect(getSteamIdStub.callCount).equal(1);
+      expect(getSteamIdStub.calledWithExactly(query)).equal(true);
+      expect(getUserStub.callCount).equal(1);
+      expect(getUserStub.calledWithExactly(steamid)).equal(true);
+      expect(isQueryValidStub.callCount).equal(1);
+      expect(isQueryValidStub.calledWithExactly(query)).equal(true);
+      expect(validateAgainstSteamStub.callCount).equal(1);
+      expect(validateAgainstSteamStub.calledWithExactly(query)).equal(true);
+    });
+
+    it('Does not have correct mode', async () => {
+      hasAuthQueryStub.returns(false);
+
+      let err: any;
+      try {
+        await strategy.handleRequest(request);
+      } catch (e) {
+        err = e;
+      }
+
+      expect(err).to.be.instanceOf(SteamOpenIdError);
+      expect(err).to.have.property('code', SteamOpenIdErrorType.InvalidMode);
+    });
+
+    it('Query is invalid', async () => {
+      hasAuthQueryStub.returns(true);
+      isQueryValidStub.returns(false);
+
+      let err: any;
+      try {
+        await strategy.handleRequest(request);
+      } catch (e) {
+        err = e;
+      }
+
+      expect(err).to.be.instanceOf(SteamOpenIdError);
+      expect(err).to.have.property('code', SteamOpenIdErrorType.InvalidQuery);
+      expect(isQueryValidStub.callCount).equal(1);
+      expect(isQueryValidStub.calledWithExactly(query)).equal(true);
+    });
+
+    it('Steam rejects this authentication request', async () => {
+      hasAuthQueryStub.returns(true);
+      isQueryValidStub.returns(true);
+      validateAgainstSteamStub.resolves(false);
+
+      let err: any;
+      try {
+        await strategy.handleRequest(request);
+      } catch (e) {
+        err = e;
+      }
+
+      expect(err).to.be.instanceOf(SteamOpenIdError);
+      expect(err).to.have.property('code', SteamOpenIdErrorType.Unauthorized);
+      expect(isQueryValidStub.callCount).equal(1);
+      expect(isQueryValidStub.calledWithExactly(query)).equal(true);
+      expect(validateAgainstSteamStub.callCount).equal(1);
+      expect(validateAgainstSteamStub.calledWithExactly(query)).equal(true);
+    });
+  });
+
+  describe('isRetryableError', () => {
+    it('Is retriable error', () => {
+      const error = new SteamOpenIdError(
+        'Message',
+        SteamOpenIdErrorType.InvalidMode,
+      );
+      expect(strategy['isRetryableError'](error)).equal(true);
+    });
+
+    it('Not an instance of SteamOpenIdError', () => {
+      const error = new Error('Message');
+      expect(strategy['isRetryableError'](error)).equal(false);
+    });
+
+    it('Wrong error code', () => {
+      const error = new SteamOpenIdError(
+        'Message',
+        SteamOpenIdErrorType.InvalidSteamId,
+      );
+      expect(strategy['isRetryableError'](error)).equal(false);
+    });
+  });
+
+  describe('getQuery', () => {
+    it('Returns query from request', () => {
+      const request = { query: {} };
+      expect(strategy['getQuery'](request)).equal(request.query);
+    });
+
+    it('Fails because query is not present', () => {
+      const request = {};
+      expect(strategy['getQuery'].bind(strategy, request)).to.throw(Error);
+    });
+
+    it('Fails because query is not an object', () => {
+      const request = { query: 'string' };
+      expect(strategy['getQuery'].bind(strategy, request)).to.throw(Error);
+    });
+  });
+
+  describe('hasAuthQuery', () => {
+    it('Is an auth query', () => {
+      const query = { 'openid.mode': 'id_res' };
+      expect(strategy['hasAuthQuery'](query)).equal(true);
+    });
+
+    it('Mode is not present', () => {
+      const query = {};
+      expect(strategy['hasAuthQuery'](query)).equal(false);
+    });
+
+    it('Wrong mode', () => {
+      const query = { 'openid.mode': 'checkid_setup' };
+      expect(strategy['hasAuthQuery'](query)).equal(false);
+    });
+  });
+
+  describe('buildRedirectUrl', () => {
+    it('Builds a redirect url to steam', () => {
+      const urlString = strategy['buildRedirectUrl']();
+      const url = new URL(urlString);
+
+      expect(url.origin).equal('https://steamcommunity.com');
+      expect(url.pathname).equal('/openid/login');
+
+      const VALID_PARAMS: Record<string, string> = {
+        'openid.mode': 'checkid_setup',
+        'openid.ns': VALID_NONCE,
+        'openid.identity': VALID_ID_SELECT,
+        'openid.claimed_id': VALID_ID_SELECT,
+        'openid.return_to': RETURN_URL,
+      };
+
+      url.searchParams.forEach((value, name) => {
+        if (VALID_PARAMS[name] !== value) {
+          throw new Error(`Unknown param: ${name} = ${value}.`);
+        }
+      });
+    });
+  });
+
+  describe('isQueryValid', () => {
+    let isValidIdentityStub: sinon.SinonStub;
+
+    beforeEach(() => {
+      isValidIdentityStub = sinon.stub(strategy as any, 'isValidIdentity');
+    });
+
+    it('Is valid query', () => {
+      isValidIdentityStub.returns(true);
+      expect(strategy['isQueryValid'](query.get())).equal(true);
+      expect(isValidIdentityStub.callCount).equal(1);
+      expect(
+        isValidIdentityStub.calledWithExactly(
+          query.properties['openid.claimed_id'],
+        ),
+      );
+    });
+
+    it('Property is missing', () => {
+      for (const property of OPENID_QUERY_PROPS) {
+        expect(strategy['isQueryValid'](query.remove(property))).equal(false);
+      }
+    });
+
+    it('Invalid nonce', () => {
+      expect(
+        strategy['isQueryValid'](query.change({ 'openid.ns': 'content' })),
+      ).equal(false);
+    });
+
+    it('Invalid endpoint', () => {
+      expect(
+        strategy['isQueryValid'](
+          query.change({ 'openid.op_endpoint': 'content' }),
+        ),
+      ).equal(false);
+    });
+
+    it("ClaimedId and Identity don' match", () => {
+      expect(
+        strategy['isQueryValid'](
+          query.change({ 'openid.claimed_id': 'content' }),
+        ),
+      ).equal(false);
+      expect(isValidIdentityStub.callCount).equal(0);
+    });
+
+    it('ClaimedId is invalid', () => {
+      isValidIdentityStub.returns(false);
+      const claimedIdValue = 'content';
+      expect(
+        strategy['isQueryValid'](
+          query.change({
+            'openid.claimed_id': claimedIdValue,
+            'openid.identity': claimedIdValue,
+          }),
+        ),
+      ).equal(false);
+      expect(isValidIdentityStub.callCount).equal(1);
+      expect(isValidIdentityStub.calledWithExactly(claimedIdValue));
+    });
+
+    it('Return does not match', () => {
+      isValidIdentityStub.returns(true);
+      expect(
+        strategy['isQueryValid'](
+          query.change({ 'openid.return_to': 'content' }),
+        ),
+      ).equal(false);
+      expect(isValidIdentityStub.callCount).equal(1);
+      expect(
+        isValidIdentityStub.calledWithExactly(
+          query.properties['openid.claimed_id'],
+        ),
+      );
+    });
+  });
+
+  describe('isValidIdentity', () => {
+    it('Is valid identity', () => {
+      const identity = 'https://steamcommunity.com/openid/id/76561197960435530';
+      expect(strategy['isValidIdentity'](identity)).equal(true);
+    });
+
+    it('Is not a string', () => {
+      const identity = null;
+      expect(strategy['isValidIdentity'](identity)).equal(false);
+    });
+
+    it('Does not match regex', () => {
+      const identity =
+        'https://localhost:3000?x=https://steamcommunity.com/openid/id/76561197960435530';
+      expect(strategy['isValidIdentity'](identity)).equal(false);
+    });
+  });
+
+  describe('validateAgainstSteam', () => {
+    let axiosPostStub: sinon.SinonStub;
+    let getOpenIdValidationRequestBodyStub: sinon.SinonStub;
+    let isSteamResponseValidStub: sinon.SinonStub;
+
+    const query = {};
+    const data = {};
+    const body = 'body';
+
+    beforeEach(() => {
+      axiosPostStub = sinon.stub(strategy['axios'], 'post');
+      getOpenIdValidationRequestBodyStub = sinon
+        .stub(strategy as any, 'getOpenIdValidationRequestBody')
+        .returns(body);
+      isSteamResponseValidStub = sinon.stub(
+        strategy as any,
+        'isSteamResponseValid',
+      );
+    });
+
+    afterEach(() => {
+      expect(getOpenIdValidationRequestBodyStub.callCount).equal(1);
+      expect(getOpenIdValidationRequestBodyStub.calledWithExactly(query)).equal(
+        true,
+      );
+      expect(axiosPostStub.callCount).equal(1);
+      expect(
+        axiosPostStub.calledWithExactly(VALID_OPENID_ENDPOINT, body, {
+          maxRedirects: 0,
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+          },
+        }),
+      );
+    });
+
+    it('Validates successfully', async () => {
+      axiosPostStub.resolves({ status: 200, data });
+      isSteamResponseValidStub.returns(true);
+
+      expect(await strategy['validateAgainstSteam'](query as any)).equal(true);
+      expect(isSteamResponseValidStub.callCount).equal(1);
+      expect(isSteamResponseValidStub.calledWith(data)).equal(true);
+    });
+
+    it('Wrong status code', async () => {
+      axiosPostStub.resolves({ status: 100, data });
+
+      expect(await strategy['validateAgainstSteam'](query as any)).equal(false);
+      expect(isSteamResponseValidStub.callCount).equal(0);
+    });
+
+    it('Response is invalid', async () => {
+      axiosPostStub.resolves({ status: 200, data });
+      isSteamResponseValidStub.returns(false);
+
+      expect(await strategy['validateAgainstSteam'](query as any)).equal(false);
+      expect(isSteamResponseValidStub.callCount).equal(1);
+      expect(isSteamResponseValidStub.calledWith(data)).equal(true);
+    });
+
+    it('Axios rejects', async () => {
+      axiosPostStub.rejects(new Error('Malformed.'));
+
+      expect(await strategy['validateAgainstSteam'](query as any)).equal(false);
+      expect(isSteamResponseValidStub.callCount).equal(0);
+    });
+  });
+
+  describe('getOpenIdValidationRequestBody', () => {
+    it('Stringifies query', () => {
+      const query = {
+        'openid.op_endpoint': VALID_OPENID_ENDPOINT,
+        'openid.mode': 'id_res',
+      };
+      expect(strategy['getOpenIdValidationRequestBody'](query as any)).equal(
+        qs.stringify({ ...query, 'openid.mode': 'check_authentication' }),
+      );
+    });
+  });
+
+  it('isSteamResponseValid', () => {
+    describe('Is valid steam response', () => {
+      const response = `ns:${VALID_NONCE}\nis_valid:true\n`;
+      expect(strategy['isSteamResponseValid'](response)).equal(true);
+    });
+
+    describe('Response is not a string', () => {
+      const response = {};
+      expect(strategy['isSteamResponseValid'](response)).equal(false);
+    });
+
+    describe('Response does not match', () => {
+      const response = `ns:${VALID_NONCE}\nis_valid:true`;
+      expect(strategy['isSteamResponseValid'](response)).equal(false);
+    });
+
+    describe('Invalid nonce', () => {
+      const response = `ns:xddd\nis_valid:true\n`;
+      expect(strategy['isSteamResponseValid'](response)).equal(false);
+    });
+
+    describe('Marked invalid', () => {
+      const response = `ns:${VALID_NONCE}\nis_valid:false\n`;
+      expect(strategy['isSteamResponseValid'](response)).equal(false);
+    });
+
+    describe('No match', () => {
+      const response = `invalid`;
+      expect(strategy['isSteamResponseValid'](response)).equal(false);
+    });
+  });
+
+  describe('getSteamId', () => {
+    it('Retrieves steamid from claimed_id property', () => {
+      const steamid = '76561197960435530';
+      const q = {
+        'openid.claimed_id': `https://steamcommunity.com/openid/id/${steamid}`,
+      };
+      expect(strategy['getSteamId'](q as any)).equal(steamid);
+    });
+  });
+
+  describe('getUser', () => {
+    let fetchPlayerSummaryStub: sinon.SinonStub;
+
+    beforeEach(() => {
+      fetchPlayerSummaryStub = sinon.stub(
+        strategy as any,
+        'fetchPlayerSummary',
+      );
+    });
+
+    const steamid = '76561197960435530';
+
+    it('Gets user without profile', async () => {
+      expect(await strategy['getUser'](steamid)).deep.equal({ steamid });
+      expect(fetchPlayerSummaryStub.callCount).equal(0);
+    });
+
+    it('Gets user with profile', async () => {
+      // @ts-expect-error
+      strategy['profile'] = true;
+
+      const profile = { steamid, avatar: 'url' };
+      fetchPlayerSummaryStub.resolves(profile);
+
+      expect(await strategy['getUser'](steamid)).equal(profile);
+      expect(fetchPlayerSummaryStub.callCount).equal(1);
+      expect(fetchPlayerSummaryStub.calledWithExactly(steamid)).equal(true);
+    });
+  });
+
+  describe('fetchPlayerSummary', async () => {
+    let axiosGetStub: sinon.SinonStub;
+
+    const steamid = '76561197960435530';
+    const apiKey = 'xxx';
+
+    beforeEach(() => {
+      strategy = new SteamOpenIdStrategy({
+        apiKey,
+        profile: true,
+        returnURL: RETURN_URL,
+      });
+
+      axiosGetStub = sinon.stub(strategy['axios'], 'get');
+    });
+
+    afterEach(() => {
+      expect(axiosGetStub.callCount).equal(1);
+      expect(
+        axiosGetStub.calledWithExactly(
+          `${PLAYER_SUMMARY_URL}/?${qs.stringify({
+            steamids: steamid,
+            key: apiKey,
+          })}`,
+        ),
+      ).equal(true);
+    });
+
+    it('Successfully fetches valid user profile', async () => {
+      const profile = { steamid };
+      axiosGetStub.resolves({ data: { response: { players: [profile] } } });
+
+      expect(await strategy['fetchPlayerSummary'](steamid)).equal(profile);
+    });
+
+    it('Malformed response, players is not an array', async () => {
+      axiosGetStub.resolves({ data: { response: { players: null } } });
+
+      expect(strategy['fetchPlayerSummary'](steamid)).to.rejectedWith(Error);
+    });
+
+    it('Malformed response, response is missing', async () => {
+      axiosGetStub.resolves({ data: {} });
+
+      expect(strategy['fetchPlayerSummary'](steamid)).to.rejectedWith(Error);
+    });
+
+    it('Malformed response, data is missing', async () => {
+      axiosGetStub.resolves({});
+
+      expect(strategy['fetchPlayerSummary'](steamid)).to.rejectedWith(Error);
+    });
+
+    it('No user returned', async () => {
+      axiosGetStub.resolves({ data: { response: { players: [] } } });
+
+      let err: any;
+      try {
+        await strategy['fetchPlayerSummary'](steamid);
+      } catch (e) {
+        err = e;
+      }
+
+      expect(err).instanceOf(SteamOpenIdError);
+      expect(err).to.have.property('code', SteamOpenIdErrorType.InvalidSteamId);
+    });
+
+    it('Wrong user returned', async () => {
+      axiosGetStub.resolves({
+        data: { response: { players: [{ steamid: 'x' }] } },
+      });
+
+      let err: any;
+      try {
+        await strategy['fetchPlayerSummary'](steamid);
+      } catch (e) {
+        err = e;
+      }
+
+      expect(err).instanceOf(SteamOpenIdError);
+      expect(err).to.have.property('code', SteamOpenIdErrorType.InvalidSteamId);
+    });
+  });
+});

package/tsconfig.json

@@ -37,5 +37,5 @@
     "skipDefaultLibCheck": true,
     "skipLibCheck": false
   },
-  "exclude": ["./sample", "./dist"]
+  "exclude": ["./sample", "./dist", "./test"]
 }