49 lines
2.0 KiB
TypeScript
49 lines
2.0 KiB
TypeScript
import { beforeEach, describe, expect, it, vi } from "vitest";
|
|
|
|
const session = vi.fn();
|
|
const validate = vi.fn();
|
|
const handler = vi.fn(async () => Response.json({ passed: true }));
|
|
|
|
vi.mock("server-only", () => ({}));
|
|
vi.mock("better-auth/next-js", () => ({ toNextJsHandler: () => ({ GET: handler }) }));
|
|
vi.mock("@/lib/auth/server", () => ({
|
|
getAuth: () => ({ api: { getSession: session }, handler }),
|
|
isSudlohOidcEnabled: () => true,
|
|
}));
|
|
vi.mock("@/lib/auth/sudloh", () => ({ validateSudlohSession: validate }));
|
|
|
|
const { GET, POST } = await import("./route");
|
|
|
|
beforeEach(() => {
|
|
vi.clearAllMocks();
|
|
process.env.BETTER_AUTH_URL = "https://guide.sudloh.com";
|
|
process.env.SUDLOH_OIDC_ONLY = "true";
|
|
session.mockResolvedValue({ user: { id: "user-1" }, session: { id: "session-1" } });
|
|
validate.mockResolvedValue(false);
|
|
});
|
|
|
|
describe("Better Auth Sudloh boundary", () => {
|
|
it("returns no browser session after Sudloh revokes the bound token", async () => {
|
|
const response = await GET(new Request("https://guide.sudloh.com/api/auth/get-session"));
|
|
expect(response.status).toBe(200);
|
|
expect(await response.json()).toBeNull();
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("denies other account endpoints but permits the OIDC callback", async () => {
|
|
const denied = await GET(new Request("https://guide.sudloh.com/api/auth/list-sessions"));
|
|
expect(denied.status).toBe(401);
|
|
const callback = await GET(new Request("https://guide.sudloh.com/api/auth/callback/sudloh?code=code"));
|
|
expect(callback.status).toBe(200);
|
|
});
|
|
|
|
it("denies Better Auth mutations with a revoked local session", async () => {
|
|
const response = await POST(new Request("https://guide.sudloh.com/api/auth/admin/create-user", {
|
|
method: "POST", headers: { Origin: "https://guide.sudloh.com", "Content-Type": "application/json" },
|
|
body: JSON.stringify({ password: "example-password" }),
|
|
}));
|
|
expect(response.status).toBe(401);
|
|
expect(handler).not.toHaveBeenCalled();
|
|
});
|
|
});
|