| 1 | import assert from "node:assert/strict"; |
| 2 | import { test } from "node:test"; |
| 3 | import { oauthCallback } from "./oauth-callback.ts"; |
| 4 | |
| 5 | test("successful and denied OAuth callbacks carry the exact configured issuer and state", () => { |
| 6 | for (const issuer of ["https://api.g1t.sh", "https://api.example/custom"]) { |
| 7 | for (const outcome of [{ code: "one-use-code" }, { error: "access_denied" }]) { |
| 8 | const url = new URL( |
| 9 | oauthCallback( |
| 10 | "http://localhost:8765/callback?keep=1&iss=wrong&code=old&error=old", |
| 11 | { ...outcome, state: "state & value" } as Record<string, string>, |
| 12 | issuer, |
| 13 | ), |
| 14 | ); |
| 15 | assert.deepEqual(url.searchParams.getAll("iss"), [issuer]); |
| 16 | assert.equal(url.searchParams.get("state"), "state & value"); |
| 17 | assert.equal(url.searchParams.get("keep"), "1"); |
| 18 | assert.equal(url.searchParams.get("code"), outcome.code ?? null); |
| 19 | assert.equal(url.searchParams.get("error"), outcome.error ?? null); |
| 20 | } |
| 21 | } |
| 22 | }); |