Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

gitagentscloudflarerustforgemcp
40 linesCodeBlameRaw
1import assert from "node:assert/strict";
2import { test } from "node:test";
3
4import { ssoAddresses } from "@g1t/contracts/sso";
5
6import { SSO_ERROR_COOKIE, afterSso, errorCookie, readErrorCookie, samlPath } from "./sso.ts";
7
8test("only a workspace's SAML address is answered before React Router", () => {
9 assert.equal(samlPath("/auth/sso/acme/saml"), "acme");
10 assert.equal(samlPath("/auth/sso/Acme-Co/saml/"), "acme-co");
11 assert.equal(samlPath("/auth/sso/acme/callback"), null);
12 assert.equal(samlPath("/auth/sso/acme/saml/extra"), null);
13 assert.equal(samlPath("/auth/sso/-acme/saml"), null);
14 assert.equal(samlPath("/acme/-/sso"), null);
15});
16
17test("afterwards it goes on to the workspace, never off the site", () => {
18 assert.equal(afterSso({ slug: "acme", next: "/" }), "/acme");
19 assert.equal(afterSso({ slug: "acme", next: "/acme/-/sso" }), "/acme/-/sso");
20 assert.equal(afterSso({ slug: "acme", next: "//evil.test" }), "/acme");
21 assert.equal(afterSso({ slug: "acme", next: "https://evil.test/" }), "/acme");
22});
23
24test("why a SAML sign-in failed survives the trip in a cookie", () => {
25 const set = errorCookie("The assertion is not for g1t; set the audience = x.");
26 assert.match(set, /HttpOnly; Secure; SameSite=Lax; Max-Age=60/);
27 const value = set.split(";")[0];
28 assert.equal(readErrorCookie(`a=b; ${value}`), "The assertion is not for g1t; set the audience = x.");
29 assert.equal(readErrorCookie(`${SSO_ERROR_COOKIE}=%E0%A4%A`), null);
30 assert.equal(readErrorCookie(null), null);
31});
32
33test("a workspace's provider is pointed at its own addresses", () => {
34 assert.deepEqual(ssoAddresses("https://g1t.sh/", "Acme"), {
35 entityId: "https://g1t.sh/auth/sso/acme/metadata",
36 metadataUrl: "https://g1t.sh/auth/sso/acme/metadata",
37 acsUrl: "https://g1t.sh/auth/sso/acme/saml",
38 callbackUrl: "https://g1t.sh/auth/sso/acme/callback",
39 });
40});