thalos-web/src/auth/callbackState.test.ts
2026-03-11 11:30:44 -06:00

31 lines
1.1 KiB
TypeScript

import { afterEach, describe, expect, it, vi } from 'vitest';
import { parseOidcCallbackState } from './callbackState';
describe('callback state parser', () => {
afterEach(() => {
delete window.__APP_CONFIG__;
vi.unstubAllEnvs();
});
it('returns error state when callback has error query', () => {
const result = parseOidcCallbackState('?error=access_denied&error_description=User%20cancelled');
expect(result.kind).toBe('error');
if (result.kind === 'error') {
expect(result.message).toBe('User cancelled');
}
});
it('returns success state with sanitized same-origin return path', () => {
const result = parseOidcCallbackState(`?returnUrl=${encodeURIComponent(`${window.location.origin}/session?tab=profile`)}`);
expect(result).toEqual({ kind: 'success', returnPath: '/session?tab=profile' });
});
it('rejects external return paths and falls back to /session', () => {
const result = parseOidcCallbackState('?returnUrl=https%3A%2F%2Fevil.example%2Fpwn');
expect(result).toEqual({ kind: 'success', returnPath: '/session' });
});
});