31 lines
1.1 KiB
TypeScript
31 lines
1.1 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from 'vitest';
|
|
import { parseOidcCallbackState } from './callbackState';
|
|
|
|
describe('callback state parser', () => {
|
|
afterEach(() => {
|
|
delete window.__APP_CONFIG__;
|
|
vi.unstubAllEnvs();
|
|
});
|
|
|
|
it('returns error state when callback has error query', () => {
|
|
const result = parseOidcCallbackState('?error=access_denied&error_description=User%20cancelled');
|
|
|
|
expect(result.kind).toBe('error');
|
|
if (result.kind === 'error') {
|
|
expect(result.message).toBe('User cancelled');
|
|
}
|
|
});
|
|
|
|
it('returns success state with sanitized same-origin return path', () => {
|
|
const result = parseOidcCallbackState(`?returnUrl=${encodeURIComponent(`${window.location.origin}/session?tab=profile`)}`);
|
|
|
|
expect(result).toEqual({ kind: 'success', returnPath: '/session?tab=profile' });
|
|
});
|
|
|
|
it('rejects external return paths and falls back to /session', () => {
|
|
const result = parseOidcCallbackState('?returnUrl=https%3A%2F%2Fevil.example%2Fpwn');
|
|
|
|
expect(result).toEqual({ kind: 'success', returnPath: '/session' });
|
|
});
|
|
});
|