Something went wrong. Try again.
An AT Protocol Personal Data Server written in JavaScript pdsjs.dev
pds atproto
Something went wrong. Try again.
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283// The forge auth wiring: the client metadata document, the login redirect// against a stubbed authorization server, the session cookie the callback// sets, and the owner-only procedure refusing a stranger's session.
import { mkdtempSync, rmSync } from 'node:fs';import { tmpdir } from 'node:os';import { join } from 'node:path';import { createAppViewStore } from '@pdsjs/appview/store';import Database from 'better-sqlite3';import { afterEach, describe, expect, it } from 'vitest';import { createForgeAuth } from '../src/auth.js';import { createRemoteAccount } from '../src/remote.js';import { createGitHostServer } from '../src/server.js';
const PDS_PORT = 2522;const PDS_BASE = `http://127.0.0.1:${PDS_PORT}`;const HOST_PORT = 2523;const ORIGIN = `http://127.0.0.1:${HOST_PORT}`;const DID = 'did:plc:forgeowner';
/** @type {Array<{close: () => Promise<void>}>} */const closers = [];/** @type {string[]} */const dirs = [];
afterEach(async () => { for (const closer of closers.splice(0)) { await closer.close().catch(() => {}); } for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });});
describe('forge auth', () => { it('serves the client metadata document the client_id names', async () => { const dir = mkdtempSync(join(tmpdir(), 'git-host-auth-')); dirs.push(dir); const auth = createForgeAuth({ origin: ORIGIN, accountDid: DID }); const server = createGitHostServer({ account: createRemoteAccount({ service: PDS_BASE, account: DID, fetch: async () => Response.json({ did: DID, handle: 'forge.test' }), }), store: createAppViewStore(new Database(':memory:')), auth, origin: ORIGIN, }); closers.push(server); await server.listen(HOST_PORT);
const doc = await fetch(`${ORIGIN}/oauth/client-metadata.json`).then( (r) => /** @type {any} */ (r.json()), ); expect(doc.client_id).toBe(`${ORIGIN}/oauth/client-metadata.json`); expect(doc.redirect_uris).toEqual([`${ORIGIN}/oauth/callback`]); expect(doc.dpop_bound_access_tokens).toBe(true); });
it('refuses an owner procedure without a session, and serves reads', async () => { const dir = mkdtempSync(join(tmpdir(), 'git-host-auth-')); dirs.push(dir); const server = createGitHostServer({ account: createRemoteAccount({ service: PDS_BASE, account: DID, fetch: async () => Response.json({ did: DID, handle: 'forge.test' }), }), store: createAppViewStore(new Database(':memory:')), origin: ORIGIN, }); closers.push(server); await server.listen(HOST_PORT);
const refusal = await fetch(`${ORIGIN}/xrpc/dev.pdsjs.git.createRepo`, { method: 'POST', headers: { 'content-type': 'application/json', origin: ORIGIN }, body: JSON.stringify({ name: 'proj' }), }); expect(refusal.status).toBe(401); });});