Something went wrong. Try again.
The logic for serving and storing associations between users and apps
Something went wrong. Try again.
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697import { describe, expect, it } from "vitest";import { buildCallbackUrl, isRegisteredCallback, parseNativeStartQuery } from "./native";
function startUrl(params: Record<string, string>): URL { const url = new URL("https://loggedin.fyi/app/start"); for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value); return url;}
describe("parseNativeStartQuery", () => { it("accepts a custom scheme callback for a valid origin", () => { const parsed = parseNativeStartQuery( startUrl({ origin: "https://your-app.example", callback: "example.your-app://loggedin", state: "xyz", }), ); expect(parsed).toEqual({ ok: true, origin: "https://your-app.example", callback: "example.your-app://loggedin", state: "xyz", }); });
it("accepts an https universal link callback", () => { const parsed = parseNativeStartQuery( startUrl({ origin: "https://your-app.example", callback: "https://your-app.example/native/loggedin", }), ); expect(parsed.ok).toBe(true); });
it("rejects script and data callbacks", () => { for (const callback of ["javascript:alert(1)", "data:text/html,<script>", "file:///etc/passwd"]) { const parsed = parseNativeStartQuery( startUrl({ origin: "https://your-app.example", callback }), ); expect(parsed.ok).toBe(false); } });
it("rejects a missing callback, a fragment, and an over-long one", () => { expect(parseNativeStartQuery(startUrl({ origin: "https://your-app.example" })).ok).toBe(false); expect( parseNativeStartQuery( startUrl({ origin: "https://your-app.example", callback: "app://cb#frag" }), ).ok, ).toBe(false); expect( parseNativeStartQuery( startUrl({ origin: "https://your-app.example", callback: `app://cb/${"x".repeat(600)}` }), ).ok, ).toBe(false); });
it("rejects a non-origin or private-network origin", () => { expect( parseNativeStartQuery(startUrl({ origin: "https://a.example/path", callback: "app://cb" })).ok, ).toBe(false); expect( parseNativeStartQuery(startUrl({ origin: "http://192.168.1.5", callback: "app://cb" })).ok, ).toBe(false); });});
describe("isRegisteredCallback", () => { it("requires an exact match against published redirect_uris", () => { const registered = ["example.your-app://loggedin", "https://your-app.example/oauth/callback"]; expect(isRegisteredCallback("example.your-app://loggedin", registered)).toBe(true); expect(isRegisteredCallback("example.your-app://loggedin/evil", registered)).toBe(false); expect(isRegisteredCallback("example.evil://loggedin", registered)).toBe(false); expect(isRegisteredCallback("example.your-app://loggedin", [])).toBe(false); expect(isRegisteredCallback("example.your-app://loggedin", undefined)).toBe(false); });});
describe("buildCallbackUrl", () => { it("appends parameters to a custom scheme", () => { const url = buildCallbackUrl("example.your-app://loggedin", { did: "did:plc:abc", token: "v1.a.b", }); expect(url).toContain("did=did%3Aplc%3Aabc"); expect(url).toContain("token=v1.a.b"); });
it("preserves an existing query on the registered callback", () => { const url = buildCallbackUrl("https://your-app.example/cb?keep=1", { denied: "1" }); expect(url).toContain("keep=1"); expect(url).toContain("denied=1"); });});