Something went wrong. Try again.
The logic for serving and storing associations between users and apps
Something went wrong. Try again.
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576import { describe, expect, it } from "vitest";import { activateRetryHeaders, embedderOrigin, shouldAttachSessionCookie, storageAccessRetryResponse, storageAccessState, withStorageAccessHeaders,} from "./storage-access";
function req(headers: Record<string, string>): Request { return new Request("https://loggedin.fyi/embed", { headers });}
describe("storage access headers", () => { it("parses Sec-Fetch-Storage-Access", () => { expect(storageAccessState(req({ "Sec-Fetch-Storage-Access": "none" }))).toBe("none"); expect(storageAccessState(req({ "Sec-Fetch-Storage-Access": "INACTIVE" }))).toBe("inactive"); expect(storageAccessState(req({ "Sec-Fetch-Storage-Access": "active" }))).toBe("active"); expect(storageAccessState(req({}))).toBeNull(); });
it("reads the embedder from Origin or Referer", () => { expect(embedderOrigin(req({ Origin: "https://lightbox-loggedin.val.run" }))).toBe( "https://lightbox-loggedin.val.run", ); expect(embedderOrigin(req({ Referer: "https://cratewalk-loggedin.val.run/app" }))).toBe( "https://cratewalk-loggedin.val.run", ); expect(embedderOrigin(req({ Origin: "null" }))).toBeNull(); });
it("does not mint a session cookie for blocked or inactive third-party embeds", () => { expect(shouldAttachSessionCookie(req({ "Sec-Fetch-Storage-Access": "none" }))).toBe(false); expect(shouldAttachSessionCookie(req({ "Sec-Fetch-Storage-Access": "inactive" }))).toBe(false); expect(shouldAttachSessionCookie(req({ "Sec-Fetch-Site": "cross-site" }))).toBe(false); expect(shouldAttachSessionCookie(req({ "Sec-Fetch-Storage-Access": "active" }))).toBe(true); expect(shouldAttachSessionCookie(req({ "Sec-Fetch-Site": "same-origin" }))).toBe(true); expect( shouldAttachSessionCookie( req({ "Sec-Fetch-Site": "same-origin", "X-Loggedin-Token": "v1.payload.signature", }), ), ).toBe(false); });
it("builds a retry challenge for a parent origin", () => { const headers = activateRetryHeaders("https://lightbox-loggedin.val.run"); expect(headers.get("Activate-Storage-Access")).toBe( 'retry; allowed-origin="https://lightbox-loggedin.val.run"', ); expect(headers.get("Vary")).toBe("Sec-Fetch-Storage-Access"); expect(storageAccessRetryResponse("https://lightbox-loggedin.val.run").status).toBe(401); });
it("marks an active response for load", () => { const next = withStorageAccessHeaders( req({ "Sec-Fetch-Storage-Access": "active" }), new Response("ok"), ); expect(next.headers.get("Activate-Storage-Access")).toBe("load"); expect(next.headers.get("Vary")).toContain("Sec-Fetch-Storage-Access"); });
it("does not ask the browser to load unpartitioned cookies for none", () => { const next = withStorageAccessHeaders( req({ "Sec-Fetch-Storage-Access": "none" }), new Response("ok"), ); expect(next.headers.get("Activate-Storage-Access")).toBeNull(); expect(next.headers.get("Vary")).toContain("Sec-Fetch-Storage-Access"); });});