Something went wrong. Try again.
Monorepo for Tangled tangled.org
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172import { describe, expect, it, vi } from "vitest";import type { OAuthUserAgent } from "@atcute/oauth-browser-client";import { provisionDelegate, CREATE_DELEGATE_NSID, GATE_CREATE_DELEGATE_NSID, LIST_DELEGATES_NSID} from "$lib/api/delegation";import metadata from "$lib/oauth-client-metadata";
const makeAgent = () => { const handle = vi.fn<(path: string, init: RequestInit) => Promise<Response>>(async () => Response.json({ token: "service-jwt" }) ); return { handle, agent: { sub: "did:plc:alice", handle } as unknown as OAuthUserAgent };};const account = { did: "did:plc:org", handle: "org.example", controllerDid: "did:plc:alice" };
describe("delegate provisioning", () => { it("mints one method-bound service auth on the user's PDS for the create call", async () => { const { agent, handle } = makeAgent(); const fetch = vi.fn<typeof globalThis.fetch>(async () => Response.json(account)); await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example/", serviceDid: "did:web:tranquil.example", fetch }) ).resolves.toEqual(account); const params = new URL(String(handle.mock.calls[0][0]), "https://pds.example").searchParams; expect(params.get("aud")).toBe("did:web:tranquil.example"); expect(params.get("lxm")).toBe(CREATE_DELEGATE_NSID); // Tranquil enforces the delegate cap itself, so no listing token is minted. expect(handle).toHaveBeenCalledTimes(1); expect(String(fetch.mock.calls[0][0])).toBe( `https://gate.example/xrpc/${GATE_CREATE_DELEGATE_NSID}` ); expect(fetch.mock.calls[0][1]).toMatchObject({ method: "POST", headers: { authorization: "Bearer service-jwt" }, body: JSON.stringify({ handle: "org.example" }) }); }); it("allows the advertised DID to differ from a forwarded URL port", async () => { const { agent, handle } = makeAgent(); await provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example:8443", serviceDid: "did:web:tranquil.example", fetch: vi.fn<typeof globalThis.fetch>(async () => Response.json(account)) }); expect( new URL(String(handle.mock.calls[0][0]), "https://pds.example").searchParams.get("aud") ).toBe("did:web:tranquil.example"); }); it.each([ ["VerifiedEmailRequired", /Verify an email/], ["UpstreamUnavailable", /temporarily unavailable/] ])("explains %s", async (error, message) => { const { agent } = makeAgent(); await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch: vi.fn(async () => Response.json({ error }, { status: 403 })) }) ).rejects.toThrow(message); }); it("shows Tranquil's own message for errors it does not recognize", async () => { const { agent } = makeAgent(); await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch: vi.fn(async () => Response.json( { error: "HandleNotAvailable", message: "Handle already taken" }, { status: 400 } ) ) }) ).rejects.toThrow(/Handle already taken/); }); it("shows Tranquil's reason for InvalidDelegation, which is not only the delegate cap", async () => { const { agent } = makeAgent(); const message = "Invite-only registration requires an existing account on this PDS"; await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch: vi.fn(async () => Response.json({ error: "InvalidDelegation", message }, { status: 400 }) ) }) ).rejects.toThrow(message); }); it("does not request a token when the sidecar is not configured", async () => { const { agent, handle } = makeAgent(); await expect(provisionDelegate(agent, "org.example", { serviceUrl: "" })).rejects.toThrow( /not configured/ ); expect(handle).not.toHaveBeenCalled(); }); it("rejects an unexpected controller", async () => { const { agent } = makeAgent(); await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch: vi.fn(async () => Response.json({ ...account, controllerDid: "did:plc:other" }) ) }) ).rejects.toThrow(/unexpected owner/); }); it("requests the permission needed to mint delegation service auth", () => { expect(metadata.scope.split(" ")).toContain(`rpc:${CREATE_DELEGATE_NSID}?aud=*`); expect(metadata.scope.split(" ")).toContain(`rpc:${LIST_DELEGATES_NSID}?aud=*`); });});
it("asks older sessions to reauthorize before any account is created", async () => { const handle = vi.fn(async () => Response.json({ error: "InsufficientScope", message: "missing scope" }, { status: 403 }) ); const fetch = vi.fn<typeof globalThis.fetch>(); await expect( provisionDelegate( { handle, sub: "did:plc:alice" } as unknown as OAuthUserAgent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch } ) ).rejects.toThrow(/Sign in again/); expect(fetch).not.toHaveBeenCalled();});
describe("controlled organization accounts", () => { it("lists on Tranquil with method-bound auth from the controller's PDS", async () => { const { listDelegatedAccounts } = await import("./delegation"); const { agent, handle } = makeAgent(); const accounts = [ { did: "did:plc:org", handle: "org.example", grantedScopes: "atproto repo:*", grantedAt: "2026-09-09T00:00:00Z" } ]; const fetch = vi.fn<typeof globalThis.fetch>(async () => Response.json({ accounts })); await expect( listDelegatedAccounts(agent, "did:web:tranquil.example", fetch) ).resolves.toEqual(accounts); const params = new URL(String(handle.mock.calls[0][0]), "https://pds.example").searchParams; expect(params.get("aud")).toBe("did:web:tranquil.example"); expect(params.get("lxm")).toBe(LIST_DELEGATES_NSID); expect(String(fetch.mock.calls[0][0])).toBe( "https://tranquil.example/xrpc/_delegation.listControlledAccounts" ); expect(fetch.mock.calls[0][1]).toEqual({ headers: { authorization: "Bearer service-jwt" } }); }); it("reports a failed listing instead of treating it as no organizations", async () => { const { listDelegatedAccounts } = await import("./delegation"); const { agent } = makeAgent(); await expect( listDelegatedAccounts(agent, "did:web:tranquil.example", async () => Response.json({ error: "InvalidToken" }, { status: 401 }) ) ).rejects.toThrow(); });});