88 lines
3.1 KiB
TypeScript
88 lines
3.1 KiB
TypeScript
import { afterEach, describe, expect, test, vi } from "vitest";
|
|
|
|
import { OidcProvider } from "../oidc/oidc-provider";
|
|
import { assertVerifiedEmailForCredentialsLinking } from "../oidc/verified-email";
|
|
|
|
const mockEnv = vi.hoisted(() => ({
|
|
AUTH_OIDC_CLIENT_ID: "client-id",
|
|
AUTH_OIDC_CLIENT_NAME: "OIDC",
|
|
AUTH_OIDC_CLIENT_SECRET: "client-secret",
|
|
AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING: false,
|
|
AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING: false,
|
|
AUTH_OIDC_FORCE_USERINFO: false,
|
|
AUTH_OIDC_ISSUER: "https://example.com",
|
|
AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE: undefined,
|
|
AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile",
|
|
AUTH_OIDC_TOKEN_ENDPOINT_AUTH_METHOD: "client_secret_basic" as const,
|
|
}));
|
|
|
|
vi.mock("../../env", () => ({ env: mockEnv }));
|
|
vi.mock("next-auth", () => ({ customFetch: Symbol("customFetch") }));
|
|
|
|
afterEach(() => {
|
|
mockEnv.AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING = false;
|
|
});
|
|
|
|
describe("assertVerifiedEmailForCredentialsLinking", () => {
|
|
test("allows a strictly verified OIDC email when credentials linking is enabled", () => {
|
|
expect(() =>
|
|
assertVerifiedEmailForCredentialsLinking({ email: "test@example.com", email_verified: true }, true),
|
|
).not.toThrow();
|
|
});
|
|
|
|
test.each([
|
|
{ email: "test@example.com", email_verified: false },
|
|
{ email: "test@example.com", email_verified: "true" },
|
|
{ email_verified: true },
|
|
{ email: null, email_verified: true },
|
|
{ email: " ", email_verified: true },
|
|
{},
|
|
])("rejects an OIDC profile without a strictly verified email when credentials linking is enabled", (profile) => {
|
|
expect(() => assertVerifiedEmailForCredentialsLinking(profile, true)).toThrow(
|
|
"OIDC provider did not return a verified email while credentials linking is enabled",
|
|
);
|
|
});
|
|
|
|
test("does not require the claim when credentials linking is disabled", () => {
|
|
expect(() => assertVerifiedEmailForCredentialsLinking({}, false)).not.toThrow();
|
|
});
|
|
|
|
test("OIDC provider rejects an unverified profile when credentials linking is enabled", () => {
|
|
mockEnv.AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING = true;
|
|
const provider = OidcProvider(null);
|
|
expect(provider.allowDangerousEmailAccountLinking).toBe(true);
|
|
const mapProfile = provider.profile;
|
|
if (!mapProfile) throw new Error("Expected OIDC profile mapper to be defined");
|
|
|
|
expect(() =>
|
|
mapProfile(
|
|
{
|
|
sub: "subject",
|
|
preferred_username: "test",
|
|
email: "test@example.com",
|
|
email_verified: false,
|
|
},
|
|
{},
|
|
),
|
|
).toThrow("OIDC provider did not return a verified email while credentials linking is enabled");
|
|
});
|
|
|
|
test("OIDC provider accepts an unverified profile when credentials linking is disabled", () => {
|
|
const provider = OidcProvider(null);
|
|
const mapProfile = provider.profile;
|
|
if (!mapProfile) throw new Error("Expected OIDC profile mapper to be defined");
|
|
|
|
expect(() =>
|
|
mapProfile(
|
|
{
|
|
sub: "subject",
|
|
preferred_username: "test",
|
|
email: "test@example.com",
|
|
email_verified: false,
|
|
},
|
|
{},
|
|
),
|
|
).not.toThrow();
|
|
});
|
|
});
|