Something went wrong. Try again.
The logic for serving and storing associations between users and apps
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748import { describe, expect, it } from "vitest";import { defaultClientId, isEmbeddableOrigin, isLocalhostOrigin, parseExactOrigin, parseReturnUrl,} from "./origins";
describe("origins", () => { it("treats localhost as local", () => { expect(isLocalhostOrigin("http://localhost:3001")).toBe(true); expect(isLocalhostOrigin("https://leaflet.pub")).toBe(false); });
it("accepts http(s) app origins and rejects private hosts", () => { expect(parseExactOrigin("https://lightbox-loggedin.val.run")).toEqual({ ok: true, origin: "https://lightbox-loggedin.val.run", }); expect(parseExactOrigin("http://localhost:3001")).toEqual({ ok: true, origin: "http://localhost:3001", }); expect(parseExactOrigin("https://evil.example/path").ok).toBe(false); expect(parseExactOrigin("http://example.com").ok).toBe(false); expect(parseExactOrigin("https://192.168.1.1").ok).toBe(false); expect(isEmbeddableOrigin("https://cratewalk-loggedin.val.run")).toBe(true); });
it("builds the conventional client metadata URL", () => { expect(defaultClientId("https://lightbox-loggedin.val.run")).toBe( "https://lightbox-loggedin.val.run/oauth-client-metadata.json", ); });
it("parses enroll return URLs without a static allowlist", () => { expect(parseReturnUrl("http://localhost:3001/after")).toEqual({ ok: true, origin: "http://localhost:3001", href: "http://localhost:3001/after", }); expect(parseReturnUrl("https://evil.example/x").ok).toBe(true); expect(parseReturnUrl("javascript:alert(1)").ok).toBe(false); expect(parseReturnUrl("http://example.com/").ok).toBe(false); });});