executor/packages/core/api/src/server/oauth-client-metadata.test.ts at 9eb8632984fbcd11b31628df256a0fae3c379c29 · UsefulSoftwareCo/executor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
import { describe, expect, it } from "@effect/vitest";

import { oauthClientIdMetadataDocumentFromRequest } from "./oauth-client-metadata";

describe("OAuth client ID metadata document", () => {
  it("builds an org-scoped hosted document with a bare callback redirect_uri", () => {
    const metadata = oauthClientIdMetadataDocumentFromRequest({
      requestUrl: "/api/oauth/client-id-metadata/acme.json",
      webRequest: new Request("http://127.0.0.1:42384/api/oauth/client-id-metadata/acme.json", {
        headers: { Host: "100.81.219.45:42384" },
      }),
      mountPrefix: "/api",
    });

    // The org is identified by the per-org client_id URL, not by a query param
    // on redirect_uri (which the client never sends, and the callback reads
    // from `state`). redirect_uri must stay bare for exact-match providers.
    expect(metadata.client_id).toBe(
      "http://100.81.219.45:42384/api/oauth/client-id-metadata/acme.json",
    );
    expect(metadata.redirect_uris).toEqual(["http://100.81.219.45:42384/api/oauth/callback"]);
    expect(metadata.token_endpoint_auth_method).toBe("none");
    expect(metadata.application_type).toBe("web");
  });

  it("uses forwarded host and protocol for proxy-facing hosted documents", () => {
    const metadata = oauthClientIdMetadataDocumentFromRequest({
      requestUrl: "/api/oauth/client-id-metadata/default.json",
      webRequest: new Request("http://127.0.0.1:3000/api/oauth/client-id-metadata/default.json", {
        headers: {
          "x-forwarded-host": "wsl-dev.tail5665af.ts.net",
          "x-forwarded-proto": "https",
          Host: "127.0.0.1:3000",
        },
      }),
      mountPrefix: "/api",
    });

    expect(metadata.client_id).toBe(
      "https://wsl-dev.tail5665af.ts.net/api/oauth/client-id-metadata/default.json",
    );
    expect(metadata.redirect_uris).toEqual([
      "https://wsl-dev.tail5665af.ts.net/api/oauth/callback",
    ]);
  });

  it("serves a hosted local document with portless loopback callbacks", () => {
    const metadata = oauthClientIdMetadataDocumentFromRequest({
      requestUrl: "/api/oauth/client-id-metadata/local.json",
      webRequest: new Request("http://127.0.0.1:3000/api/oauth/client-id-metadata/local.json", {
        headers: {
          "x-forwarded-host": "executor.sh",
          "x-forwarded-proto": "https",
          Host: "127.0.0.1:3000",
        },
      }),
      mountPrefix: "/api",
    });

    expect(metadata.client_id).toBe("https://executor.sh/api/oauth/client-id-metadata/local.json");
    expect(metadata.redirect_uris).toEqual([
      "http://127.0.0.1/api/oauth/callback",
      "http://localhost/api/oauth/callback",
      "http://[::1]/api/oauth/callback",
    ]);
    expect(metadata.application_type).toBe("native");
  });

  it("ignores a legacy executor_org query param when building redirect_uri", () => {
    const metadata = oauthClientIdMetadataDocumentFromRequest({
      requestUrl: "/api/oauth/client-id-metadata.json?executor_org=acme",
      webRequest: new Request("http://127.0.0.1:42384/api/oauth/client-id-metadata.json", {
        headers: { Host: "100.81.219.45:42384" },
      }),
      mountPrefix: "/api",
    });

    // A stray executor_org query param is inert: it stays on the client_id URL
    // (which is just the request URL) but never leaks into redirect_uri.
    expect(metadata.client_id).toBe(
      "http://100.81.219.45:42384/api/oauth/client-id-metadata.json?executor_org=acme",
    );
    expect(metadata.redirect_uris).toEqual(["http://100.81.219.45:42384/api/oauth/callback"]);
  });
});