|
| 1 | +import { describe, it, beforeEach, afterEach } from "node:test"; |
| 2 | +import assert from "node:assert/strict"; |
| 3 | +import { mkdtempSync, rmSync } from "node:fs"; |
| 4 | +import { join } from "node:path"; |
| 5 | +import { tmpdir } from "node:os"; |
| 6 | +import { toChecksumAddress, formatSIWEMessage, getAllowanceAuthHeaders } from "./allowance-auth.js"; |
| 7 | +import { saveAllowance } from "./allowance.js"; |
| 8 | + |
| 9 | +// Known test private key and derived address (do NOT use in production) |
| 10 | +const TEST_PRIVATE_KEY = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"; |
| 11 | +const TEST_ADDRESS = "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266"; |
| 12 | + |
| 13 | +let tempDir: string; |
| 14 | +let allowancePath: string; |
| 15 | + |
| 16 | +beforeEach(() => { |
| 17 | + tempDir = mkdtempSync(join(tmpdir(), "run402-siwx-test-")); |
| 18 | + allowancePath = join(tempDir, "allowance.json"); |
| 19 | + process.env.RUN402_CONFIG_DIR = tempDir; |
| 20 | + process.env.RUN402_API_BASE = "https://api.run402.com"; |
| 21 | +}); |
| 22 | + |
| 23 | +afterEach(() => { |
| 24 | + rmSync(tempDir, { recursive: true, force: true }); |
| 25 | + delete process.env.RUN402_CONFIG_DIR; |
| 26 | + delete process.env.RUN402_API_BASE; |
| 27 | +}); |
| 28 | + |
| 29 | +describe("toChecksumAddress", () => { |
| 30 | + it("checksums a known address correctly", () => { |
| 31 | + const input = "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266"; |
| 32 | + assert.equal(toChecksumAddress(input), TEST_ADDRESS); |
| 33 | + }); |
| 34 | + |
| 35 | + it("handles already-checksummed address", () => { |
| 36 | + assert.equal(toChecksumAddress(TEST_ADDRESS), TEST_ADDRESS); |
| 37 | + }); |
| 38 | + |
| 39 | + it("checksums all-lowercase address", () => { |
| 40 | + const result = toChecksumAddress("0xd8da6bf26964af9d7eed9e03e53415d37aa96045"); |
| 41 | + assert.equal(result, "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045"); |
| 42 | + }); |
| 43 | +}); |
| 44 | + |
| 45 | +describe("formatSIWEMessage", () => { |
| 46 | + it("produces correct EIP-4361 format", () => { |
| 47 | + const msg = formatSIWEMessage( |
| 48 | + { |
| 49 | + domain: "api.run402.com", |
| 50 | + uri: "https://api.run402.com/projects/v1", |
| 51 | + statement: "Sign in to Run402", |
| 52 | + version: "1", |
| 53 | + chainId: 84532, |
| 54 | + nonce: "abc123def456abcd", |
| 55 | + issuedAt: "2026-03-17T00:00:00.000Z", |
| 56 | + }, |
| 57 | + TEST_ADDRESS, |
| 58 | + ); |
| 59 | + |
| 60 | + assert.ok(msg.startsWith("api.run402.com wants you to sign in with your Ethereum account:")); |
| 61 | + assert.ok(msg.includes(TEST_ADDRESS)); |
| 62 | + assert.ok(msg.includes("Sign in to Run402")); |
| 63 | + assert.ok(msg.includes("URI: https://api.run402.com/projects/v1")); |
| 64 | + assert.ok(msg.includes("Version: 1")); |
| 65 | + assert.ok(msg.includes("Chain ID: 84532")); |
| 66 | + assert.ok(msg.includes("Nonce: abc123def456abcd")); |
| 67 | + assert.ok(msg.includes("Issued At: 2026-03-17T00:00:00.000Z")); |
| 68 | + assert.ok(!msg.includes("Expiration Time:")); |
| 69 | + }); |
| 70 | + |
| 71 | + it("includes expiration time when provided", () => { |
| 72 | + const msg = formatSIWEMessage( |
| 73 | + { |
| 74 | + domain: "api.run402.com", |
| 75 | + uri: "https://api.run402.com/projects/v1", |
| 76 | + statement: "Sign in to Run402", |
| 77 | + version: "1", |
| 78 | + chainId: 84532, |
| 79 | + nonce: "abc123def456abcd", |
| 80 | + issuedAt: "2026-03-17T00:00:00.000Z", |
| 81 | + expirationTime: "2026-03-17T00:05:00.000Z", |
| 82 | + }, |
| 83 | + TEST_ADDRESS, |
| 84 | + ); |
| 85 | + |
| 86 | + assert.ok(msg.includes("Expiration Time: 2026-03-17T00:05:00.000Z")); |
| 87 | + }); |
| 88 | +}); |
| 89 | + |
| 90 | +describe("getAllowanceAuthHeaders", () => { |
| 91 | + it("returns null when no allowance exists", () => { |
| 92 | + const result = getAllowanceAuthHeaders("/projects/v1", allowancePath); |
| 93 | + assert.equal(result, null); |
| 94 | + }); |
| 95 | + |
| 96 | + it("returns SIGN-IN-WITH-X header with valid base64 JSON", () => { |
| 97 | + saveAllowance({ address: TEST_ADDRESS, privateKey: TEST_PRIVATE_KEY }, allowancePath); |
| 98 | + |
| 99 | + const result = getAllowanceAuthHeaders("/projects/v1", allowancePath); |
| 100 | + assert.ok(result); |
| 101 | + assert.ok(result["SIGN-IN-WITH-X"]); |
| 102 | + |
| 103 | + const decoded = JSON.parse(Buffer.from(result["SIGN-IN-WITH-X"], "base64").toString()); |
| 104 | + assert.equal(decoded.domain, "api.run402.com"); |
| 105 | + assert.equal(decoded.address, TEST_ADDRESS); |
| 106 | + assert.equal(decoded.uri, "https://api.run402.com/projects/v1"); |
| 107 | + assert.equal(decoded.version, "1"); |
| 108 | + assert.equal(decoded.chainId, 84532); |
| 109 | + assert.equal(decoded.type, "eip4361"); |
| 110 | + assert.ok(decoded.nonce); |
| 111 | + assert.ok(decoded.issuedAt); |
| 112 | + assert.ok(decoded.expirationTime); |
| 113 | + assert.ok(decoded.signature); |
| 114 | + assert.ok(decoded.signature.startsWith("0x")); |
| 115 | + }); |
| 116 | + |
| 117 | + it("generates alphanumeric hex nonce (no hyphens)", () => { |
| 118 | + saveAllowance({ address: TEST_ADDRESS, privateKey: TEST_PRIVATE_KEY }, allowancePath); |
| 119 | + |
| 120 | + const result = getAllowanceAuthHeaders("/projects/v1", allowancePath); |
| 121 | + assert.ok(result); |
| 122 | + const decoded = JSON.parse(Buffer.from(result["SIGN-IN-WITH-X"], "base64").toString()); |
| 123 | + assert.match(decoded.nonce, /^[0-9a-f]{32}$/); |
| 124 | + }); |
| 125 | + |
| 126 | + it("uses checksummed address in payload", () => { |
| 127 | + saveAllowance({ address: TEST_ADDRESS.toLowerCase(), privateKey: TEST_PRIVATE_KEY }, allowancePath); |
| 128 | + |
| 129 | + const result = getAllowanceAuthHeaders("/projects/v1", allowancePath); |
| 130 | + assert.ok(result); |
| 131 | + const decoded = JSON.parse(Buffer.from(result["SIGN-IN-WITH-X"], "base64").toString()); |
| 132 | + assert.equal(decoded.address, TEST_ADDRESS); |
| 133 | + }); |
| 134 | +}); |
0 commit comments