Initial Commit

tests/oauth-diagnostics.test.ts

@@ -0,0 +1,22 @@
+import { expect, test } from 'bun:test';
+import { oauthFailureDiagnostic, SsoDiagnosticError } from '../src/lib/server/oauth-diagnostics';
+
+test('callback diagnostics never emit arbitrary errors, payloads, or credential-like strings', () => {
+  const secret = 'private-token-code-cookie-canary';
+  for (const error of [new Error(secret), secret, { message: secret, payload: secret }]) {
+    expect(oauthFailureDiagnostic('exchange', error)).toEqual({ event: 'eve_oauth_callback_failed', phase: 'exchange', reason: 'unclassified' });
+  }
+  const error = new SsoDiagnosticError('fixed message', 'jwt_validation', {
+    httpStatus: 123456789, oauthError: secret, joseCode: secret, claim: secret, claimShape: secret, validation: secret,
+  });
+  expect(JSON.stringify(error)).not.toContain(secret);
+  // Defense in depth even if another caller subsequently changes details.
+  error.details.oauthError = secret;
+  expect(JSON.stringify(oauthFailureDiagnostic('exchange', error))).not.toContain(secret);
+});
+
+test('callback diagnostics retain only actionable, allowlisted failure categories', () => {
+  expect(oauthFailureDiagnostic('state_input', new Error('Missing OAuth binding cookie')).reason).toBe('binding_cookie_missing');
+  expect(oauthFailureDiagnostic('exchange', new SsoDiagnosticError('fixed', 'token_request', { httpStatus: 401, oauthError: 'invalid_client' }))).toMatchObject({ reason: 'token_request', httpStatus: 401, oauthError: 'invalid_client' });
+  expect(oauthFailureDiagnostic('exchange', new SsoDiagnosticError('fixed', 'jwt_validation', { joseCode: 'ERR_JWT_CLAIM_VALIDATION_FAILED', claim: 'aud' }))).toMatchObject({ reason: 'jwt_validation', joseCode: 'ERR_JWT_CLAIM_VALIDATION_FAILED', claim: 'aud' });
+});