23 lines
1.7 KiB
TypeScript
23 lines
1.7 KiB
TypeScript
import { expect, test } from 'bun:test';
|
|
import { oauthFailureDiagnostic, SsoDiagnosticError } from '../src/lib/server/oauth-diagnostics';
|
|
|
|
test('callback diagnostics never emit arbitrary errors, payloads, or credential-like strings', () => {
|
|
const secret = 'private-token-code-cookie-canary';
|
|
for (const error of [new Error(secret), secret, { message: secret, payload: secret }]) {
|
|
expect(oauthFailureDiagnostic('exchange', error)).toEqual({ event: 'eve_oauth_callback_failed', phase: 'exchange', reason: 'unclassified' });
|
|
}
|
|
const error = new SsoDiagnosticError('fixed message', 'jwt_validation', {
|
|
httpStatus: 123456789, oauthError: secret, joseCode: secret, claim: secret, claimShape: secret, validation: secret,
|
|
});
|
|
expect(JSON.stringify(error)).not.toContain(secret);
|
|
// Defense in depth even if another caller subsequently changes details.
|
|
error.details.oauthError = secret;
|
|
expect(JSON.stringify(oauthFailureDiagnostic('exchange', error))).not.toContain(secret);
|
|
});
|
|
|
|
test('callback diagnostics retain only actionable, allowlisted failure categories', () => {
|
|
expect(oauthFailureDiagnostic('state_input', new Error('Missing OAuth binding cookie')).reason).toBe('binding_cookie_missing');
|
|
expect(oauthFailureDiagnostic('exchange', new SsoDiagnosticError('fixed', 'token_request', { httpStatus: 401, oauthError: 'invalid_client' }))).toMatchObject({ reason: 'token_request', httpStatus: 401, oauthError: 'invalid_client' });
|
|
expect(oauthFailureDiagnostic('exchange', new SsoDiagnosticError('fixed', 'jwt_validation', { joseCode: 'ERR_JWT_CLAIM_VALIDATION_FAILED', claim: 'aud' }))).toMatchObject({ reason: 'jwt_validation', joseCode: 'ERR_JWT_CLAIM_VALIDATION_FAILED', claim: 'aud' });
|
|
});
|