testOAuthAnswersAreThisSignInsAndSayTheirIssuer

tcmts.atproto.test.testOAuthAnswersAreThisSignInsAndSayTheirIssuer · #3c262cvt · term

A sign-in's answer must be this sign-in's (its state), and say who it's from (its issuer).

import { oauthAnswer } from "#codebase/tcmts/atproto";
import assert from "node:assert/strict";

export const testOAuthAnswersAreThisSignInsAndSayTheirIssuer = () => {
  const q = (o: Record<string, string>) => new URLSearchParams(o);
  assert.equal(
    oauthAnswer(
      q({ state: "s", iss: "https://pds.example", code: "c" }),
      "s",
      "https://pds.example/",
    ),
    "c",
  );
  assert.throws(
    () => oauthAnswer(q({ state: "s", code: "c" }), "s", "https://pds.example"),
    /a server that didn't say/,
  );
  assert.throws(
    () =>
      oauthAnswer(
        q({ state: "s", iss: "https://evil.example", code: "c" }),
        "s",
        "https://pds.example",
      ),
    /evil\.example, not/,
  );
  assert.throws(
    () =>
      oauthAnswer(
        q({ state: "x", iss: "https://pds.example", code: "c" }),
        "s",
        "https://pds.example",
      ),
    /different sign-in/,
  );
}

uses