1import { assert, it } from "@effect/vitest";
2import { ProviderInstanceId } from "@t3tools/contracts";
3import * as Effect from "effect/Effect";
4import * as Exit from "effect/Exit";
5
6import { validateAntigravityCallbackUrl } from "./antigravityCallback.ts";
7
8const instanceId = ProviderInstanceId.make("antigravity-callback-test");
9const pending = { redirectUri: "http://127.0.0.1:51234/", state: "owned-state" };
10
11it.effect("accepts the exact owned Google callback and an explicit Google denial", () =>
12 Effect.gen(function* () {
13 for (const response of ["code=example-code", "error=access_denied"]) {
14 const callback = `http://127.0.0.1:51234/?state=owned-state&${response}&iss=https%3A%2F%2Faccounts.google.com`;
15 const parsed = yield* validateAntigravityCallbackUrl(instanceId, pending, callback);
16 assert.equal(parsed.toString(), callback);
17 }
18 }),
19);
20
21it.effect("rejects different targets, credentials, fragments, and duplicate OAuth fields", () =>
22 Effect.gen(function* () {
23 const callbacks = [
24 "https://127.0.0.1:51234/?state=owned-state&code=x",
25 "http://localhost:51234/?state=owned-state&code=x",
26 "http://127.0.0.2:51234/?state=owned-state&code=x",
27 "http://127.0.0.1:51235/?state=owned-state&code=x",
28 "http://127.0.0.1:51234/other?state=owned-state&code=x",
29 "http://user:password@127.0.0.1:51234/?state=owned-state&code=x",
30 "http://127.0.0.1:51234/?state=owned-state&code=x#fragment",
31 "http://127.0.0.1:51234/?state=wrong-state&code=x",
32 "http://127.0.0.1:51234/?state=owned-state&state=owned-state&code=x",
33 "http://127.0.0.1:51234/?state=owned-state&code=x&code=y",
34 "http://127.0.0.1:51234/?state=owned-state&code=x&error=access_denied",
35 "http://127.0.0.1:51234/?state=owned-state&error=access_denied&error=other",
36 "http://127.0.0.1:51234/?state=owned-state&code=",
37 "http://127.0.0.1:51234/?state=owned-state&iss=https%3A%2F%2Faccounts.google.com",
38 "http://127.0.0.1:51234/?state=owned-state&code=x&iss=https%3A%2F%2Fexample.com",
39 "http://127.0.0.1:51234/?state=owned-state&code=x&iss=https%3A%2F%2Faccounts.google.com&iss=https%3A%2F%2Faccounts.google.com",
40 ];
41 for (const callback of callbacks) {
42 const result = yield* validateAntigravityCallbackUrl(instanceId, pending, callback).pipe(
43 Effect.exit,
44 );
45 assert.isTrue(Exit.isFailure(result), callback);
46 }
47 }),
48);