1import { verifyDpopProof } from "@t3tools/shared/dpop";
2import { describe, expect, it } from "@effect/vitest";
3import * as Effect from "effect/Effect";
4import { decodeJwt } from "jose";
5import { vi } from "vite-plus/test";
6
7import { createBrowserDpopProof, generateBrowserDpopKey } from "./dpop";
8import * as Dpop from "./dpop";
9
10describe("browser DPoP proofs", () => {
11 it.effect("signs relay resource proofs with an access-token hash", () =>
12 Effect.gen(function* () {
13 vi.stubGlobal("indexedDB", undefined);
14 const proofKey = yield* generateBrowserDpopKey;
15 const proof = yield* createBrowserDpopProof({
16 method: "POST",
17 url: "https://relay.example.test/v1/environments/env-1/connect?ignored=true",
18 accessToken: "relay-access-token",
19 proofKey,
20 }).pipe(Effect.provide(Dpop.layer));
21 const issuedAt = decodeJwt(proof.proof).iat;
22 expect(issuedAt).toBeTypeOf("number");
23
24 expect(
25 verifyDpopProof({
26 proof: proof.proof,
27 method: "POST",
28 url: "https://relay.example.test/v1/environments/env-1/connect",
29 expectedThumbprint: proof.thumbprint,
30 expectedAccessToken: "relay-access-token",
31 nowEpochSeconds: issuedAt!,
32 }),
33 ).toMatchObject({ ok: true });
34 }),
35 );
36});