| 1 | import { describe, expect, it } from "vite-plus/test"; |
| 2 | import { providerAuthReturnUrl } from "./providerAuthReturnUrl.ts"; |
| 3 | |
| 4 | describe("provider auth return destinations", () => { |
| 5 | it.each(["t3code", "t3code-dev"])( |
| 6 | "returns to %s Welcome and the selected settings instance", |
| 7 | (scheme) => { |
| 8 | expect(providerAuthReturnUrl(`${scheme}://app/welcome?code=secret#agents:machine-id`)).toBe( |
| 9 | `${scheme}://app/welcome#agents:machine-id`, |
| 10 | ); |
| 11 | expect( |
| 12 | providerAuthReturnUrl(`${scheme}://app/settings/providers?instanceId=work&code=secret`), |
| 13 | ).toBe(`${scheme}://app/settings/providers?instanceId=work`); |
| 14 | }, |
| 15 | ); |
| 16 | it.each([ |
| 17 | "t3code://attacker/welcome", |
| 18 | "t3code://app:123/welcome", |
| 19 | "t3code://app/auth/callback", |
| 20 | "t3code://user@ app/welcome", |
| 21 | "t3code://app/welcome/../evil", |
| 22 | "https://attacker.example/welcome", |
| 23 | "file:///welcome", |
| 24 | "javascript:alert(1)", |
| 25 | ])("rejects %s", (url) => expect(providerAuthReturnUrl(url)).toBeUndefined()); |
| 26 | }); |