126 lines
4.3 KiB
TypeScript
126 lines
4.3 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from "vitest";
|
|
import { createRadiusOAuth } from "../src/auth/oauth/radius.ts";
|
|
import type { AuthEvent, AuthInteraction } from "../src/auth/types.ts";
|
|
|
|
const GATEWAY = "https://radius.example";
|
|
|
|
function jsonResponse(body: unknown, status = 200): Response {
|
|
return new Response(JSON.stringify(body), {
|
|
status,
|
|
headers: { "content-type": "application/json" },
|
|
});
|
|
}
|
|
|
|
function requestUrl(input: unknown): string {
|
|
if (typeof input === "string") return input;
|
|
if (input instanceof URL) return input.toString();
|
|
if (input instanceof Request) return input.url;
|
|
throw new Error(`Unsupported request input: ${String(input)}`);
|
|
}
|
|
|
|
function interaction(loginMethod: "browser" | "device-code", events: AuthEvent[] = []): AuthInteraction {
|
|
return {
|
|
prompt: async () => loginMethod,
|
|
notify: (event) => events.push(event),
|
|
};
|
|
}
|
|
|
|
describe("Radius OAuth", () => {
|
|
afterEach(() => {
|
|
vi.restoreAllMocks();
|
|
vi.unstubAllGlobals();
|
|
vi.useRealTimers();
|
|
});
|
|
|
|
it("uses gateway endpoints directly for device login", async () => {
|
|
vi.useFakeTimers();
|
|
vi.setSystemTime(new Date("2026-07-24T00:00:00Z"));
|
|
const events: AuthEvent[] = [];
|
|
const urls: string[] = [];
|
|
vi.stubGlobal(
|
|
"fetch",
|
|
vi.fn(async (input: unknown, init?: RequestInit) => {
|
|
const url = requestUrl(input);
|
|
urls.push(url);
|
|
const form = new URLSearchParams(String(init?.body));
|
|
if (url === `${GATEWAY}/v1/oauth/device`) {
|
|
expect(form.get("client_id")).toBe("pi-gateway");
|
|
expect(form.get("scope")).toBe("gateway offline_access");
|
|
return jsonResponse({
|
|
device_code: "device-code",
|
|
user_code: "ABCD-1234",
|
|
verification_uri: "https://radius-ui.example/pair",
|
|
expires_in: 600,
|
|
interval: 5,
|
|
});
|
|
}
|
|
if (url === `${GATEWAY}/v1/oauth/token`) {
|
|
expect(form.get("grant_type")).toBe("urn:ietf:params:oauth:grant-type:device_code");
|
|
expect(form.get("client_id")).toBe("pi-gateway");
|
|
expect(form.get("device_code")).toBe("device-code");
|
|
return jsonResponse({
|
|
access_token: "access-token",
|
|
refresh_token: "refresh-token",
|
|
expires_in: 3600,
|
|
scope: "gateway offline_access",
|
|
});
|
|
}
|
|
throw new Error(`Unexpected request: ${url}`);
|
|
}),
|
|
);
|
|
|
|
const oauth = createRadiusOAuth({ name: "Radius", gateway: GATEWAY });
|
|
await expect(oauth.login(interaction("device-code", events))).resolves.toEqual({
|
|
type: "oauth",
|
|
access: "access-token",
|
|
refresh: "refresh-token",
|
|
expires: Date.now() + 3600 * 1000 - 60_000,
|
|
scope: "gateway offline_access",
|
|
});
|
|
expect(events).toEqual([
|
|
{
|
|
type: "device_code",
|
|
userCode: "ABCD-1234",
|
|
verificationUri: "https://radius-ui.example/pair",
|
|
intervalSeconds: 5,
|
|
expiresInSeconds: 600,
|
|
},
|
|
]);
|
|
expect(urls).toEqual([`${GATEWAY}/v1/oauth/device`, `${GATEWAY}/v1/oauth/token`]);
|
|
});
|
|
|
|
it("refreshes directly through the gateway without discovery", async () => {
|
|
const fetchMock = vi.fn(async (input: unknown, init?: RequestInit) => {
|
|
expect(requestUrl(input)).toBe(`${GATEWAY}/v1/oauth/token`);
|
|
const form = new URLSearchParams(String(init?.body));
|
|
expect(form.get("grant_type")).toBe("refresh_token");
|
|
expect(form.get("client_id")).toBe("pi-gateway");
|
|
expect(form.get("refresh_token")).toBe("old-refresh");
|
|
return jsonResponse({
|
|
access_token: "new-access",
|
|
refresh_token: "new-refresh",
|
|
expires_in: 3600,
|
|
});
|
|
});
|
|
vi.stubGlobal("fetch", fetchMock);
|
|
|
|
const oauth = createRadiusOAuth({ name: "Radius", gateway: GATEWAY });
|
|
await expect(
|
|
oauth.refresh({ type: "oauth", access: "old-access", refresh: "old-refresh", expires: 0 }),
|
|
).resolves.toMatchObject({ access: "new-access", refresh: "new-refresh" });
|
|
expect(fetchMock).toHaveBeenCalledOnce();
|
|
});
|
|
|
|
it("discovers only the interactive browser authorization endpoint", async () => {
|
|
const fetchMock = vi.fn(async (input: unknown) => {
|
|
expect(requestUrl(input)).toBe(`${GATEWAY}/v1/oauth`);
|
|
return jsonResponse({ issuer: "https://radius-ui.example" });
|
|
});
|
|
vi.stubGlobal("fetch", fetchMock);
|
|
|
|
const oauth = createRadiusOAuth({ name: "Radius", gateway: GATEWAY });
|
|
await expect(oauth.login(interaction("browser"))).rejects.toThrow(`Invalid Radius OAuth config from ${GATEWAY}`);
|
|
expect(fetchMock).toHaveBeenCalledOnce();
|
|
});
|
|
});
|