* add public client * implement PKCE * pass codeChallenge and codeChallengeMethod to handler * fixes for secure oauth flow * fix type error * clean up refresh token endpoint * only support S256 * fix type error * remove comment * add tests * fix type errors in route.test.ts * add missing support for refresh token * add e2e test for public client refresh tokens * allow pkce for confidential clients * fix type error * fix e2e * fix option pkce for confidential clients * e2e test improvements * fix test * remove only * add delay * fix e2e tests * remove only * don't skip pkce if codeChallenge is set * add service functions for token endpoint * use service function in refreshToken endpoint * use repository * remove return types * e2e test fixes * fix e2e test * remove .only in e2e test * remove pause * fix error responses in token endpoints * adjust tests to new error responses * fix error responses * e2e improvements * redirect on error * adjust tests * Update apps/web/modules/auth/oauth2/authorize-view.tsx Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> --------- Co-authored-by: CarinaWolli <wollencarina@gmail.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
54 lines
2.0 KiB
TypeScript
54 lines
2.0 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
import { isValidCodeChallengeMethod, verifyCodeChallenge } from "./pkce";
|
|
|
|
describe("PKCE Functions", () => {
|
|
describe("verifyCodeChallenge", () => {
|
|
it("should verify S256 code challenge correctly", () => {
|
|
const codeVerifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
|
|
const codeChallenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM";
|
|
|
|
const result = verifyCodeChallenge(codeVerifier, codeChallenge, "S256");
|
|
expect(result).toBe(true);
|
|
});
|
|
|
|
it("should fail verification with wrong S256 code challenge", () => {
|
|
const codeVerifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
|
|
const wrongCodeChallenge = "wrong_challenge_value";
|
|
|
|
const result = verifyCodeChallenge(codeVerifier, wrongCodeChallenge, "S256");
|
|
expect(result).toBe(false);
|
|
});
|
|
|
|
it("should default to S256 method when none specified", () => {
|
|
const codeVerifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
|
|
const codeChallenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM";
|
|
|
|
const result = verifyCodeChallenge(codeVerifier, codeChallenge);
|
|
expect(result).toBe(true);
|
|
});
|
|
|
|
it("should return false for unsupported method", () => {
|
|
const codeVerifier = "test_verifier";
|
|
const codeChallenge = "test_challenge";
|
|
|
|
const result = verifyCodeChallenge(codeVerifier, codeChallenge, "MD5");
|
|
expect(result).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe("isValidCodeChallengeMethod", () => {
|
|
it("should accept S256 method", () => {
|
|
expect(isValidCodeChallengeMethod("S256")).toBe(true);
|
|
});
|
|
|
|
it("should reject unsupported methods", () => {
|
|
expect(isValidCodeChallengeMethod("plain")).toBe(false);
|
|
expect(isValidCodeChallengeMethod("MD5")).toBe(false);
|
|
expect(isValidCodeChallengeMethod("SHA1")).toBe(false);
|
|
expect(isValidCodeChallengeMethod("invalid")).toBe(false);
|
|
expect(isValidCodeChallengeMethod("")).toBe(false);
|
|
});
|
|
});
|
|
});
|