Files
calendar/packages/lib/pkce.test.ts
T
Carina WollendorferGitHubCarinaWollicubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
4e0798577a feat: OAuth PKCE (#25313)
* add public client

* implement PKCE

* pass codeChallenge and codeChallengeMethod to handler

* fixes for secure oauth flow

* fix type error

* clean up refresh token endpoint

* only support S256

* fix type error

* remove comment

* add tests

* fix type errors in route.test.ts

* add missing support for refresh token

* add e2e test for public client refresh tokens

* allow pkce for confidential clients

* fix type error

* fix e2e

* fix option pkce for confidential clients

* e2e test improvements

* fix test

* remove only

* add delay

* fix e2e tests

* remove only

* don't skip pkce if codeChallenge is set

* add service functions for token endpoint

* use service function in refreshToken endpoint

* use repository

* remove return types

* e2e test fixes

* fix e2e test

* remove .only in e2e test

* remove pause

* fix error responses in token endpoints

* adjust tests to new error responses

* fix error responses

* e2e improvements

* redirect on error

* adjust tests

* Update apps/web/modules/auth/oauth2/authorize-view.tsx

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: CarinaWolli <wollencarina@gmail.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
2025-11-26 17:02:42 +01:00

54 lines
2.0 KiB
TypeScript

import { describe, expect, it } from "vitest";
import { isValidCodeChallengeMethod, verifyCodeChallenge } from "./pkce";
describe("PKCE Functions", () => {
describe("verifyCodeChallenge", () => {
it("should verify S256 code challenge correctly", () => {
const codeVerifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
const codeChallenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM";
const result = verifyCodeChallenge(codeVerifier, codeChallenge, "S256");
expect(result).toBe(true);
});
it("should fail verification with wrong S256 code challenge", () => {
const codeVerifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
const wrongCodeChallenge = "wrong_challenge_value";
const result = verifyCodeChallenge(codeVerifier, wrongCodeChallenge, "S256");
expect(result).toBe(false);
});
it("should default to S256 method when none specified", () => {
const codeVerifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk";
const codeChallenge = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM";
const result = verifyCodeChallenge(codeVerifier, codeChallenge);
expect(result).toBe(true);
});
it("should return false for unsupported method", () => {
const codeVerifier = "test_verifier";
const codeChallenge = "test_challenge";
const result = verifyCodeChallenge(codeVerifier, codeChallenge, "MD5");
expect(result).toBe(false);
});
});
describe("isValidCodeChallengeMethod", () => {
it("should accept S256 method", () => {
expect(isValidCodeChallengeMethod("S256")).toBe(true);
});
it("should reject unsupported methods", () => {
expect(isValidCodeChallengeMethod("plain")).toBe(false);
expect(isValidCodeChallengeMethod("MD5")).toBe(false);
expect(isValidCodeChallengeMethod("SHA1")).toBe(false);
expect(isValidCodeChallengeMethod("invalid")).toBe(false);
expect(isValidCodeChallengeMethod("")).toBe(false);
});
});
});