Files
fusion/packages/dashboard/app/auth.test.ts
2026-04-22 01:31:40 -07:00

68 lines
2.4 KiB
TypeScript

import { beforeEach, describe, expect, it, vi } from "vitest";
async function loadAuthModule() {
vi.resetModules();
return import("./auth");
}
describe("auth helpers", () => {
beforeEach(() => {
window.localStorage.clear();
window.history.replaceState({}, "", "/");
});
it("captures token from ?token= and cleans URL while preserving other params/hash", async () => {
window.history.replaceState({}, "", "/dashboard?token=daemon-123&view=board#focus");
const { getAuthToken } = await loadAuthModule();
expect(getAuthToken()).toBe("daemon-123");
expect(window.localStorage.getItem("fn.authToken")).toBe("daemon-123");
expect(`${window.location.pathname}${window.location.search}${window.location.hash}`).toBe(
"/dashboard?view=board#focus",
);
});
it("appends fn_token for same-origin API URLs and same-host websocket URLs", async () => {
window.localStorage.setItem("fn.authToken", "daemon-abc");
const { appendTokenQuery, QUERY_TOKEN_PARAM } = await loadAuthModule();
expect(appendTokenQuery("/api/tasks?limit=1")).toBe(
`/api/tasks?limit=1&${QUERY_TOKEN_PARAM}=daemon-abc`,
);
const wsUrl = `ws://${window.location.host}/api/events`;
expect(appendTokenQuery(wsUrl)).toBe(`${wsUrl}?${QUERY_TOKEN_PARAM}=daemon-abc`);
});
it("does not append fn_token for cross-origin URLs", async () => {
window.localStorage.setItem("fn.authToken", "daemon-abc");
const { appendTokenQuery } = await loadAuthModule();
const externalOAuth = "https://auth.provider.example/oauth/start?client_id=test";
expect(appendTokenQuery(externalOAuth)).toBe(externalOAuth);
});
it("withTokenHeader adds bearer token without overwriting explicit Authorization", async () => {
window.localStorage.setItem("fn.authToken", "daemon-xyz");
const { withTokenHeader } = await loadAuthModule();
const merged = new Headers(withTokenHeader({ "X-Test": "1" }));
expect(merged.get("Authorization")).toBe("Bearer daemon-xyz");
expect(merged.get("X-Test")).toBe("1");
const explicit = new Headers(withTokenHeader({ Authorization: "Bearer pre-signed" }));
expect(explicit.get("Authorization")).toBe("Bearer pre-signed");
});
it("returns original headers when no token is available", async () => {
const { withTokenHeader } = await loadAuthModule();
const original = { "X-Test": "no-token" };
expect(withTokenHeader(original)).toBe(original);
});
});