Something went wrong. Try again.
AtAuth
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273/** * OIDC Authorize Passkey Tests * * Tests for passkey authentication on the OIDC authorize page. */import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';import express from 'express';import request from 'supertest';import crypto from 'crypto';import { createAuthorizeRouter } from './authorize.js';import { DatabaseService } from '../../services/database.js';
function createTestApp(db: DatabaseService, mockOidc: any, mockOAuth: any, mockPasskey?: any) { const app = express(); app.use(express.json()); app.use(express.urlencoded({ extended: true }));
const router = createAuthorizeRouter(db, mockOidc, mockOAuth, mockPasskey); app.use('/oauth', router);
app.use((err: any, _req: any, res: any, _next: any) => { const status = err.status || err.statusCode || 500; res.status(status).json({ error: err.code || 'server_error', message: err.message, }); });
return app;}
function registerOIDCClient(db: DatabaseService, id = 'test-client') { db.upsertOIDCClient({ id, name: 'Test App', client_type: 'oidc', hmac_secret: crypto.randomBytes(32).toString('hex'), redirect_uris: ['https://app.example.com/callback'], grant_types: ['authorization_code'], allowed_scopes: ['openid', 'profile'], token_ttl_seconds: 3600, id_token_ttl_seconds: 3600, access_token_ttl_seconds: 3600, refresh_token_ttl_seconds: 86400, require_pkce: false, token_endpoint_auth_method: 'client_secret_basic', });}
function createPendingAuthCode(db: DatabaseService, code = 'test-auth-code') { db.saveAuthorizationCode({ code, client_id: 'test-client', redirect_uri: 'https://app.example.com/callback', scope: 'openid profile', state: 'test-state-123', did: '', handle: '', created_at: Math.floor(Date.now() / 1000), expires_at: Math.floor(Date.now() / 1000) + 600, used: false, });}
const mockCredential = { id: 'credential-id-123', rawId: 'credential-id-123', response: { clientDataJSON: 'mock-client-data', authenticatorData: 'mock-auth-data', signature: 'mock-signature', }, type: 'public-key',};
describe('POST /oauth/authorize/passkey', () => { let db: DatabaseService; let mockOidc: any; let mockOAuth: any; let mockPasskey: any; let app: express.Application;
beforeEach(() => { db = new DatabaseService(':memory:'); mockOidc = { issuer: 'https://auth.example.com', }; mockOAuth = { generateAuthUrl: vi.fn(), handleCallback: vi.fn(), }; mockPasskey = { verifyAuthentication: vi.fn(), generateAuthenticationOptions: vi.fn(), }; registerOIDCClient(db); app = createTestApp(db, mockOidc, mockOAuth, mockPasskey); });
afterEach(() => { db.close(); });
it('should complete OIDC flow via passkey authentication', async () => { createPendingAuthCode(db); mockPasskey.verifyAuthentication.mockResolvedValue({ success: true, did: 'did:plc:test123', handle: 'user.bsky.social', });
const res = await request(app) .post('/oauth/authorize/passkey') .send({ auth_code: 'test-auth-code', credential: mockCredential, challenge: 'test-challenge', });
expect(res.status).toBe(200); expect(res.body.redirect_url).toContain('https://app.example.com/callback'); expect(res.body.redirect_url).toContain('code=test-auth-code'); expect(res.body.redirect_url).toContain('state=test-state-123');
// Verify the auth code was updated with user identity const authData = db.getAuthorizationCode('test-auth-code'); expect(authData?.did).toBe('did:plc:test123'); expect(authData?.handle).toBe('user.bsky.social'); });
it('should return 400 for missing parameters', async () => { const res = await request(app) .post('/oauth/authorize/passkey') .send({ auth_code: 'test' });
expect(res.status).toBe(400); expect(res.body.error).toBe('invalid_request'); });
it('should return 400 for invalid auth code', async () => { mockPasskey.verifyAuthentication.mockResolvedValue({ success: true, did: 'did:plc:test123', handle: 'user.bsky.social', });
const res = await request(app) .post('/oauth/authorize/passkey') .send({ auth_code: 'nonexistent-code', credential: mockCredential, challenge: 'test-challenge', });
expect(res.status).toBe(400); expect(res.body.error).toBe('invalid_request'); expect(res.body.error_description).toContain('expired or invalid'); });
it('should return 400 for already-used auth code', async () => { createPendingAuthCode(db, 'used-code'); // Mark it as used via raw SQL since there's no direct method db.updateAuthorizationCodeUser('used-code', 'did:plc:old', 'old.bsky.social'); db['db'].prepare('UPDATE authorization_codes SET used = 1 WHERE code = ?').run('used-code');
const res = await request(app) .post('/oauth/authorize/passkey') .send({ auth_code: 'used-code', credential: mockCredential, challenge: 'test-challenge', });
expect(res.status).toBe(400); expect(res.body.error).toBe('invalid_request'); expect(res.body.error_description).toContain('already used'); });
it('should return 401 for failed passkey verification', async () => { createPendingAuthCode(db); mockPasskey.verifyAuthentication.mockResolvedValue({ success: false, error: 'Unknown credential', });
const res = await request(app) .post('/oauth/authorize/passkey') .send({ auth_code: 'test-auth-code', credential: mockCredential, challenge: 'bad-challenge', });
expect(res.status).toBe(401); expect(res.body.error).toBe('authentication_failed'); expect(res.body.error_description).toContain('Unknown credential'); });
it('should return 404 when passkey service is not enabled', async () => { const appNoPasskey = createTestApp(db, mockOidc, mockOAuth, null); createPendingAuthCode(db);
const res = await request(appNoPasskey) .post('/oauth/authorize/passkey') .send({ auth_code: 'test-auth-code', credential: mockCredential, challenge: 'test-challenge', });
expect(res.status).toBe(404); expect(res.body.error).toBe('not_found'); });});
describe('GET /oauth/authorize - login page', () => { let db: DatabaseService; let mockOidc: any; let mockOAuth: any;
beforeEach(() => { db = new DatabaseService(':memory:'); mockOidc = { issuer: 'https://auth.example.com' }; mockOAuth = { generateAuthUrl: vi.fn(), handleCallback: vi.fn() }; registerOIDCClient(db); });
afterEach(() => { db.close(); });
it('should render passkey button when passkey service is enabled', async () => { const mockPasskey = { verifyAuthentication: vi.fn() }; const app = createTestApp(db, mockOidc, mockOAuth, mockPasskey);
const res = await request(app) .get('/oauth/authorize') .query({ response_type: 'code', client_id: 'test-client', redirect_uri: 'https://app.example.com/callback', scope: 'openid profile', state: 'test-state', });
expect(res.status).toBe(200); expect(res.text).toContain('passkeyBtn'); expect(res.text).toContain('Sign in with passkey'); expect(res.text).toContain('b64urlToBuffer'); });
it('should not render passkey button when passkey service is disabled', async () => { const app = createTestApp(db, mockOidc, mockOAuth, null);
const res = await request(app) .get('/oauth/authorize') .query({ response_type: 'code', client_id: 'test-client', redirect_uri: 'https://app.example.com/callback', scope: 'openid profile', state: 'test-state', });
expect(res.status).toBe(200); expect(res.text).not.toContain('passkeyBtn'); expect(res.text).not.toContain('Sign in with passkey'); // Handle form should still be present expect(res.text).toContain('loginForm'); expect(res.text).toContain('you.bsky.social'); });});