| 1 | // 🤖 Tests for the restore page's payload validation + CLI return URL — the |
| 2 | // pure half of the passkey handoff (home/web/static/restore-payload.js). |
| 3 | // node home/test/restore-payload.test.mjs |
| 4 | import assert from "node:assert/strict"; |
| 5 | import { validRestorePayload, validCLIPort, cliReturnURL, validReturnScheme } from "../web/static/restore-payload.js"; |
| 6 | |
| 7 | // ---- instance shape --------------------------------------------------------- |
| 8 | |
| 9 | assert.deepEqual( |
| 10 | validRestorePayload({ ret: "https://chat.example.com/", nonce: "n", ephPub: "P" }), |
| 11 | { ret: "https://chat.example.com/", nonce: "n", ephPub: "P" }, |
| 12 | "instance payload passes", |
| 13 | ); |
| 14 | assert.equal(validRestorePayload({ ret: "not a url", nonce: "n", ephPub: "P" }), null, "unparseable ret rejected"); |
| 15 | assert.equal(validRestorePayload({ ret: "https://x.com", nonce: "n" }), null, "missing ephPub rejected"); |
| 16 | assert.equal(validRestorePayload(null), null, "null rejected"); |
| 17 | |
| 18 | // ---- app shape -------------------------------------------------------------- |
| 19 | |
| 20 | assert.deepEqual( |
| 21 | validRestorePayload({ app: 1, nonce: "n", ephPub: "P" }), |
| 22 | { app: 1, nonce: "n", ephPub: "P" }, |
| 23 | "app payload passes", |
| 24 | ); |
| 25 | // Only the expected fields survive — a smuggled ret must not ride along on an |
| 26 | // app/cli payload (their return targets are fixed / loopback-only). |
| 27 | assert.equal(validRestorePayload({ app: 1, nonce: "n", ephPub: "P", ret: "https://evil.example" }).ret, |
| 28 | undefined, "app payload drops extra fields"); |
| 29 | |
| 30 | // ---- the app shape's return scheme (dev alts name themselves) ---------------- |
| 31 | |
| 32 | assert.deepEqual( |
| 33 | validRestorePayload({ app: 1, nonce: "n", ephPub: "P", scheme: "elevenmessenger.alt-dek" }), |
| 34 | { app: 1, nonce: "n", ephPub: "P", scheme: "elevenmessenger.alt-dek" }, |
| 35 | "an alt names its own suffixed scheme", |
| 36 | ); |
| 37 | assert.equal( |
| 38 | validRestorePayload({ app: 1, nonce: "n", ephPub: "P", scheme: "elevenmessenger" }).scheme, |
| 39 | "elevenmessenger", |
| 40 | "the plain scheme passes too", |
| 41 | ); |
| 42 | for (const scheme of ["https", "evil", "elevenmessenger.alt-", "elevenmessenger.alt-UPPER", |
| 43 | "elevenmessengerx", "elevenmessenger.alt-" + "x".repeat(33), 7, null, {}]) { |
| 44 | assert.equal( |
| 45 | validRestorePayload({ app: 1, nonce: "n", ephPub: "P", scheme }).scheme, |
| 46 | undefined, |
| 47 | `junk scheme ${JSON.stringify(scheme)} dropped (plain-app fallback)`, |
| 48 | ); |
| 49 | } |
| 50 | assert.equal(validReturnScheme("elevenmessenger.alt-dek2"), true, "digits in slugs pass"); |
| 51 | assert.equal( |
| 52 | validRestorePayload({ ret: "https://x.example", nonce: "n", ephPub: "P", scheme: "elevenmessenger.alt-dek" }).scheme, |
| 53 | undefined, |
| 54 | "only the app shape carries a scheme", |
| 55 | ); |
| 56 | |
| 57 | // ---- cli shape -------------------------------------------------------------- |
| 58 | |
| 59 | assert.deepEqual( |
| 60 | validRestorePayload({ cli: 1, nonce: "n", ephPub: "P", port: 49152 }), |
| 61 | { cli: 1, nonce: "n", ephPub: "P", port: 49152 }, |
| 62 | "cli payload with port passes", |
| 63 | ); |
| 64 | assert.deepEqual( |
| 65 | validRestorePayload({ cli: 1, nonce: "n", ephPub: "P" }), |
| 66 | { cli: 1, nonce: "n", ephPub: "P", port: undefined }, |
| 67 | "cli payload without port (paste mode) passes", |
| 68 | ); |
| 69 | for (const port of [0, 80, 1023, 65536, -1, 1.5, "8080", null]) { |
| 70 | assert.equal(validRestorePayload({ cli: 1, nonce: "n", ephPub: "P", port }), null, `bad port ${port} rejected`); |
| 71 | } |
| 72 | assert.equal(validRestorePayload({ cli: 1, ephPub: "P", port: 49152 }), null, "cli missing nonce rejected"); |
| 73 | assert.equal(validRestorePayload({ cli: 1, nonce: "n", ephPub: "P", port: 49152, ret: "https://evil.example" }).ret, |
| 74 | undefined, "cli payload drops extra fields"); |
| 75 | |
| 76 | // ---- loopback URL ----------------------------------------------------------- |
| 77 | |
| 78 | assert.equal(cliReturnURL(49152, "abc-_123"), "http://127.0.0.1:49152/cb?d=abc-_123", "loopback URL shape"); |
| 79 | assert.throws(() => cliReturnURL(80, "x"), "privileged port refused"); |
| 80 | assert.throws(() => cliReturnURL("49152", "x"), "string port refused"); |
| 81 | assert.equal(validCLIPort(1024), true); |
| 82 | assert.equal(validCLIPort(65535), true); |
| 83 | assert.equal(validCLIPort(1023), false); |
| 84 | |
| 85 | console.log("restore-payload.test.mjs: all passed"); |
| 86 | |
amadan