eleven / ocho Public

Download this file

1	// Tests for the pre-join sign-in return helpers (joinreturn.js) — the guard
2	// that decides where a signed-in person may be redirected back to.
3	import test from "node:test";
4	import assert from "node:assert/strict";
5	import {
6	parseJoinReturn, validJoinReturn, stashJoinReturn, readJoinReturnStash,
7	} from "../web/static/joinreturn.js";
8
9	const OK = "https://chat.example.com/join/abc?su=n1";
10
11	test("parseJoinReturn: the #joinret= fragment, decoded", () => {
12	assert.equal(parseJoinReturn("#joinret=" + encodeURIComponent(OK)), OK);
13	assert.equal(parseJoinReturn(""), "");
14	assert.equal(parseJoinReturn("#claim=host"), "");
15	assert.equal(parseJoinReturn("#joinret=%"), ""); // malformed encoding
16	});
17
18	test("validJoinReturn: https /join/ URLs only (http for localhost dev)", () => {
19	assert.equal(validJoinReturn(OK), true);
20	assert.equal(validJoinReturn("http://localhost:8080/join/abc?su=n"), true);
21	assert.equal(validJoinReturn("http://127.0.0.1:8080/join/abc"), true);
22	assert.equal(validJoinReturn("http://chat.example.com/join/abc"), false);
23	assert.equal(validJoinReturn("https://chat.example.com/other"), false);
24	assert.equal(validJoinReturn("https://u:p@chat.example.com/join/abc"), false);
25	assert.equal(validJoinReturn("javascript:alert(1)"), false);
26	assert.equal(validJoinReturn("not a url"), false);
27	});
28
29	test("stash round trip, expiry, tamper", () => {
30	const now = 5_000_000;
31	const s = stashJoinReturn(OK, now);
32	assert.equal(readJoinReturnStash(s, now + 1000), OK);
33	assert.equal(readJoinReturnStash(s, now + 61 * 60 * 1000), "");
34	assert.equal(readJoinReturnStash(s, now - 1000), "");
35	assert.equal(readJoinReturnStash("junk", now), "");
36	assert.equal(readJoinReturnStash("", now), "");
37	// A stash whose URL fails the guard reads as absent — validated on BOTH ends.
38	assert.equal(readJoinReturnStash(stashJoinReturn("https://evil.example.com/x", now), now), "");
39	});
40