Merged PR 2315: Auth stabilistatiion and hardening

Related work items: #23020
2026-05-14 08:55:49 +00:00
parent d295a507ac
commit d0b2fd077a
41 changed files with 1462 additions and 418 deletions
@@ -0,0 +1,134 @@
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+const assert = require("assert");
+
+const rootDir = path.resolve(__dirname, "..", "..");
+
+const loadSessionClientModule = (injected = {}) => {
+    const filePath = path.join(rootDir, "lib", "auth", "sessionClient.js");
+    let source = fs.readFileSync(filePath, "utf8");
+
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(/export const\s+/g, "const ");
+    source +=
+        "\nmodule.exports = { buildSignedOutCallbackUrl, clearSessionArtifacts, performPortalSignOut };\n";
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        require,
+        window: {
+            localStorage: {
+                clear: () => {}
+            }
+        },
+        destroyCookie: () => {},
+        signOut: async () => ({}),
+        ...injected
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+test("auth/sessionClient callback URL helper returns EN/CY expected routes", async () => {
+    const mod = loadSessionClientModule();
+
+    assert.strictEqual(mod.buildSignedOutCallbackUrl("cy"), "/cy/allgofnodi");
+    assert.strictEqual(mod.buildSignedOutCallbackUrl("en"), "/logout");
+    assert.strictEqual(mod.buildSignedOutCallbackUrl(undefined), "/logout");
+});
+
+test("auth/sessionClient clearSessionArtifacts clears storage and known auth cookies", async () => {
+    const destroyed = [];
+    let clearCalls = 0;
+
+    const mod = loadSessionClientModule({
+        destroyCookie: (_ctx, name, opts) => {
+            destroyed.push({ name, opts });
+        },
+        window: {
+            localStorage: {
+                clear: () => {
+                    clearCalls += 1;
+                }
+            }
+        }
+    });
+
+    mod.clearSessionArtifacts();
+
+    assert.strictEqual(clearCalls, 1);
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(destroyed.map((d) => d.name))),
+        [
+            "next-auth.csrf-token",
+            "next-auth.callback-url",
+            "__Secure-next-auth.callback-url",
+            "pedw_locale",
+            "pinsUser"
+        ]
+    );
+    assert.strictEqual(
+        destroyed.every((d) => d.opts.path === "/"),
+        true
+    );
+});
+
+test("auth/sessionClient performPortalSignOut supports locale string argument", async () => {
+    const signOutCalls = [];
+    const mod = loadSessionClientModule({
+        signOut: async (args) => {
+            signOutCalls.push(args);
+            return { ok: true };
+        }
+    });
+
+    await mod.performPortalSignOut("cy");
+
+    assert.strictEqual(signOutCalls.length, 1);
+    assert.strictEqual(signOutCalls[0].callbackUrl, "/cy/allgofnodi");
+});
+
+test("auth/sessionClient performPortalSignOut supports callback override and injected signOut", async () => {
+    const signOutCalls = [];
+    const mod = loadSessionClientModule();
+
+    await mod.performPortalSignOut({
+        locale: "en",
+        callbackUrl: "/",
+        signOutFn: async (args) => {
+            signOutCalls.push(args);
+            return { ok: true };
+        }
+    });
+
+    assert.strictEqual(signOutCalls.length, 1);
+    assert.strictEqual(signOutCalls[0].callbackUrl, "/");
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 22 session-client tests passed (${passed}/${tests.length}).`
+    );
+};
+
+module.exports = run;
+
+if (require.main === module) {
+    run().catch((error) => {
+        console.error(error);
+        process.exit(1);
+    });
+}