pedwfrontend/tests/phase22/auth-redirect-safety.test.cjs

const assert = require("assert");
const fs = require("fs");
const path = require("path");
const vm = require("vm");

const tests = [];
const test = (name, fn) => tests.push({ name, fn });

const loadAuthInternals = () => {
    const filePath = path.join(
        __dirname,
        "..",
        "..",
        "pages",
        "api",
        "auth",
        "[...nextauth].js"
    );

    let source = fs.readFileSync(filePath, "utf8");
    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
    source = source.replace(
        /export default NextAuthPEDW;\s*$/,
        "module.exports = { appendParamsAndPathToNewUrl, resolveRequestLocale, authOptions, NextAuthPEDW };"
    );

    const context = {
        module: { exports: {} },
        exports: {},
        require: (id) => {
            if (id === "notifications-node-client") {
                return {
                    NotifyClient: function NotifyClient() {
                        return {
                            sendEmail: async () => ({})
                        };
                    }
                };
            }

            throw new Error(`Unexpected require in auth test: ${id}`);
        },
        URL,
        URLSearchParams,
        process: {
            env: {
                NEXTAUTH_URL: "https://english.example",
                CY_API_ROOT: "https://welsh.example",
                NEXTAUTH_SECRET: "test-secret"
            }
        },
        PrismaAdapter: () => ({}),
        PrismaClient: function PrismaClient() {
            return {};
        },
        NextAuth: () => ({}),
        EmailProvider: () => ({}),
        consoleLogger: () => {},
        console: {
            log: () => {},
            info: () => {},
            warn: () => {},
            error: () => {}
        }
    };

    vm.runInNewContext(source, context, { filename: filePath });
    return context.module.exports;
};

test("auth/resolveRequestLocale prefers query then body then cookie then default", async () => {
    const mod = loadAuthInternals();

    assert.strictEqual(
        mod.resolveRequestLocale({
            query: { locale: "cy" },
            body: { locale: "en" },
            cookies: { pedw_locale: "en" }
        }),
        "cy"
    );

    assert.strictEqual(
        mod.resolveRequestLocale({
            body: { locale: "cy" },
            cookies: { pedw_locale: "en" }
        }),
        "cy"
    );

    assert.strictEqual(
        mod.resolveRequestLocale({
            cookies: { pedw_locale: "cy" }
        }),
        "cy"
    );

    assert.strictEqual(mod.resolveRequestLocale({}), "en");
});

test("auth/redirect callback keeps relative URLs on same base", async () => {
    const mod = loadAuthInternals();
    const req = { query: { locale: "en" }, body: {}, cookies: {} };

    const options = mod.authOptions(req, {});
    const result = options.callbacks.redirect({
        url: "/account/register",
        baseUrl: "https://pedw.example"
    });

    assert.strictEqual(result, "https://pedw.example/account/register");
});

test("auth/redirect callback keeps same-origin absolute URLs unchanged", async () => {
    const mod = loadAuthInternals();
    const req = { query: { locale: "en" }, body: {}, cookies: {} };

    const options = mod.authOptions(req, {});
    const result = options.callbacks.redirect({
        url: "https://pedw.example/auth/verify-request?token=abc",
        baseUrl: "https://pedw.example"
    });

    assert.strictEqual(
        result,
        "https://pedw.example/auth/verify-request?token=abc"
    );
});

test("auth/redirect callback rewrites external URL to locale-safe base origin", async () => {
    const mod = loadAuthInternals();
    const req = { query: { locale: "cy" }, body: {}, cookies: {} };

    const options = mod.authOptions(req, {});
    const result = options.callbacks.redirect({
        url: "https://malicious.example/auth/signin?callbackUrl=%2Fdashboard&token=abc",
        baseUrl: "https://pedw.example"
    });

    const parsed = new URL(result);
    assert.strictEqual(parsed.origin, "https://welsh.example");
    assert.strictEqual(parsed.pathname, "/auth/signin");
    assert.strictEqual(parsed.searchParams.get("callbackUrl"), "/dashboard");
    assert.strictEqual(parsed.searchParams.get("token"), "abc");
});

const run = async () => {
    let passed = 0;

    for (const currentTest of tests) {
        await currentTest.fn();
        passed += 1;
    }

    console.log(
        `Phase 22 auth-redirect tests passed (${passed}/${tests.length}).`
    );
};

module.exports = run;

if (require.main === module) {
    run().catch((error) => {
        console.error(error);
        process.exit(1);
    });
}