pedwfrontend/tests/phase22/auth-redirect-safety.test.cjs

const assert = require("assert");
const fs = require("fs");
const path = require("path");
const vm = require("vm");

const tests = [];
const test = (name, fn) => tests.push({ name, fn });

const loadAuthInternals = ({ adapterFactory = () => ({}) } = {}) => {
    const filePath = path.join(
        __dirname,
        "..",
        "..",
        "pages",
        "api",
        "auth",
        "[...nextauth].js"
    );

    let source = fs.readFileSync(filePath, "utf8");
    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
    source = source.replace(
        /export default NextAuthPEDW;\s*$/,
        "module.exports = { appendParamsAndPathToNewUrl, resolveRequestLocale, authOptions, NextAuthPEDW };"
    );

    const context = {
        module: { exports: {} },
        exports: {},
        require: (id) => {
            if (id === "notifications-node-client") {
                return {
                    NotifyClient: function NotifyClient() {
                        return {
                            sendEmail: async () => ({})
                        };
                    }
                };
            }

            throw new Error(`Unexpected require in auth test: ${id}`);
        },
        URL,
        URLSearchParams,
        process: {
            env: {
                NEXTAUTH_URL: "https://english.example",
                CY_API_ROOT: "https://welsh.example",
                NEXTAUTH_SECRET: "test-secret"
            }
        },
        PrismaAdapter: () => adapterFactory(),
        PrismaClient: function PrismaClient() {
            return {};
        },
        NextAuth: () => ({}),
        EmailProvider: () => ({}),
        getPortalLogin: async () => ({ value: [] }),
        redactSensitive: (value) => value,
        consoleLogger: () => {},
        console: {
            log: () => {},
            info: () => {},
            warn: () => {},
            error: () => {}
        }
    };

    vm.runInNewContext(source, context, { filename: filePath });
    return context.module.exports;
};

const deferred = () => {
    let resolve;
    let reject;
    const promise = new Promise((resolvePromise, rejectPromise) => {
        resolve = resolvePromise;
        reject = rejectPromise;
    });

    return { promise, resolve, reject };
};

const createResponse = () => {
    const calls = [];
    const response = {
        writeHead(status, headers) {
            calls.push({ type: "writeHead", status, headers });
            return response;
        },
        json(body) {
            calls.push({ type: "json", body });
            return response;
        }
    };

    return { response, calls };
};

const createEmailApiRequest = () => ({
    query: { locale: "en" },
    body: {},
    cookies: {}
});

const verificationUrl = (token) =>
    `https://english.example/api/auth/callback/emailAPI?callbackUrl=https%3A%2F%2Fenglish.example&token=${token}&email=user%40example.com`;

test("auth/resolveRequestLocale prefers query then body then cookie then default", async () => {
    const mod = loadAuthInternals();

    assert.strictEqual(
        mod.resolveRequestLocale({
            query: { locale: "cy" },
            body: { locale: "en" },
            cookies: { pedw_locale: "en" }
        }),
        "cy"
    );

    assert.strictEqual(
        mod.resolveRequestLocale({
            body: { locale: "cy" },
            cookies: { pedw_locale: "en" }
        }),
        "cy"
    );

    assert.strictEqual(
        mod.resolveRequestLocale({
            cookies: { pedw_locale: "cy" }
        }),
        "cy"
    );

    assert.strictEqual(mod.resolveRequestLocale({}), "en");
});

test("auth/redirect callback keeps relative URLs on same base", async () => {
    const mod = loadAuthInternals();
    const req = { query: { locale: "en" }, body: {}, cookies: {} };

    const options = mod.authOptions(req, {});
    const result = options.callbacks.redirect({
        url: "/account/register",
        baseUrl: "https://pedw.example"
    });

    assert.strictEqual(result, "https://pedw.example/account/register");
});

test("auth/redirect callback keeps same-origin absolute URLs unchanged", async () => {
    const mod = loadAuthInternals();
    const req = { query: { locale: "en" }, body: {}, cookies: {} };

    const options = mod.authOptions(req, {});
    const result = options.callbacks.redirect({
        url: "https://pedw.example/auth/verify-request?token=abc",
        baseUrl: "https://pedw.example"
    });

    assert.strictEqual(
        result,
        "https://pedw.example/auth/verify-request?token=abc"
    );
});

test("auth/redirect callback rewrites external URL to locale-safe base origin", async () => {
    const mod = loadAuthInternals();
    const req = { query: { locale: "cy" }, body: {}, cookies: {} };

    const options = mod.authOptions(req, {});
    const result = options.callbacks.redirect({
        url: "https://malicious.example/auth/signin?callbackUrl=%2Fdashboard&token=abc",
        baseUrl: "https://pedw.example"
    });

    const parsed = new URL(result);
    assert.strictEqual(parsed.origin, "https://welsh.example");
    assert.strictEqual(parsed.pathname, "/auth/signin");
    assert.strictEqual(parsed.searchParams.get("callbackUrl"), "/dashboard");
    assert.strictEqual(parsed.searchParams.get("token"), "abc");
});

test("auth/emailAPI waits for successful token persistence before returning its URL", async () => {
    const persistence = deferred();
    const mod = loadAuthInternals({
        adapterFactory: () => ({
            createVerificationToken: () => persistence.promise
        })
    });
    const { response, calls } = createResponse();
    const options = mod.authOptions(createEmailApiRequest(), response);
    const provider = options.providers[0];

    const sendPromise = provider.sendVerificationRequest({
        identifier: "user@example.com",
        url: verificationUrl("token-one")
    });
    const createPromise = options.adapter.createVerificationToken({
        identifier: "user@example.com",
        token: "stored-token-one",
        expires: new Date(Date.now() + 60_000)
    });

    await Promise.resolve();
    await Promise.resolve();
    assert.deepStrictEqual(calls, []);

    persistence.resolve({
        identifier: "user@example.com",
        token: "stored-token-one",
        expires: new Date(Date.now() + 60_000)
    });

    await Promise.all([sendPromise, createPromise]);

    assert.strictEqual(calls[0].type, "writeHead");
    assert.strictEqual(calls[0].status, 200);
    assert.strictEqual(calls[1].type, "json");
    assert.strictEqual(calls[1].body.url, verificationUrl("token-one"));
});

test("auth/emailAPI does not return a verification URL when persistence fails", async () => {
    const persistence = deferred();
    const persistenceError = new Error("persistence failed");
    const mod = loadAuthInternals({
        adapterFactory: () => ({
            createVerificationToken: () => persistence.promise
        })
    });
    const { response, calls } = createResponse();
    const options = mod.authOptions(createEmailApiRequest(), response);

    const sendPromise = options.providers[0].sendVerificationRequest({
        identifier: "user@example.com",
        url: verificationUrl("token-two")
    });
    const createPromise = options.adapter.createVerificationToken({
        identifier: "user@example.com",
        token: "stored-token-two",
        expires: new Date(Date.now() + 60_000)
    });

    persistence.reject(persistenceError);

    const [sendResult, createResult] = await Promise.allSettled([
        sendPromise,
        createPromise
    ]);

    assert.strictEqual(sendResult.status, "rejected");
    assert.strictEqual(sendResult.reason, persistenceError);
    assert.strictEqual(createResult.status, "rejected");
    assert.strictEqual(createResult.reason, persistenceError);
    assert.deepStrictEqual(calls, []);
});

test("auth/emailAPI keeps concurrent sign-in persistence signals request-scoped", async () => {
    const firstPersistence = deferred();
    const secondPersistence = deferred();
    const adapters = [
        { createVerificationToken: () => firstPersistence.promise },
        { createVerificationToken: () => secondPersistence.promise }
    ];
    const mod = loadAuthInternals({
        adapterFactory: () => adapters.shift()
    });
    const firstResponse = createResponse();
    const secondResponse = createResponse();
    const firstOptions = mod.authOptions(
        createEmailApiRequest(),
        firstResponse.response
    );
    const secondOptions = mod.authOptions(
        createEmailApiRequest(),
        secondResponse.response
    );

    const firstSend = firstOptions.providers[0].sendVerificationRequest({
        identifier: "user@example.com",
        url: verificationUrl("first-token")
    });
    const firstCreate = firstOptions.adapter.createVerificationToken({});
    const secondSend = secondOptions.providers[0].sendVerificationRequest({
        identifier: "user@example.com",
        url: verificationUrl("second-token")
    });
    const secondCreate = secondOptions.adapter.createVerificationToken({});

    secondPersistence.resolve({ token: "stored-second-token" });
    await Promise.all([secondSend, secondCreate]);

    assert.deepStrictEqual(firstResponse.calls, []);
    assert.strictEqual(
        secondResponse.calls[1].body.url,
        verificationUrl("second-token")
    );

    firstPersistence.resolve({ token: "stored-first-token" });
    await Promise.all([firstSend, firstCreate]);

    assert.strictEqual(
        firstResponse.calls[1].body.url,
        verificationUrl("first-token")
    );
});

const run = async () => {
    let passed = 0;

    for (const currentTest of tests) {
        await currentTest.fn();
        passed += 1;
    }

    console.log(
        `Phase 22 auth-redirect tests passed (${passed}/${tests.length}).`
    );
};

module.exports = run;

if (require.main === module) {
    run().catch((error) => {
        console.error(error);
        process.exit(1);
    });
}