103 lines
4.3 KiB
TypeScript
103 lines
4.3 KiB
TypeScript
import {
|
|
buildInviteEmailHtml,
|
|
buildInviteUrl,
|
|
mapTeamRpcError,
|
|
normalizeSiteOrigin,
|
|
parseTeamAcceptInput,
|
|
parseTeamInviteInput,
|
|
TeamContractError,
|
|
} from './team-contract.ts'
|
|
|
|
function assert(condition: boolean, message: string): asserts condition {
|
|
if (!condition) throw new Error(message)
|
|
}
|
|
|
|
function assertContractError(action: () => unknown, code: string, status: number): void {
|
|
let actual: unknown
|
|
try {
|
|
action()
|
|
} catch (error) {
|
|
actual = error
|
|
}
|
|
assert(actual instanceof TeamContractError, `expected TeamContractError for ${code}`)
|
|
assert(actual.code === code, `expected ${code}, received ${actual.code}`)
|
|
assert(actual.status === status, `expected status ${status}, received ${actual.status}`)
|
|
}
|
|
|
|
Deno.test('team invite parser normalizes the only accepted request fields', () => {
|
|
const parsed = parseTeamInviteInput({
|
|
team_id: '11111111-2222-4333-8444-555555555555',
|
|
email: ' MEMBER@Example.COM ',
|
|
})
|
|
assert(parsed.teamId === '11111111-2222-4333-8444-555555555555', 'team id must be preserved')
|
|
assert(parsed.email === 'member@example.com', 'email must be normalized')
|
|
assert(parsed.role === 'member', 'role must default to member')
|
|
|
|
assertContractError(
|
|
() => parseTeamInviteInput({
|
|
team_id: parsed.teamId,
|
|
email: parsed.email,
|
|
role: 'member',
|
|
html: '<script>alert(1)</script>',
|
|
}),
|
|
'invalid_invite_request',
|
|
400,
|
|
)
|
|
})
|
|
|
|
Deno.test('team accept parser permits only a URL-safe bounded bearer token', () => {
|
|
const parsed = parseTeamAcceptInput({ token: 'abcdefghijklmnopqrstuvwx_123456' })
|
|
assert(parsed.token === 'abcdefghijklmnopqrstuvwx_123456', 'token must be preserved')
|
|
assertContractError(
|
|
() => parseTeamAcceptInput({ token: 'short' }),
|
|
'invalid_invite_token',
|
|
400,
|
|
)
|
|
assertContractError(
|
|
() => parseTeamAcceptInput({ token: parsed.token, team_id: crypto.randomUUID() }),
|
|
'invalid_invite_token',
|
|
400,
|
|
)
|
|
})
|
|
|
|
Deno.test('site URL is fail-closed to the canonical deployed HTTPS origin', () => {
|
|
assert(
|
|
normalizeSiteOrigin('https://d3ro.chanpaca.net/app/') === 'https://d3ro.chanpaca.net',
|
|
'canonical HTTPS origin must normalize',
|
|
)
|
|
assertContractError(() => normalizeSiteOrigin(undefined), 'site_url_not_configured', 503)
|
|
assertContractError(() => normalizeSiteOrigin('http://localhost:5173'), 'site_url_invalid', 503)
|
|
assertContractError(() => normalizeSiteOrigin('https://voice.chanpaca.net'), 'site_url_invalid', 503)
|
|
assertContractError(() => normalizeSiteOrigin('https://d3ro.dev'), 'site_url_invalid', 503)
|
|
assertContractError(() => normalizeSiteOrigin('http://attacker.example'), 'site_url_invalid', 503)
|
|
assertContractError(() => normalizeSiteOrigin('https://user:pass@d3ro.chanpaca.net'), 'site_url_invalid', 503)
|
|
assertContractError(() => normalizeSiteOrigin('javascript:alert(1)'), 'site_url_invalid', 503)
|
|
})
|
|
|
|
Deno.test('invite URL encodes the token and email HTML escapes every dynamic field', () => {
|
|
const token = 'abcdefghijklmnopqrstuvwx_123456'
|
|
const url = buildInviteUrl('https://d3ro.chanpaca.net', token)
|
|
assert(
|
|
url === `https://d3ro.chanpaca.net/accept-invite/?token=${token}`,
|
|
'canonical invite URL required',
|
|
)
|
|
const html = buildInviteEmailHtml({
|
|
inviteUrl: `${url}&x=<bad>`,
|
|
inviterEmail: 'owner<script>@example.com',
|
|
teamName: '<img src=x onerror=alert(1)>',
|
|
role: 'admin',
|
|
})
|
|
assert(!html.includes('<script>'), 'inviter email must be escaped')
|
|
assert(!html.includes('<img'), 'team name must be escaped')
|
|
assert(html.includes('<bad>'), 'URL text must be escaped')
|
|
assert(html.includes('&x='), 'URL ampersands must be escaped')
|
|
})
|
|
|
|
Deno.test('team RPC failures are mapped to stable public codes without provider detail', () => {
|
|
const limited = mapTeamRpcError('invite', { code: '54000', message: 'private database detail' })
|
|
assert(limited.code === 'invite_rate_limited' && limited.status === 429, 'rate limit must be stable')
|
|
const mismatch = mapTeamRpcError('accept', { code: '42501', message: 'invite_email_mismatch' })
|
|
assert(mismatch.code === 'invite_email_mismatch' && mismatch.status === 403, 'mismatch must be stable')
|
|
const unknown = mapTeamRpcError('accept', { code: 'XX000', message: 'secret stack text' })
|
|
assert(unknown.code === 'team_accept_failed' && unknown.status === 500, 'unknown errors must be sanitized')
|
|
})
|