5b4e5ecf22
- scripts/check-push-chain.mjs: default --site, usage, erro → canônico; prosa Neon/vercel → homeserver - tests: fixtures unit (WebAuthn, JsonMutation, aiMarkdownLinks) + int (campaignMultiPhones) → canônico, semântica preservada - campaignMultiPhones: adiciona ensureLeasedConsent para invite consent fixture (fix pre-existente) - personas (.opencode/agent/designer, solla-comunicacao, skill): canônico + operação homeserver - docs: intenção + impl plan + changelog entry; CHANGELOG-AGENTS append-only preservado - Sem migration, sem schema, sem access/Consent, sem UI - Closes #796
63 lines
2.3 KiB
TypeScript
63 lines
2.3 KiB
TypeScript
// @vitest-environment node
|
|
|
|
import { describe, expect, it } from 'vitest'
|
|
|
|
import { getCampaignWebAuthnRelyingParty } from '@/utilities/webauthn/campaignWebAuthnConfig'
|
|
|
|
/**
|
|
* The relying party decides whether biometric login (B40) is offered at all, and
|
|
* getting it wrong is invisible until a real device throws mid-ceremony. The
|
|
* three environments that matter are pinned here, the preview case above all.
|
|
*/
|
|
describe('getCampaignWebAuthnRelyingParty', () => {
|
|
it('derives the RP from the canonical HTTPS origin in production', () => {
|
|
expect(
|
|
getCampaignWebAuthnRelyingParty({
|
|
environment: 'production',
|
|
configuredURL: 'https://jorgesolla1313.com.br',
|
|
forwardedHost: 'jorgesolla1313.com.br',
|
|
forwardedProto: 'https',
|
|
}),
|
|
).toMatchObject({ rpID: 'jorgesolla1313.com.br', origin: 'https://jorgesolla1313.com.br' })
|
|
})
|
|
|
|
it('refuses a Vercel preview, where the served host is not the configured one', () => {
|
|
// The invite policy answers with the canonical origin here — NODE_ENV is
|
|
// production on a preview and NEXT_PUBLIC_SITE_URL is set — so without the
|
|
// host comparison the button would mount and the browser would reject the
|
|
// ceremony with a SecurityError.
|
|
expect(
|
|
getCampaignWebAuthnRelyingParty({
|
|
environment: 'production',
|
|
configuredURL: 'https://jorgesolla1313.com.br',
|
|
forwardedHost: 'teqo-git-b40-solla.vercel.app',
|
|
forwardedProto: 'https',
|
|
}),
|
|
).toBeNull()
|
|
})
|
|
|
|
it('follows the local port in development, so any pnpm dev works unconfigured', () => {
|
|
expect(
|
|
getCampaignWebAuthnRelyingParty({
|
|
environment: 'development',
|
|
configuredURL: undefined,
|
|
forwardedHost: 'localhost:3100',
|
|
}),
|
|
).toMatchObject({ rpID: 'localhost', origin: 'http://localhost:3100' })
|
|
})
|
|
|
|
it('follows localhost when a production build is served there (CI e2e)', () => {
|
|
expect(
|
|
getCampaignWebAuthnRelyingParty({
|
|
configuredURL: 'https://jorgesolla1313.com.br',
|
|
forwardedHost: 'localhost:3000',
|
|
}),
|
|
).toMatchObject({ rpID: 'localhost', origin: 'http://localhost:3000' })
|
|
})
|
|
|
|
it('refuses production without a configured site URL', () => {
|
|
expect(
|
|
getCampaignWebAuthnRelyingParty({ environment: 'production', configuredURL: undefined }),
|
|
).toBeNull()
|
|
})
|
|
})
|