homeio

1import { describe, expect, it } from "vitest";
2import {
3  PARTIAL_AUTH_TOKEN_PREFIX,
4  buildPartialAuthPayload,
5  isPartialAuthExpired,
6  parsePartialAuthToken,
7} from "@/lib/shared/auth/partial-auth";
8
9describe("shared partial-auth helpers", () => {
10  it("builds the prefixed payload string", () => {
11    expect(buildPartialAuthPayload("user-1", 1890000000)).toBe(
12      `${PARTIAL_AUTH_TOKEN_PREFIX}.user-1.1890000000`,
13    );
14  });
15
16  it("parses a well-formed token", () => {
17    const parsed = parsePartialAuthToken(
18      `${PARTIAL_AUTH_TOKEN_PREFIX}.user-1.1890000000.deadbeef`,
19    );
20    expect(parsed).toEqual({
21      payload: `${PARTIAL_AUTH_TOKEN_PREFIX}.user-1.1890000000`,
22      userId: "user-1",
23      expiresAtEpochSeconds: 1890000000,
24      signature: "deadbeef",
25    });
26  });
27
28  it("rejects tokens with the wrong prefix segment", () => {
29    // A session-token-shaped value must NOT parse as a partial-auth token,
30    // even if it happens to have 4 dot-segments by accident.
31    expect(parsePartialAuthToken("session-1.1890000000.sig.x")).toBeNull();
32  });
33
34  it("rejects tokens with the wrong segment count", () => {
35    expect(parsePartialAuthToken("partial.user-1.1890000000")).toBeNull();
36    expect(
37      parsePartialAuthToken("partial.user-1.1890000000.sig.extra"),
38    ).toBeNull();
39  });
40
41  it("rejects tokens with non-numeric expiry", () => {
42    expect(
43      parsePartialAuthToken("partial.user-1.not-a-number.sig"),
44    ).toBeNull();
45  });
46
47  it("rejects tokens with empty fields", () => {
48    expect(parsePartialAuthToken("partial..1890000000.sig")).toBeNull();
49    expect(parsePartialAuthToken("partial.user-1.1890000000.")).toBeNull();
50  });
51
52  it("detects expiration off the current clock", () => {
53    const nowSeconds = Math.floor(Date.now() / 1000);
54    expect(isPartialAuthExpired(nowSeconds - 1)).toBe(true);
55    expect(isPartialAuthExpired(nowSeconds + 60)).toBe(false);
56  });
57});
58