webauthn-rp.test.ts51 lines · main

1	import { describe, expect, test } from 'bun:test';
2
3	import { resolveWebAuthnRp, rpIdMatchesOrigin } from './webauthn.js';
4
5	describe('rpIdMatchesOrigin', () => {
6	test('exact host match', () => {
7	expect(rpIdMatchesOrigin('pay.mavifinans.sh', 'https://pay.mavifinans.sh')).toBe(
8	true,
9	);
10	});
11	test('parent domain allowed', () => {
12	expect(rpIdMatchesOrigin('mavifinans.sh', 'https://pay.mavifinans.sh')).toBe(true);
13	});
14	test('unrelated domain rejected', () => {
15	expect(rpIdMatchesOrigin('briven.tech', 'https://pay.mavifinans.sh')).toBe(false);
16	});
17	});
18
19	describe('resolveWebAuthnRp', () => {
20	test('uses request Origin for tenant app (not briven.tech)', async () => {
21	const r = await resolveWebAuthnRp({
22	// no project → no Allowed Domains; request origin wins
23	requestOrigin: 'https://pay.mavifinans.sh',
24	});
25	expect(r.ok).toBe(true);
26	if (!r.ok) return;
27	expect(r.rpId).toBe('pay.mavifinans.sh');
28	expect(r.expectedOrigin).toBe('https://pay.mavifinans.sh');
29	});
30
31	test('explicit app rpId + origin', async () => {
32	const r = await resolveWebAuthnRp({
33	rpId: 'pay.mavifinans.sh',
34	expectedOrigin: 'https://pay.mavifinans.sh',
35	});
36	expect(r.ok).toBe(true);
37	if (!r.ok) return;
38	expect(r.rpId).toBe('pay.mavifinans.sh');
39	});
40
41	test('ignores mismatched client rpId (briven.tech on mavi host)', async () => {
42	const r = await resolveWebAuthnRp({
43	rpId: 'briven.tech',
44	expectedOrigin: 'https://pay.mavifinans.sh',
45	requestOrigin: 'https://pay.mavifinans.sh',
46	});
47	expect(r.ok).toBe(true);
48	if (!r.ok) return;
49	expect(r.rpId).toBe('pay.mavifinans.sh');
50	});
51	});