heygo/tests/auth.test.ts

import { describe, expect, it } from 'vitest';
import {
  AUTH_DISABLED_PROVIDERS,
  AUTH_ENABLED_PROVIDERS,
  AUTH_SESSION_COOKIE_NAME,
  getSessionCookieAttributes,
  isAuthProviderEnabled,
} from '../worker/auth';

describe('auth configuration constants', () => {
  it('enables Google and GitHub while keeping Apple disabled', () => {
    expect(AUTH_ENABLED_PROVIDERS).toEqual(['google', 'github']);
    expect(AUTH_DISABLED_PROVIDERS).toEqual(['apple']);
    expect(isAuthProviderEnabled('google')).toBe(true);
    expect(isAuthProviderEnabled('github')).toBe(true);
    expect(isAuthProviderEnabled('apple')).toBe(false);
  });

  it('uses the canonical session cookie name', () => {
    expect(AUTH_SESSION_COOKIE_NAME).toBe('heygo_session');
  });
});

describe('session cookie policy', () => {
  it('uses the configured cookie domain when one is supplied', () => {
    expect(getSessionCookieAttributes('https://my.heygo.cc/app', '.heygo.cc')).toEqual([
      'HttpOnly',
      'SameSite=Lax',
      'Path=/',
      'Secure',
      'Domain=.heygo.cc',
    ]);
  });

  it('omits Secure over HTTP (local dev) even when a domain is set', () => {
    expect(getSessionCookieAttributes('http://localhost:8787/app', '')).toEqual([
      'HttpOnly',
      'SameSite=Lax',
      'Path=/',
    ]);
  });

  it('omits Domain when the cookie domain env var is empty (localhost development)', () => {
    expect(getSessionCookieAttributes('http://localhost:5173/app', '')).toEqual([
      'HttpOnly',
      'SameSite=Lax',
      'Path=/',
    ]);
  });

  it('honors a custom cookie domain for non-heygo hosts', () => {
    expect(getSessionCookieAttributes('https://my.example.com/app', '.example.com')).toEqual([
      'HttpOnly',
      'SameSite=Lax',
      'Path=/',
      'Secure',
      'Domain=.example.com',
    ]);
  });
});