cli-jwt.test.ts56 lines · main

1	const ORIGINAL_SECRET = process.env.BRIVEN_BETTER_AUTH_SECRET;
2	process.env.BRIVEN_BETTER_AUTH_SECRET = ORIGINAL_SECRET ?? 'a'.repeat(32);
3
4	import { afterAll, describe, expect, it } from 'bun:test';
5
6	describe('cli-jwt', () => {
7	it('round-trips a user id', async () => {
8	const { signCliToken, verifyCliToken } = await import('./cli-jwt.js');
9	const token = await signCliToken('u_test123');
10	const payload = await verifyCliToken(token);
11	expect(payload.sub).toBe('u_test123');
12	expect(payload.scope).toBe('cli');
13	});
14
15	it('rejects a forged token', async () => {
16	const { verifyCliToken } = await import('./cli-jwt.js');
17	await expect(verifyCliToken('not.a.jwt')).rejects.toThrow();
18	});
19
20	it('rejects a token with scope != cli', async () => {
21	const { verifyCliToken } = await import('./cli-jwt.js');
22	const { SignJWT } = await import('jose');
23	const { env } = await import('../env.js');
24	const secret = new TextEncoder().encode(env.BRIVEN_BETTER_AUTH_SECRET);
25	const bad = await new SignJWT({ scope: 'session' })
26	.setProtectedHeader({ alg: 'HS256' })
27	.setSubject('u_x')
28	.setIssuer('briven-api')
29	.setAudience('briven-cli')
30	.setIssuedAt()
31	.setExpirationTime('1h')
32	.sign(secret);
33	await expect(verifyCliToken(bad)).rejects.toThrow(/scope/);
34	});
35
36	it('rejects an expired token', async () => {
37	const { verifyCliToken } = await import('./cli-jwt.js');
38	const { SignJWT } = await import('jose');
39	const { env } = await import('../env.js');
40	const secret = new TextEncoder().encode(env.BRIVEN_BETTER_AUTH_SECRET);
41	const expired = await new SignJWT({ scope: 'cli' })
42	.setProtectedHeader({ alg: 'HS256' })
43	.setSubject('u_expired')
44	.setIssuer('briven-api')
45	.setAudience('briven-cli')
46	.setIssuedAt(Math.floor(Date.now() / 1000) - 7200)
47	.setExpirationTime(Math.floor(Date.now() / 1000) - 3600)
48	.sign(secret);
49	await expect(verifyCliToken(expired)).rejects.toThrow();
50	});
51	});
52
53	afterAll(() => {
54	if (ORIGINAL_SECRET === undefined) delete process.env.BRIVEN_BETTER_AUTH_SECRET;
55	else process.env.BRIVEN_BETTER_AUTH_SECRET = ORIGINAL_SECRET;
56	});