redefined-designs/backend/tests/unit/relyingParty.test.ts

import { relyingParty, RELYING_PARTY_NAME } from '../../src/passkeys/relyingParty';

/**
 * The RP ID is the one value in this feature that cannot be corrected later: a
 * passkey is bound to it permanently, and a wrong one is only discovered when a
 * customer cannot sign in with a credential that no longer matches anything.
 *
 * So these assert the derivation itself rather than that the function returns
 * something. Most of them are about what must *not* end up in the ID.
 */
describe('relyingParty', () => {
  it('takes the RP ID from PUBLIC_URL', () => {
    const rp = relyingParty({ PUBLIC_URL: 'https://redefined-designs.com' });

    expect(rp.id).toBe('redefined-designs.com');
    expect(rp.origins).toEqual(['https://redefined-designs.com']);
    expect(rp.name).toBe(RELYING_PARTY_NAME);
  });

  it('keeps a subdomain, which is a different Relying Party', () => {
    // QA and production are separate RPs on purpose. A credential registered
    // against one does not work against the other, and collapsing them to the
    // registrable domain would silently make QA able to sign into production.
    const qa = relyingParty({ PUBLIC_URL: 'https://qa-redefined-designs.bermudalamb.synology.me' });
    const prod = relyingParty({ PUBLIC_URL: 'https://redefined-designs.bermudalamb.synology.me' });

    expect(qa.id).toBe('qa-redefined-designs.bermudalamb.synology.me');
    expect(prod.id).toBe('redefined-designs.bermudalamb.synology.me');
    expect(qa.id).not.toBe(prod.id);
  });

  it('strips the port, which is not part of an RP ID', () => {
    // An RP ID of "example.com:8443" matches nothing, and the failure is a
    // credential that cannot be used rather than an error at registration.
    const rp = relyingParty({ PUBLIC_URL: 'https://example.com:8443' });

    expect(rp.id).toBe('example.com');
    expect(rp.origins).toEqual(['https://example.com:8443']);
  });

  it('strips a path and a trailing slash from the origin', () => {
    const rp = relyingParty({ PUBLIC_URL: 'https://example.com/shop/' });

    expect(rp.id).toBe('example.com');
    // The browser reports an origin, never a path, so a stored path would never
    // match what arrives.
    expect(rp.origins).toEqual(['https://example.com']);
  });

  it.each(['', '   ', undefined])('falls back to localhost when PUBLIC_URL is %p', (value) => {
    // envValidation requires PUBLIC_URL only when SMTP is configured, so a local
    // setup that cannot send mail legitimately has none.
    const rp = relyingParty(value === undefined ? {} : { PUBLIC_URL: value });

    expect(rp.id).toBe('localhost');
    // Both local origins, because the app is served from Vite during dev and
    // from Express once built, and they differ only by port.
    expect(rp.origins).toEqual(['http://localhost:5173', 'http://localhost:3000']);
  });

  it('refuses a PUBLIC_URL that is not a URL rather than guessing', () => {
    // Guessing here would bind every passkey to something nobody chose, and the
    // binding is permanent.
    expect(() => relyingParty({ PUBLIC_URL: 'redefined-designs.com' })).toThrow(
      /Relying Party ID cannot be derived/
    );
  });

  it('reads the environment on each call rather than at import', () => {
    // Captured at import, this would hold whatever the first suite to require
    // the module happened to have set.
    expect(relyingParty({ PUBLIC_URL: 'https://one.example' }).id).toBe('one.example');
    expect(relyingParty({ PUBLIC_URL: 'https://two.example' }).id).toBe('two.example');
  });
});