| 1 | import assert from "node:assert/strict"; |
| 2 | import { test } from "node:test"; |
| 3 | import { RpcError } from "../rpc.js"; |
| 4 | import { BROWSER_ERR_NO_GRANT } from "./errors.js"; |
| 5 | import { GrantRegistry } from "./grants.js"; |
| 6 | |
| 7 | const noGrant = (error: unknown) => error instanceof RpcError && error.code === BROWSER_ERR_NO_GRANT; |
| 8 | |
| 9 | test("grants are verified against the task and the service generation", () => { |
| 10 | let generation = "g-1"; |
| 11 | const revoked: string[] = []; |
| 12 | const grants = new GrantRegistry({ generation: () => generation, now: () => 5, onRevoked: (grant) => revoked.push(grant.grantId) }); |
| 13 | assert.throws(() => grants.verify("grant-a"), noGrant); |
| 14 | const grant = grants.install({ grantId: "grant-a", taskId: "task-a", sessionId: "s" }); |
| 15 | assert.deepEqual(grant, { grantId: "grant-a", taskId: "task-a", sessionId: "s", generation: "g-1", createdAt: 5 }); |
| 16 | assert.equal(grants.verify("grant-a").taskId, "task-a"); |
| 17 | assert.equal(grants.verifyTab("grant-a", "task-a").grantId, "grant-a"); |
| 18 | assert.throws(() => grants.verifyTab("grant-a", "task-b"), noGrant); |
| 19 | assert.throws(() => grants.verifyTab("grant-a", undefined), noGrant); |
| 20 | assert.throws(() => grants.install({ grantId: "", taskId: "t", sessionId: "" }), noGrant); |
| 21 | |
| 22 | generation = "g-2"; |
| 23 | assert.throws(() => grants.verify("grant-a"), noGrant); |
| 24 | assert.deepEqual(revoked, ["grant-a"]); |
| 25 | assert.equal(grants.size, 0); |
| 26 | }); |
| 27 | |
| 28 | test("revoke removes the grant and a generation change revokes every grant", () => { |
| 29 | let generation = "g-1"; |
| 30 | const revoked: string[] = []; |
| 31 | const grants = new GrantRegistry({ generation: () => generation, onRevoked: (grant) => revoked.push(grant.grantId) }); |
| 32 | grants.install({ grantId: "a", taskId: "ta", sessionId: "" }); |
| 33 | grants.install({ grantId: "b", taskId: "tb", sessionId: "" }); |
| 34 | assert.equal(grants.revoke("a")?.taskId, "ta"); |
| 35 | assert.equal(grants.revoke("a"), null); |
| 36 | assert.throws(() => grants.verify("a"), noGrant); |
| 37 | grants.observeGeneration("g-1"); |
| 38 | assert.equal(grants.size, 1, "the same generation changes nothing"); |
| 39 | generation = ""; |
| 40 | grants.observeGeneration(""); |
| 41 | assert.equal(grants.size, 0); |
| 42 | assert.deepEqual(revoked, ["a", "b"]); |
| 43 | assert.throws(() => grants.install({ grantId: "c", taskId: "t", sessionId: "" }), noGrant); |
| 44 | }); |
| 45 |