index.test.ts

// Dependencies
import { createCookieSessionStorage } from "@remix-run/server-runtime";

// Internals
import { Auth0Strategy } from "../src";

describe(Auth0Strategy, () => {
  let verify = jest.fn();
  // You will probably need a sessionStorage to test the strategy.
  let sessionStorage = createCookieSessionStorage({
    cookie: { secrets: ["s3cr3t"] },
  });

  beforeEach(() => {
    jest.resetAllMocks();
  });

  test("should allow changing the scope", async () => {
    let strategy = new Auth0Strategy(
      {
        domain: "test.fake.auth0.com",
        clientID: "CLIENT_ID",
        clientSecret: "CLIENT_SECRET",
        callbackURL: "https://example.app/callback",
        scope: "custom",
      },
      verify
    );

    let request = new Request("https://example.app/auth/auth0");

    try {
      await strategy.authenticate(request, sessionStorage, {
        sessionKey: "user",
      });
    } catch (error) {
      if (!(error instanceof Response)) throw error;
      let location = error.headers.get("Location");

      if (!location) throw new Error("No redirect header");

      let redirectUrl = new URL(location);

      expect(redirectUrl.searchParams.get("scope")).toBe("custom");
    }
  });

  test("should have the scope `openid profile email` as default", async () => {
    let strategy = new Auth0Strategy(
      {
        domain: "test.fake.auth0.com",
        clientID: "CLIENT_ID",
        clientSecret: "CLIENT_SECRET",
        callbackURL: "https://example.app/callback",
      },
      verify
    );

    let request = new Request("https://example.app/auth/auth0");

    try {
      await strategy.authenticate(request, sessionStorage, {
        sessionKey: "user",
      });
    } catch (error) {
      if (!(error instanceof Response)) throw error;
      let location = error.headers.get("Location");

      if (!location) throw new Error("No redirect header");

      let redirectUrl = new URL(location);

      expect(redirectUrl.searchParams.get("scope")).toBe(
        "openid profile email"
      );
    }
  });

  test("should correctly format the authorization URL", async () => {
    let strategy = new Auth0Strategy(
      {
        domain: "test.fake.auth0.com",
        clientID: "CLIENT_ID",
        clientSecret: "CLIENT_SECRET",
        callbackURL: "https://example.app/callback",
      },
      verify
    );

    let request = new Request("https://example.app/auth/auth0");

    try {
      await strategy.authenticate(request, sessionStorage, {
        sessionKey: "user",
      });
    } catch (error) {
      if (!(error instanceof Response)) throw error;

      let location = error.headers.get("Location");

      if (!location) throw new Error("No redirect header");

      let redirectUrl = new URL(location);

      expect(redirectUrl.hostname).toBe("test.fake.auth0.com");
      expect(redirectUrl.pathname).toBe("/authorize");
    }
  });

  test("should allow changing the audience", async () => {
    let strategy = new Auth0Strategy(
      {
        domain: "test.fake.auth0.com",
        clientID: "CLIENT_ID",
        clientSecret: "CLIENT_SECRET",
        callbackURL: "https://example.app/callback",
        scope: "custom",
        audience: "SOME_AUDIENCE",
      },
      verify
    );

    let request = new Request("https://example.app/auth/auth0");

    try {
      await strategy.authenticate(request, sessionStorage, {
        sessionKey: "user",
      });
    } catch (error) {
      if (!(error instanceof Response)) throw error;
      let location = error.headers.get("Location");

      if (!location) throw new Error("No redirect header");

      let redirectUrl = new URL(location);

      expect(redirectUrl.searchParams.get("audience")).toBe("SOME_AUDIENCE");
    }
  });

  test("should redirect to logout URL with appropriate arguments and destroy session", async () => {
    let strategy = new Auth0Strategy(
      {
        domain: "test.fake.auth0.com",
        clientID: "CLIENT_ID",
        clientSecret: "CLIENT_SECRET",
        callbackURL: "https://example.app/callback",
      },
      verify
    );

    let request = new Request("https://example.app/auth/auth0");

    try {
      await strategy.logout(request, sessionStorage, {
        redirectTo: "/login",
      });
    } catch (error) {
      if (!(error instanceof Response)) throw error;

      let location = error.headers.get("Location");

      if (!location) throw new Error("No redirect header");

      let redirectUrl = new URL(location);

      expect(redirectUrl.hostname).toBe("test.fake.auth0.com");
      expect(redirectUrl.pathname).toBe("/v2/logout");
      expect(redirectUrl.searchParams.get("returnTo")).toBe("/login");
      expect(redirectUrl.searchParams.get("client_id")).toBe("CLIENT_ID");

      let session = await sessionStorage.getSession();
      expect(error.headers.get("Set-Cookie")).toBe(
        await sessionStorage.destroySession(session)
      );
    }
  });
});