John
2e14873f2d
Track application source and tests; exclude local env, user workspaces, and runtime data via .gitignore. Co-authored-by: Cursor <cursoragent@cursor.com>
24 lines
850 B
JavaScript
24 lines
850 B
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import {
|
|
loadWechatOAuthConfig,
|
|
sanitizeWechatReturnTo,
|
|
} from './wechat-oauth.mjs';
|
|
|
|
test('loadWechatOAuthConfig requires app secret and callback url', () => {
|
|
const config = loadWechatOAuthConfig({
|
|
H5_WECHAT_OAUTH_ENABLED: '1',
|
|
H5_WECHAT_APP_ID: 'wxtest',
|
|
H5_WECHAT_APP_SECRET: 'secret',
|
|
H5_PUBLIC_BASE_URL: 'https://example.com',
|
|
});
|
|
assert.equal(config.enabled, true);
|
|
assert.equal(config.callbackUrl, 'https://example.com/auth/wechat/callback');
|
|
});
|
|
|
|
test('sanitizeWechatReturnTo rejects external urls', () => {
|
|
const req = { get: (name) => (name === 'host' ? 'example.com' : null) };
|
|
assert.equal(sanitizeWechatReturnTo('https://evil.com/phish', req), '/');
|
|
assert.equal(sanitizeWechatReturnTo('/space?page=1', req), '/space?page=1');
|
|
});
|