release: WRNexusJS 0.8.0

packages/oauth/test/oauth.test.ts

@@ -8,6 +8,8 @@ import {
   exchangeCode,
   completeAuth,
   randomToken,
+  discoverOidc,
+  validateOidcClaims,
 } from "../src/index.ts";
 
 const CREDS = { clientId: "cid", clientSecret: "secret" };
@@ -93,3 +95,42 @@ test("completeAuth maps the provider profile (custom provider)", async () => {
   expect(profile.id).toBe("99");
   expect(profile.email).toBe("x@acme.test");
 });
+
+test("OIDC discovery enforces issuer and secure required endpoints", async () => {
+  const valid = await discoverOidc("https://issuer.example/", (async () =>
+    Response.json({
+      issuer: "https://issuer.example",
+      authorization_endpoint: "https://issuer.example/authorize",
+      token_endpoint: "https://issuer.example/token",
+      jwks_uri: "https://keys.example/jwks",
+    })) as unknown as typeof fetch);
+  expect(valid.jwks_uri).toBe("https://keys.example/jwks");
+  await expect(
+    discoverOidc("https://issuer.example", (async () =>
+      Response.json({
+        issuer: "https://attacker.example",
+        authorization_endpoint: "https://issuer.example/authorize",
+        token_endpoint: "http://issuer.example/token",
+        jwks_uri: "https://issuer.example/jwks",
+      })) as unknown as typeof fetch),
+  ).rejects.toThrow("issuer mismatch");
+});
+
+test("OIDC claim conformance enforces nonce, subject, and authorized party", () => {
+  const valid = {
+    sub: "user-1",
+    iss: "https://issuer.example",
+    aud: ["client-1", "api"],
+    azp: "client-1",
+    exp: 200,
+    iat: 100,
+    nonce: "nonce-1",
+  };
+  expect(() => validateOidcClaims(valid, { clientId: "client-1", nonce: "nonce-1" })).not.toThrow();
+  expect(() =>
+    validateOidcClaims({ ...valid, nonce: "wrong" }, { clientId: "client-1", nonce: "nonce-1" }),
+  ).toThrow("nonce");
+  expect(() => validateOidcClaims({ ...valid, azp: "other" }, { clientId: "client-1" })).toThrow(
+    "authorized party",
+  );
+});