98 lines
3.3 KiB
TypeScript
98 lines
3.3 KiB
TypeScript
/**
|
|
* @jest-environment node
|
|
*/
|
|
|
|
import { NextRequest } from "next/server";
|
|
import { getToken } from "next-auth/jwt";
|
|
|
|
import { GET } from "./route";
|
|
|
|
jest.mock("next-auth/jwt", () => ({
|
|
getToken: jest.fn(),
|
|
}));
|
|
|
|
const getTokenMock = getToken as jest.MockedFunction<typeof getToken>;
|
|
|
|
describe("GET /api/auth/keycloak-logout", () => {
|
|
const originalIssuer = process.env.KEYCLOAK_ISSUER;
|
|
const originalClientId = process.env.KEYCLOAK_CLIENT_ID;
|
|
const originalNextAuthUrl = process.env.NEXTAUTH_URL;
|
|
const originalPostLogoutRedirectUri =
|
|
process.env.KEYCLOAK_POST_LOGOUT_REDIRECT_URI;
|
|
|
|
beforeEach(() => {
|
|
process.env.KEYCLOAK_ISSUER = "https://keycloak.example.com/realms/tjwater";
|
|
process.env.KEYCLOAK_CLIENT_ID = "tjwater";
|
|
process.env.NEXTAUTH_URL = "https://frontend.example.com";
|
|
delete process.env.KEYCLOAK_POST_LOGOUT_REDIRECT_URI;
|
|
getTokenMock.mockReset();
|
|
});
|
|
|
|
afterAll(() => {
|
|
process.env.KEYCLOAK_ISSUER = originalIssuer;
|
|
process.env.KEYCLOAK_CLIENT_ID = originalClientId;
|
|
process.env.NEXTAUTH_URL = originalNextAuthUrl;
|
|
if (originalPostLogoutRedirectUri) {
|
|
process.env.KEYCLOAK_POST_LOGOUT_REDIRECT_URI = originalPostLogoutRedirectUri;
|
|
} else {
|
|
delete process.env.KEYCLOAK_POST_LOGOUT_REDIRECT_URI;
|
|
}
|
|
});
|
|
|
|
it("clears the local session and redirects the browser to Keycloak logout", async () => {
|
|
getTokenMock.mockResolvedValue({
|
|
idToken: "header.payload.signature",
|
|
});
|
|
const request = new NextRequest(
|
|
"https://frontend.example.com/api/auth/keycloak-logout",
|
|
{
|
|
headers: {
|
|
cookie:
|
|
"__Secure-next-auth.session-token.0=first; __Secure-next-auth.session-token.1=second; next-auth.session-token=local",
|
|
},
|
|
},
|
|
);
|
|
|
|
const response = await GET(request);
|
|
const logoutUrl = new URL(response.headers.get("location") ?? "");
|
|
|
|
expect(logoutUrl.origin).toBe("https://keycloak.example.com");
|
|
expect(logoutUrl.pathname).toBe(
|
|
"/realms/tjwater/protocol/openid-connect/logout",
|
|
);
|
|
expect(logoutUrl.searchParams.get("id_token_hint")).toBe(
|
|
"header.payload.signature",
|
|
);
|
|
expect(logoutUrl.searchParams.get("client_id")).toBe("tjwater");
|
|
expect(logoutUrl.searchParams.get("post_logout_redirect_uri")).toBeNull();
|
|
expect(
|
|
response.cookies.get("__Secure-next-auth.session-token.0"),
|
|
).toMatchObject({ value: "", path: "/", secure: true });
|
|
expect(
|
|
response.cookies.get("__Secure-next-auth.session-token.1"),
|
|
).toMatchObject({ value: "", path: "/", secure: true });
|
|
expect(response.cookies.get("next-auth.session-token")).toMatchObject({
|
|
value: "",
|
|
path: "/",
|
|
});
|
|
expect(
|
|
response.cookies.get("next-auth.session-token")?.secure,
|
|
).toBeFalsy();
|
|
});
|
|
|
|
it("ignores a legacy automatic post-logout redirect setting", async () => {
|
|
process.env.KEYCLOAK_POST_LOGOUT_REDIRECT_URI =
|
|
"https://frontend.example.com/login";
|
|
getTokenMock.mockResolvedValue({ idToken: "header.payload.signature" });
|
|
|
|
const response = await GET(
|
|
new NextRequest(
|
|
"https://frontend.example.com/api/auth/keycloak-logout",
|
|
),
|
|
);
|
|
const logoutUrl = new URL(response.headers.get("location") ?? "");
|
|
|
|
expect(logoutUrl.searchParams.get("post_logout_redirect_uri")).toBeNull();
|
|
});
|
|
});
|