Swadhin Biswas Feature/ai code reviewer (#79) · 8/16/2026
cfd400d
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
/**
* Contract: OAuth provider primitives (WS4-02)
*
* Guards the token/code hashing + access-token issuance used by the
* authorization-code flow.
*/
import { describe, expect, it } from "vitest";
import {
hashClientSecret,
generateClientCredentials,
generateAuthCode,
issueAccessToken,
verifyAccessToken,
OAUTH_SCOPES,
} from "@/lib/oauth-provider";
describe("OAuth provider contract", () => {
it("exposes a stable scope vocabulary", () => {
expect(OAUTH_SCOPES).toContain("user:read");
expect(OAUTH_SCOPES).toContain("repo:read");
expect(OAUTH_SCOPES).toContain("repo:write");
expect(OAUTH_SCOPES).toContain("notifications");
});
it("client credentials are unique and secrets are not stored in plaintext", () => {
const a = generateClientCredentials();
const b = generateClientCredentials();
expect(a.clientId).not.toBe(b.clientId);
expect(a.clientSecret).not.toBe(b.clientSecret);
expect(a.clientSecret.length).toBeGreaterThanOrEqual(32);
const hash = hashClientSecret(a.clientSecret);
expect(hash).not.toContain(a.clientSecret);
expect(hash).toMatch(/^[0-9a-f]{64}$/);
expect(hashClientSecret(a.clientSecret)).toBe(hash); // deterministic
expect(hashClientSecret(a.clientSecret)).not.toBe(hashClientSecret(b.clientSecret));
});
it("authorization codes are high-entropy and unique", () => {
const a = generateAuthCode();
const b = generateAuthCode();
expect(a).not.toBe(b);
expect(Buffer.byteLength(a)).toBeGreaterThanOrEqual(32);
});
it("issues verifiable access tokens with scope + app claims", async () => {
process.env.JWT_SECRET = "test-secret-for-oauth-contract";
const token = await issueAccessToken({
userId: "user-1",
appId: "app-1",
scopes: ["repo:read"],
});
expect(token.split(".")).toHaveLength(3);
const payload = await verifyAccessToken(token);
expect(payload).not.toBeNull();
expect(payload!.userId).toBe("user-1");
expect(payload!.appId).toBe("app-1");
expect(payload!.scopes).toEqual(["repo:read"]);
});
it("rejects tampered or foreign tokens", async () => {
process.env.JWT_SECRET = "test-secret-for-oauth-contract";
const token = await issueAccessToken({
userId: "user-2",
appId: "app-2",
scopes: [],
});
// Tamper with the payload
const [h, p, s] = token.split(".");
const tamperedPayload = Buffer.from(
JSON.stringify({ sub: "attacker", type: "oauth_access", appId: "app-2", scopes: [] }),
).toString("base64url");
const tampered = `${h}.${tamperedPayload}.${s}`;
expect(await verifyAccessToken(tampered)).toBeNull();
// Non-oauth JWT should be rejected
expect(await verifyAccessToken("not-a-jwt")).toBeNull();
});
});