Shuki VakninandLinus Rath
f2703bcc27
Accounts whose primary sending identity differs from their login (basic auth registers accountId from the typed login; OAuth from the identity email) were force-re-authed on switch because the guard derived the connected id only from the primary-identity email. Collect every server-confirmed identifier (JMAP Session.username + primary-identity email) and only re-auth when the target matches none. Excludes the constructor username so a real desync still trips. Adds JMAPClient.getSessionUsername().
69 lines
3.0 KiB
TypeScript
69 lines
3.0 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { connectedAccountCandidates } from '../auth-store';
|
|
import type { Identity } from '@/lib/jmap/types';
|
|
|
|
// The account-switch guard force-re-auths only when the connected session
|
|
// matches NONE of its server-confirmed identifiers. accountId is generated
|
|
// from the primary-identity email (OAuth) OR the login username (basic), so
|
|
// the candidate set must cover both: the JMAP Session.username (authenticated
|
|
// login) and the primary sending-identity email.
|
|
|
|
const SERVER = 'https://mail.example.com';
|
|
|
|
const fakeClient = (opts: {
|
|
sessionUsername?: string;
|
|
constructorUsername?: string;
|
|
identities?: Identity[] | Error;
|
|
}) =>
|
|
({
|
|
getSessionUsername: () => opts.sessionUsername,
|
|
getUsername: () => opts.constructorUsername ?? '',
|
|
getIdentities: async () => {
|
|
if (opts.identities instanceof Error) throw opts.identities;
|
|
return opts.identities ?? [];
|
|
},
|
|
}) as never;
|
|
|
|
const id = (over: Partial<Identity> = {}): Identity => ({
|
|
id: 'id-1', name: 'Real User', email: 'real@example.com', mayDelete: true, ...over,
|
|
});
|
|
|
|
describe('connectedAccountCandidates (account-switch guard)', () => {
|
|
it('includes the primary-identity email (OAuth registers by email)', async () => {
|
|
const out = await connectedAccountCandidates(
|
|
fakeClient({ sessionUsername: 'preferred_user', identities: [id()] }), SERVER,
|
|
);
|
|
expect(out).toContain('real@example.com@mail.example.com');
|
|
});
|
|
|
|
it('includes the session login username (basic auth registers by login)', async () => {
|
|
// support@ case: login is the email, but the primary sending identity is a
|
|
// different address. The login must still be accepted.
|
|
const out = await connectedAccountCandidates(
|
|
fakeClient({ sessionUsername: 'support@linux-hosting.co.il', identities: [id({ email: 'alias@elsewhere.com' })] }),
|
|
SERVER,
|
|
);
|
|
expect(out).toContain('support@linux-hosting.co.il@mail.example.com');
|
|
expect(out).toContain('alias@elsewhere.com@mail.example.com');
|
|
});
|
|
|
|
it('excludes the constructor username (cannot mask a desync)', async () => {
|
|
// A desynced slot: client built for support@ but the token resolves to
|
|
// shuki@. Candidates come only from the server (session + identities),
|
|
// never the constructor echo, so support@ is NOT among them.
|
|
const out = await connectedAccountCandidates(
|
|
fakeClient({ sessionUsername: 'shuki@linux-hosting.co.il', constructorUsername: 'support@linux-hosting.co.il', identities: [id({ email: 'shuki@linux-hosting.co.il' })] }),
|
|
SERVER,
|
|
);
|
|
expect(out).not.toContain('support@linux-hosting.co.il@mail.example.com');
|
|
expect(out).toContain('shuki@linux-hosting.co.il@mail.example.com');
|
|
});
|
|
|
|
it('returns empty when nothing can be confirmed (caller must not bounce)', async () => {
|
|
const out = await connectedAccountCandidates(
|
|
fakeClient({ sessionUsername: undefined, identities: new Error('no idents') }), SERVER,
|
|
);
|
|
expect(out).toEqual([]);
|
|
});
|
|
});
|