test: add tests for sessionauth validation failure redirection

supertokens · Apr 12, 2024 · f3a42ff · f3a42ff
1 parent 744d04e
commit f3a42ff
Show file tree

Hide file tree

Showing 5 changed files with 140 additions and 3 deletions.
diff --git a/examples/for-tests-react-16/src/App.js b/examples/for-tests-react-16/src/App.js
@@ -57,7 +57,8 @@ export function getApiDomain() {
 export function getWebsiteDomain() {
     const websitePort = process.env.REACT_APP_WEBSITE_PORT || 3031;
     const websiteUrl = process.env.REACT_APP_WEBSITE_URL || `http://localhost:${websitePort}`;
-    return websiteUrl;
+
+    return getQueryParams("websiteDomain") ?? websiteUrl;
 }
 
 /*

diff --git a/examples/for-tests/src/App.js b/examples/for-tests/src/App.js
@@ -54,7 +54,7 @@ export function getApiDomain() {
 export function getWebsiteDomain() {
     const websitePort = process.env.REACT_APP_WEBSITE_PORT || 3031;
     const websiteUrl = process.env.REACT_APP_WEBSITE_URL || `http://localhost:${websitePort}`;
-    return websiteUrl;
+    return getQueryParams("websiteDomain") ?? websiteUrl;
 }
 
 /*

diff --git a/lib/build/index2.js b/lib/build/index2.js
diff --git a/lib/ts/recipe/session/sessionAuth.tsx b/lib/ts/recipe/session/sessionAuth.tsx
@@ -189,6 +189,7 @@ const SessionAuth: React.FC<PropsWithChildren<SessionAuthProps>> = ({ children,
                     if (failureRedirectInfo.redirectPath !== undefined) {
                         if (compareRedirectionURLToCurrentURL(failureRedirectInfo.redirectPath)) {
                             setContext(toSetContext);
+                            return;
                         } else {
                             return await SuperTokens.getInstanceOrThrow().redirectToUrl(
                                 failureRedirectInfo.redirectPath,

diff --git a/test/end-to-end/signin-rrdv6.test.js b/test/end-to-end/signin-rrdv6.test.js
@@ -50,6 +50,7 @@ import {
     waitForText,
     waitForSTElement,
     backendBeforeEach,
+    getInvalidClaimsJSON,
 } from "../helpers";
 import fetch from "isomorphic-fetch";
 import { SOMETHING_WENT_WRONG_ERROR } from "../constants";
@@ -535,6 +536,140 @@ describe("SuperTokens SignIn with react router dom v6", function () {
             assert.deepStrictEqual(redirectUrl, "/dashboard");
         });
 
+        it("Should not redirect to onFailureRedirections result if it's the current url and set the context", async function () {
+            await Promise.all([
+                page.goto(`${TEST_CLIENT_BASE_URL}/auth`),
+                page.waitForNavigation({ waitUntil: "networkidle0" }),
+            ]);
+
+            // Set correct values.
+            await setInputValues(page, [
+                { name: "email", value: "[email protected]" },
+                { name: "password", value: "Str0ngP@ssw0rd" },
+            ]);
+            await Promise.all([
+                submitFormReturnRequestAndResponse(page, SIGN_IN_API),
+                page.waitForNavigation({ waitUntil: "networkidle0" }),
+            ]);
+
+            await page.evaluate(() => {
+                const validator = window.UserRoleClaim.validators.includes("admin");
+                validator.onFailureRedirection = () => window.location.href;
+                window.setClaimValidators([validator]);
+            });
+
+            await page.waitForSelector(".invalidClaims");
+            assert.deepStrictEqual(await getInvalidClaimsJSON(page), [
+                {
+                    id: "st-role",
+                    reason: {
+                        actualValue: [],
+                        expectedToInclude: "admin",
+                        message: "wrong value",
+                    },
+                },
+            ]);
+        });
+
+        it("Should not redirect to onFailureRedirections result if it's the current path and set the context", async function () {
+            await Promise.all([
+                page.goto(
+                    `${TEST_CLIENT_BASE_URL}/auth?redirectToPath=${encodeURIComponent("/dashboard?test=value#asdf")}`
+                ),
+                page.waitForNavigation({ waitUntil: "networkidle0" }),
+            ]);
+
+            // Set correct values.
+            await setInputValues(page, [
+                { name: "email", value: "[email protected]" },
+                { name: "password", value: "Str0ngP@ssw0rd" },
+            ]);
+            await Promise.all([
+                submitFormReturnRequestAndResponse(page, SIGN_IN_API),
+                page.waitForNavigation({ waitUntil: "networkidle0" }),
+            ]);
+
+            await page.evaluate(() => {
+                const validator = window.UserRoleClaim.validators.includes("admin");
+                validator.onFailureRedirection = () => "/dashboard?test=value#asdf";
+                window.setClaimValidators([validator]);
+            });
+
+            await page.waitForSelector(".invalidClaims");
+            assert.deepStrictEqual(await getInvalidClaimsJSON(page), [
+                {
+                    id: "st-role",
+                    reason: {
+                        actualValue: [],
+                        expectedToInclude: "admin",
+                        message: "wrong value",
+                    },
+                },
+            ]);
+        });
+
+        it("Should redirect to onFailureRedirections result if it's on another domain", async function () {
+            await Promise.all([
+                page.goto(`${TEST_CLIENT_BASE_URL}/auth`),
+                page.waitForNavigation({ waitUntil: "networkidle0" }),
+            ]);
+
+            // Set correct values.
+            await setInputValues(page, [
+                { name: "email", value: "[email protected]" },
+                { name: "password", value: "Str0ngP@ssw0rd" },
+            ]);
+            await Promise.all([
+                submitFormReturnRequestAndResponse(page, SIGN_IN_API),
+                page.waitForNavigation({ waitUntil: "networkidle0" }),
+            ]);
+
+            await page.evaluate(() => {
+                const validator = window.UserRoleClaim.validators.includes("admin");
+                validator.onFailureRedirection = () => "https://supertokens.com";
+                window.setClaimValidators([validator]);
+            });
+
+            await page.waitForNavigation({ waitUntil: "networkidle0" });
+
+            let href = await page.evaluate(() => window.location.href);
+            assert.strictEqual(href, "https://supertokens.com/");
+        });
+
+        it("Should redirect to onFailureRedirections result if it's a path and we are not on the websiteDomain", async function () {
+            await Promise.all([
+                page.goto(`${TEST_CLIENT_BASE_URL}/auth`),
+                page.waitForNavigation({ waitUntil: "networkidle0" }),
+            ]);
+
+            // Set correct values.
+            await setInputValues(page, [
+                { name: "email", value: "[email protected]" },
+                { name: "password", value: "Str0ngP@ssw0rd" },
+            ]);
+
+            await Promise.all([
+                submitFormReturnRequestAndResponse(page, SIGN_IN_API),
+                page.waitForNavigation({ waitUntil: "networkidle0" }),
+            ]);
+
+            await Promise.all([
+                page.goto(
+                    `${TEST_CLIENT_BASE_URL}/dashboard?websiteDomain=${encodeURIComponent("https://supertokens.com")}`
+                ),
+                page.waitForNavigation({ waitUntil: "networkidle0" }),
+            ]);
+
+            await page.evaluate(() => {
+                const validator = window.UserRoleClaim.validators.includes("admin");
+                validator.onFailureRedirection = () => "/test";
+                window.setClaimValidators([validator]);
+            });
+            await page.waitForNavigation({ waitUntil: "networkidle0" });
+            let href = await page.evaluate(() => window.location.href);
+            assert.strictEqual(href, "https://supertokens.com/test");
+        });
+
         describe("Successful Sign In with redirect to, with EmailPasswordAuth", async function () {
             it("First sign in", async function () {
                 consoleLogs = await clearBrowserCookiesWithoutAffectingConsole(page, consoleLogs);