32 lines
1.0 KiB
TypeScript
32 lines
1.0 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { extractOidcRoles } from "../src/index";
|
|
|
|
function unsignedToken(payload: Record<string, unknown>) {
|
|
return `header.${Buffer.from(JSON.stringify(payload)).toString("base64url")}.signature`;
|
|
}
|
|
|
|
describe("OIDC role extraction", () => {
|
|
it("combines realm and configured-client roles from Keycloak tokens", () => {
|
|
const roles = extractOidcRoles({
|
|
clientId: "minecraft-account-manager-admin",
|
|
profile: { groups: ["support"] },
|
|
accessToken: unsignedToken({
|
|
realm_access: { roles: ["minecraft-account-manager-admin"] },
|
|
resource_access: {
|
|
"minecraft-account-manager-admin": { roles: ["settings-editor"] },
|
|
},
|
|
}),
|
|
});
|
|
|
|
expect(roles).toEqual([
|
|
"support",
|
|
"minecraft-account-manager-admin",
|
|
"settings-editor",
|
|
]);
|
|
});
|
|
|
|
it("treats malformed token payloads as having no roles", () => {
|
|
expect(extractOidcRoles({ clientId: "admin", accessToken: "invalid" })).toEqual([]);
|
|
});
|
|
});
|