fix(auth): bound OIDC initiation and transport

2026-08-17 07:03:19 +02:00
parent 8573500121
commit bdabecbb63
15 changed files with 747 additions and 111 deletions
@@ -0,0 +1,41 @@
+import { createFileAuthSessionStore } from "../../src/auth/session-store.js";
+
+const root = process.env.THT_TEST_SESSION_ROOT;
+const attempts = Number(process.env.THT_TEST_OIDC_ATTEMPTS);
+const now = new Date(process.env.THT_TEST_OIDC_NOW ?? "invalid");
+const capacity = Number(process.env.THT_TEST_OIDC_CAPACITY);
+if (!root || !Number.isSafeInteger(attempts) || attempts < 1 || Number.isNaN(now.getTime())
+  || !Number.isSafeInteger(capacity) || capacity < 1) process.exit(2);
+
+const store = createFileAuthSessionStore(root, undefined, { oidcStateCapacity: capacity });
+process.send?.("ready");
+process.once("message", async (message) => {
+  if (message !== "create") process.exit(3);
+  let created = 0;
+  try {
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+      try {
+        await store.createOidcState({
+          nonce: `n${String(process.pid).padStart(10, "0")}${String(attempt).padStart(32, "0")}`,
+          codeVerifier: `v${String(process.pid).padStart(10, "0")}${String(attempt).padStart(32, "0")}`,
+          returnTo: "/",
+          authConfigRevision: "a".repeat(64),
+          issuer: "https://issuer.example.test",
+          browserTransactionDigest: "b".repeat(64),
+        }, now);
+        created += 1;
+      } catch (error) {
+        if (!(error instanceof Error) || error.message !== "auth_oidc_state_capacity") throw error;
+      }
+    }
+    process.send?.({ created });
+    process.exit(0);
+  } catch (error) {
+    process.send?.({
+      created,
+      failed: true,
+      error: error instanceof Error ? error.message : "non-error failure",
+    });
+    process.exit(4);
+  }
+});