1import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
2
3import { hasCloudPublicConfig } from "./publicConfig.ts";
4
5afterEach(() => {
6 vi.unstubAllEnvs();
7 vi.unstubAllGlobals();
8});
9
10describe("hasCloudPublicConfig", () => {
11 it("rejects an insecure relay URL", () => {
12 vi.stubEnv("VITE_CLERK_PUBLISHABLE_KEY", "pk_test_example");
13 vi.stubEnv("VITE_CLERK_JWT_TEMPLATE", "t3-relay");
14 vi.stubEnv("VITE_T3CODE_RELAY_URL", "http://relay.example.test");
15
16 expect(hasCloudPublicConfig()).toBe(false);
17 });
18
19 describe("browser origins", () => {
20 beforeEach(() => {
21 vi.stubEnv("VITE_CLERK_PUBLISHABLE_KEY", `pk_live_${btoa("clerk.example.com$")}`);
22 vi.stubEnv("VITE_CLERK_JWT_TEMPLATE", "t3-relay");
23 vi.stubEnv("VITE_T3CODE_RELAY_URL", "https://relay.example.test");
24 });
25
26 it.each(["https://example.com", "https://nightly.app.example.com:443"])(
27 "enables production auth on the configured root and subdomains: %s",
28 (origin) => {
29 vi.stubGlobal("window", { location: new URL(origin) });
30
31 expect(hasCloudPublicConfig()).toBe(true);
32 },
33 );
34
35 it.each(["http://localhost:3773", "https://machine.example.ts.net"])(
36 "disables production auth on private browser origins: %s",
37 (origin) => {
38 vi.stubGlobal("window", { location: new URL(origin) });
39
40 expect(hasCloudPublicConfig()).toBe(false);
41 },
42 );
43
44 it.each(["http://app.example.com:443", "https://app.example.com:3773"])(
45 "rejects unsupported schemes and ports even on the configured domain: %s",
46 (origin) => {
47 vi.stubGlobal("window", { location: new URL(origin) });
48
49 expect(hasCloudPublicConfig()).toBe(false);
50 },
51 );
52
53 it.each(["https://notexample.com", "https://example.com.evil.test"])(
54 "rejects domain lookalikes: %s",
55 (origin) => {
56 vi.stubGlobal("window", { location: new URL(origin) });
57
58 expect(hasCloudPublicConfig()).toBe(false);
59 },
60 );
61
62 it.each([
63 ["https://tenant.clerk.accounts.dev", true],
64 ["https://other.clerk.accounts.dev", false],
65 ])("keeps a provider hostname scoped to its own instance: %s", (origin, expected) => {
66 vi.stubEnv("VITE_CLERK_PUBLISHABLE_KEY", `pk_live_${btoa("tenant.clerk.accounts.dev$")}`);
67 vi.stubGlobal("window", { location: new URL(origin) });
68
69 expect(hasCloudPublicConfig()).toBe(expected);
70 });
71
72 it("keeps production keys available in the Electron auth shell", () => {
73 vi.stubGlobal("window", { location: new URL("file:///app/index.html"), desktopBridge: {} });
74
75 expect(hasCloudPublicConfig()).toBe(true);
76 });
77 });
78});