|
| 1 | +// CL-7508: the sidecar-hosted loopback login service binds exactly the |
| 2 | +// pinned provider ports, surfaces a busy port as the typed |
| 3 | +// `OAuthCallbackPortInUseError`, and never opens a browser sidecar-side. |
| 4 | +import { afterAll, describe, expect, test } from "bun:test"; |
| 5 | +import { createServer, type Server } from "node:http"; |
| 6 | +import { |
| 7 | + CODEX_AUTHORIZE_URL, |
| 8 | + CODEX_REDIRECT_URI, |
| 9 | +} from "@corbits/codex-provider/constants"; |
| 10 | +import { XAI_REDIRECT_URI } from "@corbits/xai-provider"; |
| 11 | +import { OAuthCallbackPortInUseError } from "@corbits/oauth-core"; |
| 12 | +import { createOAuthLoopbackLoginService } from "./oauth-login"; |
| 13 | + |
| 14 | +const occupied: Server[] = []; |
| 15 | +afterAll(() => { |
| 16 | + for (const server of occupied) server.close(); |
| 17 | +}); |
| 18 | + |
| 19 | +/** Occupies a pinned port so a login attempt must fail with the typed |
| 20 | + * port-in-use error. Resolves false when the port was already busy (the |
| 21 | + * assertion we are about to make is then trivially proven by whatever |
| 22 | + * holds the port). */ |
| 23 | +function occupy(port: number): Promise<boolean> { |
| 24 | + return new Promise((resolve) => { |
| 25 | + const server = createServer(); |
| 26 | + server.once("error", () => resolve(false)); |
| 27 | + server.listen(port, "127.0.0.1", () => { |
| 28 | + occupied.push(server); |
| 29 | + resolve(true); |
| 30 | + }); |
| 31 | + }); |
| 32 | +} |
| 33 | + |
| 34 | +function redirectOf(authorizeUrl: string): string { |
| 35 | + return new URL(authorizeUrl).searchParams.get("redirect_uri") ?? ""; |
| 36 | +} |
| 37 | + |
| 38 | +describe("oauth loopback login service", () => { |
| 39 | + test("codex pins localhost:1455 in the authorize URL it returns", async () => { |
| 40 | + const service = createOAuthLoopbackLoginService(); |
| 41 | + const handle = await service.start("codex"); |
| 42 | + try { |
| 43 | + expect(handle.authorizeUrl.startsWith(CODEX_AUTHORIZE_URL)).toBe(true); |
| 44 | + expect(redirectOf(handle.authorizeUrl)).toBe(CODEX_REDIRECT_URI); |
| 45 | + expect(new URL(CODEX_REDIRECT_URI).port).toBe("1455"); |
| 46 | + } finally { |
| 47 | + handle.cancel(); |
| 48 | + } |
| 49 | + }); |
| 50 | + |
| 51 | + test("xai-oauth pins 127.0.0.1:1456 in the authorize URL it returns", async () => { |
| 52 | + const service = createOAuthLoopbackLoginService(); |
| 53 | + const handle = await service.start("xai-oauth"); |
| 54 | + try { |
| 55 | + expect(redirectOf(handle.authorizeUrl)).toBe(XAI_REDIRECT_URI); |
| 56 | + expect(new URL(XAI_REDIRECT_URI).hostname).toBe("127.0.0.1"); |
| 57 | + expect(new URL(XAI_REDIRECT_URI).port).toBe("1456"); |
| 58 | + } finally { |
| 59 | + handle.cancel(); |
| 60 | + } |
| 61 | + }); |
| 62 | + |
| 63 | + test("a bound pinned port surfaces OAuthCallbackPortInUseError, never a fallback port", async () => { |
| 64 | + // The xai pin shares this machine's port space, so holding 1456 forces |
| 65 | + // the bind failure path for whichever login reaches it. |
| 66 | + const held = await occupy(1456); |
| 67 | + if (!held) return; // something else already proves the port is busy |
| 68 | + const service = createOAuthLoopbackLoginService(); |
| 69 | + // The bind happens while the handle is being staged, so `start` itself |
| 70 | + // is what rejects. |
| 71 | + const outcome = await service.start("xai-oauth").then( |
| 72 | + () => "completed", |
| 73 | + (cause: unknown) => cause, |
| 74 | + ); |
| 75 | + expect(outcome).toBeInstanceOf(OAuthCallbackPortInUseError); |
| 76 | + expect((outcome as OAuthCallbackPortInUseError).port).toBe(1456); |
| 77 | + }); |
| 78 | + |
| 79 | + test("a cancelled login frees the pinned port for the next one", async () => { |
| 80 | + const service = createOAuthLoopbackLoginService(); |
| 81 | + const first = await service.start("codex"); |
| 82 | + first.cancel(); |
| 83 | + // If cancel did not close 1455's listener, this rebind would fail with |
| 84 | + // the typed port-in-use error instead of staging a fresh login. |
| 85 | + const second = await service.start("codex"); |
| 86 | + expect(redirectOf(second.authorizeUrl)).toBe(CODEX_REDIRECT_URI); |
| 87 | + second.cancel(); |
| 88 | + }); |
| 89 | +}); |
0 commit comments