pike/glyph Public Public: anyone can read this; nobody can change it.

import { expect, test } from "bun:test";

import { sign, who, whoAtTty } from "./who.ts";

const KEY = "a-key-only-the-forge-holds";

const later = Date.now() + 60_000;

const request = (identity: string, signature: string): Request =>

  new Request("http://app/", {

    headers: { "x-forge-identity": identity, "x-forge-signature": signature },

  });

test("a signed identity is who it says", () => {

  const identity = `u1|alice|admin|${later}`;

  expect(who(request(identity, sign(identity, KEY)), KEY)).toEqual({

    role: "admin",

    id: "u1",

    name: "alice",

  });

});

test("a forged, tampered, expired or unsigned identity is anonymous", () => {

  const identity = `u1|alice|admin|${later}`;

  expect(who(request(identity, sign(identity, "another key")), KEY)).toEqual({

    role: "anon",

  });

  expect(

    who(request(`u1|alice|admin|${later + 1}`, sign(identity, KEY)), KEY),

  ).toEqual({ role: "anon" });

  const expired = `u1|alice|user|${Date.now() - 1}`;

  expect(who(request(expired, sign(expired, KEY)), KEY)).toEqual({

    role: "anon",

  });

  const odd = `u1|alice|owner|${later}`;

  expect(who(request(odd, sign(odd, KEY)), KEY)).toEqual({ role: "anon" });

  expect(who(new Request("http://app/"), KEY)).toEqual({ role: "anon" });

  // No key configured: nothing verifies, whoever signed it.

  expect(who(request(identity, sign(identity, KEY)), "")).toEqual({

    role: "anon",

  });

});

test("the terminal trusts its environment", () => {

  expect(whoAtTty({})).toEqual({ role: "anon" });

  expect(whoAtTty({ FORGE_APP_USER: "alice" })).toEqual({

    role: "user",

    id: "alice",

    name: "alice",

  });

  expect(

    whoAtTty({

      FORGE_APP_USER: "alice",

      FORGE_APP_USER_ID: "u1",

      FORGE_APP_USER_ROLE: "admin",

    }),

  ).toEqual({

    role: "admin",

    id: "u1",

    name: "alice",

  });

});