Something went wrong. Try again.
Monorepo for Tangled forked from tangled.org/core
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195import { describe, expect, it, vi } from "vitest";import type { OAuthUserAgent } from "@atcute/oauth-browser-client";import { provisionDelegate, CREATE_DELEGATE_NSID, GATE_CREATE_DELEGATE_NSID, LIST_DELEGATES_NSID} from "#lib/api/delegation.ts";import metadata from "#lib/oauth-client-metadata.ts";import type { Fetch } from "#lib/fetch.ts";
const makeAgent = () => { const handle = vi.fn<(path: string, init: RequestInit) => Promise<Response>>(async () => Response.json({ token: "service-jwt" }) ); return { handle, agent: { sub: "did:plc:alice", handle } as unknown as OAuthUserAgent };};const account = { did: "did:plc:org", handle: "org.example", controllerDid: "did:plc:alice" };
describe("delegate provisioning", () => { it("mints one method-bound service auth on the user's PDS for the create call", async () => { const { agent, handle } = makeAgent(); const fetch = vi.fn<Fetch>(async () => Response.json(account)); await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example/", serviceDid: "did:web:tranquil.example", fetch }) ).resolves.toEqual(account); const params = new URL(String(handle.mock.calls[0][0]), "https://pds.example").searchParams; expect(params.get("aud")).toBe("did:web:tranquil.example"); expect(params.get("lxm")).toBe(CREATE_DELEGATE_NSID); // Tranquil enforces the delegate cap itself, so no listing token is minted. expect(handle).toHaveBeenCalledTimes(1); expect(String(fetch.mock.calls[0][0])).toBe( `https://gate.example/xrpc/${GATE_CREATE_DELEGATE_NSID}` ); expect(fetch.mock.calls[0][1]).toMatchObject({ method: "POST", headers: { authorization: "Bearer service-jwt" }, body: JSON.stringify({ handle: "org.example" }) }); }); it("allows the advertised DID to differ from a forwarded URL port", async () => { const { agent, handle } = makeAgent(); await provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example:8443", serviceDid: "did:web:tranquil.example", fetch: vi.fn<Fetch>(async () => Response.json(account)) }); expect( new URL(String(handle.mock.calls[0][0]), "https://pds.example").searchParams.get("aud") ).toBe("did:web:tranquil.example"); }); it.each([ [ "VerifiedEmailRequired", 403, "Verify an email address in Settings → Emails before creating an organization." ], [ "UpstreamUnavailable", 502, "Organization creation is temporarily unavailable. Try again in a few minutes." ], ["HandleNotAvailable", 400, "This organization name is taken. Choose another one."], ["InvalidHandle", 400, "This organization name isn't allowed. Choose another one."] ])("explains %s", async (error, status, message) => { const { agent } = makeAgent(); await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch: vi.fn(async () => Response.json({ error, message: "Handle already taken" }, { status }) ) }) ).rejects.toThrow(message); }); it("falls back to a plain sentence when an unknown error has no message", async () => { const { agent } = makeAgent(); const error = provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch: vi.fn(async () => Response.json({ error: "RateLimitExceeded" }, { status: 429 })) }); await expect(error).rejects.toThrow("Unable to create the organization. Try again."); await expect(error).rejects.not.toThrow(/unspecified description/); }); it.each([ [401, "Sign in again to grant Tangled permission to create organizations."], [403, "Sign in again to grant Tangled permission to create organizations."], [500, "Unable to confirm your account with your PDS. Try again."] ])("explains a %i from the user's PDS while minting service auth", async (status, message) => { const { agent, handle } = makeAgent(); handle.mockResolvedValue(Response.json({ error: "Whatever" }, { status })); await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch: vi.fn() }) ).rejects.toThrow(message); }); it("shows Tranquil's reason for InvalidDelegation, which is not only the delegate cap", async () => { const { agent } = makeAgent(); const message = "Invite-only registration requires an existing account on this PDS"; await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch: vi.fn(async () => Response.json({ error: "InvalidDelegation", message }, { status: 400 }) ) }) ).rejects.toThrow(message); }); it("does not request a token when the sidecar is not configured", async () => { const { agent, handle } = makeAgent(); await expect(provisionDelegate(agent, "org.example", { serviceUrl: "" })).rejects.toThrow( "Organization creation isn't set up on this server." ); expect(handle).not.toHaveBeenCalled(); }); it("rejects an unexpected controller", async () => { const { agent } = makeAgent(); await expect( provisionDelegate(agent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch: vi.fn(async () => Response.json({ ...account, controllerDid: "did:plc:other" }) ) }) ).rejects.toThrow(/different account than the one you chose/); }); it("requests the permission needed to mint delegation service auth", () => { expect(metadata.scope.split(" ")).toContain(`rpc:${CREATE_DELEGATE_NSID}?aud=*`); expect(metadata.scope.split(" ")).toContain(`rpc:${LIST_DELEGATES_NSID}?aud=*`); });});
it("asks older sessions to reauthorize before any account is created", async () => { const handle = vi.fn(async () => Response.json({ error: "InsufficientScope", message: "missing scope" }, { status: 403 }) ); const fetch = vi.fn<Fetch>(); await expect( provisionDelegate( { handle, sub: "did:plc:alice" } as unknown as OAuthUserAgent, "org.example", { serviceUrl: "https://gate.example", serviceDid: "did:web:tranquil.example", fetch } ) ).rejects.toThrow(/Sign in again/); expect(fetch).not.toHaveBeenCalled();});
describe("controlled organization accounts", () => { it("lists on Tranquil with method-bound auth from the controller's PDS", async () => { const { listDelegatedAccounts } = await import("./delegation"); const { agent, handle } = makeAgent(); const accounts = [ { did: "did:plc:org", handle: "org.example", grantedScopes: "atproto repo:*", grantedAt: "2026-09-09T00:00:00Z" } ]; const fetch = vi.fn<Fetch>(async () => Response.json({ accounts })); await expect( listDelegatedAccounts(agent, "did:web:tranquil.example", fetch) ).resolves.toEqual(accounts); const params = new URL(String(handle.mock.calls[0][0]), "https://pds.example").searchParams; expect(params.get("aud")).toBe("did:web:tranquil.example"); expect(params.get("lxm")).toBe(LIST_DELEGATES_NSID); expect(String(fetch.mock.calls[0][0])).toBe( "https://tranquil.example/xrpc/_delegation.listControlledAccounts" ); expect(fetch.mock.calls[0][1]).toEqual({ headers: { authorization: "Bearer service-jwt" } }); }); it("reports a failed listing instead of treating it as no organizations", async () => { const { listDelegatedAccounts } = await import("./delegation"); const { agent } = makeAgent(); await expect( listDelegatedAccounts(agent, "did:web:tranquil.example", async () => Response.json({ error: "InvalidToken" }, { status: 401 }) ) ).rejects.toThrow(); });});