Function callback_server_rejects_wrong_origin

crates/openshell-cli/src/auth.rs:590–633

()

    #[tokio::test]
    async fn callback_server_rejects_wrong_origin() {
        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = listener.local_addr().unwrap();
        let (tx, rx) = oneshot::channel();

        tokio::spawn(run_callback_server(
            listener,
            tx,
            "ABC-1234".to_string(),
            TEST_GATEWAY.to_string(),
        ));

        let mut stream = tokio::net::TcpStream::connect(addr).await.unwrap();
        let body = r#"{"token":"jwt","code":"ABC-1234"}"#;
        let request = format!(
            "POST /callback HTTP/1.1\r\n\
             Host: 127.0.0.1\r\n\
             Origin: https://evil.example.com\r\n\
             Content-Type: application/json\r\n\
             Content-Length: {}\r\n\r\n\
             {}",
            body.len(),
            body,
        );
        stream.write_all(request.as_bytes()).await.unwrap();

        let mut buf = vec![0u8; 4096];
        let n = stream.read(&mut buf).await.unwrap();
        let response = String::from_utf8_lossy(&buf[..n]);
        assert!(
            response.contains("403 Forbidden"),
            "wrong origin should return 403:\n{response}"
        );
        assert!(
            response.contains("origin not allowed"),
            "should explain the error:\n{response}"
        );

        // Token channel should not receive a value.
        assert!(
            rx.await.is_err(),
            "token channel should not receive a value with wrong origin"
        );
    }

    #[tokio::test]
    async fn callback_server_rejects_missing_origin() {