Function signInThroughIdp

apps/host-selfhost/src/auth/sso.test.ts:208–246

(email: string)

// consent page (pick the account's form) -> callback back into the app.
// Returns the callback response plus the cookies it set.
const signInThroughIdp = async (email: string) => {
  const start = await handler(
    new Request(`${BASE}/api/auth/sign-in/oauth2`, {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({ providerId: "okta", callbackURL: "/" }),
    }),
  );
  expect(start.status).toBe(200);
  const { url } = (await start.json()) as { url: string };
  expect(url.startsWith(idp.url)).toBe(true);
  const stateCookies = start.headers
    .getSetCookie()
    .map((cookie) => cookie.split(";")[0]!)
    .join("; ");

  const consentHtml = await fetch(url).then((r) => r.text());
  const form = [...consentHtml.matchAll(/<form[\s\S]*?<\/form>/gi)]
    .map((m) => m[0])
    .find((f) => f.includes(email));
  expect(form).toBeDefined();
  const action = decodeHtml(form!.match(/\baction=["']([^"']+)["']/i)![1]!);
  const consent = await fetch(action, {
    method: "POST",
    headers: { "content-type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams(formFields(form!)),
    redirect: "manual",
  });
  expect(consent.status).toBe(302);
  const callbackUrl = consent.headers.get("location")!;
  expect(callbackUrl.startsWith(CALLBACK)).toBe(true);

  const callback = await handler(new Request(callbackUrl, { headers: { cookie: stateCookies } }));
  const cookies = callback.headers
    .getSetCookie()
    .map((cookie) => cookie.split(";")[0]!)
    .join("; ");
  return { callback, cookies };
};

test("an allowlisted-domain IdP account signs in and joins the org as a member", async () => {
  const { callback, cookies } = await signInThroughIdp("alice@example.com");