MailSend/test/ui/auth-next.test.ts

import { describe, expect, it } from 'vitest';

import { nextAuthSuccessState, safeInternalPath } from '../../src/frontend/auth/auth-model.js';

describe('authentication next path', () => {
  it('restores a filtered internal deep link after login', () => {
    expect(nextAuthSuccessState('/api/login', {}, '/activity?status=failed&page=2').redirectTo)
      .toBe('/activity?status=failed&page=2');
  });

  it.each([
    'https://attacker.example/path',
    '//attacker.example/path',
    '/\\attacker.example/path',
    '/login',
    '/api/events',
    'javascript:alert(1)'
  ])('rejects unsafe destination %s', (value) => {
    expect(safeInternalPath(value, '/overview')).toBe('/overview');
  });
});