Jakob WennbergandClaude Opus 4.8
d704714eef
A failed email-verification link redirected to /login?error=auth_error with no flow context, so the login page framed every callback failure as a broken password-reset link and pushed new users into a reset form for an account that was never confirmed. The callback now forwards a coarse flow hint (recovery vs signup); the login page renders confirmation copy without the reset CTA for the signup case. The new copy names the likely cause (link opened in a different browser than signup, or a one-time token consumed by a mail scanner) instead of only "expired or already used". Silent-team creation is also wrapped in try/catch so a transient insert failure cannot turn an otherwise-successful first-time confirmation into a 500. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
88 lines
2.9 KiB
TypeScript
88 lines
2.9 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
|
import { NextRequest } from 'next/server'
|
|
|
|
const verifyOtp = vi.fn()
|
|
const exchangeCodeForSession = vi.fn()
|
|
|
|
vi.mock('@supabase/ssr', () => ({
|
|
createServerClient: vi.fn(() => ({
|
|
auth: {
|
|
verifyOtp,
|
|
exchangeCodeForSession,
|
|
getUser: vi.fn().mockResolvedValue({ data: { user: { id: 'user-1' } } }),
|
|
mfa: {
|
|
getAuthenticatorAssuranceLevel: vi.fn().mockResolvedValue({ data: null }),
|
|
listFactors: vi.fn().mockResolvedValue({ data: null }),
|
|
},
|
|
},
|
|
from: vi.fn(),
|
|
rpc: vi.fn(),
|
|
})),
|
|
}))
|
|
|
|
vi.mock('@/lib/auth/invite-tokens', () => ({
|
|
hashInviteToken: vi.fn(),
|
|
}))
|
|
|
|
import { GET } from '../route'
|
|
|
|
describe('GET /auth/callback: recovery flow', () => {
|
|
beforeEach(() => {
|
|
vi.clearAllMocks()
|
|
})
|
|
|
|
it('redirects to /reset-password after a successful recovery OTP (token-hash flow)', async () => {
|
|
verifyOtp.mockResolvedValue({ error: null })
|
|
|
|
const request = new NextRequest(
|
|
'http://localhost:3000/auth/callback?token_hash=abc&type=recovery&next=/reset-password'
|
|
)
|
|
const response = await GET(request)
|
|
|
|
expect(response.status).toBe(307)
|
|
expect(response.headers.get('location')).toBe('http://localhost:3000/reset-password')
|
|
expect(verifyOtp).toHaveBeenCalledWith({ token_hash: 'abc', type: 'recovery' })
|
|
})
|
|
|
|
it('redirects to /reset-password after a successful PKCE exchange when next=/reset-password (no type param)', async () => {
|
|
exchangeCodeForSession.mockResolvedValue({ error: null })
|
|
|
|
const request = new NextRequest(
|
|
'http://localhost:3000/auth/callback?code=xyz&next=/reset-password'
|
|
)
|
|
const response = await GET(request)
|
|
|
|
expect(response.status).toBe(307)
|
|
expect(response.headers.get('location')).toBe('http://localhost:3000/reset-password')
|
|
expect(exchangeCodeForSession).toHaveBeenCalledWith('xyz')
|
|
})
|
|
|
|
it('tags a failed recovery link with flow=recovery so the login page shows reset copy', async () => {
|
|
verifyOtp.mockResolvedValue({ error: { message: 'Token has expired or is invalid' } })
|
|
|
|
const request = new NextRequest(
|
|
'http://localhost:3000/auth/callback?token_hash=expired&type=recovery&next=/reset-password'
|
|
)
|
|
const response = await GET(request)
|
|
|
|
expect(response.status).toBe(307)
|
|
expect(response.headers.get('location')).toBe(
|
|
'http://localhost:3000/login?error=auth_error&flow=recovery'
|
|
)
|
|
})
|
|
|
|
it('tags a failed signup confirmation (PKCE code, no type/next) with flow=signup', async () => {
|
|
exchangeCodeForSession.mockResolvedValue({
|
|
error: { message: 'code verifier missing' },
|
|
})
|
|
|
|
const request = new NextRequest('http://localhost:3000/auth/callback?code=xyz')
|
|
const response = await GET(request)
|
|
|
|
expect(response.status).toBe(307)
|
|
expect(response.headers.get('location')).toBe(
|
|
'http://localhost:3000/login?error=auth_error&flow=signup'
|
|
)
|
|
})
|
|
})
|