@@ -1,6 +1,23 @@
1+import { createServer } from "node:net";
12import { describe, expect, it } from "vitest";
23import * as providerAuthRuntime from "./provider-auth-runtime.js";
345+async function getFreePort(): Promise<number> {
6+return await new Promise((resolve, reject) => {
7+const server = createServer();
8+server.once("error", reject);
9+server.listen(0, "127.0.0.1", () => {
10+const address = server.address();
11+if (!address || typeof address === "string") {
12+server.close(() => reject(new Error("Failed to allocate a local port")));
13+return;
14+}
15+const { port } = address;
16+server.close((err) => (err ? reject(err) : resolve(port)));
17+});
18+});
19+}
20+421describe("plugin-sdk provider-auth-runtime", () => {
522it("exports the runtime-ready auth helper", () => {
623expect(providerAuthRuntime.getRuntimeAuthForModel).toBeTypeOf("function");
@@ -25,4 +42,42 @@ describe("plugin-sdk provider-auth-runtime", () => {
2542error: "Paste the full redirect URL, not just the code.",
2643});
2744});
45+46+it("allows browser IdP pages to probe the localhost callback with CORS", async () => {
47+const port = await getFreePort();
48+const callback = providerAuthRuntime.waitForLocalOAuthCallback({
49+expectedState: "state-1",
50+timeoutMs: 5_000,
51+ port,
52+callbackPath: "/callback",
53+redirectUri: `http://127.0.0.1:${port}/callback`,
54+hostname: "127.0.0.1",
55+successTitle: "OAuth complete",
56+});
57+58+const preflight = await fetch(`http://127.0.0.1:${port}/callback`, {
59+method: "OPTIONS",
60+headers: {
61+Origin: "https://auth.x.ai",
62+"Access-Control-Request-Method": "GET",
63+"Access-Control-Request-Headers": "content-type",
64+"Access-Control-Request-Private-Network": "true",
65+},
66+});
67+68+expect(preflight.status).toBe(204);
69+expect(preflight.headers.get("access-control-allow-origin")).toBe("https://auth.x.ai");
70+expect(preflight.headers.get("access-control-allow-methods")).toContain("GET");
71+expect(preflight.headers.get("access-control-allow-private-network")).toBe("true");
72+73+const response = await fetch(`http://127.0.0.1:${port}/callback?code=code-1&state=state-1`, {
74+headers: {
75+Origin: "https://auth.x.ai",
76+},
77+});
78+79+expect(response.status).toBe(200);
80+expect(response.headers.get("access-control-allow-origin")).toBe("https://auth.x.ai");
81+await expect(callback).resolves.toEqual({ code: "code-1", state: "state-1" });
82+});
2883});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。