passkeys-firefox-relay.test.ts

1// @vitest-environment jsdom23import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";45const mockSendMessage = vi.fn().mockResolvedValue({ ok: true });67vi.stubGlobal("chrome", {8  runtime: {9    id: "ext-id",10    sendMessage: mockSendMessage,11  },12});1314beforeAll(async () => {15  await import("./passkeys-firefox-relay");16});1718async function fire(payload: unknown, source: Window | null = window) {19  window.dispatchEvent(20    new MessageEvent("message", {21      data: { type: "PEACH_PASSKEY_REQUEST", id: "x", payload },22      source,23    })24  );25  await new Promise((resolve) => setTimeout(resolve, 10));26}2728describe("Firefox passkey relay allowlist", () => {29  beforeEach(() => {30    mockSendMessage.mockClear();31  });3233  const allowed = [34    "PASSKEY_CREATE",35    "PASSKEY_GET",36    "PASSKEY_HAS_CREDENTIALS",37    "INITIATE_FIREFOX_PASSKEY_CREATE",38    "COMPLETE_FIREFOX_PASSKEY_CREATE",39    "PASSKEY_OFFER_DECLINE",40    "GET_PASSKEY_OFFER_DECLINED",41    "GET_PASSKEY_FOR_DOMAIN",42    "PASSKEY_AUTH_RESPONSE",43  ];4445  const blocked = [46    "GET_ENTRIES",47    "GET_RECOVERY_WORDS",48    "DESTROY_VAULT",49    "GET_DERIVED_KEY",50    "ADD_ENTRY",51    "UPDATE_ENTRY",52    "DELETE_ENTRY",53    "CLEAR_VAULT_ENTRIES",54    "RESTORE_FROM_CODEX",55    "CHANGE_PASSWORD",56    "RECOVER_WITH_WORDS",57    "SETUP_DURESS",58    "PAIRING_COMPLETED",59    "ACTIVATE_LICENSE",60    "TRIGGER_SYNC",61    "GET_IDENTITIES",62    "SEARCH_VAULT",63    "GET_ENTRY_FOR_FILL",64    "TEST_LOCAL_WEBSOCKET",65    "TEST_WS_LOCAL",66    "",67    "TOTALLY_MADE_UP",68  ];6970  for (const type of allowed) {71    it(`forwards allowed message: ${type}`, async () => {72      await fire({ type });73      expect(mockSendMessage).toHaveBeenCalledWith({ type });74    });75  }7677  for (const type of blocked) {78    it(`blocks message: ${type || "(empty)"}`, async () => {79      await fire({ type });80      expect(mockSendMessage).not.toHaveBeenCalled();81    });82  }8384  it("blocks null payload", async () => {85    await fire(null);86    expect(mockSendMessage).not.toHaveBeenCalled();87  });8889  it("blocks empty payload object", async () => {90    await fire({});91    expect(mockSendMessage).not.toHaveBeenCalled();92  });9394  it("blocks cross-frame messages", async () => {95    await fire({ type: "PASSKEY_GET" }, null);96    expect(mockSendMessage).not.toHaveBeenCalled();97  });9899  it("does not post a response for blocked messages", async () => {100    const spy = vi.spyOn(window, "postMessage");101    await fire({ type: "GET_ENTRIES" });102    expect(spy).not.toHaveBeenCalled();103    spy.mockRestore();104  });105});