// node --test javascript/src/oauth/renew-once.test.mjs (skips without Chrome, or when esm.sh is unreachable) // The real BrowserOAuthClient (esm.sh, the pin examples/web/hello uses) in headless Chrome, signed in at a fake // authorization server + PDS (javascript/src/oauth-server/fake.mjs), and two more pages of the same origin (frames: // their own client and memory, the same IndexedDB session and Web Locks). Forced order: page 2's token is refused, // page 1 renews it, and only then does page 2 go on with its refused token: sessionXrpc (renewOnce) must take the // saved one, not refresh again (refresh tokens rotate). The library's own fetchHandler refreshes twice here. import assert from "node:assert/strict"; import { test } from "node:test"; import { browse, CHROME } from "../../../docs/browser.mjs"; import { fakeAtproto } from "../oauth-server/fake.mjs"; const ROOT = new URL("../../../", import.meta.url).pathname; const CLIENT = "https://esm.sh/@atproto/oauth-client-browser@0.5.14"; const online = await fetch(CLIENT, { signal: AbortSignal.timeout(5000) }).then((r) => r.ok, () => false); // "/" (and "/?frame="): a page with its own BrowserOAuthClient; page.holdNextRefusal() holds its next refused // response until released const page = (fake) => ` `; test("pages sharing a BrowserOAuthClient session renew a refused token once (sessionXrpc)", { skip: (!CHROME && "no Chrome") || (!online && `${CLIENT} unreachable`) }, async () => { const fake = await fakeAtproto(); try { await browse( async ({ on, open, evaluate }) => { await open("/"); await evaluate("page.ready"); const back = new Promise((ok) => on("Page.loadEventFired", ok)); await evaluate("page.signIn('alice.test')"); // to the fake's authorize, which approves and redirects back await back; const did = await evaluate("page.ready.then((signedIn) => signedIn?.session.did)"); assert.equal(did, fake.did("alice")); await evaluate(`Promise.all([1, 2].map((n) => new Promise((ok) => { const f = document.createElement("iframe"); f.onload = ok; f.src = "/?frame=" + n; document.body.append(f) })))`); await evaluate("Promise.all([frames[0], frames[1]].map((f) => f.page.ready))"); fake.expireAll(); fake.refreshes = 0; await evaluate(`(window.held = frames[1].page.holdNextRefusal(), window.second = frames[1].page.getSession(${JSON.stringify(did)}), held.reached.then(() => true))`); assert.equal(await evaluate(`frames[0].page.getSession(${JSON.stringify(did)}).then((s) => s.did)`), did); assert.equal(fake.refreshes, 1, "page 1 renewed the refused token"); assert.equal(await evaluate("(held.release(), second.then((s) => s.did))"), did); assert.equal(fake.refreshes, 1, "page 2 used page 1's renewal: one refresh across pages"); }, { root: ROOT, index: page(fake.base) }, ); } finally { await fake.close(); } });