frontend/src/auth/errorUtils.test.ts

import { describe, expect, it } from "vitest";
import { getAuthErrorMessage, getCallbackErrorFromUrl, toUserFacingAuthError } from "./errorUtils";

describe("errorUtils", () => {
  it("normalizes invalid state messages for users", () => {
    expect(toUserFacingAuthError("invalid state")).toContain("Retry login");
  });

  it("returns null when callback URL has no auth error params", () => {
    expect(getCallbackErrorFromUrl("https://toolkit.masterstelecom.com/")).toBeNull();
  });

  it("decodes callback error descriptions", () => {
    const out = getCallbackErrorFromUrl(
      "https://toolkit.masterstelecom.com/?error=invalid_request&error_description=Callback%20URL%20mismatch"
    );
    expect(out).toBe("Callback URL mismatch");
  });

  it("handles malformed encoded callback messages safely", () => {
    const out = getCallbackErrorFromUrl(
      "https://toolkit.masterstelecom.com/?error=invalid_request&error_description=%E0%A4%A"
    );
    expect(out).toBeTruthy();
  });

  it("supports auth errors returned in URL hash fragments", () => {
    const out = getCallbackErrorFromUrl(
      "https://toolkit.masterstelecom.com/#error=access_denied&error_description=Client+blocked"
    );
    expect(out).toContain("Client blocked");
  });

  it("normalizes raw access_denied and invalid_request tokens", () => {
    expect(toUserFacingAuthError("access_denied")).toContain("Access denied by Auth0 policy");
    expect(toUserFacingAuthError("invalid_request")).toContain("Authentication request is invalid");
  });

  it("surfaces explicit guidance for the removed masters-toolkit-api audience", () => {
    expect(toUserFacingAuthError("Service not found: https://masters-toolkit-api/")).toContain(
      "Remove `VITE_AUTH0_AUDIENCE`/`AUTH0_AUDIENCE`"
    );
  });

  it("extracts useful message fields from Auth0 error objects", () => {
    expect(getAuthErrorMessage({ error: "access_denied", error_description: "domain blocked" })).toBe("domain blocked");
    expect(getAuthErrorMessage({ cause: { message: "callback mismatch" } })).toBe("callback mismatch");
  });

  it("redacts sensitive query params and token-like strings", () => {
    const msg = getAuthErrorMessage({
      error_description:
        "invalid_request code=abc123 state=xyz789 Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.aaa.bbb sk-proj-1234567890abcdefghijklmnop",
    });
    expect(msg).toContain("code=[redacted]");
    expect(msg).toContain("state=[redacted]");
    expect(msg).toMatch(/Bearer \[(redacted|redacted-jwt)\]/);
    expect(msg).toContain("[redacted-key]");
  });
});