hikmettan/ihaleist
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: clear consumed Telegram challenges after link changes

Browse Source
This commit is contained in:
hikmettan
2026-09-06 14:53:35 +03:00
parent 283bfe5990
commit 37fb7b0366
6 changed files with 43 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/telegram-link.test.mjs
+6 -6
View File
@@ -15,14 +15,14 @@ test('server challenge belongs to its account, expires, rotates and is consumed
let time=1000000;const linker=createTelegramLinker(store,()=>time),email='link@example.test';
const first=linker.issue(email);assert.match(first.kod,/^[a-f0-9]{48}$/);
assert.ok(!JSON.stringify(store.getData(email,'telegram')).includes(first.kod));
await assert.rejects(linker.link('other@example.test',first.kod,async()=>found),{status:400});
await assert.rejects(linker.link('other@example.test',first.kod,async()=>found),{status:400,kod:'TELEGRAM_CHALLENGE_INVALID'});
const second=linker.issue(email);assert.notEqual(second.kod,first.kod);
await assert.rejects(linker.link(email,first.kod,async()=>found),{status:400});
await assert.rejects(linker.link(email,first.kod,async()=>found),{status:400,kod:'TELEGRAM_CHALLENGE_INVALID'});
time=second.expiresAt;
await assert.rejects(linker.link(email,second.kod,async()=>found),{status:400});
await assert.rejects(linker.link(email,second.kod,async()=>found),{status:400,kod:'TELEGRAM_CHALLENGE_INVALID'});
const current=linker.issue(email);
assert.deepEqual(await linker.link(email,current.kod,async()=>found),found);
await assert.rejects(linker.link(email,current.kod,async()=>found),{status:400});
await assert.rejects(linker.link(email,current.kod,async()=>found),{status:400,kod:'TELEGRAM_CHALLENGE_INVALID'});
assert.equal(store.getData(email,'telegram').chatId,'123');
assert.throws(()=>linker.issue(email),{status:409});
});
@@ -30,10 +30,10 @@ test('server challenge belongs to its account, expires, rotates and is consumed
test('disconnect or expiration during provider lookup cannot restore a removed link',async()=>{
let time=1000000;const linker=createTelegramLinker(store,()=>time),email='disconnect@example.test';
const challenge=linker.issue(email);
await assert.rejects(linker.link(email,challenge.kod,async()=>{store.setData(email,'telegram',null);return found;}),{status:400});
await assert.rejects(linker.link(email,challenge.kod,async()=>{store.setData(email,'telegram',null);return found;}),{status:400,kod:'TELEGRAM_CHALLENGE_INVALID'});
assert.equal(store.getData(email,'telegram'),null);
const next=linker.issue(email);
await assert.rejects(linker.link(email,next.kod,async()=>{time=next.expiresAt;return found;}),{status:400});
await assert.rejects(linker.link(email,next.kod,async()=>{time=next.expiresAt;return found;}),{status:400,kod:'TELEGRAM_CHALLENGE_INVALID'});
});
test('matching accepts only a fresh exact code from a private non-bot sender',async()=>{