Initial

server/test/entra.test.mjs

@@ -0,0 +1,19 @@
+import './setup.mjs';
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { load } from './setup.mjs';
+
+const { isEntraLoginConfigured, signState, verifyState } = await load('../services/entraService.js');
+
+test('Entra login is disabled when not configured', () => {
+  // The test environment leaves ENTRA_* unset, so login must not be offered.
+  assert.equal(isEntraLoginConfigured(), false);
+});
+
+test('signed state round-trips and rejects tampering', () => {
+  const state = signState({ nonce: 42 });
+  const decoded = verifyState(state);
+  assert.equal(decoded.purpose, 'entra-state');
+  assert.throws(() => verifyState(state + 'tampered'));
+  assert.throws(() => verifyState('not-a-token'));
+});