c8748d1b14
New email/password accounts must verify before signing in. Social login users (Google, Discord) are unaffected. Existing users are grandfathered via an idempotent migration. Adds a /check-email interstitial with a resend button, and a --success CSS token for consistent styling. Closes #343 Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
32 lines
875 B
TypeScript
32 lines
875 B
TypeScript
import { describe, it, expect } from "vitest";
|
|
import { safeRedirectTo } from "../check-email";
|
|
|
|
describe("safeRedirectTo", () => {
|
|
it("returns / for null", () => {
|
|
expect(safeRedirectTo(null)).toBe("/");
|
|
});
|
|
|
|
it("returns / for empty string", () => {
|
|
expect(safeRedirectTo("")).toBe("/");
|
|
});
|
|
|
|
it("allows a root-relative path", () => {
|
|
expect(safeRedirectTo("/dashboard")).toBe("/dashboard");
|
|
});
|
|
|
|
it("allows a nested path", () => {
|
|
expect(safeRedirectTo("/leagues/123/draft/456")).toBe("/leagues/123/draft/456");
|
|
});
|
|
|
|
it("rejects an absolute URL", () => {
|
|
expect(safeRedirectTo("https://evil.com")).toBe("/");
|
|
});
|
|
|
|
it("rejects a protocol-relative URL", () => {
|
|
expect(safeRedirectTo("//evil.com")).toBe("/");
|
|
});
|
|
|
|
it("rejects a path starting with //", () => {
|
|
expect(safeRedirectTo("//not-a-host")).toBe("/");
|
|
});
|
|
});
|