1import { describe, it, expect } from "vitest";2import { callbackOrigin, callbackOrigins } from "../../src/push-policy.ts";34describe("callback origins", () => {5 it("accepts HTTPS public DNS origins and never broadens a path into a policy origin", () => {6 expect(callbackOrigin("https://push.example.com/token?q=secret")).toBe("https://push.example.com");7 expect(callbackOrigins(["https://push.example.com/", "https://push.example.com"])).toEqual(["https://push.example.com"]);8 expect(callbackOrigins(["https://push.example.com/token"])).toBeNull();9 expect(callbackOrigins([])).toEqual([]);10 expect(callbackOrigins(Array(17).fill("https://push.example.com"))).toBeNull();11 });1213 it("rejects local targets, credentials, redirects disguised as origins and other protocols", () => {14 for (const url of ["http://push.example.com", "https://127.0.0.1", "https://2130706433", "https://0x7f000001", "https://[::1]", "https://localhost", "https://service.local", "https://service.internal", "https://host.test", "https://user:secret@push.example.com", "https://push.example.com:8443", "https://push.example.com/#secret", "file:///etc/passwd", "https://push.example.com.", "https://*.example.com"]) expect(callbackOrigin(url), url).toBe("");15 });16});