66import { afterEach , beforeEach , describe , expect , it , vi } from 'vitest'
77import { createMockRequest , setupAuthApiMocks } from '@/app/api/__test-utils__/utils'
88
9+ vi . mock ( '@/lib/core/utils/urls' , ( ) => ( {
10+ getBaseUrl : vi . fn ( ( ) => 'https://app.example.com' ) ,
11+ } ) )
12+
913describe ( 'Forget Password API Route' , ( ) => {
1014 beforeEach ( ( ) => {
1115 vi . resetModules ( )
@@ -15,7 +19,7 @@ describe('Forget Password API Route', () => {
1519 vi . clearAllMocks ( )
1620 } )
1721
18- it ( 'should send password reset email successfully' , async ( ) => {
22+ it ( 'should send password reset email successfully with same-origin redirectTo ' , async ( ) => {
1923 setupAuthApiMocks ( {
2024 operations : {
2125 forgetPassword : { success : true } ,
@@ -24,7 +28,7 @@ describe('Forget Password API Route', () => {
2428
2529 const req = createMockRequest ( 'POST' , {
263027- redirectTo : 'https://example.com/reset' ,
31+ redirectTo : 'https://app. example.com/reset' ,
2832 } )
2933
3034 const { POST } = await import ( '@/app/api/auth/forget-password/route' )
@@ -39,12 +43,36 @@ describe('Forget Password API Route', () => {
3943 expect ( auth . auth . api . forgetPassword ) . toHaveBeenCalledWith ( {
4044 body : {
414542- redirectTo : 'https://example.com/reset' ,
46+ redirectTo : 'https://app. example.com/reset' ,
4347 } ,
4448 method : 'POST' ,
4549 } )
4650 } )
4751
52+ it ( 'should reject external redirectTo URL' , async ( ) => {
53+ setupAuthApiMocks ( {
54+ operations : {
55+ forgetPassword : { success : true } ,
56+ } ,
57+ } )
58+
59+ const req = createMockRequest ( 'POST' , {
60+ 61+ redirectTo : 'https://evil.com/phishing' ,
62+ } )
63+
64+ const { POST } = await import ( '@/app/api/auth/forget-password/route' )
65+
66+ const response = await POST ( req )
67+ const data = await response . json ( )
68+
69+ expect ( response . status ) . toBe ( 400 )
70+ expect ( data . message ) . toBe ( 'Redirect URL must be a valid same-origin URL' )
71+
72+ const auth = await import ( '@/lib/auth' )
73+ expect ( auth . auth . api . forgetPassword ) . not . toHaveBeenCalled ( )
74+ } )
75+
4876 it ( 'should send password reset email without redirectTo' , async ( ) => {
4977 setupAuthApiMocks ( {
5078 operations : {
0 commit comments