vh/homepage
1
0
Fork 0
mirror of https://github.com/gethomepage/homepage.git synced 2026-09-27 14:31:17 -07:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

Fix: remove debug logging from nextauth

Browse Source
This commit is contained in:
shamoon
2026-07-13 09:49:45 -07:00
parent b0749e95d2
commit 126d4ac341
2 changed files with 63 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/__tests__/pages/api/auth/[...nextauth].test.js
+55 -1
View File
@@ -1,19 +1,29 @@
import { beforeEach, describe, expect, it, vi } from "vitest";
const { nextAuthMock } = vi.hoisted(() => ({
const { debugMock, errorMock, nextAuthMock, warnMock } = vi.hoisted(() => ({
debugMock: vi.fn(),
errorMock: vi.fn(),
nextAuthMock: vi.fn((options) => ({ options })),
warnMock: vi.fn(),
}));
vi.mock("next-auth", () => ({
default: nextAuthMock,
}));
vi.mock("utils/logger", () => ({
default: vi.fn(() => ({ debug: debugMock, error: errorMock, warn: warnMock })),
}));
describe("pages/api/auth/[...nextauth]", () => {
const originalEnv = process.env;
beforeEach(() => {
vi.resetModules();
debugMock.mockClear();
errorMock.mockClear();
nextAuthMock.mockClear();
warnMock.mockClear();
process.env = { ...originalEnv };
delete process.env.NEXTAUTH_SECRET;
delete process.env.NEXTAUTH_URL;
@@ -27,6 +37,50 @@ describe("pages/api/auth/[...nextauth]", () => {
expect(mod.default.options.pages?.signIn).toBe("/auth/signin");
});
it("does not enable NextAuth's raw debug logger", async () => {
const mod = await import("pages/api/auth/[...nextauth]");
expect(mod.default.options).not.toHaveProperty("debug");
});
it("routes sanitized NextAuth logs through the Homepage logger", async () => {
const mod = await import("pages/api/auth/[...nextauth]");
const sensitiveMetadata = {
clientSecret: "sensitive-client-secret",
access_token: "sensitive-access-token",
id_token: "sensitive-id-token",
};
mod.default.options.logger.error("OAUTH_CALLBACK_ERROR", sensitiveMetadata);
mod.default.options.logger.warn("NEXTAUTH_URL", sensitiveMetadata);
mod.default.options.logger.debug("OAUTH_CALLBACK_RESPONSE", sensitiveMetadata);
expect(errorMock).toHaveBeenCalledWith("%s", "OAUTH_CALLBACK_ERROR");
expect(warnMock).toHaveBeenCalledWith("%s", "NEXTAUTH_URL");
expect(debugMock).toHaveBeenCalledWith("%s", "OAUTH_CALLBACK_RESPONSE");
expect(JSON.stringify([...errorMock.mock.calls, ...warnMock.mock.calls, ...debugMock.mock.calls])).not.toContain(
"sensitive",
);
});
it("logs only sanitized authentication lifecycle events", async () => {
const mod = await import("pages/api/auth/[...nextauth]");
await mod.default.options.events.signIn({
account: {
provider: "homepage-oidc",
access_token: "sensitive-access-token",
id_token: "sensitive-id-token",
},
user: { email: "sensitive@example.com" },
});
await mod.default.options.events.signOut({ token: { sub: "sensitive-user-id" } });
expect(debugMock).toHaveBeenNthCalledWith(1, "Sign in via provider '%s'", "homepage-oidc");
expect(debugMock).toHaveBeenNthCalledWith(2, "Sign out");
expect(JSON.stringify(debugMock.mock.calls)).not.toContain("sensitive");
});
it("maps HOMEPAGE_AUTH_SECRET and HOMEPAGE_EXTERNAL_URL to NextAuth envs", async () => {
process.env.HOMEPAGE_AUTH_SECRET = "secret";
process.env.HOMEPAGE_EXTERNAL_URL = "https://homepage.example";