fix

apps/api/src/common/oidc-forwarded-proto.spec.ts

@@ -0,0 +1,52 @@
+import { normalizeOidcForwardedProto } from './oidc-forwarded-proto';
+
+describe('normalizeOidcForwardedProto', () => {
+  it('corrects an OIDC request when the trusted public issuer uses HTTPS', () => {
+    const request = {
+      method: 'GET',
+      originalUrl: '/oidc/auth?client_id=test',
+      headers: { 'x-forwarded-proto': 'http' },
+    };
+
+    const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', true);
+
+    expect(result).toEqual({ corrected: true, path: '/oidc/auth', previousProto: 'http' });
+    expect(request.headers['x-forwarded-proto']).toBe('https');
+  });
+
+  it('also corrects interaction routes used to finish login and consent', () => {
+    const request = { originalUrl: '/interaction/uid/login', headers: {} as Record<string, string> };
+
+    const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', true);
+
+    expect(result.corrected).toBe(true);
+    expect(request.headers['x-forwarded-proto']).toBe('https');
+  });
+
+  it('does not alter unrelated API requests', () => {
+    const request = { originalUrl: '/api/account', headers: { 'x-forwarded-proto': 'http' } };
+
+    const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', true);
+
+    expect(result.corrected).toBe(false);
+    expect(request.headers['x-forwarded-proto']).toBe('http');
+  });
+
+  it('does not override the protocol when proxy trust is disabled', () => {
+    const request = { originalUrl: '/oidc/auth', headers: { 'x-forwarded-proto': 'http' } };
+
+    const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', false);
+
+    expect(result.corrected).toBe(false);
+    expect(request.headers['x-forwarded-proto']).toBe('http');
+  });
+
+  it('does not force HTTPS for a configured HTTP issuer', () => {
+    const request = { originalUrl: '/oidc/auth', headers: { 'x-forwarded-proto': 'http' } };
+
+    const result = normalizeOidcForwardedProto(request, 'http://localhost:8080', true);
+
+    expect(result.corrected).toBe(false);
+    expect(request.headers['x-forwarded-proto']).toBe('http');
+  });
+});