taler-typescript-core

commit 4c93cec5fbdf99ecac1c06a7298bf3d1cbfcb106
parent 9fba8c16c1d94287f36909ec974f555f27e14493
Author: Florian Dold <dold@taler.net>
Date:   Wed, 22 Jul 2026 00:27:59 +0200

wallet: test token domain matching against the merchant

Cover the three cases the existing test does not: a plain domain in
expected_domains/trusted_domains, a wildcard that must only match at a
label boundary, and domain names containing hyphens.

Diffstat:
M
packages/taler-wallet-core/src/tokenSelection.test.ts
 | 
77
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 77 insertions(+), 0 deletions(-)
diff --git a/packages/taler-wallet-core/src/tokenSelection.test.ts b/packages/taler-wallet-core/src/tokenSelection.test.ts
@@ -92,3 +92,80 @@ test("match trusted_domains and expected_domains against merchant", (t) => {
     }) === TokenMerchantVerificationResult.Automatic,
   );
 });
+
+test("a non-wildcard domain only matches that exact host", (t) => {
+  const merchant = "https://evil.com/";
+  const issuer = "https://backend.test.taler.net/";
+
+  assert.strictEqual(
+    verifyTokenMerchant(merchant, issuer, {
+      class: MerchantContractTokenKind.Discount,
+      expected_domains: ["shop.taler.net"],
+    }),
+    TokenMerchantVerificationResult.Unexpected,
+  );
+
+  assert.strictEqual(
+    verifyTokenMerchant(merchant, issuer, {
+      class: MerchantContractTokenKind.Subscription,
+      trusted_domains: ["shop.taler.net"],
+    }),
+    TokenMerchantVerificationResult.Untrusted,
+  );
+
+  assert.strictEqual(
+    verifyTokenMerchant("https://shop.taler.net/", issuer, {
+      class: MerchantContractTokenKind.Discount,
+      expected_domains: ["shop.taler.net"],
+    }),
+    TokenMerchantVerificationResult.Automatic,
+  );
+});
+
+test("a wildcard domain only matches at a label boundary", (t) => {
+  const issuer = "https://backend.test.taler.net/";
+
+  assert.strictEqual(
+    verifyTokenMerchant("https://eviltaler.net/", issuer, {
+      class: MerchantContractTokenKind.Discount,
+      expected_domains: ["*.taler.net"],
+    }),
+    TokenMerchantVerificationResult.Unexpected,
+  );
+
+  assert.strictEqual(
+    verifyTokenMerchant("https://shop.taler.net/", issuer, {
+      class: MerchantContractTokenKind.Discount,
+      expected_domains: ["*.taler.net"],
+    }),
+    TokenMerchantVerificationResult.Automatic,
+  );
+
+  assert.strictEqual(
+    verifyTokenMerchant("https://taler.net/", issuer, {
+      class: MerchantContractTokenKind.Discount,
+      expected_domains: ["*.taler.net"],
+    }),
+    TokenMerchantVerificationResult.Automatic,
+  );
+});
+
+test("domains may contain hyphens", (t) => {
+  const issuer = "https://backend.test.taler.net/";
+
+  assert.strictEqual(
+    verifyTokenMerchant("https://shop.my-shop.com/", issuer, {
+      class: MerchantContractTokenKind.Discount,
+      expected_domains: ["*.my-shop.com"],
+    }),
+    TokenMerchantVerificationResult.Automatic,
+  );
+
+  assert.strictEqual(
+    verifyTokenMerchant("https://other.com/", issuer, {
+      class: MerchantContractTokenKind.Discount,
+      expected_domains: ["*.my-shop.com"],
+    }),
+    TokenMerchantVerificationResult.Unexpected,
+  );
+});