feat: secure React dashboard cutover

tests/private-media-auth.test.ts

@@ -0,0 +1,48 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import express from 'express';
+import type { AddressInfo } from 'node:net';
+import { afterEach, describe, expect, it } from 'vitest';
+import { createDashboardAuth } from '../src/web/auth.js';
+
+const servers: Array<ReturnType<express.Express['listen']>> = [];
+const temporaryDirectories: string[] = [];
+
+afterEach(async () => {
+  await Promise.all(
+    servers.splice(0).map(
+      (server) => new Promise<void>((resolve) => server.close(() => resolve())),
+    ),
+  );
+  for (const directory of temporaryDirectories.splice(0)) {
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+});
+
+describe('private media authentication', () => {
+  it('rejects anonymous media requests and permits an authenticated session', async () => {
+    const mediaDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'redditbot-media-auth-'));
+    temporaryDirectories.push(mediaDirectory);
+    fs.writeFileSync(path.join(mediaDirectory, 'private.txt'), 'private-media');
+
+    const app = express();
+    app.use(createDashboardAuth('create01'));
+    app.use('/media', express.static(mediaDirectory));
+
+    const server = app.listen(0);
+    servers.push(server);
+    await new Promise<void>((resolve) => server.once('listening', resolve));
+    const { port } = server.address() as AddressInfo;
+    const url = `http://127.0.0.1:${port}/media/private.txt`;
+
+    const anonymousResponse = await fetch(url);
+    const authenticatedResponse = await fetch(url, {
+      headers: { Authorization: 'Bearer create01' },
+    });
+
+    expect(anonymousResponse.status).toBe(401);
+    expect(authenticatedResponse.status).toBe(200);
+    expect(await authenticatedResponse.text()).toBe('private-media');
+  });
+});